SAP-C02 Design for New Solutions Practice Test 3 — 15 Questions

Question 1

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 1 hour and the recovery point objective (RPO) is 15 minutes. Which combination of steps should the company take to meet these requirements? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon Route 53 health checks to monitor the primary application and configure DNS failover to the secondary Region.. Route 53 health checks can monitor the primary application's endpoint, and DNS failover to a secondary Region enables automatic traffic redirection within minutes, aligning with the 1-hour RTO. This approach provides a simple, stateless failover mechanism without requiring complex routing changes.

Answer

Configure a Multi-AZ deployment for the RDS database in the primary Region.

Answer

Deploy the application on Amazon Aurora Global Database.

Question 2

A company is designing a serverless data processing pipeline using AWS Step Functions, AWS Lambda, and Amazon DynamoDB. The pipeline must process incoming JSON records from an Amazon Kinesis Data Stream. Each record must be processed exactly once and in order. The company expects a throughput of up to 1,000 records per second. Which combination of services and configurations should the company use to meet these requirements? (Choose TWO.)

Accepted Answer

Configure the Kinesis Data Stream with 10 shards.. With a throughput of 1,000 records per second, a Kinesis Data Stream with 10 shards provides the necessary capacity (each shard supports up to 1,000 records/second for ingestion and 2 MB/s for reads). This shard count ensures the stream can handle the peak load without throttling, while maintaining the ordering guarantee within each shard.

Answer

Use DynamoDB Streams to trigger the Lambda function for each record.

Answer

Use an Amazon SQS FIFO queue as the event source for the Lambda function to maintain order.

Answer

Use AWS Step Functions to coordinate processing of records and ensure exactly-once delivery.

Question 3

A company is designing a new application that will be deployed on Amazon ECS with Fargate launch type. The application needs to store configuration data, including database connection strings, that must be encrypted at rest. The company wants to follow best practices for managing secrets. Which solution should the company use?

Accepted Answer

Store the secrets in AWS Secrets Manager and reference them in the ECS task definition.. AWS Secrets Manager is the recommended service for storing sensitive configuration data like database connection strings because it provides built-in encryption at rest using AWS KMS, automatic secret rotation, and fine-grained access control. ECS task definitions can reference Secrets Manager secrets directly using the 'secrets' parameter, which injects the secret value into the container at runtime without exposing it in plaintext. This approach follows AWS best practices for managing secrets by avoiding hard-coded values and leveraging a dedicated secrets management service.

Answer

Store the configuration data in an S3 bucket with server-side encryption (SSE-S3) and download it at container startup.

Answer

Store the secrets in AWS Systems Manager Parameter Store (SecureString) and reference them in the ECS task definition.

Answer

Store the configuration data in environment variables in the ECS task definition.

Question 4

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They want to implement a blue/green deployment strategy with minimal impact on users. Which approach should they use?

Accepted Answer

Create a new target group with the green instances. Modify the ALB listener rule to forward traffic to the new target group.. Blue/green deployment with an ALB is achieved by creating a new target group for the green instances and modifying the ALB listener rule to forward traffic to the new target group. This allows instant traffic shifting with zero downtime, as the ALB can route traffic between target groups without changing the DNS or creating a new ALB. The blue (old) target group remains available for instant rollback if needed.

Answer

Stop all instances, launch new instances with the new version, and update the target group.

Answer

Update the existing target group's instances to the new version, one at a time.

Answer

Create a new ALB and update DNS to point to the new ALB.

Question 5

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application has variable traffic patterns, with high traffic during business hours and low traffic at night. They want to optimize costs while maintaining performance. Which scaling strategy should they implement?

Accepted Answer

Use target tracking scaling with a schedule to increase minimum capacity during business hours.. Combining target tracking scaling with a scheduled action allows the application to dynamically adjust capacity based on actual demand while ensuring a higher baseline during peak business hours. This hybrid approach optimizes costs by scaling down at night and maintains performance by preventing cold starts or lag during traffic spikes, which is ideal for variable patterns on ECS Fargate.

Answer

Use step scaling policies based on memory utilization.

Answer

Use scheduled scaling to increase capacity during business hours.

Answer

Use simple scaling policies based on CPU utilization.

Question 6

A company needs to design a disaster recovery (DR) solution for a critical database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 5 minutes. The primary region is us-east-1. Which solution meets these requirements?

Accepted Answer

Enable Multi-AZ deployment with a DB cluster.. A Multi-AZ DB cluster deployment for Amazon RDS for MySQL provides automatic failover to a standby instance in a different Availability Zone within the same region, achieving an RTO of typically 1–2 minutes and an RPO of effectively zero (synchronous replication). This meets the 15-minute RTO and 5-minute RPO requirements without any manual intervention or cross-region latency.

Answer

Use automated backups with 5-minute retention.

Answer

Take manual snapshots every 5 minutes and copy to another region.

Answer

Create a cross-region read replica in us-west-2.

Question 7

A company wants to design a highly available, stateless web application using Amazon ECS with Fargate. They need to distribute traffic across multiple AWS Regions for low latency. Which approach should they use?

Accepted Answer

Use Amazon Route 53 latency-based routing to direct traffic to an Application Load Balancer in each region.. Amazon Route 53 latency-based routing directs users to the region with the lowest latency, and using an Application Load Balancer (ALB) in each region provides regional traffic distribution and health checks for the stateless ECS Fargate tasks. This combination ensures high availability and low latency across multiple AWS Regions, as the ALB handles HTTP/HTTPS traffic and integrates with ECS service discovery.

Answer

Use a single Network Load Balancer in the primary region with cross-zone load balancing.

Answer

Use Amazon CloudFront with origins in each region.

Answer

Use AWS Global Accelerator with Network Load Balancers in each region.

Question 8

A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)

Accepted Answer

TLS for all data in transit. TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, ensuring confidentiality and integrity between client and server. AWS services like ELB, CloudFront, and API Gateway enforce TLS for all communications, making it the correct choice for securing data in transit.

Answer

AWS Certificate Manager (ACM) for all encryption

Answer

SSL certificates for all connections

Answer

AWS Identity and Access Management (IAM) for data encryption

Question 9

A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)

Accepted Answer

AWS Certificate Manager (ACM). AWS App Mesh provides a service mesh that supports mTLS for encrypting and authenticating service-to-service communication within an ECS Fargate environment. AWS Cloud Map enables service discovery by allowing microservices to register and discover each other via DNS or API calls. AWS Certificate Manager (ACM) is used to provision and manage the X.509 certificates required for mTLS, which are integrated with App Mesh to enforce mutual authentication.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 10

A company is designing a new application on AWS that requires a relational database with read replicas across multiple AWS Regions. The database must have automated failover and a recovery point objective (RPO) of less than 5 seconds. Which database solution should the company choose?

Accepted Answer

Amazon Aurora Global Database. Amazon Aurora Global Database is the correct choice because it is designed for cross-Region replication with a typical RPO of less than 1 second and automated failover from the primary Region to a secondary Region in under 1 minute. This meets the requirement for a relational database with read replicas across multiple Regions and an RPO of less than 5 seconds, as Aurora Global Database uses a dedicated, fast replication channel that minimizes lag.

Answer

Amazon RDS for MySQL with Multi-AZ and cross-Region read replicas

Answer

Amazon RDS for PostgreSQL with cross-Region read replicas and Multi-AZ

Answer

Amazon DynamoDB Global Tables

Question 11

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The Lambda function processes messages from an SQS queue and writes to DynamoDB. The company expects unpredictable traffic spikes and must ensure that messages are not lost. Which configuration should the company use to meet these requirements?

Accepted Answer

Use an SQS queue as a Lambda event source with reserved concurrency on the Lambda function. Using an SQS queue as a Lambda event source with reserved concurrency ensures that messages are not lost during traffic spikes. SQS acts as a durable buffer, and reserved concurrency prevents the Lambda function from being throttled, which would otherwise cause messages to remain in the queue or be sent to a dead-letter queue. This combination guarantees that every message is processed without loss, even under unpredictable load.

Answer

Enable DynamoDB Accelerator (DAX) for the Lambda function

Answer

Provisioned Concurrency on the Lambda function

Answer

Increase the SQS queue visibility timeout and retention period

Question 12

A company is designing a microservices architecture on Amazon ECS with AWS Fargate. The services need to communicate with each other using HTTP APIs. The company wants to minimize operational overhead and enable canary deployments. Which solution should the company use for service discovery and traffic routing?

Accepted Answer

Use AWS App Mesh with Envoy sidecars. AWS App Mesh with Envoy sidecars provides a service mesh that handles service discovery, traffic routing, and canary deployments at the application layer. It integrates natively with ECS Fargate, offloading operational overhead by managing traffic splitting, retries, and observability without modifying application code. This makes it ideal for microservices requiring fine-grained control over HTTP traffic routing.

Answer

Use Amazon API Gateway with VPC Link

Answer

Use an Application Load Balancer with target groups per service

Answer

Use Amazon Route 53 with weighted routing policies

Question 13

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The company wants to reduce operational overhead and achieve high availability. Which database strategy should the company adopt for the microservices?

Accepted Answer

Use a separate Amazon RDS instance for each microservice. A microservices architecture requires database isolation to ensure loose coupling, independent scaling, and fault isolation. Using a separate Amazon RDS instance for each microservice allows each team to manage its own schema, optimize queries independently, and avoid a single point of failure, which aligns with the goal of reducing operational overhead and achieving high availability.

Answer

Use Amazon RDS Proxy with a single database

Answer

Use Amazon DynamoDB for all microservices

Answer

Use a single Amazon RDS instance shared across all microservices

Question 14

A company is designing a data lake on Amazon S3 for analytics. The data is ingested from multiple sources and must be encrypted at rest. The company requires the ability to audit access to the data lake and enforce fine-grained access control based on tags. Which solution should the company choose?

Accepted Answer

Use S3 bucket policies with condition keys for tags. The correct solution uses S3 bucket policies with condition keys based on tags. S3 bucket policies can use the `s3:ExistingObjectTag` condition key to enforce fine-grained access control based on object tags. Encryption at rest is achieved using S3's default encryption (SSE-S3) or other server-side encryption options, which are independent of the access control mechanism. AWS CloudTrail with S3 data events can audit all access requests, providing the required audit trail. This combination meets all requirements: encryption at rest, tag-based fine-grained access control, and auditing.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C) and bucket policies

Answer

Use AWS Lake Formation with column-level permissions

Answer

Use S3 Object Lambda with AWS CloudTrail

Question 15

A company is designing a new application on AWS that requires a highly available and scalable web tier. The web servers must be stateless and scale automatically based on CPU utilization. Which TWO actions should the company take to meet these requirements?

Accepted Answer

Configure an Auto Scaling group with a launch template that includes a user data script to bootstrap the web server. A launch template with user data allows the Auto Scaling group to bootstrap web server software automatically when new instances launch, ensuring they are stateless and ready to serve traffic. Option B is correct because attaching an Application Load Balancer (ALB) distributes incoming traffic across the Auto Scaling group's instances, enabling horizontal scaling and high availability. Together, these actions support stateless web servers that scale based on CPU utilization via Auto Scaling policies.

Answer

Configure lifecycle hooks in the Auto Scaling group to drain connections

Answer

Use a single large EC2 instance (e.g., c5n.18xlarge) to handle all traffic

Answer

Use a Network Load Balancer to distribute traffic to web servers