Alibaba Cloud CAP-C01 Exam Dumps - Actual Questions Answers

The ECS security group must allow inbound HTTPS traffic. For an inbound security-group rule, the Internet clients are the source, so the correct rule permits TCP destination port 443 from source 0.0.0.0/0. This makes Option C correct. Alibaba Cloud security groups are stateful, which means response traffic belonging to an allowed connection is automatically permitted and does not require a matching outbound security-group rule.

Network ACLs behave differently. Alibaba Cloud VPC network ACLs are stateless. If the ACL permits an inbound HTTPS request but does not permit the corresponding return packet, the TCP session cannot operate correctly. The inbound ACL therefore needs TCP 443 from Internet clients, while the outbound ACL must permit return traffic to client ephemeral destination ports. Alibaba Cloud explicitly recommends 1024–65535 when all client ephemeral-port implementations must be supported.

Option D permits only the incoming side of the ACL and therefore fails because response packets remain blocked. Option E incorrectly assumes that outbound server responses use destination port 443; the server ' s source port is 443, but the destination is the client ' s ephemeral port.

Study Guide reference: Securing Workloads on Alibaba Cloud — stateful Security Groups, stateless network ACLs, HTTPS exposure, and ephemeral ports.

==================================================

The architectural defect is that application state is stored independently on local block storage attached to each ECS instance. ALB can route successive requests to either backend, so each server exposes only the files stored on its own EBS disk. The correct solution is therefore to separate persistent shared data from individual compute instances.

Alibaba Cloud File Storage NAS provides shared file storage that can be mounted concurrently by multiple ECS instances. A single NAS file system becomes the authoritative repository for uploaded documents, so regardless of which ECS instance receives a request, both instances access the same underlying dataset. Alibaba Cloud explicitly supports mounting NAS on multiple ECS instances for shared access.

Periodic EBS synchronization is operationally fragile and introduces consistency windows. ALB session persistence would merely hide the architectural problem and would fail when an ECS instance becomes unavailable or is replaced. Sending every request to both servers would also complicate application logic and still leave divergent storage.

Moving the data to NAS converts the application tier into a horizontally scalable compute layer while maintaining one consistent shared filesystem.

Study Guide reference: Core Infrastructure Deep Dive — ECS storage patterns, File Storage NAS, shared storage, and stateless application architecture.

Option B reduces interference between transaction processing and read-heavy workloads inside PolarDB. PolarDB ' s read/write splitting automatically routes writes to the primary node while distributing eligible reads across read-only nodes. This allows reporting and ordinary SELECT traffic to consume separate compute capacity instead of competing with critical transactional writes on the primary node. Alibaba Cloud specifically identifies reporting, analytics, and read-heavy applications as appropriate read/write-splitting scenarios.

Option D provides stronger isolation for computationally expensive analytics. DTS can continuously synchronize PolarDB for MySQL data into MaxCompute using initial full synchronization followed by ongoing incremental change capture. Analysts can then execute large-scale analytical workloads against MaxCompute without placing those queries on the production transactional database.

Running queries on ECS does not inherently remove load from PolarDB because the SQL operations would still execute against the database. Introducing MongoDB merely to execute analytical queries creates a second database technology without an appropriate replication or analytical architecture.

Together, PolarDB read/write splitting optimizes operational read traffic while DTS-to-MaxCompute isolates heavyweight analytical processing, producing an effective HTAP-style separation of concerns.

Study Guide reference: Core Infrastructure Deep Dive — PolarDB, read/write splitting, DTS, MaxCompute, and analytical workload offloading.

==================================================