SAP-C02 Design for New Solutions Practice Test 33 — 15 Questions

Question 1

A company is designing a multi-tier web application that must be fault-tolerant and scalable. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in an Auto Scaling group. The instances run a web server and a backend application. Which TWO steps should be taken to ensure the application can scale without data loss?

Accepted Answer

Store session state in an external data store such as ElastiCache.. Option B is correct because storing session state in an external data store like ElastiCache decouples session data from individual EC2 instances. This ensures that if an instance is terminated or replaced during scaling events, the session data persists and can be served by any other instance in the Auto Scaling group, preventing data loss and maintaining user experience.

Answer

Use instance store volumes for temporary data.

Answer

Use a custom CloudWatch metric to scale based on CPU utilization.

Answer

Use a fixed number of EC2 instances instead of Auto Scaling.

Question 2

A company is deploying a containerized application on Amazon ECS with Fargate. The application needs to be accessible from the internet and must be secured with an AWS WAF. Which TWO steps should be taken to achieve this?

Accepted Answer

Associate the ALB with an AWS WAF web ACL.. Option A is correct because AWS WAF can be associated with an Application Load Balancer (ALB) to filter HTTP/HTTPS traffic at the application layer. This allows you to protect the containerized application from common web exploits like SQL injection or cross-site scripting. Option B is correct because an ALB is required to route internet traffic to the ECS Fargate service and to terminate TLS, which is necessary for WAF to inspect the request payload.

Answer

Use a Network Load Balancer in front of the ECS service.

Answer

Assign public IP addresses to the Fargate tasks.

Answer

Use Amazon CloudFront as a CDN.

Question 3

A company is running a production web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application uses a MySQL database hosted on Amazon RDS with Multi-AZ enabled. Recently, during a traffic spike, some users experienced increased latency and occasional 503 errors. The operations team noticed that the database CPU utilization reached 100% and the number of database connections peaked at the maximum limit. The application team confirmed that the application uses connection pooling on the EC2 instances but the pool size is fixed. Which solution should the solutions architect recommend to prevent recurrence?

Accepted Answer

Implement Amazon RDS Proxy to manage database connections.. Option C is correct because the issue stems from database connections hitting the maximum limit, causing CPU saturation and 503 errors. Amazon RDS Proxy sits between the application and the database, efficiently managing and pooling connections from the EC2 instances, reducing the number of open connections to the RDS instance and preventing connection exhaustion. This allows the existing connection pooling on the EC2 side to scale without overwhelming the database, directly addressing the root cause.

Answer

Add read replicas to offload read queries.

Answer

Increase the DB instance class to a larger size.

Answer

Increase the maximum number of EC2 instances in the Auto Scaling group.

Question 4

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without tight coupling. Which AWS service should they use to decouple the services while providing durable message storage?

Accepted Answer

Amazon SQS. Amazon SQS (Simple Queue Service) is the correct choice because it provides a fully managed message queue that enables asynchronous communication between microservices, decoupling them so that producers and consumers operate independently. SQS offers durable message storage by persisting messages across multiple Availability Zones, ensuring messages are not lost even if a consumer fails. This aligns with the requirement for loose coupling and reliable message delivery.

Answer

Amazon SNS

Answer

Amazon EventBridge

Answer

Amazon Kinesis Data Streams

Question 5

A company is designing a new application that will store sensitive data in Amazon S3. The data must be encrypted at rest using a key that is rotated every 90 days. The company wants to use AWS managed services to minimize operational overhead. Which encryption solution should they choose?

Accepted Answer

SSE-S3. Option A is correct because SSE-S3 uses S3-managed keys that are automatically rotated. Option B is wrong because SSE-KMS requires customer management of key rotation, though it can be automatic with KMS. Option C is wrong because SSE-C requires the customer to manage the keys. Option D is wrong because client-side encryption adds operational overhead.

Answer

SSE-C

Answer

Client-side encryption with AWS KMS

Answer

SSE-KMS with automatic rotation

Question 6

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling approach should they use?

Accepted Answer

Target tracking scaling policies. Option B is correct because target tracking scaling policies automatically adjust capacity based on a target metric. Option A is wrong because simple scaling requires manual intervention for cooldown. Option C is wrong because scheduled scaling is for predictable traffic. Option D is wrong because manual scaling is not automatic.

Answer

Manual scaling

Answer

Scheduled scaling

Answer

Simple scaling policies

Question 7

A company is designing a new data lake on Amazon S3. They need to query the data using standard SQL and expect to run complex queries that scan large datasets. The query performance should be optimized to minimize data scanned. Which service should they use?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless interactive query service that uses standard SQL to analyze data directly in Amazon S3. It is optimized for querying large datasets with a pay-per-query model, and it automatically minimizes data scanned by leveraging features like columnar data formats (Parquet, ORC), partitioning, and compression to reduce the amount of data read per query.

Answer

Amazon Redshift Spectrum

Answer

Amazon EMR

Answer

Amazon QuickSight

Question 8

A company is designing a new multi-region application that requires a global database with low-latency reads and writes. The application must be able to survive a regional outage. Which database solution should they choose?

Accepted Answer

Amazon Aurora Global Database. Option C is correct because Aurora Global Database provides low-latency reads and writes across regions with automatic failover. Option A is wrong because DynamoDB global tables are multi-region but do not support cross-region writes with the same consistency. Option B is wrong because RDS Multi-AZ is single-region. Option D is wrong because ElastiCache is a cache, not a primary database.

Answer

Amazon RDS Multi-AZ

Answer

Amazon ElastiCache for Redis global datastore

Answer

Amazon DynamoDB global tables

Question 9

A company is designing a new serverless application using AWS Lambda. The function must process a file uploaded to S3 and then send a notification to an external API. The external API has a rate limit of 10 requests per second. Which approach should they use to handle throttling?

Accepted Answer

Use Amazon SQS to buffer the requests and set a Lambda reserved concurrency to limit the processing rate. Option D is correct because using SQS as a dead-letter queue with a Lambda reserved concurrency and a throttle can control the rate. Option A is wrong because increasing timeout does not handle rate limiting. Option B is wrong because SNS does not provide rate control. Option C is wrong because Lambda destination on failure alone does not throttle.

Answer

Increase the Lambda function timeout and retry on failure

Answer

Configure a Lambda function destination on failure to reprocess

Answer

Use Amazon SNS to fan out the notification to multiple Lambda functions

Question 10

A company is designing a new cloud-native application that will run on Amazon ECS with Fargate. The application must store logs centrally for analysis. Which TWO services can be used to collect and analyze logs from ECS Fargate tasks?

Accepted Answer

Amazon CloudWatch Logs. Option A and Option C are correct. CloudWatch Logs can be used with the awslogs driver to collect logs. FireLens (using Fluent Bit) can also collect and forward logs. Option B is wrong because Kinesis Data Analytics is for streaming analytics, not log collection. Option D is wrong because S3 is a storage service, not a log analysis service. Option E is wrong because CloudTrail captures API calls, not application logs.

Answer

Amazon S3

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Analytics

Question 11

A company is designing a new disaster recovery solution for a critical application running on Amazon EC2. They need to replicate data across AWS Regions with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. Which THREE actions should they take to meet these objectives?

Accepted Answer

Create a CloudFormation template to provision the infrastructure in the secondary region. Option B is correct because AWS CloudFormation templates enable infrastructure-as-code, allowing rapid and consistent provisioning of the secondary region environment. This automation is essential to meet the 1-hour RTO, as it eliminates manual setup and reduces recovery time to minutes by deploying pre-defined stacks.

Answer

Manually create and copy AMIs to the secondary region weekly

Answer

Configure the EC2 instances in a Multi-AZ Auto Scaling group

Question 12

A company is designing a new VPC for a web application that must be accessible from the internet. The application will run on EC2 instances in private subnets. Which TWO components are required to allow the EC2 instances to access the internet for updates?

Accepted Answer

A route table in the private subnet with a default route pointing to the NAT Gateway. Option A is correct because a route table in the private subnet with a default route (0.0.0.0/0) pointing to a NAT Gateway is required to direct outbound internet traffic from the EC2 instances to the NAT Gateway. The NAT Gateway then forwards this traffic to the Internet Gateway, enabling the instances to download updates while remaining inaccessible from the internet.

Answer

An Internet Gateway attached to the VPC

Answer

VPC Flow Logs

Answer

A virtual private gateway

Question 13

A company is designing a new CI/CD pipeline for a containerized application. They want to automatically build, test, and deploy the application to Amazon EKS. Which THREE AWS services should they use to implement this pipeline?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is correct because it orchestrates the CI/CD workflow by integrating with other AWS services to automate the build, test, and deployment stages. For a containerized application on Amazon EKS, CodePipeline can pull source code from CodeCommit, trigger CodeBuild to build and test the Docker image, and then deploy the image to an EKS cluster using a deployment action or a custom action. This provides a fully managed, continuous delivery pipeline that automates the entire release process.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 14

A developer ran the AWS CLI command shown in the exhibit. The instance has an attached EBS volume with 'DeleteOnTermination' set to false. The instance will be started again soon. What will happen to the EBS volume when the instance is stopped?

Accepted Answer

The EBS volume remains attached to the instance and the data persists.. Option D is correct because stopping an EC2 instance does not affect the attached EBS volumes; they remain attached and their data persists. The 'DeleteOnTermination' attribute only controls behavior when the instance is terminated, not stopped. Since the instance will be started again soon, the volume stays attached with its data intact.

Answer

The EBS volume is detached but the data is preserved.

Answer

The EBS volume is deleted.

Answer

The EBS volume is deleted because the instance is stopped.

Question 15

A security engineer created the S3 bucket policy shown in the exhibit. The policy is intended to allow the role MyAppRole to get objects only if they are encrypted with SSE-S3. However, the role is getting access denied errors when trying to get objects that are encrypted with SSE-S3. What is the most likely cause?

Accepted Answer

The condition key 's3:x-amz-server-side-encryption' checks the request header, not the object's encryption state.. Option A is correct. The s3:x-amz-server-side-encryption condition key is a request header, not a property of the object. SSE-S3 encryption is applied by default, but the condition checks for the request header, which is not present when the object is already encrypted server-side. Option B is wrong because the resource is correct. Option C is wrong because the condition key is valid. Option D is wrong because the role ARN is correctly specified.

Answer

The Principal is incorrect; it should be the role name, not ARN.

Answer

The Resource ARN is incorrect; it should be 'arn:aws:s3:::my-bucket'.

Answer

The condition key is misspelled.