🔍

SAA-C03 — questions

Page 17 of 51 · 1019 total questions.

SAA-C03 Question 321

Single page →
Topic 1 · Question 321

What should a solutions architect do to ensure that all objects uploaded to an Amazon S3 bucket are encrypted?

  • AUpdate the bucket policy to deny if the PutObject does not have an s3:x-amz-acl header set.
  • BUpdate the bucket policy to deny if the PutObject does not have an s3:x-amz-acl header set to private.
  • CUpdate the bucket policy to deny if the PutObject does not have an aws:SecureTransport header set to true.
  • DUpdate the bucket policy to deny if the PutObject does not have an x-amz-server-side-encryption header set. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Update the bucket policy to deny if the PutObject does not have an x-amz-server-side-encryption header set.

SAA-C03 Question 322

Single page →
Topic 1 · Question 322

A solutions architect is designing a multi-tier application for a company. The application's users upload images from a mobile device. The application generates a thumbnail of each image and returns a message to the user to confirm that the image was uploaded successfully. The thumbnail generation can take up to 60 seconds, but the company wants to provide a faster response time to its users to notify them that the original image was received. The solutions architect must design the application to asynchronously dispatch requests to the different application tiers. What should the solutions architect do to meet these requirements?

  • AWrite a custom AWS Lambda function to generate the thumbnail and alert the user. Use the image upload process as an event source to invoke the Lambda function.
  • BCreate an AWS Step Functions workflow. Configure Step Functions to handle the orchestration between the application tiers and alert the user when thumbnail generation is complete.
  • CCreate an Amazon Simple Queue Service (Amazon SQS) message queue. As images are uploaded, place a message on the SQS queue for thumbnail generation. Alert the user through an application message that the image was received. (correct answer)
  • DCreate Amazon Simple Notification Service (Amazon SNS) notification topics and subscriptions. Use one subscription with the application to generate the thumbnail after the image upload is complete. Use a second subscription to message the user's mobile app by way of a push notification after thumbnail generation is complete.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an Amazon Simple Queue Service (Amazon SQS) message queue. As images are uploaded, place a message on the SQS queue for thumbnail generation. Alert the user through an application message that the image was rec...

Explanation

Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes. This option decouples the components so they scale independently and absorb load spikes.

SAA-C03 Question 323

Single page →
Topic 1 · Question 323

A company’s facility has badge readers at every entrance throughout the building. When badges are scanned, the readers send a message over HTTPS to indicate who attempted to access that particular entrance. A solutions architect must design a system to process these messages from the sensors. The solution must be highly available, and the results must be made available for the company’s security team to analyze. Which system architecture should the solutions architect recommend?

  • ALaunch an Amazon EC2 instance to serve as the HTTPS endpoint and to process the messages. Configure the EC2 instance to save the results to an Amazon S3 bucket.
  • BCreate an HTTPS endpoint in Amazon API Gateway. Configure the API Gateway endpoint to invoke an AWS Lambda function to process the messages and save the results to an Amazon DynamoDB table. (correct answer)
  • CUse Amazon Route 53 to direct incoming sensor messages to an AWS Lambda function. Configure the Lambda function to process the messages and save the results to an Amazon DynamoDB table.
  • DCreate a gateway VPC endpoint for Amazon S3. Configure a Site-to-Site VPN connection from the facility network to the VPC so that sensor data can be written directly to an S3 bucket by way of the VPC endpoint.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an HTTPS endpoint in Amazon API Gateway. Configure the API Gateway endpoint to invoke an AWS Lambda function to process the messages and save the results to an Amazon DynamoDB table.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. Amazon API Gateway is a fully managed front door for creating and securing APIs at scale. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SAA-C03 Question 324

Single page →
Topic 1 · Question 324

A company wants to implement a disaster recovery plan for its primary on-premises file storage volume. The file storage volume is mounted from an Internet Small Computer Systems Interface (iSCSI) device on a local storage server. The file storage volume holds hundreds of terabytes (TB) of data. The company wants to ensure that end users retain immediate access to all file types from the on-premises systems without experiencing latency. Which solution will meet these requirements with the LEAST amount of change to the company's existing infrastructure?

  • AProvision an Amazon S3 File Gateway as a virtual machine (VM) that is hosted on premises. Set the local cache to 10 TB. Modify existing applications to access the files through the NFS protocol. To recover from a disaster, provision an Amazon EC2 instance and mount the S3 bucket that contains the files.
  • BProvision an AWS Storage Gateway tape gateway. Use a data backup solution to back up all existing data to a virtual tape library. Configure the data backup solution to run nightly after the initial backup is complete. To recover from a disaster, provision an Amazon EC2 instance and restore the data to an Amazon Elastic Block Store (Amazon EBS) volume from the volumes in the virtual tape library.
  • CProvision an AWS Storage Gateway Volume Gateway cached volume. Set the local cache to 10 TB. Mount the Volume Gateway cached volume to the existing file server by using iSCSI, and copy all files to the storage volume. Configure scheduled snapshots of the storage volume. To recover from a disaster, restore a snapshot to an Amazon Elastic Block Store (Amazon EBS) volume and attach the EBS volume to an Amazon EC2 instance.
  • DProvision an AWS Storage Gateway Volume Gateway stored volume with the same amount of disk space as the existing file storage volume. Mount the Volume Gateway stored volume to the existing file server by using iSCSI, and copy all files to the storage volume. Configure scheduled snapshots of the storage volume. To recover from a disaster, restore a snapshot to an Amazon Elastic Block Store (Amazon EBS) volume and attach the EBS volume to an Amazon EC2 instance. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Provision an AWS Storage Gateway Volume Gateway stored volume with the same amount of disk space as the existing file storage volume. Mount the Volume Gateway stored volume to the existing file server by using iSCSI,...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon EBS provides block storage attached to a single EC2 instance. AWS Storage Gateway bridges on-premises apps to AWS storage with local caching. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SAA-C03 Question 325

Single page →
Topic 1 · Question 325

A company is hosting a web application from an Amazon S3 bucket. The application uses Amazon Cognito as an identity provider to authenticate users and return a JSON Web Token (JWT) that provides access to protected resources that are stored in another S3 bucket. Upon deployment of the application, users report errors and are unable to access the protected content. A solutions architect must resolve this issue by providing proper permissions so that users can access the protected content. Which solution meets these requirements?

  • AUpdate the Amazon Cognito identity pool to assume the proper IAM role for access to the protected content. (correct answer)
  • BUpdate the S3 ACL to allow the application to access the protected content.
  • CRedeploy the application to Amazon S3 to prevent eventually consistent reads in the S3 bucket from affecting the ability of users to access the protected content.
  • DUpdate the Amazon Cognito pool to use custom attribute mappings within the identity pool and grant users the proper permissions to access the protected content.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Update the Amazon Cognito identity pool to assume the proper IAM role for access to the protected content.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Amazon Cognito manages user sign-up, sign-in and federated identity for applications.

SAA-C03 Question 326

Single page →
Topic 1 · Question 326 · Select all that apply

An image hosting company uploads its large assets to Amazon S3 Standard buckets. The company uses multipart upload in parallel by using S3 APIs and overwrites if the same object is uploaded again. For the first 30 days after upload, the objects will be accessed frequently. The objects will be used less frequently after 30 days, but the access patterns for each object will be inconsistent. The company must optimize its S3 storage costs while maintaining high availability and resiliency of stored assets. Which combination of actions should a solutions architect recommend to meet these requirements? (Choose two.)

  • AMove assets to S3 Intelligent-Tiering after 30 days. (correct answer)
  • BConfigure an S3 Lifecycle policy to clean up incomplete multipart uploads. (correct answer)
  • CConfigure an S3 Lifecycle policy to clean up expired object delete markers.
  • DMove assets to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.
  • EMove assets to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 30 days.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Move assets to S3 Intelligent-Tiering after 30 days. Option B: Configure an S3 Lifecycle policy to clean up incomplete multipart uploads.

Explanation

S3 Intelligent-Tiering automatically moves objects between tiers to optimize cost with no operational effort. S3 Lifecycle policies automatically transition or expire objects to control storage cost. Amazon S3 provides durable, scalable object storage that is fully managed. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SAA-C03 Question 327

Single page →
Topic 1 · Question 327

A solutions architect must secure a VPC network that hosts Amazon EC2 instances. The EC2 instances contain highly sensitive data and run in a private subnet. According to company policy, the EC2 instances that run in the VPC can access only approved third-party software repositories on the internet for software product updates that use the third party’s URL. Other internet traffic must be blocked. Which solution meets these requirements?

  • AUpdate the route table for the private subnet to route the outbound traffic to an AWS Network Firewall firewall. Configure domain list rule groups. (correct answer)
  • BSet up an AWS WAF web ACL. Create a custom set of rules that filter traffic requests based on source and destination IP address range sets.
  • CImplement strict inbound security group rules. Configure an outbound rule that allows traffic only to the authorized software repositories on the internet by specifying the URLs.
  • DConfigure an Application Load Balancer (ALB) in front of the EC2 instances. Direct all outbound traffic to the ALB. Use a URL-based rule listener in the ALB’s target group for outbound access to the internet.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Update the route table for the private subnet to route the outbound traffic to an AWS Network Firewall firewall. Configure domain list rule groups.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 328

Single page →
Topic 1 · Question 328

A company is hosting a three-tier ecommerce application in the AWS Cloud. The company hosts the website on Amazon S3 and integrates the website with an API that handles sales requests. The company hosts the API on three Amazon EC2 instances behind an Application Load Balancer (ALB). The API consists of static and dynamic front-end content along with backend workers that process sales requests asynchronously. The company is expecting a significant and sudden increase in the number of sales requests during events for the launch of new products. What should a solutions architect recommend to ensure that all the requests are processed successfully?

  • AAdd an Amazon CloudFront distribution for the dynamic content. Increase the number of EC2 instances to handle the increase in traffic.
  • BAdd an Amazon CloudFront distribution for the static content. Place the EC2 instances in an Auto Scaling group to launch new instances based on network traffic.
  • CAdd an Amazon CloudFront distribution for the dynamic content. Add an Amazon ElastiCache instance in front of the ALB to reduce traffic for the API to handle.
  • DAdd an Amazon CloudFront distribution for the static content. Add an Amazon Simple Queue Service (Amazon SQS) queue to receive requests from the website for later processing by the EC2 instances. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Add an Amazon CloudFront distribution for the static content. Add an Amazon Simple Queue Service (Amazon SQS) queue to receive requests from the website for later processing by the EC2 instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon EBS provides block storage attached to a single EC2 instance. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. This option decouples the components so they scale independently and absorb load spikes.

SAA-C03 Question 329

Single page →
Topic 1 · Question 329

A security audit reveals that Amazon EC2 instances are not being patched regularly. A solutions architect needs to provide a solution that will run regular security scans across a large fleet of EC2 instances. The solution should also patch the EC2 instances on a regular schedule and provide a report of each instance’s patch status. Which solution will meet these requirements?

  • ASet up Amazon Macie to scan the EC2 instances for software vulnerabilities. Set up a cron job on each EC2 instance to patch the instance on a regular schedule.
  • BTurn on Amazon GuardDuty in the account. Configure GuardDuty to scan the EC2 instances for software vulnerabilities. Set up AWS Systems Manager Session Manager to patch the EC2 instances on a regular schedule.
  • CSet up Amazon Detective to scan the EC2 instances for software vulnerabilities. Set up an Amazon EventBridge scheduled rule to patch the EC2 instances on a regular schedule.
  • DTurn on Amazon Inspector in the account. Configure Amazon Inspector to scan the EC2 instances for software vulnerabilities. Set up AWS Systems Manager Patch Manager to patch the EC2 instances on a regular schedule. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Turn on Amazon Inspector in the account. Configure Amazon Inspector to scan the EC2 instances for software vulnerabilities. Set up AWS Systems Manager Patch Manager to patch the EC2 instances on a regular schedule.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon Inspector automatically scans workloads for software vulnerabilities. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 330

Single page →
Topic 1 · Question 330

A company is planning to store data on Amazon RDS DB instances. The company must encrypt the data at rest. What should a solutions architect do to meet this requirement?

  • ACreate a key in AWS Key Management Service (AWS KMS). Enable encryption for the DB instances. (correct answer)
  • BCreate an encryption key. Store the key in AWS Secrets Manager. Use the key to encrypt the DB instances.
  • CGenerate a certificate in AWS Certificate Manager (ACM). Enable SSL/TLS on the DB instances by using the certificate.
  • DGenerate a certificate in AWS Identity and Access Management (IAM). Enable SSL/TLS on the DB instances by using the certificate.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a key in AWS Key Management Service (AWS KMS). Enable encryption for the DB instances.

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SAA-C03 Question 331

Single page →
Topic 1 · Question 331

A company must migrate 20 TB of data from a data center to the AWS Cloud within 30 days. The company’s network bandwidth is limited to 15 Mbps and cannot exceed 70% utilization. What should a solutions architect do to meet these requirements?

  • AUse AWS Snowball. (correct answer)
  • BUse AWS DataSync.
  • CUse a secure VPN connection.
  • DUse Amazon S3 Transfer Acceleration.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use AWS Snowball.

Explanation

AWS Snowball physically ships data to AWS, ideal when bandwidth is limited or data is very large.

SAA-C03 Question 332

Single page →
Topic 1 · Question 332

A company needs to provide its employees with secure access to confidential and sensitive files. The company wants to ensure that the files can be accessed only by authorized users. The files must be downloaded securely to the employees’ devices. The files are stored in an on-premises Windows file server. However, due to an increase in remote usage, the file server is running out of capacity. . Which solution will meet these requirements?

  • AMigrate the file server to an Amazon EC2 instance in a public subnet. Configure the security group to limit inbound traffic to the employees’ IP addresses.
  • BMigrate the files to an Amazon FSx for Windows File Server file system. Integrate the Amazon FSx file system with the on-premises Active Directory. Configure AWS Client VPN. (correct answer)
  • CMigrate the files to Amazon S3, and create a private VPC endpoint. Create a signed URL to allow download.
  • DMigrate the files to Amazon S3, and create a public VPC endpoint. Allow employees to sign on with AWS IAM Identity Center (AWS Single Sign-On).
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Migrate the files to an Amazon FSx for Windows File Server file system. Integrate the Amazon FSx file system with the on-premises Active Directory. Configure AWS Client VPN.

Explanation

Amazon FSx for Windows File Server provides fully managed SMB/Windows shared file storage. Amazon FSx provides fully managed third-party file systems. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 333

Single page →
Topic 1 · Question 333

A company’s application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. On the first day of every month at midnight, the application becomes much slower when the month-end financial calculation batch runs. This causes the CPU utilization of the EC2 instances to immediately peak to 100%, which disrupts the application. What should a solutions architect recommend to ensure the application is able to handle the workload and avoid downtime?

  • AConfigure an Amazon CloudFront distribution in front of the ALB.
  • BConfigure an EC2 Auto Scaling simple scaling policy based on CPU utilization.
  • CConfigure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule. (correct answer)
  • DConfigure Amazon ElastiCache to remove some of the workload from the EC2 instances.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Config tracks resource configuration changes and evaluates compliance. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SAA-C03 Question 334

Single page →
Topic 1 · Question 334

A company wants to give a customer the ability to use on-premises Microsoft Active Directory to download files that are stored in Amazon S3. The customer’s application uses an SFTP client to download the files. Which solution will meet these requirements with the LEAST operational overhead and no changes to the customer’s application?

  • ASet up AWS Transfer Family with SFTP for Amazon S3. Configure integrated Active Directory authentication. (correct answer)
  • BSet up AWS Database Migration Service (AWS DMS) to synchronize the on-premises client with Amazon S3. Configure integrated Active Directory authentication.
  • CSet up AWS DataSync to synchronize between the on-premises location and the S3 location by using AWS IAM Identity Center (AWS Single Sign-On).
  • DSet up a Windows Amazon EC2 instance with SFTP to connect the on-premises client with Amazon S3. Integrate AWS Identity and Access Management (IAM).
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Set up AWS Transfer Family with SFTP for Amazon S3. Configure integrated Active Directory authentication.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance. AWS Transfer Family provides managed SFTP/FTPS/FTP access to S3 and EFS.

SAA-C03 Question 335

Single page →
Topic 1 · Question 335

A company is experiencing sudden increases in demand. The company needs to provision large Amazon EC2 instances from an Amazon Machine Image (AMI). The instances will run in an Auto Scaling group. The company needs a solution that provides minimum initialization latency to meet the demand. Which solution meets these requirements?

  • AUse the aws ec2 register-image command to create an AMI from a snapshot. Use AWS Step Functions to replace the AMI in the Auto Scaling group.
  • BEnable Amazon Elastic Block Store (Amazon EBS) fast snapshot restore on a snapshot. Provision an AMI by using the snapshot. Replace the AMI in the Auto Scaling group with the new AMI. (correct answer)
  • CEnable AMI creation and define lifecycle rules in Amazon Data Lifecycle Manager (Amazon DLM). Create an AWS Lambda function that modifies the AMI in the Auto Scaling group.
  • DUse Amazon EventBridge to invoke AWS Backup lifecycle policies that provision AMIs. Configure Auto Scaling group capacity limits as an event source in EventBridge.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable Amazon Elastic Block Store (Amazon EBS) fast snapshot restore on a snapshot. Provision an AMI by using the snapshot. Replace the AMI in the Auto Scaling group with the new AMI.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EBS provides block storage attached to a single EC2 instance.

SAA-C03 Question 336

Single page →
Topic 1 · Question 336

A company hosts a multi-tier web application that uses an Amazon Aurora MySQL DB cluster for storage. The application tier is hosted on Amazon EC2 instances. The company’s IT security guidelines mandate that the database credentials be encrypted and rotated every 14 days. What should a solutions architect do to meet this requirement with the LEAST operational effort?

  • ACreate a new AWS Key Management Service (AWS KMS) encryption key. Use AWS Secrets Manager to create a new secret that uses the KMS key with the appropriate credentials. Associate the secret with the Aurora DB cluster. Configure a custom rotation period of 14 days. (correct answer)
  • BCreate two parameters in AWS Systems Manager Parameter Store: one for the user name as a string parameter and one that uses the SecureString type for the password. Select AWS Key Management Service (AWS KMS) encryption for the password parameter, and load these parameters in the application tier. Implement an AWS Lambda function that rotates the password every 14 days.
  • CStore a file that contains the credentials in an AWS Key Management Service (AWS KMS) encrypted Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system in all EC2 instances of the application tier. Restrict the access to the file on the file system so that the application can read the file and that only super users can modify the file. Implement an AWS Lambda function that rotates the key in Aurora every 14 days and writes new credentials into the file.
  • DStore a file that contains the credentials in an AWS Key Management Service (AWS KMS) encrypted Amazon S3 bucket that the application uses to load the credentials. Download the file to the application regularly to ensure that the correct credentials are used. Implement an AWS Lambda function that rotates the Aurora credentials every 14 days and uploads these credentials to the file in the S3 bucket.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a new AWS Key Management Service (AWS KMS) encryption key. Use AWS Secrets Manager to create a new secret that uses the KMS key with the appropriate credentials. Associate the secret with the Aurora DB cluster....

Explanation

Amazon Aurora is a high-performance managed relational database with built-in replication and failover. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest. AWS Secrets Manager stores and automatically rotates secrets such as database credentials.

SAA-C03 Question 337

Single page →
Topic 1 · Question 337

A company has deployed a web application on AWS. The company hosts the backend database on Amazon RDS for MySQL with a primary DB instance and five read replicas to support scaling needs. The read replicas must lag no more than 1 second behind the primary DB instance. The database routinely runs scheduled stored procedures. As traffic on the website increases, the replicas experience additional lag during periods of peak load. A solutions architect must reduce the replication lag as much as possible. The solutions architect must minimize changes to the application code and must minimize ongoing operational overhead. Which solution will meet these requirements?

  • AMigrate the database to Amazon Aurora MySQL. Replace the read replicas with Aurora Replicas, and configure Aurora Auto Scaling. Replace the stored procedures with Aurora MySQL native functions. (correct answer)
  • BDeploy an Amazon ElastiCache for Redis cluster in front of the database. Modify the application to check the cache before the application queries the database. Replace the stored procedures with AWS Lambda functions.
  • CMigrate the database to a MySQL database that runs on Amazon EC2 instances. Choose large, compute optimized EC2 instances for all replica nodes. Maintain the stored procedures on the EC2 instances.
  • DMigrate the database to Amazon DynamoDB. Provision a large number of read capacity units (RCUs) to support the required throughput, and configure on-demand capacity scaling. Replace the stored procedures with DynamoDB streams.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Migrate the database to Amazon Aurora MySQL. Replace the read replicas with Aurora Replicas, and configure Aurora Auto Scaling. Replace the stored procedures with Aurora MySQL native functions.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon Aurora is a high-performance managed relational database with built-in replication and failover. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 338

Single page →
Topic 1 · Question 338

A solutions architect must create a disaster recovery (DR) plan for a high-volume software as a service (SaaS) platform. All data for the platform is stored in an Amazon Aurora MySQL DB cluster. The DR plan must replicate data to a secondary AWS Region. Which solution will meet these requirements MOST cost-effectively?

  • AUse MySQL binary log replication to an Aurora cluster in the secondary Region. Provision one DB instance for the Aurora cluster in the secondary Region.
  • BSet up an Aurora global database for the DB cluster. When setup is complete, remove the DB instance from the secondary Region. (correct answer)
  • CUse AWS Database Migration Service (AWS DMS) to continuously replicate data to an Aurora cluster in the secondary Region. Remove the DB instance from the secondary Region.
  • DSet up an Aurora global database for the DB cluster. Specify a minimum of one DB instance in the secondary Region.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Set up an Aurora global database for the DB cluster. When setup is complete, remove the DB instance from the secondary Region.

Explanation

Amazon Aurora is a high-performance managed relational database with built-in replication and failover. This option delivers the requirement at the lowest cost.

SAA-C03 Question 339

Single page →
Topic 1 · Question 339

A company has a custom application with embedded credentials that retrieves information from an Amazon RDS MySQL DB instance. Management says the application must be made more secure with the least amount of programming effort. What should a solutions architect do to meet these requirements?

  • AUse AWS Key Management Service (AWS KMS) to create keys. Configure the application to load the database credentials from AWS KMS. Enable automatic key rotation.
  • BCreate credentials on the RDS for MySQL database for the application user and store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Create an AWS Lambda function that rotates the credentials in Secret Manager.
  • CCreate credentials on the RDS for MySQL database for the application user and store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule for the application user in the RDS for MySQL database using Secrets Manager. (correct answer)
  • DCreate credentials on the RDS for MySQL database for the application user and store the credentials in AWS Systems Manager Parameter Store. Configure the application to load the database credentials from Parameter Store. Set up a credentials rotation schedule for the application user in the RDS for MySQL database using Parameter Store.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create credentials on the RDS for MySQL database for the application user and store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a cre...

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. AWS Secrets Manager stores and automatically rotates secrets such as database credentials. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 340

Single page →
Topic 1 · Question 340

A media company hosts its website on AWS. The website application’s architecture includes a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB) and a database that is hosted on Amazon Aurora. The company’s cybersecurity team reports that the application is vulnerable to SQL injection. How should the company resolve this issue?

  • AUse AWS WAF in front of the ALB. Associate the appropriate web ACLs with AWS WAF. (correct answer)
  • BCreate an ALB listener rule to reply to SQL injections with a fixed response.
  • CSubscribe to AWS Shield Advanced to block all SQL injection attempts automatically.
  • DSet up Amazon Inspector to block all SQL injection attempts automatically.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use AWS WAF in front of the ALB. Associate the appropriate web ACLs with AWS WAF.

Explanation

AWS WAF protects web applications from common exploits and malicious requests.

Showing questions 321–340 of 1019 · Page 17 of 51