SAP-C02 Design for New Solutions Practice Test 5 — 15 Questions

Question 1

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without direct coupling. Which AWS service should they use to decouple the services?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon SQS. Amazon SQS is the correct choice because it provides a fully managed message queue that enables asynchronous communication between microservices, allowing them to send, store, and receive messages without direct coupling. Services can poll or receive messages from the queue at their own pace, ensuring that the producer and consumer are decoupled and can operate independently, even if one is temporarily unavailable.

Answer

AWS Step Functions

Answer

Amazon SNS

Answer

Amazon Kinesis

Question 2

A financial services company needs to store sensitive customer data in Amazon S3 with encryption at rest. They require that the encryption keys be stored in AWS CloudHSM and that the S3 bucket must not be able to access the keys without explicit permission. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) is correct because it allows the customer to supply their own encryption keys, which can be stored in AWS CloudHSM, and S3 will use those keys to encrypt data at rest. With SSE-C, the customer manages the keys outside of AWS, and S3 cannot access the keys without explicit permission because the keys are provided per request and not stored by AWS. This meets the requirement of storing keys in CloudHSM and ensuring S3 has no independent access to them.

Answer

SSE-S3

Answer

Client-side encryption

Answer

SSE-KMS

Question 3

A startup is building a serverless application using AWS Lambda. They need to store session state that can be shared across multiple Lambda invocations. Which AWS service should they use?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice because it provides a low-latency, in-memory data store that can be shared across multiple Lambda invocations. Redis supports data structures like strings, hashes, and lists, making it ideal for storing session state that needs to be accessed and updated quickly by concurrent serverless functions.

Answer

Amazon S3

Answer

Amazon DynamoDB

Answer

Amazon CloudFront

Question 4

A company is designing a multi-tier web application on AWS. They want to ensure that the web tier can scale automatically based on CPU utilization. Which AWS service should they use?

Accepted Answer

Auto Scaling groups. Auto Scaling groups (Option C) are the correct service because they directly manage the automatic scaling of EC2 instances based on defined policies, such as a target CPU utilization threshold. When CPU utilization exceeds the threshold, the Auto Scaling group launches new instances to handle the load, and it terminates instances when utilization drops, ensuring the web tier scales automatically.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

Elastic Load Balancing

Question 5

A company is migrating a legacy monolithic application to AWS. They want to refactor the application into microservices and use container orchestration. Which AWS service should they use to manage the containers?

Accepted Answer

Amazon EKS. Amazon EKS (Elastic Kubernetes Service) is the correct choice because the company is migrating a legacy monolithic application to microservices and requires container orchestration. EKS provides a managed Kubernetes control plane, which is the industry-standard platform for automating deployment, scaling, and management of containerized applications, making it ideal for refactoring into microservices.

Answer

AWS Lambda

Answer

Amazon ECS

Answer

AWS Fargate

Question 6

A company needs to provide a global content delivery solution with low latency. Which AWS service should they use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a global content delivery network (CDN) that caches content at edge locations worldwide, reducing latency by serving data from the nearest edge to the user. It integrates with origins like S3, EC2, or on-premises servers and supports both static and dynamic content acceleration, making it the correct choice for low-latency global delivery.

Answer

Amazon S3

Answer

Amazon EC2

Answer

Amazon Route 53

Question 7

A company is designing a data lake on AWS using Amazon S3. They need to run SQL queries on the data without moving it to a separate database. Which AWS service should they use?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless, interactive query service that allows you to run standard SQL queries directly against data stored in Amazon S3 without needing to move or transform the data. It uses Presto under the hood and charges only for the data scanned per query, making it ideal for ad-hoc SQL analysis on a data lake.

Answer

Amazon EMR

Answer

Amazon Redshift

Answer

AWS Glue

Question 8

A company is designing a disaster recovery solution for a critical database using Amazon RDS Multi-AZ. However, they also need to protect against regional failures. Which additional AWS service should they use?

Accepted Answer

RDS Cross-Region Read Replicas. RDS Multi-AZ provides high availability within a single region by synchronously replicating data to a standby instance in a different Availability Zone. To protect against a regional failure, you need a cross-region disaster recovery solution. RDS Cross-Region Read Replicas asynchronously replicate data to a different AWS Region, allowing you to promote the replica to a standalone primary database in the event of a regional outage.

Answer

RDS Multi-AZ in the same region

Answer

Amazon S3

Answer

AWS Database Migration Service

Question 9

A company wants to implement a serverless architecture where an AWS Lambda function is triggered whenever a new object is uploaded to an S3 bucket. Which S3 feature should they use?

Accepted Answer

S3 Event Notifications. S3 Event Notifications allow you to configure S3 to publish events (e.g., s3:ObjectCreated:Put) to AWS Lambda, SQS, or SNS whenever an object is uploaded. This is the native serverless integration that triggers a Lambda function directly from S3 without polling or custom code.

Answer

S3 Object Lock

Answer

S3 Transfer Acceleration

Answer

S3 Inventory

Question 10

A company is designing a new application on AWS that requires a highly available and fault-tolerant architecture. Which TWO design principles should they follow?

Accepted Answer

Use Auto Scaling groups to automatically replace unhealthy instances.. Auto Scaling groups can automatically replace unhealthy EC2 instances by performing health checks and launching new instances to maintain desired capacity, which is a core principle of fault-tolerant design. Option B is correct because deploying across multiple Availability Zones ensures that if one AZ fails, the application continues to operate from another AZ, providing high availability and fault tolerance.

Answer

Manually create EBS snapshots every day.

Answer

Store data in a single Amazon S3 bucket in one Region.

Answer

Use a single large EC2 instance to simplify management.

Question 11

A company is building a serverless application using AWS Lambda and Amazon API Gateway. They need to authenticate users. Which TWO services can be used for authentication?

Accepted Answer

AWS IAM. AWS IAM is correct because it can be used to authenticate users by attaching IAM authorization to API Gateway, allowing the API to verify the caller's identity via AWS Signature Version 4 signing. This is commonly used for machine-to-machine or internal service calls where the caller has AWS credentials.

Answer

AWS Security Token Service

Answer

Amazon SQS

Answer

Amazon CloudFront

Question 12

A company is designing a new system that will use Amazon S3 to store sensitive data. Which THREE methods can be used to encrypt data at rest in S3?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) is correct because it allows you to encrypt data at rest in S3 using your own encryption keys, which you manage outside of AWS. You provide the encryption key as part of your PUT request, and S3 uses it to encrypt the object before writing it to disk, then discards the key from memory. This method gives you full control over the key lifecycle while still leveraging S3's server-side encryption infrastructure.

Answer

Client-side encryption

Answer

AWS IAM

Question 13

An administrator runs the above commands on an S3 bucket. What is the effect of these configurations on an object uploaded to the bucket?

Accepted Answer

Objects cannot be deleted or overwritten for 365 days unless special permissions are granted.. The configuration shown enables S3 Object Lock in governance mode with a retention period of 365 days. In governance mode, an object cannot be deleted or overwritten until the retention period expires, unless the user has special permissions such as s3:BypassGovernanceRetention. This is why option C is correct: objects cannot be deleted or overwritten for 365 days unless special permissions are granted.

Answer

Objects are locked indefinitely until the lock is manually removed.

Answer

Objects can be deleted immediately because versioning is enabled.

Answer

Objects can be deleted only by the root user.

Question 14

An IAM policy attached to an S3 bucket is shown. What is the net effect on requests to read objects from the bucket?

Accepted Answer

Only requests using HTTPS from the IP range 192.0.2.0/24 are allowed.. The IAM policy includes a Deny statement that blocks all requests unless they use HTTPS and originate from the 192.0.2.0/24 IP range. The Allow statement grants read access to the bucket, but the Deny with a condition (aws:SecureTransport and aws:SourceIp) explicitly overrides the Allow for requests that do not meet both conditions. Therefore, only HTTPS requests from the specified IP range are permitted, making option C correct.

Answer

All HTTPS requests from any IP are allowed.

Answer

Only requests using HTTPS from any IP are allowed because the Deny is overridden.

Answer

All requests from the IP range 192.0.2.0/24 are allowed, regardless of protocol.

Question 15

An administrator runs the above commands and observes the outputs. The instance is in a public subnet with an internet gateway. What is the most likely issue preventing users from accessing the web server?

Accepted Answer

The security group allows HTTP only from the IP range 203.0.113.0/24.. Security groups are stateful: if inbound HTTP traffic is allowed, the corresponding outbound response traffic is automatically allowed, regardless of outbound rules. Therefore, missing outbound rules cannot prevent responses. The most likely issue is that the security group only allows HTTP from the IP range 203.0.113.0/24. Users outside that range will be blocked, even though the instance is in a public subnet with an internet gateway.

Answer

The security group allows SSH from a restricted IP, but not from the users.

Answer

The security group does not allow outbound traffic, so responses cannot be sent.

Answer

The security group does not allow inbound HTTP traffic.