SAP-C02 Design for New Solutions Practice Test 36 — 15 Questions

Question 1

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. They need to offload SSL/TLS termination to reduce CPU usage on the instances. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the ALB with an SSL certificate. An Application Load Balancer (ALB) can terminate SSL/TLS by installing a certificate on it, reducing CPU load on backend EC2 instances. Option A (self-signed certificate on each instance) does not offload SSL and is less secure. Option B (NLB with SSL pass-through) does not terminate SSL; it passes encrypted traffic through. Option D (CloudFront) can terminate SSL but is a CDN service, not primarily for SSL offload in this architecture, and adds cost and complexity.

Answer

Install a self-signed certificate on each EC2 instance

Answer

Use a Network Load Balancer (NLB) with SSL pass-through

Answer

Use Amazon CloudFront for SSL termination

Question 2

A company is designing a new application that will use Amazon RDS for PostgreSQL. They need to implement read replicas to offload read traffic. However, they are concerned about replication lag affecting read consistency. Which action would minimize replication lag?

Accepted Answer

Use instance types with higher network performance. Using an instance type with higher network performance (option D) reduces replication lag because it provides more bandwidth for the replication process. Option A (increasing allocated storage) does not directly affect replication lag. Option B (using an encrypted connection) does not impact lag; encryption adds overhead but is necessary for security. Option C (enabling Multi-AZ) is for high availability, not for read replicas.

Answer

Increase the allocated storage on the primary instance

Answer

Use an encrypted connection between the primary and replica

Answer

Enable Multi-AZ on the primary instance

Question 3

A company is designing a serverless application using AWS Lambda. The function needs to access a VPC resource. What is the correct way to configure this?

Accepted Answer

Assign the Lambda function to the VPC and configure a security group. Lambda functions must be attached to a VPC and assigned a security group to access resources within the VPC, such as an RDS database or an Elasticache cluster. This configuration creates an elastic network interface (ENI) in the VPC, allowing the function to communicate with VPC resources via private IP addresses. The security group acts as a virtual firewall to control inbound and outbound traffic for the Lambda function.

Answer

Attach an Internet Gateway to the VPC

Answer

Set up a VPC peering connection

Answer

Configure a NAT Gateway in the public subnet

Question 4

A company is designing a new application to store and retrieve user profile pictures. The images will be accessed frequently and must be served with low latency. Which storage solution should they use?

Accepted Answer

Amazon S3. Amazon S3 is ideal for storing and serving static content like images with low latency. Option A (Amazon EBS) is block storage for EC2, Option C (Amazon EFS) is file storage, and Option D (Amazon RDS) is a relational database.

Answer

Amazon EBS

Answer

Amazon EFS

Answer

Amazon RDS

Question 5

A solutions architect is reviewing the above IAM policy attached to an S3 bucket. A user from IP address 10.0.1.5 makes a request over HTTP (not HTTPS). Will the user be able to download an object?

Accepted Answer

No, because the request is not using HTTPS.. The IAM policy includes a condition that requires requests to use HTTPS (aws:SecureTransport = true). Since the user's request is over HTTP, the condition fails, and the Allow statement does not apply. Therefore, the request is denied by default, and the user cannot download the object.

Answer

No, because the IP address is not in the allowed range.

Answer

Yes, because the IP address is allowed.

Answer

Yes, because the Allow statement is evaluated first.

Question 6

A company is designing a new application that will run on Amazon ECS with Fargate. They need to store configuration data and secrets securely. Which services should they use? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is correct because it is purpose-built for securely storing, rotating, and managing secrets such as database credentials and API keys throughout their lifecycle. It integrates natively with Amazon ECS to inject secrets into containers at runtime without exposing them in the task definition or environment variables, meeting the requirement for secure configuration data and secrets.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS KMS

Question 7

A company is designing a new data lake on Amazon S3. They need to ensure that data is encrypted at rest and that access is audited. Which services should they use? (Choose TWO.)

Accepted Answer

AWS KMS. AWS KMS (C) is correct because it provides the customer-managed and AWS-managed keys used for server-side encryption of S3 objects (SSE-KMS), satisfying the requirement that data be encrypted at rest. AWS CloudTrail (E) is correct because it records S3 data events and management events, providing the audit trail of who accessed the data and when. Amazon Macie (A) is a data-discovery and PII-classification service, not an encryption or access-auditing mechanism. Amazon GuardDuty (B) is a threat-detection service that identifies malicious activity but does not itself encrypt data or provide the required access audit log. AWS Config (D) tracks resource configuration changes and compliance, but it does not perform encryption at rest or capture the detailed access auditing required here.

Answer

Amazon Macie

Answer

Amazon GuardDuty

Answer

AWS Config

Question 8

A company is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences sudden spikes in traffic. Which AWS service should be used to handle the traffic spikes without losing any requests?

Accepted Answer

Amazon SQS. Amazon SQS is a fully managed message queuing service that decouples application components and buffers requests during traffic spikes. By placing an SQS queue between API Gateway and Lambda (or between Lambda and DynamoDB), the system can absorb sudden bursts of traffic without losing requests, as messages are durably stored until processed. This is the standard pattern for handling spiky serverless workloads.

Answer

Amazon SNS

Answer

AWS Step Functions

Answer

Amazon Kinesis Data Streams

Question 9

A company wants to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS supports ongoing replication to minimize downtime during migration.

Answer

AWS Server Migration Service (SMS)

Answer

AWS DataSync

Answer

AWS Snowball

Question 10

A company is designing a new application that will process streaming data from IoT devices. The data must be processed in real time and then stored in Amazon S3 for long-term analytics. Which combination of AWS services should be used?

Accepted Answer

Amazon Kinesis Data Streams, AWS Lambda, Amazon S3. Amazon Kinesis Data Streams ingests and buffers streaming IoT data in real time, AWS Lambda processes each record as it arrives, and the processed data is written directly to Amazon S3 for durable long-term analytics. This combination provides the low-latency, serverless pipeline required for real-time processing and S3-based storage.

Answer

Amazon Kinesis Data Firehose, Amazon Redshift

Answer

Amazon SQS, AWS Lambda, Amazon RDS

Answer

AWS IoT Core, Amazon DynamoDB

Question 11

A company is designing a new application that requires a relational database with high read capacity. The application is read-heavy and requires low latency. Which database configuration should be used?

Accepted Answer

Amazon RDS with read replicas. Amazon RDS with read replicas is the correct choice because the application is read-heavy and requires low latency. Read replicas offload read traffic from the primary database instance, scaling read capacity and reducing latency for read operations by distributing the load across multiple copies of the data.

Answer

Amazon DynamoDB with DAX

Answer

Amazon RDS with Multi-AZ deployment

Answer

Amazon ElastiCache for Redis

Question 12

A company is designing a new application that will store and retrieve large files (up to 5 TB). The files must be accessible via HTTPS and must be durable. Which AWS storage service should be used?

Accepted Answer

Amazon S3. Amazon S3 is the correct choice because it supports objects up to 5 TB in size, provides HTTPS access via RESTful API endpoints, and offers 99.999999999% (11 nines) durability by automatically replicating data across multiple Availability Zones. S3 is purpose-built for storing and retrieving large files over the internet with high durability and scalability.

Answer

Amazon EFS

Answer

AWS Storage Gateway

Answer

Amazon EBS

Question 13

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group. The application must be able to distribute incoming traffic across multiple instances. Which TWO AWS services can be used for this purpose? (Choose TWO.)

Accepted Answer

Network Load Balancer. Option C (Network Load Balancer) is correct because it is an Elastic Load Balancing service that operates at Layer 4 (TCP/UDP/TLS) and distributes incoming traffic across targets such as EC2 instances in an Auto Scaling group, using listeners and target groups. Option D (Application Load Balancer) is correct because it is an Elastic Load Balancing service that operates at Layer 7 (HTTP/HTTPS) and also distributes incoming traffic across EC2 instances registered in target groups within an Auto Scaling group. Both load balancers integrate with Auto Scaling groups so that instances added or removed by scaling are automatically registered or deregistered as targets. Option A (Amazon CloudFront) is a content delivery network that caches and serves content from edge locations, not a load balancer for distributing traffic across EC2 instances. Option B (AWS Global Accelerator) improves global reachability and performance by routing traffic over the AWS global network to endpoints, but it is not the primary service for distributing traffic across multiple EC2 instances in an Auto Scaling group. Option E (Amazon Route 53) is a DNS service that can perform DNS-based routing, but it does not distribute incoming traffic across EC2 instances at the connection level like a load balancer.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 14

A company deployed the above CloudFormation template. An EC2 instance launched in the PrivateSubnet needs to access the internet for software updates. Which action is required?

Accepted Answer

Add a NAT Gateway in the PublicSubnet and update the PrivateSubnet's route table to point to the NAT Gateway. A NAT Gateway placed in a public subnet with an Internet Gateway attached allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing inbound connections from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. This is the standard AWS pattern for outbound-only internet access from private subnets.

Answer

Create a VPC Peering connection to a public VPC

Answer

Add an Internet Gateway to the VPC and route the private subnet's route table to it

Answer

Modify the PrivateSubnet to assign public IP addresses on launch

Question 15

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web tier, an application tier, and a database tier. The company wants to decouple the tiers to improve scalability and resilience. Which AWS service should the company use to send messages from the web tier to the application tier asynchronously?

Accepted Answer

Amazon SQS. Amazon SQS is the correct choice because it provides a fully managed message queuing service that enables asynchronous communication between decoupled application tiers. The web tier can send messages to an SQS queue, and the application tier can poll and process those messages independently, which improves scalability and resilience by allowing each tier to scale and fail independently.

Answer

Amazon SNS

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions