SAP-C02 Design for New Solutions Practice Test 4 — 15 Questions

Question 1

A company is designing a new containerized application on Amazon EKS. The application must be able to access secrets (e.g., database credentials) securely. The company requires that secrets be automatically rotated and audited. Which THREE actions should the company take to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use IAM roles for service accounts (IRSA) to grant pods access to Secrets Manager. IAM Roles for Service Accounts (IRSA) allows pods in Amazon EKS to assume an IAM role with fine-grained permissions, enabling secure access to AWS Secrets Manager without embedding long-term credentials. This approach integrates with AWS IAM to provide temporary credentials via OIDC federation, ensuring that only authorized pods can retrieve secrets.

Answer

Mount the Secrets Store CSI Driver volume directly to the pod without using ASCP

Answer

Store secrets in Kubernetes Secrets and use a ConfigMap to reference them

Question 2

A company is designing a new real-time analytics platform that ingests data from thousands of IoT devices. The devices send JSON messages every second to an AWS IoT Core topic. The messages must be processed and stored in Amazon S3 for long-term analysis. The processing includes enrichment by calling a third-party API to add location data. The company expects the workload to vary significantly, with peak traffic of 100,000 messages per second. The solution must be cost-effective and minimize operational overhead. The current architecture uses a Lambda function subscribed to the IoT topic, which processes each message and writes to S3. However, during initial testing, the Lambda function frequently times out due to the third-party API latency, causing message loss. What should the company do to resolve this issue while meeting all requirements?

Accepted Answer

Configure the IoT rule to write messages to an Amazon SQS queue. Then use a Lambda function with reserved concurrency to poll the queue and process messages at a controlled rate. Decoupling the ingestion from the processing using an SQS queue allows the Lambda function to poll messages at a controlled rate, preventing timeouts from third-party API latency. The SQS queue acts as a buffer, absorbing traffic spikes of up to 100,000 messages per second, and Lambda can process messages asynchronously without loss. This approach is cost-effective and minimizes operational overhead by leveraging managed services.

Answer

Increase the Lambda function timeout to 15 minutes and memory to 10240 MB

Answer

Use Amazon Kinesis Data Firehose to buffer data and write to S3, then trigger a Lambda function to enrich data asynchronously

Answer

Enable Provisioned Concurrency on the Lambda function to reduce cold starts

Question 3

A company is designing a new microservices architecture on AWS. Each microservice must be independently deployable and scalable. The company expects unpredictable traffic patterns with sudden spikes. Which combination of AWS services should be used to build a decoupled, resilient system?

Accepted Answer

Use Amazon API Gateway, AWS Lambda, Amazon SQS, Amazon DynamoDB, and Amazon CloudWatch.. It combines API Gateway as a managed entry point, Lambda for stateless compute, SQS for decoupling and buffering sudden traffic spikes, DynamoDB for serverless NoSQL storage, and CloudWatch for observability. This serverless stack ensures each microservice is independently deployable and scales automatically without provisioning, handling unpredictable spikes via SQS queue depth and Lambda concurrency limits.

Answer

Use Application Load Balancer, Amazon EC2 Auto Scaling, Amazon SQS, and Amazon RDS.

Answer

Use Amazon API Gateway, AWS Lambda, Amazon Kinesis Data Streams, and Amazon DynamoDB.

Answer

Use Application Load Balancer, Amazon ECS with Fargate, Amazon SQS, and Amazon RDS with read replicas.

Question 4

A company is migrating a monolithic legacy application to a microservices architecture on AWS. The application currently uses a relational database with complex joins. The migration must minimize application changes. Which database strategy should be used for the new architecture?

Accepted Answer

Use a single Amazon RDS instance shared by all microservices.. The requirement to minimize application changes means the microservices must continue to use the same relational database with complex joins. A single shared Amazon RDS instance preserves the existing SQL queries and join logic without requiring data decomposition or API-based data access patterns, which would necessitate significant application rewrites.

Answer

Use a separate Amazon RDS instance for each microservice.

Answer

Use Amazon Aurora with RDS Proxy in front of it.

Answer

Use Amazon DynamoDB as a shared database for all microservices.

Question 5

A solutions architect is designing a new serverless application using AWS Lambda to process orders from an API Gateway endpoint and store them in DynamoDB. The architect creates the IAM role shown in the exhibit. When testing, the Lambda function fails to write to DynamoDB with an AccessDeniedException. What is the MOST likely cause?

Accepted Answer

The IAM role lacks a trust policy that allows Lambda to assume it.. The IAM role shown in the exhibit likely includes a permissions policy that grants DynamoDB write access, but it is missing a trust policy that allows the Lambda service (lambda.amazonaws.com) to assume the role. Without this trust relationship, Lambda cannot obtain temporary credentials to execute the function, resulting in an AccessDeniedException when attempting to write to DynamoDB.

Answer

The Lambda function does not have permission to create log groups.

Answer

The Lambda function is not in the same VPC as DynamoDB.

Answer

The DynamoDB table 'Orders' does not exist.

Question 6

A company is designing a new microservices architecture on AWS. They need a solution for service discovery that allows services to register themselves and discover other services dynamically. The solution must be highly available and integrated with AWS-native services. Which AWS service should they use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it is a fully managed service discovery service that allows microservices to register themselves dynamically and discover other services via DNS or HTTP API calls. It integrates natively with AWS services like Amazon ECS, Amazon EKS, and AWS Lambda, and provides high availability through automatic health checking and resource synchronization across AWS Regions.

Answer

Amazon ECS Service Discovery

Answer

Application Load Balancer (ALB)

Answer

Amazon Route 53 private hosted zones

Question 7

A company is designing a new application that will process sensitive data. The application will run on Amazon ECS with Fargate. The security team requires that all data at rest be encrypted, and that encryption keys be managed by the company's own hardware security module (HSM) in an on-premises data center. Which TWO steps should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Use AWS CloudHSM to generate and store encryption keys. AWS CloudHSM provides dedicated, single-tenant HSM instances that the company can use to generate and store encryption keys in its own HSM, meeting the requirement that keys be managed by the company's own HSM in an on-premises data center (though CloudHSM is in AWS, it is customer-controlled). Option D is correct because creating an AWS KMS custom key store backed by AWS CloudHSM allows the company to use KMS for encryption operations while the key material is stored in the CloudHSM cluster, satisfying the need for customer-managed HSM-backed keys.

Answer

Configure Amazon EBS encryption using AWS KMS with a customer managed key

Answer

Enable Amazon S3 default encryption with SSE-C

Answer

Store encryption keys in AWS Certificate Manager (ACM)

Question 8

A company has attached the above bucket policy to an S3 bucket. The bucket is accessed by an application running on an EC2 instance in the same AWS account. The EC2 instance is in a private subnet and uses an S3 Gateway Endpoint (vpce-12345678) to access the bucket. The application is failing to get objects from the bucket. What is the most likely cause?

Accepted Answer

The application is using HTTP instead of HTTPS. The bucket policy likely includes a condition that denies requests not using HTTPS (i.e., `aws:SecureTransport`: false). The application is failing because it is using HTTP instead of HTTPS to access the S3 bucket, which violates the encryption-in-transit requirement enforced by the policy. Without HTTPS, the request is denied by the S3 service.

Answer

The application is not using the VPC endpoint

Answer

The bucket policy does not allow encryption in transit

Answer

The application is missing the required x-amz-server-side-encryption header

Question 9

A company is designing a new web application that will be deployed on AWS. The application consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances running a web server. The application must be highly available across multiple Availability Zones. The company expects variable traffic patterns, including sudden spikes. The operations team wants to minimize manual intervention. The application stores session state in a shared data store. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. The company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates. The ALB must terminate SSL/TLS connections. Which combination of actions should the company take to meet these requirements?

Accepted Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using the same ACM certificate. Configure health checks on the target group to use HTTP on port 80 with path /health.. It meets all requirements: the ALB terminates SSL/TLS using an ACM certificate on an HTTPS listener, encrypts traffic between ALB and EC2 instances by using HTTPS on the target group with the same ACM certificate (mutual TLS is not required; the ALB re-encrypts using the same certificate), and uses HTTP health checks on port 80 to avoid certificate validation issues during health checks. This ensures end-to-end encryption, high availability across multiple AZs, and minimizes manual intervention by automating certificate management with ACM.

Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTP health checks on port 80.

Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using a self-signed certificate. Configure health checks to use HTTPS on port 443.

Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS health checks on port 443 using a separate ACM certificate.

Question 10

Drag and drop the steps to migrate an on-premises MySQL database to Amazon RDS using AWS DMS in the correct order.

Accepted Answer

Create replication instance, then create source and target endpoints, then create migration task, then start migration task, then cut over after validation. First create the replication instance, then endpoints, then the migration task, start it, and finally cut over.

Answer

Create replication instance, then create migration task, then create source and target endpoints, then start migration task, then cut over after validation

Answer

Create replication instance, then create source and target endpoints, then cut over after validation, then create migration task, then start migration task

Answer

Create replication instance, then create source and target endpoints, then start migration task, then create migration task, then cut over after validation

Question 11

Drag and drop the steps to set up a cross-region VPC peering connection in the correct order.

Accepted Answer

Initiate VPC peering connection request, Accept VPC peering connection request, Add routes to route tables, Update security groups, Update network ACLs. First initiate, then accept, then add routes, then update security groups, and finally network ACLs.

Answer

Accept VPC peering connection request, Initiate VPC peering connection request, Add routes to route tables, Update security groups, Update network ACLs

Answer

Initiate VPC peering connection request, Accept VPC peering connection request, Update security groups, Add routes to route tables, Update network ACLs

Answer

Initiate VPC peering connection request, Accept VPC peering connection request, Update network ACLs, Update security groups, Add routes to route tables

Question 12

Drag and drop the steps to recover an Amazon RDS Multi-AZ DB instance after a primary instance failure in the correct order.

Accepted Answer

1) Detect failure, 2) Wait for automatic failover to complete, 3) Verify that the standby instance is promoted to primary, 4) Update application endpoints to point to the new primary, 5) Investigate the root cause of the failure.. First identify failure, wait for failover, verify promotion, update endpoints, then investigate.

Answer

1) Detect failure, 2) Immediately update application endpoints, 3) Verify promotion, 4) Wait for failover to complete, 5) Investigate the cause.

Answer

1) Investigate the root cause of the failure, 2) Detect failure, 3) Wait for automatic failover, 4) Verify promotion, 5) Update endpoints.

Answer

1) Detect failure, 2) Verify promotion, 3) Update endpoints, 4) Wait for failover, 5) Investigate.

Question 13

Match each storage class to its description.

Accepted Answer

S3 Standard: Designed for frequently accessed data with low latency and high throughput.. S3 storage classes cater to different access patterns. Standard for frequent access, Intelligent-Tiering for automatic cost optimization, Standard-IA for infrequent but rapid access, One Zone-IA for lower durability infrequent access, Glacier and Deep Archive for archival with longer retrieval times.

Answer

S3 One Zone-IA: Designed for data that is accessed frequently and requires high durability.

Answer

S3 Glacier: For data that requires immediate access with low latency.

Question 14

Match each AWS security service to its purpose.

Accepted Answer

AWS WAF: Protects web applications from common web exploits. Security services address different aspects of threat protection and access control.

Answer

AWS IAM: Manages encryption keys

Answer

AWS KMS: Manages user identities and permissions

Question 15

Match each AWS cost management tool to its use.

Accepted Answer

AWS Cost Explorer: A visual tool that enables you to view and analyze your AWS costs and usage.. Correct matches: Cost Explorer visualizes costs, Budgets set alerts, Trusted Advisor recommends optimizations, and CUR provides detailed data. Common confusions involve mixing tool capabilities.

Answer

AWS Cost Explorer: A service that automatically reduces costs by applying savings plans.

Answer

AWS Budgets: A report that includes all cost and usage data in CSV format.