SAP-C02 Design for New Solutions Practice Test 30 — 15 Questions

Question 1

A company is designing a new application that requires a relational database with high read capacity. The application is read-heavy and requires low latency. Which database configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon RDS with read replicas. Amazon RDS with read replicas is the correct choice because the application is read-heavy and requires low latency. Read replicas offload read traffic from the primary database instance, scaling read capacity and reducing latency for read operations by distributing the load across multiple copies of the data.

Answer

Amazon DynamoDB with DAX

Answer

Amazon RDS with Multi-AZ deployment

Answer

Amazon ElastiCache for Redis

Question 2

A company is designing a new application that requires a relational database with high read capacity. The application is read-heavy and requires low latency. Which database configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Kubernetes Event-Driven Autoscaler (KEDA). Kubernetes Event-Driven Autoscaler (KEDA) is the correct component because it is specifically designed to scale Kubernetes workloads based on external event sources like Amazon SQS queue depth. KEDA acts as a custom metrics adapter that integrates with the Kubernetes Horizontal Pod Autoscaler (HPA), allowing the application to scale pods dynamically based on the number of messages in the SQS queue, which is a custom metric not natively supported by the standard HPA.

Answer

Kubernetes Horizontal Pod Autoscaler (HPA) with Prometheus

Answer

Kubernetes Cluster Autoscaler

Answer

AWS Auto Scaling with target tracking

Question 3

A company is designing a new application that will store and retrieve large files (up to 5 TB). The files must be accessible via HTTPS and must be durable. Which AWS storage service should be used?

Accepted Answer

Amazon S3. Amazon S3 is the correct choice because it supports objects up to 5 TB in size, provides HTTPS access via RESTful API endpoints, and offers 99.999999999% (11 nines) durability by automatically replicating data across multiple Availability Zones. S3 is purpose-built for storing and retrieving large files over the internet with high durability and scalability.

Answer

Amazon EFS

Answer

AWS Storage Gateway

Answer

Amazon EBS

Question 4

A company is designing a new application that requires a relational database with high read capacity. The application is read-heavy and requires low latency. Which database configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network Load Balancer. Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and can distribute incoming traffic across multiple EC2 instances in an Auto Scaling group with extremely low latency and high throughput. It is ideal for applications that require handling millions of requests per second while preserving the source IP address of clients.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 5

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS database. Which THREE steps are required to secure the database access? (Choose THREE.)

Accepted Answer

Place the Lambda function in a VPC with access to the RDS instance. Placing the Lambda function in the same VPC as the RDS instance allows it to communicate over a private IP address, eliminating exposure to the public internet. This is essential for secure database access, as Lambda functions outside the VPC cannot directly connect to RDS instances that are not publicly accessible.

Answer

Store database credentials in the Lambda function code

Answer

Use a public IP address for the RDS instance

Question 6

A company is monitoring a Lambda function named my-function. The function has an alias 'prod' that points to version 1. The above CLI output shows two metrics for the Errors metric. What is the likely reason for two metrics?

Accepted Answer

The function has two versions: $LATEST and version 1. The CLI output shows two metrics for the Errors metric because the function has two versions: $LATEST (the unpublished, mutable version) and version 1 (the published, immutable version). The alias 'prod' points to version 1, but CloudWatch metrics are emitted per version, so both $LATEST and version 1 generate separate error metric streams. This is why two distinct data points appear for the same metric name.

Answer

The function is invoked via two different triggers

Answer

The function is configured with two different reserved concurrency settings

Answer

The function is deployed in two different regions

Question 7

A company deployed the above CloudFormation template. An EC2 instance launched in the PrivateSubnet needs to access the internet for software updates. Which action is required?

Accepted Answer

Add a NAT Gateway in the PublicSubnet and update the PrivateSubnet's route table to point to the NAT Gateway. A NAT Gateway placed in a public subnet with an Internet Gateway attached allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing inbound connections from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. This is the standard AWS pattern for outbound-only internet access from private subnets.

Answer

Create a VPC Peering connection to a public VPC

Answer

Add an Internet Gateway to the VPC and route the private subnet's route table to it

Answer

Modify the PrivateSubnet to assign public IP addresses on launch

Question 8

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web tier, an application tier, and a database tier. The company wants to decouple the tiers to improve scalability and resilience. Which AWS service should the company use to send messages from the web tier to the application tier asynchronously?

Accepted Answer

Amazon SQS. Amazon SQS is the correct choice because it provides a fully managed message queuing service that enables asynchronous communication between decoupled application tiers. The web tier can send messages to an SQS queue, and the application tier can poll and process those messages independently, which improves scalability and resilience by allowing each tier to scale and fail independently.

Answer

Amazon SNS

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 9

A company is designing a new microservices architecture on AWS. Each microservice must store its own data and communicate with other services via RESTful APIs. The company wants to minimize operational overhead. Which data store should the company use for each microservice?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency at any scale, making it ideal for microservices that need to store their own data and communicate via RESTful APIs. It requires no operational overhead for scaling, patching, or replication, and its pay-per-request billing aligns with the unpredictable traffic patterns common in microservices architectures.

Answer

Amazon ElastiCache for Redis

Answer

Amazon Redshift

Answer

Amazon RDS for PostgreSQL

Question 10

A company is designing a new real-time analytics platform that ingests millions of events per second from IoT devices. The events must be processed with low latency (under 100 ms) and stored for replay. The company wants to use managed services. Which combination of AWS services should the company use?

Accepted Answer

Amazon Kinesis Data Streams + AWS Lambda. Amazon Kinesis Data Streams can ingest and buffer millions of events per second with sub-100 ms latency, and AWS Lambda can process each record in near real-time as it arrives in the stream. This combination meets the low-latency requirement and allows events to be replayed from the stream's retention window (up to 365 days with extended retention).

Answer

Amazon S3 + AWS Lambda

Answer

Amazon Kinesis Data Firehose + Amazon Redshift

Answer

Amazon SQS + AWS Lambda

Question 11

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The company wants to secure the API by requiring authentication via a JSON Web Token (JWT). Which service should the company use to manage user authentication and issue JWTs?

Accepted Answer

Amazon Cognito User Pools. Amazon Cognito User Pools is the correct choice because it is a fully managed identity provider that handles user sign-up, sign-in, and issues JSON Web Tokens (JWTs) for authentication. It integrates directly with API Gateway Lambda authorizers to validate JWTs and control access to API endpoints without custom code.

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Security Token Service (STS)

Question 12

A company is designing a new data lake on AWS. The data lake will store raw data in Amazon S3 and use Amazon Athena for ad-hoc queries. The company needs to ensure that only authorized users can query specific partitions based on their department. Which approach should the company use to implement fine-grained access control?

Accepted Answer

Use AWS Lake Formation to define data filters and grant permissions to departments at the partition level.. Using AWS Lake Formation with data filters allows fine-grained access control at the partition level. Option B is incorrect because S3 bucket policies can restrict access to object prefixes but cannot control access at the partition level within Athena queries. Option C is incorrect because Redshift Spectrum is designed for querying data in Amazon Redshift, not Athena. Option D is incorrect because while separate IAM roles can provide access to specific databases or tables, they cannot easily restrict access to specific partitions in Athena without Lake Formation.

Answer

Use S3 bucket policies to restrict access to prefixes corresponding to each department.

Answer

Store each department's data in separate databases and use Amazon Redshift Spectrum to query.

Answer

Create separate IAM roles for each department and attach policies that grant access to specific partitions in Athena.

Question 13

A company is designing a containerized microservices architecture on Amazon ECS. The services must be able to discover each other using DNS names. Which AWS service should the company use for service discovery?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that integrates natively with Amazon ECS. It allows microservices to register their DNS names and health checks, enabling other services to discover them via DNS queries or API calls. This directly supports the requirement for containerized services to find each other using DNS names within an ECS cluster.

Answer

Amazon Route 53 Resolver

Answer

Elastic Load Balancing (ELB)

Answer

Amazon Elastic Container Registry (ECR)

Question 14

A company is designing a new web application that will be accessed by users worldwide. The application will serve static content (HTML, CSS, images) and dynamic API responses. The company wants to minimize latency for all users. Which combination of AWS services should the company use?

Accepted Answer

Amazon CloudFront and Amazon API Gateway. Amazon CloudFront is a global content delivery network (CDN) that serves static content (HTML, CSS, images) from edge locations, minimizing latency. For dynamic API responses, CloudFront can route requests to Amazon API Gateway, which acts as a backend to handle API calls. This combination provides low-latency access worldwide for both static and dynamic content. Option A (Route 53 + S3) is incorrect because Route 53 is DNS only and S3 alone does not provide caching at edge locations. Option C (S3 + CloudFront) is missing a managed API service for dynamic responses; while CloudFront can serve static content from S3, it needs API Gateway or a compute origin for dynamic APIs. Option D (ALB + CloudFront) places CloudFront in front of an ALB, but ALB is regional and does not effectively reduce latency for static assets; additionally, ALB is not optimized for API management like API Gateway.

Answer

Amazon Route 53 and Amazon S3

Answer

Amazon S3 and Amazon CloudFront

Answer

Application Load Balancer (ALB) and Amazon CloudFront

Question 15

A company is designing a new application that requires a relational database with high read capacity. The application is read-heavy and requires low latency. Which database configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a managed service that enables you to create, store, and control encryption keys used to encrypt data at rest and in transit. KMS integrates with other AWS services (e.g., S3, EBS, RDS) and supports envelope encryption, where a customer master key (CMK) encrypts data keys that perform the actual encryption. It also provides automatic key rotation and fine-grained access control via IAM policies and key policies, meeting the requirement for AWS-managed keys.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)