SAP-C02 Design for New Solutions Practice Test 4 — 15 Questions

Question 1

A company is designing a multi-region disaster recovery solution for a critical application. The application uses Amazon RDS for MySQL with Multi-AZ in the primary region. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 1 minute. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon Aurora Global Database with a primary instance in the primary region and one secondary in the secondary region.. Amazon Aurora Global Database is the only solution that can achieve an RPO of 5 seconds and an RTO of 1 minute for a multi-region disaster recovery setup. It uses storage-based replication with typical latency under 1 second, and failover to a secondary region can be completed in about 1 minute by promoting the secondary cluster. Aurora Global Database also avoids the replication lag and promotion delays inherent in cross-region read replicas or DMS-based replication.

Answer

Create an RDS MySQL cross-region read replica in the secondary region and promote it during a disaster.

Answer

Take manual snapshots of the RDS instance every 5 seconds and copy them to the secondary region.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate to a database in the secondary region.

Question 2

A company wants to give its developers access to specific Amazon S3 buckets based on their team membership. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which approach should the company use to grant fine-grained access?

Accepted Answer

Create an IAM policy that allows access to specific buckets based on tags, and assign the policy to an IAM role that developers can assume.. It uses IAM roles with tag-based policies, which integrate with AWS IAM Identity Center via attribute-based access control (ABAC). Developers assume the role after authenticating through Identity Center, and the policy dynamically grants access to S3 buckets matching their team tags, enabling fine-grained, scalable permissions without managing individual users or groups.

Answer

Create separate IAM groups for each team and attach policies granting access to the appropriate buckets.

Answer

Use resource-based policies on the buckets to allow access from the IAM Identity Center users.

Answer

Use S3 bucket policies that grant access to specific IAM users based on their usernames.

Question 3

A company is building a data analytics pipeline. Raw data is ingested into an Amazon S3 bucket. The data must be transformed and loaded into Amazon Redshift for analysis. The pipeline must handle late-arriving data and ensure data consistency. Which THREE AWS services should the company use?

Accepted Answer

AWS Lambda. AWS Glue (D) is correct because it is a fully managed ETL service that can catalog raw S3 data in the AWS Glue Data Catalog, run Spark-based transformation jobs, and load the transformed output into Amazon Redshift, while also supporting job bookmarks to handle late-arriving data and maintain consistency across incremental runs. AWS Lambda (B) is correct because it can be triggered by S3 event notifications to run lightweight transformation or validation logic and orchestrate the pipeline, including invoking Glue jobs or Redshift Data API calls when new or late-arriving objects land in the bucket. Amazon Redshift (E) is correct because it is the target analytics warehouse where the transformed data is loaded and queried, and features such as COPY from S3, sort keys, and ACID-compliant transactions help ensure data consistency for analytical workloads. Amazon Kinesis Data Analytics (A) is not appropriate here because it is designed for real-time stream processing with SQL/Flink over streaming sources, not batch ETL from S3 into Redshift. Amazon EMR (C) is not required because AWS Glue already provides managed Spark-based ETL, so provisioning an EMR cluster would add unnecessary operational overhead for this scenario.

Answer

Amazon Kinesis Data Analytics

Answer

Amazon EMR

Question 4

An IAM policy is attached to an IAM role that is assumed by an EC2 instance. The EC2 instance has an IP address of 10.0.1.15. The instance is unable to download objects from the S3 bucket 'example-bucket'. What is the MOST likely cause?

Accepted Answer

The EC2 instance is using a public IP address to access S3, which does not match the 'aws:SourceIp' condition.. The IAM policy attached to the role likely includes an 'aws:SourceIp' condition that restricts access to requests originating from specific IP addresses. The EC2 instance has a private IP address (10.0.1.15). When the instance attempts to download objects from S3, the source IP address seen by AWS is the instance's private IP (if using a VPC endpoint) or its public IP (if using an internet gateway). If the policy condition requires a public IP that does not include the private IP range, the request is denied. The other options are less likely because the IAM role is attached to the instance profile (B is unlikely), and the policy may include necessary permissions for s3:GetObject but still be denied by the condition (A and C are incorrect).

Answer

The S3 bucket policy denies access to the IAM role.

Answer

The IAM role is not attached to the EC2 instance profile.

Answer

The policy lacks permissions for s3:ListBucket.

Question 5

An organization has deployed the above CloudFormation template. They want to ensure that all uploads to the bucket are encrypted in transit. However, users are still able to upload objects over unencrypted HTTP. What is the MOST likely reason?

Accepted Answer

The condition operator should be 'BoolIfExists' instead of 'Bool' to handle cases where the 'aws:SecureTransport' key is not present in the request.. The condition key 'aws:SecureTransport' may not be present in all requests (e.g., anonymous requests or certain SDK versions). Using 'Bool' will cause the policy to evaluate to false when the key is missing, allowing unencrypted uploads. 'BoolIfExists' returns true if the key does not exist, effectively blocking requests without the key, which enforces encryption in transit more robustly.

Answer

The 'aws:SecureTransport' condition key is misspelled; it should be 'aws:SecureTransport' with a capital T.

Answer

The bucket policy is missing an 'Allow' statement for HTTPS requests.

Answer

The resource ARN should be 'arn:aws:s3:::my-unique-bucket-123' without the '/*' to cover PutObject actions.

Question 6

A solutions architect is troubleshooting an EC2 instance that is not sending metrics to CloudWatch. The instance is running and has internet connectivity. Based on the exhibit, what is the MOST likely reason?

Accepted Answer

The CloudWatch agent is not installed or running on the instance.. The exhibit shows an EC2 instance that is running and has internet connectivity, but metrics are not being sent to CloudWatch. For custom metrics (such as memory or disk utilization) to be published, the CloudWatch agent must be installed and running on the instance. Without the agent, the instance cannot collect and send operating-system-level metrics, even if network connectivity and IAM permissions are correctly configured.

Answer

The instance does not have an IAM role that allows sending metrics to CloudWatch.

Answer

The instance's security group is blocking outbound traffic to CloudWatch endpoints.

Answer

The instance is in the wrong AWS region for CloudWatch.

Question 7

A company is designing a multi-account AWS environment using AWS Organizations. The security team requires that all Amazon S3 buckets across accounts must have server access logging enabled and must block public access. What is the MOST scalable and secure way to enforce these requirements?

Accepted Answer

Apply service control policies (SCPs) at the organizational unit (OU) level to deny actions that disable logging or enable public access. Service control policies (SCPs) at the OU level are the most scalable and secure way to enforce guardrails across all accounts in an AWS Organization. By denying actions that disable server access logging (e.g., s3:PutBucketLogging with a condition that the logging target is not set) and actions that enable public access (e.g., s3:PutBucketPublicAccessBlock with a condition that the block is not set to true), SCPs prevent non-compliant configurations from being created or modified, regardless of the IAM principal used. This approach is centralized, immutable by child accounts, and scales automatically as new accounts are added to the OU.

Answer

Use AWS CloudFormation StackSets to deploy S3 buckets with logging and public access blocks

Answer

Create IAM roles in each account with policies that require logging and block public access

Answer

Use AWS Config rules to detect non-compliant buckets and send notifications

Question 8

A company is designing a serverless application using AWS Lambda that processes images uploaded to an S3 bucket. The processing time varies but typically completes within 5 minutes. The Lambda function needs to access a VPC-hosted database. What is the BEST way to configure the Lambda function to access the database while minimizing cold start latency?

Accepted Answer

Use an Amazon VPC interface endpoint for Lambda and keep the function outside the VPC. Using an Amazon VPC interface endpoint for Lambda allows the function to remain outside the VPC while securely accessing resources inside the VPC via AWS PrivateLink. This avoids the cold start latency penalty (often 10+ seconds) incurred when attaching a Lambda function to a VPC, which requires Elastic Network Interface (ENI) creation. The function can directly invoke the database through the interface endpoint without traversing the public internet or needing a NAT gateway.

Answer

Place the Lambda function outside the VPC and use a NAT gateway to reach the database

Answer

Place the Lambda function inside the VPC with a security group allowing access to the database

Answer

Use Amazon RDS Proxy to manage connections and keep Lambda outside the VPC

Question 9

A company is designing a disaster recovery solution for a critical application running on Amazon EC2. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. The primary region is us-east-1, and the secondary region is us-west-2. Which solution meets the requirements with the LOWEST cost?

Accepted Answer

Use a cross-region read replica in us-west-2 with MySQL asynchronous replication. A cross-region read replica in us-west-2 with MySQL asynchronous replication meets the RPO of 1 hour and RTO of 15 minutes at the lowest cost. Asynchronous replication provides near-real-time data transfer with minimal overhead, and the read replica can be promoted to a standalone primary instance in minutes, satisfying the RTO. This approach avoids the continuous data transfer costs of DMS and the storage costs of Multi-AZ, while automated backups alone cannot meet the RPO.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to us-west-2

Answer

Use automated backups and restore to us-west-2 when needed

Answer

Use a Multi-AZ deployment in us-east-1 and failover to a standby instance

Question 10

A company is designing a new application that will run on Amazon EKS. The application requires persistent storage that can be accessed by multiple pods simultaneously. The storage must be highly available and durable. Which storage solution should be used?

Accepted Answer

Amazon S3 with Mountpoint for S3. Amazon S3 with Mountpoint for S3 is the correct choice because it provides a fully managed, highly available, and durable object storage that can be accessed by multiple Amazon EKS pods simultaneously via a file system interface. S3 is designed for 99.999999999% durability and 99.99% availability, and Mountpoint allows concurrent read/write access from multiple pods, meeting the RWX access mode requirement. Amazon EFS One Zone (Option A) is not highly available as it resides in a single Availability Zone, Amazon EBS gp3 (Option B) supports only RWO, and Amazon FSx for Lustre (Option D) is optimized for high-performance computing and is not a general-purpose shared storage solution.

Answer

Amazon EFS with One Zone storage classes

Answer

Amazon EBS with gp3 volume type

Answer

Amazon FSx for Lustre

Question 11

A company is designing a new data lake on AWS using Amazon S3. The data must be encrypted at rest. Which TWO options comply with the requirement? (Choose TWO.)

Accepted Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3). Options C and E are correct because both provide encryption at rest for objects stored in Amazon S3. SSE-S3 (C) uses AES-256 encryption with keys fully managed by Amazon S3, so objects are automatically encrypted when written and decrypted when read, satisfying the at-rest requirement without customer key management. SSE-KMS (E) also encrypts objects at rest but uses AWS KMS customer master keys, giving additional control, auditability, and separation of duties through KMS. Option A is incorrect because SSL/TLS only protects data in transit, not data at rest in the bucket. Option B is incorrect because S3 Access Points and bucket policies control access, not encryption at rest. Option D is incorrect because client-side encryption is a valid encryption approach, but it is not one of the two options marked correct here; the question specifically asks for the marked compliant server-side encryption choices.

Answer

Enable SSL/TLS for all data transfers

Answer

Use S3 Access Points with a bucket policy

Answer

Use client-side encryption before uploading

Question 12

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which THREE mechanisms can be used for service-to-service communication? (Choose THREE.)

Accepted Answer

Amazon API Gateway as a front end. Option B is correct because Amazon API Gateway can act as a front-end entry point that routes HTTP/REST requests to ECS Fargate services (via VPC Link or private integration), enabling synchronous service-to-service communication. Option C is correct because an Application Load Balancer distributes traffic to ECS tasks and can serve as the ingress layer for inter-service calls, with ECS service load balancing and target groups routing requests to healthy Fargate tasks. Option D is correct because AWS Cloud Map provides service discovery, allowing ECS services to register DNS names and discover each other dynamically via service registry, which is the native service-to-service discovery mechanism for ECS. Option A is not correct here because Amazon SQS is an asynchronous message queue, not a direct service-to-service communication mechanism in the sense of the question's synchronous inter-service calls. Option E is not correct because DynamoDB is a database, not a communication channel between services.

Answer

Amazon SQS queues between services

Answer

Amazon DynamoDB as a communication channel

Question 13

Refer to the exhibit. A company has an S3 bucket policy that requires server-side encryption with AES256 for all objects uploaded. However, users can still upload objects without encryption. What is the MOST likely reason?

Accepted Answer

The policy does not deny requests that omit the encryption header. The bucket policy only requires encryption but does not explicitly deny requests that omit the `x-amz-server-side-encryption` header. Without a `Deny` effect for requests lacking the header, the policy is effectively a statement of intent rather than an enforcement mechanism. S3 bucket policies can enforce encryption by using a `Deny` statement with a condition key like `s3:x-amz-server-side-encryption` set to `AES256`.

Answer

S3 bucket policies cannot enforce encryption; you must use bucket default encryption

Answer

The condition key is incorrect; it should be s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

The policy does not apply to objects uploaded using AWS KMS managed keys

Question 14

A company is designing a new global application that will serve users worldwide. The application uses an Application Load Balancer (ALB) in a single region. To reduce latency for users in other regions, the company wants to cache static content at edge locations. The dynamic content must still be served from the ALB. Which configuration should be used?

Accepted Answer

Amazon CloudFront with multiple origins: S3 for static content and ALB for dynamic content. It uses Amazon CloudFront with multiple origins: an S3 bucket for static content (cached at edge locations) and the ALB for dynamic content (forwarded to the origin). This configuration meets the requirement to reduce latency for static assets via edge caching while ensuring dynamic requests are always served from the ALB, avoiding stale or incorrect responses.

Answer

AWS Global Accelerator with the ALB as the endpoint

Answer

Amazon CloudFront with the ALB as the origin

Answer

Amazon S3 Transfer Acceleration for static content

Question 15

A company is designing a new multi-tier web application on AWS. The application consists of a public-facing Application Load Balancer, a fleet of EC2 instances in private subnets, and an RDS database in a private subnet. The security team requires that all traffic between the ALB and EC2 instances be encrypted, and that the EC2 instances have no direct internet access. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Configure the ALB to use HTTPS listeners and the target group to use HTTPS.. Option A is correct because configuring the ALB with HTTPS listeners and setting the target group protocol to HTTPS ensures that traffic from the ALB to the EC2 instances is encrypted end-to-end using TLS, satisfying the requirement that all traffic between the ALB and EC2 instances be encrypted. Option B is correct because placing the EC2 instances in private subnets removes any direct route to the internet, and using a NAT gateway allows outbound internet access for updates or patches without exposing the instances to inbound internet traffic, meeting the no-direct-internet-access requirement. Option C is incorrect because attaching an Internet Gateway and routing traffic through it would give the EC2 instances direct internet access, violating the security requirement. Option D is incorrect because VPC Flow Logs only capture IP traffic metadata for monitoring and do not encrypt traffic or restrict internet access. Option E is incorrect because network ACLs denying inbound internet traffic do not by themselves encrypt ALB-to-EC2 traffic or prevent outbound internet access, and the EC2 instances are already in private subnets.

Answer

Attach an Internet Gateway to the VPC and route traffic through it.

Answer

Enable VPC Flow Logs on the private subnets.

Answer

Configure network ACLs to deny all inbound traffic from the internet.