The PDF version of our CAP-C01 guide exam is prepared for you to print it and read it everywhere. It is convenient for you to see the answers to the questions and remember them. After you buy the PDF version of our study material, you will get an E-mail form us in 5 to 10 minutes after payment. Then you can click the link in the E-mail and download your CAP-C01 study engine. You can download it as many times as you need.
| Section | Objectives |
|---|---|
| Building Highly Available, Performant Cloud Architecture | - Leveling up Your Core Infrastructure |
| Building Enterprise-grade Networks on Alibaba Cloud | - Cloud Networking Deep Dive |
| Core Infrastructure Deep Dive | - Core Storage Infrastructure Deep Dive - Core Compute Infrastructure Deep Dive - Best Practices for Database Services |
| Delivering Services and Content on Alibaba Cloud | - Delivering Services and Content on Alibaba Cloud |
| Securing Workloads on Alibaba Cloud | - Alibaba Cloud Security Deep Dive |
>> New APP Alibaba Cloud CAP-C01 Simulations <<
Many students often start to study as the exam is approaching. Time is very valuable to these students, and for them, one extra hour of study may mean 3 points more on the test score. If you are one of these students, then Alibaba Cloud Certified Professional: Cloud Architect exam tests are your best choice. Because students often purchase materials from the Internet, there is a problem that they need transport time, especially for those students who live in remote areas. When the materials arrive, they may just have a little time to read them before the exam. However, with CAP-C01 Exam Questions, you will never encounter such problems, because our materials are distributed to customers through emails. After you have successfully paid, you can immediately receive CAP-C01 test guide from our customer service staff, and then you can start learning immediately.
NEW QUESTION # 15
Alisa ' s company recently migrated to Alibaba Cloud and wants to implement a solution to protect the traffic that flows in and out of the production VPC. Their previous on-premises solution had an inspection server that performed specific operations such as traffic flow inspection and traffic filtering. The company wants to have the same functionalities on Alibaba Cloud.
Which of the following solutions will meet these requirements?
Answer: D
Explanation:
Alibaba Cloud Cloud Firewall is the purpose-built managed network-security service for centralized traffic inspection, filtering, access control, and threat prevention. It protects multiple network boundaries, including traffic between cloud workloads and the Internet as well as east-west traffic involving VPC environments.
For Internet-facing assets, Cloud Firewall can inspect inbound and outbound traffic and apply access-control policies, DPI-based analysis, intrusion-prevention rules, and threat intelligence without requiring an organization to deploy and maintain a self-managed firewall appliance.
For private architectures, a VPC Firewall can inspect and control traffic traversing VPC boundaries through CEN or Express Connect. Access-control policies determine which traffic is permitted or blocked.
Simple Log Service can analyze network logs but does not itself enforce inline traffic filtering. Traffic Mirroring copies traffic to another inspection system and therefore requires additional tooling. Security Center focuses primarily on workload security posture, vulnerability management, malware protection, and host security rather than functioning as the VPC ' s inline network firewall.
Cloud Firewall therefore most closely reproduces the company ' s former inspection-and-filtering architecture as a fully managed cloud-native service.
Study Guide reference: Securing Workloads on Alibaba Cloud - Cloud Firewall, network inspection, access control, IPS, and VPC security.
NEW QUESTION # 16
Belinda is designing an API-driven cloud communications platform. The application is hosted on Elastic Compute Service (ECS) instances behind a Network Load Balancer (NLB). It leverages API Gateway to serve public-facing APIs to customers. For security reasons, Belinda wants to protect the platform against web exploits like SQL injection and large, sophisticated DDoS attacks.
Which combination of solutions provides the MOST protection? (Correct answers: 2)
Answer: C,D
Explanation:
The threats described exist at different layers, so the architecture should apply layered protection. WAF is the correct control for public HTTP/API traffic because it analyzes application-layer requests and blocks threats such as SQL injection, cross-site scripting, command injection, brute-force attacks, and other OWASP-style attacks. Alibaba Cloud explicitly supports integrating WAF with API Gateway and recommends disabling direct access paths afterward so clients cannot bypass WAF.
Large DDoS attacks require a dedicated volumetric mitigation service. Anti-DDoS Proxy scrubs malicious network and transport-layer traffic before clean traffic is forwarded toward the application infrastructure.
Alibaba Cloud ' s Anti-DDoS architecture supports protected services behind Server Load Balancer resources and provides port-forwarding mechanisms for non-HTTP workloads.
Alibaba Cloud specifically recommends combining Anti-DDoS and WAF when an application needs protection against both large volumetric attacks and sophisticated application-layer exploits.
WAF should protect the HTTP/API application boundary rather than being treated as a general Layer-4 NLB firewall. Security Center provides workload security and posture management, while basic DDoS protection alone is less suitable for the question ' s explicitly stated large and sophisticated attacks.
Study Guide reference: Securing Workloads on Alibaba Cloud - WAF, Anti-DDoS, API Gateway security, and defense-in-depth.
NEW QUESTION # 17
Sandra hosts a web application on a single ECS instance that stores documents uploaded by users in an EBS data disk. As the requirements grow, they duplicate the application and host it in a second ECS instance in a different zone. An ALB instance is used to distribute traffic between these ECS instances. However, after completing this change, users reported that every time they access the web application, they could only see some of their documents at any given time, but never all of the documents at the same time.
As a Cloud Architect, how would you solve this issue?
Answer: A
Explanation:
The architectural defect is that application state is stored independently on local block storage attached to each ECS instance. ALB can route successive requests to either backend, so each server exposes only the files stored on its own EBS disk. The correct solution is therefore to separate persistent shared data from individual compute instances.
Alibaba Cloud File Storage NAS provides shared file storage that can be mounted concurrently by multiple ECS instances. A single NAS file system becomes the authoritative repository for uploaded documents, so regardless of which ECS instance receives a request, both instances access the same underlying dataset.
Alibaba Cloud explicitly supports mounting NAS on multiple ECS instances for shared access.
Periodic EBS synchronization is operationally fragile and introduces consistency windows. ALB session persistence would merely hide the architectural problem and would fail when an ECS instance becomes unavailable or is replaced. Sending every request to both servers would also complicate application logic and still leave divergent storage.
Moving the data to NAS converts the application tier into a horizontally scalable compute layer while maintaining one consistent shared filesystem.
Study Guide reference: Core Infrastructure Deep Dive - ECS storage patterns, File Storage NAS, shared storage, and stateless application architecture.
NEW QUESTION # 18
A company has a web server running on an Elastic Compute Service (ECS) instance that is bound with an Elastic IP address. The ECS instance resides in a default security group within a VPC. The network ACL has been modified to block all traffic. Keran is a Cloud Architect and has been assigned the task of making the web server accessible from everywhere on port 443.
Which combination of steps can Keran take to accomplish this task? (Correct answers: 2)
Answer: C,E
Explanation:
The ECS security group must allow inbound HTTPS traffic. For an inbound security-group rule, the Internet clients are the source, so the correct rule permits TCP destination port 443 from source 0.0.0.0/0. This makes Option C correct. Alibaba Cloud security groups are stateful, which means response traffic belonging to an allowed connection is automatically permitted and does not require a matching outbound security-group rule.
Network ACLs behave differently. Alibaba Cloud VPC network ACLs are stateless. If the ACL permits an inbound HTTPS request but does not permit the corresponding return packet, the TCP session cannot operate correctly. The inbound ACL therefore needs TCP 443 from Internet clients, while the outbound ACL must permit return traffic to client ephemeral destination ports. Alibaba Cloud explicitly recommends 1024-65535 when all client ephemeral-port implementations must be supported.
Option D permits only the incoming side of the ACL and therefore fails because response packets remain blocked. Option E incorrectly assumes that outbound server responses use destination port 443; the server ' s source port is 443, but the destination is the client ' s ephemeral port.
Study Guide reference: Securing Workloads on Alibaba Cloud - stateful Security Groups, stateless network ACLs, HTTPS exposure, and ephemeral ports.
NEW QUESTION # 19
A startup is building a serverless backend for their mobile application on Alibaba Cloud. The backend includes APIs for user authentication, data storage, and real-time notifications. The startup expects variable traffic with unpredictable spikes and wants to minimize costs by paying only for actual usage.
Which combination of Alibaba Cloud services should the startup use to achieve this architecture? (Correct answers: 2)
Answer: B,D
Explanation:
Function Compute and Simple Message Queue form an appropriate serverless, event-driven backend for bursty mobile workloads.
Function Compute is fully managed and automatically allocates elastic compute resources when functions are invoked. Alibaba Cloud bills Function Compute primarily according to actual configured resources and execution duration, allowing the startup to avoid maintaining continuously running application servers. This is particularly suitable for APIs and backend handlers experiencing unpredictable request spikes.
SMQ provides managed asynchronous messaging for decoupling backend components. It supports queue- based processing and publish-subscribe topics, making it suitable for notification events, background jobs, workflow messages, and traffic buffering. Alibaba Cloud explicitly identifies load leveling during sudden traffic spikes as an SMQ use case.
SMQ can also directly trigger Function Compute through queue or topic integrations, creating an event-driven design without dedicated message-consumer servers.
ECS requires persistent server resources and management, which conflicts with the requested serverless operating model. MaxCompute is a large-scale data warehouse and batch analytics platform rather than the application ' s transactional API or messaging layer.
Therefore, Function Compute supplies elastic execution while SMQ provides reliable asynchronous communication and notification-event handling.
Study Guide reference: Delivering Services and Content on Alibaba Cloud - Function Compute, serverless architectures, SMQ, event-driven integration, and elastic application services.
NEW QUESTION # 20
......
As to this fateful exam that can help you or break you in some circumstances, our company made these CAP-C01 practice materials with accountability. We understand you can have more chances being accepted by other places and getting higher salary or acceptance. Our CAP-C01training materials are made by our responsible company which means you can gain many other benefits as well. We offer free demos for your reference, and send you the new updates if our experts make them freely.
CAP-C01 Study Materials: https://www.lead1pass.com/Alibaba-Cloud/CAP-C01-practice-exam-dumps.html