SAP-C02 Design for New Solutions Practice Test 6 — 15 Questions

Question 1

A company is designing a new microservices-based application on AWS. They want to ensure that services can discover each other dynamically and that traffic can be load balanced across multiple Availability Zones. Which AWS service should they use for service discovery?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Cloud Map. AWS Cloud Map is a cloud resource discovery service that allows microservices to dynamically register their endpoints (IP addresses, ports) and discover each other via DNS or API calls. It integrates with Amazon Route 53 auto-naming and health checks, enabling load-balanced traffic across multiple Availability Zones by returning healthy, available endpoints. This makes it the correct choice for dynamic service discovery in a microservices architecture.

Answer

AWS Service Catalog

Answer

Amazon Route 53 private hosted zones

Answer

AWS Systems Manager Parameter Store

Question 2

A financial services company needs to design a solution for storing sensitive customer data that must be encrypted at rest using a customer-managed key stored in AWS Key Management Service (KMS). The data will be accessed by multiple EC2 instances in an Auto Scaling group. The company needs to rotate the key every 90 days and ensure that old encrypted data can still be decrypted. Which key strategy should they use?

Accepted Answer

Use a customer-managed CMK and generate a new key every 90 days, re-encrypting all data.. It uses a customer-managed CMK with manual rotation every 90 days, which meets the specific rotation requirement. By generating a new key and keeping the old key enabled, old encrypted data remains decryptable. Option C is incorrect because automatic rotation in AWS KMS has a fixed interval of 365 days, which does not satisfy the 90-day rotation requirement.

Answer

Use AWS CloudHSM to generate a key and store it in a hardware security module.

Answer

Use an AWS managed key for S3 and enable automatic rotation.

Answer

Use a customer-managed CMK and enable automatic key rotation.

Question 3

A startup is building a serverless application using AWS Lambda. They need to securely store and retrieve database credentials without hardcoding them in the function code. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and retrieving database credentials and other secrets throughout their lifecycle. It integrates natively with Lambda via the AWS SDK, allowing retrieval of credentials at runtime without hardcoding, and supports automatic rotation of secrets for supported databases like Amazon RDS.

Answer

Amazon DynamoDB

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Systems Manager Parameter Store

Question 4

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to output logs to CloudWatch Logs. Which configuration should be used to send logs from the container to CloudWatch?

Accepted Answer

Use the awslogs log driver in the task definition and specify the log group.. The awslogs log driver is the native, built-in mechanism for Amazon ECS tasks using the Fargate launch type to send container logs directly to CloudWatch Logs. By specifying the 'awslogs' log driver in the task definition and providing the log group name, ECS automatically streams stdout and stderr from the container to the specified CloudWatch log group without requiring any additional agents or infrastructure.

Answer

Install and configure the CloudWatch agent in the container image.

Answer

Output logs to stdout/stderr and use a Lambda function to push them.

Answer

Configure a sidecar container running the CloudWatch agent.

Question 5

A company is designing a multi-region disaster recovery solution for a critical application using Amazon RDS for MySQL. They need a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which solution should they choose?

Accepted Answer

Use Amazon RDS with cross-Region read replicas and promote the replica to a primary instance in a disaster.. Amazon RDS for MySQL cross-Region read replicas use asynchronous replication with a typical lag of less than 5 seconds, meeting the RPO requirement. In a disaster, you promote the replica to a standalone primary instance, which takes under 1 minute, satisfying the RTO. This is the only option that provides both sub-5-second RPO and sub-1-minute RTO for RDS MySQL.

Answer

Use Amazon Aurora Global Database.

Answer

Use Amazon RDS with automated backups and restore in another Region.

Answer

Use Amazon RDS Multi-AZ with a standby in a different AWS Region.

Question 6

A company is building a new web application that will be accessed by users globally. They want to minimize latency and protect against DDoS attacks. Which AWS service should they use as the entry point?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is correct because it is a global content delivery network (CDN) that caches content at edge locations close to users, reducing latency for static and dynamic content. It also provides built-in DDoS protection through AWS Shield Standard and can integrate with AWS WAF for additional layer 7 filtering, making it the ideal entry point for a globally accessed web application requiring both low latency and DDoS mitigation.

Answer

Elastic Load Balancing

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 7

A company is designing a new solution that uses Amazon S3 to store large amounts of archival data. The data must be retained for 7 years and then automatically deleted. Which S3 feature should they use?

Accepted Answer

S3 Lifecycle policies. S3 Lifecycle policies allow you to define rules that automatically expire objects after a specified period, such as 7 years. This directly meets the requirement to retain archival data for a fixed duration and then delete it without manual intervention.

Answer

S3 Replication

Answer

S3 Versioning

Answer

S3 Object Lock

Question 8

A company is migrating a legacy on-premises application to AWS. The application requires a fixed IP address for whitelisting by external partners. The solution must be highly available across multiple Availability Zones. Which design should they use?

Accepted Answer

Use a Network Load Balancer (NLB) with an Elastic IP address.. A Network Load Balancer (NLB) supports static IP addresses via Elastic IPs per Availability Zone, providing a fixed IP for partner whitelisting while maintaining high availability across multiple AZs. Unlike ALBs, NLBs operate at Layer 4 and can preserve the client IP, which is critical for IP-based whitelisting scenarios.

Answer

Use an Application Load Balancer (ALB) with an Elastic IP address.

Answer

Use Amazon Route 53 with a weighted routing policy.

Answer

Use a Classic Load Balancer (CLB) with an Elastic IP address.

Question 9

A company wants to share a large dataset stored in Amazon S3 with a partner who has their own AWS account. The partner needs to access the data using their own account credentials. Which approach should the company use?

Accepted Answer

Grant the partner's AWS account access via a bucket policy.. A bucket policy can grant cross-account access to the partner's AWS account by specifying the partner's AWS account ID as the principal. This allows the partner's IAM users or roles to access the S3 bucket directly using their own credentials, without needing to share access keys or create users in the company's account. The bucket policy must explicitly allow the necessary actions (e.g., s3:GetObject) and the partner must also have an IAM policy that permits the same actions.

Answer

Use S3 cross-region replication.

Answer

Create a pre-signed URL for the partner.

Answer

Provide the partner with an IAM user in the company's account.

Question 10

Which TWO strategies can be used to reduce the cost of Amazon DynamoDB tables for a new application with unpredictable traffic patterns? (Choose two.)

Accepted Answer

Use DynamoDB auto scaling with provisioned capacity.. DynamoDB auto scaling with provisioned capacity automatically adjusts the read and write throughput based on actual traffic patterns, preventing over-provisioning and reducing costs during low-traffic periods. For unpredictable traffic, this avoids paying for unused capacity while still handling spikes within the configured limits.

Answer

Use DynamoDB Streams to reduce write capacity.

Answer

Use DynamoDB global tables for multi-region replication.

Answer

Use DynamoDB Accelerator (DAX) to reduce read capacity.

Question 11

Which THREE factors should be considered when designing a VPC for a new application that must be compliant with the Payment Card Industry Data Security Standard (PCI DSS)? (Choose three.)

Accepted Answer

Encrypt traffic between VPCs using VPN or AWS PrivateLink.. PCI DSS Requirement 4.1 mandates that cardholder data transmitted across open, public networks must be encrypted. Using VPN (IPsec) or AWS PrivateLink ensures that traffic between VPCs is encrypted in transit, meeting this compliance requirement. This approach also avoids exposing data to the public internet.

Answer

Use VPC endpoints to keep traffic within the AWS network.

Answer

Use a single Availability Zone to reduce complexity.

Question 12

Which TWO AWS services can be used to decouple components in a new microservices architecture? (Choose two.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that enables microservices to communicate asynchronously. One service can publish a message to an SNS topic, and multiple subscriber services (e.g., Lambda, SQS, HTTP endpoints) can receive and process that message independently, decoupling the producer from the consumers.

Answer

AWS Direct Connect

Answer

Amazon Route 53

Answer

Amazon ElastiCache

Question 13

A Solutions Architect runs the AWS CLI command shown in the exhibit. Which statement accurately describes the output?

Accepted Answer

The command lists all instances regardless of state.. The AWS CLI command `aws ec2 describe-instances` without any filter returns all EC2 instances in the current region, regardless of their state (running, stopped, terminated, etc.). The `--query` parameter is used correctly to extract specific fields from the JSON output, but it does not filter instances by state. Therefore, the output includes every instance, and option A is correct.

Answer

The command lists instances in JSON format.

Answer

The command lists only running instances.

Answer

The command fails because --query is used incorrectly.

Question 14

A Solutions Architect is reviewing the IAM policy shown in the exhibit. The policy is attached to an IAM user. Which of the following is true about this policy?

Accepted Answer

The policy allows s3:GetObject on example-bucket only from the specified IP range.. The IAM policy uses a `Condition` block with `IpAddress` to restrict the `s3:GetObject` action on `example-bucket` to requests originating from the specified IP range. The `Effect` is `Allow`, so the policy grants the `s3:GetObject` permission only when the source IP matches the condition, effectively limiting access to that range.

Answer

The policy denies access if the source IP is not in the specified range.

Answer

The policy is invalid because the Resource is not specific enough.

Answer

The policy allows all S3 actions on all buckets.

Question 15

A Solutions Architect is reviewing the CloudFormation template snippet shown in the exhibit. What will happen when this template is deployed?

Accepted Answer

The template will create an S3 bucket with versioning enabled.. The CloudFormation template snippet includes the `VersioningConfiguration` property set to `Enabled` within the `AWS::S3::Bucket` resource. This explicitly enables versioning when the stack is deployed. The template also specifies a `BucketName`, so CloudFormation uses that name rather than generating a random one. Option B is incorrect because the bucket name is explicitly provided, not randomly generated. Option C is incorrect because the template will only fail if the bucket name is already taken, but that is not guaranteed. Option D is incorrect because versioning is explicitly enabled.

Answer

The template will create an S3 bucket with a random name.

Answer

The template will fail because the bucket name is not globally unique.

Answer

The template will create an S3 bucket with versioning disabled.