SAP-C02 Design for New Solutions Practice Test 6 — 15 Questions

Question 1

A company is designing a disaster recovery architecture for a critical application. The primary region runs on Amazon EC2 with an RDS database. The recovery time objective (RTO) is 15 minutes, and recovery point objective (RPO) is 1 minute. Which TWO steps should be taken to meet these objectives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure RDS Multi-AZ in the primary region.. Option A is correct because RDS Multi-AZ maintains a synchronous standby replica in a second Availability Zone with automatic failover, which supports an RPO of effectively zero (well within the 1-minute target) and failover typically completes in 1–2 minutes, satisfying the 15-minute RTO for database availability. Option B is correct because Amazon Aurora Global Database replicates data to a secondary region with typical cross-Region replication lag under 1 second, meeting the 1-minute RPO, and it enables a secondary region to be promoted in under a minute, meeting the 15-minute RTO for a true cross-region disaster recovery posture. Option C is not correct because a pre-warmed standby EC2 instance alone does not address database replication or the 1-minute RPO, and pre-warming is not a complete DR solution for the RDS tier. Option D is not correct because hourly snapshots yield an RPO of up to 60 minutes, far exceeding the 1-minute requirement. Option E is not correct because S3 Cross-Region Replication applies to object storage, not to the EC2/RDS application stack, and does not provide the database replication needed to meet the stated RTO and RPO.

Answer

Pre-warm a standby EC2 instance in the DR region.

Answer

Take hourly snapshots of RDS and copy them to the DR region.

Answer

Use Amazon S3 Cross-Region Replication for application data.

Question 2

A company wants to store configuration data for multiple applications securely. Each application runs on Amazon EC2 instances in an Auto Scaling group. The configuration includes database credentials and API keys. Which TWO services should be used together to achieve this?

Accepted Answer

IAM roles for EC2 instances.. Option C (IAM roles for EC2 instances) is correct because attaching an IAM role to the EC2 instances (via an instance profile) provides temporary, automatically rotated credentials through the instance metadata service, allowing the applications to call AWS APIs without embedding long-term access keys. Option E (AWS Systems Manager Parameter Store) is correct because it can store configuration data and secrets such as database credentials and API keys as SecureString parameters encrypted with AWS KMS, and applications on the EC2 instances can retrieve them at runtime using the permissions granted by the IAM role. Together, Parameter Store holds the sensitive configuration and the IAM role authorizes secure, keyless retrieval, which fits applications in an Auto Scaling group where instances are ephemeral. Option A (AWS Secrets Manager) is a valid secret-storage service, but it is not one of the two marked answers for this scenario. Option B (Amazon S3 with bucket policies) is not ideal for storing credentials and API keys, since S3 is object storage and bucket policies alone do not provide secret management features like encryption-focused SecureString parameters or managed rotation. Option D (EC2 user data scripts) is unsuitable because user data is visible in instance metadata and is not a secure mechanism for storing or retrieving secrets.

Answer

AWS Secrets Manager.

Answer

Amazon S3 with bucket policies.

Answer

EC2 user data scripts.

Question 3

Refer to the exhibit. An IAM policy is attached to a user who needs to upload objects to an S3 bucket owned by another AWS account. The uploads are failing with access denied. What is the most likely cause?

Accepted Answer

The upload request does not include the required ACL header.. When an IAM user in Account A uploads objects to an S3 bucket in Account B, the bucket policy must explicitly grant the cross-account principal `s3:PutObject` permission. However, if the bucket is configured to require the `bucket-owner-full-control` canned ACL (or a specific ACL header) for uploaded objects, the request must include that ACL header. Without it, S3 denies the upload even if the IAM policy and bucket policy otherwise allow the action. This is a common requirement when the bucket owner wants to ensure they retain full control of objects uploaded by other accounts.

Answer

The resource ARN is incorrect.

Answer

The bucket policy denies the request.

Answer

The user does not have s3:PutObject permission.

Question 4

Refer to the exhibit. A solutions architect runs this CLI command but receives an error: 'Unknown options: --query'. What is the most likely cause?

Accepted Answer

The AWS CLI version is outdated.. The 'Unknown options: --query' error occurs when the AWS CLI version is outdated and does not recognize the --query parameter. The --query parameter was introduced in AWS CLI version 1.6.0. If the CLI version is older, it will treat --query as an unknown option. While it is true that --query often requires --output for proper formatting, the error for missing --output would be different, not 'Unknown options'. Therefore, the most likely cause is an outdated AWS CLI version.

Answer

The --filters parameter is incorrectly formatted.

Answer

The --query parameter is used without specifying --output.

Answer

The tag value is missing.

Question 5

A company is designing a data lake on AWS using Amazon S3. The data lake will store petabytes of data from various sources. The company needs to query the data using Amazon Athena and Amazon Redshift Spectrum. The data is highly compressed and stored in Parquet format. Which storage class should be used to minimize costs while maintaining immediate query performance?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct choice because it automatically moves data between access tiers (frequent, infrequent, and archive instant retrieval) based on changing access patterns, ensuring that frequently queried data remains in low-latency tiers for immediate query performance with Athena and Redshift Spectrum, while reducing storage costs for data that becomes less active. This is ideal for a petabyte-scale data lake where access patterns are unpredictable or vary over time, as it avoids manual tier management and the retrieval delays of archive classes.

Answer

S3 Standard

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-IA

Question 6

A company is designing a new solution to ingest real-time clickstream data from a website. The data volume varies from 100 to 100,000 events per second. The solution must buffer the data for up to 5 minutes and then deliver it to Amazon S3 for analysis. The company wants to minimize operational overhead and cost. Which service should be used to buffer the data?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed to ingest streaming data, buffer it for configurable durations (up to 15 minutes by default, but easily set to 5 minutes), and automatically deliver it to destinations like Amazon S3. It handles variable data volumes (100 to 100,000 events per second) without requiring manual scaling, minimizing operational overhead and cost compared to alternatives.

Answer

Amazon Kinesis Data Streams

Answer

AWS Lambda

Answer

Amazon SQS

Question 7

A company is designing a multi-region active-active application using Amazon DynamoDB global tables. The application requires strong consistency reads. However, global tables only support eventual consistency. What should the solutions architect do to meet the requirement?

Accepted Answer

Design the application to handle eventual consistency using conditional writes and application logic.. DynamoDB global tables inherently replicate data asynchronously across regions, which means they only support eventual consistency. To meet strong consistency requirements in an active-active multi-region setup, the application must be designed to handle eventual consistency by using conditional writes and application logic to manage conflicts and ensure data integrity. This approach acknowledges the technical limitation of global tables while still achieving the desired consistency level through careful application design.

Answer

Enable strong consistency in the global table configuration.

Answer

Use DynamoDB Streams to replicate data to another region with strong consistency.

Answer

Use DynamoDB Accelerator (DAX) to provide strong consistency reads.

Question 8

A company is designing a new serverless application using AWS Lambda to process high-resolution images uploaded to Amazon S3. Each image can be up to 500 MB. The processing must complete within 5 minutes. What is the MOST cost-effective and scalable design to meet these requirements?

Accepted Answer

Configure S3 event notifications to invoke a Lambda function that processes the image in memory and writes the result to another S3 bucket.. Lambda can directly process images up to 500 MB within its 15-minute timeout (5 minutes is well within limits), and processing in memory avoids the latency and cost of intermediate storage or compute. S3 event notifications invoke Lambda synchronously, making this the most cost-effective and scalable design for serverless image processing.

Answer

Use S3 event notifications to send the image to an Amazon SQS queue, then process it with a Lambda function.

Answer

Use AWS Fargate to run a containerized image processing service triggered by S3 event notifications.

Answer

Use AWS Step Functions to orchestrate a Lambda function and an EC2 instance for processing.

Question 9

A financial services company is designing a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets in any account have server-side encryption enabled using AWS KMS (SSE-KMS) with a customer managed key. Additionally, they want to prevent any S3 bucket from being publicly accessible. What is the MOST efficient and comprehensive way to enforce these policies?

Accepted Answer

Create an SCP that denies s3:PutObject without the x-amz-server-side-encryption-aws:kms header, and another SCP that denies s3:PutBucketPublicAccessBlock with a condition key. Also, use a resource-based policy on the S3 service to block public access.. SCPs can deny the s3:PutObject action unless the x-amz-server-side-encryption-aws:kms header is present, ensuring SSE-KMS is enforced at the API level across all accounts. Additionally, an SCP denying s3:PutBucketPublicAccessBlock with a condition key (e.g., requiring the PublicAccessBlockConfiguration to be fully enabled) prevents any bucket from being made publicly accessible. This approach is comprehensive and efficient as it proactively blocks non-compliant actions before they occur, rather than relying on reactive remediation.

Answer

Use a service control policy (SCP) to deny the s3:PutBucketAcl action that grants public access, and rely on bucket policies to enforce encryption.

Answer

Use AWS Config rules with automatic remediation to enable encryption and block public access on any non-compliant bucket.

Answer

Create an SCP that denies the s3:PutBucketPublicAccessBlock action and attach it to the root OU.

Question 10

A company is designing a disaster recovery architecture for a critical application. The primary region runs on Amazon EC2 with an RDS database. The recovery time objective (RTO) is 15 minutes, and recovery point objective (RPO) is 1 minute. Which TWO steps should be taken to meet these objectives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a cross-Region read replica for the RDS MySQL DB instance. In the DR event, promote the read replica to a standalone instance.. The most cost-effective strategy because a cross-Region read replica for RDS MySQL allows continuous replication with minimal overhead, achieving an RPO of seconds to minutes and an RTO of minutes (promotion time). It avoids the cost of a full Aurora Global Database or the RPO gap from daily snapshots, meeting the 15-minute RPO and 2-hour RTO requirements at lower cost.

Answer

Take daily automated snapshots of the RDS DB instance and copy them to the DR Region. In the DR Region, restore the DB instance from the latest snapshot.

Answer

Use Amazon Aurora Global Database to replicate data across Regions.

Answer

Use AWS Backup to copy backups to the DR Region and set up EC2 Image Builder for application recovery.

Question 11

A company is designing a microservices architecture on Amazon ECS with Fargate. They want to ensure that services can communicate with each other but are isolated from the internet. What is the MOST secure way to achieve this?

Accepted Answer

Place all ECS services in private subnets and use AWS Cloud Map for service discovery.. Placing ECS services in private subnets ensures they have no direct internet access, while AWS Cloud Map provides a secure, DNS-based service discovery mechanism that allows services to communicate internally using private IP addresses. This design eliminates exposure to the internet and leverages AWS's native service discovery for dynamic microservices.

Answer

Use VPC peering to connect the subnets of each service.

Answer

Use AWS PrivateLink to create VPC endpoints for each service.

Answer

Place services in public subnets and use security groups to restrict inbound traffic.

Question 12

A company is designing a data lake on Amazon S3. Data is ingested from various sources, including IoT devices, and must be stored in a cost-effective manner. The data access patterns are unpredictable; some data is accessed frequently for a few days, then rarely accessed. The company wants to minimize storage costs while ensuring data is available within minutes when accessed. Which storage class should they use for the data?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct choice because it automatically moves data between two access tiers (frequent and infrequent access) based on changing access patterns, with no retrieval fees. This matches the unpredictable access pattern described—data accessed frequently for a few days then rarely—while ensuring data is available within minutes (milliseconds latency). It minimizes storage costs by charging lower rates for infrequently accessed data without requiring manual lifecycle management.

Answer

S3 Standard

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-Infrequent Access

Question 13

A company is designing a new application on AWS that uses Amazon API Gateway and AWS Lambda to expose a RESTful API. The API must authenticate requests using OAuth 2.0 with an external identity provider (IdP). The company wants to offload the authentication logic to the API Gateway. Which API Gateway feature should they use?

Accepted Answer

Configure a Lambda authorizer to validate the OAuth 2.0 token.. A Lambda authorizer (formerly known as a custom authorizer) allows API Gateway to call a Lambda function that validates the OAuth 2.0 token (e.g., JWT) from the external IdP. This offloads authentication logic from the backend Lambda to API Gateway, enabling centralized token validation before the request reaches the integration.

Answer

Use API Gateway's WebSocket API.

Answer

Enable API Gateway's VPC Link.

Answer

Use usage plans with API keys.

Question 14

A company is designing a new serverless data processing pipeline that uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The data must be processed using AWS Lambda and then stored in Amazon S3. The company needs to ensure that records are processed in order within each shard and that each record is processed exactly once. Which configuration should they use? (Choose TWO.)

Accepted Answer

Use the Kinesis Client Library (KCL) and implement deduplication logic in the Lambda function.. Option E is correct because setting reserved concurrency to 1 per shard ensures that only one Lambda invocation processes a given shard at a time, which preserves the order of records within that shard as required. Option D is correct because the Kinesis Client Library (KCL) tracks shard processing with checkpointing and provides at-least-once delivery, so implementing deduplication logic in the Lambda function is necessary to achieve exactly-once processing semantics. Option A is not correct because inserting an SQS FIFO queue between Kinesis and Lambda adds unnecessary complexity and does not by itself guarantee exactly-once processing or preserve Kinesis shard ordering end-to-end. Option B is not correct because increasing the batch window only reduces invocation frequency and does not address ordering or exactly-once processing. Option C is not correct because enabling parallelization factor allows multiple Lambda instances to process the same shard concurrently, which can break in-shard ordering.

Answer

Use an Amazon SQS FIFO queue between Kinesis and Lambda to ensure ordering.

Answer

Increase the batch window to reduce the number of Lambda invocations.

Answer

Enable parallelization factor on the Lambda event source mapping.

Question 15

A solutions architect is troubleshooting an issue where an EC2 instance cannot connect to the internet. The output of the describe-instances CLI command is shown in the exhibit. The instance is in a VPC with a public subnet that has a route table with a default route pointing to an internet gateway. The security group allows outbound traffic to 0.0.0.0/0. What is the MOST likely cause of the problem?

Accepted Answer

The instance does not have a public IP address.. The stem states that the subnet has a route table with a default route to an internet gateway, and the security group allows outbound traffic. The exhibit shows describe-instances output, which likely indicates the instance does not have a public IP address. Without a public IP, the instance cannot communicate with the internet even though routing is configured correctly. Option B is correct.

Answer

The subnet's route table does not have a route to the internet gateway.

Answer

The instance is not in a running state.

Answer

The security group is blocking outbound traffic.