SAP-C02 Design for New Solutions Practice Test 43 — 15 Questions

Question 1

A financial services firm is migrating a latency-sensitive trading analytics workload to AWS. The workload runs on Amazon EC2 instances in a single VPC and requires network throughput of up to 100 Gbps per instance, consistent sub-100-microsecond inter-instance latency, and the ability to place instances close together to minimize hops. The firm also wants the instances to communicate without traversing the public internet. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an Elastic Fabric Adapter (EFA) to the instances and enable it for the application. Low-latency, high-bandwidth east-west traffic is achieved by combining a cluster placement group, which minimizes physical distance and hops within one Availability Zone, with Elastic Fabric Adapter, which provides OS-bypass networking for tightly coupled workloads. Together they deliver the required per-instance throughput and consistent latency while keeping traffic on the private AWS network.

Answer

Configure a VPC peering connection between the workload VPC and a shared services VPC in another Region

Answer

Deploy the instances into a spread placement group across three Availability Zones

Answer

Enable AWS Global Accelerator with endpoint groups pointing to the instances in multiple Regions

Question 2

A media company is designing a new video transcoding pipeline. Source files are uploaded to an Amazon S3 bucket, and a Lambda function must start an AWS Elemental MediaConvert job for each upload. Transcoding jobs take 20-40 minutes, and the company wants automatic retries with a dead-letter queue for failed job submissions, while avoiding duplicate jobs if the same object is processed twice. Which design meets these requirements?

Accepted Answer

Configure S3 Event Notifications to invoke the Lambda function asynchronously, set MaximumRetryAttempts to 2 and a dead-letter queue on the function, and use the S3 object versionId plus sequencer in the event to deduplicate job submissions in DynamoDB.. S3 event notifications invoke Lambda asynchronously, which is the only invocation mode where MaximumRetryAttempts and on-failure destinations such as a dead-letter queue apply. Because MediaConvert job submission is a short API call, the function finishes well within the Lambda timeout. Deduplication should use immutable S3 event metadata, namely the object versionId and sequencer, to conditionally record each event in DynamoDB so that repeated notifications for the same object version do not start a second transcoding job.

Answer

Configure S3 Event Notifications to invoke the Lambda function synchronously through an Application Load Balancer, and rely on the Lambda function's built-in idempotency token to prevent duplicate MediaConvert jobs.

Answer

Use an S3 Event Notification to send messages to an Amazon SQS FIFO queue, have Lambda poll the queue, and rely on the FIFO message deduplication ID to ensure each S3 object produces exactly one MediaConvert job.

Answer

Enable S3 Event Notifications to invoke a Step Functions state machine that calls Lambda, and configure the state machine with a Retry policy and a Catch block to route failures to an SQS dead-letter queue, using the S3 ETag as the idempotency key.

Question 3

A logistics company is designing a new application that processes shipping manifests. The application runs on Amazon EC2 instances in an Auto Scaling group and must store session state so that users remain logged in if an instance is terminated. The company wants a highly available, low-latency solution with minimal operational overhead. Which solution meets these requirements?

Accepted Answer

Store session state in an Amazon ElastiCache for Redis cluster with Multi-AZ enabled, and configure the application to read and write session data to the cluster.. ElastiCache for Redis with Multi-AZ is purpose-built for low-latency data access and provides automatic failover. By externalizing session state, any EC2 instance in the Auto Scaling group can handle requests, so instance termination does not log users out. AWS manages the cluster, keeping operational overhead low while meeting the high-availability and performance requirements.

Answer

Enable sticky sessions on the Application Load Balancer so that each user is always routed to the same EC2 instance, and store session state locally on that instance.

Answer

Store session state in an Amazon RDS for MySQL Multi-AZ database, and have the application query the database for each request.

Answer

Store session state in an Amazon S3 bucket and have the application read and write the session file for each request.

Question 4

A healthcare company is designing a new application that must store protected health information in Amazon DynamoDB. The compliance team requires that all data be encrypted at rest with a customer-managed AWS KMS key so that key rotation and access can be audited centrally. The application runs on Amazon EC2 instances in a private subnet and must access the table over a private network path. The solutions architect needs to configure encryption and network access. Which combination of steps should the architect take?

Accepted Answer

Create a DynamoDB table with a customer-managed KMS key, and create a gateway VPC endpoint for DynamoDB; attach an endpoint policy that restricts access to the specific table.. Using a customer-managed KMS key for the DynamoDB table meets the compliance requirement for auditable, rotatable encryption. A gateway VPC endpoint for DynamoDB provides private connectivity from the VPC, and an endpoint policy can restrict access to the specific table, satisfying the private network requirement without exposing traffic to the internet.

Answer

Create a DynamoDB table with a customer-managed KMS key, and create an interface VPC endpoint for DynamoDB; attach an endpoint policy allowing access to the table.

Answer

Create a DynamoDB table with a customer-managed KMS key, and configure the application to use the DynamoDB Accelerator (DAX) cluster in the VPC for private access.

Answer

Create a DynamoDB table with an AWS owned key, and create a VPC endpoint for DynamoDB; use the default endpoint policy.

Question 5

A media company is designing a new video transcoding pipeline. Source files are uploaded to an Amazon S3 bucket, and the company wants each upload to trigger processing without managing servers. Jobs can take up to 20 minutes, and the company must be able to retry a failed job without reprocessing successful ones. The operations team wants visibility into which specific uploads failed and the ability to replay only those. The company also wants to decouple the upload event from the worker so that bursts of thousands of simultaneous uploads do not overwhelm the processing tier. Which design should the solutions architect recommend?

Accepted Answer

Configure S3 Event Notifications to send each upload to an Amazon SQS queue, and run workers on Amazon ECS that poll the queue and delete messages only after successful transcoding. The design must buffer unpredictable bursts, support jobs longer than a Lambda invocation, and allow selective replay of only failed uploads. An SQS queue between S3 event notifications and a long-running ECS worker tier satisfies all three: the queue absorbs spikes, workers process at their own pace, and messages are deleted only on success so failures remain individually replayable. This also keeps the pipeline serverless at the ingestion edge without imposing a compute timeout.

Answer

Configure S3 Event Notifications to publish to an Amazon SNS topic that fans out to an AWS Step Functions state machine per upload

Answer

Enable S3 Transfer Acceleration and use S3 Batch Operations to transcode all objects nightly regardless of which uploads succeeded

Answer

Configure S3 Event Notifications to invoke an AWS Lambda function directly for each upload, with a 15-minute timeout and built-in retries

Question 6

A media company is designing a new video processing pipeline. The pipeline must ingest large video files uploaded to Amazon S3, process them using AWS Lambda, and store the output in another S3 bucket. The processing time can vary from a few seconds to over 15 minutes. The company wants a fully serverless, cost-effective solution that can handle sudden spikes in uploads. Which solution should a solutions architect recommend?

Accepted Answer

Use an S3 event notification to send a message to an Amazon SQS queue, then have a Lambda function poll the queue and start an AWS Step Functions state machine to process the video.. The pipeline requires handling variable processing times, including jobs exceeding 15 minutes, and sudden spikes. Using S3 event notifications to enqueue messages in SQS decouples ingestion from processing, and a Lambda function can poll the queue and start a Step Functions state machine. Step Functions can orchestrate long-running workflows and is fully serverless, scaling automatically with demand.

Answer

Configure S3 event notifications to invoke an AWS Lambda function that starts an Amazon ECS task on AWS Fargate to process the video.

Answer

Configure an S3 event notification to trigger a Lambda function directly for each uploaded video file.

Answer

Use an S3 event notification to trigger an AWS Glue job that processes the video and writes the output to S3.

Question 7

A company is designing a new serverless application that processes messages from an Amazon SQS queue. The messages contain sensitive data that must be encrypted at rest. The company wants to use a customer-managed AWS KMS key for encryption and ensure that only the application's Lambda function can decrypt the messages. Which approach should be used?

Accepted Answer

Enable SSE for the SQS queue using a customer-managed KMS key. Grant the Lambda function's execution role kms:Decrypt permission on that key, and ensure the key policy allows the role to use it.. Using server-side encryption with a customer-managed KMS key on the SQS queue allows control over the key policy. The Lambda execution role must be granted kms:Decrypt permission, and the key policy must allow that role. This ensures only the Lambda function can decrypt messages, meeting the security requirements.

Answer

Enable server-side encryption (SSE) for the SQS queue using the default AWS managed key (aws/sqs). The Lambda function's execution role does not need any KMS permissions.

Answer

Use Amazon SQS FIFO queue with content-based deduplication and enable SSE with an AWS managed key. The Lambda function can decrypt messages without additional permissions.

Answer

Store the messages in an Amazon S3 bucket encrypted with a customer-managed KMS key, and have the Lambda function read from S3. Use SQS only for notification.

Question 8

A media company stores millions of video files in an Amazon S3 bucket and serves them to viewers worldwide through Amazon CloudFront. The company recently enabled S3 Block Public Access and now viewers receive access-denied errors. The security team insists the bucket must remain private and no long-term credentials may be embedded in the application. Which solution meets these requirements with the LEAST administrative effort?

Accepted Answer

Create an origin access control (OAC) on the distribution and update the bucket policy to allow the CloudFront service principal to read objects. Origin access control is the current mechanism for letting a CloudFront distribution read from a private S3 bucket. CloudFront signs origin requests with SigV4, and a bucket policy grants access to the CloudFront service principal, so Block Public Access can remain enabled and no static credentials exist anywhere in the application.

Answer

Generate an IAM user with programmatic access and store the access keys in the CloudFront origin configuration

Answer

Replicate the bucket to a second Region and point the CloudFront origin at the replica bucket with public read access

Answer

Disable S3 Block Public Access on the bucket and attach a bucket policy granting s3:GetObject to everyone

Question 9

A company runs a stateless web tier on Amazon EC2 instances behind an Application Load Balancer. Traffic is highly variable, with sharp spikes during flash sales. The company wants the web tier to scale out quickly during spikes and scale in when demand drops, while keeping costs low. Which configuration should a solutions architect recommend?

Accepted Answer

Use an Auto Scaling group with a target tracking scaling policy based on average CPU utilization, and enable the Application Load Balancer health checks.. Variable demand with sharp spikes and a desire for low cost calls for dynamic scaling that follows actual load. Target tracking on average CPU utilization adjusts capacity automatically as utilization moves, adding instances during flash sales and removing them afterward, while ALB health checks keep traffic on healthy targets.

Answer

Use an Auto Scaling group with a simple scaling policy and a cooldown period of 600 seconds.

Answer

Use a larger fixed fleet of EC2 instances sized to handle peak flash-sale traffic at all times, behind the Application Load Balancer.

Answer

Use an Auto Scaling group with a scheduled scaling policy that adds instances every day at a fixed hour.

Question 10

A company is designing a new application that requires a relational database with high availability and automatic failover across multiple Availability Zones. The database must support read-heavy workloads with minimal latency and must be able to scale read capacity independently. The company wants to minimize administrative overhead. Which solution meets these requirements?

Accepted Answer

Amazon Aurora with a Multi-AZ deployment and Aurora Replicas in the same region.. Amazon Aurora is a MySQL- and PostgreSQL-compatible relational database that provides high availability through storage replication across three Availability Zones and automatic failover. Aurora Replicas can serve read-only traffic, enabling independent scaling of read capacity with low latency. It is fully managed, reducing administrative overhead.

Answer

Amazon RDS for PostgreSQL with Multi-AZ and a standby replica that can serve read traffic to offload the primary.

Answer

Amazon DynamoDB with global tables and on-demand capacity mode.

Answer

Amazon RDS for MySQL with a Multi-AZ deployment and a read replica in a different region.

Question 11

A global e-commerce company is designing a new order-processing system that must survive the failure of an entire AWS Region. The system uses an Amazon Aurora MySQL database and must provide a recovery point objective (RPO) of 1 minute and a recovery time objective (RTO) of 5 minutes. The company wants to minimize operational overhead and avoid managing replication instances. Which solution should the solutions architect recommend?

Accepted Answer

Create an Aurora global database with the primary cluster in one Region and a secondary cluster in another Region; configure the application to fail over using the secondary cluster's endpoint.. Aurora global database replicates data across Regions with sub-second typical latency, enabling an RPO well within one minute, and allows a secondary cluster to be promoted in under a minute, meeting the five-minute RTO. Because it is a managed feature with no replication instances to operate, it also minimizes operational overhead.

Answer

Configure Aurora MySQL with a cross-Region read replica using binary log replication, and promote the replica on failure.

Answer

Take automated snapshots of the Aurora cluster and copy them to another Region; restore from the copied snapshot on failure.

Answer

Deploy Aurora MySQL with a Multi-AZ configuration across three Availability Zones in a single Region; rely on automatic failover for disaster recovery.

Question 12

A company is designing a new global web application that will be deployed in multiple AWS Regions. The application must provide low-latency access to users worldwide, and the company wants to minimize operational complexity. The application uses a stateless web tier and a DynamoDB backend. The company needs to ensure that writes in one Region are eventually visible in other Regions. Which solution should a solutions architect recommend?

Accepted Answer

Deploy the web tier in each Region behind an Application Load Balancer, and use DynamoDB global tables for the backend.. DynamoDB global tables automatically replicate data across Regions, providing an active-active multi-Region database with eventual consistency. This allows writes in one Region to be visible in other Regions. Deploying the stateless web tier in each Region behind an ALB ensures low-latency access for users. The combination minimizes operational complexity because replication and failover are managed by AWS.

Answer

Deploy the web tier in each Region and use Amazon RDS for MySQL with cross-Region read replicas for the backend.

Answer

Deploy the web tier in each Region and use DynamoDB Accelerator (DAX) in each Region to replicate data across Regions.

Answer

Deploy the web tier in one Region and use Amazon CloudFront with Lambda@Edge to serve users globally, while using a single DynamoDB table in that Region.

Question 13

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted on multiple Amazon EC2 instances across multiple Availability Zones. The file system must be highly available, durable, and support POSIX permissions. The company wants a fully managed solution. Which AWS service should a solutions architect recommend?

Accepted Answer

Amazon Elastic File System (Amazon EFS).. Amazon Elastic File System (Amazon EFS) is a fully managed, scalable, and elastic NFS file system for Linux-based workloads. It can be mounted on multiple EC2 instances across multiple Availability Zones simultaneously, providing high availability and durability. It supports POSIX permissions and is designed for shared access, making it the correct choice for a legacy application requiring a shared file system.

Answer

Amazon S3 with a file gateway deployed on each EC2 instance.

Answer

Amazon Elastic Block Store (Amazon EBS) with Multi-Attach enabled.

Answer

Amazon FSx for Windows File Server.

Question 14

A company is designing a new application that will store sensitive customer data in Amazon S3. The company must ensure that the data is encrypted at rest and that the encryption keys are rotated automatically every year. The company also wants to audit key usage. Which solution will meet these requirements?

Accepted Answer

Use server-side encryption with AWS KMS customer managed keys (SSE-KMS) and enable automatic key rotation.. Using SSE-KMS with AWS KMS customer managed keys enables automatic annual key rotation and provides audit trails of key usage via AWS CloudTrail. This meets the requirements for encryption at rest, automatic rotation, and auditing. Customer managed keys also allow the company to control access and lifecycle, which is important for sensitive data. Other encryption options either lack auditing, require manual key management, or add unnecessary complexity.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3).

Answer

Use client-side encryption with an AWS KMS customer managed key and store the encrypted data in Amazon S3.

Question 15

A company is designing a new solution that requires a highly available and scalable architecture for a stateless web application. The application will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure that the instances are automatically replaced if they fail health checks and that the application scales based on demand. The company also wants to minimize costs by using a mix of On-Demand and Spot Instances. Which two actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Attach the Auto Scaling group to the ALB target group, and configure the group to use ELB health checks.. Using an Auto Scaling group with a mixed instances policy allows a mix of On-Demand and Spot Instances, reducing costs while maintaining availability. Attaching the group to the ALB target group and using ELB health checks ensures that unhealthy instances are automatically replaced. Together, these actions provide scalability, high availability, and cost optimization.

Answer

Use Spot Fleet with a diversified allocation strategy to launch instances across multiple instance types and Availability Zones.

Answer

Configure a scheduled scaling policy to add instances every hour to handle expected traffic increases.

Answer

Enable termination protection on all EC2 instances to prevent accidental termination.