SAP-C02 Design for New Solutions Practice Test 37 — 15 Questions

Question 1

A company is designing a new microservices architecture on AWS. Each microservice must store its own data and communicate with other services via RESTful APIs. The company wants to minimize operational overhead. Which data store should the company use for each microservice?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency at any scale, making it ideal for microservices that need to store their own data and communicate via RESTful APIs. It requires no operational overhead for scaling, patching, or replication, and its pay-per-request billing aligns with the unpredictable traffic patterns common in microservices architectures.

Answer

Amazon ElastiCache for Redis

Answer

Amazon Redshift

Answer

Amazon RDS for PostgreSQL

Question 2

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The company wants to secure the API by requiring authentication via a JSON Web Token (JWT). Which service should the company use to manage user authentication and issue JWTs?

Accepted Answer

Amazon Cognito User Pools. Amazon Cognito User Pools is the correct choice because it is a fully managed identity provider that handles user sign-up, sign-in, and issues JSON Web Tokens (JWTs) for authentication. It integrates directly with API Gateway Lambda authorizers to validate JWTs and control access to API endpoints without custom code.

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Security Token Service (STS)

Question 3

A company is designing a new data lake on AWS. The data lake will store raw data in Amazon S3 and use Amazon Athena for ad-hoc queries. The company needs to ensure that only authorized users can query specific partitions based on their department. Which approach should the company use to implement fine-grained access control?

Accepted Answer

Use AWS Lake Formation to define data filters and grant permissions to departments at the partition level.. AWS Lake Formation provides fine-grained access control for data lakes, including table- and column-level permissions and data filters that can restrict access at the partition level. By defining data filters and granting permissions to departments, the company can ensure that each department can query only the partitions relevant to them, even when using Amazon Athena.

Answer

Use S3 bucket policies to restrict access to prefixes corresponding to each department.

Answer

Store each department's data in separate databases and use Amazon Redshift Spectrum to query.

Answer

Create separate IAM roles for each department and attach policies that grant access to specific partitions in Athena.

Question 4

A company is designing a containerized microservices architecture on Amazon ECS. The services must be able to discover each other using DNS names. Which AWS service should the company use for service discovery?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that integrates natively with Amazon ECS. It allows microservices to register their DNS names and health checks, enabling other services to discover them via DNS queries or API calls. This directly supports the requirement for containerized services to find each other using DNS names within an ECS cluster.

Answer

Amazon Route 53 Resolver

Answer

Elastic Load Balancing (ELB)

Answer

Amazon Elastic Container Registry (ECR)

Question 5

A company is designing a new application that will process sensitive financial data. The application must encrypt data at rest and in transit. The company wants to use AWS managed keys for encryption. Which AWS service should the company use to create and manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a managed service that enables you to create, store, and control encryption keys used to encrypt data at rest and in transit. KMS integrates with other AWS services (e.g., S3, EBS, RDS) and supports envelope encryption, where a customer master key (CMK) encrypts data keys that perform the actual encryption. It also provides automatic key rotation and fine-grained access control via IAM policies and key policies, meeting the requirement for AWS-managed keys.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Question 6

A company is designing a new serverless application that uses AWS Lambda, Amazon DynamoDB, and Amazon API Gateway. The application must handle burst traffic and cannot lose any data. The company wants to use a dead-letter queue (DLQ) for failed Lambda invocations. Which TWO services can be used as a DLQ for Lambda? (Choose two.)

Accepted Answer

Amazon SNS. Amazon SNS and Amazon SQS are the two supported destinations for Lambda's dead-letter queue (DLQ) configuration, but only for asynchronous invocations. When a Lambda function is invoked asynchronously and fails after the configured number of retries, the event can be redirected to an SNS topic or an SQS queue for later reprocessing or analysis. This ensures no data is lost during burst traffic, as failed events are persisted in the DLQ. Synchronous invocations do not support DLQ.

Answer

Amazon DynamoDB Streams

Answer

Amazon Kinesis Data Streams

Answer

Amazon Simple Email Service (SES)

Question 7

Refer to the exhibit. A company has an S3 bucket policy that allows GetObject access from two IP ranges (10.0.0.0/16 and 192.168.0.0/16). The policy also denies all S3 actions on the 'confidential/' prefix unless the request comes from the 10.0.0.0/16 range. Which of the following statements is true?

Accepted Answer

Users from 10.0.0.0/16 can access objects in the confidential/ prefix, but users from 192.168.0.0/16 cannot.. The S3 bucket policy includes an explicit Deny statement that blocks all S3 actions on the 'confidential/' prefix unless the request originates from the 10.0.0.0/16 IP range. Since explicit Deny statements override any Allow statements in AWS IAM policy evaluation, users from 192.168.0.0/16 are denied access to the 'confidential/' prefix even though the GetObject Allow statement includes that range. Only users from 10.0.0.0/16 satisfy the condition in the Deny statement and can therefore access objects in the 'confidential/' prefix.

Answer

Users from 192.168.0.0/16 can access objects in the confidential/ prefix.

Answer

Users from 10.0.0.0/16 cannot access objects in the confidential/ prefix.

Answer

The policy has no effect because the Allow and Deny statements cancel each other.

Question 8

A company is designing a new application that will run on Amazon ECS with Fargate. The application consists of three microservices: Service A, Service B, and Service C. Service A receives HTTP requests from an Application Load Balancer and sends messages to an Amazon SQS queue. Service B polls the SQS queue and processes the messages, storing results in Amazon DynamoDB. Service C reads from DynamoDB and sends notifications via Amazon SNS. The company expects variable traffic and wants to minimize costs. During a load test, the team observes that Service B is not scaling fast enough, causing the SQS queue to grow. The team also notices that Service C is idle most of the time. Which solution should the company implement to improve scaling and reduce costs?

Accepted Answer

Configure Service B with a target tracking scaling policy based on the SQS queue backlog and convert Service C to an AWS Lambda function triggered by DynamoDB Streams.. It addresses both scaling and cost issues: Service B's scaling is improved by using a target tracking scaling policy based on the SQS queue backlog (ApproximateNumberOfMessagesVisible), which directly correlates to the work demand, ensuring faster and more precise scaling. Converting Service C to a Lambda function triggered by DynamoDB Streams eliminates idle compute costs from a constantly running Fargate service, as Lambda only runs when new data appears in DynamoDB, reducing costs significantly.

Answer

Use AWS Lambda with Provisioned Concurrency for Service B and keep Service C as a Fargate service.

Answer

Use a step scaling policy for Service B based on CPU utilization and keep Service C as is.

Answer

Increase the number of ECS tasks for Service B manually and use a scheduled scaling policy for Service C.

Question 9

A company is designing a new microservices architecture on AWS. Each microservice must store its own data and communicate with other services via RESTful APIs. The company wants to minimize operational overhead. Which data store should the company use for each microservice?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Application Auto Scaling with a target tracking scaling policy based on average CPU utilization.. Amazon ECS with Fargate uses Application Auto Scaling to automatically adjust the desired count of tasks based on demand. A target tracking scaling policy based on average CPU utilization is the correct approach because it allows you to define a target value (e.g., 70% CPU) and Application Auto Scaling will add or remove tasks to maintain that target, matching the variable traffic patterns described.

Answer

Use Amazon EC2 Auto Scaling to add more Fargate tasks.

Answer

Use AWS Auto Scaling Plans with predictive scaling.

Answer

Manually adjust the desired count of tasks in the ECS service based on traffic analysis.

Question 10

A solutions architect is designing a new serverless application using AWS Lambda for business logic, Amazon API Gateway for RESTful APIs, and Amazon DynamoDB for data storage. The application will experience unpredictable traffic spikes. What is the MOST cost-effective way to handle concurrency and scaling?

Accepted Answer

Use Lambda reserved concurrency to set a limit on concurrent executions.. Lambda reserved concurrency sets a hard limit on the number of concurrent executions for a function, preventing runaway scaling and controlling costs during unpredictable traffic spikes. It ensures that the function does not consume more concurrency than allocated, which avoids excessive DynamoDB read/write capacity usage and keeps costs predictable without needing to pre-warm instances.

Answer

Use Lambda provisioned concurrency to pre-warm instances.

Answer

Configure DynamoDB auto scaling to handle traffic spikes.

Answer

Set a usage plan in API Gateway with a throttling limit.

Question 11

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The team wants to decouple the database layer and allow each microservice to own its data. Which design pattern should the team implement?

Accepted Answer

Use a database-per-service pattern with each microservice having its own Amazon DynamoDB table or RDS instance.. The database-per-service pattern is the foundational microservices data management approach where each service owns its private datastore, exposing data only through its API. This gives each microservice independent schema evolution, technology choice (polyglot persistence), and failure isolation — directly satisfying the requirement that 'each microservice owns its data.' DynamoDB or a dedicated RDS instance per service enforces this boundary at the infrastructure level, preventing the shared-database anti-pattern that recreates the monolith's coupling.

Answer

Implement an event-driven architecture using Amazon SQS and AWS Lambda with CQRS.

Answer

Deploy a read replica of the database for each microservice to offload queries.

Answer

Use a single Amazon RDS instance with multiple schemas for each microservice.

Question 12

A company is designing a new solution to process streaming data from IoT devices. The data must be ingested, processed in real-time, and stored in a data warehouse for analytics. The company expects millions of events per second. Which combination of AWS services should be used?

Accepted Answer

Amazon Kinesis Data Streams for ingestion, Amazon Kinesis Data Analytics for real-time processing, and Amazon S3 as a staging area before loading into Amazon Redshift.. Amazon Kinesis Data Streams can ingest millions of events per second with durable, ordered shards, while Kinesis Data Analytics provides real-time SQL or Apache Flink processing on the stream. Amazon S3 acts as a staging layer before loading into Amazon Redshift via COPY or Redshift Spectrum, enabling scalable analytics without throttling the ingestion pipeline.

Answer

Amazon Kinesis Data Firehose for ingestion and delivery to Amazon S3, then use AWS Glue for ETL into Amazon Redshift.

Answer

Amazon DynamoDB Streams for ingestion, AWS Lambda for processing, and Amazon Redshift for storage.

Answer

Amazon SQS for ingestion, AWS Lambda for processing, and Amazon DynamoDB for storage.

Question 13

A company needs to design a new solution for storing and retrieving user-uploaded images. The images are accessed frequently for the first 30 days and then rarely accessed after that. The company wants to minimize storage costs while maintaining low-latency access for frequently accessed images. Which storage strategy should be used?

Accepted Answer

Store images in Amazon S3 Standard and use lifecycle policies to transition to S3 Standard-IA after 30 days.. Amazon S3 Standard provides low-latency access for frequently accessed images, and S3 lifecycle policies allow automatic transition to S3 Standard-Infrequent Access (Standard-IA) after 30 days, reducing storage costs while maintaining rapid access for the initial period. This strategy directly meets the requirement of minimizing costs without sacrificing performance for the first 30 days.

Answer

Store images in Amazon EBS volumes attached to a web server.

Answer

Store all images in Amazon S3 Glacier Flexible Retrieval.

Answer

Store all images in Amazon S3 Standard.

Question 14

A company is designing a new cloud-native application that will be deployed across multiple AWS Regions for high availability. The application uses Amazon Aurora Global Database for its primary data store. The company needs to ensure that in the event of a regional failure, the secondary region can be promoted to primary with minimal data loss. Which configuration should be used?

Accepted Answer

Use Aurora Global Database with one primary region and one secondary region. Enable managed failover with a Recovery Point Objective (RPO) of 1 second.. Amazon Aurora Global Database is specifically designed for cross-region disaster recovery with a typical RPO of 1 second and RTO of less than 1 minute when managed failover is enabled. It uses a storage-based replication layer that replicates data from the primary to secondary regions with minimal latency, ensuring that in a regional failure, the secondary region can be promoted to primary with very little data loss.

Answer

Use Aurora Serverless v2 with data replication across regions using Database Migration Service (DMS).

Answer

Deploy Aurora Multi-AZ in the primary region and use a secondary region as a warm standby.

Answer

Configure Aurora Cross-Region Read Replicas and use Amazon Route 53 for DNS failover.

Question 15

A company is designing a new solution to securely store and manage secrets for applications running on AWS. The secrets include database credentials, API keys, and OAuth tokens. The solution must automatically rotate secrets and integrate with AWS services like Amazon RDS. Which AWS service should be used?

Accepted Answer

Use AWS Secrets Manager to store secrets and configure automatic rotation.. AWS Secrets Manager is purpose-built for securely storing, managing, and automatically rotating secrets such as database credentials, API keys, and OAuth tokens. It provides native integration with Amazon RDS, enabling automatic rotation of RDS credentials without custom code, which directly meets the requirements for automatic rotation and AWS service integration.

Answer

Store secrets in AWS Systems Manager Parameter Store with a SecureString parameter type.

Answer

Use AWS CloudHSM to store secrets as keys.

Answer

Use AWS Key Management Service (KMS) to store secrets as encrypted data keys.