CAP-C01 Alibaba Cloud Certified Professional: Cloud Architect Question and Answers

The application needs asynchronous decoupling between high-volume ingestion and database writes. Simple Message Queue provides exactly this load-leveling pattern. The first Function Compute function can acknowledge incoming requests quickly and place each item into SMQ. A second function consumes the queued messages and writes them to RDS at a rate the database can sustain.

SMQ is a distributed managed messaging service specifically designed to decouple producers and consumers. Alibaba Cloud identifies traffic-spike buffering, asynchronous processing, and independent component scaling as core SMQ use cases. Queue messages are delivered at least once during their validity period, significantly improving durability compared with directly coupling every incoming API request to a database write.

Function Compute also integrates directly with SMQ queues and topics as event sources, reducing custom integration and infrastructure management.

Kafka could also provide durable asynchronous messaging, but it is a more elaborate streaming platform than necessary for this workload and therefore carries additional configuration complexity. Moving to ECS reintroduces server administration, while replacing RDS does not solve the ingestion decoupling problem.

Study Guide reference: Core Infrastructure Deep Dive — Function Compute, messaging architectures, asynchronous processing, and scalable application integration.

==================================================

The public web tier needs an inbound security-group rule permitting TCP 443 from Internet clients. Therefore, Option E is required. Security groups act as virtual firewalls and should expose only application ports required by the workload. Alibaba Cloud recommends allowing public access only to necessary web-service ports such as HTTPS 443 while keeping internal services inaccessible from the Internet.

For the database tier, access should be limited to ECS instances belonging to the web-server security group. Alibaba Cloud RDS for MySQL supports associating an ECS security group with an RDS instance, allowing ECS instances in that group to connect without adding every server address individually to an IP whitelist. This is particularly useful when application-server membership changes dynamically.

Option B is overly broad because every resource within the public vSwitch ' s CIDR could potentially be authorized rather than only the approved web tier. Option C would prevent legitimate database traffic. Option D is unnecessary because RDS access behaves as an allow-list model: only explicitly authorized addresses or associated security-group members should be granted database access.

Thus, Internet clients reach the web tier only over HTTPS, while MySQL accepts access only from the authorized application servers.

Study Guide reference: Securing Workloads on Alibaba Cloud — Security Groups, RDS access control, least privilege, and tiered network segmentation.

==================================================

The threats described exist at different layers, so the architecture should apply layered protection. WAF is the correct control for public HTTP/API traffic because it analyzes application-layer requests and blocks threats such as SQL injection, cross-site scripting, command injection, brute-force attacks, and other OWASP-style attacks. Alibaba Cloud explicitly supports integrating WAF with API Gateway and recommends disabling direct access paths afterward so clients cannot bypass WAF.

Large DDoS attacks require a dedicated volumetric mitigation service. Anti-DDoS Proxy scrubs malicious network and transport-layer traffic before clean traffic is forwarded toward the application infrastructure. Alibaba Cloud ' s Anti-DDoS architecture supports protected services behind Server Load Balancer resources and provides port-forwarding mechanisms for non-HTTP workloads.

Alibaba Cloud specifically recommends combining Anti-DDoS and WAF when an application needs protection against both large volumetric attacks and sophisticated application-layer exploits.

WAF should protect the HTTP/API application boundary rather than being treated as a general Layer-4 NLB firewall. Security Center provides workload security and posture management, while basic DDoS protection alone is less suitable for the question ' s explicitly stated large and sophisticated attacks.

Study Guide reference: Securing Workloads on Alibaba Cloud — WAF, Anti-DDoS, API Gateway security, and defense-in-depth.

==================================================

Function Compute and Simple Message Queue form an appropriate serverless, event-driven backend for bursty mobile workloads.

Function Compute is fully managed and automatically allocates elastic compute resources when functions are invoked. Alibaba Cloud bills Function Compute primarily according to actual configured resources and execution duration, allowing the startup to avoid maintaining continuously running application servers. This is particularly suitable for APIs and backend handlers experiencing unpredictable request spikes.

SMQ provides managed asynchronous messaging for decoupling backend components. It supports queue-based processing and publish-subscribe topics, making it suitable for notification events, background jobs, workflow messages, and traffic buffering. Alibaba Cloud explicitly identifies load leveling during sudden traffic spikes as an SMQ use case.

SMQ can also directly trigger Function Compute through queue or topic integrations, creating an event-driven design without dedicated message-consumer servers.

ECS requires persistent server resources and management, which conflicts with the requested serverless operating model. MaxCompute is a large-scale data warehouse and batch analytics platform rather than the application ' s transactional API or messaging layer.

Therefore, Function Compute supplies elastic execution while SMQ provides reliable asynchronous communication and notification-event handling.

Study Guide reference: Delivering Services and Content on Alibaba Cloud — Function Compute, serverless architectures, SMQ, event-driven integration, and elastic application services.

==================================================

Option B provides the simplest consolidated content-delivery architecture. Alibaba Cloud CDN can use multiple origins, and current CDN functionality supports origin-selection rules based on parameters such as request path, headers, query strings, and cookies. This allows static requests to be associated with an OSS origin while application requests are forwarded toward the ALB-backed application tier.

Static objects stored in OSS benefit directly from CDN edge caching. Requests are routed to nearby CDN points of presence, and cached resources can be returned without repeatedly accessing the OSS origin, reducing both latency and origin load.

Dynamic responses are generally not cached because they are generated uniquely for requests. They can still be routed to the application origin according to the configured origin rules.

The Global Accelerator alternatives create an unnecessarily fragmented architecture and attempt to use separate acceleration paths where one CDN-facing domain and origin-routing configuration can satisfy the question with fewer components. They also introduce additional DNS and acceleration configuration.

Therefore, a single CDN delivery layer with OSS and ALB-backed origins, combined with Alibaba Cloud DNS directing the application domain to CDN, produces the lowest configuration overhead.

Study Guide reference: Delivering Services and Content on Alibaba Cloud — CDN, OSS acceleration, ALB origins, and intelligent content delivery.

==================================================

Express Connect combined with Cloud Enterprise Network Transit Routers provides the appropriate enterprise hybrid-network architecture. Express Connect establishes a dedicated private circuit from the on-premises data center to Alibaba Cloud, providing lower latency, predictable performance, high bandwidth, and reduced exposure compared with Internet-based VPN connectivity.

The Express Connect circuit terminates through a Virtual Border Router. That VBR can be attached to CEN, where Transit Routers provide hub-and-spoke connectivity to multiple VPCs instead of requiring separate point-to-point connections for every VPC. Transit Routers can connect VPCs, VBRs, VPN attachments, and inter-region Transit Routers, enabling centralized routing across a geographically distributed enterprise network.

Alibaba Cloud also supports connecting an on-premises VBR and multiple VPCs to a Transit Router so that all attached networks communicate over private connectivity. Cross-region CEN connections then extend the architecture to VPCs in additional regions.

VPN Gateway relies on Internet-based encrypted tunnels and would require more tunnel management at scale. NAT Gateway performs address translation and does not provide private hybrid interconnection. Apsara Stack is an on-premises cloud platform rather than the required connectivity service.

Study Guide reference: Building Enterprise-grade Networks on Alibaba Cloud — Express Connect, CEN, Transit Router, hybrid networking, and cross-region connectivity.

==================================================

Option A refers to PolarDB Global Database Network (GDN), Alibaba Cloud ' s architecture for connecting PolarDB clusters across regions. A GDN contains a primary cluster and secondary regional clusters. Data changes are continuously replicated, local reads can be served by regional clusters, and write operations are routed to the primary cluster. Maintaining a single authoritative write path is particularly important for reservation transactions where concurrent booking operations must be controlled consistently.

Option C provides resilient application capacity by deploying ECS application servers in multiple regions and using ALB within each regional deployment to distribute requests among healthy instances. In a complete production implementation, a global routing mechanism such as DNS traffic management or Global Accelerator would normally direct users between those regional application stacks.

Function Compute is suitable for payment-gateway integrations because payment callbacks and API interactions are event-driven or request-driven workloads. Function Compute can be exposed securely through API Gateway, which provides routing, authentication, traffic control, and API management without persistent integration servers.

OSS versioning is useful for protecting stored objects but does not supply the transactional database, regional application availability, or payment-processing functionality required here.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — multi-region PolarDB, GDN, regional application tiers, ALB, and serverless integration.

==================================================

Alibaba Cloud CDN is specifically designed to accelerate content delivery by distributing and caching content at geographically distributed points of presence. When a user requests an accelerated resource, CDN DNS scheduling assigns an appropriate PoP. If the resource is cached there, the PoP returns it directly without requiring a round trip to the origin infrastructure. Alibaba Cloud documentation explicitly states that static resources are cached on the nearest PoP to reduce latency and improve access efficiency.

This directly satisfies both key requirements in the question: caching static content and directing users toward edge infrastructure close to their locations. If content is not cached or has expired, the CDN PoP performs an origin fetch and then serves the resource.

GTM can perform DNS-based geographical or latency routing among application endpoints and regions, but it is not itself a distributed static-content caching service. Express Connect provides private dedicated connectivity between enterprise/on-premises networks and Alibaba Cloud. SLB distributes traffic among backend servers but does not provide a worldwide edge caching network.

Therefore, Alibaba Cloud CDN is the only listed service that simultaneously implements PoP-based edge delivery and static-content caching.

Study Guide reference: Delivering Content on Alibaba Cloud; content acceleration and global application-delivery architecture.

==================================================

Option C provides the lowest-change migration path for the application tier. Rehosting the existing Windows workload on Windows Server ECS instances preserves its operating-system environment while distributing instances across availability zones improves resilience against zone-level infrastructure failures.

For the database tier, Option A provides the stronger managed architecture. Alibaba Cloud explicitly supports using DTS to migrate self-managed Oracle databases to PolarDB for PostgreSQL (Compatible with Oracle), including schema, full-data, and incremental-data migration for minimal migration downtime.

PolarDB ' s Oracle-compatible edition is specifically engineered to run Oracle workloads with minimal application modification. It supports Oracle-compatible data types, SQL constructs, PL/SQL features, OCI connectivity, packages, sequences, synonyms, and related functionality.

It also provides built-in high availability: failures are detected automatically and workloads can fail over to healthy nodes. This provides a more complete managed availability architecture than simply deploying independent self-managed Oracle servers across zones, which would additionally require Oracle-level replication/failover configuration.

Options B and D require substantial application refactoring and therefore conflict with the explicit requirement to minimize development changes.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — workload migration, ECS multi-zone design, DTS, and PolarDB Oracle compatibility.

==================================================

Option B provides both an appropriate security boundary and an optimized delivery path. Alibaba Cloud CDN should be the Internet-facing content-delivery layer so that cacheable HTTPS resources are served from edge points of presence close to users. Alibaba Cloud currently supports directly configuring an ALB instance domain as a CDN origin, producing the request path client → CDN → ALB → backend server. This prevents clients from bypassing the load-balancing tier and preserves centralized health checking and traffic distribution.

The backend ECS instances should remain on private network addresses rather than being individually Internet-exposed. For an Internet-facing ALB, external traffic reaches the ALB through its public EIP and is then forwarded internally to backend ECS private IP addresses. This substantially reduces the attack surface while retaining public application availability.

Options C and D unnecessarily expose ECS instances through public networking. Option A uses private ECS instances, but making the individual application servers the CDN origins bypasses the ALB ' s centralized distribution and availability functions. Therefore, CDN → ALB → private ECS is the strongest architecture.

Study Guide reference: Delivering Content on Alibaba Cloud; Delivering Services on Alibaba Cloud; Highly Available Architecture.

==================================================

Simple Log Service (SLS) is the appropriate logging platform for an ACK Serverless environment. Serverless Kubernetes removes much of the node-management responsibility, so the logging architecture should follow the same managed-service model rather than introduce dedicated log-processing infrastructure.

Alibaba Cloud provides native SLS integration for ACK Serverless. SLS can collect container standard output and application log files and then provide centralized search, analysis, dashboards, alerting, and downstream shipping. Alibaba documentation specifically states that ACK Serverless provides managed SLS capabilities and supports collecting container logs directly into SLS.

ARMS is primarily an application performance monitoring and observability platform; it does not replace SLS as the core centralized log-ingestion service. Option C is incorrect because SLS supports near-real-time collection and analysis. Option D also misunderstands serverless logging: scaling events do not inherently require dedicated logging servers.

The architecture should therefore preserve the operational advantages of serverless compute by using SLS as a fully managed, elastic logging layer capable of handling workload fluctuations without requiring the organization to provision and administer separate logging infrastructure.

Study Guide reference: Core Infrastructure Deep Dive — ACK, serverless container architecture, observability, and Simple Log Service.

CDN should form the content-delivery layer for cacheable video assets. Alibaba Cloud CDN distributes content to geographically dispersed edge nodes so viewers retrieve cached objects from nearby POPs rather than repeatedly connecting to a distant origin. Alibaba Cloud explicitly supports video-oriented CDN acceleration and edge delivery, reducing both end-user latency and origin bandwidth demand.

Auto Scaling addresses peak-time compute demand. It monitors workload conditions and automatically increases ECS capacity during traffic spikes, then scales resources back when traffic decreases. Alibaba Cloud specifically identifies streaming platforms with unpredictable demand as a typical Auto Scaling scenario.

Global Accelerator complements CDN and Auto Scaling where viewers or application endpoints are separated by long-distance or cross-border networks. GA routes traffic through Alibaba Cloud ' s optimized global BGP network, reducing latency, jitter, and packet loss. Alibaba documentation explicitly identifies video streaming as a latency-sensitive scenario that benefits from this architecture.

Tair can improve authentication or session performance, but it does not directly address video delivery quality or regional network performance. Therefore, CDN + Auto Scaling + Global Accelerator most directly satisfies the streaming requirement.

Study Guide reference: Delivering Services and Content on Alibaba Cloud — CDN, Global Accelerator, Auto Scaling, video delivery, and global traffic optimization.

==================================================