Alibaba Cloud CAP-C01 - Alibaba Cloud Certified Professional: Cloud Architect

The three explicit requirements are centralized key management, encryption in transit, and encryption at rest.

KMS satisfies centralized cryptographic-key management. It provides secure key creation, storage, lifecycle management, access control, and integration with Alibaba Cloud services such as databases and storage. Customer-managed software or hardware-protected keys can also be used where stricter compliance controls are required.

Certificate Management Service provides SSL/TLS certificates that establish encrypted HTTPS/TLS communication and verify server identity. TLS prevents sensitive transaction information from being transmitted as readable plaintext across network connections.

Transparent Data Encryption protects database data at rest. Alibaba Cloud RDS documentation identifies TDE as an encryption layer protecting database data files and backups without requiring applications to perform the underlying encryption themselves. RDS also separately supports SSL for database connection encryption.

Security Groups are an important network-access control, but the question requires exactly three controls specifically addressing encryption and centralized key management. Redis session management is unrelated.

The resulting security architecture therefore uses KMS for keys, TLS certificates for data in transit, and RDS TDE for persistent data at rest.

Study Guide reference: Securing Workloads on Alibaba Cloud — KMS, TLS/SSL, RDS encryption, TDE, and cryptographic key governance.

==================================================

Simple Log Service (SLS) is a managed log-ingestion, storage, query, analysis, and visualization service, making it the most operationally efficient front-end for this telemetry workload. It eliminates the requirement to provision and manage ECS-based collectors or a separate search cluster simply to ingest and analyze log records.

For longer-term retention, Alibaba Cloud supports automatically shipping SLS data to OSS. This creates a clean hot-to-cold architecture: maintain recent data in SLS for interactive analysis and export older data to OSS for economical retention.

OSS lifecycle management can then automatically transition aging objects to lower-cost storage classes such as Archive. Lifecycle rules are explicitly designed to automate storage-class transitions based on object age, eliminating manual archival administration.

Option A requires additional Elasticsearch retention administration. Option B requires managing ECS infrastructure even though the question explicitly prioritizes reduced operational management. Option D adds Kafka unnecessarily and still specifies manual archival, directly conflicting with the requirement to minimize operational effort.

Thus, SLS for managed ingestion and recent analysis combined with SLS-to-OSS shipping and OSS lifecycle transitions provides the strongest serverless/managed retention architecture.

Study Guide reference: Core Infrastructure Deep Dive; Core Storage Infrastructure; operationally efficient log and data-storage architecture.

==================================================

The core problem is durability during transient processing or network failures. A topic provides publish/subscribe notification delivery, but placing an SMQ queue behind the topic creates a persistent buffer between the notification producer and the Function Compute consumer. Alibaba Cloud supports subscribing a queue to an SMQ topic so that every message published to the topic is copied into the queue and retained for consumption.

Function Compute should then process records from the queue. Queue semantics provide the required failure recovery: after a consumer receives a message, it becomes temporarily invisible. The consumer deletes the message only after successful processing. If processing fails—for example because of a temporary connectivity problem—the message is not deleted and becomes visible again after the visibility timeout, allowing another processing attempt.

Function Compute also supports SMQ queue triggers with configurable retries, fault-tolerance behavior, and dead-letter handling, which can further strengthen this architecture.

Increasing memory does not fix network reliability, and multi-region deployment alone does not guarantee message persistence. A durable queue therefore prevents transient failures from silently losing ingestion work.

Study Guide reference: Core Infrastructure Deep Dive — Simple Message Queue, Function Compute, durable asynchronous processing, retries, and decoupled event-driven architecture.

Tair is the appropriate architecture for a frequently changing game leaderboard because Redis-compatible sorted data structures are optimized for high-throughput score updates and ranking operations. Instead of repeatedly executing expensive aggregation and sorting queries against the relational database, the application can maintain player scores in Tair and retrieve the highest-ranked members directly.

Alibaba Cloud specifically documents leaderboard implementations based on Tair ' s sorted-set capabilities. Tair ' s enhanced exZset functionality supports scalable ranking use cases and can distribute large leaderboards across multiple internal structures while preserving rank calculation.

This also protects RDS from high-frequency scoreboard queries. RDS remains the durable transactional database, while Tair operates as the low-latency serving and ranking layer for frequently accessed score data.

CDN caching is unsuitable because the leaderboard changes continually and requires near-real-time freshness. A second relational PostgreSQL database would duplicate database infrastructure without providing the specialized in-memory ranking semantics required. An RDS read replica can reduce pressure on the primary database, but calculating and sorting rankings through SQL for every refresh remains less efficient than maintaining rankings directly in an in-memory sorted structure.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — Tair, caching, low-latency architectures, and database performance optimization.

==================================================

Alibaba Cloud CDN is specifically designed to accelerate content delivery by distributing and caching content at geographically distributed points of presence. When a user requests an accelerated resource, CDN DNS scheduling assigns an appropriate PoP. If the resource is cached there, the PoP returns it directly without requiring a round trip to the origin infrastructure. Alibaba Cloud documentation explicitly states that static resources are cached on the nearest PoP to reduce latency and improve access efficiency.

This directly satisfies both key requirements in the question: caching static content and directing users toward edge infrastructure close to their locations. If content is not cached or has expired, the CDN PoP performs an origin fetch and then serves the resource.

GTM can perform DNS-based geographical or latency routing among application endpoints and regions, but it is not itself a distributed static-content caching service. Express Connect provides private dedicated connectivity between enterprise/on-premises networks and Alibaba Cloud. SLB distributes traffic among backend servers but does not provide a worldwide edge caching network.

Therefore, Alibaba Cloud CDN is the only listed service that simultaneously implements PoP-based edge delivery and static-content caching.

Study Guide reference: Delivering Content on Alibaba Cloud; content acceleration and global application-delivery architecture.

==================================================