SAP-C02 Design for New Solutions Practice Test 33 — 15 Questions

Question 1

A company is migrating a legacy monolithic application to AWS. The application uses a proprietary binary protocol over TCP. The company wants to modernize the architecture using microservices while minimizing changes to the client. Which approach should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Network Load Balancer with TCP listener and route traffic based on destination port to different target groups.. A Network Load Balancer (NLB) with a TCP listener can forward traffic based on destination port to different target groups, allowing the legacy client using a proprietary binary protocol over TCP to reach distinct microservices without any client-side changes. This preserves the existing TCP connection semantics and binary protocol, which an Application Load Balancer (HTTP/HTTPS only) or API Gateway (HTTP/REST) cannot handle.

Answer

Use AWS Global Accelerator with a TCP listener and endpoint groups for microservices.

Answer

Use an Application Load Balancer with path-based routing to direct traffic to separate microservices.

Answer

Use Amazon API Gateway with a custom authorizer to route requests to AWS Lambda functions.

Question 2

A company is designing a data lake on Amazon S3. The data is ingested from multiple sources and must be encrypted at rest using customer-managed keys. The company also needs to audit all access to the data lake. Which combination of services should be used?

Accepted Answer

Configure S3 bucket encryption with SSE-KMS using a customer-managed CMK. Enable AWS CloudTrail with data events for S3 and KMS.. It uses SSE-KMS with a customer-managed CMK to meet the encryption-at-rest requirement with customer-controlled keys, and enables AWS CloudTrail with data events for both S3 and KMS to audit all access to the data lake. This combination provides granular auditing of every S3 object-level operation (e.g., GetObject, PutObject) and every KMS key usage (e.g., Decrypt, GenerateDataKey), which is essential for compliance and security monitoring.

Answer

Enable S3 bucket encryption with SSE-S3. Enable S3 server access logs.

Answer

Enable S3 default encryption with SSE-S3. Enable Amazon CloudWatch Logs for S3 access logging.

Answer

Use client-side encryption with a customer-managed key. Enable Amazon CloudWatch Logs for S3 access logs.

Question 3

A company is designing a solution to process real-time streaming data from IoT devices. The data must be ingested, processed with sub-second latency, and stored for analytics. Which services should the company use? (Choose TWO.)

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can process streaming data from Amazon Kinesis Data Streams with sub-second latency by subscribing to the stream as an event source. Lambda functions are invoked synchronously with each record, enabling real-time transformations or lightweight analytics before the data is stored.

Answer

Amazon SQS

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Kinesis Data Firehose

Question 4

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by third-party APIs. The company plans to use an Application Load Balancer with EC2 instances. Which two steps should the company take to ensure the ALB has a consistent set of IP addresses? (Choose TWO.)

Accepted Answer

Place a Network Load Balancer with Elastic IP addresses in front of the ALB.. Option B is correct because an Application Load Balancer does not support static IP addresses, but a Network Load Balancer can be assigned Elastic IP addresses per subnet; placing the NLB in front of the ALB gives third-party APIs a fixed set of IPs to whitelist while the NLB forwards traffic to the ALB. Option D is correct because AWS Global Accelerator provides two static anycast IP addresses that front the ALB, so third parties can whitelist those fixed IPs and traffic is routed to the ALB without the ALB itself needing static addresses. Option A is not correct because a NAT Gateway with Elastic IPs only affects outbound traffic from private subnets and does not provide static inbound IPs for an ALB. Option C is not correct because a Route 53 A record resolves to the ALB's DNS name and its dynamic IP addresses, so it does not create a consistent static IP set. Option E is not correct because AWS WAF is a layer 7 filtering service and has no effect on the IP addresses used by the ALB.

Answer

Use a NAT Gateway with Elastic IPs for outbound traffic.

Answer

Use Amazon Route 53 with an A record pointing to the ALB.

Answer

Associate an AWS WAF web ACL with the ALB.

Question 5

A company is designing a new application that will use Amazon S3 to store sensitive customer data. The data must be encrypted at rest and in transit. The company also needs to ensure that only authorized users can access the data. Which three steps should the company take? (Choose THREE.)

Accepted Answer

Enable S3 default encryption with SSE-KMS.. Option A is correct because enabling S3 default encryption with SSE-KMS ensures all objects are encrypted at rest using AWS KMS-managed keys, satisfying the encryption-at-rest requirement for sensitive customer data. Option C is correct because bucket policies that restrict access based on IAM roles enforce least-privilege authorization, ensuring only authorized users can access the data. Option D is correct because a bucket policy denying requests that do not use HTTPS (aws:SecureTransport false) enforces encryption in transit by rejecting unencrypted HTTP access. Option B is not required because SSE-KMS already meets the encryption-at-rest requirement, and client-side encryption is an alternative rather than a necessary step. Option E is incorrect because making the bucket publicly accessible would expose sensitive data and violate the requirement that only authorized users can access it.

Answer

Use client-side encryption with a customer key.

Answer

Make the bucket publicly accessible for ease of access.

Question 6

A company is migrating a legacy monolithic application to AWS. The application uses a proprietary binary protocol over TCP. The company wants to modernize the architecture using microservices while minimizing changes to the client. Which approach should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, elastic NFS file system that supports concurrent read/write access from thousands of EC2 instances across multiple Availability Zones. It is designed for high availability and scalability, automatically growing and shrinking as files are added or removed, making it ideal for a shared file system for user uploads in a migrated monolithic application.

Answer

Amazon FSx for Windows File Server

Answer

Amazon S3 with S3 File Gateway

Answer

Amazon EBS with Multi-Attach enabled

Question 7

A solutions architect is designing a web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application requires that users' session data be stored and made available across all instances. Which solution is MOST cost-effective and scalable?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data. Amazon ElastiCache for Redis provides a fully managed, in-memory data store that is ideal for storing session state externally from the EC2 instances. This decouples session data from the compute layer, allowing any instance to retrieve the same session data regardless of which instance originally handled the request. Redis offers sub-millisecond latency, built-in replication, and automatic failover, making it both highly scalable and cost-effective for session management at scale.

Answer

Store session data on an Amazon EBS volume attached to each instance

Answer

Store session data in an Amazon RDS database

Answer

Enable sticky sessions (session affinity) on the ALB

Question 8

A company is building a microservices architecture on Amazon ECS. Services need to communicate with each other and with external SaaS applications. The architect must ensure that service discovery is dynamic and that traffic to external services is routed through a single egress point for security and monitoring. Which combination of services should the architect use?

Accepted Answer

AWS Cloud Map for service discovery and a NAT gateway for egress. AWS Cloud Map is the correct choice for dynamic service discovery in Amazon ECS because it allows services to register themselves with a logical service name and be discovered via DNS or API calls, which is ideal for microservices that scale and change frequently. A NAT gateway provides a single, controlled egress point for outbound traffic to external SaaS applications, enabling centralized security monitoring and consistent IP address management, unlike an Internet Gateway which would expose instances directly.

Answer

Amazon Route 53 for service discovery and an Application Load Balancer for egress

Answer

AWS Cloud Map for service discovery and an Internet Gateway for egress

Answer

Amazon Route 53 for service discovery and VPC endpoints for egress

Question 9

A company is deploying a containerized application on Amazon EKS. The application needs to access an Amazon RDS database. The security team requires that database credentials be rotated automatically and never stored in plaintext. Which solution should the architect use?

Accepted Answer

Use AWS Secrets Manager to store and rotate credentials, and grant the EKS pod access via an IAM role. AWS Secrets Manager is the correct choice because it natively supports automatic rotation of RDS database credentials via a built-in Lambda rotation function, and it integrates with IAM roles to grant EKS pods secure access without storing secrets in plaintext. By using an IAM role for the pod (via IRSA), the application can retrieve credentials at runtime from Secrets Manager, ensuring compliance with the security team's requirements.

Answer

Use IAM database authentication for RDS and assign an IAM role to the pod

Answer

Hardcode the credentials in the container image and rotate the image regularly

Answer

Store credentials in AWS Systems Manager Parameter Store and grant the EKS pod access via an IAM role

Question 10

A company is building a serverless application using AWS Lambda. The Lambda function needs to process files uploaded to an S3 bucket. The function should be triggered as soon as a new object is created. How should the architect configure this?

Accepted Answer

Configure S3 to send event notifications to the Lambda function directly. Amazon S3 can directly invoke an AWS Lambda function via event notifications when a new object is created. This is the simplest and most direct integration, requiring no intermediate services. S3 publishes an event to Lambda, which then executes the function synchronously, ensuring near-real-time processing of uploaded files.

Answer

Configure S3 to send event notifications to an SNS topic, which triggers the Lambda function

Answer

Configure S3 to send event notifications to an SQS queue, and have the Lambda function poll the queue

Answer

Configure S3 to send event notifications to Amazon CloudWatch Events, which triggers the Lambda function

Question 11

A company is designing a new application that will process messages from an SQS queue. The messages must be processed in real-time with minimal latency, and the processing time per message varies from 100 ms to 5 seconds. The company wants to minimize cost and operational overhead. Which solution should the architect recommend?

Accepted Answer

Use an SQS queue as an event source for an AWS Lambda function. Using an SQS queue as an event source for AWS Lambda enables real-time, low-latency processing of messages without any polling infrastructure to manage. Lambda automatically scales to handle variable processing times (100 ms to 5 seconds) and charges only for compute time used, minimizing both cost and operational overhead. This serverless approach eliminates the need for EC2 instances or Auto Scaling groups, aligning perfectly with the requirements for minimal latency and reduced management effort.

Answer

Use Amazon Kinesis Data Streams and an AWS Lambda function

Answer

Use an SQS queue and an EC2 Auto Scaling group to poll and process messages

Answer

Use SQS to send messages to Amazon SNS, which triggers a Lambda function

Question 12

A company is designing a multi-region active-active application that uses Amazon DynamoDB global tables. The application must be able to handle write conflicts that may occur when the same item is updated in two different regions at the same time. The company needs to ensure that the application uses the most recently written data. What should the architect recommend?

Accepted Answer

Use the default last writer wins conflict resolution. Amazon DynamoDB global tables use a last writer wins (LWW) conflict resolution mechanism based on the timestamp of the update. When concurrent updates to the same item occur in different regions, DynamoDB automatically compares the update timestamps and retains the most recently written data. This satisfies the requirement to use the most recently written data without requiring custom reconciliation logic.

Answer

Use optimistic locking with a version number

Answer

Use DynamoDB Streams to capture changes and reconcile conflicts

Answer

Use conditional writes to prevent overwrites

Question 13

A company is designing a new web application that will serve static content (HTML, CSS, JS, images) to users globally. The application must have low latency and high availability. Content changes infrequently, but when updated, the changes must be reflected immediately. Which solution should the architect recommend?

Accepted Answer

Store content in an S3 bucket and use Amazon CloudFront with S3 as origin. Amazon CloudFront, with an S3 bucket as the origin, provides a global content delivery network (CDN) that caches static content at edge locations, significantly reducing latency for users worldwide. S3 offers durable, highly available storage, and CloudFront’s cache invalidation or versioned object updates allow changes to be reflected immediately when content is updated. This combination meets the requirements for low latency, high availability, and immediate content refresh.

Answer

Store content on an EC2 instance behind an Application Load Balancer and use CloudFront

Answer

Store content in Amazon ElastiCache for Redis and use CloudFront

Answer

Store content in an S3 bucket and use S3 Transfer Acceleration

Question 14

A company is designing a new data lake on AWS. The data lake will store petabytes of data from various sources, including IoT devices, application logs, and streaming data. The data must be stored cost-effectively, and access patterns vary from frequently accessed recent data to rarely accessed historical data. The company also needs to run SQL queries on the data. Which solution should the architect recommend?

Accepted Answer

Store data in S3 with lifecycle policies to transition between storage classes, and use Amazon Athena for queries. Amazon S3 lifecycle policies allow automatic transition of objects between storage classes (e.g., S3 Standard to S3 Standard-IA to S3 Glacier Deep Archive) based on age, optimizing cost for varying access patterns. Amazon Athena enables serverless SQL querying directly on data stored in S3, making it ideal for a petabyte-scale data lake without managing infrastructure.

Answer

Store data in S3 with lifecycle policies to transition to Glacier, and use S3 Select for queries

Answer

Store data in Amazon EMR on EC2 and query with Hive

Answer

Store data in Amazon Redshift and query with Redshift Spectrum

Question 15

A company is designing a new microservices architecture on AWS. Each microservice is deployed as a containerized application and must be able to scale independently. The company wants to minimize operational overhead for managing the containers and the underlying infrastructure. Which solution should the architect recommend?

Accepted Answer

Amazon ECS with Fargate launch type. Amazon ECS with the Fargate launch type is the correct choice because it is a serverless compute engine for containers that eliminates the need to provision, configure, or manage the underlying EC2 instances. This directly meets the requirement to minimize operational overhead while allowing each microservice to scale independently, as Fargate automatically handles the infrastructure and scaling based on the task definitions.

Answer

Amazon EKS with managed node groups

Answer

Amazon ECS with EC2 launch type and Auto Scaling groups

Answer

Amazon Lightsail containers