Design for New Solutions — AWS Certified Solutions Architect SAP-C02 practice questions

200 analysts need ad-hoc SQL over a 5 PB S3 data lake with cost controls and cross-account data sharing. Which approach is BEST?

1. A dedicated EMR cluster per analyst so query isolation is preserved and cost is attributable to individual users directly
2. Athena with per-team workgroups for cost controls, Glue Catalog as metastore, Lake Formation cross-account sharing, and Parquet partitions
3. Loading the entire 5 PB into Redshift RA3 nodes to give analysts a single warehouse for ad-hoc SQL access
4. Federated queries routing every analyst SQL statement to an RDS PostgreSQL instance holding the entire data lake

Answer: B — Athena with per-team workgroups for cost controls, Glue Catalog as metastore, Lake Formation cross-account sharing, and Parquet partitions

B) Athena + Lake Formation + Glue + Parquet is the canonical serverless lakehouse pattern with workgroup cost controls. A) A cluster per analyst is wildly expensive. C) 5 PB into Redshift is overkill for ad-hoc. D) Postgres cannot hold 5 PB.

Egress from an OU must go through a stateful DPI-capable firewall with logs streamed to a central SIEM. Which architecture is BEST?

1. Central inspection VPC with AWS Network Firewall attached to a TGW and Firehose delivery of logs to the SIEM
2. Each VPC routing 0.0.0.0/0 to its own NAT Gateway with Security Groups performing traffic filtering per subnet
3. Each VPC using an internal NLB fronting a third-party WAF appliance stack running on EC2 for egress inspection
4. Enabling GuardDuty as the sole traffic-inspection layer for egress across all workloads in the target OU

Answer: A — Central inspection VPC with AWS Network Firewall attached to a TGW and Firehose delivery of logs to the SIEM

A) Central inspection VPC + Network Firewall + Firehose is AWS-prescriptive DPI egress. B) SG do not do DPI. C) NLB+WAF is not L3/L4 stateful firewall. D) GuardDuty is detection, not inline inspection.

Strong tenant isolation with per-tenant BYOK and instant cryptographic erase on revocation is required. Which design is BEST?

1. A single shared KMS key across all tenants rotated monthly to reduce key sprawl while still meeting cryptographic hygiene
2. S3-managed keys (SSE-S3) tagged per tenant on each object with tenant metadata to enforce boundary at read time
3. Storing all tenant data unencrypted in separate S3 buckets isolated per tenant using bucket policies for access control
4. One customer-managed KMS key per tenant encrypting all tenant data with EncryptionContext bound to the tenant identifier

Answer: D — One customer-managed KMS key per tenant encrypting all tenant data with EncryptionContext bound to the tenant identifier

D) Per-tenant CMK enables cryptographic erase via key deletion/disable and enforces per-tenant boundaries. A) Shared key blocks per-tenant revocation. B) SSE-S3 keys are not revocable per-tenant. C) Unencrypted violates compliance.

A global API must serve sub-100 ms p95 to users in 6 Regions with 30000 RPS peak and Region-failure survival. Which is BEST?

1. Global Accelerator routing to Regional API Gateway + Lambda in 4 Regions with DynamoDB Global Tables and Route 53 health checks
2. CloudFront fronting Regional API Gateway in two Regions with Aurora Global writer plus DynamoDB on-demand replicas as warm standby
3. Single-Region API Gateway behind CloudFront with all logic running exclusively in Lambda@Edge across the AWS edge network
4. NLB-based architecture with EC2 in one Region and CloudFront in front for static assets only across the global user base

Answer: A — Global Accelerator routing to Regional API Gateway + Lambda in 4 Regions with DynamoDB Global Tables and Route 53 health checks

A) GA + Regional API GW + Lambda + DynamoDB Global Tables is the canonical globally-active low-latency pattern. B) Two-Region warm standby cannot deliver sub-100ms across 6 user Regions. C) Lambda@Edge has hard limits; one-Region data is a SPOF. D) Ignores multi-Region.

A corporate site sees 10x launch spikes and mixes static + dynamic content behind ECS/ALB. Which CDN design is BEST?

1. Direct ALB exposure with bigger ECS tasks provisioned to absorb the 10x spikes without any CDN or edge cache in front
2. CloudFront in front of the ALB with cache behaviors, origin shield, and AWS WAF applied at the CloudFront distribution
3. S3-only static site served through CloudFront with API Gateway calls for every dynamic request to the backend service
4. Multiple parallel ALBs sharded by URL path to distribute the load without a shared CDN layer above the origin fleet

Answer: B — CloudFront in front of the ALB with cache behaviors, origin shield, and AWS WAF applied at the CloudFront distribution

B) CloudFront + origin shield + WAF is canonical CDN-fronted dynamic origin. A) Bigger tasks skip the cache layer. C) Rewrites the app. D) Path-sharded ALBs skip cache.

A social app has 100:1 read-write ratio, needs sub-ms p99 reads globally, and tolerates eventual consistency for non-critical reads. Which is BEST?

1. Aurora Global Database with read replicas in every Region and a single writer serving all writes globally to consumers
2. ElastiCache Redis cluster-mode in one Region with cross-Region replication configured to secondary read-only clusters
3. Self-hosted Cassandra clusters running on EC2 in every Region with peer-to-peer replication across the cluster mesh
4. DynamoDB Global Tables in active-active with DAX in each Region caching hot reads and conditional writes for updates

Answer: D — DynamoDB Global Tables in active-active with DAX in each Region caching hot reads and conditional writes for updates

D) Global Tables + DAX is canonical for global low-latency reads with eventual consistency. A) Aurora Global writes go cross-Region to primary. B) ElastiCache global is single-primary. C) Self-hosted reintroduces ops.

AWS Glue is BEST described as:

1. A serverless ETL service with crawlers, Spark jobs, and a shared Data Catalog
2. A managed Kafka streaming service supporting Connect and cross-cluster replication
3. A columnar warehouse offering federated queries and concurrency scaling for OLAP
4. A relational transactional database engine compatible with MySQL and PostgreSQL

Answer: A — A serverless ETL service with crawlers, Spark jobs, and a shared Data Catalog

A) Glue is the AWS serverless ETL and metadata catalog. B) That is MSK. C) That is Redshift. D) That is Aurora.

Amazon Aurora differs from standard RDS engines PRIMARILY because it:

1. Only stores encrypted keys and delegates all data-plane operations to CloudHSM devices
2. Is a cloud-native MySQL/PostgreSQL-compatible engine with 6-way replication across 3 AZs
3. Is incompatible with MySQL and PostgreSQL clients and requires proprietary drivers
4. Requires manual sharding across dozens of writer instances to reach production scale

Answer: B — Is a cloud-native MySQL/PostgreSQL-compatible engine with 6-way replication across 3 AZs

B) Aurora is cloud-native MySQL/PG-compatible with 6-copy/3-AZ replication. A) Aurora manages data itself. C) Aurora is compatible. D) Aurora scales horizontally without manual sharding via Aurora Serverless / read replicas.

A spike-prone workload must absorb millions of asynchronous requests with retries and dead-letter handling. Which architecture is BEST?

1. Synchronous API Gateway invoking a single Lambda per request without a queue in front
2. Amazon SQS in front of Lambda or ECS auto-scaling consumers with a dead-letter queue
3. A single large EC2 instance polling requests from a database table on a tight loop
4. Amazon Kinesis Firehose delivering all requests to S3 with no downstream consumers

Answer: B — Amazon SQS in front of Lambda or ECS auto-scaling consumers with a dead-letter queue

B) SQS + auto-scaling + DLQ is the canonical async decoupling pattern. A) Synchronous alone does not absorb spikes safely. C) A single EC2 is a SPOF. D) Firehose is delivery-only and lacks request semantics.

Which BEST contrasts Amazon WorkSpaces with AppStream 2.0?

1. WorkSpaces streams applications only; AppStream streams full persistent virtual desktops
2. WorkSpaces streams full persistent virtual desktops; AppStream streams individual applications
3. Both services provide identical persistent desktops with only pricing model differences
4. Both services stream ephemeral applications only and neither supports persistent user state

Answer: B — WorkSpaces streams full persistent virtual desktops; AppStream streams individual applications

B) WorkSpaces = persistent VDI; AppStream = app streaming. A) Reversed. C) They differ architecturally. D) WorkSpaces is persistent, AppStream is per-session.

SAP requirement themes?

Cost-effective, secure, highly available, scalable, operationally efficient.

EC2 dedicated host vs dedicated instance?

Host: physical server, BYOL friendly. Instance: dedicated hardware but no host visibility.

Pilot Light pattern?

Minimal core in DR region. Scale up on disaster. Lower cost than warm standby.

Fargate cost vs EC2 launch type?

Fargate: per-task billing, no infra mgmt. EC2: cheaper at scale, more ops.