CAP-C01 Alibaba Cloud Certified Professional: Cloud Architect Questions and Answers

OSS, E-MapReduce, and MaxCompute collectively provide the strongest large-scale analytics architecture among the listed services.

OSS supplies the scalable data-lake storage layer. Alibaba Cloud describes OSS-based data lakes as capable of retaining structured, semi-structured, and unstructured datasets at very large scale while decoupling storage capacity from compute resources. OSS storage can scale independently into exabyte-scale environments.

E-MapReduce provides managed big-data processing based on ecosystems such as Hadoop and Spark and integrates directly with OSS. EMR DataLake configurations support Spark and Hive for batch workloads and Presto/Trino for interactive SQL analysis, making EMR highly appropriate for workloads requiring both scheduled processing and ad-hoc querying.

MaxCompute supplies a massively scalable managed data-warehouse and analytical processing layer. Alibaba Cloud also supports architectures where MaxCompute processes structured analytical datasets while OSS provides the underlying flexible data-lake storage.

PolarDB is an operational relational database and is not intended to act as the primary petabyte-scale data-lake processing platform. Elasticsearch is valuable for search and log analytics but does not replace the combination of OSS, EMR, and MaxCompute for generalized big-data processing.

Study Guide reference: Core Infrastructure Deep Dive — OSS data lakes, EMR, MaxCompute, distributed analytics, batch processing, and interactive query architectures.

The ECS security group must allow inbound HTTPS traffic. For an inbound security-group rule, the Internet clients are the source, so the correct rule permits TCP destination port 443 from source 0.0.0.0/0. This makes Option C correct. Alibaba Cloud security groups are stateful, which means response traffic belonging to an allowed connection is automatically permitted and does not require a matching outbound security-group rule.

Network ACLs behave differently. Alibaba Cloud VPC network ACLs are stateless. If the ACL permits an inbound HTTPS request but does not permit the corresponding return packet, the TCP session cannot operate correctly. The inbound ACL therefore needs TCP 443 from Internet clients, while the outbound ACL must permit return traffic to client ephemeral destination ports. Alibaba Cloud explicitly recommends 1024–65535 when all client ephemeral-port implementations must be supported.

Option D permits only the incoming side of the ACL and therefore fails because response packets remain blocked. Option E incorrectly assumes that outbound server responses use destination port 443; the server ' s source port is 443, but the destination is the client ' s ephemeral port.

Study Guide reference: Securing Workloads on Alibaba Cloud — stateful Security Groups, stateless network ACLs, HTTPS exposure, and ephemeral ports.

==================================================

Global Accelerator is designed for precisely this class of global interactive application. Clients connect through Alibaba Cloud ' s nearby acceleration access points, after which traffic traverses Alibaba Cloud ' s optimized global network toward the most appropriate backend region. This reduces Internet routing variability and improves end-to-end latency for latency-sensitive workloads such as gaming.

GA listeners define the application protocol and ports, while endpoint groups represent backend deployments in different regions. With intelligent routing, GA can select a nearby healthy endpoint group and forward requests accordingly. Alibaba Cloud also provides endpoint health checks; when an endpoint becomes unhealthy, new requests can automatically be directed to healthy endpoints.

CDN is highly effective for static cacheable content but is not the correct primary mechanism for arbitrary real-time game traffic and regional backend health-based routing. RDS and Tair improve application data performance but do not solve global network acceleration.

Therefore, GA in front of regional ALBs provides the correct architecture: nearest-entry acceleration, Alibaba Cloud backbone transport, regional endpoint groups, health monitoring, and failover.

Study Guide reference: Delivering Services and Content on Alibaba Cloud — Global Accelerator, ALB, multi-region traffic management, and high availability.

Each selected option maps directly to one of the stated enterprise requirements.

A multi-zone PolarDB deployment protects the database against availability-zone-level infrastructure failure. Alibaba Cloud ' s multi-AZ PolarDB architecture keeps replicated data in separate zones and can use standby resources for failover when the primary zone becomes unavailable, resulting in a higher database SLA than a single-zone deployment.

Cloud Backup provides centralized policy-driven backup and recovery for Alibaba Cloud and on-premises resources, including ECS data, databases, NAS, OSS, and other supported workloads. This addresses the requirement for automated application and database protection without building custom backup infrastructure.

RAM roles and associated policies provide fine-grained authorization. RAM policies define allowed actions, affected resources, and optional access conditions, enabling least-privilege access to sensitive student data and administrative services.

Leaving OSS data unencrypted conflicts with the handling of sensitive enterprise information, while manual ACK scaling does not contribute to the stated requirement for high availability or automated operations.

The resulting architecture therefore combines multi-AZ database resilience, managed backup protection, and fine-grained identity authorization.

Study Guide reference: Securing Workloads on Alibaba Cloud — RAM; Building Highly Available, Performant Cloud Architecture — PolarDB HA and Cloud Backup.

==================================================

A multi-zone deployment within the same region is the standard architecture for surviving the complete failure of one availability zone. Alibaba Cloud zones within a region are physically isolated for fault tolerance while maintaining high-speed internal network connectivity. Alibaba Cloud explicitly recommends deploying resources across different zones when higher disaster-recovery capability is required.

For an application tier, multiple ECS instances should be placed in separate zones and normally fronted by a multi-zone ALB or another suitable load-balancing service. Health checks ensure that traffic is no longer directed to unavailable instances, allowing surviving instances in another zone to continue serving requests. Alibaba Cloud ' s current high-availability guidance specifically describes multi-zone ECS and load-balancer deployments as the architecture for resilience against data-center or zone failures.

Option A remains vulnerable because all compute resources share the same zone failure domain. Option C retains a single compute point of failure regardless of storage performance. Option D can protect against an entire regional disaster, but it adds substantially greater networking, data synchronization, routing, and operational complexity than is necessary for the stated requirement of surviving one zone failure.

Therefore, distributing ECS instances across multiple zones within one region is the correct high-availability strategy.

Study Guide reference: Highly Available Architecture on Alibaba Cloud; Core Compute Infrastructure; multi-zone disaster recovery.

Serverless App Engine is the strongest fit because it provides an application-oriented serverless platform specifically intended for hosting containerized and microservice applications without requiring the organization to administer Kubernetes clusters or ECS infrastructure. SAE can deploy applications directly from container images, including images stored in Alibaba Cloud Container Registry, and automatically manages provisioning, application lifecycle, scaling, monitoring, and underlying resources.

SAE namespaces also provide logical isolation for development, testing, and production environments. This directly addresses the requirement for separate production and testing deployments while avoiding the overhead of maintaining separate ACK clusters.

SAE integrates with Application Load Balancer for Layer 7 ingress and routing. ALB can expose SAE applications and route traffic to the appropriate backend application instances.

ACK Serverless removes worker-node management but still introduces Kubernetes objects and cluster administration. ACK Managed requires even greater cluster administration. Function Compute is optimized for functions and event-driven processing rather than straightforward migration of a multi-service container application.

Study Guide reference: Core Infrastructure Deep Dive — serverless compute, SAE, containerized applications, microservices, and application scaling.

==================================================

Alibaba Cloud CDN is specifically designed to accelerate content delivery by distributing and caching content at geographically distributed points of presence. When a user requests an accelerated resource, CDN DNS scheduling assigns an appropriate PoP. If the resource is cached there, the PoP returns it directly without requiring a round trip to the origin infrastructure. Alibaba Cloud documentation explicitly states that static resources are cached on the nearest PoP to reduce latency and improve access efficiency.

This directly satisfies both key requirements in the question: caching static content and directing users toward edge infrastructure close to their locations. If content is not cached or has expired, the CDN PoP performs an origin fetch and then serves the resource.

GTM can perform DNS-based geographical or latency routing among application endpoints and regions, but it is not itself a distributed static-content caching service. Express Connect provides private dedicated connectivity between enterprise/on-premises networks and Alibaba Cloud. SLB distributes traffic among backend servers but does not provide a worldwide edge caching network.

Therefore, Alibaba Cloud CDN is the only listed service that simultaneously implements PoP-based edge delivery and static-content caching.

Study Guide reference: Delivering Content on Alibaba Cloud; content acceleration and global application-delivery architecture.

==================================================

OSS provides region-specific internal endpoints specifically for private access from Alibaba Cloud compute resources. When an ECS instance and an OSS bucket reside in the same region, the ECS instance can access the bucket using an internal OSS domain such as an oss- < region > -internal.aliyuncs.com endpoint. Traffic remains on Alibaba Cloud ' s internal network instead of traversing the public Internet.

This directly satisfies the security requirement without adding unnecessary networking components. The ECS instance does not require an EIP, NAT Gateway, or Internet connectivity for the OSS data path.

VPN Gateway is intended primarily for connecting VPCs to on-premises networks or other private networks; it is unnecessary for same-region OSS access. PrivateLink has legitimate private-service connectivity use cases, but the presence of a native OSS internal endpoint makes it unnecessary here. A VPC gateway endpoint may be relevant to certain Alibaba Cloud service integrations, but it is not required for this straightforward same-region ECS-to-OSS architecture.

The important exam design principle is to prefer a service ' s native private endpoint when one exists and the workload is already located inside the corresponding Alibaba Cloud region.

Study Guide reference: Building Enterprise-grade Networks on Alibaba Cloud — VPC private connectivity and OSS internal endpoints.

The workload is an excellent candidate for preemptible, currently called spot, ECS capacity because it is short-lived, batch-oriented, horizontally scalable, and explicitly tolerant of interruption. The question states that if an instance fails, another instance can reprocess the job. That removes the main architectural objection to using interruptible compute.

Alibaba Cloud describes ECS spot instances as unused ECS capacity offered at substantially reduced prices compared with standard pay-as-you-go instances. The documented recommended scenarios include short-term tasks, data analytics, and applications that are highly fault tolerant and able to tolerate interruption.

Savings Plans and reserved-instance-style commitments can reduce costs for predictable long-term baseline consumption, but this workload runs only at two scheduled times each day. Purchasing committed capacity for a sporadic workload can leave paid capacity economically underutilized. Higher-specification pay-as-you-go instances also do not inherently minimize compute cost.

Using a launch template with preemptible/spot ECS instances allows Auto Scaling to add inexpensive compute when the batch workload requires it, while the application ' s retry mechanism handles interruptions.

Study Guide reference: Core Compute Infrastructure Deep Dive; Scalable Architecture on Alibaba Cloud; cost optimization for elastic compute.

==================================================

VPC peering provides direct private communication between two VPCs without exposing either application or database traffic to the public Internet. Alibaba Cloud VPCs are isolated by default. After creating a peering connection and configuring the required bidirectional routes, resources in VPC A and VPC B can communicate using private IP addresses. VPC peering supports same-account and cross-account connections as well as same-region and cross-region configurations.

This is materially more secure than exposing the database publicly. The application ' s existing EIP does not need to participate in database connectivity; the application can use its ECS private address when communicating across the peering link. Security-group and database whitelist rules should then restrict access to only the required source CIDRs and ports.

Option A intentionally routes database access through public addressing. Option B introduces an unnecessary proxy server, additional management overhead, and another failure point. Option D creates the largest attack surface by making the database Internet-accessible.

The design principle is straightforward: when workloads in two Alibaba Cloud VPCs require direct communication, establish private network connectivity and keep sensitive database traffic off the Internet.

Study Guide reference: Building Enterprise-grade Networks on Alibaba Cloud — VPC isolation, VPC peering, routing, and private database access.

CDN should form the content-delivery layer for cacheable video assets. Alibaba Cloud CDN distributes content to geographically dispersed edge nodes so viewers retrieve cached objects from nearby POPs rather than repeatedly connecting to a distant origin. Alibaba Cloud explicitly supports video-oriented CDN acceleration and edge delivery, reducing both end-user latency and origin bandwidth demand.

Auto Scaling addresses peak-time compute demand. It monitors workload conditions and automatically increases ECS capacity during traffic spikes, then scales resources back when traffic decreases. Alibaba Cloud specifically identifies streaming platforms with unpredictable demand as a typical Auto Scaling scenario.

Global Accelerator complements CDN and Auto Scaling where viewers or application endpoints are separated by long-distance or cross-border networks. GA routes traffic through Alibaba Cloud ' s optimized global BGP network, reducing latency, jitter, and packet loss. Alibaba documentation explicitly identifies video streaming as a latency-sensitive scenario that benefits from this architecture.

Tair can improve authentication or session performance, but it does not directly address video delivery quality or regional network performance. Therefore, CDN + Auto Scaling + Global Accelerator most directly satisfies the streaming requirement.

Study Guide reference: Delivering Services and Content on Alibaba Cloud — CDN, Global Accelerator, Auto Scaling, video delivery, and global traffic optimization.

==================================================

The application needs asynchronous decoupling between high-volume ingestion and database writes. Simple Message Queue provides exactly this load-leveling pattern. The first Function Compute function can acknowledge incoming requests quickly and place each item into SMQ. A second function consumes the queued messages and writes them to RDS at a rate the database can sustain.

SMQ is a distributed managed messaging service specifically designed to decouple producers and consumers. Alibaba Cloud identifies traffic-spike buffering, asynchronous processing, and independent component scaling as core SMQ use cases. Queue messages are delivered at least once during their validity period, significantly improving durability compared with directly coupling every incoming API request to a database write.

Function Compute also integrates directly with SMQ queues and topics as event sources, reducing custom integration and infrastructure management.

Kafka could also provide durable asynchronous messaging, but it is a more elaborate streaming platform than necessary for this workload and therefore carries additional configuration complexity. Moving to ECS reintroduces server administration, while replacing RDS does not solve the ingestion decoupling problem.

Study Guide reference: Core Infrastructure Deep Dive — Function Compute, messaging architectures, asynchronous processing, and scalable application integration.

==================================================