SAP-C02 Design for New Solutions Practice Test 9 — 15 Questions

Question 1

A company is designing a disaster recovery solution for a critical application running on Amazon EC2. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. The primary region is us-east-1, and the secondary region is us-west-2. Which solution meets the requirements with the LOWEST cost?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a cross-region read replica in us-west-2 with MySQL asynchronous replication. A cross-region read replica in us-west-2 with MySQL asynchronous replication meets the RPO of 1 hour and RTO of 15 minutes at the lowest cost. Asynchronous replication provides near-real-time data transfer with minimal overhead, and the read replica can be promoted to a standalone primary instance in minutes, satisfying the RTO. This approach avoids the continuous data transfer costs of DMS and the storage costs of Multi-AZ, while automated backups alone cannot meet the RPO.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to us-west-2

Answer

Use automated backups and restore to us-west-2 when needed

Answer

Use a Multi-AZ deployment in us-east-1 and failover to a standby instance

Question 2

A company wants to design a cost-effective solution to store infrequently accessed log files for 7 years. The logs are generated daily and must be available for retrieval within 24 hours. Which Amazon S3 storage class should be used?

Accepted Answer

S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is the most cost-effective storage class for infrequently accessed data that must be retained for 7 years, with retrieval times of up to 12 hours (within the 24-hour requirement). It offers the lowest storage cost among S3 classes, making it ideal for long-term archival of log files that are rarely accessed.

Answer

S3 One Zone-Infrequent Access

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Question 3

A company is designing an event-driven architecture using Amazon EventBridge. They have multiple AWS accounts that need to receive events from a central account. What is the MOST scalable and secure way to route events to these accounts?

Accepted Answer

Use Amazon EventBridge cross-account event buses in each target account. Amazon EventBridge cross-account event buses allow a central account to route events directly to event buses in target accounts using resource-based policies. This approach is serverless, fully managed, and scales horizontally without any intermediate components, making it the most scalable and secure solution. It avoids the complexity and potential bottlenecks of Lambda invocations, Kinesis stream management, or SNS-to-SQS fan-out across accounts.

Answer

Publish events to an AWS Lambda function in each target account

Answer

Use Amazon Kinesis Data Streams with cross-account access

Answer

Create an Amazon SNS topic in the central account and subscribe SQS queues in each target account

Question 4

A company is designing a new application that will run on Amazon EKS. The application requires persistent storage that can be accessed by multiple pods simultaneously. The storage must be highly available and durable. Which storage solution should be used?

Accepted Answer

Amazon S3 with Mountpoint for S3. Amazon S3 with Mountpoint for S3 is the correct choice because it provides a fully managed, highly available, and durable object storage that can be accessed by multiple Amazon EKS pods simultaneously via a file system interface. S3 is designed for 99.999999999% durability and 99.99% availability, and Mountpoint allows concurrent read/write access from multiple pods, meeting the RWX access mode requirement. Amazon EFS One Zone (Option A) is not highly available as it resides in a single Availability Zone, Amazon EBS gp3 (Option B) supports only RWO, and Amazon FSx for Lustre (Option D) is optimized for high-performance computing and is not a general-purpose shared storage solution.

Answer

Amazon EFS with One Zone storage classes

Answer

Amazon EBS with gp3 volume type

Answer

Amazon FSx for Lustre

Question 5

A company is designing a new web application on AWS. The application must be highly available and scale automatically based on traffic. The architecture includes an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. The application stores session state. What is the BEST way to handle session state to ensure high availability?

Accepted Answer

Store session state in Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the best choice for handling session state in a highly available, auto-scaling web application because it provides a centralized, in-memory data store that is external to the EC2 instances. This ensures that session data persists independently of instance lifecycle events (e.g., scaling in/out or failures), and Redis offers sub-millisecond latency, replication, and automatic failover, which are critical for maintaining session continuity across the fleet.

Answer

Store session state in Amazon DynamoDB

Answer

Store session state on the local instance store of each EC2 instance

Answer

Store session state in Amazon S3

Question 6

A company is designing a new data lake on AWS using Amazon S3. The data must be encrypted at rest. Which TWO options comply with the requirement? (Choose TWO.)

Accepted Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3). Server-side encryption with Amazon S3 managed keys (SSE-S3) encrypts data at rest using AES-256, with S3 managing the encryption keys entirely. This meets the requirement for encryption at rest without any additional customer effort or key management overhead.

Answer

Enable SSL/TLS for all data transfers

Answer

Use S3 Access Points with a bucket policy

Answer

Use client-side encryption before uploading

Question 7

A company is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The API must be secured using AWS WAF. Which TWO actions should the company take to integrate WAF with API Gateway? (Choose TWO.)

Accepted Answer

Associate an AWS WAF web ACL with the API Gateway HTTP API. AWS WAF can be directly associated with an API Gateway HTTP API to filter and monitor HTTP requests based on rules in a web ACL. Option D is correct because AWS WAF can also be directly associated with a specific stage of an API Gateway REST API, providing granular security at the API stage level.

Answer

Create an AWS WAF web ACL and attach it to the Lambda function

Answer

Configure API Gateway to require an API key and associate WAF with the usage plan

Answer

Place AWS WAF in front of Amazon CloudFront and use CloudFront as the API Gateway endpoint

Question 8

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which THREE mechanisms can be used for service-to-service communication? (Choose THREE.)

Accepted Answer

Amazon API Gateway as a front end. Amazon API Gateway acts as a front-end proxy that can route requests to ECS Fargate services, enabling synchronous service-to-service communication via RESTful or WebSocket APIs. It handles authentication, throttling, and request transformation, making it a suitable mechanism for external or internal service calls.

Answer

Amazon SQS queues between services

Answer

Amazon DynamoDB as a communication channel

Question 9

Refer to the exhibit. A company has an S3 bucket policy that requires server-side encryption with AES256 for all objects uploaded. However, users can still upload objects without encryption. What is the MOST likely reason?

Accepted Answer

The policy does not deny requests that omit the encryption header. The bucket policy only requires encryption but does not explicitly deny requests that omit the `x-amz-server-side-encryption` header. Without a `Deny` effect for requests lacking the header, the policy is effectively a statement of intent rather than an enforcement mechanism. S3 bucket policies can enforce encryption by using a `Deny` statement with a condition key like `s3:x-amz-server-side-encryption` set to `AES256`.

Answer

S3 bucket policies cannot enforce encryption; you must use bucket default encryption

Answer

The condition key is incorrect; it should be s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

The policy does not apply to objects uploaded using AWS KMS managed keys

Question 10

Refer to the exhibit. A CloudFormation stack has been deployed with the VPCId and SubnetIds outputs. A developer wants to use these outputs as parameters in another CloudFormation stack. Which AWS service can be used to pass these values to the new stack?

Accepted Answer

CloudFormation cross-stack references using Export and ImportValue. CloudFormation cross-stack references using the `Export` output attribute and the `Fn::ImportValue` intrinsic function allow you to pass output values from one stack as parameters to another stack within the same AWS account and region. This is the native, recommended mechanism for sharing stack outputs without introducing external services or additional complexity.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store

Question 11

Refer to the exhibit. An IAM policy allows ec2:Describe* actions on all resources. A developer wants to also allow describing RDS instances. Which action must be added to the policy?

Accepted Answer

rds:Describe*. AWS IAM policies use the `rds:Describe*` action to grant permission to describe RDS instances, DB snapshots, DB parameter groups, and other RDS resources. The `ec2:Describe*` action only covers EC2 resources, not RDS resources, so a separate RDS-specific action is required. The wildcard `*` after `Describe` matches all RDS describe operations, including `rds:DescribeDBInstances`.

Answer

rds:List*

Answer

rds:Get*

Answer

ec2:DescribeRdsInstances

Question 12

A company is designing a new microservices application on AWS. Each microservice needs to store and retrieve stateful data with low latency (single-digit milliseconds). The data must be durable and highly available across multiple Availability Zones. Which AWS service should be used for the primary data store for each microservice?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It is designed for high availability and durability by automatically replicating data across three Availability Zones in an AWS Region, meeting the requirements for stateful microservices data storage.

Answer

Amazon S3

Answer

Amazon RDS with Multi-AZ

Answer

Amazon ElastiCache for Redis

Question 13

A company wants to design a serverless event-driven architecture where multiple downstream services need to process events from a single source. Events must be reliably delivered and each downstream service must process every event independently. Which AWS service should be used as the event router?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the correct choice because it provides a fully managed event bus that can receive events from a single source and fan out to multiple downstream targets (e.g., Lambda, SQS, Step Functions) with built-in filtering, transformation, and reliable delivery. Each downstream service subscribes independently via rules, ensuring every event is processed by all subscribers without the need for a polling mechanism or manual orchestration.

Answer

AWS Step Functions

Answer

Amazon Kinesis Data Streams

Answer

Amazon Simple Queue Service (SQS)

Question 14

A company is designing a new hybrid cloud solution that requires low-latency access to on-premises data from AWS. The connection must be highly available and encrypted. The company has multiple VPCs and on-premises locations. Which combination of services meets these requirements?

Accepted Answer

AWS Transit Gateway and AWS Direct Connect with VPN backup. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks, simplifying the hybrid architecture. AWS Direct Connect provides a private, low-latency, and consistent network path, while a Site-to-Site VPN over the Direct Connect link (or as a separate backup) adds encryption and high availability. This combination meets all requirements: low latency (Direct Connect), encryption (VPN), high availability (dual connections or failover), and support for multiple VPCs and on-premises locations (Transit Gateway).

Answer

AWS Site-to-Site VPN and VPC Endpoints

Answer

VPC Peering and AWS Site-to-Site VPN

Answer

AWS Client VPN and VPC Peering

Question 15

A company is designing a new application that will run on Amazon ECS with Fargate. The application must be able to read and write files to a shared file system that is accessible from multiple tasks simultaneously. The file system must be durable and support NFS protocol. Which storage solution should be used?

Accepted Answer

Amazon EFS. Amazon EFS is the correct choice because it provides a fully managed, durable, NFS-based (Network File System) shared file system that can be mounted concurrently by multiple Amazon ECS tasks running on Fargate. EFS supports the NFSv4.1 and NFSv4.0 protocols, ensuring simultaneous read/write access across tasks, and its data is replicated across multiple Availability Zones for durability.

Answer

Amazon EBS with Multi-Attach

Answer

Amazon S3

Answer

Amazon FSx for Lustre