πŸ”

SAA-C03 β€” questions

Page 20 of 51 Β· 1019 total questions.

Topic 1 Β· Question 381

A company hosts a three-tier web application that includes a PostgreSQL database. The database stores the metadata from documents. The company searches the metadata for key terms to retrieve documents that the company reviews in a report each month. The documents are stored in Amazon S3. The documents are usually written only once, but they are updated frequently. The reporting process takes a few hours with the use of relational queries. The reporting process must not prevent any document modifications or the addition of new documents. A solutions architect needs to implement a solution to speed up the reporting process. Which solution will meet these requirements with the LEAST amount of change to the application code?

  • ASet up a new Amazon DocumentDB (with MongoDB compatibility) cluster that includes a read replica. Scale the read replica to generate the reports.
  • BSet up a new Amazon Aurora PostgreSQL DB cluster that includes an Aurora Replica. Issue queries to the Aurora Replica to generate the reports. (correct answer)
  • CSet up a new Amazon RDS for PostgreSQL Multi-AZ DB instance. Configure the reporting module to query the secondary RDS node so that the reporting module does not affect the primary node.
  • DSet up a new Amazon DynamoDB table to store the documents. Use a fixed write capacity to support new document entries. Automatically scale the read capacity to support the reports.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Set up a new Amazon Aurora PostgreSQL DB cluster that includes an Aurora Replica. Issue queries to the Aurora Replica to generate the reports.

Explanation

Amazon Aurora is a high-performance managed relational database with built-in replication and failover.

Topic 1 Β· Question 382

A company has a three-tier application on AWS that ingests sensor data from its users’ devices. The traffic flows through a Network Load Balancer (NLB), then to Amazon EC2 instances for the web tier, and finally to EC2 instances for the application tier. The application tier makes calls to a database. What should a solutions architect do to improve the security of the data in transit?

  • AConfigure a TLS listener. Deploy the server certificate on the NLB. (correct answer)
  • BConfigure AWS Shield Advanced. Enable AWS WAF on the NLB.
  • CChange the load balancer to an Application Load Balancer (ALB). Enable AWS WAF on the ALB.
  • DEncrypt the Amazon Elastic Block Store (Amazon EBS) volume on the EC2 instances by using AWS Key Management Service (AWS KMS).
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure a TLS listener. Deploy the server certificate on the NLB.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 Β· Question 383

A company is planning to migrate a commercial off-the-shelf application from its on-premises data center to AWS. The software has a software licensing model using sockets and cores with predictable capacity and uptime requirements. The company wants to use its existing licenses, which were purchased earlier this year. Which Amazon EC2 pricing option is the MOST cost-effective?

  • ADedicated Reserved Hosts (correct answer)
  • BDedicated On-Demand Hosts
  • CDedicated Reserved Instances
  • DDedicated On-Demand Instances
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Dedicated Reserved Hosts This option delivers the requirement at the lowest cost.

Topic 1 Β· Question 384

A company runs an application on Amazon EC2 Linux instances across multiple Availability Zones. The application needs a storage layer that is highly available and Portable Operating System Interface (POSIX)-compliant. The storage layer must provide maximum data durability and must be shareable across the EC2 instances. The data in the storage layer will be accessed frequently for the first 30 days and will be accessed infrequently after that time. Which solution will meet these requirements MOST cost-effectively?

  • AUse the Amazon S3 Standard storage class. Create an S3 Lifecycle policy to move infrequently accessed data to S3 Glacier.
  • BUse the Amazon S3 Standard storage class. Create an S3 Lifecycle policy to move infrequently accessed data to S3 Standard-Infrequent Access (S3 Standard-IA).
  • CUse the Amazon Elastic File System (Amazon EFS) Standard storage class. Create a lifecycle management policy to move infrequently accessed data to EFS Standard-Infrequent Access (EFS Standard-IA). (correct answer)
  • DUse the Amazon Elastic File System (Amazon EFS) One Zone storage class. Create a lifecycle management policy to move infrequently accessed data to EFS One Zone-Infrequent Access (EFS One Zone-IA).
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use the Amazon Elastic File System (Amazon EFS) Standard storage class. Create a lifecycle management policy to move infrequently accessed data to EFS Standard-Infrequent Access (EFS Standard-IA).

Explanation

Amazon EFS is a shared, elastic NFS file system that multiple instances can mount concurrently across AZs. This option delivers the requirement at the lowest cost.

Topic 1 Β· Question 385

A solutions architect is creating a new VPC design. There are two public subnets for the load balancer, two private subnets for web servers, and two private subnets for MySQL. The web servers use only HTTPS. The solutions architect has already created a security group for the load balancer allowing port 443 from 0.0.0.0/0. Company policy requires that each resource has the least access required to still be able to perform its tasks. Which additional configuration strategy should the solutions architect use to meet these requirements?

  • ACreate a security group for the web servers and allow port 443 from 0.0.0.0/0. Create a security group for the MySQL servers and allow port 3306 from the web servers security group.
  • BCreate a network ACL for the web servers and allow port 443 from 0.0.0.0/0. Create a network ACL for the MySQL servers and allow port 3306 from the web servers security group.
  • CCreate a security group for the web servers and allow port 443 from the load balancer. Create a security group for the MySQL servers and allow port 3306 from the web servers security group. (correct answer)
  • DCreate a network ACL for the web servers and allow port 443 from the load balancer. Create a network ACL for the MySQL servers and allow port 3306 from the web servers security group.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a security group for the web servers and allow port 443 from the load balancer. Create a security group for the MySQL servers and allow port 3306 from the web servers security group.

Explanation

A load balancer distributes traffic across targets in multiple AZs for availability and scale.

Topic 1 Β· Question 386

An ecommerce company is running a multi-tier application on AWS. The front-end and backend tiers both run on Amazon EC2, and the database runs on Amazon RDS for MySQL. The backend tier communicates with the RDS instance. There are frequent calls to return identical datasets from the database that are causing performance slowdowns. Which action should be taken to improve the performance of the backend?

  • AImplement Amazon SNS to store the database calls.
  • BImplement Amazon ElastiCache to cache the large datasets. (correct answer)
  • CImplement an RDS for MySQL read replica to cache database calls.
  • DImplement Amazon Kinesis Data Firehose to stream the calls to the database.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Implement Amazon ElastiCache to cache the large datasets.

Explanation

Amazon ElastiCache provides in-memory caching (Redis/Memcached) to reduce latency and offload the database.

Topic 1 Β· Question 387 Β· Select all that apply

A new employee has joined a company as a deployment engineer. The deployment engineer will be using AWS CloudFormation templates to create multiple AWS resources. A solutions architect wants the deployment engineer to perform job activities while following the principle of least privilege. Which combination of actions should the solutions architect take to accomplish this goal? (Choose two.)

  • AHave the deployment engineer use AWS account root user credentials for performing AWS CloudFormation stack operations.
  • BCreate a new IAM user for the deployment engineer and add the IAM user to a group that has the PowerUsers IAM policy attached.
  • CCreate a new IAM user for the deployment engineer and add the IAM user to a group that has the AdministratorAccess IAM policy attached.
  • DCreate a new IAM user for the deployment engineer and add the IAM user to a group that has an IAM policy that allows AWS CloudFormation actions only. (correct answer)
  • ECreate an IAM role for the deployment engineer to explicitly define the permissions specific to the AWS CloudFormation stack and launch stacks using that IAM role. (correct answer)
Reveal answer & explanation
Correct answer: D, E

The correct answer is D, E. Option D: Create a new IAM user for the deployment engineer and add the IAM user to a group that has an IAM policy that allows AWS CloudFormation actions only. Option E: Create an IAM role for the deployment engineer to explicitly define the permissions specific to the AWS CloudFormation stack and launch stacks using that IAM role.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS CloudFormation provisions infrastructure as code repeatably.

Topic 1 Β· Question 388

A company is deploying a two-tier web application in a VPC. The web tier is using an Amazon EC2 Auto Scaling group with public subnets that span multiple Availability Zones. The database tier consists of an Amazon RDS for MySQL DB instance in separate private subnets. The web tier requires access to the database to retrieve product information. The web application is not working as intended. The web application reports that it cannot connect to the database. The database is confirmed to be up and running. All configurations for the network ACLs, security groups, and route tables are still in their default states. What should a solutions architect recommend to fix the application?

  • AAdd an explicit rule to the private subnet’s network ACL to allow traffic from the web tier’s EC2 instances.
  • BAdd a route in the VPC route table to allow traffic between the web tier’s EC2 instances and the database tier.
  • CDeploy the web tier's EC2 instances and the database tier’s RDS instance into two separate VPCs, and configure VPC peering.
  • DAdd an inbound rule to the security group of the database tier’s RDS instance to allow traffic from the web tiers security group. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Add an inbound rule to the security group of the database tier’s RDS instance to allow traffic from the web tiers security group.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Topic 1 Β· Question 389

A company has a large dataset for its online advertising business stored in an Amazon RDS for MySQL DB instance in a single Availability Zone. The company wants business reporting queries to run without impacting the write operations to the production DB instance. Which solution meets these requirements?

  • ADeploy RDS read replicas to process the business reporting queries. (correct answer)
  • BScale out the DB instance horizontally by placing it behind an Elastic Load Balancer.
  • CScale up the DB instance to a larger instance type to handle write operations and queries.
  • DDeploy the DB instance in multiple Availability Zones to process the business reporting queries.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deploy RDS read replicas to process the business reporting queries.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover.

Topic 1 Β· Question 390 Β· Select all that apply

A company hosts a three-tier ecommerce application on a fleet of Amazon EC2 instances. The instances run in an Auto Scaling group behind an Application Load Balancer (ALB). All ecommerce data is stored in an Amazon RDS for MariaDB Multi-AZ DB instance. The company wants to optimize customer session management during transactions. The application must store session data durably. Which solutions will meet these requirements? (Choose two.)

  • ATurn on the sticky sessions feature (session affinity) on the ALB. (correct answer)
  • BUse an Amazon DynamoDB table to store customer session information.
  • CDeploy an Amazon Cognito user pool to manage user session information.
  • DDeploy an Amazon ElastiCache for Redis cluster to store customer session information. (correct answer)
  • EUse AWS Systems Manager Application Manager in the application to manage user session information.
Reveal answer & explanation
Correct answer: A, D

The correct answer is A, D. Option A: Turn on the sticky sessions feature (session affinity) on the ALB. Option D: Deploy an Amazon ElastiCache for Redis cluster to store customer session information.

Explanation

Amazon ElastiCache provides in-memory caching (Redis/Memcached) to reduce latency and offload the database. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Topic 1 Β· Question 391

A company needs a backup strategy for its three-tier stateless web application. The web application runs on Amazon EC2 instances in an Auto Scaling group with a dynamic scaling policy that is configured to respond to scaling events. The database tier runs on Amazon RDS for PostgreSQL. The web application does not require temporary local storage on the EC2 instances. The company’s recovery point objective (RPO) is 2 hours. The backup strategy must maximize scalability and optimize resource utilization for this environment. Which solution will meet these requirements?

  • ATake snapshots of Amazon Elastic Block Store (Amazon EBS) volumes of the EC2 instances and database every 2 hours to meet the RPO.
  • BConfigure a snapshot lifecycle policy to take Amazon Elastic Block Store (Amazon EBS) snapshots. Enable automated backups in Amazon RDS to meet the RPO.
  • CRetain the latest Amazon Machine Images (AMIs) of the web and application tiers. Enable automated backups in Amazon RDS and use point-in-time recovery to meet the RPO. (correct answer)
  • DTake snapshots of Amazon Elastic Block Store (Amazon EBS) volumes of the EC2 instances every 2 hours. Enable automated backups in Amazon RDS and use point-in-time recovery to meet the RPO.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Retain the latest Amazon Machine Images (AMIs) of the web and application tiers. Enable automated backups in Amazon RDS and use point-in-time recovery to meet the RPO.

Explanation

AWS Backup centrally automates and manages backups across AWS services. Amazon RDS is a managed relational database that handles patching, backups and failover.

Topic 1 Β· Question 392

A company wants to deploy a new public web application on AWS. The application includes a web server tier that uses Amazon EC2 instances. The application also includes a database tier that uses an Amazon RDS for MySQL DB instance. The application must be secure and accessible for global customers that have dynamic IP addresses. How should a solutions architect configure the security groups to meet these requirements?

  • AConfigure the security group for the web servers to allow inbound traffic on port 443 from 0.0.0.0/0. Configure the security group for the DB instance to allow inbound traffic on port 3306 from the security group of the web servers. (correct answer)
  • BConfigure the security group for the web servers to allow inbound traffic on port 443 from the IP addresses of the customers. Configure the security group for the DB instance to allow inbound traffic on port 3306 from the security group of the web servers.
  • CConfigure the security group for the web servers to allow inbound traffic on port 443 from the IP addresses of the customers. Configure the security group for the DB instance to allow inbound traffic on port 3306 from the IP addresses of the customers.
  • DConfigure the security group for the web servers to allow inbound traffic on port 443 from 0.0.0.0/0. Configure the security group for the DB instance to allow inbound traffic on port 3306 from 0.0.0.0/0.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure the security group for the web servers to allow inbound traffic on port 443 from 0.0.0.0/0. Configure the security group for the DB instance to allow inbound traffic on port 3306 from the security group of t...

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 Β· Question 393

A payment processing company records all voice communication with its customers and stores the audio files in an Amazon S3 bucket. The company needs to capture the text from the audio files. The company must remove from the text any personally identifiable information (PII) that belongs to customers. What should a solutions architect do to meet these requirements?

  • AProcess the audio files by using Amazon Kinesis Video Streams. Use an AWS Lambda function to scan for known PII patterns.
  • BWhen an audio file is uploaded to the S3 bucket, invoke an AWS Lambda function to start an Amazon Textract task to analyze the call recordings.
  • CConfigure an Amazon Transcribe transcription job with PII redaction turned on. When an audio file is uploaded to the S3 bucket, invoke an AWS Lambda function to start the transcription job. Store the output in a separate S3 bucket. (correct answer)
  • DCreate an Amazon Connect contact flow that ingests the audio files with transcription turned on. Embed an AWS Lambda function to scan for known PII patterns. Use Amazon EventBridge to start the contact flow when an audio file is uploaded to the S3 bucket.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure an Amazon Transcribe transcription job with PII redaction turned on. When an audio file is uploaded to the S3 bucket, invoke an AWS Lambda function to start the transcription job. Store the output in a separ...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Transcribe converts speech to text.

Topic 1 Β· Question 394

A company is running a multi-tier ecommerce web application in the AWS Cloud. The application runs on Amazon EC2 instances with an Amazon RDS for MySQL Multi-AZ DB instance. Amazon RDS is configured with the latest generation DB instance with 2,000 GB of storage in a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume. The database performance affects the application during periods of high demand. A database administrator analyzes the logs in Amazon CloudWatch Logs and discovers that the application performance always degrades when the number of read and write IOPS is higher than 20,000. What should a solutions architect do to improve the application performance?

  • AReplace the volume with a magnetic volume.
  • BIncrease the number of IOPS on the gp3 volume.
  • CReplace the volume with a Provisioned IOPS SSD (io2) volume. (correct answer)
  • DReplace the 2,000 GB gp3 volume with two 1,000 GB gp3 volumes.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Replace the volume with a Provisioned IOPS SSD (io2) volume. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Topic 1 Β· Question 395

An IAM user made several configuration changes to AWS resources in their company's account during a production deployment last week. A solutions architect learned that a couple of security group rules are not configured as desired. The solutions architect wants to confirm which IAM user was responsible for making changes. Which service should the solutions architect use to find the desired information?

  • AAmazon GuardDuty
  • BAmazon Inspector
  • CAWS CloudTrail (correct answer)
  • DAWS Config
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: AWS CloudTrail

Explanation

AWS CloudTrail records API activity for auditing and governance.

Topic 1 Β· Question 396

A company has implemented a self-managed DNS service on AWS. The solution consists of the following: β€’ Amazon EC2 instances in different AWS Regions β€’ Endpoints of a standard accelerator in AWS Global Accelerator The company wants to protect the solution against DDoS attacks. What should a solutions architect do to meet this requirement?

  • ASubscribe to AWS Shield Advanced. Add the accelerator as a resource to protect. (correct answer)
  • BSubscribe to AWS Shield Advanced. Add the EC2 instances as resources to protect.
  • CCreate an AWS WAF web ACL that includes a rate-based rule. Associate the web ACL with the accelerator.
  • DCreate an AWS WAF web ACL that includes a rate-based rule. Associate the web ACL with the EC2 instances.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Subscribe to AWS Shield Advanced. Add the accelerator as a resource to protect.

Explanation

AWS Shield provides managed DDoS protection.

Topic 1 Β· Question 397

An ecommerce company needs to run a scheduled daily job to aggregate and filter sales records for analytics. The company stores the sales records in an Amazon S3 bucket. Each object can be up to 10 GB in size. Based on the number of sales events, the job can take up to an hour to complete. The CPU and memory usage of the job are constant and are known in advance. A solutions architect needs to minimize the amount of operational effort that is needed for the job to run. Which solution meets these requirements?

  • ACreate an AWS Lambda function that has an Amazon EventBridge notification. Schedule the EventBridge event to run once a day.
  • BCreate an AWS Lambda function. Create an Amazon API Gateway HTTP API, and integrate the API with the function. Create an Amazon EventBridge scheduled event that calls the API and invokes the function.
  • CCreate an Amazon Elastic Container Service (Amazon ECS) cluster with an AWS Fargate launch type. Create an Amazon EventBridge scheduled event that launches an ECS task on the cluster to run the job. (correct answer)
  • DCreate an Amazon Elastic Container Service (Amazon ECS) cluster with an Amazon EC2 launch type and an Auto Scaling group with at least one EC2 instance. Create an Amazon EventBridge scheduled event that launches an ECS task on the cluster to run the job.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an Amazon Elastic Container Service (Amazon ECS) cluster with an AWS Fargate launch type. Create an Amazon EventBridge scheduled event that launches an ECS task on the cluster to run the job.

Explanation

AWS Fargate runs containers serverlessly so there are no EC2 hosts to manage or patch. Amazon ECS orchestrates containers and integrates natively with AWS networking and IAM. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

Topic 1 Β· Question 398

A company needs to transfer 600 TB of data from its on-premises network-attached storage (NAS) system to the AWS Cloud. The data transfer must be complete within 2 weeks. The data is sensitive and must be encrypted in transit. The company’s internet connection can support an upload speed of 100 Mbps. Which solution meets these requirements MOST cost-effectively?

  • AUse Amazon S3 multi-part upload functionality to transfer the files over HTTPS.
  • BCreate a VPN connection between the on-premises NAS system and the nearest AWS Region. Transfer the data over the VPN connection.
  • CUse the AWS Snow Family console to order several AWS Snowball Edge Storage Optimized devices. Use the devices to transfer the data to Amazon S3. (correct answer)
  • DSet up a 10 Gbps AWS Direct Connect connection between the company location and the nearest AWS Region. Transfer the data over a VPN connection into the Region to store the data in Amazon S3.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use the AWS Snow Family console to order several AWS Snowball Edge Storage Optimized devices. Use the devices to transfer the data to Amazon S3.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Snowball physically ships data to AWS, ideal when bandwidth is limited or data is very large. This option delivers the requirement at the lowest cost.

Topic 1 Β· Question 399

A financial company hosts a web application on AWS. The application uses an Amazon API Gateway Regional API endpoint to give users the ability to retrieve current stock prices. The company’s security team has noticed an increase in the number of API requests. The security team is concerned that HTTP flood attacks might take the application offline. A solutions architect must design a solution to protect the application from this type of attack. Which solution meets these requirements with the LEAST operational overhead?

  • ACreate an Amazon CloudFront distribution in front of the API Gateway Regional API endpoint with a maximum TTL of 24 hours.
  • BCreate a Regional AWS WAF web ACL with a rate-based rule. Associate the web ACL with the API Gateway stage. (correct answer)
  • CUse Amazon CloudWatch metrics to monitor the Count metric and alert the security team when the predefined rate is reached.
  • DCreate an Amazon CloudFront distribution with Lambda@Edge in front of the API Gateway Regional API endpoint. Create an AWS Lambda function to block requests from IP addresses that exceed the predefined rate.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a Regional AWS WAF web ACL with a rate-based rule. Associate the web ACL with the API Gateway stage.

Explanation

Amazon API Gateway is a fully managed front door for creating and securing APIs at scale. AWS WAF protects web applications from common exploits and malicious requests.

Topic 1 Β· Question 400

A meteorological startup company has a custom web application to sell weather data to its users online. The company uses Amazon DynamoDB to store its data and wants to build a new service that sends an alert to the managers of four internal teams every time a new weather event is recorded. The company does not want this new service to affect the performance of the current application. What should a solutions architect do to meet these requirements with the LEAST amount of operational overhead?

  • AUse DynamoDB transactions to write new event data to the table. Configure the transactions to notify internal teams.
  • BHave the current application publish a message to four Amazon Simple Notification Service (Amazon SNS) topics. Have each team subscribe to one topic.
  • CEnable Amazon DynamoDB Streams on the table. Use triggers to write to a single Amazon Simple Notification Service (Amazon SNS) topic to which the teams can subscribe. (correct answer)
  • DAdd a custom attribute to each record to flag new items. Write a cron job that scans the table every minute for items that are new and notifies an Amazon Simple Queue Service (Amazon SQS) queue to which the teams can subscribe.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enable Amazon DynamoDB Streams on the table. Use triggers to write to a single Amazon Simple Notification Service (Amazon SNS) topic to which the teams can subscribe.

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers.

Showing questions 381–400 of 1019 Β· Page 20 of 51