Alibaba Cloud CAP-C01 Alibaba Cloud Certified Professional: Cloud Architect Exam Practice Test

Option A offers the strongest combination of resilience, predictable baseline capacity, flexibility, and reduced cost. Nine standard pay-as-you-go ECS instances are spread evenly across three zones and can support the scheduled workloads that have strict SLA requirements. The remaining three instances use lower-cost preemptible/spot capacity for user jobs that can tolerate interruption or delay.

Alibaba Cloud describes spot instances as offering the same compute performance as ordinary pay-as-you-go ECS but at substantially lower prices, with the trade-off that capacity can be reclaimed. This makes spot capacity appropriate for interruption-tolerant workloads but inappropriate as the sole capacity supporting strict SLAs.

A Savings Plan discounts eligible pay-as-you-go ECS usage while preserving significantly greater flexibility than traditional reserved-instance matching. Current Alibaba Cloud documentation states that Savings Plans apply discounts to pay-as-you-go usage and can offer flexibility across instance configurations; they do involve a one- or three-year hourly spend commitment, but they do not provision or reserve fixed ECS capacity.

Options C and D concentrate too much reliable capacity into fewer zones or place excessive workload on interruptible capacity. Option A therefore provides the best workload-tiering and multi-zone design among the available choices.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — multi-zone ECS, workload resilience, Savings Plans, and spot instances.

==================================================

OSS versioning is specifically intended to protect objects from unintended deletions and overwrites. When versioning is enabled, OSS retains historical versions of an object. A normal delete operation creates a delete marker instead of permanently destroying all existing versions, allowing an administrator to restore a previous version when required.

Alibaba Cloud explicitly recommends versioning as a protection mechanism against accidental deletion or overwriting. Its current documentation states that, after versioning is enabled, accidentally deleted or overwritten content remains available as historical versions that can subsequently be restored.

Encryption protects confidentiality of stored data but does not provide logical deletion recovery. A private bucket ACL reduces unauthorized access but does not stop an authorized administrator or application from deleting an object accidentally. Lifecycle rules automate transitions or deletion according to defined policies; improperly configured lifecycle rules can themselves delete data, so they are not the primary protection mechanism requested here.

For particularly critical workloads, versioning can be supplemented with backup or carefully designed cross-region replication, but among the four choices, enabling OSS versioning directly addresses accidental deletion and provides recovery capability.

Study Guide reference: Core Storage Infrastructure Deep Dive; data durability, protection, and OSS object-management mechanisms.

==================================================

Alibaba Cloud CDN addresses the front-end performance problem by caching static resources at edge Points of Presence close to users. Instead of every image, JavaScript file, stylesheet, or other cacheable object being retrieved from the origin application, CDN returns cached copies from nearby edge nodes. This reduces network latency and decreases load on the original application servers. Alibaba Cloud specifically identifies reduced latency and lower origin workload as primary benefits of CDN.

Read/write splitting addresses database-side pressure. ApsaraDB RDS for MySQL can use database proxy functionality to direct write operations to the primary instance and distribute eligible read operations to read-only instances. This is especially effective for read-heavy web applications because it reduces CPU and I/O load on the primary database and increases aggregate read throughput.

A multi-zone database improves availability rather than directly solving page-load latency. AnalyticDB is an analytical database and should not replace RDS simply to handle transactional data. OSS is optimized for static objects; hosting dynamic application content there does not fit its object-storage model.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — CDN acceleration, RDS read scaling, database proxies, and application performance optimization.

==================================================

Serverless App Engine is the strongest fit because it provides an application-oriented serverless platform specifically intended for hosting containerized and microservice applications without requiring the organization to administer Kubernetes clusters or ECS infrastructure. SAE can deploy applications directly from container images, including images stored in Alibaba Cloud Container Registry, and automatically manages provisioning, application lifecycle, scaling, monitoring, and underlying resources.

SAE namespaces also provide logical isolation for development, testing, and production environments. This directly addresses the requirement for separate production and testing deployments while avoiding the overhead of maintaining separate ACK clusters.

SAE integrates with Application Load Balancer for Layer 7 ingress and routing. ALB can expose SAE applications and route traffic to the appropriate backend application instances.

ACK Serverless removes worker-node management but still introduces Kubernetes objects and cluster administration. ACK Managed requires even greater cluster administration. Function Compute is optimized for functions and event-driven processing rather than straightforward migration of a multi-service container application.

Study Guide reference: Core Infrastructure Deep Dive — serverless compute, SAE, containerized applications, microservices, and application scaling.

==================================================

The core problem is durability during transient processing or network failures. A topic provides publish/subscribe notification delivery, but placing an SMQ queue behind the topic creates a persistent buffer between the notification producer and the Function Compute consumer. Alibaba Cloud supports subscribing a queue to an SMQ topic so that every message published to the topic is copied into the queue and retained for consumption.

Function Compute should then process records from the queue. Queue semantics provide the required failure recovery: after a consumer receives a message, it becomes temporarily invisible. The consumer deletes the message only after successful processing. If processing fails—for example because of a temporary connectivity problem—the message is not deleted and becomes visible again after the visibility timeout, allowing another processing attempt.

Function Compute also supports SMQ queue triggers with configurable retries, fault-tolerance behavior, and dead-letter handling, which can further strengthen this architecture.

Increasing memory does not fix network reliability, and multi-region deployment alone does not guarantee message persistence. A durable queue therefore prevents transient failures from silently losing ingestion work.

Study Guide reference: Core Infrastructure Deep Dive — Simple Message Queue, Function Compute, durable asynchronous processing, retries, and decoupled event-driven architecture.

The requirements explicitly identify two separate environments: a production ACK cluster using stable pay-as-you-go ECS capacity and a dedicated development cluster that is used only intermittently. Option D satisfies both requirements while preserving ACK-managed node-pool operations.

For the development cluster, preemptible instances—now generally described as spot instances in current Alibaba Cloud documentation—are appropriate because the workload is temporary, interruption-tolerant, and cost-sensitive. Alibaba Cloud states that spot capacity can reduce compute costs substantially compared with ordinary pay-as-you-go instances. ACK node pools can use spot instances and can automatically perform scaling and replacement operations.

The production cluster remains on pay-as-you-go nodes, avoiding the reclamation risk associated with spot capacity. A separate managed development cluster also preserves workload isolation.

Option A does not provide the required second development cluster and imposes subscription commitment. Option B requires Eric to maintain an external Auto Scaling and bootstrap mechanism, contradicting the desire for ACK to manage nodes. Option C again describes only one cluster and fails to retain the required production environment.

Study Guide reference: Core Infrastructure Deep Dive — ACK managed clusters, node pools, spot/preemptible ECS, and cloud cost optimization.

Express Connect and CEN Transit Router provide the enterprise networking foundation required for a multinational hybrid environment. Express Connect gives the company ' s on-premises infrastructure dedicated private connectivity to Alibaba Cloud. A Virtual Border Router can then attach to a CEN Transit Router, allowing the data center to communicate privately with VPCs in the same region and across other regions.

CEN provides centralized routing for VPCs, VBRs, inter-region connections, and other network attachments. This avoids the operational complexity and poor scalability of maintaining large meshes of VPC peering links or independent VPN connections.

For network visibility, CEN Transit Router flow logs integrate directly with Simple Log Service. These flow logs capture five-tuple traffic information, bytes, packets, and connection details and deliver the records to SLS for monitoring, troubleshooting, compliance analysis, and long-term querying.

Security Center supplements this design by providing centralized security posture and workload-security management. In a comprehensive enterprise implementation, network access controls and security policies are applied alongside this centralized connectivity architecture.

VPC peering becomes difficult to administer at multinational scale, individual VPN gateways add operational complexity, and Global Accelerator is designed primarily to accelerate application access rather than replace an enterprise hybrid WAN.

Study Guide reference: Building Enterprise-grade Networks on Alibaba Cloud — Express Connect, CEN, Transit Router, SLS, and centralized hybrid networking.

==================================================

The ECS security group must allow inbound HTTPS traffic. For an inbound security-group rule, the Internet clients are the source, so the correct rule permits TCP destination port 443 from source 0.0.0.0/0. This makes Option C correct. Alibaba Cloud security groups are stateful, which means response traffic belonging to an allowed connection is automatically permitted and does not require a matching outbound security-group rule.

Network ACLs behave differently. Alibaba Cloud VPC network ACLs are stateless. If the ACL permits an inbound HTTPS request but does not permit the corresponding return packet, the TCP session cannot operate correctly. The inbound ACL therefore needs TCP 443 from Internet clients, while the outbound ACL must permit return traffic to client ephemeral destination ports. Alibaba Cloud explicitly recommends 1024–65535 when all client ephemeral-port implementations must be supported.

Option D permits only the incoming side of the ACL and therefore fails because response packets remain blocked. Option E incorrectly assumes that outbound server responses use destination port 443; the server ' s source port is 443, but the destination is the client ' s ephemeral port.

Study Guide reference: Securing Workloads on Alibaba Cloud — stateful Security Groups, stateless network ACLs, HTTPS exposure, and ephemeral ports.

==================================================

Simple Log Service (SLS) is a managed log-ingestion, storage, query, analysis, and visualization service, making it the most operationally efficient front-end for this telemetry workload. It eliminates the requirement to provision and manage ECS-based collectors or a separate search cluster simply to ingest and analyze log records.

For longer-term retention, Alibaba Cloud supports automatically shipping SLS data to OSS. This creates a clean hot-to-cold architecture: maintain recent data in SLS for interactive analysis and export older data to OSS for economical retention.

OSS lifecycle management can then automatically transition aging objects to lower-cost storage classes such as Archive. Lifecycle rules are explicitly designed to automate storage-class transitions based on object age, eliminating manual archival administration.

Option A requires additional Elasticsearch retention administration. Option B requires managing ECS infrastructure even though the question explicitly prioritizes reduced operational management. Option D adds Kafka unnecessarily and still specifies manual archival, directly conflicting with the requirement to minimize operational effort.

Thus, SLS for managed ingestion and recent analysis combined with SLS-to-OSS shipping and OSS lifecycle transitions provides the strongest serverless/managed retention architecture.

Study Guide reference: Core Infrastructure Deep Dive; Core Storage Infrastructure; operationally efficient log and data-storage architecture.

==================================================

This is fundamentally a lift-and-shift filesystem workload. The applications already depend on standard operating-system file interfaces, and the requirement explicitly states that application code should not be changed. ECS therefore preserves the existing Linux and Windows execution environments, while File Storage NAS supplies managed shared filesystem semantics.

Alibaba Cloud NAS supports NFS and SMB protocols and is designed specifically for workloads migrating from traditional file servers. Alibaba documentation describes NAS as appropriate for lift-and-shift applications because existing applications can continue using standard filesystem calls, path structures, and file-locking behavior without rewriting file I/O logic.

For cross-operating-system sharing, Alibaba Cloud recommends SMB when Linux and Windows clients must access the same filesystem, and Linux ECS can mount SMB when cross-platform data sharing is required.

OSS would change the storage interface from filesystem semantics to object APIs, normally requiring application changes. Message Queue changes the application ' s data exchange architecture. ACK introduces unnecessary containerization complexity.

Therefore, Linux ECS + Windows ECS + managed NAS most closely preserves the existing application model while eliminating the operational problems associated with manually synchronized on-premises file systems.

Study Guide reference: Core Infrastructure Deep Dive — ECS migration, File Storage NAS, NFS/SMB, and lift-and-shift architecture.

Option B provides the simplest consolidated content-delivery architecture. Alibaba Cloud CDN can use multiple origins, and current CDN functionality supports origin-selection rules based on parameters such as request path, headers, query strings, and cookies. This allows static requests to be associated with an OSS origin while application requests are forwarded toward the ALB-backed application tier.

Static objects stored in OSS benefit directly from CDN edge caching. Requests are routed to nearby CDN points of presence, and cached resources can be returned without repeatedly accessing the OSS origin, reducing both latency and origin load.

Dynamic responses are generally not cached because they are generated uniquely for requests. They can still be routed to the application origin according to the configured origin rules.

The Global Accelerator alternatives create an unnecessarily fragmented architecture and attempt to use separate acceleration paths where one CDN-facing domain and origin-routing configuration can satisfy the question with fewer components. They also introduce additional DNS and acceleration configuration.

Therefore, a single CDN delivery layer with OSS and ALB-backed origins, combined with Alibaba Cloud DNS directing the application domain to CDN, produces the lowest configuration overhead.

Study Guide reference: Delivering Services and Content on Alibaba Cloud — CDN, OSS acceleration, ALB origins, and intelligent content delivery.

==================================================

Simple Log Service (SLS) is the appropriate logging platform for an ACK Serverless environment. Serverless Kubernetes removes much of the node-management responsibility, so the logging architecture should follow the same managed-service model rather than introduce dedicated log-processing infrastructure.

Alibaba Cloud provides native SLS integration for ACK Serverless. SLS can collect container standard output and application log files and then provide centralized search, analysis, dashboards, alerting, and downstream shipping. Alibaba documentation specifically states that ACK Serverless provides managed SLS capabilities and supports collecting container logs directly into SLS.

ARMS is primarily an application performance monitoring and observability platform; it does not replace SLS as the core centralized log-ingestion service. Option C is incorrect because SLS supports near-real-time collection and analysis. Option D also misunderstands serverless logging: scaling events do not inherently require dedicated logging servers.

The architecture should therefore preserve the operational advantages of serverless compute by using SLS as a fully managed, elastic logging layer capable of handling workload fluctuations without requiring the organization to provision and administer separate logging infrastructure.

Study Guide reference: Core Infrastructure Deep Dive — ACK, serverless container architecture, observability, and Simple Log Service.

The application needs asynchronous decoupling between high-volume ingestion and database writes. Simple Message Queue provides exactly this load-leveling pattern. The first Function Compute function can acknowledge incoming requests quickly and place each item into SMQ. A second function consumes the queued messages and writes them to RDS at a rate the database can sustain.

SMQ is a distributed managed messaging service specifically designed to decouple producers and consumers. Alibaba Cloud identifies traffic-spike buffering, asynchronous processing, and independent component scaling as core SMQ use cases. Queue messages are delivered at least once during their validity period, significantly improving durability compared with directly coupling every incoming API request to a database write.

Function Compute also integrates directly with SMQ queues and topics as event sources, reducing custom integration and infrastructure management.

Kafka could also provide durable asynchronous messaging, but it is a more elaborate streaming platform than necessary for this workload and therefore carries additional configuration complexity. Moving to ECS reintroduces server administration, while replacing RDS does not solve the ingestion decoupling problem.

Study Guide reference: Core Infrastructure Deep Dive — Function Compute, messaging architectures, asynchronous processing, and scalable application integration.

==================================================

The three explicit requirements are centralized key management, encryption in transit, and encryption at rest.

KMS satisfies centralized cryptographic-key management. It provides secure key creation, storage, lifecycle management, access control, and integration with Alibaba Cloud services such as databases and storage. Customer-managed software or hardware-protected keys can also be used where stricter compliance controls are required.

Certificate Management Service provides SSL/TLS certificates that establish encrypted HTTPS/TLS communication and verify server identity. TLS prevents sensitive transaction information from being transmitted as readable plaintext across network connections.

Transparent Data Encryption protects database data at rest. Alibaba Cloud RDS documentation identifies TDE as an encryption layer protecting database data files and backups without requiring applications to perform the underlying encryption themselves. RDS also separately supports SSL for database connection encryption.

Security Groups are an important network-access control, but the question requires exactly three controls specifically addressing encryption and centralized key management. Redis session management is unrelated.

The resulting security architecture therefore uses KMS for keys, TLS certificates for data in transit, and RDS TDE for persistent data at rest.

Study Guide reference: Securing Workloads on Alibaba Cloud — KMS, TLS/SSL, RDS encryption, TDE, and cryptographic key governance.

==================================================

VPC peering provides direct private communication between two VPCs without exposing either application or database traffic to the public Internet. Alibaba Cloud VPCs are isolated by default. After creating a peering connection and configuring the required bidirectional routes, resources in VPC A and VPC B can communicate using private IP addresses. VPC peering supports same-account and cross-account connections as well as same-region and cross-region configurations.

This is materially more secure than exposing the database publicly. The application ' s existing EIP does not need to participate in database connectivity; the application can use its ECS private address when communicating across the peering link. Security-group and database whitelist rules should then restrict access to only the required source CIDRs and ports.

Option A intentionally routes database access through public addressing. Option B introduces an unnecessary proxy server, additional management overhead, and another failure point. Option D creates the largest attack surface by making the database Internet-accessible.

The design principle is straightforward: when workloads in two Alibaba Cloud VPCs require direct communication, establish private network connectivity and keep sensitive database traffic off the Internet.

Study Guide reference: Building Enterprise-grade Networks on Alibaba Cloud — VPC isolation, VPC peering, routing, and private database access.