Alibaba Cloud Alibaba Cloud Certified Professional: Cloud Architect CAP-C01 Exam Dumps: Updated Questions & Answers (October 2026)

Option C provides the lowest-change migration path for the application tier. Rehosting the existing Windows workload on Windows Server ECS instances preserves its operating-system environment while distributing instances across availability zones improves resilience against zone-level infrastructure failures.

For the database tier, Option A provides the stronger managed architecture. Alibaba Cloud explicitly supports using DTS to migrate self-managed Oracle databases to PolarDB for PostgreSQL (Compatible with Oracle), including schema, full-data, and incremental-data migration for minimal migration downtime.

PolarDB ' s Oracle-compatible edition is specifically engineered to run Oracle workloads with minimal application modification. It supports Oracle-compatible data types, SQL constructs, PL/SQL features, OCI connectivity, packages, sequences, synonyms, and related functionality.

It also provides built-in high availability: failures are detected automatically and workloads can fail over to healthy nodes. This provides a more complete managed availability architecture than simply deploying independent self-managed Oracle servers across zones, which would additionally require Oracle-level replication/failover configuration.

Options B and D require substantial application refactoring and therefore conflict with the explicit requirement to minimize development changes.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — workload migration, ECS multi-zone design, DTS, and PolarDB Oracle compatibility.

==================================================

The ECS security group must allow inbound HTTPS traffic. For an inbound security-group rule, the Internet clients are the source, so the correct rule permits TCP destination port 443 from source 0.0.0.0/0. This makes Option C correct. Alibaba Cloud security groups are stateful, which means response traffic belonging to an allowed connection is automatically permitted and does not require a matching outbound security-group rule.

Network ACLs behave differently. Alibaba Cloud VPC network ACLs are stateless. If the ACL permits an inbound HTTPS request but does not permit the corresponding return packet, the TCP session cannot operate correctly. The inbound ACL therefore needs TCP 443 from Internet clients, while the outbound ACL must permit return traffic to client ephemeral destination ports. Alibaba Cloud explicitly recommends 1024–65535 when all client ephemeral-port implementations must be supported.

Option D permits only the incoming side of the ACL and therefore fails because response packets remain blocked. Option E incorrectly assumes that outbound server responses use destination port 443; the server ' s source port is 443, but the destination is the client ' s ephemeral port.

Study Guide reference: Securing Workloads on Alibaba Cloud — stateful Security Groups, stateless network ACLs, HTTPS exposure, and ephemeral ports.

==================================================

ROS Stack Groups are specifically designed for centrally deploying a common Resource Orchestration Service template across multiple Alibaba Cloud accounts and regions. This makes option D the architecture that directly addresses both dimensions of the requirement: multi-account governance and multi-region infrastructure-as-code deployment.

Alibaba Cloud documentation states that stack instances belonging to a stack group can deploy stacks into destination accounts and different regions. With Resource Directory integration and service-managed permissions, trusted access can be enabled so that stack groups are operated by a management account or delegated administrator while deployments occur in organization member accounts.

Nested stacks are primarily a template-composition mechanism; they do not constitute centralized multi-account deployment orchestration. Manually combining ordinary ROS templates and RAM policies could technically enable cross-account operations, but it recreates functionality that Stack Groups provide natively and increases operational overhead. Resource Directory and Cloud Governance alone also do not replace the actual multi-account, multi-region stack deployment mechanism.

Therefore, Resource Directory establishes the organizational account structure while ROS Stack Groups provide repeatable infrastructure deployment across those accounts and target regions.

Study Guide reference: Core Infrastructure Deep Dive; Resource Orchestration Service, multi-account governance, and repeatable cloud architecture.

==================================================

A multi-zone deployment within the same region is the standard architecture for surviving the complete failure of one availability zone. Alibaba Cloud zones within a region are physically isolated for fault tolerance while maintaining high-speed internal network connectivity. Alibaba Cloud explicitly recommends deploying resources across different zones when higher disaster-recovery capability is required.

For an application tier, multiple ECS instances should be placed in separate zones and normally fronted by a multi-zone ALB or another suitable load-balancing service. Health checks ensure that traffic is no longer directed to unavailable instances, allowing surviving instances in another zone to continue serving requests. Alibaba Cloud ' s current high-availability guidance specifically describes multi-zone ECS and load-balancer deployments as the architecture for resilience against data-center or zone failures.

Option A remains vulnerable because all compute resources share the same zone failure domain. Option C retains a single compute point of failure regardless of storage performance. Option D can protect against an entire regional disaster, but it adds substantially greater networking, data synchronization, routing, and operational complexity than is necessary for the stated requirement of surviving one zone failure.

Therefore, distributing ECS instances across multiple zones within one region is the correct high-availability strategy.

Study Guide reference: Highly Available Architecture on Alibaba Cloud; Core Compute Infrastructure; multi-zone disaster recovery.

Global Accelerator is designed for precisely this class of global interactive application. Clients connect through Alibaba Cloud ' s nearby acceleration access points, after which traffic traverses Alibaba Cloud ' s optimized global network toward the most appropriate backend region. This reduces Internet routing variability and improves end-to-end latency for latency-sensitive workloads such as gaming.

GA listeners define the application protocol and ports, while endpoint groups represent backend deployments in different regions. With intelligent routing, GA can select a nearby healthy endpoint group and forward requests accordingly. Alibaba Cloud also provides endpoint health checks; when an endpoint becomes unhealthy, new requests can automatically be directed to healthy endpoints.

CDN is highly effective for static cacheable content but is not the correct primary mechanism for arbitrary real-time game traffic and regional backend health-based routing. RDS and Tair improve application data performance but do not solve global network acceleration.

Therefore, GA in front of regional ALBs provides the correct architecture: nearest-entry acceleration, Alibaba Cloud backbone transport, regional endpoint groups, health monitoring, and failover.

Study Guide reference: Delivering Services and Content on Alibaba Cloud — Global Accelerator, ALB, multi-region traffic management, and high availability.

The three explicit requirements are centralized key management, encryption in transit, and encryption at rest.

KMS satisfies centralized cryptographic-key management. It provides secure key creation, storage, lifecycle management, access control, and integration with Alibaba Cloud services such as databases and storage. Customer-managed software or hardware-protected keys can also be used where stricter compliance controls are required.

Certificate Management Service provides SSL/TLS certificates that establish encrypted HTTPS/TLS communication and verify server identity. TLS prevents sensitive transaction information from being transmitted as readable plaintext across network connections.

Transparent Data Encryption protects database data at rest. Alibaba Cloud RDS documentation identifies TDE as an encryption layer protecting database data files and backups without requiring applications to perform the underlying encryption themselves. RDS also separately supports SSL for database connection encryption.

Security Groups are an important network-access control, but the question requires exactly three controls specifically addressing encryption and centralized key management. Redis session management is unrelated.

The resulting security architecture therefore uses KMS for keys, TLS certificates for data in transit, and RDS TDE for persistent data at rest.

Study Guide reference: Securing Workloads on Alibaba Cloud — KMS, TLS/SSL, RDS encryption, TDE, and cryptographic key governance.

==================================================

Express Connect with redundant connections is the strongest match for a mission-critical hybrid network requiring private connectivity, high availability, and enterprise-scale bandwidth. Express Connect establishes dedicated, secure, high-speed private connectivity between an on-premises data center and Alibaba Cloud VPC resources rather than transporting application traffic over the public Internet.

Alibaba Cloud ' s current Express Connect guidance identifies disaster recovery and high availability as primary enterprise scenarios. Redundant circuits and connection paths can protect connectivity against failures involving leased lines, devices, fiber cuts, and access points. Alibaba also identifies highly elastic, high-availability architectures based on dedicated connectivity and ECMP for environments with significant traffic requirements.

VPC peering connects VPC networks and does not independently provide an on-premises dedicated access circuit. VPN Gateway can connect an on-premises network to a VPC securely, but it uses Internet-based VPN transport and is generally not the strongest option where dedicated private connectivity, large scalable bandwidth, and robust path redundancy are explicit requirements. NAT Gateway provides address translation and Internet access functions rather than private hybrid connectivity.

Therefore, redundant Express Connect paths provide the enterprise-grade hybrid networking characteristics described.

Study Guide reference: Building Enterprise-grade Networks on Alibaba Cloud; hybrid connectivity, resilient networking, and Express Connect design.

==================================================

Simple Log Service (SLS) is a managed log-ingestion, storage, query, analysis, and visualization service, making it the most operationally efficient front-end for this telemetry workload. It eliminates the requirement to provision and manage ECS-based collectors or a separate search cluster simply to ingest and analyze log records.

For longer-term retention, Alibaba Cloud supports automatically shipping SLS data to OSS. This creates a clean hot-to-cold architecture: maintain recent data in SLS for interactive analysis and export older data to OSS for economical retention.

OSS lifecycle management can then automatically transition aging objects to lower-cost storage classes such as Archive. Lifecycle rules are explicitly designed to automate storage-class transitions based on object age, eliminating manual archival administration.

Option A requires additional Elasticsearch retention administration. Option B requires managing ECS infrastructure even though the question explicitly prioritizes reduced operational management. Option D adds Kafka unnecessarily and still specifies manual archival, directly conflicting with the requirement to minimize operational effort.

Thus, SLS for managed ingestion and recent analysis combined with SLS-to-OSS shipping and OSS lifecycle transitions provides the strongest serverless/managed retention architecture.

Study Guide reference: Core Infrastructure Deep Dive; Core Storage Infrastructure; operationally efficient log and data-storage architecture.

==================================================

Global Database Network is the architecture specifically intended for geographically distributed PolarDB deployments requiring cross-region data replication, local read capability, and disaster recovery. A GDN contains a primary cluster plus secondary clusters in other regions. Data is continuously synchronized between them. Applications can connect to regional cluster endpoints; read requests can be served locally while write requests are routed to the primary cluster. Alibaba Cloud also supports switching the primary cluster to a secondary cluster, including forced switchover scenarios for failures.

Option C provides strong node-level and zone-level availability within a PolarDB cluster, but it does not deliver the same level of protection against an entire regional outage. Option D relies on backup restoration, which introduces significantly higher RTO and operational intervention. Option B invents an unnecessary Function Compute replication mechanism instead of using PolarDB ' s native cross-region replication.

For a mission-critical global e-commerce database, GDN provides the best combination of cross-region redundancy, replication, local reads, and regional failover capabilities.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — PolarDB high availability, cross-region disaster recovery, and Global Database Network.

Option A refers to PolarDB Global Database Network (GDN), Alibaba Cloud ' s architecture for connecting PolarDB clusters across regions. A GDN contains a primary cluster and secondary regional clusters. Data changes are continuously replicated, local reads can be served by regional clusters, and write operations are routed to the primary cluster. Maintaining a single authoritative write path is particularly important for reservation transactions where concurrent booking operations must be controlled consistently.

Option C provides resilient application capacity by deploying ECS application servers in multiple regions and using ALB within each regional deployment to distribute requests among healthy instances. In a complete production implementation, a global routing mechanism such as DNS traffic management or Global Accelerator would normally direct users between those regional application stacks.

Function Compute is suitable for payment-gateway integrations because payment callbacks and API interactions are event-driven or request-driven workloads. Function Compute can be exposed securely through API Gateway, which provides routing, authentication, traffic control, and API management without persistent integration servers.

OSS versioning is useful for protecting stored objects but does not supply the transactional database, regional application availability, or payment-processing functionality required here.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — multi-region PolarDB, GDN, regional application tiers, ALB, and serverless integration.

==================================================