SAP-C02 Design for New Solutions Practice Test 8 — 15 Questions

Question 1

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data includes sensitive customer information that must be encrypted at rest. The company also needs to regularly rotate the encryption keys. Which solution meets these requirements with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation in KMS.. SSE-KMS with automatic key rotation provides encryption at rest with minimal operational overhead. AWS KMS automatically rotates the customer master key (CMK) annually, and you can configure a custom rotation period (e.g., 90 days) if needed. This meets the requirement for regular key rotation without manual intervention, unlike SSE-S3 which does not support key rotation, and SSE-C which requires manual key management.

Answer

Use server-side encryption with S3 managed keys (SSE-S3) and enable S3 bucket key rotation.

Answer

Implement client-side encryption using the AWS Encryption SDK and store keys in AWS Secrets Manager.

Answer

Use server-side encryption with customer-provided keys (SSE-C) and rotate keys manually.

Question 2

A media company is building a video transcoding pipeline using AWS Elemental MediaConvert. The source videos are uploaded to an S3 bucket, and the transcoded outputs are stored in another S3 bucket. The company wants to trigger the transcoding job as soon as a new video is uploaded. The pipeline must handle high volumes of uploads and ensure that no upload is missed. Which solution is MOST reliable and scalable?

Accepted Answer

Configure an S3 event notification to directly invoke an AWS Lambda function that starts the MediaConvert job.. S3 event notifications can directly invoke a Lambda function with minimal latency and no intermediate components, making it the simplest and most reliable way to trigger MediaConvert jobs for each upload. S3 event notifications are designed to deliver events with at-least-once delivery semantics, ensuring no upload is missed even under high volumes. This direct integration avoids additional failure points like SNS or SQS, which could introduce delays or require extra configuration for scaling.

Answer

Configure an S3 event notification to publish to an Amazon SNS topic, which triggers an AWS Lambda function that starts the MediaConvert job.

Answer

Use Amazon EventBridge to detect S3 PUT events and route them to a Lambda function.

Answer

Configure an S3 event notification to send events to an Amazon SQS queue, and have a Lambda function poll the queue and start MediaConvert jobs.

Question 3

A company is deploying a web application on AWS that requires a relational database. The application is read-heavy and expects sudden spikes in traffic. The database must be highly available and perform well under load. Which database configuration meets these requirements?

Accepted Answer

Deploy Amazon RDS in a Multi-AZ configuration and use read replicas to offload read traffic.. It combines Multi-AZ deployment for high availability with read replicas to offload read traffic, addressing both the read-heavy workload and sudden traffic spikes. Multi-AZ ensures automatic failover to a standby instance in a different Availability Zone if the primary fails, while read replicas distribute read queries across multiple copies, reducing load on the primary database and improving performance under spike conditions.

Answer

Use Amazon ElastiCache for Memcached as the primary database.

Answer

Deploy Amazon RDS in a Multi-AZ configuration without read replicas.

Answer

Deploy Amazon RDS in a single Availability Zone with a large instance size.

Question 4

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to store persistent data that must be shared across multiple containers in the same task. Which storage option should the company use?

Accepted Answer

Amazon EFS file system. Amazon EFS provides a shared, persistent, and scalable NFS file system that can be mounted concurrently by multiple containers within the same ECS task using Fargate. EFS supports the NFSv4.1 protocol, enabling simultaneous read/write access from multiple containers, which meets the requirement for shared persistent storage across containers in the same task.

Answer

Amazon S3 bucket mounted using s3fs

Answer

Amazon FSx for Lustre

Answer

Amazon EBS volume

Question 5

A company is designing a multi-region disaster recovery solution for a critical application. The application uses Amazon RDS for MySQL with Multi-AZ in the primary region. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 1 minute. Which solution meets these requirements?

Accepted Answer

Use Amazon Aurora Global Database with a primary instance in the primary region and one secondary in the secondary region.. Amazon Aurora Global Database is the only solution that can achieve an RPO of 5 seconds and an RTO of 1 minute for a multi-region disaster recovery setup. It uses storage-based replication with typical latency under 1 second, and failover to a secondary region can be completed in about 1 minute by promoting the secondary cluster. Aurora Global Database also avoids the replication lag and promotion delays inherent in cross-region read replicas or DMS-based replication.

Answer

Create an RDS MySQL cross-region read replica in the secondary region and promote it during a disaster.

Answer

Take manual snapshots of the RDS instance every 5 seconds and copy them to the secondary region.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate to a database in the secondary region.

Question 6

A company wants to give its developers access to specific Amazon S3 buckets based on their team membership. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which approach should the company use to grant fine-grained access?

Accepted Answer

Create an IAM policy that allows access to specific buckets based on tags, and assign the policy to an IAM role that developers can assume.. It uses IAM roles with tag-based policies, which integrate with AWS IAM Identity Center via attribute-based access control (ABAC). Developers assume the role after authenticating through Identity Center, and the policy dynamically grants access to S3 buckets matching their team tags, enabling fine-grained, scalable permissions without managing individual users or groups.

Answer

Create separate IAM groups for each team and attach policies granting access to the appropriate buckets.

Answer

Use resource-based policies on the buckets to allow access from the IAM Identity Center users.

Answer

Use S3 bucket policies that grant access to specific IAM users based on their usernames.

Question 7

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to implement service discovery and load balancing at the application layer. Which TWO services should the company use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is correct because it provides service discovery for microservices by allowing services to register their DNS names and health checks, enabling dynamic routing between ECS Fargate tasks. Application Load Balancer (ALB) is correct because it operates at Layer 7 (application layer), supporting HTTP/HTTPS traffic, path-based routing, and integration with ECS for load balancing across Fargate tasks.

Answer

Amazon API Gateway

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53

Question 8

A company is building a data analytics pipeline. Raw data is ingested into an Amazon S3 bucket. The data must be transformed and loaded into Amazon Redshift for analysis. The pipeline must handle late-arriving data and ensure data consistency. Which THREE AWS services should the company use?

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can be triggered by S3 events to process late-arriving data in near real-time, transforming and loading it into Amazon Redshift. Lambda's serverless nature allows it to handle variable data arrival patterns without managing infrastructure, ensuring data consistency through idempotent processing logic.

Answer

Amazon Kinesis Data Analytics

Answer

Amazon EMR

Question 9

A company is designing a cost-effective architecture for a batch processing job that runs nightly. The job can tolerate interruptions and requires significant compute power for a few hours. The company wants to minimize costs. Which TWO strategies should the company use?

Accepted Answer

Use Spot Instances for compute.. Spot Instances (Option A) are ideal for this batch processing job because the job can tolerate interruptions and requires significant compute power for only a few hours nightly. Spot Instances offer up to 90% cost savings compared to On-Demand Instances by leveraging unused AWS EC2 capacity, making them the most cost-effective choice for fault-tolerant, time-flexible workloads.

Answer

Purchase Reserved Instances (RI) for a 1-year term.

Answer

Use On-Demand Instances to ensure availability.

Answer

Use Dedicated Hosts for compliance.

Question 10

An organization has deployed the above CloudFormation template. They want to ensure that all uploads to the bucket are encrypted in transit. However, users are still able to upload objects over unencrypted HTTP. What is the MOST likely reason?

Accepted Answer

The condition operator should be 'BoolIfExists' instead of 'Bool' to handle cases where the 'aws:SecureTransport' key is not present in the request.. The condition key 'aws:SecureTransport' may not be present in all requests (e.g., anonymous requests or certain SDK versions). Using 'Bool' will cause the policy to evaluate to false when the key is missing, allowing unencrypted uploads. 'BoolIfExists' returns true if the key does not exist, effectively blocking requests without the key, which enforces encryption in transit more robustly.

Answer

The 'aws:SecureTransport' condition key is misspelled; it should be 'aws:SecureTransport' with a capital T.

Answer

The bucket policy is missing an 'Allow' statement for HTTPS requests.

Answer

The resource ARN should be 'arn:aws:s3:::my-unique-bucket-123' without the '/*' to cover PutObject actions.

Question 11

A solutions architect is troubleshooting an EC2 instance that is not sending metrics to CloudWatch. The instance is running and has internet connectivity. Based on the exhibit, what is the MOST likely reason?

Accepted Answer

The CloudWatch agent is not installed or running on the instance.. The exhibit shows an EC2 instance that is running and has internet connectivity, but metrics are not being sent to CloudWatch. For custom metrics (such as memory or disk utilization) to be published, the CloudWatch agent must be installed and running on the instance. Without the agent, the instance cannot collect and send operating-system-level metrics, even if network connectivity and IAM permissions are correctly configured.

Answer

The instance does not have an IAM role that allows sending metrics to CloudWatch.

Answer

The instance's security group is blocking outbound traffic to CloudWatch endpoints.

Answer

The instance is in the wrong AWS region for CloudWatch.

Question 12

A company is designing a new application that will process real-time streaming data from thousands of IoT devices. The data must be ingested, processed with low latency, and stored in Amazon S3 for analytics. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

Amazon Kinesis Data Streams, AWS Lambda, Amazon S3. Amazon Kinesis Data Streams ingests real-time streaming data from thousands of IoT devices with low latency, and AWS Lambda can process each record as it arrives via event source mapping. The processed data is then stored in Amazon S3 for analytics, meeting all requirements for ingestion, low-latency processing, and durable storage.

Answer

Amazon SQS, AWS Lambda, Amazon S3

Answer

Amazon Kinesis Data Firehose, Amazon Redshift, Amazon S3

Answer

Amazon MQ, AWS Lambda, Amazon RDS

Question 13

A company is designing a multi-account AWS environment using AWS Organizations. The security team requires that all Amazon S3 buckets across accounts must have server access logging enabled and must block public access. What is the MOST scalable and secure way to enforce these requirements?

Accepted Answer

Apply service control policies (SCPs) at the organizational unit (OU) level to deny actions that disable logging or enable public access. Service control policies (SCPs) at the OU level are the most scalable and secure way to enforce guardrails across all accounts in an AWS Organization. By denying actions that disable server access logging (e.g., s3:PutBucketLogging with a condition that the logging target is not set) and actions that enable public access (e.g., s3:PutBucketPublicAccessBlock with a condition that the block is not set to true), SCPs prevent non-compliant configurations from being created or modified, regardless of the IAM principal used. This approach is centralized, immutable by child accounts, and scales automatically as new accounts are added to the OU.

Answer

Use AWS CloudFormation StackSets to deploy S3 buckets with logging and public access blocks

Answer

Create IAM roles in each account with policies that require logging and block public access

Answer

Use AWS Config rules to detect non-compliant buckets and send notifications

Question 14

A company is designing a serverless application using AWS Lambda that processes images uploaded to an S3 bucket. The processing time varies but typically completes within 5 minutes. The Lambda function needs to access a VPC-hosted database. What is the BEST way to configure the Lambda function to access the database while minimizing cold start latency?

Accepted Answer

Use an Amazon VPC interface endpoint for Lambda and keep the function outside the VPC. Using an Amazon VPC interface endpoint for Lambda allows the function to remain outside the VPC while securely accessing resources inside the VPC via AWS PrivateLink. This avoids the cold start latency penalty (often 10+ seconds) incurred when attaching a Lambda function to a VPC, which requires Elastic Network Interface (ENI) creation. The function can directly invoke the database through the interface endpoint without traversing the public internet or needing a NAT gateway.

Answer

Place the Lambda function outside the VPC and use a NAT gateway to reach the database

Answer

Place the Lambda function inside the VPC with a security group allowing access to the database

Answer

Use Amazon RDS Proxy to manage connections and keep Lambda outside the VPC

Question 15

A company is migrating a monolithic application to microservices on Amazon ECS. The application needs to communicate with external partners via HTTPS. The company wants to use mTLS for mutual authentication. Which AWS service should be used to handle the mTLS termination?

Accepted Answer

Application Load Balancer (ALB) with mutual TLS. Application Load Balancer (ALB) supports mutual TLS (mTLS) natively by configuring a trust store on the listener that validates client certificates against a Certificate Authority (CA) bundle you upload. This allows the ALB to terminate the HTTPS connection and perform client certificate authentication before forwarding traffic to the ECS service, meeting the requirement for mTLS termination without custom proxy logic.

Answer

Amazon CloudFront with a custom origin

Answer

Network Load Balancer (NLB) with TLS termination

Answer

Amazon API Gateway HTTP API