Free Alibaba Cloud CAP-C01 Practice Exam with Questions & Answers

Option C provides the lowest-change migration path for the application tier. Rehosting the existing Windows workload on Windows Server ECS instances preserves its operating-system environment while distributing instances across availability zones improves resilience against zone-level infrastructure failures.

For the database tier, Option A provides the stronger managed architecture. Alibaba Cloud explicitly supports using DTS to migrate self-managed Oracle databases to PolarDB for PostgreSQL (Compatible with Oracle), including schema, full-data, and incremental-data migration for minimal migration downtime.

PolarDB ' s Oracle-compatible edition is specifically engineered to run Oracle workloads with minimal application modification. It supports Oracle-compatible data types, SQL constructs, PL/SQL features, OCI connectivity, packages, sequences, synonyms, and related functionality.

It also provides built-in high availability: failures are detected automatically and workloads can fail over to healthy nodes. This provides a more complete managed availability architecture than simply deploying independent self-managed Oracle servers across zones, which would additionally require Oracle-level replication/failover configuration.

Options B and D require substantial application refactoring and therefore conflict with the explicit requirement to minimize development changes.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — workload migration, ECS multi-zone design, DTS, and PolarDB Oracle compatibility.

==================================================

A multi-zone deployment within the same region is the standard architecture for surviving the complete failure of one availability zone. Alibaba Cloud zones within a region are physically isolated for fault tolerance while maintaining high-speed internal network connectivity. Alibaba Cloud explicitly recommends deploying resources across different zones when higher disaster-recovery capability is required.

For an application tier, multiple ECS instances should be placed in separate zones and normally fronted by a multi-zone ALB or another suitable load-balancing service. Health checks ensure that traffic is no longer directed to unavailable instances, allowing surviving instances in another zone to continue serving requests. Alibaba Cloud ' s current high-availability guidance specifically describes multi-zone ECS and load-balancer deployments as the architecture for resilience against data-center or zone failures.

Option A remains vulnerable because all compute resources share the same zone failure domain. Option C retains a single compute point of failure regardless of storage performance. Option D can protect against an entire regional disaster, but it adds substantially greater networking, data synchronization, routing, and operational complexity than is necessary for the stated requirement of surviving one zone failure.

Therefore, distributing ECS instances across multiple zones within one region is the correct high-availability strategy.

Study Guide reference: Highly Available Architecture on Alibaba Cloud; Core Compute Infrastructure; multi-zone disaster recovery.

Express Connect and CEN Transit Router provide the enterprise networking foundation required for a multinational hybrid environment. Express Connect gives the company ' s on-premises infrastructure dedicated private connectivity to Alibaba Cloud. A Virtual Border Router can then attach to a CEN Transit Router, allowing the data center to communicate privately with VPCs in the same region and across other regions.

CEN provides centralized routing for VPCs, VBRs, inter-region connections, and other network attachments. This avoids the operational complexity and poor scalability of maintaining large meshes of VPC peering links or independent VPN connections.

For network visibility, CEN Transit Router flow logs integrate directly with Simple Log Service. These flow logs capture five-tuple traffic information, bytes, packets, and connection details and deliver the records to SLS for monitoring, troubleshooting, compliance analysis, and long-term querying.

Security Center supplements this design by providing centralized security posture and workload-security management. In a comprehensive enterprise implementation, network access controls and security policies are applied alongside this centralized connectivity architecture.

VPC peering becomes difficult to administer at multinational scale, individual VPN gateways add operational complexity, and Global Accelerator is designed primarily to accelerate application access rather than replace an enterprise hybrid WAN.

Study Guide reference: Building Enterprise-grade Networks on Alibaba Cloud — Express Connect, CEN, Transit Router, SLS, and centralized hybrid networking.

==================================================

ROS Stack Groups are specifically designed for centrally deploying a common Resource Orchestration Service template across multiple Alibaba Cloud accounts and regions. This makes option D the architecture that directly addresses both dimensions of the requirement: multi-account governance and multi-region infrastructure-as-code deployment.

Alibaba Cloud documentation states that stack instances belonging to a stack group can deploy stacks into destination accounts and different regions. With Resource Directory integration and service-managed permissions, trusted access can be enabled so that stack groups are operated by a management account or delegated administrator while deployments occur in organization member accounts.

Nested stacks are primarily a template-composition mechanism; they do not constitute centralized multi-account deployment orchestration. Manually combining ordinary ROS templates and RAM policies could technically enable cross-account operations, but it recreates functionality that Stack Groups provide natively and increases operational overhead. Resource Directory and Cloud Governance alone also do not replace the actual multi-account, multi-region stack deployment mechanism.

Therefore, Resource Directory establishes the organizational account structure while ROS Stack Groups provide repeatable infrastructure deployment across those accounts and target regions.

Study Guide reference: Core Infrastructure Deep Dive; Resource Orchestration Service, multi-account governance, and repeatable cloud architecture.

==================================================

The three explicit requirements are centralized key management, encryption in transit, and encryption at rest.

KMS satisfies centralized cryptographic-key management. It provides secure key creation, storage, lifecycle management, access control, and integration with Alibaba Cloud services such as databases and storage. Customer-managed software or hardware-protected keys can also be used where stricter compliance controls are required.

Certificate Management Service provides SSL/TLS certificates that establish encrypted HTTPS/TLS communication and verify server identity. TLS prevents sensitive transaction information from being transmitted as readable plaintext across network connections.

Transparent Data Encryption protects database data at rest. Alibaba Cloud RDS documentation identifies TDE as an encryption layer protecting database data files and backups without requiring applications to perform the underlying encryption themselves. RDS also separately supports SSL for database connection encryption.

Security Groups are an important network-access control, but the question requires exactly three controls specifically addressing encryption and centralized key management. Redis session management is unrelated.

The resulting security architecture therefore uses KMS for keys, TLS certificates for data in transit, and RDS TDE for persistent data at rest.

Study Guide reference: Securing Workloads on Alibaba Cloud — KMS, TLS/SSL, RDS encryption, TDE, and cryptographic key governance.

==================================================

Simple Log Service (SLS) is the appropriate logging platform for an ACK Serverless environment. Serverless Kubernetes removes much of the node-management responsibility, so the logging architecture should follow the same managed-service model rather than introduce dedicated log-processing infrastructure.

Alibaba Cloud provides native SLS integration for ACK Serverless. SLS can collect container standard output and application log files and then provide centralized search, analysis, dashboards, alerting, and downstream shipping. Alibaba documentation specifically states that ACK Serverless provides managed SLS capabilities and supports collecting container logs directly into SLS.

ARMS is primarily an application performance monitoring and observability platform; it does not replace SLS as the core centralized log-ingestion service. Option C is incorrect because SLS supports near-real-time collection and analysis. Option D also misunderstands serverless logging: scaling events do not inherently require dedicated logging servers.

The architecture should therefore preserve the operational advantages of serverless compute by using SLS as a fully managed, elastic logging layer capable of handling workload fluctuations without requiring the organization to provision and administer separate logging infrastructure.

Study Guide reference: Core Infrastructure Deep Dive — ACK, serverless container architecture, observability, and Simple Log Service.

The fundamental decision is the trade-off between infrastructure control and infrastructure abstraction.

A conventional managed/dedicated Kubernetes environment gives architects greater control over node pools, instance types, resource placement, operating-system configuration, network topology, specialized hardware, and related infrastructure choices. This makes Option B appropriate when a regulated fintech application requires exact control over the compute and networking environment.

ACK Serverless takes the opposite approach. Alibaba Cloud manages the underlying node infrastructure, and workloads run without customers purchasing or maintaining worker nodes. Alibaba ' s documentation states that ACK Serverless uses pay-as-you-go resource consumption and can scale pods rapidly, making it particularly appropriate for variable or unpredictable workloads.

Alibaba Cloud also explicitly describes ACK Serverless as Kubernetes-compatible infrastructure where customers focus on application development while paying according to CPU and memory resources requested by workloads.

Option A is too absolute: dedicated Kubernetes infrastructure does not inherently guarantee lower application latency; latency depends on workload, topology, instance configuration, networking, and scaling behavior. Option C is also incorrect because both managed and serverless ACK environments integrate deeply with Alibaba Cloud networking services.

Study Guide reference: Core Infrastructure Deep Dive — ACK deployment models, serverless containers, cluster control, elasticity, and cost optimization.

==================================================

Data Transmission Service and OSS lifecycle management address the two distinct requirements: continuously replicated operational data and economical long-term retention.

DTS provides real-time data synchronization by continuously capturing changes from a source database and applying them to a destination. Alibaba Cloud identifies active geo-redundancy, disaster recovery, cross-region replication, and real-time data synchronization as standard DTS scenarios. Maintaining a secondary synchronized dataset in another failure domain therefore provides substantially better recovery characteristics than relying only on periodic backups.

Historical data has a different access pattern. Regulatory medical records can remain necessary for years while being rarely retrieved. OSS lifecycle policies can automatically transition aging objects from frequently accessed storage into lower-cost storage classes such as Archive. Alibaba Cloud specifically describes lifecycle policies for medical records and other compliance datasets that become cold over time.

Option B provides backup protection but does not directly provide the requested continuous replication architecture and unnecessarily introduces self-managed databases on ECS. DMS simplifies database administration but is not a data-replication or archival-storage mechanism.

Consequently, DTS supplies the live replication/fault-tolerance layer, while OSS lifecycle policies supply automated and cost-efficient long-term retention.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — DTS replication, disaster recovery, OSS lifecycle management, and compliance-oriented storage.

Option A refers to PolarDB Global Database Network (GDN), Alibaba Cloud ' s architecture for connecting PolarDB clusters across regions. A GDN contains a primary cluster and secondary regional clusters. Data changes are continuously replicated, local reads can be served by regional clusters, and write operations are routed to the primary cluster. Maintaining a single authoritative write path is particularly important for reservation transactions where concurrent booking operations must be controlled consistently.

Option C provides resilient application capacity by deploying ECS application servers in multiple regions and using ALB within each regional deployment to distribute requests among healthy instances. In a complete production implementation, a global routing mechanism such as DNS traffic management or Global Accelerator would normally direct users between those regional application stacks.

Function Compute is suitable for payment-gateway integrations because payment callbacks and API interactions are event-driven or request-driven workloads. Function Compute can be exposed securely through API Gateway, which provides routing, authentication, traffic control, and API management without persistent integration servers.

OSS versioning is useful for protecting stored objects but does not supply the transactional database, regional application availability, or payment-processing functionality required here.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — multi-region PolarDB, GDN, regional application tiers, ALB, and serverless integration.

==================================================

Serverless App Engine is the strongest fit because it provides an application-oriented serverless platform specifically intended for hosting containerized and microservice applications without requiring the organization to administer Kubernetes clusters or ECS infrastructure. SAE can deploy applications directly from container images, including images stored in Alibaba Cloud Container Registry, and automatically manages provisioning, application lifecycle, scaling, monitoring, and underlying resources.

SAE namespaces also provide logical isolation for development, testing, and production environments. This directly addresses the requirement for separate production and testing deployments while avoiding the overhead of maintaining separate ACK clusters.

SAE integrates with Application Load Balancer for Layer 7 ingress and routing. ALB can expose SAE applications and route traffic to the appropriate backend application instances.

ACK Serverless removes worker-node management but still introduces Kubernetes objects and cluster administration. ACK Managed requires even greater cluster administration. Function Compute is optimized for functions and event-driven processing rather than straightforward migration of a multi-service container application.

Study Guide reference: Core Infrastructure Deep Dive — serverless compute, SAE, containerized applications, microservices, and application scaling.

==================================================