I85PREP
⌘ K
Alibaba Cloud Architect Professional study materials
Alibaba Cloud Architect Professional study resources

Alibaba Cloud Architect Professional practice questions

One question at a time. Build your Alibaba Cloud Architect Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Architecture Design

A company wants its web tier to automatically scale out when CPU utilization stays above 70% for several minutes. Which Alibaba Cloud service should be used to define and trigger that scaling behavior?

  1. CloudMonitor alarm rules only
  2. Resource Access Management
  3. Server Load Balancer
  4. Auto Scaling Correct answer.

Explanation

Auto Scaling manages scaling groups and scaling rules that add or remove ECS instances based on triggers such as CloudMonitor alarms. It is the service that performs the actual instance scaling action.

Question 2Cloud Architecture Design

An application running on ECS needs to store and retrieve arbitrary numbers of objects ranging from a few KB to several GB without managing file systems. Which Alibaba Cloud storage service fits best?

  1. Object Storage Service Correct answer.
  2. NAS
  3. Cloud Disk
  4. ApsaraDB for Redis

Explanation

Object Storage Service is designed for massive volumes of unstructured objects accessed via HTTP APIs, with no file-system or capacity provisioning concerns. It scales automatically for object counts and object sizes.

Question 3Cloud Architecture Design

A solutions architect is designing a multi-zone deployment in a single region. What is the primary availability benefit of spreading ECS instances across multiple zones?

  1. It guarantees lower latency to end users worldwide
  2. It isolates the application from the failure of a single data center Correct answer.
  3. It reduces the cost of outbound internet bandwidth
  4. It removes the need for a load balancer

Explanation

Zones are physically separate data centers with independent power and network infrastructure within a region. Distributing instances across zones means a single-zone failure does not take down the whole application.

Question 4Cloud Architecture Design

Which Alibaba Cloud component resolves a domain name to the address of a Server Load Balancer or application endpoint and supports weighted and latency-based routing policies?

  1. Express Connect
  2. Alibaba Cloud DNS Correct answer.
  3. Virtual Private Cloud
  4. Cloud Enterprise Network

Explanation

Alibaba Cloud DNS provides authoritative domain resolution and supports routing policies such as weighted, latency-based, and failover. It is the service that answers client DNS queries.

Question 5Cloud Architecture Design

A team wants to run containerized microservices without provisioning or managing the underlying ECS nodes. Which Alibaba Cloud offering directly provides that serverless container runtime?

  1. Function Compute
  2. Serverless App Engine / Elastic Container Instance Correct answer.
  3. Container Registry
  4. Elastic Compute Service

Explanation

Serverless App Engine and Elastic Container Instance let you run containers without managing cluster nodes, handling the underlying infrastructure for you. They target container workloads rather than pure functions.

Question 6Cloud Architecture Design

Which Alibaba Cloud service is used to create an isolated virtual network with its own IP address range, subnets, and route tables?

  1. NAT Gateway
  2. Smart Access Gateway
  3. Cloud Enterprise Network
  4. Virtual Private Cloud Correct answer.

Explanation

Virtual Private Cloud provides a logically isolated network where you define CIDR blocks, subnets, and routing. Other services attach to or connect VPCs but do not define the isolated network itself.

Question 7Cloud Architecture Design

An architect needs a managed relational database that automatically handles primary/standby failover within a region. Which service category should be selected?

  1. ApsaraDB for Redis in standalone mode
  2. Table Store
  3. ApsaraDB for RDS with high-availability edition Correct answer.
  4. AnalyticDB

Explanation

ApsaraDB for RDS high-availability edition maintains a standby node and performs automatic failover if the primary fails. It is the managed relational option built for this resilience.

Question 8Cloud Architecture Design

What does the principle of least privilege require when designing Resource Access Management policies?

  1. Encrypting all policy documents at rest
  2. Rotating access keys every day
  3. Granting all permissions to administrators only
  4. Granting each principal only the permissions needed for its tasks Correct answer.

Explanation

Least privilege means each identity receives only the specific actions and resources it requires, minimizing blast radius. Broader grants or unrelated controls do not satisfy the principle.

Question 9Cloud Architecture Design

A web application stores user-uploaded images in OSS and serves them to global users. The architect wants to reduce latency for overseas users without changing the application. Which approach is most appropriate?

  1. Enable OSS cross-region replication and serve from the nearest bucket Correct answer.
  2. Increase the size of the ECS instances serving the images
  3. Move the bucket to a single region close to headquarters
  4. Enable static website hosting on the origin bucket

Explanation

Cross-region replication copies objects to buckets in other regions so reads can be served from a location closer to users, reducing latency. Static hosting or larger ECS instances do not address geographic distance.

Question 10Cloud Architecture Design

An application in a VPC must reach the public internet for software updates, but the ECS instances have no public IP addresses and must not be directly reachable from the internet. Which component enables this?

  1. An internet-facing Server Load Balancer
  2. An Express Connect circuit
  3. A NAT Gateway with an elastic IP Correct answer.
  4. A VPC peering connection

Explanation

A NAT Gateway lets instances without public IPs initiate outbound internet traffic through an elastic IP while remaining unreachable inbound. It is the standard egress solution for private subnets.

Question 11Cloud Architecture Design

A company needs a shared, POSIX-compatible file system that multiple ECS instances across several availability zones can mount concurrently. Which storage choice meets this requirement?

  1. Local instance ephemeral disk
  2. NAS file system Correct answer.
  3. OSS bucket mounted as a block device
  4. A separate Cloud Disk per instance

Explanation

NAS provides a shared file-system interface that many instances can mount at once, including across zones within a region. Block disks and local disks are attached per instance.

Question 12Cloud Architecture Design

An e-commerce platform expects unpredictable traffic spikes and wants to add instances quickly while keeping costs low during quiet periods. Which Auto Scaling configuration best matches this goal?

  1. Scheduled scaling only at known times
  2. Manual scaling performed by operators
  3. A fixed scaling group sized for peak load
  4. Dynamic scaling rules tied to load metrics with a minimum capacity floor Correct answer.

Explanation

Dynamic scaling adjusts capacity automatically in response to real-time metrics, and a minimum floor keeps baseline availability. This balances responsiveness with cost during low-traffic periods.

Question 13Cloud Architecture Design

An architect is choosing between a Server Load Balancer layer-4 listener and a layer-7 listener for a TCP-based database proxy. Which statement justifies the choice?

  1. Layer-7 listeners terminate TLS and therefore cannot forward raw TCP
  2. Layer-4 listeners forward TCP traffic without inspecting application payloads Correct answer.
  3. Layer-7 listeners support HTTP header-based routing, which TCP requires
  4. Layer-4 listeners require an application-layer health check path

Explanation

Layer-4 listeners operate on transport-layer connections and forward TCP or UDP without parsing application data, which suits non-HTTP protocols. Layer-7 listeners are for HTTP/HTTPS with content-based routing.

Question 14Cloud Architecture Design

A company wants to connect its on-premises data center to a VPC with predictable bandwidth and low latency, and the traffic must not traverse the public internet. Which service should be used?

  1. VPC peering
  2. Express Connect dedicated connection Correct answer.
  3. VPN Gateway over the internet
  4. Smart Access Gateway over the internet

Explanation

Express Connect provides a dedicated physical link between on-premises infrastructure and Alibaba Cloud, giving predictable bandwidth and bypassing the public internet. VPN and internet-based options share public network paths.

Question 15Cloud Architecture Design

An application writes to an RDS instance and reads far more often than it writes. The architect wants to offload read traffic without changing the application's write path. Which feature should be enabled?

  1. RDS backup and restore
  2. RDS read-only instances Correct answer.
  3. RDS transparent data encryption
  4. RDS database proxy in write-only mode

Explanation

Read-only instances replicate from the primary and serve read queries, offloading the primary while the write path stays on the primary. Backups and encryption do not distribute query load.

Question 16Cloud Architecture Design

A workload runs batch jobs that can tolerate interruption and must be as cost-effective as possible. Which ECS purchasing option is most appropriate?

  1. Dedicated host instances
  2. Preemptible (spot) instances Correct answer.
  3. Subscription instances billed monthly
  4. Pay-as-you-go instances

Explanation

Preemptible instances offer large discounts but can be reclaimed, so they suit fault-tolerant, interruptible workloads like batch jobs. Subscription and pay-as-you-go cost more for the same capacity.

Question 17Cloud Architecture Design

An architect must ensure that if the primary region becomes unavailable, a standby environment in another region can take over with minimal data loss. Which combination best supports this?

  1. Cross-region replication plus a defined failover runbook Correct answer.
  2. Auto Scaling within one zone
  3. Single-region multi-zone deployment only
  4. Daily backups stored in the same region

Explanation

Disaster recovery across regions requires replicating data to the standby region and a tested failover procedure to promote it. Same-region measures cannot survive a full region outage.

Question 18Cloud Architecture Design

A company wants to decouple a front-end service from a slow back-end processor so that bursts do not overwhelm the processor. Which architecture is most appropriate?

  1. A message queue between the services Correct answer.
  2. A larger ECS instance for the processor
  3. Synchronous direct calls with retries
  4. A shared database table polled every second

Explanation

A message queue buffers bursts and lets the back-end consume at its own pace, decoupling the producers from consumers. Scaling up or synchronous retries do not absorb sudden load spikes.

Question 19Cloud Architecture Design

An architect is designing a VPC with public-facing web servers and private database servers. Which subnet and routing design best enforces isolation?

  1. Give every instance a public IP and rely on host firewalls
  2. Place databases in a public subnet and web servers in a private subnet
  3. Place web servers in a public subnet and databases in a private subnet with no internet route Correct answer.
  4. Place all servers in one public subnet with security groups

Explanation

Separating tiers into public and private subnets, with the private subnet lacking a route to the internet gateway, prevents direct inbound access to databases. Security groups add fine-grained control on top of subnet isolation.

Question 20Cloud Architecture Design

A solution must process millions of small event messages per hour with variable volume and the team does not want to manage servers. Which service fits best?

  1. A single large RDS instance with triggers
  2. A fixed-size ECS cluster polling a database
  3. A dedicated Express Connect circuit
  4. Function Compute triggered by events Correct answer.

Explanation

Function Compute runs code on demand in response to events and scales automatically with volume, with no server management. It suits variable-throughput event processing.

Question 21Cloud Architecture Design

An architect is evaluating whether to cache session data in ApsaraDB for Redis. Which design consideration most directly justifies the choice?

  1. Redis provides durable relational transactions
  2. Redis stores large binary objects indefinitely
  3. Redis serves low-latency reads for frequently accessed data Correct answer.
  4. Redis replaces the need for a load balancer

Explanation

Redis is an in-memory data store that provides very low-latency access to frequently used data such as sessions or hot keys. It is not a relational engine or a primary store for large objects.

Question 22Cloud Architecture Design

A company must prove that data stored in OSS is encrypted at rest and that access is limited to specific roles. Which combination of controls addresses both requirements?

  1. Transfer acceleration plus custom domain names
  2. Bucket versioning plus lifecycle rules
  3. Cross-region replication plus static website hosting
  4. Server-side encryption plus RAM policies scoped to roles Correct answer.

Explanation

Server-side encryption satisfies encryption at rest, while RAM policies scoped to specific roles enforce who can access the data. Versioning, replication, and acceleration address durability and performance rather than these two controls.

Question 23Cloud Architecture Design

An application spans two VPCs in different regions and must exchange traffic privately with predictable performance. Which design is most appropriate?

  1. Route traffic over the public internet with TLS
  2. Attach both VPCs to one NAT Gateway
  3. Rely on VPC peering across regions without additional configuration
  4. Use Cloud Enterprise Network to interconnect the VPCs Correct answer.

Explanation

Cloud Enterprise Network interconnects VPCs across regions over Alibaba Cloud's private backbone, providing private, predictable connectivity. Public internet routing exposes traffic to variable conditions.

Question 24Cloud Architecture Design

A team wants a database design that scales writes horizontally for a high-volume time-series workload with predictable query patterns. Which Alibaba Cloud service is most suitable?

  1. Table Store Correct answer.
  2. RDS for MySQL with a single primary
  3. AnalyticDB for transactional writes
  4. ApsaraDB for Redis as the system of record

Explanation

Table Store is a distributed NoSQL wide-column store designed to scale horizontally for high-volume reads and writes with flexible schemas. It suits time-series-style access patterns better than a single relational primary.

Question 25Cloud Architecture Design

An architect must design a solution where application secrets are rotated automatically and never stored in source code or instance images. Which approach best meets this requirement?

  1. Hard-code secrets in environment variables baked into images
  2. Commit encrypted secrets to the code repository
  3. Place secrets in a public OSS bucket restricted by obscurity
  4. Store secrets in a managed secrets service and retrieve them at runtime via an authorized role Correct answer.

Explanation

A managed secrets service centralizes storage and supports rotation, while runtime retrieval through an authorized role avoids embedding secrets in code or images. Baking secrets into images or repositories exposes them broadly.

Question 26Cloud Architecture Design

An architect is designing a VPC and needs to place a group of ECS instances that must have direct outbound access to the internet without any address translation. Which VPC component should the instances be placed in?

  1. A vSwitch connected only to a VPN Gateway
  2. A vSwitch whose route table points to a NAT Gateway
  3. A vSwitch associated with a public IP address pool and an internet gateway route Correct answer.
  4. A vSwitch with no route to an internet gateway

Explanation

Instances reach the internet directly when their vSwitch has a route to the internet gateway and they hold a public IP. NAT Gateway is for instances without public IPs, and a vSwitch with no internet route is private by design.

Question 27Cloud Architecture Design

Which Alibaba Cloud service provides a managed message queue that decouples producers and consumers and supports ordered messages?

  1. Alibaba Cloud Message Queue for Apache RocketMQ Correct answer.
  2. Alibaba Cloud Object Storage Service
  3. Alibaba Cloud Function Compute
  4. Alibaba Cloud Server Load Balancer

Explanation

Message Queue for Apache RocketMQ is a managed messaging service that supports ordered and transactional messages. Function Compute runs code, SLB distributes traffic, and OSS stores objects.

Question 28Cloud Architecture Design

An architect wants to distribute incoming HTTP requests across a group of ECS instances and perform health checks at the application layer. Which Server Load Balancer listener type should be used?

  1. UDP listener
  2. HTTP listener Correct answer.
  3. TCP listener
  4. GRE listener

Explanation

An HTTP listener operates at layer 7, enabling application-layer health checks and content-based routing. TCP and UDP listeners work at layer 4 and cannot inspect HTTP health.

Question 29Cloud Architecture Design

Which Alibaba Cloud service is a fully managed, serverless compute platform that runs code in response to events without provisioning servers?

  1. Alibaba Cloud ECS
  2. Alibaba Cloud Function Compute Correct answer.
  3. Alibaba Cloud Container Service for Kubernetes
  4. Alibaba Cloud Elastic Bare Metal Server

Explanation

Function Compute is a serverless, event-driven compute service where the platform manages servers and scaling. ECS, ACK, and EBM all require provisioning and managing underlying capacity.

Question 30Cloud Architecture Design

An architect needs to store infrequently accessed backup data for several years at the lowest cost, and retrieval latency of minutes is acceptable. Which OSS storage class is most appropriate?

  1. Standard
  2. Infrequent Access
  3. Archive Correct answer.
  4. Cold Archive

Explanation

Archive storage is designed for long-term retention of data that is rarely accessed, with lower storage cost and retrieval times measured in minutes. Cold Archive is for even colder data with longer restore times, while Standard and Infrequent Access cost more for storage.

Question 31Cloud Architecture Design

Which Alibaba Cloud service provides a managed, highly available Domain Name System for resolving domain names to IP addresses?

  1. Alibaba Cloud DNS Correct answer.
  2. Alibaba Cloud Direct Connect
  3. Alibaba Cloud Smart Access Gateway
  4. Alibaba Cloud VPN Gateway

Explanation

Alibaba Cloud DNS is a managed DNS service for domain resolution. Direct Connect, VPN Gateway, and Smart Access Gateway are connectivity services, not DNS resolvers.

Question 32Cloud Architecture Design

An architect is designing for high availability across availability zones. Which statement best describes an Alibaba Cloud region?

  1. A region is a single logical data center shared by all tenants
  2. A region contains a single availability zone with one data center
  3. A region is a billing construct with no physical infrastructure
  4. A region is a geographic area containing multiple isolated availability zones Correct answer.

Explanation

A region is a geographic area that contains multiple availability zones, which are isolated power and network domains. Deploying across zones within a region improves fault tolerance.

Question 33Cloud Architecture Design

Which Alibaba Cloud service is used to centrally manage permissions and identities for Alibaba Cloud resources?

  1. Alibaba Cloud CloudMonitor
  2. Alibaba Cloud Config
  3. Alibaba Cloud ActionTrail
  4. Resource Access Management (RAM) Correct answer.

Explanation

RAM manages users, groups, roles, and policies that control access to Alibaba Cloud resources. ActionTrail audits API calls, Config evaluates resource compliance, and CloudMonitor tracks metrics.

Question 34Cloud Architecture Design

A company runs a stateless web tier behind Server Load Balancer and wants the tier to scale out automatically based on CPU utilization. Which Alibaba Cloud service should be used?

  1. Auto Scaling Correct answer.
  2. Alibaba Cloud CDN
  3. Alibaba Cloud WAF
  4. Resource Orchestration Service

Explanation

Auto Scaling adjusts ECS instance count based on scaling rules such as CPU thresholds and integrates with SLB. ROS templates resources, CDN caches content, and WAF filters web attacks.

Question 35Cloud Architecture Design

An application running on ECS instances in a VPC needs to access OSS without sending traffic over the public internet. Which approach should the architect use?

  1. Use an OSS VPC endpoint so traffic stays within the Alibaba Cloud private network Correct answer.
  2. Set up an IPsec VPN tunnel to the OSS public endpoint
  3. Assign public IP addresses to all ECS instances
  4. Configure a NAT Gateway for outbound internet access to OSS

Explanation

OSS supports VPC endpoints that route requests over the private network, avoiding public internet exposure. NAT and public IPs still traverse the internet, and a VPN to a public endpoint is unnecessary.

Question 36Cloud Architecture Design

An architect must ensure that an application can continue reading and writing data if a single ECS instance fails, without manual intervention. Which design meets this requirement with the least operational effort?

  1. Deploy the application on a single ECS instance with a scheduled snapshot
  2. Deploy the application on a single ECS instance and monitor it with CloudMonitor
  3. Deploy the application across multiple ECS instances in an Auto Scaling group behind a Server Load Balancer Correct answer.
  4. Deploy the application on a single ECS instance with a manual failover runbook

Explanation

Spreading instances across an Auto Scaling group behind SLB provides automatic health-check-based failover and replacement. Single-instance designs require manual recovery or only protect data, not availability.

Question 37Cloud Architecture Design

A team wants to run containerized microservices and have the platform manage node patching and scaling while still allowing Kubernetes APIs. Which Alibaba Cloud service best fits?

  1. Elastic Compute Service with self-managed Kubernetes
  2. Elastic Container Instance
  3. Container Service for Kubernetes (ACK) with managed node pools Correct answer.
  4. Function Compute

Explanation

ACK with managed node pools provides a managed Kubernetes control plane and automated node lifecycle management. Self-managed Kubernetes on ECS shifts patching to the team, while Function Compute and ECI are not full Kubernetes cluster services.

Question 38Cloud Architecture Design

An architect is designing a multi-tier application and wants the database tier to be reachable only from the application tier. Which VPC configuration achieves this?

  1. Assign public IPs to the database instances and restrict access by password
  2. Place the database tier in a vSwitch with a route to the internet gateway
  3. Place the database tier in a private vSwitch and use security group rules that allow only the application tier's security group Correct answer.
  4. Place both tiers in the same public vSwitch and rely on application authentication

Explanation

Isolating the database in a private vSwitch and using security group references restricts traffic to the application tier. Public placement and password-only controls expose the database to broader network access.

Question 39Cloud Architecture Design

A company wants to migrate an on-premises Oracle database to Alibaba Cloud with minimal application changes and wants the vendor to manage backups, patching, and high availability. Which service should the architect recommend?

  1. ApsaraDB for RDS for Oracle Correct answer.
  2. Alibaba Cloud Table Store
  3. A self-managed Oracle database on ECS
  4. ApsaraDB for Redis

Explanation

ApsaraDB for RDS supports Oracle and provides managed backups, patching, and high availability. Self-managed Oracle on ECS shifts operational duties to the customer, while Redis and Table Store are different data models.

Question 40Cloud Architecture Design

An architect needs to protect a public-facing web application from common web exploits such as SQL injection and cross-site scripting. Which Alibaba Cloud service should be deployed?

  1. Alibaba Cloud Cloud Firewall
  2. Alibaba Cloud Security Center
  3. Alibaba Cloud Web Application Firewall Correct answer.
  4. Alibaba Cloud Anti-DDoS Basic

Explanation

Web Application Firewall inspects HTTP/HTTPS traffic and blocks application-layer attacks like SQL injection and XSS. Anti-DDoS mitigates volumetric attacks, Cloud Firewall controls network traffic, and Security Center is a posture management service.

Question 41Cloud Architecture Design

An application writes logs to OSS and the architect wants to automatically transcode uploaded video files as soon as they land in a bucket. Which combination of services achieves this with minimal custom infrastructure?

  1. OSS event notification triggering Function Compute Correct answer.
  2. A cron job on an ECS instance polling the bucket
  3. Server Load Balancer health checks invoking a transcoder
  4. CloudMonitor alarms restarting a transcoding script

Explanation

OSS can emit event notifications when objects are created, and Function Compute can run transcoding logic in response. Polling, load balancer health checks, and monitoring alarms do not provide event-driven processing.

Question 42Cloud Architecture Design

A company needs a data warehouse for complex analytical queries over petabytes of structured data. Which Alibaba Cloud service is designed for this workload?

  1. ApsaraDB for RDS
  2. Alibaba Cloud Message Queue for Apache Kafka
  3. Alibaba Cloud Table Store
  4. Alibaba Cloud AnalyticDB for PostgreSQL Correct answer.

Explanation

AnalyticDB for PostgreSQL is a massively parallel processing data warehouse optimized for large-scale analytical queries. RDS is for transactional workloads, Table Store is a NoSQL store, and Kafka is a messaging service.

Question 43Cloud Architecture Design

An architect must ensure that an ECS instance can download software packages from the internet but cannot be reached from the internet. Which configuration achieves this?

  1. Place the instance in a public vSwitch with a security group allowing all inbound traffic
  2. Assign an EIP to the instance and open all inbound ports
  3. Attach the instance to a Classic Load Balancer with a public endpoint
  4. Place the instance in a private vSwitch and route outbound traffic through a NAT Gateway Correct answer.

Explanation

A NAT Gateway provides outbound internet access for instances in a private vSwitch without exposing them to inbound connections. EIPs and public vSwitches create inbound reachability, and a public load balancer exposes the service.

Question 44Cloud Architecture Design

A company wants to enforce that all OSS buckets in its account have server-side encryption enabled and block public access. Which Alibaba Cloud service should the architect use to evaluate and remediate resource configuration continuously?

  1. Alibaba Cloud CloudMonitor
  2. Alibaba Cloud Resource Access Management
  3. Alibaba Cloud ActionTrail
  4. Alibaba Cloud Config Correct answer.

Explanation

Alibaba Cloud Config continuously evaluates resource configurations against rules and can trigger remediation. ActionTrail records API calls, RAM manages permissions, and CloudMonitor tracks metrics.

Question 45Cloud Architecture Design

An architect is designing a disaster recovery strategy with an RPO of minutes and an RTO of under an hour for a relational database. Which approach best meets these targets?

  1. Nightly logical backups shipped to another region
  2. Manual export of data to OSS once per day
  3. A weekly full backup stored in the same region
  4. Cross-region replication or backup with continuous log shipping and automated recovery runbooks Correct answer.

Explanation

Continuous log shipping and cross-region replication reduce data loss to minutes, and automated runbooks achieve recovery within the RTO. Daily or weekly backups cannot meet a minutes-level RPO.

Question 46Cloud Architecture Design

An application uses ApsaraDB for Redis as a cache. The architect wants to reduce the impact of a cache node failure on read availability. Which Redis architecture should be selected?

  1. A master-replica (read/write splitting) Redis instance with multiple replicas Correct answer.
  2. A single-node Redis instance
  3. A Redis instance with a larger memory specification
  4. A Redis instance with persistence disabled

Explanation

A master-replica deployment with multiple replicas allows reads to continue from replicas if the master fails and supports failover. A single node has no redundancy, and persistence or memory size does not provide availability.

Question 47Cloud Architecture Design

A company runs a steady-state batch processing workload 24x7 on ECS and wants to minimize compute cost while retaining the ability to change instance types. Which purchasing option is most appropriate?

  1. Savings plans with no commitment
  2. Pay-as-you-go instances
  3. Subscription (prepaid) instances Correct answer.
  4. Spot instances

Explanation

Subscription instances offer significant discounts for long-term, predictable workloads while allowing instance type changes at renewal or through supported conversions. Pay-as-you-go is costlier for steady state, and spot instances can be reclaimed.

Question 48Cloud Architecture Design

An architect must design an application that processes messages from a queue where each message must be processed exactly once and in order per partition. Which design consideration is most important?

  1. Use multiple consumers with no ordering guarantee and rely on idempotency
  2. Use a fan-out topic with many independent subscribers
  3. Use a standard queue with at-least-once delivery and deduplication by message ID
  4. Use a partitioned queue with ordered delivery and a single consumer per partition Correct answer.

Explanation

Ordering per partition requires that each partition be consumed by a single consumer in sequence, which preserves order and supports exactly-once processing. Fan-out and unordered consumers break per-partition ordering.

Question 49Cloud Architecture Design

A global application serves users from multiple regions and must route each user to the nearest healthy regional endpoint while failing over automatically. Which Alibaba Cloud service should be used?

  1. A single Server Load Balancer in one region
  2. Alibaba Cloud CDN with a single origin
  3. Alibaba Cloud VPN Gateway with static routes
  4. Alibaba Cloud DNS with global traffic management (GSLB) policies Correct answer.

Explanation

Alibaba Cloud DNS global traffic management supports latency-based and failover routing across regional endpoints. A single SLB or CDN origin does not provide multi-region health-based routing, and VPN Gateway is for connectivity.

Question 50Cloud Architecture Design

An architect is designing a multi-account landing zone and wants to centrally enforce network policies and share a common VPC with multiple business units while minimizing operational overhead. Which Alibaba Cloud capability best supports this?

  1. Per-unit NAT Gateways with no central control
  2. Separate VPCs per business unit with manual peering
  3. Alibaba Cloud Resource Directory with shared VPC and centralized network management Correct answer.
  4. A single RAM user shared by all business units

Explanation

Resource Directory organizes accounts into a hierarchy and supports shared VPC and centralized network policy enforcement. Manual peering and shared RAM users increase operational risk, and per-unit NAT Gateways lack central control.