SAP-C02 Design for New Solutions Practice Question
A company is designing a new microservices architecture using Amazon ECS with the Fargate launch type. The services need to communicate securely within a VPC. The company requires that inter-service communication is encrypted and that the services can discover each other using DNS names. Which THREE steps should the company take to meet these requirements?
⚠ Common exam trap
It's easy for candidates to confuse VPC peering or load balancers as solutions for service discovery, but AWS specifically tests that Cloud Map with awsvpc network mode is the correct combination for DNS-based discovery and secure inter-service communication within a VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AWS Cloud Map for service discovery.
AWS Cloud Map is a cloud resource discovery service that allows microservices to dynamically discover each other using DNS names or API calls. By integrating Cloud Map with ECS service discovery, tasks can register themselves with a namespace, enabling other services to resolve their IP addresses via DNS queries, which satisfies the requirement for DNS-based discovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy an Application Load Balancer in front of each service for inter-service communication.
Why it's wrong here
ALB is for external traffic; inter-service communication can be direct via DNS names.
- ✗
Create a VPC peering connection between the services' subnets.
Why it's wrong here
Services are in the same VPC; no peering needed.
- ✓
Enable AWS Cloud Map for service discovery.
Why this is correct
Cloud Map allows services to register and discover each other via DNS.
- ✓
Configure the ECS task definitions to use the awsvpc network mode.
Why this is correct
awsvpc mode gives each task its own ENI and a DNS hostname.
- ✓
Create VPC endpoints for Amazon ECR and Amazon S3 to allow Fargate tasks to pull images.
Why this is correct
Fargate tasks need to pull container images; VPC endpoints avoid NAT gateways and provide private connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.