Score Higher on Verified CAP-C01 | Alibaba Cloud Certified Professional: Cloud Architect Exam Questions with Answers

Tair (Redis OSS-Compatible) is the appropriate centralized session-state layer for an elastic, distributed application. When ECS instances frequently scale in and out, application sessions must not depend on the lifecycle of any individual compute node. By storing session tokens and session state in Tair, every ECS instance can retrieve the same session information, making the web/application tier effectively stateless and compatible with Auto Scaling.

Alibaba Cloud Tair is a fully managed Redis-compatible database designed for high throughput, low latency, elastic scalability, and high availability. Alibaba Cloud also documents session-oriented Tair use cases in which session tokens are stored as Redis/Tair data structures with TTL values, demonstrating precisely why the service fits distributed session management.

Session stickiness is weaker because it attempts to keep a user on a specific backend and therefore creates affinity to an instance that might be removed during scaling or failover. CloudMonitor is an observability service, not a session store. STS issues temporary Alibaba Cloud credentials and does not maintain application user sessions.

Consequently, separating session state from ECS compute by storing it in Tair gives the architecture the elasticity and fault tolerance required.

Study Guide reference: Distributed Architecture on Alibaba Cloud; Performant Architecture; Core Infrastructure Deep Dive.

==================================================

The existing architecture has two important bottlenecks: a single ECS compute node and files stored on storage attached to that individual ECS instance. Option E eliminates the compute single point of failure. A custom image allows identical ECS instances to be created, while Auto Scaling maintains multiple instances and ALB distributes requests across healthy backends. This provides horizontal scalability and significantly stronger application availability.

Option D addresses shared application storage. File Storage NAS is a managed, POSIX-compatible shared filesystem that multiple ECS instances can mount concurrently. All web servers therefore see the same files, while NAS handles storage scalability and consistency independently from the ECS lifecycle.

Option A improves performance by moving cacheable website content toward users. CDN serves static resources from nearby POPs and reduces requests and bandwidth reaching the origin infrastructure.

Although OSS is excellent for native object-storage workloads, mounting OSS through ossfs does not provide the same filesystem semantics and consistency characteristics as NAS for a traditional application requiring minimal modification. Global Accelerator primarily optimizes network paths and does not eliminate the application ' s compute or storage single points of failure.

Study Guide reference: Building Highly Available, Performant Cloud Architecture — ALB, Auto Scaling, NAS shared storage, and CDN.

==================================================

The threats described exist at different layers, so the architecture should apply layered protection. WAF is the correct control for public HTTP/API traffic because it analyzes application-layer requests and blocks threats such as SQL injection, cross-site scripting, command injection, brute-force attacks, and other OWASP-style attacks. Alibaba Cloud explicitly supports integrating WAF with API Gateway and recommends disabling direct access paths afterward so clients cannot bypass WAF.

Large DDoS attacks require a dedicated volumetric mitigation service. Anti-DDoS Proxy scrubs malicious network and transport-layer traffic before clean traffic is forwarded toward the application infrastructure. Alibaba Cloud ' s Anti-DDoS architecture supports protected services behind Server Load Balancer resources and provides port-forwarding mechanisms for non-HTTP workloads.

Alibaba Cloud specifically recommends combining Anti-DDoS and WAF when an application needs protection against both large volumetric attacks and sophisticated application-layer exploits.

WAF should protect the HTTP/API application boundary rather than being treated as a general Layer-4 NLB firewall. Security Center provides workload security and posture management, while basic DDoS protection alone is less suitable for the question ' s explicitly stated large and sophisticated attacks.

Study Guide reference: Securing Workloads on Alibaba Cloud — WAF, Anti-DDoS, API Gateway security, and defense-in-depth.

==================================================