Architecture Design and Implementation Built for the Cloud (25%)

SAP-C03 · 75 questions

• A financial advisory firm wants a Bedrock assistant that answers from 50,000 internal PDFs with citations, daily document updates, and low-latency semantic search without fine-tuning a model. Retrieved context must stay fresh and traceable to source chunks. Which RAG ingestion and retrieval design meets the grounded generation requirement?
• A retail platform processes orders in eu-west-1 and runs analytics in us-east-1 under a separate analytics account. Order events must route reliably across accounts and Regions, support schema filtering, and allow replay for new consumers without custom polling. Which EventBridge pattern provides cross-account and cross-Region event routing?
• A national e-commerce retailer processes 20,000 orders per hour during flash sales. Payment events must be processed exactly once and in order per customer to avoid double charges, while inventory updates can tolerate duplicates and out-of-order delivery for higher throughput. What messaging design satisfies both needs?
• A SaaS company hosts its app in three workload accounts and must add support chat using Amazon Bedrock without storing foundation model data locally and while centralizing model access control and logging. Developers need private inference in each workload VPC. Which multi-account generative AI integration pattern meets centralized governance with local inference?
• A gaming studio needs sub-10ms reads for player profiles with millions of requests per second, flexible JSON attributes per game, global distribution, and strong consistency only for inventory trades while profiles use eventual consistency. Which database service best fits these access and scalability requirements?
• A global media company with VPC-only IPv4 workloads must support IPv6 mobile clients, retain private IPv4 for legacy databases, and avoid address exhaustion during expansion. The dual-stack rollout must not break existing DNS. Which IPv6 adoption strategy enables dual-stack growth with compatibility?
• A regulated fintech company runs 15 containerized microservices handling ledger writes and notifications. The team has no Kubernetes expertise, must avoid EC2 node patching, requires AWS-native service discovery between services, and needs isolated IAM permissions per microservice task. Which container orchestration approach meets these microservice isolation and operations requirements?
• A gaming company runs active-active APIs in us-east-1 and eu-west-1 needing sub-100ms joins, automatic failover on health failure, and static IPs for firewall allowlisting. Latency-based DNS alone causes inconsistent reconnects. Which global traffic routing design meets latency, failover, and static IP needs?
• A manufacturer runs factory systems on premises and VPC workloads in us-east-1 that must stay connected during carrier outages, with sub-second failover between paths and centralized routing to three VPCs. Compliance requires encrypted redundant corporate connectivity. Which hybrid connectivity design delivers redundant failover with centralized routing?
• A fintech trading platform in us-east-1 needs multi-second RPO, under 30-second RTO, and sub-100ms local reads in eu-west-1 for an Aurora MySQL cluster without application rewrites or manual binlog replication. Failover must promote the remote region quickly. Which scaling solution provides highly available global reads and fast regional failover?
• A travel booking startup runs ticketing APIs on EC2 instances behind an ALB and loses shopping carts whenever an instance is replaced during scaling events. Traffic triples on holidays and the team must scale horizontally without session loss while keeping read latency under 20 ms for seat maps. How should state be redesigned?
• A travel company wants a conversational agent that can check live bookings via Lambda, answer policy questions from PDFs, maintain session memory, and trace each tool call for support audits. Developers prefer managed orchestration over custom LangChain code. Which AI agent architecture integrates tools with traceable managed orchestration?
• An e-commerce company stores 80 TB of clickstream JSON in S3, needs SQL analytics with schema evolution, fine-grained access by marketing team, and Redshift joins without duplicating data. Query patterns are ad hoc and bursty. Which data lake design supports governed schema-evolving analytics with zero-copy warehouse joins?
• A logistics firm runs 50 microservices across three VPCs and two accounts with polyglot protocols. Teams need identity-aware routing, fine-grained traffic shifting, and unified telemetry without running sidecar proxies or managing service discovery manually. Which service mesh design simplifies communication and observability?
• A Tier-1 auto parts plant keeps 40 TB of quality videos on on-premises NFS with POSIX permissions. Engineers need nightly replication to Amazon S3 for analytics, bandwidth throttling during shifts, and incremental transfers with integrity validation. Which data synchronization strategy best meets the hybrid file replication requirements?
• A B2B SaaS company hosts churn models for 180 small tenants. Each model is invoked sporadically during business hours, sits idle overnight, requires low-latency responses when called, and must avoid paying for 180 always-on endpoints. Which SageMaker inference design delivers cost-efficient low-latency scoring across tenants?
• A visual-effects studio runs 800 Linux render nodes in one AZ that need a shared POSIX namespace for 4K frames, with bursty 50 GB/s throughput for scratch files that are deleted after 10 days, plus durable render output kept for months. Which storage architecture best matches these access patterns and performance requirements?
• A fitness app streams 40,000 wearable events per minute with bursts during races. Product wants SQL queries over raw and curated data, automatic schema discovery, and no cluster tuning during spikes. Which serverless pipeline best delivers this analysis?
• A national logistics firm runs inventory on premises with JMS queues and SOAP XML services that cannot be rewritten. Partners need REST JSON APIs with burst buffering and per-key throttling during peak season. Which data-transformation integration pattern modernizes the legacy interface without rewriting the host?
• A retail chain ingests clickstreams and POS events at 40K per second for fraud alerts within seconds, plus nightly inventory joins over terabytes and Salesforce contact sync for dashboards. Exactly-once stream handling and SQL warehousing are needed. Which analytics pipeline meets real-time and batch needs?
• A gaming leaderboard uses DynamoDB with 85% repeated reads of player ranks, p99 latency spiked to 18 ms during tournaments, and developers cannot add cache invalidation code due to a freeze. Which data caching strategy optimizes DynamoDB performance without application rewrites?
• An insurance firm processes claims in five steps across Lambda, human approvals, and partner APIs with retries, timeouts, and full audit of state. Executions must survive staff delays lasting days and resume safely after failures. Which design provides durable execution?
• A legal tech firm must let its assistant answer from 200,000 private contracts that update daily, cite source clauses, avoid retraining a model, and keep data within its VPC boundary. Answers must stay current as PDFs arrive in S3. Which RAG ingestion and retrieval strategy best meets these grounding and freshness requirements?
• A delivery platform stores 400 microservice images in Amazon ECR across teams, facing stale vulnerable images and rising storage spend. Leadership wants automatic vulnerability detection, cleanup of old tags, and blocked mutable overwrites. Which ECR configuration governs image security and lifecycle?
• A global manufacturer keeps corp.example.com on on-premises BIND servers and runs factory analytics in a VPC using the same name in a private hosted zone. On-premises BIND is authoritative for the plant.corp.example.com subdomain, while the private hosted zone holds the AWS record names under corp.example.com. EC2 must resolve on-premises names and plant resolvers must resolve AWS private names without leaking private IPs publicly. Which DNS solution delivers bidirectional hybrid resolution for the overlapping zone?
• A gaming studio runs real-time matchmaking on EKS with sharp evening spikes where pods queue while nodes sit full, then idle capacity wastes spend overnight. CPU-based pod limits alone cannot add nodes. Which auto scaling pattern handles bursty container demand cost-effectively?
• A media company produces live-stream metadata in an ap-southeast-2 production account and must deliver filtered playback events to a central analytics custom bus in a eu-west-1 audit account with secure least-privilege access and replay for missed events. Compliance requires no public internet exposure of the bus. Which cross-account and cross-Region event routing pattern using event buses and forwarding meets these needs?
• A gaming platform needs millisecond leaderboards for 2M daily players, relational inventory with ACID transactions and joins, plus petabyte-scale analytics over historical seasons. Single database cannot meet latency, consistency, and scale together. Which database selection fits access patterns and scalability?
• Three subsidiaries need governed access to a central marketing data lake in S3 for campaign joins without copying raw tables, with column-level privacy and expiring access. Which data cataloging and cross-account sharing pattern enables secure governed discovery?
• A brokerage connects its headquarters to six production VPCs in one Region. Trading feeds require consistent private throughput, must fail over automatically if a dedicated path fails, and must avoid manual router changes during outages. Which hybrid connectivity design provides redundant automatic failover for the VPC estate?
• A global travel booking platform runs on Amazon Aurora PostgreSQL in eu-west-1 with heavy read traffic in us-east-1 and ap-southeast-2. The business requires regional reads under 50 ms, RPO of about a second, and managed cross-Region failover within a few minutes. Which database scaling solution provides high availability with fast global failover?
• A manufacturing company runs computer-vision quality inspection on its factory floor requiring single-digit millisecond latency to on-premises machines, must keep sensor data resident on-site for compliance, and wants the same Kubernetes APIs and ECR images as its AWS cloud workloads. Which hybrid compute pattern provides AWS-managed infrastructure on-premises for this workload?
• A 12-person retail team runs 25 microservices with spiky checkout traffic, has no Kubernetes expertise, and must deploy quickly across AZs without managing EC2 nodes. Uptime and simplified operations matter more than pod-level control. Which container orchestration approach for microservices should the architect choose?
• A food delivery platform emits order events from checkout that must be processed in order per restaurant, duplicates suppressed from retries, and failures retried without loss. Throughput is 300 TPS with Lambda consumers. Which messaging design provides ordering, idempotency, and delivery guarantees for this workload?
• A media studio keeps 40 TB of NFS video on premises, needs nightly one-way sync to S3 for rendering, must preserve permissions and throttle bandwidth during business hours. Which data synchronization design meets hybrid transfer requirements?
• An e-commerce platform sees HTTPS bursts for checkout via browsers and persistent MQTT connections from 200k IoT price tags needing low-latency passthrough. Cost must scale per pattern. Which ingress pattern using load balancers and API Gateway optimizes resources for each usage pattern?
• An enterprise runs 40 microservices across three VPCs and two accounts using ECS and Lambda, needing identity-aware HTTP routing, fine-grained access, and unified observability without sidecar proxies to manage. East-west traffic must scale without Transit Gateway peering sprawl. Which service mesh design for microservice communication and observability should the architect adopt?
• A global news site serves 5M readers with personalized headlines requiring sub-50ms header rewrites at edge and heavier A/B personalization needing regional compute. Cache hit ratio must stay high. Which edge architecture using CloudFront Functions and Lambda@Edge meets latency and compute needs?
• A SaaS provider has 60 workload VPCs across three business units plus on-premises data centers, must share a central logging and license service without transitive internet routing, and needs private connectivity that scales without managing hundreds of peering links. Which multi-VPC hybrid connectivity design provides scalable private service sharing?
• A video editing collective has 40 EC2 editors across two Availability Zones needing shared POSIX access to 20 TB of active projects with sub-millisecond latency and burst throughput for 4K renders. Cold footage must cost little. Which storage architecture matches access patterns and performance requirements?
• A logistics firm runs IBM MQ on premises and SOAP mainframe jobs, needs REST APIs for mobile apps with payload reshaping and durable buffering during outages. Which integration pattern modernizes legacy systems with data transformation?
• A travel booking service runs stateful sticky sessions on EC2 with local carts, causing lost bookings on scaling and AZ failure. It needs seamless failover, sub-10ms session reads, and durable itineraries. Which stateless design with externalized state meets resilience and performance goals?
• A media company stores 800 container image versions in ECR across dev and prod, facing rising storage costs, stale vulnerable tags, and no visibility into base-image CVEs. Teams overwrite mutable tags and never clean up. Which container image management using security scans and lifecycle policies should the architect enforce?
• A gaming leaderboard uses DynamoDB with 80% repeated reads of the same player profiles and suffers throttling during tournaments despite overprovisioned capacity. P99 latency must stay under 5 ms without changing application queries. Which data caching strategy optimizes DynamoDB read performance?
• A fintech startup will operate 150 VPCs across dev, test, and prod with overlapping team CIDRs, must prevent IP exhaustion, enforce segmentation between tiers, and provide auditors with a single view of allocations. Which VPC addressing and segmentation design ensures scalable isolation?
• A manufacturer runs corp.example.com on on-premises Active Directory DNS and runs the same domain in a VPC via a Route 53 private hosted zone for EC2 workloads. Both sides must resolve each other's new records without changing the domain name. Which DNS integration design achieves bidirectional hybrid resolution for this split-horizon namespace?
• A media company ingests 8,000 click events per second from web clients, must transform JSON to Parquet in near real time with no servers to manage, auto-discover schema for analysts, and support ad-hoc SQL without clusters. Which serverless data processing pipeline meets these streaming and analysis requirements?
• A retail group has sales data in three member accounts registered to S3, needs governed cross-account discovery of curated tables only, plus privacy-preserving joins with a supplier without sharing raw data. Which data cataloging and sharing pattern meets all needs?
• A sports media startup serves 200,000 fans with live scores, chat, and polls needing sub-second fan-out and bidirectional messages. REST polling overloaded servers and missed updates during goals. The team runs on API Gateway, Lambda, and DynamoDB. Which WebSocket and publish-subscribe design supports real-time data processing?
• An e-commerce platform runs burst checkout APIs on Lambda and catalog services on EKS with spiky traffic. The team must scale functions without throttling, scale pods on custom latency metrics, and add nodes only when pods cannot schedule. Which auto scaling combination fits serverless and container patterns?
• A retailer runs public web apps behind an Application Load Balancer and private VPC workloads needing east-west inspection between subnets, SQL injection blocking, and subnet-level filtering with audit trails. Which network security architecture delivers traffic inspection, filtering, and application-layer protection?
• A robotics manufacturer needs to run containerized quality-inspection workloads inside its factory with single-digit millisecond access to on-site machines, using AWS APIs and EKS while AWS operates the rack hardware. Which hybrid compute pattern satisfies this low-latency on-premises requirement with managed infrastructure?
• A fintech startup needs public HTTPS APIs with path-based routing to microservices, sudden 10x burst traffic, plus a separate low-latency TCP feed for market data with static IPs for allowlisting. Which ingress pattern optimizes resources for both usage patterns?
• A health SaaS has 400 standard clinics sharing tables and 10 hospital tenants requiring strict data isolation and per-tenant keys for compliance. A single pooled database without controls caused cross-tenant reads in testing. Which multi-tenant architecture with tenant isolation patterns meets both needs?
• A fintech order flow spans payment authorization, fraud check, and ledger posting across three Lambdas, must survive crashes mid-flow, retry steps with backoff, and maintain exactly-once state without custom checkpoint code. Which durable execution pattern handles this multi-step workflow?
• A ticketing platform must process seat holds in strict order per event, handle duplicate webhook deliveries safely, and fan out confirmations to email, SMS, and analytics with at-least-once delivery. Which event-driven messaging pattern meets ordering and delivery guarantees?
• A global streaming platform is exhausting IPv4 addresses, faces higher NAT costs, and must support IPv6 clients while keeping IPv4 compatibility for legacy encoders. Which IPv6 adoption and dual-stack migration strategy enables end-to-end coexistence?
• A retailer operates 20 member accounts across two Regions, must aggregate order events centrally for analytics, preserve source account context, enforce least-privilege event access, and forward events reliably across Regions. Which cross-account event routing pattern meets these needs?
• A bank centralizes Bedrock guardrails and logging in a shared-services account while product teams build assistants in 20 workload accounts. Security forbids internet-exposed model traffic and duplicated guardrail rules. Which multi-account generative AI integration for Bedrock meets both goals?
• A logistics group runs 40 workload accounts with a shared payments VPC and an on-premises data center over Direct Connect. Workloads need centralized routing, overlapping IP isolation for acquisitions, and private access to payments without traversing the internet. Which connectivity design provides scalable hybrid and multi-account VPC integration?
• A global media site serves personalized images from S3 via CloudFront to 40 countries. It must rewrite viewer URLs, add country headers, and validate lightweight tokens at the edge for millions of requests with submillisecond startup and minimal cost. Which edge compute control meets the latency requirement for this token check?
• A mobile gaming startup runs leaderboard and session logic on EC2 instances with local memory and disk. Players lose progress when instances restart and scaling out causes inconsistent scores across Availability Zones. The team wants stateless containers that scale horizontally. Which externalized state management design best enables stateless application scale?
• A fintech runs active-active trading APIs in eu-west-1 and us-east-1 over TCP with TLS. Clients need fixed anycast IPs, sub-minute failover for TCP health failures, and no DNS caching delays. Compliance requires traffic to stay on the AWS backbone. Which global traffic routing strategy meets multi-Region TCP routing requirements?
• A SaaS company is decomposing a monolith into 30 Kubernetes-native microservices with spiky traffic, wants Kubernetes APIs and serverless nodes, and requires namespace isolation plus autoscaling without managing EC2. Which container orchestration design for microservices best balances control and operations?
• A retailer stores 80 TB of clickstream and orders in S3 with duplicated Parquet datasets. Analysts need ACID upserts, schema evolution, fine-grained access, and SQL from Athena and Redshift. Engineering wants open formats without a proprietary store. Which data lakehouse design supports governed Iceberg queries with Lake Formation?
• A logistics company ingests 15,000 vehicle telemetry events per second that must be filtered, enriched, cataloged for SQL, and available to analysts within minutes. Engineers want no servers to manage and pay only for queries run. Which serverless data processing and analysis pipeline meets near-real-time and ad hoc needs?
• A healthcare SaaS must deploy HIPAA workloads across three Availability Zones with web, app, and database tiers, non-overlapping CIDRs for future peering, and audit-ready IP tracking. Growth will require many VPCs and subnets. Which VPC architecture using segmentation and address management ensures scalable isolation?
• A travel company wants a conversational agent that answers policy questions from its help center, checks live booking APIs, and books changes when the user confirms. Responses must cite sources and invoke verified backend actions. Which AI agent architecture integrates tools using Bedrock AgentCore and Knowledge Bases?
• A live auction platform must push bid updates to 50,000 browsers in under a second and broadcast each new bid to all watchers while tracking active connections. Polling overloads the backend. Which architecture supports real-time bidirectional messaging for this fan-out requirement?
• A fraud startup scores payments in under 100 ms with spiky daytime traffic and idle nights, using a custom XGBoost container. It needs automatic scaling, A/B testing of model variants, and minimal ops overhead. Which ML inference architecture using SageMaker AI endpoints meets these needs?
• A fintech runs public APIs on an ALB with microservices in private subnets and Direct Connect to on-premises. It must inspect all east-west and egress traffic, filter stateless floods, and block OWASP web attacks centrally. Which network security architecture provides layered traffic inspection and filtering?
• A retailer runs 40 ECS microservices across three VPCs needing fine-grained L7 routing, identity-aware access, and unified tracing without managing sidecar proxies. Which service mesh design for microservice communication best reduces operational overhead?
• A food delivery company needs live driver ETAs from 20K Kafka events per second and nightly SaaS order dumps for BI. Analysts query curated data in Redshift with sub-second dashboards. Ingestion must be managed without custom servers. Which analytics pipeline supports real-time MSK streaming with batch SaaS ingestion?
• An e-commerce checkout orchestrates inventory reserve, payment, fraud review with 24-hour human approval, and shipment across Lambda, SQS, and third-party APIs. Timeouts and partial failures cause double charges and lost orders. Engineers need retries, parallel steps, and durable state across days. Which durable execution pattern coordinates the multi-step checkout reliably?
• A fintech SaaS has 200 startups on shared services but five banks demand isolated compute, data, and keys with tenant-aware auth. It must balance cost efficiency with strong isolation. Which multi-tenant control satisfies both isolation tiers for this platform?