5 Questions to Test Your Design for New Solutions Knowledge (SAP-C02)
Here are 5 SAP-C02 practice questions on Design for New Solutions. About 29% of the exam comes from this domain. Each answer explains the correct choice and what is wrong with the others.
AWS Solutions Architect – Professional (SAP-C02) · Design for New Solutions · 5 questions with answers and explanations
🧠What these questions look for
Designing a new solution means getting each requirement right from the start. Scenarios set a recovery objective, a deployment workflow, a launch with known demand, or a network rule for many VPCs, and ask which pattern or service meets it at the stated cost. The usual trap is an option that works but is either over-built for the budget or too slow for the target.
Watch for these while you work
• Rank disaster recovery patterns by recovery time, data loss and running cost, then pick the cheapest one that still meets the stated objectives. Each step up buys speed with standing capacity.
• Plan for limits before a known event. If a launch will need far more capacity than the account normally uses, Service Quotas increases are part of the design, not an incident response.
• For controls that must apply across many VPCs and accounts, such as an allow-list of domain names, look for a DNS-level filter combined with a service that deploys it organization-wide.
Question 1 of 5
An architect anticipates that a new product launch will require significantly more concurrent Lambda executions and EC2 On-Demand instances than the account's current default service quotas allow. What should be done well before the launch?
Show answer
✅ Answer: B
Difficulty: applied · Topic: Service Quotas, Lambda, EC2
Service quotas
Every account has service quotas (formerly limits) per Region, for example:
• Lambda concurrent executions: 1,000 by default per Region.
• EC2 On-Demand instances: measured in vCPUs per instance-family group, for example "Running On-Demand Standard (A, C, D, H, I, M, R, T, Z) instances".
Planning ahead
• The Service Quotas console shows each quota's applied value and, for many, current usage; CloudWatch alarms can warn at, say, 80 percent use.
• Increases are requested there (or through Support). Some are approved automatically, but large increases can take days and may need review.
• Quota request templates in AWS Organizations can apply increases to new accounts automatically.
Example: a launch needs 3,000 concurrent Lambda executions and 2,000 more vCPUs of M instances; request both weeks in advance and confirm they are applied before load testing.
Why each option works or fails
• ✗ A. Spread load over more accounts: this adds cross-account networking, deployment and operations complexity to work around quotas that can simply be raised, and each new account starts with low defaults too.
• ✓ B. (correct): Review usage in Service Quotas and request increases before launch: this confirms the current limits, and asking early gives AWS time to approve the Lambda and EC2 increases, so the launch is not throttled.
• ✗ C. Request after throttling appears: increases are not guaranteed to be applied within minutes, and large ones may need review. Users would see failures during the launch while the request is pending.
• ✗ D. Move EC2 to Spot: Spot capacity can be interrupted and may not be available, Spot has its own vCPU quotas, and this does nothing about the Lambda concurrency limit.
🎯 Key idea: Check quota usage and request increases well before a known traffic event; waiting for throttling means failures while the request is processed.
Question 2 of 5
A new serverless application needs repeatable deployments of Lambda functions, API Gateway, and DynamoDB tables with local testing support. Which tool fits?
Show answer
✅ Answer: A
Difficulty: applied · Topic: AWS SAM
AWS Serverless Application Model (SAM)
SAM is an open-source framework for serverless applications built on AWS CloudFormation.
• A template declares Transform: AWS::Serverless-2016-10-31 and uses short resource types such as AWS::Serverless::Function, AWS::Serverless::Api and AWS::Serverless::SimpleTable; SAM expands them into full CloudFormation resources, IAM roles and permissions.
• The SAM CLI builds and deploys the stack (sam build, sam deploy), so every environment is created from the same template.
• It supports local testing: sam local invoke runs a function in a Lambda-like container, and sam local start-api serves the API locally.
Example: one template defines a function, an API route that triggers it and a DynamoDB table; sam deploy creates the same stack in dev and prod.
Why each option works or fails
• ✓ A. AWS SAM (correct): it defines Lambda, API Gateway and DynamoDB concisely as infrastructure as code, deploys repeatably through CloudFormation, and provides local invoke and API emulation for testing.
• ✗ B. Elastic Beanstalk web server tier: it manages EC2-based web applications with load balancers and Auto Scaling; it does not model Lambda functions and API Gateway APIs as serverless resources.
• ✗ C. OpsWorks with Chef: OpsWorks managed configuration of servers with Chef or Puppet and has reached end of life; it never targeted serverless resources.
• ✗ D. Manual console configuration: clicking through the console is not repeatable or versioned and offers no local testing, so environments drift.
🎯 Key idea: Serverless infrastructure as code with local testing is SAM; Beanstalk and OpsWorks are server-oriented, and console clicks are not repeatable.
Question 3 of 5
A financial services company requires near-zero downtime and near-zero data loss for a critical trading platform, and is willing to accept the operational complexity and cost of running full production capacity in two regions simultaneously. Which DR pattern fits?
Show answer
✅ Answer: B
Difficulty: advanced · Topic: Route 53, Aurora, DynamoDB
The four DR strategies, from cheapest to fastest
• Backup and restore: data is backed up to another Region; infrastructure is rebuilt after a disaster. RPO and RTO in hours.
• Pilot light: core data is replicated live, but compute is off or minimal and is started on failover. Minutes to hours.
• Warm standby: a scaled-down but fully working copy runs in the second Region and is scaled up on failover. Minutes.
• Multi-site active-active: full production capacity runs in two or more Regions and serves traffic all the time. RTO near zero, and RPO near zero with synchronous-like or very low-lag replication.
What active-active looks like
Route 53 latency-based (or geolocation) routing with health checks spreads users across Regions; data is replicated with services such as DynamoDB global tables or Aurora Global Database. If one Region fails, health checks remove it and the other Region, already at full size, absorbs the load.
The price is double infrastructure plus the complexity of multi-Region writes and consistency.
Why each option works or fails
• ✗ A. Pilot light with a manual runbook: compute must be started and scaled, and manual steps add more time, so RTO is tens of minutes or more, not near zero.
• ✓ B. Multi-site active-active (correct): both Regions already run full production and take live traffic, and near-real-time replication keeps data current, so failover is nearly instant with near-zero data loss, which is what the trading platform needs and has agreed to pay for.
• ✗ C. Warm standby: it is faster than pilot light, but the standby must still scale out to full capacity and traffic must be moved, so it cannot promise near-zero downtime.
• ✗ D. Hourly backups: restoring from backups takes hours and loses up to an hour of trades, far from near-zero RTO and RPO.
🎯 Key idea: Near-zero RTO and RPO, with budget for full capacity in two Regions, means multi-site active-active; every cheaper pattern trades some downtime or data loss for cost.
Question 4 of 5
A company is designing a new platform in which workloads in many VPCs must resolve only an approved list of about 200 domain names (for package repositories and partner APIs). Any other DNS resolution attempt must be blocked and logged to detect data exfiltration through DNS tunneling. The security team wants to manage this centrally across the organization. Which solution meets these requirements?
Show answer
✅ Answer: A
Difficulty: advanced · Topic: Amazon Route 53 Resolver DNS Firewall, AWS Firewall Manager
DNS Firewall
Route 53 Resolver DNS Firewall filters outbound DNS queries that leave a VPC through the Resolver.
• A rule group contains ordered rules; each rule matches a domain list and takes an action: ALLOW, ALERT or BLOCK.
• An allow-list is built with a high-priority rule that allows the approved domain list and a lower-priority rule that blocks the wildcard *.
• Queries and actions can be logged with Resolver query logging, and AWS Firewall Manager can apply rule groups across accounts in an organization.
Why each option works or fails
• ✓ A. DNS Firewall allow-list (correct): approved domains resolve, everything else is blocked and logged before any answer is returned, and Firewall Manager makes the policy central.
• ✗ B. GuardDuty findings only: this is detective and after the fact. It does not stop queries, and tunneling data has already left when the finding arrives.
• ✗ C. Security groups on port 53: the resolver address is always allowed, so this does not filter domain names. Queries to any domain still go through the resolver.
• ✗ D. Private hosted zone with the 200 records: this only answers those names for the zone; other names still resolve using the public resolver, so nothing is blocked.
🎯 Key idea: Use Route 53 Resolver DNS Firewall with allow and block-all rules for a domain allow-list, and Firewall Manager to apply it organization-wide.
Question 5 of 5
A new application requires RTO of 15 minutes and RPO of 1 minute in a second Region at moderate cost. Which DR strategy fits?
Show answer
✅ Answer: D
Difficulty: advanced
The four DR strategies
From cheapest and slowest to most expensive and fastest:
• Backup and restore: backups copied to another Region; RPO and RTO in hours.
• Pilot light: data replicated continuously, core infrastructure defined but application servers off or not deployed; RTO in tens of minutes to hours because compute must be provisioned and scaled.
• Warm standby: data replicated continuously and a scaled-down but fully working copy of the application running; recovery means scaling it up and switching traffic, so RTO in minutes.
• Multi-site active/active: full capacity serving traffic in both Regions; near-zero RTO at the highest cost.
Mapping the requirement
An RPO of 1 minute needs continuous replication (for example Aurora Global Database or DynamoDB global tables). An RTO of 15 minutes leaves little time to launch and configure a whole stack, so something must already be running.
Why each option works or fails
• ✗ A. Multi-site active-active: it meets the targets but runs full production capacity twice, which exceeds the moderate-cost requirement for a 15-minute RTO.
• ✗ B. Backup and restore with daily backups: daily backups mean up to 24 hours of data loss, and restoring a full stack takes hours, missing both RPO and RTO.
• ✗ C. Pilot light with no compute: data is current, but launching, configuring and scaling all compute during the event puts a 15-minute RTO at risk.
• ✓ D. Warm standby (correct): continuous replication meets the 1-minute RPO, and the already-running scaled-down stack only needs to scale up and receive traffic, which fits a 15-minute RTO at moderate cost.
🎯 Key idea: Minutes of RTO with near-real-time RPO at moderate cost is warm standby; pilot light is cheaper but slower, active-active faster but costlier.
📊 About this set
Exam: SAP-C02 · 75 questions · 180 minutes · passing score 750 · the largest of 4 domains
This set: 3 advanced, 2 applied · 4 scenario, 1 trade-off
Topics: Service Quotas, Lambda, EC2, AWS SAM, Route 53, Aurora, DynamoDB, Amazon Route 53 Resolver DNS Firewall, AWS Firewall Manager
🔗 More from this exam
• All SAP-C02 practice sets
• Every exam on this blog
📚 More SAP-C02 practice
More SAP-C02 questions: https://hyunhp.github.io/cert-bank/#exam=SAP-C02
Study guide: https://hyunhp.github.io/cert-bank/study.html#exam=SAP-C02
These are original practice questions, not real exam questions, and cert-bank is not affiliated with any certification vendor.
Original practice questions written for this blog, not exam dumps.
Comments
Post a Comment