SAP-C02 Design for New Solutions Practice Test 7 — 15 Questions

Question 1

A company has an S3 bucket policy as shown in the exhibit. The bucket 'my-bucket' is owned by account 111111111111. What access does this policy grant to account 123456789012?

Accepted Answer

Full S3 access to the bucket and objects for all IAM users in account 123456789012.. In AWS S3 bucket policies, specifying the root user ARN `arn:aws:iam::123456789012:root` as the principal grants access to all IAM users and roles in that account, not just the root user. The root user ARN is a shorthand for the entire account. Therefore, the policy grants full S3 access to all IAM users in account 123456789012, making option B correct.

Answer

Full S3 access to the bucket and objects for the root user of account 123456789012.

Answer

No access because the root user is not allowed.

Answer

Read-only access to the bucket.

Question 2

A startup needs a serverless compute service to run code in response to S3 events. The code should execute within milliseconds and require no server management. Which AWS service should be used?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that executes code in response to events, such as S3 object creation, with sub-millisecond startup times. It automatically scales and requires no server management, making it ideal for this use case.

Answer

Amazon ECS

Answer

Amazon EC2

Answer

AWS Fargate

Question 3

A company is designing a microservices architecture on ECS with Fargate. Services need to communicate securely within a VPC and be accessible from the internet via an Application Load Balancer. The solution must minimize operational overhead. Which networking configuration should be used?

Accepted Answer

Services in private subnets with a NAT Gateway and an ALB in public subnets.. Placing ECS Fargate services in private subnets ensures they are not directly exposed to the internet, enhancing security. The Application Load Balancer (ALB) in public subnets handles internet-facing traffic and forwards requests to the private services. A NAT Gateway is required for the private services to initiate outbound internet access (e.g., for pulling container images or external dependencies), while the ALB provides inbound connectivity without exposing the services directly. This setup minimizes operational overhead by using AWS-managed components (Fargate, ALB, NAT Gateway) and avoids managing bastion hosts or custom routing.

Answer

Services in private subnets with a VPC endpoint and an NLB.

Answer

Services in a single public subnet with an ALB.

Answer

Services in public subnets with Internet Gateways and an ALB.

Question 4

A company needs to store configuration files for multiple environments (dev, test, prod) and retrieve them programmatically with versioning and access control. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store is the correct choice because it is designed to store configuration data and secrets hierarchically (e.g., /dev/config, /prod/config) with built-in versioning and fine-grained access control via IAM policies. It supports retrieval programmatically through the AWS SDK, CLI, or API, and integrates natively with other AWS services for parameter updates and notifications.

Answer

AWS Secrets Manager

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 5

A company needs to provide temporary credentials for users to access an S3 bucket for exactly 1 hour. The solution must not require any custom code or user management. Which AWS service should be used?

Accepted Answer

AWS STS. AWS STS (Security Token Service) is the correct choice because it can generate temporary, limited-privilege credentials for IAM users or federated users, with a configurable expiration period (up to 1 hour for the default API call). This meets the requirement of providing temporary credentials for exactly 1 hour without requiring custom code or user management, as STS is a managed service that issues credentials via API calls like AssumeRole or GetFederationToken.

Answer

Amazon Cognito identity pools

Answer

An IAM role with a trust policy

Answer

S3 pre-signed URLs

Question 6

A company is designing a new application that requires a highly available and durable NoSQL database. Which TWO services should be considered? (Choose TWO.)

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB (B) is correct because it is a fully managed, serverless NoSQL key-value and document database that automatically replicates data across three Availability Zones within a Region, providing built-in high availability and durability with single-digit millisecond performance at scale. Amazon Keyspaces (for Apache Cassandra) (E) is also correct because it is a fully managed, serverless Apache Cassandra-compatible NoSQL database that replicates data across multiple Availability Zones by default, delivering high availability and durability without managing servers. Amazon DocumentDB (A) is a managed document database but is MongoDB-compatible rather than a general-purpose NoSQL service for this scenario, and it is not marked correct here. Amazon Neptune (C) is a graph database optimized for highly connected data, not the general NoSQL requirement described. Amazon RDS (D) is a relational (SQL) database service, so it does not meet the NoSQL requirement.

Answer

Amazon DocumentDB

Answer

Amazon Neptune

Answer

Amazon RDS

Question 7

A company is designing a new microservices architecture that requires service discovery and API management. Which THREE services can be used together to achieve this? (Choose THREE.)

Accepted Answer

Amazon API Gateway. Amazon API Gateway (B) is correct because it provides the API management layer — REST/HTTP/WebSocket APIs, throttling, authentication, and routing to backend microservices. Application Load Balancer (C) is correct because it performs Layer 7 load balancing and can route requests to microservice targets such as ECS tasks, EKS pods, Lambda, or IP targets, supporting service discovery integration. AWS Cloud Map (E) is correct because it is the service discovery service that lets microservices register instances and discover each other via DNS or API calls, which is exactly what a microservices architecture needs. Amazon Route 53 (A) is a DNS service and can support service discovery via records, but it is not the purpose-built service discovery mechanism for microservices in this scenario. Amazon VPC Lattice (D) is a service networking service that can provide connectivity and routing, but it is not one of the three services intended here for combined service discovery and API management.

Answer

Amazon Route 53

Answer

Amazon VPC Lattice

Question 8

A developer runs the above AWS CLI command. What is the expected output?

Accepted Answer

A list of instance IDs for running web-server instances. The AWS CLI command uses `describe-instances` with a `--filters` parameter to select only instances with a tag `Name=web-server` and a state of `running`. The `--query` parameter then extracts the `InstanceId` values from the result. Therefore, the output is a list of instance IDs for running web-server instances, making option B correct.

Answer

A list of public IP addresses

Answer

All instance IDs regardless of state

Answer

An error because the query syntax is incorrect

Question 9

An S3 bucket is created using the above CloudFormation template. What happens to objects in the bucket after 30 days?

Accepted Answer

Objects are permanently deleted. The CloudFormation template defines a lifecycle rule with an expiration action that deletes objects after 30 days. Since no prefix is specified, the rule applies to all objects in the bucket. After 30 days, objects are permanently deleted, not transitioned to another storage class.

Answer

Objects are transitioned to Glacier

Answer

The lifecycle rule is not applied because no prefix is specified

Answer

Objects are archived to S3 Standard-IA

Question 10

A company is migrating a legacy monolithic application to AWS. The application currently runs on a single server and uses a MySQL database. The company wants to decouple the application into microservices while minimizing changes to the existing code. Which design approach is MOST cost-effective and requires the least code changes?

Accepted Answer

Use AWS App Runner for the existing application and add new microservices as separate App Runner services with a sidecar pattern. AWS App Runner allows you to run the existing monolithic application with minimal code changes by simply pointing it at a container image or source code, while new microservices can be added as separate App Runner services. The sidecar pattern enables you to attach auxiliary processes (e.g., logging, monitoring) without modifying the core application code, making this the most cost-effective and least disruptive approach for decoupling into microservices.

Answer

Deploy the application on AWS Elastic Beanstalk and use Amazon RDS for MySQL

Answer

Refactor the application into AWS Lambda functions using an API Gateway

Answer

Containerize the application using Docker and run it on Amazon ECS with AWS Fargate, using Amazon RDS for MySQL

Question 11

A company is designing a data lake on AWS using Amazon S3. The data lake will store sensitive customer data that must be encrypted at rest. The company requires that the encryption keys be managed by the company's own hardware security module (HSM) and rotated every 90 days. Which solution meets these requirements?

Accepted Answer

Use client-side encryption with keys stored in AWS CloudHSM and rotate the keys using CloudHSM key rotation. The company requires encryption keys to be managed by its own HSM and rotated every 90 days. AWS CloudHSM provides a dedicated HSM appliance that the customer fully controls, and client-side encryption ensures that the encryption keys never leave the customer's HSM environment. The customer can implement key rotation within CloudHSM using its native key management capabilities, meeting both the HSM control and 90-day rotation requirements.

Answer

Use SSE-S3 (Amazon S3 managed keys) and configure a lifecycle policy to re-encrypt objects every 90 days

Answer

Use SSE-KMS with a customer managed key and configure automatic key rotation every 90 days

Answer

Use SSE-C (customer-provided keys) and provide the key with each PUT request, rotating the key every 90 days

Question 12

A company is designing a serverless application that processes images uploaded to an S3 bucket. The processing must be asynchronous and can take up to 15 minutes per image. Which AWS service should be used to trigger the processing?

Accepted Answer

Configure S3 Event Notifications to send an event to an Amazon SQS queue, which is polled by an AWS Lambda function. S3 Event Notifications can asynchronously deliver events to an SQS queue, and an AWS Lambda function can poll that queue. This decouples the processing from the S3 upload, allowing the Lambda function to handle the 15-minute processing limit asynchronously without timing out, since Lambda's maximum execution time is 15 minutes.

Answer

Configure S3 Event Notifications to publish a message to an Amazon SNS topic, which triggers an AWS Lambda function

Answer

Configure S3 Event Notifications to invoke an AWS Lambda function synchronously

Answer

Use Amazon EventBridge to capture S3 events and trigger an AWS Step Functions workflow

Question 13

A company is deploying a web application on AWS. The application requires a relational database with read replicas for scaling read queries. The database must support automatic failover and be Multi-AZ. Which database solution meets these requirements?

Accepted Answer

Amazon Aurora with Multi-AZ and Aurora Replicas. Amazon Aurora with Multi-AZ and Aurora Replicas (Option B) is the correct choice because it provides a single integrated solution where Aurora Replicas serve as both read replicas for scaling read queries and automatic failover targets. In contrast, Amazon RDS for MySQL with Multi-AZ and Read Replicas (Option D) uses a separate Multi-AZ standby for failover and read replicas that are not automatically promoted; while it technically meets the individual requirements, it does not provide the combined failover and read scaling within the same tier, making Aurora the preferred solution. Option A is a NoSQL database, not relational. Option C is a caching service, not a relational database.

Answer

Amazon DynamoDB with global tables

Answer

Amazon ElastiCache for Redis with replication groups

Answer

Amazon RDS for MySQL with Multi-AZ and Read Replicas

Question 14

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which approach provides the BEST security and performance?

Accepted Answer

Use AWS App Mesh for service-to-service communication with mutual TLS. AWS App Mesh provides a service mesh that enables secure, encrypted service-to-service communication using mutual TLS (mTLS), which authenticates both sides of the connection and encrypts traffic in transit. It also offers observability, traffic control, and retry logic at the application layer, making it the best choice for microservices on ECS Fargate where security and performance are critical.

Answer

Use VPC peering between the services' VPCs

Answer

Use an internet-facing Application Load Balancer for each service

Answer

Use an internal Network Load Balancer for each service

Question 15

A company is designing a disaster recovery (DR) strategy for a critical application. The application runs on EC2 instances in a single AWS Region. The company needs a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which TWO strategies meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon DynamoDB global tables for the database and deploy EC2 instances in a warm standby configuration in another Region. Amazon DynamoDB global tables provide automatic, asynchronous replication across multiple AWS Regions with an RPO of typically less than 1 second, easily meeting the 15-minute RPO. Combined with a warm standby configuration of EC2 instances in the secondary Region, you can quickly fail over within the 2-hour RTO using Route 53 or other DNS mechanisms. Option C is incorrect because Application Load Balancers (ALBs) are regional in scope and do not support cross-Region load balancing. ALB cannot directly route traffic to targets in another Region, so the described architecture would not achieve cross-Region failover as intended. Options A and B involve replication mechanisms (S3 CRR and EBS snapshots) that cannot guarantee the 15-minute RPO due to asynchronous delays and manual recovery steps. Option E describes an Active-Passive configuration within the same Region, which does not provide disaster recovery across Regions.

Answer

Use S3 Cross-Region Replication for application data and launch EC2 instances from AMIs copied to the secondary Region

Answer

Take hourly snapshots of EBS volumes and copy them to another Region; use AWS CloudFormation to launch instances from the snapshots

Answer

Use Amazon Aurora Global Database for the database and deploy EC2 instances with an Application Load Balancer that has cross-Region load balancing enabled

Answer

Configure an Active-Passive failover using Route 53 with health checks within the same Region