CAP-C01 Alibaba Cloud Certified Professional: Cloud Architect Questions and Answers

Tair, Auto Scaling, and ALB directly address the three core runtime requirements: session performance, elastic capacity, and distributed traffic handling.

Tair provides an in-memory Redis-compatible data tier that is appropriate for high-frequency session information. Keeping session state outside individual ECS game servers allows requests to be handled by different backend instances without losing player session information and avoids disk/database latency on critical session lookups.

Auto Scaling directly satisfies the requirement to react automatically to sudden player surges. Alibaba Cloud Auto Scaling can monitor metrics such as CPU utilization and automatically add ECS instances when capacity thresholds are exceeded, then remove excess capacity as demand decreases.

ALB distributes client requests across the resulting game-server fleet, performs health checks, and avoids overloading individual ECS instances.

CDN is highly valuable for downloading static assets such as textures, patches, images, and game packages because those objects can be cached at edge POPs. However, standard CDN does not provide the core dynamic scaling mechanism for real-time game sessions. Given that exactly three selections are required, Auto Scaling is essential because the question explicitly requires automatic scaling during player surges.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — Tair, ALB, Auto Scaling, low-latency session architecture, and elastic gaming workloads.

==================================================

Server Load Balancer SSL termination and Certificate Management Service provide the most direct combination for centralized TLS protection and certificate lifecycle management.

With SSL/TLS termination on the load-balancing layer, clients establish encrypted HTTPS or SSL connections to the SLB service. Encryption processing is performed centrally rather than requiring every backend instance to independently process incoming TLS handshakes. This simplifies the backend architecture and centralizes certificate configuration.

Certificate Management Service is specifically designed for issuing, importing, storing, monitoring, deploying, and renewing SSL certificates. Alibaba Cloud currently supports centralized certificate deployment to services including SLB, CDN, WAF, ECS, and other supported resources.

The integration is particularly strong because Alibaba Cloud ' s load-balancing services use certificates managed through Certificate Management Service. For example, SSL listeners require appropriate server certificates for encrypted client connections.

WAF adds web-application threat protection but is not primarily a certificate lifecycle automation solution. CDN with HTTPS is valuable for accelerated content delivery but is not required simply to centralize TLS termination. KMS protects cryptographic keys and secrets but does not replace SSL certificate deployment and lifecycle management.

Therefore, SLB plus Certificate Management Service provides encrypted access and centralized certificate administration with the lowest operational burden.

Study Guide reference: Securing Workloads on Alibaba Cloud — TLS, certificate lifecycle management, SSL termination, and secure load balancing.

==================================================

Basic security groups support group-based authorization, allowing one security group ' s rules to reference another security group rather than requiring administrators to maintain long lists of individual IP addresses. Alibaba Cloud explicitly recommends source-security-group authorization for internal application communication because it is more manageable than maintaining individual private IP addresses or CIDR ranges.

This distinction is important because advanced security groups do not support another security group as an authorization object. Their primary benefit is higher private-IP capacity for very large deployments, not simplified service-to-service authorization.

For workloads residing in different VPCs, network connectivity must first exist through VPC Peering, Cloud Enterprise Network, PrivateLink, or another appropriate mechanism. Security groups do not themselves establish cross-VPC routes; they enforce authorization once the relevant network path exists.

Centralized logging provides visibility but does not simplify the actual authorization rules. Network ACLs operate at the vSwitch/subnet boundary and are less appropriate for application-tier identity based on security-group membership.

Thus, basic security groups with group-based authorization provide the intended simplified access-control model.

Study Guide reference: Securing Workloads on Alibaba Cloud — security groups, group-based authorization, least privilege, and VPC workload segmentation.

==================================================

Time Series Database is specifically designed for timestamped telemetry generated by IoT devices, monitoring systems, and industrial equipment. Alibaba Cloud identifies IoT device monitoring as a core TSDB scenario, including continuously collecting, storing, analyzing, and querying device-status and business-event data in real time.

ApsaraMQ for Kafka provides the high-throughput ingestion and buffering layer. It is a managed distributed Kafka platform intended for real-time data pipelines, monitoring-data aggregation, log collection, streaming processing, and large-scale analytics. Its partitioned distributed architecture lets producers ingest very large event volumes while downstream consumers process the streams independently.

Function Compute supplies elastic event processing without persistent compute servers. Alibaba Cloud supports ApsaraMQ for Kafka triggers that invoke Function Compute automatically whenever new records arrive in Kafka topics. This enables functions to perform transformations, filtering, enrichment, alert generation, or routing in near real time.

EMR is valuable for Hadoop/Spark-style batch analytics, but the question specifically emphasizes low-latency real-time ingestion and analysis. It therefore does not replace the streaming components selected above.

Study Guide reference: Core Infrastructure Deep Dive — IoT telemetry, TSDB, ApsaraMQ for Kafka, Function Compute, and real-time streaming architectures.

==================================================

File Storage NAS is Alibaba Cloud ' s managed shared filesystem service and is the correct storage family for workloads that require standard filesystem semantics and mounting by many clients. NAS supports NFS and SMB-based access, and a mount target acts as the private VPC endpoint through which clients access a NAS filesystem. General-purpose NAS currently supports up to two mount targets, and a mount target can be concurrently accessed by large numbers of compute nodes.

Alibaba Cloud also explicitly supports accessing NAS from an on-premises data center through VPN Gateway. This means the same private network architecture can accommodate cloud-hosted ECS clients and systems connected through the enterprise VPN.

OSS provides object semantics rather than a native shared NFS/SMB filesystem. EBS is block storage attached to compute instances and would require Priya to build and maintain custom file-server proxies, reducing availability and increasing administration.

Among the offered answers, multiple NAS mount points best align with the requirement for scalable managed file storage and resilient access paths while preserving standard filesystem protocols.

Study Guide reference: Core Infrastructure Deep Dive — File Storage NAS, NFS/SMB, mount targets, and hybrid-cloud storage.

A multi-zone deployment within the same region is the standard architecture for surviving the complete failure of one availability zone. Alibaba Cloud zones within a region are physically isolated for fault tolerance while maintaining high-speed internal network connectivity. Alibaba Cloud explicitly recommends deploying resources across different zones when higher disaster-recovery capability is required.

For an application tier, multiple ECS instances should be placed in separate zones and normally fronted by a multi-zone ALB or another suitable load-balancing service. Health checks ensure that traffic is no longer directed to unavailable instances, allowing surviving instances in another zone to continue serving requests. Alibaba Cloud ' s current high-availability guidance specifically describes multi-zone ECS and load-balancer deployments as the architecture for resilience against data-center or zone failures.

Option A remains vulnerable because all compute resources share the same zone failure domain. Option C retains a single compute point of failure regardless of storage performance. Option D can protect against an entire regional disaster, but it adds substantially greater networking, data synchronization, routing, and operational complexity than is necessary for the stated requirement of surviving one zone failure.

Therefore, distributing ECS instances across multiple zones within one region is the correct high-availability strategy.

Study Guide reference: Highly Available Architecture on Alibaba Cloud; Core Compute Infrastructure; multi-zone disaster recovery.

Alibaba Cloud CDN addresses the front-end performance problem by caching static resources at edge Points of Presence close to users. Instead of every image, JavaScript file, stylesheet, or other cacheable object being retrieved from the origin application, CDN returns cached copies from nearby edge nodes. This reduces network latency and decreases load on the original application servers. Alibaba Cloud specifically identifies reduced latency and lower origin workload as primary benefits of CDN.

Read/write splitting addresses database-side pressure. ApsaraDB RDS for MySQL can use database proxy functionality to direct write operations to the primary instance and distribute eligible read operations to read-only instances. This is especially effective for read-heavy web applications because it reduces CPU and I/O load on the primary database and increases aggregate read throughput.

A multi-zone database improves availability rather than directly solving page-load latency. AnalyticDB is an analytical database and should not replace RDS simply to handle transactional data. OSS is optimized for static objects; hosting dynamic application content there does not fit its object-storage model.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — CDN acceleration, RDS read scaling, database proxies, and application performance optimization.

==================================================

The ECS security group must allow inbound HTTPS traffic. For an inbound security-group rule, the Internet clients are the source, so the correct rule permits TCP destination port 443 from source 0.0.0.0/0. This makes Option C correct. Alibaba Cloud security groups are stateful, which means response traffic belonging to an allowed connection is automatically permitted and does not require a matching outbound security-group rule.

Network ACLs behave differently. Alibaba Cloud VPC network ACLs are stateless. If the ACL permits an inbound HTTPS request but does not permit the corresponding return packet, the TCP session cannot operate correctly. The inbound ACL therefore needs TCP 443 from Internet clients, while the outbound ACL must permit return traffic to client ephemeral destination ports. Alibaba Cloud explicitly recommends 1024–65535 when all client ephemeral-port implementations must be supported.

Option D permits only the incoming side of the ACL and therefore fails because response packets remain blocked. Option E incorrectly assumes that outbound server responses use destination port 443; the server ' s source port is 443, but the destination is the client ' s ephemeral port.

Study Guide reference: Securing Workloads on Alibaba Cloud — stateful Security Groups, stateless network ACLs, HTTPS exposure, and ephemeral ports.

==================================================

The strongest architecture for an existing e-commerce platform experiencing predictable but substantial traffic spikes is OSS/CDN + ALB + Auto Scaling. Auto Scaling is specifically designed to increase ECS capacity when traffic or resource utilization rises and remove unnecessary instances after demand subsides. Alibaba Cloud documents this as a core mechanism for handling traffic spikes while avoiding permanent over-provisioning.

ALB complements Auto Scaling by distributing requests across healthy ECS backend instances. As scaling creates additional instances, they can be automatically added to the ALB server group, allowing traffic to use the enlarged compute pool immediately.

Static images and videos should be moved to OSS and accelerated through CDN. CDN caches static resources on geographically distributed edge nodes, substantially reducing requests reaching the ECS application tier and lowering origin bandwidth and processing load during sales events.

Function Compute is highly elastic, but introducing it merely to supplement an existing server-based application normally requires application restructuring. It is therefore less directly applicable than the three mechanisms specifically designed to scale and offload the existing architecture.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — Auto Scaling, ALB, CDN offloading, and elastic ECS architecture.

==================================================

Data Transmission Service and OSS lifecycle management address the two distinct requirements: continuously replicated operational data and economical long-term retention.

DTS provides real-time data synchronization by continuously capturing changes from a source database and applying them to a destination. Alibaba Cloud identifies active geo-redundancy, disaster recovery, cross-region replication, and real-time data synchronization as standard DTS scenarios. Maintaining a secondary synchronized dataset in another failure domain therefore provides substantially better recovery characteristics than relying only on periodic backups.

Historical data has a different access pattern. Regulatory medical records can remain necessary for years while being rarely retrieved. OSS lifecycle policies can automatically transition aging objects from frequently accessed storage into lower-cost storage classes such as Archive. Alibaba Cloud specifically describes lifecycle policies for medical records and other compliance datasets that become cold over time.

Option B provides backup protection but does not directly provide the requested continuous replication architecture and unnecessarily introduces self-managed databases on ECS. DMS simplifies database administration but is not a data-replication or archival-storage mechanism.

Consequently, DTS supplies the live replication/fault-tolerance layer, while OSS lifecycle policies supply automated and cost-efficient long-term retention.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — DTS replication, disaster recovery, OSS lifecycle management, and compliance-oriented storage.

Option C provides the lowest-change migration path for the application tier. Rehosting the existing Windows workload on Windows Server ECS instances preserves its operating-system environment while distributing instances across availability zones improves resilience against zone-level infrastructure failures.

For the database tier, Option A provides the stronger managed architecture. Alibaba Cloud explicitly supports using DTS to migrate self-managed Oracle databases to PolarDB for PostgreSQL (Compatible with Oracle), including schema, full-data, and incremental-data migration for minimal migration downtime.

PolarDB ' s Oracle-compatible edition is specifically engineered to run Oracle workloads with minimal application modification. It supports Oracle-compatible data types, SQL constructs, PL/SQL features, OCI connectivity, packages, sequences, synonyms, and related functionality.

It also provides built-in high availability: failures are detected automatically and workloads can fail over to healthy nodes. This provides a more complete managed availability architecture than simply deploying independent self-managed Oracle servers across zones, which would additionally require Oracle-level replication/failover configuration.

Options B and D require substantial application refactoring and therefore conflict with the explicit requirement to minimize development changes.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — workload migration, ECS multi-zone design, DTS, and PolarDB Oracle compatibility.

==================================================

Express Connect with redundant connections is the strongest match for a mission-critical hybrid network requiring private connectivity, high availability, and enterprise-scale bandwidth. Express Connect establishes dedicated, secure, high-speed private connectivity between an on-premises data center and Alibaba Cloud VPC resources rather than transporting application traffic over the public Internet.

Alibaba Cloud ' s current Express Connect guidance identifies disaster recovery and high availability as primary enterprise scenarios. Redundant circuits and connection paths can protect connectivity against failures involving leased lines, devices, fiber cuts, and access points. Alibaba also identifies highly elastic, high-availability architectures based on dedicated connectivity and ECMP for environments with significant traffic requirements.

VPC peering connects VPC networks and does not independently provide an on-premises dedicated access circuit. VPN Gateway can connect an on-premises network to a VPC securely, but it uses Internet-based VPN transport and is generally not the strongest option where dedicated private connectivity, large scalable bandwidth, and robust path redundancy are explicit requirements. NAT Gateway provides address translation and Internet access functions rather than private hybrid connectivity.

Therefore, redundant Express Connect paths provide the enterprise-grade hybrid networking characteristics described.

Study Guide reference: Building Enterprise-grade Networks on Alibaba Cloud; hybrid connectivity, resilient networking, and Express Connect design.

==================================================