SAP-C02 Design for New Solutions Practice Test 42 — 15 Questions

Question 1

A company is designing a new serverless application that uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application must handle sudden spikes in traffic without throttling errors and must provide consistent low-latency responses. The company wants to minimize operational overhead. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use DynamoDB on-demand capacity mode for the table.. DynamoDB on-demand capacity mode automatically scales to handle traffic spikes, eliminating the need to provision capacity and reducing operational overhead. Lambda provisioned concurrency pre-warms execution environments, reducing cold starts and ensuring consistent low-latency responses. Together, these actions enable the serverless application to handle sudden spikes without throttling or performance degradation.

Answer

Configure Lambda function reserved concurrency to ensure sufficient capacity.

Answer

Configure API Gateway with a usage plan and API keys to limit requests per client.

Answer

Enable API Gateway caching for the stage to reduce backend requests.

Question 2

A company is designing a new multi-tier application on AWS. The application will use an Application Load Balancer (ALB) to distribute traffic to Amazon EC2 instances in an Auto Scaling group. The company requires that the application be highly available across multiple Availability Zones and that it can scale automatically based on demand. The company also wants to ensure that the application can handle sudden spikes in traffic without manual intervention. Which two actions should a solutions architect recommend to meet these requirements? (Choose two.)

Accepted Answer

Create a target tracking scaling policy based on average CPU utilization to automatically adjust the number of instances.. To achieve high availability, the Auto Scaling group must span multiple Availability Zones with a minimum capacity of at least two instances. To handle sudden spikes automatically, a target tracking scaling policy based on a metric like CPU utilization dynamically adjusts capacity. Together, these actions provide both resilience and elasticity without manual intervention.

Answer

Enable cross-zone load balancing on the ALB and configure the Auto Scaling group to use a single Availability Zone.

Answer

Use a Network Load Balancer (NLB) instead of an Application Load Balancer (ALB) to improve performance.

Answer

Configure a scheduled scaling policy to add instances at predicted peak times.

Question 3

A company is deploying a containerized web application on Amazon Elastic Kubernetes Service (Amazon EKS). The application requires persistent storage that must be shared across multiple pods running on different nodes. The storage must support ReadWriteMany (RWX) access mode and provide high throughput for media processing workloads. The company wants to minimize operational overhead and use AWS managed services. Which two solutions should a solutions architect recommend? (Choose two.)

Accepted Answer

Use Amazon Elastic File System (Amazon EFS) with the EFS CSI driver to provide a shared file system for the pods.. Amazon EFS and Amazon FSx for Lustre both support the ReadWriteMany access mode and are managed AWS services that integrate with Amazon EKS via CSI drivers. EFS provides scalable, elastic storage suitable for general-purpose shared file systems, while FSx for Lustre delivers high throughput and low latency for compute-intensive media processing. Together, they offer the required shared storage with minimal operational overhead.

Answer

Use Amazon Elastic Block Store (Amazon EBS) with the EBS CSI driver to provide persistent volumes for the pods.

Answer

Use Amazon S3 with the Mountpoint for Amazon S3 CSI driver to provide a shared file system.

Answer

Use AWS Storage Gateway in file gateway mode to provide an NFS mount for the pods.

Question 4

A company runs a stateful web application on a single Amazon EC2 instance. The application writes data to a locally attached instance store volume. The company wants to improve the durability of the data without modifying the application. The data must survive an instance stop/start and be available if the instance is terminated and relaunched. What should a solutions architect recommend?

Accepted Answer

Move the data to an Amazon EBS volume with the DeleteOnTermination flag set to false.. Amazon EBS volumes are durable, persistent block storage that can be detached from one instance and attached to another. Setting DeleteOnTermination to false ensures the volume remains after instance termination. The application can continue to write to the same mount point, so no code changes are needed. This provides the required data durability across instance stop/start and termination.

Answer

Enable termination protection on the EC2 instance.

Answer

Create an Amazon Machine Image (AMI) of the instance after each data change.

Answer

Use an Auto Scaling group with a launch template that includes the instance store volume.

Question 5

A company is migrating a legacy on-premises application to AWS. The application uses a shared file system that must be accessible from multiple Linux-based Amazon EC2 instances simultaneously. The application requires a POSIX-compliant file system with high throughput and low latency. The company wants a fully managed, scalable solution that can grow to petabytes. What should a solutions architect recommend?

Accepted Answer

Amazon Elastic File System (Amazon EFS). Amazon EFS is a fully managed, elastic file system that supports the POSIX interface and can be mounted on multiple Linux EC2 instances concurrently. It scales automatically to petabytes and offers high throughput and low latency. It requires no infrastructure management, making it the ideal choice for a shared file system for Linux workloads.

Answer

Amazon FSx for Lustre

Answer

Amazon S3 with s3fs-fuse mounted on each EC2 instance

Answer

Amazon FSx for Windows File Server

Question 6

A financial services firm is designing a new trade-processing platform on AWS. The platform uses AWS Lambda functions that must access an Amazon RDS for MySQL database in a private subnet. Security policy forbids storing database credentials in environment variables or code. The firm also requires that credentials be automatically rotated every 30 days, and that the rotation be auditable. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Store the database credentials in AWS Secrets Manager. Grant the Lambda execution role secretsmanager:GetSecretValue on the specific secret ARN, and configure automatic rotation with a 30-day schedule using the provided RDS MySQL rotation Lambda function.. AWS Secrets Manager integrates directly with Amazon RDS to rotate database credentials automatically using a managed rotation Lambda function. Configuring a 30-day rotation schedule satisfies the policy, and granting the Lambda execution role only secretsmanager:GetSecretValue on the specific secret ARN follows least privilege. Rotation events are logged in AWS CloudTrail, providing the required auditability.

Answer

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter. Create a custom Lambda function that rotates the password every 30 days and updates the parameter.

Answer

Store the database credentials in an encrypted Amazon S3 object. Have the Lambda function retrieve and decrypt the object at each invocation using an AWS KMS key, and use an S3 Lifecycle rule to delete and recreate the object every 30 days.

Answer

Store the database credentials in AWS Secrets Manager. Attach the AWS managed policy SecretsManagerReadWrite to the Lambda execution role, and enable automatic rotation with a 30-day schedule using the provided RDS MySQL rotation Lambda function.

Question 7

A financial-services company is designing a new multi-tenant SaaS platform on AWS. Each tenant must be able to bring its own AWS KMS customer managed key (CMK) so that tenant data is encrypted with a key the tenant controls and can revoke at any time. The platform stores objects in a single Amazon S3 bucket shared by all tenants and must support per-tenant key revocation without redeploying the application. Which design meets these requirements with the LEAST operational overhead?

Accepted Answer

Use S3 server-side encryption with AWS KMS keys (SSE-KMS) and specify a tenant-specific CMK in the x-amz-server-side-encryption-aws-kms-key-id header on each PutObject request, granting the platform role kms:GenerateDataKey and kms:Decrypt on each tenant CMK.. Per-tenant customer managed keys in AWS KMS can be selected at PutObject time through the SSE-KMS key-id header, letting one shared S3 bucket hold objects encrypted under many tenant-controlled keys. Because decryption requires kms:Decrypt on the specific CMK, revoking that grant or disabling the tenant CMK instantly cuts off access to that tenant's objects without redeploying or restructuring storage, which is the lowest-overhead way to meet the bring-your-own-key and revocation requirements.

Answer

Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3) and store a per-tenant envelope key in AWS Secrets Manager, encrypting each object client-side with that secret before upload.

Answer

Enable S3 default encryption with SSE-KMS using a single platform-owned CMK, and use S3 Access Points with a per-tenant access point policy to isolate tenant prefixes.

Answer

Create a separate S3 bucket per tenant and configure each bucket with SSE-KMS using a tenant-owned CMK via a bucket key, then use S3 Inventory to track objects across buckets.

Question 8

A company is designing a new application that will be deployed on AWS. The application consists of a web tier running on Amazon EC2 instances and a database tier using Amazon Aurora. The company expects unpredictable traffic patterns and wants to optimize costs while maintaining high availability. The web tier must automatically scale based on demand, and the database must be able to handle read-heavy workloads. What should a solutions architect recommend?

Accepted Answer

Use an Auto Scaling group for the web tier with a target tracking scaling policy, and add Aurora Replicas to the Aurora cluster for read scaling.. The recommended solution is to use an Auto Scaling group with a target tracking scaling policy for the web tier, which dynamically adjusts capacity based on demand, and to add Aurora Replicas to the Aurora cluster to handle read-heavy workloads. This provides high availability, cost optimization, and read scalability. Other options either use less responsive scaling policies or change the architecture unnecessarily.

Answer

Use AWS Lambda for the web tier with provisioned concurrency, and use Aurora Serverless for the database.

Answer

Use an Auto Scaling group with a scheduled scaling policy for the web tier, and use a single Aurora instance with a larger instance size for the database.

Answer

Use an Auto Scaling group with a simple scaling policy for the web tier, and enable Aurora Auto Scaling for the database.

Question 9

A retail company is designing a new order-processing workflow. When an order is placed, an Amazon API Gateway endpoint invokes an AWS Lambda function that must validate the order, then wait for a human fraud analyst to approve or reject it, and finally send a confirmation email. The approval can take up to three days, and the company wants to minimize operational overhead. Which design should the solutions architect use?

Accepted Answer

Use AWS Step Functions Standard workflows with a Lambda task for validation, a callback pattern using a task token for the analyst decision, and a Lambda task to send the email.. Step Functions Standard workflows run for up to a year and support the callback task token pattern, which is purpose-built for pausing a workflow until an external human or system responds. The analyst's approval action calls SendTaskSuccess or SendTaskFailure with the token, resuming the state machine, which then invokes the email step. Retries, timeouts, and state persistence are handled by the service.

Answer

Use AWS Step Functions Express workflows with a wait state that polls Amazon DynamoDB for the analyst decision on a fixed interval.

Answer

Use an Amazon EventBridge rule that schedules a Lambda function every five minutes to check whether the analyst has approved the order.

Answer

Use a single long-lived Lambda function that polls an Amazon SQS queue for the analyst decision until it arrives or the function times out.

Question 10

A media company is designing a new video transcoding pipeline on AWS. The pipeline receives large video files in an Amazon S3 bucket, and each file must be transcoded into multiple formats. The transcoding jobs take between 10 and 45 minutes, and the company wants to minimize compute cost while ensuring that jobs are not interrupted. The solution must automatically scale based on the number of pending jobs. Which compute option should the company use?

Accepted Answer

AWS Batch with a managed compute environment using On-Demand EC2 instances, scaling based on the number of jobs in the job queue.. AWS Batch with On-Demand instances provides a managed batch processing environment that scales based on job queue depth. It supports long-running jobs beyond the Lambda timeout and avoids the interruption risk of Spot Instances. The managed compute environment automatically provisions and terminates instances, reducing operational overhead while meeting the cost and reliability requirements.

Answer

AWS Lambda functions with a 15-minute timeout, triggered by S3 event notifications, scaling automatically with concurrency.

Answer

AWS Fargate tasks on Amazon ECS, triggered by an Application Load Balancer, scaling based on CPU utilization of the tasks.

Answer

Amazon EC2 Spot Instances in an Auto Scaling group, with a launch template that installs transcoding software, scaling based on the SQS queue depth.

Question 11

A financial services company is building a new payment processing system on AWS. The system must durably retain transactional records for seven years to meet regulatory requirements, and the records must be encrypted at rest with a customer-provided key that the company can rotate on demand. The company wants the simplest operational model and does not want to manage any servers. Which solution should a solutions architect recommend?

Accepted Answer

Store records in Amazon S3 with a bucket policy that enforces SSE-KMS using a customer managed key, and use S3 Object Lock in compliance mode for the retention period.. The requirement for a customer-provided key that can be rotated on demand points to SSE-KMS with a customer managed key, and the seven-year immutable retention requirement points to S3 Object Lock in compliance mode. S3 offers the highest durability with no server management, making it the simplest solution that fully meets the regulatory, encryption, and operational requirements.

Answer

Store records in Amazon DynamoDB with encryption at rest using an AWS owned key, and enable point-in-time recovery with a seven-year retention window.

Answer

Store records in Amazon S3 Glacier Deep Archive with server-side encryption using Amazon S3 managed keys (SSE-S3), and rely on S3 Versioning to prevent deletion for seven years.

Answer

Store records in Amazon EBS volumes attached to EC2 instances, and use AWS KMS customer managed keys to encrypt the volumes. Configure a lifecycle policy to snapshot the volumes every day for seven years.

Question 12

A financial services firm runs a latency-sensitive trading application across three AWS Regions. The application writes to an Amazon DynamoDB table in the primary Region and must be able to read and write locally in the other two Regions with single-digit-millisecond latency, while tolerating a full Region failure. The firm accepts eventual consistency across Regions but requires that no acknowledged write is ever lost. Which solution should a solutions architect recommend?

Accepted Answer

Create a DynamoDB global table with multi-Region replication and configure the application to read and write to the local Regional replica.. Multi-active writes with local single-digit-millisecond latency in three Regions, tolerance of a Region outage, and no acknowledged-write loss point to DynamoDB global tables. Each Region holds a full replica that accepts reads and writes locally, and replication propagates changes asynchronously, so a failed Region does not stop the others from serving traffic.

Answer

Replicate the table to each Region using AWS Database Migration Service with change data capture, and have the application write to the nearest Regional table.

Answer

Use Amazon Aurora Global Database with a writer in the primary Region and read replicas in the other Regions, and route writes to the primary writer endpoint.

Answer

Deploy the DynamoDB table in the primary Region and use DynamoDB Accelerator (DAX) clusters in each Region to serve local reads and writes.

Question 13

A company is deploying a new three-tier web application on AWS. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The application tier runs on Amazon ECS with the Fargate launch type. The database tier uses Amazon Aurora MySQL. The security team requires that all data in transit between tiers be encrypted and that the application tier be able to access the database without hardcoding credentials. The company wants to minimize operational overhead. Which solution meets these requirements?

Accepted Answer

Configure the Application Load Balancer with an HTTPS listener using an ACM certificate, enable TLS on the ECS service, and store database credentials in AWS Secrets Manager with automatic rotation. Grant the ECS task role permission to read the secret.. The correct solution encrypts data in transit at all tiers and centralizes credential management with automatic rotation. An HTTPS listener on the Application Load Balancer with an ACM certificate secures client traffic, TLS on the ECS service secures application traffic, and Aurora MySQL supports TLS for database connections. AWS Secrets Manager with automatic rotation and an ECS task role eliminates hardcoded credentials while minimizing operational overhead.

Answer

Use an Application Load Balancer with an HTTP listener and rely on security groups to restrict traffic. Store database credentials in environment variables within the ECS task definition.

Answer

Configure the Application Load Balancer with an HTTPS listener using an ACM certificate, enable TLS on the ECS service, and store database credentials in AWS Systems Manager Parameter Store as a SecureString parameter without rotation.

Answer

Use AWS Certificate Manager Private Certificate Authority to issue certificates for the ALB and ECS tasks, and store database credentials in an Amazon S3 bucket encrypted with SSE-S3. Grant the ECS task role access to the bucket.

Question 14

A company runs a stateless REST API on six Amazon EC2 instances in a single Availability Zone behind a Network Load Balancer (NLB). The API writes uploaded files to a shared POSIX file system that must remain accessible from every instance. The company wants to make the architecture resilient to an Availability Zone failure with the least operational effort. Which solution should a solutions architect recommend?

Accepted Answer

Deploy an Amazon EFS file system with mount targets in at least two Availability Zones, and launch EC2 instances in an Auto Scaling group across those same Availability Zones.. A shared POSIX file system that survives an Availability Zone loss is delivered by Amazon EFS with mount targets in multiple zones, combined with an Auto Scaling group that spans those zones. This is fully managed, requires no replication logic, and keeps the existing Linux application unchanged, which satisfies the resilience goal with the least operational effort.

Answer

Store the files in an Amazon S3 bucket in the same Region and use the AWS CLI to synchronize the bucket to local instance store volumes on each EC2 instance.

Answer

Create an Amazon FSx for Windows File Server file system in one Availability Zone and configure AWS DataSync to copy files to a second file system hourly.

Answer

Attach an Amazon EBS io2 Block Express volume to all six EC2 instances and enable EBS Multi-Attach so every instance reads and writes the same volume.

Question 15

A financial services company is designing a new multi-account landing zone. A central security team must be able to audit all API activity across every account, and each business unit must be prevented from disabling the audit trail. The company uses AWS Organizations with all features enabled. The solutions architect needs a solution that captures management events from all accounts in one place and enforces immutability of the logs. Which combination of actions should the architect take?

Accepted Answer

Create an organization trail in AWS CloudTrail that applies to all accounts, deliver logs to a central S3 bucket, and apply an S3 bucket policy with a Deny for s3:DeleteObject and s3:PutBucketPolicy to all principals except the security account.. An organization trail in CloudTrail applies automatically to all accounts in AWS Organizations and delivers management events to a central S3 bucket. Adding a bucket policy that denies deletion and policy modification to all principals except the security account prevents business units from tampering with the audit logs, satisfying both centralization and immutability requirements.

Answer

Create an individual trail in each account and configure each trail to deliver to a shared S3 bucket; use AWS Config rules to detect deletion of the trails.

Answer

Use AWS Control Tower to create a landing zone and enable the AWS CloudTrail configuration in the security OU; rely on the default CloudTrail trail created by Control Tower for audit.

Answer

Enable AWS CloudTrail Lake in the management account and configure event data stores for each member account; use IAM policies to restrict access to the event data stores.