SAP-C02 Design for New Solutions Practice Test 31 — 15 Questions

Question 1

A company is designing a new data processing pipeline that uses AWS Glue to run ETL jobs. The pipeline must process data from multiple sources with varying schemas and load the results into Amazon Redshift. The data must be partitioned by date and encrypted at rest. Which TWO AWS services or features should the company use to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon S3 server-side encryption. Amazon S3 server-side encryption (SSE) is correct because it provides at-rest encryption for data stored in S3, which is the intermediate storage for AWS Glue ETL jobs. This ensures that all data processed by Glue and loaded into Redshift is encrypted at rest, meeting the security requirement without additional application-level changes.

Answer

AWS Database Migration Service (DMS)

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Athena

Question 2

A company is designing a new disaster recovery (DR) strategy for its critical applications. The DR plan must achieve a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 minute. The applications run on Amazon EC2 instances with Amazon EBS volumes. Which THREE actions should the company take to meet these requirements? (Choose three.)

Accepted Answer

Configure Amazon RDS Multi-AZ deployments.. Amazon RDS Multi-AZ deployments provide synchronous replication to a standby instance in a different Availability Zone, enabling automatic failover with an RTO typically under 1-2 minutes and an RPO of effectively zero, which meets the 15-minute RTO and 1-minute RPO requirements for the database tier.

Answer

Use a single Availability Zone for EC2 instances to simplify failover.

Answer

Store backups in Amazon S3 Glacier.

Question 3

A company is designing a new serverless application that uses AWS Lambda, Amazon DynamoDB, and Amazon API Gateway. The application must handle burst traffic and cannot lose any data. The company wants to use a dead-letter queue (DLQ) for failed Lambda invocations. Which TWO services can be used as a DLQ for Lambda? (Choose two.)

Accepted Answer

Amazon SNS. Amazon SNS and Amazon SQS are the two supported destinations for Lambda's dead-letter queue (DLQ) configuration, but only for asynchronous invocations. When a Lambda function is invoked asynchronously and fails after the configured number of retries, the event can be redirected to an SNS topic or an SQS queue for later reprocessing or analysis. This ensures no data is lost during burst traffic, as failed events are persisted in the DLQ. Synchronous invocations do not support DLQ.

Answer

Amazon DynamoDB Streams

Answer

Amazon Kinesis Data Streams

Answer

Amazon Simple Email Service (SES)

Question 4

Refer to the exhibit. A company has an S3 bucket policy that allows GetObject access from two IP ranges (10.0.0.0/16 and 192.168.0.0/16). The policy also denies all S3 actions on the 'confidential/' prefix unless the request comes from the 10.0.0.0/16 range. Which of the following statements is true?

Accepted Answer

Users from 10.0.0.0/16 can access objects in the confidential/ prefix, but users from 192.168.0.0/16 cannot.. The S3 bucket policy includes an explicit Deny statement that blocks all S3 actions on the 'confidential/' prefix unless the request originates from the 10.0.0.0/16 IP range. Since explicit Deny statements override any Allow statements in AWS IAM policy evaluation, users from 192.168.0.0/16 are denied access to the 'confidential/' prefix even though the GetObject Allow statement includes that range. Only users from 10.0.0.0/16 satisfy the condition in the Deny statement and can therefore access objects in the 'confidential/' prefix.

Answer

Users from 192.168.0.0/16 can access objects in the confidential/ prefix.

Answer

Users from 10.0.0.0/16 cannot access objects in the confidential/ prefix.

Answer

The policy has no effect because the Allow and Deny statements cancel each other.

Question 5

Refer to the exhibit. A company uses AWS CloudFormation to deploy an EC2 instance. The template uses a condition to select the instance type based on the environment. The company deploys the stack with the parameter EnvType set to 'prod'. What will be the instance type of the created EC2 instance?

Accepted Answer

t3.large. The condition in the CloudFormation template evaluates to true when EnvType equals 'prod', so the EC2 instance is created with the instance type specified in the condition's true branch, which is t3.large. The template uses a condition like 'If(Equals(EnvType, 'prod'), t3.large, t2.micro)', and since the parameter is set to 'prod', the Fn::If intrinsic function returns 't3.large'.

Answer

The instance type will be determined at runtime.

Answer

The instance will not be created because the condition is false.

Answer

t2.micro

Question 6

A company is designing a new application that will run on Amazon ECS with Fargate. The application consists of three microservices: Service A, Service B, and Service C. Service A receives HTTP requests from an Application Load Balancer and sends messages to an Amazon SQS queue. Service B polls the SQS queue and processes the messages, storing results in Amazon DynamoDB. Service C reads from DynamoDB and sends notifications via Amazon SNS. The company expects variable traffic and wants to minimize costs. During a load test, the team observes that Service B is not scaling fast enough, causing the SQS queue to grow. The team also notices that Service C is idle most of the time. Which solution should the company implement to improve scaling and reduce costs?

Accepted Answer

Configure Service B with a target tracking scaling policy based on the SQS queue backlog and convert Service C to an AWS Lambda function triggered by DynamoDB Streams.. It addresses both scaling and cost issues: Service B's scaling is improved by using a target tracking scaling policy based on the SQS queue backlog (ApproximateNumberOfMessagesVisible), which directly correlates to the work demand, ensuring faster and more precise scaling. Converting Service C to a Lambda function triggered by DynamoDB Streams eliminates idle compute costs from a constantly running Fargate service, as Lambda only runs when new data appears in DynamoDB, reducing costs significantly.

Answer

Use AWS Lambda with Provisioned Concurrency for Service B and keep Service C as a Fargate service.

Answer

Use a step scaling policy for Service B based on CPU utilization and keep Service C as is.

Answer

Increase the number of ECS tasks for Service B manually and use a scheduled scaling policy for Service C.

Question 7

A company is designing a new microservices application on AWS. Each microservice will be deployed as a containerized application using Amazon ECS with Fargate launch type. The company expects variable traffic patterns and needs to ensure that the application can scale automatically based on demand. Which scaling solution should be used?

Accepted Answer

Configure Application Auto Scaling with a target tracking scaling policy based on average CPU utilization.. Amazon ECS with Fargate uses Application Auto Scaling to automatically adjust the desired count of tasks based on demand. A target tracking scaling policy based on average CPU utilization is the correct approach because it allows you to define a target value (e.g., 70% CPU) and Application Auto Scaling will add or remove tasks to maintain that target, matching the variable traffic patterns described.

Answer

Use Amazon EC2 Auto Scaling to add more Fargate tasks.

Answer

Use AWS Auto Scaling Plans with predictive scaling.

Answer

Manually adjust the desired count of tasks in the ECS service based on traffic analysis.

Question 8

A solutions architect is designing a new serverless application using AWS Lambda for business logic, Amazon API Gateway for RESTful APIs, and Amazon DynamoDB for data storage. The application will experience unpredictable traffic spikes. What is the MOST cost-effective way to handle concurrency and scaling?

Accepted Answer

Use Lambda reserved concurrency to set a limit on concurrent executions.. Lambda reserved concurrency sets a hard limit on the number of concurrent executions for a function, preventing runaway scaling and controlling costs during unpredictable traffic spikes. It ensures that the function does not consume more concurrency than allocated, which avoids excessive DynamoDB read/write capacity usage and keeps costs predictable without needing to pre-warm instances.

Answer

Use Lambda provisioned concurrency to pre-warm instances.

Answer

Configure DynamoDB auto scaling to handle traffic spikes.

Answer

Set a usage plan in API Gateway with a throttling limit.

Question 9

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The team wants to decouple the database layer and allow each microservice to own its data. Which design pattern should the team implement?

Accepted Answer

Use a database-per-service pattern with each microservice having its own Amazon DynamoDB table or RDS instance.. The database-per-service pattern ensures each microservice has its own database, promoting loose coupling and independent scaling. Option A is wrong because an event-driven architecture with CQRS is a separate pattern for handling commands and queries, not for database decoupling per service. Option B is wrong because read replicas are used to offload read traffic from a single database, not to provide each microservice its own data store. Option C is wrong because a single RDS instance with multiple schemas still results in a shared database, contradicting the goal of decoupling.

Answer

Implement an event-driven architecture using Amazon SQS and AWS Lambda with CQRS.

Answer

Deploy a read replica of the database for each microservice to offload queries.

Answer

Use a single Amazon RDS instance with multiple schemas for each microservice.

Question 10

A company is designing a new solution to process streaming data from IoT devices. The data must be ingested, processed in real-time, and stored in a data warehouse for analytics. The company expects millions of events per second. Which combination of AWS services should be used?

Accepted Answer

Amazon Kinesis Data Streams for ingestion, Amazon Kinesis Data Analytics for real-time processing, and Amazon S3 as a staging area before loading into Amazon Redshift.. Amazon Kinesis Data Streams can ingest millions of events per second with durable, ordered shards, while Kinesis Data Analytics provides real-time SQL or Apache Flink processing on the stream. Amazon S3 acts as a staging layer before loading into Amazon Redshift via COPY or Redshift Spectrum, enabling scalable analytics without throttling the ingestion pipeline.

Answer

Amazon Kinesis Data Firehose for ingestion and delivery to Amazon S3, then use AWS Glue for ETL into Amazon Redshift.

Answer

Amazon DynamoDB Streams for ingestion, AWS Lambda for processing, and Amazon Redshift for storage.

Answer

Amazon SQS for ingestion, AWS Lambda for processing, and Amazon DynamoDB for storage.

Question 11

A company needs to design a new solution for storing and retrieving user-uploaded images. The images are accessed frequently for the first 30 days and then rarely accessed after that. The company wants to minimize storage costs while maintaining low-latency access for frequently accessed images. Which storage strategy should be used?

Accepted Answer

Store images in Amazon S3 Standard and use lifecycle policies to transition to S3 Standard-IA after 30 days.. Amazon S3 Standard provides low-latency access for frequently accessed images, and S3 lifecycle policies allow automatic transition to S3 Standard-Infrequent Access (Standard-IA) after 30 days, reducing storage costs while maintaining rapid access for the initial period. This strategy directly meets the requirement of minimizing costs without sacrificing performance for the first 30 days.

Answer

Store images in Amazon EBS volumes attached to a web server.

Answer

Store all images in Amazon S3 Glacier Flexible Retrieval.

Answer

Store all images in Amazon S3 Standard.

Question 12

A company is designing a new cloud-native application that will be deployed across multiple AWS Regions for high availability. The application uses Amazon Aurora Global Database for its primary data store. The company needs to ensure that in the event of a regional failure, the secondary region can be promoted to primary with minimal data loss. Which configuration should be used?

Accepted Answer

Use Aurora Global Database with one primary region and one secondary region. Enable managed failover with a Recovery Point Objective (RPO) of 1 second.. Amazon Aurora Global Database is specifically designed for cross-region disaster recovery with a typical RPO of 1 second and RTO of less than 1 minute when managed failover is enabled. It uses a storage-based replication layer that replicates data from the primary to secondary regions with minimal latency, ensuring that in a regional failure, the secondary region can be promoted to primary with very little data loss.

Answer

Use Aurora Serverless v2 with data replication across regions using Database Migration Service (DMS).

Answer

Deploy Aurora Multi-AZ in the primary region and use a secondary region as a warm standby.

Answer

Configure Aurora Cross-Region Read Replicas and use Amazon Route 53 for DNS failover.

Question 13

A company is designing a new solution to securely store and manage secrets for applications running on AWS. The secrets include database credentials, API keys, and OAuth tokens. The solution must automatically rotate secrets and integrate with AWS services like Amazon RDS. Which AWS service should be used?

Accepted Answer

Use AWS Secrets Manager to store secrets and configure automatic rotation.. AWS Secrets Manager is purpose-built for securely storing, managing, and automatically rotating secrets such as database credentials, API keys, and OAuth tokens. It provides native integration with Amazon RDS, enabling automatic rotation of RDS credentials without custom code, which directly meets the requirements for automatic rotation and AWS service integration.

Answer

Store secrets in AWS Systems Manager Parameter Store with a SecureString parameter type.

Answer

Use AWS CloudHSM to store secrets as keys.

Answer

Use AWS Key Management Service (KMS) to store secrets as encrypted data keys.

Question 14

A company is designing a new data lake solution on AWS using Amazon S3 as the storage layer. The data lake will be used by multiple teams for analytics and machine learning. The company needs to enforce fine-grained access control at the object level, enable auditing of data access, and ensure that sensitive data is masked for unauthorized users. Which combination of AWS services should be used?

Accepted Answer

Use AWS Lake Formation for fine-grained access control and auditing, and Amazon S3 Object Lambda to mask data on the fly.. AWS Lake Formation provides fine-grained access control at the column, row, and cell level for data in S3, and it integrates with AWS CloudTrail for auditing data access. Amazon S3 Object Lambda can transform data on the fly, such as masking sensitive fields, before returning it to the requester, meeting the requirement to mask data for unauthorized users.

Answer

Use S3 bucket policies and S3 access logs for auditing.

Answer

Use Amazon Macie to discover sensitive data and apply S3 bucket policies to restrict access.

Answer

Use IAM policies with condition keys and enable AWS CloudTrail for auditing.

Question 15

A company is designing a new container-based application using Amazon EKS. The application requires persistent storage for stateful workloads, such as databases. The storage must be highly available and durable across multiple Availability Zones. Which storage solution should be used?

Accepted Answer

Use Amazon EFS with the EFS CSI driver.. Amazon EFS provides a fully managed, elastic NFS file system that is accessible from multiple Amazon EKS worker nodes across different Availability Zones simultaneously. The EFS CSI driver enables Kubernetes pods to mount EFS as a persistent volume, delivering the required high availability and durability for stateful workloads like databases without single-AZ dependency.

Answer

Use Amazon EBS volumes with the EBS CSI driver.

Answer

Use Amazon FSx for Lustre as a shared file system.

Answer

Use Amazon S3 with the S3 CSI driver.