SAP-C02 Design for New Solutions Practice Test 9 — 15 Questions

Question 1

A company is designing a multi-region active-active application using Amazon Aurora Global Database. The application must have Recovery Point Objective (RPO) of less than 1 second and Recovery Time Objective (RTO) of less than 1 minute in case of a regional failure. Which configuration meets these requirements?

Accepted Answer

Deploy Aurora Global Database with multi-master clusters in two regions.. Aurora Global Database uses storage-based replication with typical RPO of seconds, but for sub-second RPO, multi-master with asynchronous replication (option C) is needed. Option A (single-master) has failover time > 1 minute. Option B (DynamoDB Global Tables) is not Aurora. Option D (read replicas cross-region) has higher RPO.

Answer

Deploy a single Aurora cluster with a primary in one region and a read replica in the secondary region.

Answer

Use cross-region read replicas with synchronous replication.

Answer

Use Amazon DynamoDB Global Tables instead of Aurora.

Question 2

A company is designing a new microservices architecture on Amazon ECS with Fargate. Each microservice must be isolated and able to communicate with others only through defined APIs. Which solution provides the BEST isolation and security?

Accepted Answer

Use AWS App Mesh with Envoy sidecars to control traffic between services.. Using a service mesh like App Mesh (option C) provides fine-grained traffic control and security between microservices. Option A (same security group) is too permissive. Option B (ALB per service) adds complexity. Option D (VPC peering) is for VPC-level, not service-level.

Answer

Place all microservices in the same security group and allow all traffic.

Answer

Use an Application Load Balancer per microservice with listener rules.

Answer

Use VPC peering between each microservice's VPC.

Question 3

A company is designing a new application that will store sensitive user data in Amazon S3. Compliance requirements mandate that all data must be encrypted at rest using a key that is managed by the company and rotated automatically every year. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS) and enable automatic key rotation.. SSE-KMS with a customer managed key (CMK) allows the company to control the key and enable automatic yearly rotation (option D). Option A (SSE-S3) uses AWS-managed keys. Option B (SSE-C) requires the company to manage keys outside AWS. Option C (client-side) stores keys client-side.

Answer

Use client-side encryption with the AWS SDK.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Use S3 server-side encryption with S3 managed keys (SSE-S3).

Question 4

A company is designing a new data lake on Amazon S3 using AWS Glue for ETL. The data is partitioned by date and sensitive columns must be masked for non-privileged users. The solution must minimize storage costs and allow different masking policies per user. Which approach should the architect recommend?

Accepted Answer

Use AWS Lake Formation to define column-level permissions and masking policies.. Using Lake Formation with column-level permissions (option D) allows masking policies per user without duplicating data. Option A (multiple copies) increases cost. Option B (separate S3 paths) is complex. Option C (Glue transforms) mixes ETL with access control.

Answer

Create separate S3 buckets for each masking policy and copy data accordingly.

Answer

Use AWS Glue ETL jobs to mask data based on user role at query time.

Answer

Store masked data in separate prefixes in the same bucket and use S3 bucket policies.

Question 5

A company needs to provide temporary, limited-privilege credentials to mobile app users to access AWS resources. Which AWS service should the architect recommend?

Accepted Answer

Use Amazon Cognito with an identity pool to issue temporary credentials.. AWS Cognito Identity Pools (option C) provide temporary credentials for authenticated users. Option A (IAM users) is not for mobile users. Option B (STS) is for federated users, not directly for mobile. Option D (IAM roles) cannot be assumed directly by mobile apps.

Answer

Create IAM users for each mobile user and distribute access keys.

Answer

Use AWS Security Token Service (STS) directly from the mobile app.

Answer

Create an IAM role and have the mobile app assume it directly.

Question 6

A company is designing a new web application that requires a scalable, low-latency key-value store for session state. The application runs on EC2 instances in an Auto Scaling group. Which solution is the MOST cost-effective and scalable?

Accepted Answer

Use Amazon ElastiCache for Redis.. ElastiCache for Redis (option B) is a managed, scalable, low-latency key-value store ideal for session state. Option A (DynamoDB) works but is more expensive for simple session data. Option C (RDS) is relational and not low-latency for key-value. Option D (local instance store) is not durable.

Answer

Store session state on the local instance store of each EC2 instance.

Answer

Store session state in Amazon DynamoDB.

Answer

Store session state in Amazon RDS for MySQL.

Question 7

A company is designing a new real-time analytics platform that processes streaming data from IoT devices. The data must be ingested, processed with windowed aggregations, and stored in Amazon S3 for long-term analytics. The solution must handle late-arriving data and provide exactly-once processing semantics. Which combination of AWS services should the architect use?

Accepted Answer

Use Amazon Kinesis Data Analytics for Apache Flink to process data from Kinesis Data Streams and output to S3.. Kinesis Data Analytics for Apache Flink (option D) provides exactly-once processing and handles late data. Option A (Kinesis Data Firehose) does not provide exactly-once. Option B (Lambda) is not ideal for streaming analytics. Option C (EMR) is more complex.

Answer

Use Amazon Kinesis Data Firehose to ingest data and AWS Glue for processing.

Answer

Use Amazon EMR with Spark Streaming to process data from Kinesis Data Streams.

Answer

Use AWS Lambda to process records from Kinesis Data Streams and store in S3.

Question 8

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must be highly available across multiple Availability Zones. Which TWO actions should the architect take? (Choose TWO.)

Accepted Answer

Configure the ALB as internet-facing and attach it to multiple Availability Zones.. For high availability, the ALB must be internet-facing (option B) and EC2 instances should be in multiple AZs (option C). Option A (single AZ) is not HA. Option D (NLB) is not needed. Option E (public IPs) is unnecessary.

Answer

Launch all EC2 instances in a single Availability Zone.

Answer

Use a Network Load Balancer instead of an Application Load Balancer.

Answer

Assign Elastic IP addresses to each EC2 instance.

Question 9

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

Accepted Answer

EC2 Spot Instances to reduce compute costs.. AWS Batch (option A) manages job scheduling and scaling. Spot Instances (option C) reduce cost. S3 Event Notifications (option D) trigger jobs when files arrive. Option B (Auto Scaling) is less efficient. Option E (Lambda) has a 15-minute limit.

Answer

AWS Lambda functions to process each file.

Answer

Auto Scaling group with scheduled scaling policies.

Question 10

A company is designing a new disaster recovery solution for a critical application that runs on Amazon EC2 with an Amazon RDS for MySQL database. The Recovery Time Objective (RTO) is 15 minutes and Recovery Point Objective (RPO) is 1 hour. Which TWO strategies meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon Aurora Global Database for the database tier.. Aurora Global Database (option D) provides RPO of seconds and RTO of minutes. Multi-AZ (option C) provides HA but not cross-region DR. Option A (RDS cross-region) meets RPO but RTO may be >15 min. Option B (EC2 AMI copy) is slow. Option D is correct. Option E (read replica) can be promoted quickly.

Answer

Use EC2 AMI copy to another region and launch instances from the AMI.

Answer

Use RDS cross-region snapshots and restore in the DR region.

Answer

Configure RDS Multi-AZ in the primary region.

Question 11

A solutions architect runs the above CLI command. What is the output format?

Accepted Answer

A JSON array of strings.. The command uses --query with JMESPath to output specific fields as a JSON array. Option A is correct. Options B, C, D are incorrect because the query specifies an array output.

Answer

YAML formatted output.

Answer

A text table with columns.

Answer

A JSON object with keys.

Question 12

An IAM policy is attached to an IAM user. The user tries to download an object from S3 bucket 'example-bucket' from an IP address 10.0.1.5. What will happen?

Accepted Answer

The request is allowed.. The policy grants s3:GetObject only if the source IP is in 10.0.0.0/16. Since 10.0.1.5 is within that range, the request is allowed. Option A is correct. Option B would be true if IP outside range. Option C (deny) would override. Option D (no effect) is incorrect.

Answer

The policy has no effect because the condition is invalid.

Answer

The request is denied unless there is another explicit deny.

Answer

The request is denied.

Question 13

A solutions architect attempts to create this stack but receives an error: "Value of property SecurityGroups must be a list of strings". What is the likely cause?

Accepted Answer

The SecurityGroups property should be a list, but the YAML specifies a single reference incorrectly.. The SecurityGroups property expects a list of security group IDs or names, not references to security group objects. Using !Ref returns the physical ID (name) of the security group, but in YAML, the value is a single string, not a list. Option C explains the issue. Option A (AMI) is fine. Option B (CIDR) is valid. Option D (circular dependency) is not true.

Answer

The security group ingress rule allows SSH from anywhere.

Answer

There is a circular dependency between the EC2 instance and the security group.

Answer

The AMI ID is invalid.

Question 14

A company is designing a new serverless application on AWS. The application consists of multiple AWS Lambda functions that process incoming events from an Amazon SQS queue. The company wants to ensure that each message is processed exactly once. Which configuration should the company use?

Accepted Answer

Use an SQS FIFO queue and enable content-based deduplication.. Option B is correct because SQS FIFO queues guarantee exactly-once processing. Option A is wrong because standard SQS queues do not guarantee exactly-once. Option C is wrong because Lambda destination is for success/failure, not exactly-once. Option D is wrong because DynamoDB Streams are not for SQS.

Answer

Use a standard SQS queue and set the Lambda function reserved concurrency to 1.

Answer

Use a standard SQS queue and configure Lambda destinations for the queue.

Answer

Use an SQS FIFO queue and configure DynamoDB Streams as the event source for Lambda.

Question 15

A company is designing a new web application that will be deployed on Amazon ECS with Fargate. The application must scale based on the number of requests per container. The company wants to use a service that can automatically adjust the number of tasks based on a custom metric. Which solution should the company use?

Accepted Answer

Configure an ECS Service Auto Scaling policy with a target tracking scaling policy based on a custom CloudWatch metric.. Option A is correct because ECS Service Auto Scaling can use target tracking with a custom CloudWatch metric. Option B is wrong because DynamoDB auto scaling is for tables. Option C is wrong because Application Auto Scaling is the underlying service, but the question asks for the specific solution; ECS Service Auto Scaling is the direct feature. Option D is wrong because AWS Auto Scaling is a broader console feature, but the scaling policy is applied via ECS Service Auto Scaling.

Answer

Configure Amazon DynamoDB auto scaling to adjust the read capacity based on the request count.

Answer

Use Application Auto Scaling to register the ECS service and create a step scaling policy.

Answer

Use the AWS Auto Scaling console to create a scaling plan that includes the ECS service.