SAP-C02 Design for New Solutions Practice Test 40 — 15 Questions

Question 1

A company is designing a new real-time bidding platform that must handle sudden bursts of traffic up to 100,000 requests per second. The application runs on Amazon EC2 instances behind an Application Load Balancer and stores bid data in Amazon DynamoDB. The company wants to minimize latency and cost while ensuring the database can scale automatically. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use DynamoDB with on-demand capacity mode and enable DynamoDB Accelerator (DAX) for read-heavy workloads.. The correct solution uses DynamoDB on-demand mode to handle unpredictable bursts without capacity planning, and DAX to provide microsecond read latency for read-heavy operations. This combination ensures automatic scaling, low latency, and cost efficiency for a real-time bidding platform. Other options either require manual scaling, introduce bottlenecks, or are not optimized for the required throughput and latency.

Answer

Use Amazon RDS for MySQL with Multi-AZ and read replicas, and implement a caching layer using Amazon ElastiCache.

Answer

Use DynamoDB with provisioned capacity mode and set up Auto Scaling with a target utilization of 70%.

Answer

Use Amazon Aurora Serverless v2 with auto-scaling and enable Aurora Global Database for low-latency reads.

Question 2

A company is migrating a legacy monolithic application to AWS. The application stores session state locally on each server. The company wants to refactor the application to be stateless and deploy it across multiple Availability Zones for high availability. The application must handle sudden traffic spikes and maintain session persistence. Which solution should a solutions architect recommend?

Accepted Answer

Store session state in an Amazon ElastiCache for Redis cluster with Multi-AZ enabled, and configure the application to use it.. ElastiCache for Redis with Multi-AZ is the best choice because it provides a highly available, low-latency, in-memory session store that externalizes session state, making the application stateless. It scales to handle traffic spikes and ensures session persistence across AZs with automatic failover. Other options either keep the application stateful, introduce latency, or are not optimized for session management.

Answer

Use Application Load Balancer with sticky sessions (session affinity) and store session state on each EC2 instance's local disk.

Answer

Store session state in an Amazon S3 bucket and have the application read and write session data for each request.

Answer

Use Amazon DynamoDB with a global secondary index to store session state, and configure the application to use it.

Question 3

A company is designing a new serverless application that processes files uploaded to Amazon S3. The processing involves multiple steps, each implemented as a separate AWS Lambda function. The company needs to coordinate these steps, handle retries, and maintain a visual workflow. The solution must be highly available and scalable. Which service should be used to orchestrate the workflow?

Accepted Answer

AWS Step Functions. AWS Step Functions is designed for orchestrating multi-step serverless workflows. It provides state management, built-in retries, error handling, and a visual interface, all while scaling automatically. Other options are messaging or event services that lack orchestration features, or manual approaches that are not robust.

Answer

Amazon Simple Notification Service (SNS) with Lambda subscriptions

Answer

AWS Lambda with recursive invocations and dead-letter queues

Answer

Amazon EventBridge with rules to trigger Lambda functions

Question 4

A company is designing a new global web application that will be deployed on AWS. The application must provide low-latency access to users worldwide and must be able to fail over between regions in case of an outage. The company wants to use a single global endpoint and minimize DNS propagation delays during failover. Which solution should a solutions architect recommend?

Accepted Answer

Use AWS Global Accelerator with endpoint groups in multiple regions and health checks.. AWS Global Accelerator offers a single global anycast IP address and routes traffic over the AWS global network, reducing latency. It performs health checks and automatically fails over to healthy endpoints within seconds, far faster than DNS-based failover. This meets the need for a single global endpoint and minimal failover delay. Other options rely on DNS, which introduces propagation delays and does not provide a single IP.

Answer

Use Amazon CloudFront with origin failover and multiple regional origins.

Answer

Use Amazon Route 53 with latency-based routing and health checks to fail over between regions.

Answer

Use an Application Load Balancer in each region and Route 53 weighted routing with health checks.

Question 5

A company is designing a new application that will be deployed on AWS. The application requires a relational database that must be highly available, automatically scalable, and support read-heavy workloads. The company wants to minimize operational overhead and ensure that the database can fail over to another Availability Zone automatically. Which solution meets these requirements?

Accepted Answer

Amazon Aurora with a Multi-AZ deployment and Auto Scaling for read replicas. Amazon Aurora with Multi-AZ and Auto Scaling for read replicas provides a highly available, relational database that automatically scales read capacity. It minimizes operational overhead by handling failover and scaling automatically. Other options either lack automatic scaling, are not relational, or are not designed for transactional workloads.

Answer

Amazon DynamoDB with global tables and on-demand capacity

Answer

Amazon Redshift with concurrency scaling and Multi-AZ

Answer

Amazon RDS for MySQL with Multi-AZ and a read replica in a different region

Question 6

A company is deploying a new financial application on AWS that requires strict compliance with PCI DSS. The application will store sensitive cardholder data in an Amazon S3 bucket. The security team needs to ensure that data is encrypted at rest and that access is audited. They also need to be able to prove that encryption keys are rotated annually. Which two actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Enable default encryption on the S3 bucket using SSE-KMS with a customer managed key.. To meet encryption at rest with provable key rotation, use SSE-KMS with a customer managed key, which allows you to enable automatic annual rotation and audit key usage. To audit access to the data, enable CloudTrail data events for the S3 bucket, which logs object-level operations and KMS key usage. Together, these provide the necessary encryption and auditing controls.

Answer

Enable versioning on the S3 bucket to protect against accidental deletion.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Enable S3 server access logging to a separate bucket.

Question 7

A financial services company is designing a new application that will store sensitive customer data in Amazon S3. The company must encrypt the data at rest and ensure that the encryption keys are rotated annually. The security team requires that the company retains full control over the key rotation and can audit key usage. The solutions architect needs to recommend an encryption solution that meets these requirements with minimal operational effort. Which solution should the architect recommend?

Accepted Answer

Use SSE-KMS with a customer managed key (CMK) and enable automatic key rotation.. SSE-KMS with a customer managed key provides the company with full control over the encryption keys, including the ability to enable automatic annual rotation. It also integrates with AWS CloudTrail for auditing key usage. This solution is fully managed, requiring minimal operational effort. Other options either do not provide the required control or require more management overhead.

Answer

Use client-side encryption with a custom encryption library and store the keys in AWS Secrets Manager.

Answer

Use SSE-S3 with default encryption and enable S3 bucket key.

Answer

Use SSE-KMS with an AWS managed key and enable automatic key rotation.

Question 8

A healthcare company is building a new patient records system on AWS. The system must store documents in Amazon S3 and provide access to authenticated patients and clinicians. The company requires that all data be encrypted at rest with keys that the company can rotate annually and immediately disable if compromised, and that access to the keys be logged for compliance. The company does not want to manage any hardware security modules. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS) and enable AWS CloudTrail logging of KMS API calls.. The requirements demand customer-controlled key lifecycle (annual rotation and immediate disablement) and detailed auditing of key usage, all without managing HSMs. SSE-KMS with customer managed keys provides configurable rotation and the ability to disable a key instantly, while CloudTrail captures all KMS API activity for compliance. The other options either lack key control, lack audit logging, or add unnecessary operational burden.

Answer

Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3) and enable S3 server access logging.

Answer

Use S3 client-side encryption with a customer-provided key stored in AWS Secrets Manager, and enable AWS CloudTrail data events on the bucket.

Answer

Use S3 server-side encryption with AWS KMS AWS managed keys (aws/s3) and enable Amazon S3 Inventory to track encryption status.

Question 9

A company is designing a new internal web application for its employees. The application must be accessible only from the corporate network, which connects to AWS via an AWS Site-to-Site VPN. The company wants to use an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The solution must ensure that the ALB is not accessible from the internet. Which configuration should be used?

Accepted Answer

Create an internal ALB in a private subnet and attach a security group that allows traffic from the corporate network CIDR.. The requirement is for an ALB that is not accessible from the internet but is reachable from the corporate network over VPN. An internal ALB provides a private DNS name and private IP addresses, ensuring no internet exposure. Placing it in a private subnet and using a security group to allow only the corporate CIDR restricts access to the intended source. This combination satisfies the security and accessibility requirements.

Answer

Create an internet-facing ALB in a private subnet and attach a network ACL that denies all traffic except the corporate CIDR.

Answer

Create an internet-facing ALB in a public subnet and attach a security group that allows only the corporate network CIDR.

Answer

Create an internal ALB in a public subnet and attach a security group that allows only the corporate network CIDR.

Question 10

A financial services company is migrating a batch risk-calculation workload to AWS. The workload runs nightly for 90 minutes, requires 64 vCPUs and 256 GiB of memory, and must complete within a 2-hour window. The company wants to minimize cost and is open to interruption because the job can restart from a checkpoint. Which compute option should a solutions architect recommend?

Accepted Answer

Amazon EC2 Spot Instances with a capacity-optimized allocation strategy and checkpointing to Amazon S3.. The workload is short, deterministic, and restartable from a checkpoint, which makes it a strong fit for EC2 Spot Instances. A capacity-optimized allocation strategy improves the likelihood of obtaining and retaining capacity for the full 90 minutes, and checkpointing to Amazon S3 allows recovery if a Spot Instance is reclaimed. This combination minimizes cost while still meeting the 2-hour completion window.

Answer

AWS Fargate tasks on Amazon ECS with 16 vCPU and 120 GiB of memory, scaled by a scheduled Application Auto Scaling policy.

Answer

AWS Lambda functions with 10 GB of memory and a 15-minute timeout, invoked in parallel by AWS Step Functions.

Answer

Amazon EC2 On-Demand instances launched in an Auto Scaling group with a scheduled scaling policy.

Question 11

A logistics company is designing a new event-driven system to process shipment tracking updates. The system must ingest millions of events per second from thousands of IoT devices, retain the events for up to 7 days so multiple independent consumer applications can replay them, and deliver each event to consumers in the order it was received per device. Which AWS service should a solutions architect recommend as the ingestion and retention layer?

Accepted Answer

Amazon Kinesis Data Streams with a retention period of 7 days and partition keys based on device ID.. Kinesis Data Streams is built for high-throughput, ordered event ingestion with configurable retention, and it allows multiple independent consumers to read and replay the same records. Partitioning by device ID guarantees that all events from one device are processed in order by a single consumer. This directly meets the ingestion rate, 7-day retention, replay, and per-device ordering requirements.

Answer

Amazon Simple Queue Service (Amazon SQS) FIFO queues with a message retention period of 7 days.

Answer

Amazon EventBridge with an event bus and archive and replay configured for 7 days.

Answer

Amazon Managed Streaming for Apache Kafka (Amazon MSK) with a topic retention of 7 days and a single partition per topic.

Question 12

A company is designing a new serverless application that processes sensitive financial data. The application uses AWS Lambda functions that read from and write to an Amazon S3 bucket. The company requires that the data be encrypted at rest and in transit, and that access to the S3 bucket be restricted to only the Lambda functions. The company also wants to minimize management overhead. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Configure the S3 bucket to use server-side encryption with AWS KMS (SSE-KMS) and grant the Lambda execution role permissions to use the KMS key.. To encrypt data at rest with granular control, use SSE-KMS and grant the Lambda execution role access to the KMS key. To restrict access to only Lambda functions and enforce encryption in transit, attach an S3 bucket policy that allows the Lambda execution role and denies non-HTTPS requests. These actions meet the requirements with minimal overhead.

Answer

Use Amazon S3 presigned URLs to allow Lambda functions to access the bucket without credentials.

Answer

Enable S3 default encryption with Amazon S3 managed keys (SSE-S3) and use VPC endpoints to access the bucket.

Answer

Store the S3 bucket credentials in AWS Secrets Manager and have the Lambda functions retrieve them at runtime.

Question 13

A company is designing a new two-tier web application on AWS. The web tier runs on Amazon EC2 instances behind an Application Load Balancer (ALB), and the database tier uses Amazon RDS for MySQL. The company requires that the database credentials be automatically rotated every 30 days without application downtime. The application retrieves credentials from a centralized store at runtime. Which solution meets these requirements?

Accepted Answer

Store the database credentials in AWS Secrets Manager and enable automatic rotation with a Lambda rotation function.. The requirement is for automatic rotation of database credentials every 30 days with no application downtime and a centralized store. AWS Secrets Manager provides native support for rotating RDS MySQL credentials using a Lambda rotation function, and applications can retrieve the latest credentials at runtime. This meets all the requirements without custom development. The other options either lack native rotation, are insecure, or use a different authentication mechanism that does not involve rotating credentials.

Answer

Use IAM database authentication for RDS and store the IAM role credentials in AWS Secrets Manager with automatic rotation.

Answer

Store the database credentials in an encrypted Amazon S3 object and use an AWS Lambda function to rotate the credentials in RDS and update the S3 object.

Answer

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter and configure automatic rotation using a Lambda function.

Question 14

A company is designing a new application that will use Amazon API Gateway and AWS Lambda. The application must authenticate users using an existing OpenID Connect (OIDC) identity provider. The company wants to minimize the amount of custom code required and ensure that only authenticated users can invoke the API. Which authentication method should be used?

Accepted Answer

Use API Gateway native OpenID Connect authorization with a JWT authorizer.. API Gateway native OpenID Connect authorization with a JWT authorizer allows you to validate tokens from an OIDC provider without writing custom code. It automatically validates the token's signature, issuer, and audience, and only allows authenticated users to invoke the API. This meets the requirements with minimal custom code.

Answer

Use AWS Lambda authorizer with a custom authorizer function that validates JWT tokens.

Answer

Use API Gateway resource policies to restrict access based on IP range.

Answer

Use Amazon Cognito user pools with an OIDC identity provider.

Question 15

A company is deploying a new web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure that the application can handle sudden spikes in traffic and maintain high availability across multiple Availability Zones. The solution must be cost-effective and require minimal manual intervention. Which solution should a solutions architect recommend?

Accepted Answer

Use an Auto Scaling group with a launch template that spans multiple Availability Zones, and configure a target tracking scaling policy based on average CPU utilization.. An Auto Scaling group spanning multiple Availability Zones with a target tracking policy based on CPU utilization automatically adjusts capacity to handle traffic spikes, ensures high availability, and is cost-effective by scaling in during low demand. It requires minimal manual intervention, making it the best choice.

Answer

Use an Auto Scaling group with a scheduled scaling policy that scales out during business hours and scales in at night.

Answer

Use AWS Lambda functions behind an Application Load Balancer to handle the web traffic, with provisioned concurrency to reduce cold starts.

Answer

Use a fixed number of EC2 instances in two Availability Zones and configure an Application Load Balancer with sticky sessions.