Alibaba Cloud Updated CAP-C01 Exam Questions and Answers by arden

Basic security groups support group-based authorization, allowing one security group ' s rules to reference another security group rather than requiring administrators to maintain long lists of individual IP addresses. Alibaba Cloud explicitly recommends source-security-group authorization for internal application communication because it is more manageable than maintaining individual private IP addresses or CIDR ranges.

This distinction is important because advanced security groups do not support another security group as an authorization object. Their primary benefit is higher private-IP capacity for very large deployments, not simplified service-to-service authorization.

For workloads residing in different VPCs, network connectivity must first exist through VPC Peering, Cloud Enterprise Network, PrivateLink, or another appropriate mechanism. Security groups do not themselves establish cross-VPC routes; they enforce authorization once the relevant network path exists.

Centralized logging provides visibility but does not simplify the actual authorization rules. Network ACLs operate at the vSwitch/subnet boundary and are less appropriate for application-tier identity based on security-group membership.

Thus, basic security groups with group-based authorization provide the intended simplified access-control model.

Study Guide reference: Securing Workloads on Alibaba Cloud — security groups, group-based authorization, least privilege, and VPC workload segmentation.

==================================================

Option A refers to PolarDB Global Database Network (GDN), Alibaba Cloud ' s architecture for connecting PolarDB clusters across regions. A GDN contains a primary cluster and secondary regional clusters. Data changes are continuously replicated, local reads can be served by regional clusters, and write operations are routed to the primary cluster. Maintaining a single authoritative write path is particularly important for reservation transactions where concurrent booking operations must be controlled consistently.

Option C provides resilient application capacity by deploying ECS application servers in multiple regions and using ALB within each regional deployment to distribute requests among healthy instances. In a complete production implementation, a global routing mechanism such as DNS traffic management or Global Accelerator would normally direct users between those regional application stacks.

Function Compute is suitable for payment-gateway integrations because payment callbacks and API interactions are event-driven or request-driven workloads. Function Compute can be exposed securely through API Gateway, which provides routing, authentication, traffic control, and API management without persistent integration servers.

OSS versioning is useful for protecting stored objects but does not supply the transactional database, regional application availability, or payment-processing functionality required here.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — multi-region PolarDB, GDN, regional application tiers, ALB, and serverless integration.

==================================================

OSS versioning is specifically intended to protect objects from unintended deletions and overwrites. When versioning is enabled, OSS retains historical versions of an object. A normal delete operation creates a delete marker instead of permanently destroying all existing versions, allowing an administrator to restore a previous version when required.

Alibaba Cloud explicitly recommends versioning as a protection mechanism against accidental deletion or overwriting. Its current documentation states that, after versioning is enabled, accidentally deleted or overwritten content remains available as historical versions that can subsequently be restored.

Encryption protects confidentiality of stored data but does not provide logical deletion recovery. A private bucket ACL reduces unauthorized access but does not stop an authorized administrator or application from deleting an object accidentally. Lifecycle rules automate transitions or deletion according to defined policies; improperly configured lifecycle rules can themselves delete data, so they are not the primary protection mechanism requested here.

For particularly critical workloads, versioning can be supplemented with backup or carefully designed cross-region replication, but among the four choices, enabling OSS versioning directly addresses accidental deletion and provides recovery capability.

Study Guide reference: Core Storage Infrastructure Deep Dive; data durability, protection, and OSS object-management mechanisms.

==================================================

The workload is an excellent candidate for preemptible, currently called spot, ECS capacity because it is short-lived, batch-oriented, horizontally scalable, and explicitly tolerant of interruption. The question states that if an instance fails, another instance can reprocess the job. That removes the main architectural objection to using interruptible compute.

Alibaba Cloud describes ECS spot instances as unused ECS capacity offered at substantially reduced prices compared with standard pay-as-you-go instances. The documented recommended scenarios include short-term tasks, data analytics, and applications that are highly fault tolerant and able to tolerate interruption.

Savings Plans and reserved-instance-style commitments can reduce costs for predictable long-term baseline consumption, but this workload runs only at two scheduled times each day. Purchasing committed capacity for a sporadic workload can leave paid capacity economically underutilized. Higher-specification pay-as-you-go instances also do not inherently minimize compute cost.

Using a launch template with preemptible/spot ECS instances allows Auto Scaling to add inexpensive compute when the batch workload requires it, while the application ' s retry mechanism handles interruptions.

Study Guide reference: Core Compute Infrastructure Deep Dive; Scalable Architecture on Alibaba Cloud; cost optimization for elastic compute.

==================================================