SAP-C02 Design for New Solutions Practice Test 7 — 15 Questions

Question 1

A solutions architect is troubleshooting an EC2 instance that is not sending metrics to CloudWatch. The instance is running and has internet connectivity. Based on the exhibit, what is the MOST likely reason?

Accepted Answer

The CloudWatch agent is not installed or running on the instance.. The exhibit shows that monitoring is disabled. Detailed monitoring is required for EC2 metrics at 1-minute frequency, but basic monitoring (5-minute) is enabled by default. However, if the CloudWatch agent is not installed, custom metrics won't be sent. The most likely reason is that the CloudWatch agent is not installed or configured. Option A (no IAM role) is possible but not shown. Option B (security group) is not shown. Option D (wrong region) is unlikely.

Answer

The instance does not have an IAM role that allows sending metrics to CloudWatch.

Answer

The instance's security group is blocking outbound traffic to CloudWatch endpoints.

Answer

The instance is in the wrong AWS region for CloudWatch.

Question 2

A company is designing a new application that will process real-time streaming data from thousands of IoT devices. The data must be ingested, processed with low latency, and stored in Amazon S3 for analytics. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

Amazon Kinesis Data Streams, AWS Lambda, Amazon S3. Amazon Kinesis Data Streams ingests real-time streaming data from thousands of IoT devices with low latency, and AWS Lambda can process each record as it arrives via event source mapping. The processed data is then stored in Amazon S3 for analytics, meeting all requirements for ingestion, low-latency processing, and durable storage.

Answer

Amazon SQS, AWS Lambda, Amazon S3

Answer

Amazon Kinesis Data Firehose, Amazon Redshift, Amazon S3

Answer

Amazon MQ, AWS Lambda, Amazon RDS

Question 3

A company is designing a multi-account AWS environment using AWS Organizations. The security team requires that all Amazon S3 buckets across accounts must have server access logging enabled and must block public access. What is the MOST scalable and secure way to enforce these requirements?

Accepted Answer

Apply service control policies (SCPs) at the organizational unit (OU) level to deny actions that disable logging or enable public access. Option C is correct because SCPs can be applied at the OU level to deny actions that disable logging or allow public access, enforcing compliance across all accounts. Option A is incorrect because IAM roles in each account are not scalable for enforcement. Option B is incorrect because CloudFormation StackSets can deploy resources but cannot prevent non-compliant actions. Option D is incorrect because Config rules only detect non-compliance, not enforce.

Answer

Use AWS CloudFormation StackSets to deploy S3 buckets with logging and public access blocks

Answer

Create IAM roles in each account with policies that require logging and block public access

Answer

Use AWS Config rules to detect non-compliant buckets and send notifications

Question 4

A company is designing a serverless application using AWS Lambda that processes images uploaded to an S3 bucket. The processing time varies but typically completes within 5 minutes. The Lambda function needs to access a VPC-hosted database. What is the BEST way to configure the Lambda function to access the database while minimizing cold start latency?

Accepted Answer

Use an Amazon VPC interface endpoint for Lambda and keep the function outside the VPC. Option B is correct because using a VPC interface endpoint for Lambda avoids placing the function inside the VPC, which eliminates cold start latency due to ENI creation. Option A is incorrect because placing Lambda in the VPC adds cold start delays. Option C is incorrect because RDS Proxy does not eliminate the need for VPC access. Option D is incorrect because a NAT gateway is for outbound internet, not inbound database access.

Answer

Place the Lambda function outside the VPC and use a NAT gateway to reach the database

Answer

Place the Lambda function inside the VPC with a security group allowing access to the database

Answer

Use Amazon RDS Proxy to manage connections and keep Lambda outside the VPC

Question 5

A company is migrating a monolithic application to microservices on Amazon ECS. The application needs to communicate with external partners via HTTPS. The company wants to use mTLS for mutual authentication. Which AWS service should be used to handle the mTLS termination?

Accepted Answer

Application Load Balancer (ALB) with mutual TLS. Option D is correct because Application Load Balancer supports mTLS authentication. Option A is incorrect because CloudFront does not natively support mTLS. Option B is incorrect because Network Load Balancer does not support mTLS. Option C is incorrect because API Gateway supports mTLS only in REST API mode, not HTTP API, and is less suitable for ECS.

Answer

Amazon CloudFront with a custom origin

Answer

Network Load Balancer (NLB) with TLS termination

Answer

Amazon API Gateway HTTP API

Question 6

A company is designing a disaster recovery solution for a critical application running on Amazon EC2. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. The primary region is us-east-1, and the secondary region is us-west-2. Which solution meets the requirements with the LOWEST cost?

Accepted Answer

Use a cross-region read replica in us-west-2 with MySQL asynchronous replication. Option A is correct because a cross-region read replica with MySQL asynchronous replication provides an RPO of seconds to minutes and can be promoted quickly, meeting RTO and RPO at low cost. Option B is incorrect because Database Migration Service is not designed for real-time replication. Option C is incorrect because Multi-AZ is for high availability within a region, not cross-region DR. Option D is incorrect because automated backups have a restore time longer than 15 minutes typically.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to us-west-2

Answer

Use automated backups and restore to us-west-2 when needed

Answer

Use a Multi-AZ deployment in us-east-1 and failover to a standby instance

Question 7

A company wants to design a cost-effective solution to store infrequently accessed log files for 7 years. The logs are generated daily and must be available for retrieval within 24 hours. Which Amazon S3 storage class should be used?

Accepted Answer

S3 Glacier Deep Archive. Option B is correct because S3 Glacier Deep Archive is the lowest-cost storage for long-term archival with retrieval times of 12-24 hours. Option A is incorrect because S3 Standard is for frequently accessed data. Option C is incorrect because S3 Intelligent-Tiering is for unknown access patterns. Option D is incorrect because S3 One Zone-IA is for infrequent access but not long-term archive.

Answer

S3 One Zone-Infrequent Access

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Question 8

A company is designing an event-driven architecture using Amazon EventBridge. They have multiple AWS accounts that need to receive events from a central account. What is the MOST scalable and secure way to route events to these accounts?

Accepted Answer

Use Amazon EventBridge cross-account event buses in each target account. Option D is correct because EventBridge cross-account event buses allow events to be sent directly to event buses in other accounts securely and scalably. Option A is incorrect because SNS topics have limited cross-account capabilities. Option B is incorrect because Kinesis Data Streams is not designed for event routing. Option C is incorrect because Lambda functions would require custom invocation logic.

Answer

Publish events to an AWS Lambda function in each target account

Answer

Use Amazon Kinesis Data Streams with cross-account access

Answer

Create an Amazon SNS topic in the central account and subscribe SQS queues in each target account

Question 9

A company is designing a new application that will run on Amazon EKS. The application requires persistent storage that can be accessed by multiple pods simultaneously. The storage must be highly available and durable. Which storage solution should be used?

Accepted Answer

Amazon EFS with One Zone storage classes. Option C is correct because Amazon EFS provides a shared file system that can be mounted by multiple pods concurrently, with high availability and durability. Option A is incorrect because EBS volumes can only be attached to a single EC2 instance, not multiple pods. Option B is incorrect because S3 is object storage, not file system. Option D is incorrect because FSx for Lustre is optimized for high-performance computing, not general shared storage.

Answer

Amazon EBS with gp3 volume type

Answer

Amazon S3 with Mountpoint for S3

Answer

Amazon FSx for Lustre

Question 10

A company is designing a new web application on AWS. The application must be highly available and scale automatically based on traffic. The architecture includes an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. The application stores session state. What is the BEST way to handle session state to ensure high availability?

Accepted Answer

Store session state in Amazon ElastiCache for Redis. Option A is correct because ElastiCache for Redis provides a highly available, in-memory data store for session state that can be accessed by any instance. Option B is incorrect because storing session state on the instance itself is not fault-tolerant. Option C is incorrect because DynamoDB is a database, not optimized for session state. Option D is incorrect because S3 is object storage, not suitable for session state.

Answer

Store session state in Amazon DynamoDB

Answer

Store session state on the local instance store of each EC2 instance

Answer

Store session state in Amazon S3

Question 11

A company is designing a new data lake on AWS using Amazon S3. The data must be encrypted at rest. Which TWO options comply with the requirement? (Choose TWO.)

Accepted Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3). Options A and D are correct because SSE-S3 and SSE-KMS are both server-side encryption options that encrypt data at rest. Option B is incorrect because client-side encryption is not at rest encryption; it is before sending. Option C is incorrect because SSL/TLS is for data in transit. Option E is incorrect because S3 Access Points do not provide encryption.

Answer

Enable SSL/TLS for all data transfers

Answer

Use S3 Access Points with a bucket policy

Answer

Use client-side encryption before uploading

Question 12

A company is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The API must be secured using AWS WAF. Which TWO actions should the company take to integrate WAF with API Gateway? (Choose TWO.)

Accepted Answer

Associate an AWS WAF web ACL with the API Gateway HTTP API. Options A and D are correct because AWS WAF can be associated with an API Gateway REST API or HTTP API regional endpoint. Option B is incorrect because CloudFront is not required. Option C is incorrect because WAF does not protect Lambda functions directly. Option E is incorrect because WAF does not integrate with API keys.

Answer

Create an AWS WAF web ACL and attach it to the Lambda function

Answer

Configure API Gateway to require an API key and associate WAF with the usage plan

Answer

Place AWS WAF in front of Amazon CloudFront and use CloudFront as the API Gateway endpoint

Question 13

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which THREE mechanisms can be used for service-to-service communication? (Choose THREE.)

Accepted Answer

Amazon API Gateway as a front end. Options A, B, and C are correct because service discovery, ALB, and API Gateway are common patterns for service communication. Option D is incorrect because SQS is for asynchronous messaging, not direct communication. Option E is incorrect because DynamoDB is a database, not a communication mechanism.

Answer

Amazon SQS queues between services

Answer

Amazon DynamoDB as a communication channel

Question 14

Refer to the exhibit. A company has an S3 bucket policy that requires server-side encryption with AES256 for all objects uploaded. However, users can still upload objects without encryption. What is the MOST likely reason?

Accepted Answer

The policy does not deny requests that omit the encryption header. Option C is correct because the policy has a Deny with a condition but also an Allow with the same condition. The Allow statement effectively overrides the Deny because the Deny only applies when encryption is not AES256, but the Allow applies when encryption is AES256. However, the issue is that the Deny statement is not denying all non-compliant uploads because the Allow statement is too permissive. Actually, the correct interpretation: The Deny statement denies PutObject when encryption is not AES256. The Allow statement allows PutObject when encryption is AES256. However, without the Allow, the default is implicit deny. The Allow statement is redundant but not harmful. The problem might be that the policy is missing a condition to also require encryption for existing objects? But the real issue is that the policy does not deny requests that do not include the encryption header at all. The condition "StringNotEquals" only matches when the header is present but not equal to AES256. If no encryption header is present, the condition evaluates to true because the value is not present? Actually, if the header is missing, the condition key does not exist, and the condition evaluates to false. So the Deny does not apply when no encryption header is present. Therefore, users can upload without encryption. Option C correctly identifies this: the policy does not deny requests that omit the encryption header. Option A is incorrect because bucket policy can enforce encryption. Option B is incorrect because the condition is correct. Option D is incorrect because AWS managed keys are not relevant.

Answer

S3 bucket policies cannot enforce encryption; you must use bucket default encryption

Answer

The condition key is incorrect; it should be s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

The policy does not apply to objects uploaded using AWS KMS managed keys

Question 15

Refer to the exhibit. A CloudFormation stack has been deployed with the VPCId and SubnetIds outputs. A developer wants to use these outputs as parameters in another CloudFormation stack. Which AWS service can be used to pass these values to the new stack?

Accepted Answer

CloudFormation cross-stack references using Export and ImportValue. Option B is correct because AWS CloudFormation cross-stack references allow you to export stack outputs and import them into other stacks using the Fn::ImportValue function. Option A is incorrect because Systems Manager Parameter Store can store parameters but is not the native CloudFormation way. Option C is incorrect because Secrets Manager is for secrets. Option D is incorrect because SNS is for notifications.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store