SAP-C02 Design for New Solutions Practice Test 38 — 15 Questions

Question 1

A company is designing a new data lake solution on AWS using Amazon S3 as the storage layer. The data lake will be used by multiple teams for analytics and machine learning. The company needs to enforce fine-grained access control at the object level, enable auditing of data access, and ensure that sensitive data is masked for unauthorized users. Which combination of AWS services should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Lake Formation for fine-grained access control and auditing, and Amazon S3 Object Lambda to mask data on the fly.. AWS Lake Formation provides fine-grained access control at the column, row, and cell level for data in S3, and it integrates with AWS CloudTrail for auditing data access. Amazon S3 Object Lambda can transform data on the fly, such as masking sensitive fields, before returning it to the requester, meeting the requirement to mask data for unauthorized users.

Answer

Use S3 bucket policies and S3 access logs for auditing.

Answer

Use Amazon Macie to discover sensitive data and apply S3 bucket policies to restrict access.

Answer

Use IAM policies with condition keys and enable AWS CloudTrail for auditing.

Question 2

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which TWO actions should be taken to achieve this? (Choose two.)

Accepted Answer

Launch EC2 instances in at least two Availability Zones.. Launching EC2 instances in at least two Availability Zones (AZs) ensures that if one AZ fails, the application continues to run from the other AZ, providing fault tolerance and high availability. Option D is correct because configuring the ALB to be internet-facing and registering instances from multiple AZs allows the ALB to distribute incoming traffic across healthy instances in different AZs, automatically rerouting traffic if an AZ becomes impaired.

Answer

Use an Auto Scaling group to launch instances only in one Availability Zone.

Answer

Use a Network Load Balancer instead of ALB for better performance.

Answer

Launch all EC2 instances in a single Availability Zone for low latency.

Question 3

A company is designing a new event-driven architecture using AWS services. The system must process events from multiple sources, filter and route events to different consumers, and ensure that events are processed exactly once. Which THREE services should be used to build this architecture? (Choose three.)

Accepted Answer

AWS Lambda functions to consume events from queues and process them.. AWS Lambda functions are correct because they can be triggered by Amazon SQS FIFO queues to process messages one at a time, preserving the order and enabling idempotent processing. Lambda integrates natively with SQS, automatically scaling the number of concurrent executions based on the queue depth, which supports the exactly-once processing requirement when combined with FIFO queues.

Answer

Amazon Kinesis Data Firehose to deliver events to destinations.

Answer

AWS AppSync to provide real-time subscriptions for events.

Question 4

A company is designing a new solution to host a static website with global audience. The website content includes HTML, CSS, JavaScript, and images. The company wants to minimize latency for users worldwide and reduce the load on the origin server. The origin server is an Amazon S3 bucket configured for static website hosting. Which solution should be used to achieve these goals?

Accepted Answer

Use Amazon CloudFront as a content delivery network (CDN) in front of the S3 bucket.. Amazon CloudFront is a global content delivery network (CDN) that caches static content (HTML, CSS, JavaScript, images) at edge locations worldwide, significantly reducing latency for a global audience. By placing CloudFront in front of an S3 bucket configured for static website hosting, it offloads requests from the origin server, reducing load and improving performance. CloudFront also supports features like custom SSL, geo-restriction, and origin shield to further optimize delivery.

Answer

Use AWS Global Accelerator to route traffic to the S3 bucket.

Answer

Use AWS Lambda@Edge to serve content from edge locations.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 5

A company is migrating a monolithic application to a serverless architecture using AWS Lambda. The application reads and writes to an Amazon RDS for PostgreSQL database. The database connection pool is exhausted during peak traffic. Which design change should a solutions architect recommend to avoid connection exhaustion?

Accepted Answer

Use Amazon RDS Proxy to pool and share database connections.. Amazon RDS Proxy sits between the Lambda function and the RDS database, managing a pool of database connections and reusing them across multiple invocations. This prevents the Lambda function from exhausting the database connection pool during traffic spikes, as each Lambda instance does not need to open its own connection. RDS Proxy also handles connection multiplexing and reduces the overhead of establishing new connections.

Answer

Use Amazon SQS to buffer write requests to the database.

Answer

Use DynamoDB Accelerator (DAX) as a caching layer.

Answer

Increase the max_connections parameter in the RDS parameter group.

Question 6

A company is deploying a web application on AWS Elastic Beanstalk. The application must be accessible over HTTPS only and must automatically redirect HTTP requests to HTTPS. The SSL/TLS certificate is provided by AWS Certificate Manager (ACM). How should this be configured?

Accepted Answer

Configure the environment’s load balancer to listen on port 443 with the ACM certificate and port 80 with a redirect rule.. Elastic Beanstalk environments using a load balancer (ALB or CLB) can be configured to listen on port 443 with the ACM certificate for HTTPS termination, and simultaneously define a listener on port 80 with a redirect action that sends HTTP traffic to HTTPS. This is the simplest and most scalable approach, as it offloads SSL termination and redirection to the load balancer, eliminating the need to manage certificates or redirection logic on individual instances.

Answer

Use a NAT instance to perform SSL termination and redirect.

Answer

Install the certificate on each EC2 instance and configure the web server to redirect HTTP to HTTPS.

Answer

Deploy a CloudFront distribution with the ACM certificate and redirect HTTP to HTTPS at the distribution level.

Question 7

A company wants to decouple a frontend API from backend processing to improve scalability and fault tolerance. The frontend sends requests that can be processed asynchronously. Which AWS service should be used to decouple the components?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queue that decouples the frontend API from backend processing. The frontend can send requests to an SQS queue, and backend consumers can poll and process messages asynchronously, which improves scalability by buffering traffic spikes and enhances fault tolerance by persisting messages until they are successfully processed.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 8

A company is designing a data lake solution on Amazon S3. Data is ingested from multiple sources and stored in a raw bucket. The data must be processed and transformed before being moved to a curated bucket. The processing logic is complex and includes conditional transformations. Which service should be used to orchestrate the transformation pipeline?

Accepted Answer

AWS Step Functions. AWS Step Functions is the correct choice because it is designed to orchestrate complex, multi-step workflows with conditional branching, retries, and error handling. It can coordinate AWS Lambda functions, AWS Glue jobs, and other services to process and transform data from a raw S3 bucket to a curated bucket, making it ideal for a transformation pipeline with complex logic.

Answer

AWS Data Pipeline

Answer

AWS Lambda functions

Answer

AWS Glue ETL jobs

Question 9

A company is building a high-performance computing (HPC) cluster on AWS for genomics research. The compute nodes require low-latency inter-node communication. Which networking solution should be used?

Accepted Answer

Elastic Fabric Adapter (EFA). Elastic Fabric Adapter (EFA) is a network interface that enables HPC and machine learning applications to achieve low-latency inter-node communication by bypassing the operating system kernel and providing OS-bypass capabilities via the Libfabric library. This is essential for tightly coupled HPC workloads like genomics research, where MPI (Message Passing Interface) jobs require microsecond-level latency and high throughput between compute nodes.

Answer

Enhanced Networking (ENA)

Answer

VPC Peering

Answer

AWS Direct Connect

Question 10

A company is designing a CI/CD pipeline for a containerized application using AWS CodePipeline. The application is deployed to Amazon ECS with Fargate. The pipeline must automatically build and test code changes before deploying to production. Which service should be used to build and test the Docker images?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service because it is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy. In this scenario, CodeBuild can build the Docker image from a Dockerfile, run unit or integration tests inside the build environment, and then push the image to Amazon ECR, all within the CI/CD pipeline defined in AWS CodePipeline.

Answer

AWS CodeDeploy

Answer

Amazon ECR

Answer

AWS CodeCommit

Question 11

A company is designing a web application that must support millions of concurrent users. The application uses a RESTful API frontend and a relational database backend. Which TWO strategies should be implemented to improve scalability?

Accepted Answer

Implement read replicas for the database.. Read replicas (Option C) offload read traffic from the primary database instance, allowing the relational database to handle a higher volume of concurrent read queries without degrading write performance. This directly improves scalability for read-heavy workloads common in web applications.

Answer

Use Amazon SQS to queue database write requests.

Answer

Use sticky sessions (session affinity) on the load balancer.

Answer

Use a single large EC2 instance for the database.

Question 12

A company is migrating a legacy application to AWS. The application consists of several components that communicate via TCP. The solutions architect must design a solution that minimizes operational overhead and provides high availability. Which TWO strategies should be used?

Accepted Answer

Use managed services like Amazon RDS and Amazon ElastiCache to reduce operational overhead.. Using managed services like Amazon RDS and Amazon ElastiCache offloads administrative tasks such as patching, backups, and replication setup, significantly reducing operational overhead. Option E is correct because an Application Load Balancer (ALB) distributes incoming TCP traffic across multiple EC2 instances in different Availability Zones, providing high availability and fault tolerance for the application components.

Answer

Use instance store volumes for data persistence.

Answer

Use Spot Instances for all compute resources.

Answer

Use VPC Peering to connect components.

Question 13

A company is designing a multi-tier web application that must be fault-tolerant and scalable. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in an Auto Scaling group. The instances run a web server and a backend application. Which TWO steps should be taken to ensure the application can scale without data loss?

Accepted Answer

Store session state in an external data store such as ElastiCache.. Storing session state in an external data store like ElastiCache decouples session data from individual EC2 instances. This ensures that if an instance is terminated or replaced during scaling events, the session data persists and can be served by any other instance in the Auto Scaling group, preventing data loss and maintaining user experience.

Answer

Use instance store volumes for temporary data.

Answer

Use a custom CloudWatch metric to scale based on CPU utilization.

Answer

Use a fixed number of EC2 instances instead of Auto Scaling.

Question 14

A company is running a production web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application uses a MySQL database hosted on Amazon RDS with Multi-AZ enabled. Recently, during a traffic spike, some users experienced increased latency and occasional 503 errors. The operations team noticed that the database CPU utilization reached 100% and the number of database connections peaked at the maximum limit. The application team confirmed that the application uses connection pooling on the EC2 instances but the pool size is fixed. Which solution should the solutions architect recommend to prevent recurrence?

Accepted Answer

Implement Amazon RDS Proxy to manage database connections.. The issue stems from database connections hitting the maximum limit, causing CPU saturation and 503 errors. Amazon RDS Proxy sits between the application and the database, efficiently managing and pooling connections from the EC2 instances, reducing the number of open connections to the RDS instance and preventing connection exhaustion. This allows the existing connection pooling on the EC2 side to scale without overwhelming the database, directly addressing the root cause.

Answer

Add read replicas to offload read queries.

Answer

Increase the DB instance class to a larger size.

Answer

Increase the maximum number of EC2 instances in the Auto Scaling group.

Question 15

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling approach should they use?

Accepted Answer

Target tracking scaling policies. Target tracking scaling policies are the correct choice because they allow Auto Scaling to automatically adjust capacity based on a target value for a specific CloudWatch metric (e.g., average CPU utilization or request count per target). This approach handles sudden traffic spikes without manual intervention by continuously monitoring the metric and adding or removing EC2 instances to maintain the target, making it ideal for unpredictable workloads.

Answer

Manual scaling

Answer

Scheduled scaling

Answer

Simple scaling policies