Pass the Alibaba Cloud Alibaba Cloud Computing CAP-C01 Questions and answers with CertsForce

The existing architecture has two important bottlenecks: a single ECS compute node and files stored on storage attached to that individual ECS instance. Option E eliminates the compute single point of failure. A custom image allows identical ECS instances to be created, while Auto Scaling maintains multiple instances and ALB distributes requests across healthy backends. This provides horizontal scalability and significantly stronger application availability.

Option D addresses shared application storage. File Storage NAS is a managed, POSIX-compatible shared filesystem that multiple ECS instances can mount concurrently. All web servers therefore see the same files, while NAS handles storage scalability and consistency independently from the ECS lifecycle.

Option A improves performance by moving cacheable website content toward users. CDN serves static resources from nearby POPs and reduces requests and bandwidth reaching the origin infrastructure.

Although OSS is excellent for native object-storage workloads, mounting OSS through ossfs does not provide the same filesystem semantics and consistency characteristics as NAS for a traditional application requiring minimal modification. Global Accelerator primarily optimizes network paths and does not eliminate the application ' s compute or storage single points of failure.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — ALB, Auto Scaling, NAS shared storage, and CDN.

==================================================

Function Compute with EventBridge provides the lowest-management architecture among the choices. Function Compute is a fully managed, event-driven compute platform: Alibaba Cloud provisions and scales the required execution infrastructure automatically, and billing is based on configured resources and execution duration. This removes the operational burden of maintaining ECS instances or an ACK cluster.

The stated execution time of up to one hour is supported. Current Function Compute documentation permits individual function executions of up to 24 hours, so the job duration does not require a container cluster merely because it exceeds traditional short-function runtimes.

EventBridge supports recurring time-triggered events using fixed schedules or cron expressions and is suitable for scheduled batch-processing workflows. Function Compute also integrates directly with EventBridge-based cloud-product event triggers.

Options A and C introduce Kubernetes control and workload-management complexity that is unnecessary for a single scheduled processing job. Option B is less precise because Serverless Workflow provides orchestration rather than being required to perform the actual computation.

Therefore, EventBridge schedules the daily invocation and Function Compute performs the OSS-backed processing without persistent infrastructure.

Study Guide reference: Delivering Services on Alibaba Cloud; serverless architecture and event-driven application delivery.

==================================================

The public web tier needs an inbound security-group rule permitting TCP 443 from Internet clients. Therefore, Option E is required. Security groups act as virtual firewalls and should expose only application ports required by the workload. Alibaba Cloud recommends allowing public access only to necessary web-service ports such as HTTPS 443 while keeping internal services inaccessible from the Internet.

For the database tier, access should be limited to ECS instances belonging to the web-server security group. Alibaba Cloud RDS for MySQL supports associating an ECS security group with an RDS instance, allowing ECS instances in that group to connect without adding every server address individually to an IP whitelist. This is particularly useful when application-server membership changes dynamically.

Option B is overly broad because every resource within the public vSwitch ' s CIDR could potentially be authorized rather than only the approved web tier. Option C would prevent legitimate database traffic. Option D is unnecessary because RDS access behaves as an allow-list model: only explicitly authorized addresses or associated security-group members should be granted database access.

Thus, Internet clients reach the web tier only over HTTPS, while MySQL accepts access only from the authorized application servers.

Study Guide reference: Securing Workloads on Alibaba Cloud — Security Groups, RDS access control, least privilege, and tiered network segmentation.

==================================================

Option A refers to PolarDB Global Database Network (GDN), Alibaba Cloud ' s architecture for connecting PolarDB clusters across regions. A GDN contains a primary cluster and secondary regional clusters. Data changes are continuously replicated, local reads can be served by regional clusters, and write operations are routed to the primary cluster. Maintaining a single authoritative write path is particularly important for reservation transactions where concurrent booking operations must be controlled consistently.

Option C provides resilient application capacity by deploying ECS application servers in multiple regions and using ALB within each regional deployment to distribute requests among healthy instances. In a complete production implementation, a global routing mechanism such as DNS traffic management or Global Accelerator would normally direct users between those regional application stacks.

Function Compute is suitable for payment-gateway integrations because payment callbacks and API interactions are event-driven or request-driven workloads. Function Compute can be exposed securely through API Gateway, which provides routing, authentication, traffic control, and API management without persistent integration servers.

OSS versioning is useful for protecting stored objects but does not supply the transactional database, regional application availability, or payment-processing functionality required here.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — multi-region PolarDB, GDN, regional application tiers, ALB, and serverless integration.

==================================================

The ECS security group must allow inbound HTTPS traffic. For an inbound security-group rule, the Internet clients are the source, so the correct rule permits TCP destination port 443 from source 0.0.0.0/0. This makes Option C correct. Alibaba Cloud security groups are stateful, which means response traffic belonging to an allowed connection is automatically permitted and does not require a matching outbound security-group rule.

Network ACLs behave differently. Alibaba Cloud VPC network ACLs are stateless. If the ACL permits an inbound HTTPS request but does not permit the corresponding return packet, the TCP session cannot operate correctly. The inbound ACL therefore needs TCP 443 from Internet clients, while the outbound ACL must permit return traffic to client ephemeral destination ports. Alibaba Cloud explicitly recommends 1024–65535 when all client ephemeral-port implementations must be supported.

Option D permits only the incoming side of the ACL and therefore fails because response packets remain blocked. Option E incorrectly assumes that outbound server responses use destination port 443; the server ' s source port is 443, but the destination is the client ' s ephemeral port.

Study Guide reference: Securing Workloads on Alibaba Cloud — stateful Security Groups, stateless network ACLs, HTTPS exposure, and ephemeral ports.

==================================================

Time Series Database is specifically designed for timestamped telemetry generated by IoT devices, monitoring systems, and industrial equipment. Alibaba Cloud identifies IoT device monitoring as a core TSDB scenario, including continuously collecting, storing, analyzing, and querying device-status and business-event data in real time.

ApsaraMQ for Kafka provides the high-throughput ingestion and buffering layer. It is a managed distributed Kafka platform intended for real-time data pipelines, monitoring-data aggregation, log collection, streaming processing, and large-scale analytics. Its partitioned distributed architecture lets producers ingest very large event volumes while downstream consumers process the streams independently.

Function Compute supplies elastic event processing without persistent compute servers. Alibaba Cloud supports ApsaraMQ for Kafka triggers that invoke Function Compute automatically whenever new records arrive in Kafka topics. This enables functions to perform transformations, filtering, enrichment, alert generation, or routing in near real time.

EMR is valuable for Hadoop/Spark-style batch analytics, but the question specifically emphasizes low-latency real-time ingestion and analysis. It therefore does not replace the streaming components selected above.

Study Guide reference: Core Infrastructure Deep Dive — IoT telemetry, TSDB, ApsaraMQ for Kafka, Function Compute, and real-time streaming architectures.

==================================================

File Storage NAS is Alibaba Cloud ' s managed shared filesystem service and is the correct storage family for workloads that require standard filesystem semantics and mounting by many clients. NAS supports NFS and SMB-based access, and a mount target acts as the private VPC endpoint through which clients access a NAS filesystem. General-purpose NAS currently supports up to two mount targets, and a mount target can be concurrently accessed by large numbers of compute nodes.

Alibaba Cloud also explicitly supports accessing NAS from an on-premises data center through VPN Gateway. This means the same private network architecture can accommodate cloud-hosted ECS clients and systems connected through the enterprise VPN.

OSS provides object semantics rather than a native shared NFS/SMB filesystem. EBS is block storage attached to compute instances and would require Priya to build and maintain custom file-server proxies, reducing availability and increasing administration.

Among the offered answers, multiple NAS mount points best align with the requirement for scalable managed file storage and resilient access paths while preserving standard filesystem protocols.

Study Guide reference: Core Infrastructure Deep Dive — File Storage NAS, NFS/SMB, mount targets, and hybrid-cloud storage.

OSS versioning is specifically intended to protect objects from unintended deletions and overwrites. When versioning is enabled, OSS retains historical versions of an object. A normal delete operation creates a delete marker instead of permanently destroying all existing versions, allowing an administrator to restore a previous version when required.

Alibaba Cloud explicitly recommends versioning as a protection mechanism against accidental deletion or overwriting. Its current documentation states that, after versioning is enabled, accidentally deleted or overwritten content remains available as historical versions that can subsequently be restored.

Encryption protects confidentiality of stored data but does not provide logical deletion recovery. A private bucket ACL reduces unauthorized access but does not stop an authorized administrator or application from deleting an object accidentally. Lifecycle rules automate transitions or deletion according to defined policies; improperly configured lifecycle rules can themselves delete data, so they are not the primary protection mechanism requested here.

For particularly critical workloads, versioning can be supplemented with backup or carefully designed cross-region replication, but among the four choices, enabling OSS versioning directly addresses accidental deletion and provides recovery capability.

Study Guide reference: Core Storage Infrastructure Deep Dive; data durability, protection, and OSS object-management mechanisms.

==================================================

The core problem is durability during transient processing or network failures. A topic provides publish/subscribe notification delivery, but placing an SMQ queue behind the topic creates a persistent buffer between the notification producer and the Function Compute consumer. Alibaba Cloud supports subscribing a queue to an SMQ topic so that every message published to the topic is copied into the queue and retained for consumption.

Function Compute should then process records from the queue. Queue semantics provide the required failure recovery: after a consumer receives a message, it becomes temporarily invisible. The consumer deletes the message only after successful processing. If processing fails—for example because of a temporary connectivity problem—the message is not deleted and becomes visible again after the visibility timeout, allowing another processing attempt.

Function Compute also supports SMQ queue triggers with configurable retries, fault-tolerance behavior, and dead-letter handling, which can further strengthen this architecture.

Increasing memory does not fix network reliability, and multi-region deployment alone does not guarantee message persistence. A durable queue therefore prevents transient failures from silently losing ingestion work.

Study Guide reference: Core Infrastructure Deep Dive — Simple Message Queue, Function Compute, durable asynchronous processing, retries, and decoupled event-driven architecture.

The fundamental decision is the trade-off between infrastructure control and infrastructure abstraction.

A conventional managed/dedicated Kubernetes environment gives architects greater control over node pools, instance types, resource placement, operating-system configuration, network topology, specialized hardware, and related infrastructure choices. This makes Option B appropriate when a regulated fintech application requires exact control over the compute and networking environment.

ACK Serverless takes the opposite approach. Alibaba Cloud manages the underlying node infrastructure, and workloads run without customers purchasing or maintaining worker nodes. Alibaba ' s documentation states that ACK Serverless uses pay-as-you-go resource consumption and can scale pods rapidly, making it particularly appropriate for variable or unpredictable workloads.

Alibaba Cloud also explicitly describes ACK Serverless as Kubernetes-compatible infrastructure where customers focus on application development while paying according to CPU and memory resources requested by workloads.

Option A is too absolute: dedicated Kubernetes infrastructure does not inherently guarantee lower application latency; latency depends on workload, topology, instance configuration, networking, and scaling behavior. Option C is also incorrect because both managed and serverless ACK environments integrate deeply with Alibaba Cloud networking services.

Study Guide reference: Core Infrastructure Deep Dive — ACK deployment models, serverless containers, cluster control, elasticity, and cost optimization.

==================================================