CAP-C01 Alibaba Cloud Certified Professional: Cloud Architect Questions and Answers

The three explicit requirements are centralized key management, encryption in transit, and encryption at rest.

KMS satisfies centralized cryptographic-key management. It provides secure key creation, storage, lifecycle management, access control, and integration with Alibaba Cloud services such as databases and storage. Customer-managed software or hardware-protected keys can also be used where stricter compliance controls are required.

Certificate Management Service provides SSL/TLS certificates that establish encrypted HTTPS/TLS communication and verify server identity. TLS prevents sensitive transaction information from being transmitted as readable plaintext across network connections.

Transparent Data Encryption protects database data at rest. Alibaba Cloud RDS documentation identifies TDE as an encryption layer protecting database data files and backups without requiring applications to perform the underlying encryption themselves. RDS also separately supports SSL for database connection encryption.

Security Groups are an important network-access control, but the question requires exactly three controls specifically addressing encryption and centralized key management. Redis session management is unrelated.

The resulting security architecture therefore uses KMS for keys, TLS certificates for data in transit, and RDS TDE for persistent data at rest.

Study Guide reference: Securing Workloads on Alibaba Cloud — KMS, TLS/SSL, RDS encryption, TDE, and cryptographic key governance.

==================================================

ROS Stack Groups are specifically designed for centrally deploying a common Resource Orchestration Service template across multiple Alibaba Cloud accounts and regions. This makes option D the architecture that directly addresses both dimensions of the requirement: multi-account governance and multi-region infrastructure-as-code deployment.

Alibaba Cloud documentation states that stack instances belonging to a stack group can deploy stacks into destination accounts and different regions. With Resource Directory integration and service-managed permissions, trusted access can be enabled so that stack groups are operated by a management account or delegated administrator while deployments occur in organization member accounts.

Nested stacks are primarily a template-composition mechanism; they do not constitute centralized multi-account deployment orchestration. Manually combining ordinary ROS templates and RAM policies could technically enable cross-account operations, but it recreates functionality that Stack Groups provide natively and increases operational overhead. Resource Directory and Cloud Governance alone also do not replace the actual multi-account, multi-region stack deployment mechanism.

Therefore, Resource Directory establishes the organizational account structure while ROS Stack Groups provide repeatable infrastructure deployment across those accounts and target regions.

Study Guide reference: Core Infrastructure Deep Dive; Resource Orchestration Service, multi-account governance, and repeatable cloud architecture.

==================================================

Alibaba Cloud CDN is specifically designed to accelerate content delivery by distributing and caching content at geographically distributed points of presence. When a user requests an accelerated resource, CDN DNS scheduling assigns an appropriate PoP. If the resource is cached there, the PoP returns it directly without requiring a round trip to the origin infrastructure. Alibaba Cloud documentation explicitly states that static resources are cached on the nearest PoP to reduce latency and improve access efficiency.

This directly satisfies both key requirements in the question: caching static content and directing users toward edge infrastructure close to their locations. If content is not cached or has expired, the CDN PoP performs an origin fetch and then serves the resource.

GTM can perform DNS-based geographical or latency routing among application endpoints and regions, but it is not itself a distributed static-content caching service. Express Connect provides private dedicated connectivity between enterprise/on-premises networks and Alibaba Cloud. SLB distributes traffic among backend servers but does not provide a worldwide edge caching network.

Therefore, Alibaba Cloud CDN is the only listed service that simultaneously implements PoP-based edge delivery and static-content caching.

Study Guide reference: Delivering Content on Alibaba Cloud; content acceleration and global application-delivery architecture.

==================================================

Alibaba Cloud CDN addresses the front-end performance problem by caching static resources at edge Points of Presence close to users. Instead of every image, JavaScript file, stylesheet, or other cacheable object being retrieved from the origin application, CDN returns cached copies from nearby edge nodes. This reduces network latency and decreases load on the original application servers. Alibaba Cloud specifically identifies reduced latency and lower origin workload as primary benefits of CDN.

Read/write splitting addresses database-side pressure. ApsaraDB RDS for MySQL can use database proxy functionality to direct write operations to the primary instance and distribute eligible read operations to read-only instances. This is especially effective for read-heavy web applications because it reduces CPU and I/O load on the primary database and increases aggregate read throughput.

A multi-zone database improves availability rather than directly solving page-load latency. AnalyticDB is an analytical database and should not replace RDS simply to handle transactional data. OSS is optimized for static objects; hosting dynamic application content there does not fit its object-storage model.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — CDN acceleration, RDS read scaling, database proxies, and application performance optimization.

==================================================

Basic security groups support group-based authorization, allowing one security group ' s rules to reference another security group rather than requiring administrators to maintain long lists of individual IP addresses. Alibaba Cloud explicitly recommends source-security-group authorization for internal application communication because it is more manageable than maintaining individual private IP addresses or CIDR ranges.

This distinction is important because advanced security groups do not support another security group as an authorization object. Their primary benefit is higher private-IP capacity for very large deployments, not simplified service-to-service authorization.

For workloads residing in different VPCs, network connectivity must first exist through VPC Peering, Cloud Enterprise Network, PrivateLink, or another appropriate mechanism. Security groups do not themselves establish cross-VPC routes; they enforce authorization once the relevant network path exists.

Centralized logging provides visibility but does not simplify the actual authorization rules. Network ACLs operate at the vSwitch/subnet boundary and are less appropriate for application-tier identity based on security-group membership.

Thus, basic security groups with group-based authorization provide the intended simplified access-control model.

Study Guide reference: Securing Workloads on Alibaba Cloud — security groups, group-based authorization, least privilege, and VPC workload segmentation.

==================================================

OSS provides region-specific internal endpoints specifically for private access from Alibaba Cloud compute resources. When an ECS instance and an OSS bucket reside in the same region, the ECS instance can access the bucket using an internal OSS domain such as an oss- < region > -internal.aliyuncs.com endpoint. Traffic remains on Alibaba Cloud ' s internal network instead of traversing the public Internet.

This directly satisfies the security requirement without adding unnecessary networking components. The ECS instance does not require an EIP, NAT Gateway, or Internet connectivity for the OSS data path.

VPN Gateway is intended primarily for connecting VPCs to on-premises networks or other private networks; it is unnecessary for same-region OSS access. PrivateLink has legitimate private-service connectivity use cases, but the presence of a native OSS internal endpoint makes it unnecessary here. A VPC gateway endpoint may be relevant to certain Alibaba Cloud service integrations, but it is not required for this straightforward same-region ECS-to-OSS architecture.

The important exam design principle is to prefer a service ' s native private endpoint when one exists and the workload is already located inside the corresponding Alibaba Cloud region.

Study Guide reference: Building Enterprise-grade Networks on Alibaba Cloud — VPC private connectivity and OSS internal endpoints.

OSS versioning is specifically intended to protect objects from unintended deletions and overwrites. When versioning is enabled, OSS retains historical versions of an object. A normal delete operation creates a delete marker instead of permanently destroying all existing versions, allowing an administrator to restore a previous version when required.

Alibaba Cloud explicitly recommends versioning as a protection mechanism against accidental deletion or overwriting. Its current documentation states that, after versioning is enabled, accidentally deleted or overwritten content remains available as historical versions that can subsequently be restored.

Encryption protects confidentiality of stored data but does not provide logical deletion recovery. A private bucket ACL reduces unauthorized access but does not stop an authorized administrator or application from deleting an object accidentally. Lifecycle rules automate transitions or deletion according to defined policies; improperly configured lifecycle rules can themselves delete data, so they are not the primary protection mechanism requested here.

For particularly critical workloads, versioning can be supplemented with backup or carefully designed cross-region replication, but among the four choices, enabling OSS versioning directly addresses accidental deletion and provides recovery capability.

Study Guide reference: Core Storage Infrastructure Deep Dive; data durability, protection, and OSS object-management mechanisms.

==================================================

The existing architecture has two important bottlenecks: a single ECS compute node and files stored on storage attached to that individual ECS instance. Option E eliminates the compute single point of failure. A custom image allows identical ECS instances to be created, while Auto Scaling maintains multiple instances and ALB distributes requests across healthy backends. This provides horizontal scalability and significantly stronger application availability.

Option D addresses shared application storage. File Storage NAS is a managed, POSIX-compatible shared filesystem that multiple ECS instances can mount concurrently. All web servers therefore see the same files, while NAS handles storage scalability and consistency independently from the ECS lifecycle.

Option A improves performance by moving cacheable website content toward users. CDN serves static resources from nearby POPs and reduces requests and bandwidth reaching the origin infrastructure.

Although OSS is excellent for native object-storage workloads, mounting OSS through ossfs does not provide the same filesystem semantics and consistency characteristics as NAS for a traditional application requiring minimal modification. Global Accelerator primarily optimizes network paths and does not eliminate the application ' s compute or storage single points of failure.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — ALB, Auto Scaling, NAS shared storage, and CDN.

==================================================

Option B provides both an appropriate security boundary and an optimized delivery path. Alibaba Cloud CDN should be the Internet-facing content-delivery layer so that cacheable HTTPS resources are served from edge points of presence close to users. Alibaba Cloud currently supports directly configuring an ALB instance domain as a CDN origin, producing the request path client → CDN → ALB → backend server. This prevents clients from bypassing the load-balancing tier and preserves centralized health checking and traffic distribution.

The backend ECS instances should remain on private network addresses rather than being individually Internet-exposed. For an Internet-facing ALB, external traffic reaches the ALB through its public EIP and is then forwarded internally to backend ECS private IP addresses. This substantially reduces the attack surface while retaining public application availability.

Options C and D unnecessarily expose ECS instances through public networking. Option A uses private ECS instances, but making the individual application servers the CDN origins bypasses the ALB ' s centralized distribution and availability functions. Therefore, CDN → ALB → private ECS is the strongest architecture.

Study Guide reference: Delivering Content on Alibaba Cloud; Delivering Services on Alibaba Cloud; Highly Available Architecture.

==================================================

The public web tier needs an inbound security-group rule permitting TCP 443 from Internet clients. Therefore, Option E is required. Security groups act as virtual firewalls and should expose only application ports required by the workload. Alibaba Cloud recommends allowing public access only to necessary web-service ports such as HTTPS 443 while keeping internal services inaccessible from the Internet.

For the database tier, access should be limited to ECS instances belonging to the web-server security group. Alibaba Cloud RDS for MySQL supports associating an ECS security group with an RDS instance, allowing ECS instances in that group to connect without adding every server address individually to an IP whitelist. This is particularly useful when application-server membership changes dynamically.

Option B is overly broad because every resource within the public vSwitch ' s CIDR could potentially be authorized rather than only the approved web tier. Option C would prevent legitimate database traffic. Option D is unnecessary because RDS access behaves as an allow-list model: only explicitly authorized addresses or associated security-group members should be granted database access.

Thus, Internet clients reach the web tier only over HTTPS, while MySQL accepts access only from the authorized application servers.

Study Guide reference: Securing Workloads on Alibaba Cloud — Security Groups, RDS access control, least privilege, and tiered network segmentation.

==================================================

Data Transmission Service and OSS lifecycle management address the two distinct requirements: continuously replicated operational data and economical long-term retention.

DTS provides real-time data synchronization by continuously capturing changes from a source database and applying them to a destination. Alibaba Cloud identifies active geo-redundancy, disaster recovery, cross-region replication, and real-time data synchronization as standard DTS scenarios. Maintaining a secondary synchronized dataset in another failure domain therefore provides substantially better recovery characteristics than relying only on periodic backups.

Historical data has a different access pattern. Regulatory medical records can remain necessary for years while being rarely retrieved. OSS lifecycle policies can automatically transition aging objects from frequently accessed storage into lower-cost storage classes such as Archive. Alibaba Cloud specifically describes lifecycle policies for medical records and other compliance datasets that become cold over time.

Option B provides backup protection but does not directly provide the requested continuous replication architecture and unnecessarily introduces self-managed databases on ECS. DMS simplifies database administration but is not a data-replication or archival-storage mechanism.

Consequently, DTS supplies the live replication/fault-tolerance layer, while OSS lifecycle policies supply automated and cost-efficient long-term retention.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — DTS replication, disaster recovery, OSS lifecycle management, and compliance-oriented storage.

Time Series Database is specifically designed for timestamped telemetry generated by IoT devices, monitoring systems, and industrial equipment. Alibaba Cloud identifies IoT device monitoring as a core TSDB scenario, including continuously collecting, storing, analyzing, and querying device-status and business-event data in real time.

ApsaraMQ for Kafka provides the high-throughput ingestion and buffering layer. It is a managed distributed Kafka platform intended for real-time data pipelines, monitoring-data aggregation, log collection, streaming processing, and large-scale analytics. Its partitioned distributed architecture lets producers ingest very large event volumes while downstream consumers process the streams independently.

Function Compute supplies elastic event processing without persistent compute servers. Alibaba Cloud supports ApsaraMQ for Kafka triggers that invoke Function Compute automatically whenever new records arrive in Kafka topics. This enables functions to perform transformations, filtering, enrichment, alert generation, or routing in near real time.

EMR is valuable for Hadoop/Spark-style batch analytics, but the question specifically emphasizes low-latency real-time ingestion and analysis. It therefore does not replace the streaming components selected above.

Study Guide reference: Core Infrastructure Deep Dive — IoT telemetry, TSDB, ApsaraMQ for Kafka, Function Compute, and real-time streaming architectures.

==================================================