🔍

SAA-C03 — questions

Page 28 of 51 · 1019 total questions.

SAA-C03 Question 541

Single page →
Topic 1 · Question 541 · Select all that apply

A company wants to build a web application on AWS. Client access requests to the website are not predictable and can be idle for a long time. Only customers who have paid a subscription fee can have the ability to sign in and use the web application. Which combination of steps will meet these requirements MOST cost-effectively? (Choose three.)

  • ACreate an AWS Lambda function to retrieve user information from Amazon DynamoDB. Create an Amazon API Gateway endpoint to accept RESTful APIs. Send the API calls to the Lambda function. (correct answer)
  • BCreate an Amazon Elastic Container Service (Amazon ECS) service behind an Application Load Balancer to retrieve user information from Amazon RDS. Create an Amazon API Gateway endpoint to accept RESTful APIs. Send the API calls to the Lambda function.
  • CCreate an Amazon Cognito user pool to authenticate users. (correct answer)
  • DCreate an Amazon Cognito identity pool to authenticate users.
  • EUse AWS Amplify to serve the frontend web content with HTML, CSS, and JS. Use an integrated Amazon CloudFront configuration. (correct answer)
  • FUse Amazon S3 static web hosting with PHP, CSS, and JS. Use Amazon CloudFront to serve the frontend web content.
Reveal answer & explanation
Correct answer: A, C, E

The correct answer is A, C, E. Option A: Create an AWS Lambda function to retrieve user information from Amazon DynamoDB. Create an Amazon API Gateway endpoint to accept RESTful APIs. Send the API calls to the Lambda function. Option C: Create an Amazon Cognito user pool to authenticate users. Option E: Use AWS Amplify to serve the frontend web content with HTML, CSS, and JS. Use an integrated Amazon CloudFront configuration.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. This option delivers the requirement at the lowest cost.

SAA-C03 Question 542

Single page →
Topic 1 · Question 542

A media company uses an Amazon CloudFront distribution to deliver content over the internet. The company wants only premium customers to have access to the media streams and file content. The company stores all content in an Amazon S3 bucket. The company also delivers content on demand to customers for a specific purpose, such as movie rentals or music downloads. Which solution will meet these requirements?

  • AGenerate and provide S3 signed cookies to premium customers.
  • BGenerate and provide CloudFront signed URLs to premium customers. (correct answer)
  • CUse origin access control (OAC) to limit the access of non-premium customers.
  • DGenerate and activate field-level encryption to block non-premium customers.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Generate and provide CloudFront signed URLs to premium customers.

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SAA-C03 Question 543

Single page →
Topic 1 · Question 543 · Select all that apply

A company runs Amazon EC2 instances in multiple AWS accounts that are individually bled. The company recently purchased a Savings Pian. Because of changes in the company’s business requirements, the company has decommissioned a large number of EC2 instances. The company wants to use its Savings Plan discounts on its other AWS accounts. Which combination of steps will meet these requirements? (Choose two.)

  • AFrom the AWS Account Management Console of the management account, turn on discount sharing from the billing preferences section. (correct answer)
  • BFrom the AWS Account Management Console of the account that purchased the existing Savings Plan, turn on discount sharing from the billing preferences section. Include all accounts.
  • CFrom the AWS Organizations management account, use AWS Resource Access Manager (AWS RAM) to share the Savings Plan with other accounts.
  • DCreate an organization in AWS Organizations in a new payer account. Invite the other AWS accounts to join the organization from the management account. (correct answer)
  • ECreate an organization in AWS Organizations in the existing AWS account with the existing EC2 instances and Savings Plan. Invite the other AWS accounts to join the organization from the management account.
Reveal answer & explanation
Correct answer: A, D

The correct answer is A, D. Option A: From the AWS Account Management Console of the management account, turn on discount sharing from the billing preferences section. Option D: Create an organization in AWS Organizations in a new payer account. Invite the other AWS accounts to join the organization from the management account.

Explanation

AWS Organizations centrally governs and secures multiple AWS accounts.

SAA-C03 Question 544

Single page →
Topic 1 · Question 544

A retail company uses a regional Amazon API Gateway API for its public REST APIs. The API Gateway endpoint is a custom domain name that points to an Amazon Route 53 alias record. A solutions architect needs to create a solution that has minimal effects on customers and minimal data loss to release the new version of APIs. Which solution will meet these requirements?

  • ACreate a canary release deployment stage for API Gateway. Deploy the latest API version. Point an appropriate percentage of traffic to the canary stage. After API verification, promote the canary stage to the production stage. (correct answer)
  • BCreate a new API Gateway endpoint with a new version of the API in OpenAPI YAML file format. Use the import-to-update operation in merge mode into the API in API Gateway. Deploy the new version of the API to the production stage.
  • CCreate a new API Gateway endpoint with a new version of the API in OpenAPI JSON file format. Use the import-to-update operation in overwrite mode into the API in API Gateway. Deploy the new version of the API to the production stage.
  • DCreate a new API Gateway endpoint with new versions of the API definitions. Create a custom domain name for the new API Gateway API. Point the Route 53 alias record to the new API Gateway API custom domain name.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a canary release deployment stage for API Gateway. Deploy the latest API version. Point an appropriate percentage of traffic to the canary stage. After API verification, promote the canary stage to the producti...

Explanation

Amazon API Gateway is a fully managed front door for creating and securing APIs at scale.

SAA-C03 Question 545

Single page →
Topic 1 · Question 545

A company wants to direct its users to a backup static error page if the company's primary website is unavailable. The primary website's DNS records are hosted in Amazon Route 53. The domain is pointing to an Application Load Balancer (ALB). The company needs a solution that minimizes changes and infrastructure overhead. Which solution will meet these requirements?

  • AUpdate the Route 53 records to use a latency routing policy. Add a static error page that is hosted in an Amazon S3 bucket to the records so that the traffic is sent to the most responsive endpoints.
  • BSet up a Route 53 active-passive failover configuration. Direct traffic to a static error page that is hosted in an Amazon S3 bucket when Route 53 health checks determine that the ALB endpoint is unhealthy. (correct answer)
  • CSet up a Route 53 active-active configuration with the ALB and an Amazon EC2 instance that hosts a static error page as endpoints. Configure Route 53 to send requests to the instance only if the health checks fail for the ALB.
  • DUpdate the Route 53 records to use a multivalue answer routing policy. Create a health check. Direct traffic to the website if the health check passes. Direct traffic to a static error page that is hosted in Amazon S3 if the health check does not pass.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Set up a Route 53 active-passive failover configuration. Direct traffic to a static error page that is hosted in an Amazon S3 bucket when Route 53 health checks determine that the ALB endpoint is unhealthy.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 546

Single page →
Topic 1 · Question 546

A recent analysis of a company's IT expenses highlights the need to reduce backup costs. The company's chief information officer wants to simplify the on-premises backup infrastructure and reduce costs by eliminating the use of physical backup tapes. The company must preserve the existing investment in the on-premises backup applications and workflows. What should a solutions architect recommend?

  • ASet up AWS Storage Gateway to connect with the backup applications using the NFS interface.
  • BSet up an Amazon EFS file system that connects with the backup applications using the NFS interface.
  • CSet up an Amazon EFS file system that connects with the backup applications using the iSCSI interface.
  • DSet up AWS Storage Gateway to connect with the backup applications using the iSCSI-virtual tape library (VTL) interface. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Set up AWS Storage Gateway to connect with the backup applications using the iSCSI-virtual tape library (VTL) interface.

Explanation

AWS Storage Gateway bridges on-premises apps to AWS storage with local caching. AWS Backup centrally automates and manages backups across AWS services. This option delivers the requirement at the lowest cost.

SAA-C03 Question 547

Single page →
Topic 1 · Question 547

A company has data collection sensors at different locations. The data collection sensors stream a high volume of data to the company. The company wants to design a platform on AWS to ingest and process high-volume streaming data. The solution must be scalable and support data collection in near real time. The company must store the data in Amazon S3 for future reporting. Which solution will meet these requirements with the LEAST operational overhead?

  • AUse Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3. (correct answer)
  • BUse AWS Glue to deliver streaming data to Amazon S3.
  • CUse AWS Lambda to deliver streaming data and store the data to Amazon S3.
  • DUse AWS Database Migration Service (AWS DMS) to deliver streaming data to Amazon S3.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Kinesis Data Firehose delivers streaming data to destinations like S3/Redshift with no servers to manage. Amazon Kinesis ingests and processes real-time streaming data at scale.

SAA-C03 Question 548

Single page →
Topic 1 · Question 548

A company has separate AWS accounts for its finance, data analytics, and development departments. Because of costs and security concerns, the company wants to control which services each AWS account can use. Which solution will meet these requirements with the LEAST operational overhead?

  • AUse AWS Systems Manager templates to control which AWS services each department can use.
  • BCreate organization units (OUs) for each department in AWS Organizations. Attach service control policies (SCPs) to the OUs. (correct answer)
  • CUse AWS CloudFormation to automatically provision only the AWS services that each department can use.
  • DSet up a list of products in AWS Service Catalog in the AWS accounts to manage and control the usage of specific AWS services.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create organization units (OUs) for each department in AWS Organizations. Attach service control policies (SCPs) to the OUs.

Explanation

AWS Organizations centrally governs and secures multiple AWS accounts. Service Control Policies set guardrails on what accounts in an organization can do.

SAA-C03 Question 549

Single page →
Topic 1 · Question 549

A company has created a multi-tier application for its ecommerce website. The website uses an Application Load Balancer that resides in the public subnets, a web tier in the public subnets, and a MySQL cluster hosted on Amazon EC2 instances in the private subnets. The MySQL database needs to retrieve product catalog and pricing information that is hosted on the internet by a third-party provider. A solutions architect must devise a strategy that maximizes security without increasing operational overhead. What should the solutions architect do to meet these requirements?

  • ADeploy a NAT instance in the VPC. Route all the internet-based traffic through the NAT instance.
  • BDeploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet-bound traffic to the NAT gateway. (correct answer)
  • CConfigure an internet gateway and attach it to the VPModify the private subnet route table to direct internet-bound traffic to the internet gateway.
  • DConfigure a virtual private gateway and attach it to the VPC. Modify the private subnet route table to direct internet-bound traffic to the virtual private gateway.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Deploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet-bound traffic to the NAT gateway.

Explanation

A NAT gateway lets private subnet resources reach the internet for outbound traffic only.

SAA-C03 Question 550

Single page →
Topic 1 · Question 550 · Select all that apply

A company is using AWS Key Management Service (AWS KMS) keys to encrypt AWS Lambda environment variables. A solutions architect needs to ensure that the required permissions are in place to decrypt and use the environment variables. Which steps must the solutions architect take to implement the correct permissions? (Choose two.)

  • AAdd AWS KMS permissions in the Lambda resource policy.
  • BAdd AWS KMS permissions in the Lambda execution role. (correct answer)
  • CAdd AWS KMS permissions in the Lambda function policy.
  • DAllow the Lambda execution role in the AWS KMS key policy. (correct answer)
  • EAllow the Lambda resource policy in the AWS KMS key policy.
Reveal answer & explanation
Correct answer: B, D

The correct answer is B, D. Option B: Add AWS KMS permissions in the Lambda execution role. Option D: Allow the Lambda execution role in the AWS KMS key policy.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SAA-C03 Question 551

Single page →
Topic 1 · Question 551

A company has a financial application that produces reports. The reports average 50 KB in size and are stored in Amazon S3. The reports are frequently accessed during the first week after production and must be stored for several years. The reports must be retrievable within 6 hours. Which solution meets these requirements MOST cost-effectively?

  • AUse S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier after 7 days. (correct answer)
  • BUse S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days.
  • CUse S3 Intelligent-Tiering. Configure S3 Intelligent-Tiering to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) and S3 Glacier.
  • DUse S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier Deep Archive after 7 days.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier after 7 days.

Explanation

Amazon S3 Glacier offers low-cost archival storage for infrequently accessed data. S3 Lifecycle policies automatically transition or expire objects to control storage cost. Amazon S3 provides durable, scalable object storage that is fully managed. This option delivers the requirement at the lowest cost.

SAA-C03 Question 552

Single page →
Topic 1 · Question 552

A company needs to optimize the cost of its Amazon EC2 instances. The company also needs to change the type and family of its EC2 instances every 2-3 months. What should the company do to meet these requirements?

  • APurchase Partial Upfront Reserved Instances for a 3-year term.
  • BPurchase a No Upfront Compute Savings Plan for a 1-year term. (correct answer)
  • CPurchase All Upfront Reserved Instances for a 1-year term.
  • DPurchase an All Upfront EC2 Instance Savings Plan for a 1-year term.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Purchase a No Upfront Compute Savings Plan for a 1-year term.

SAA-C03 Question 553

Single page →
Topic 1 · Question 553

A solutions architect needs to review a company's Amazon S3 buckets to discover personally identifiable information (PII). The company stores the PII data in the us-east-1 Region and us-west-2 Region. Which solution will meet these requirements with the LEAST operational overhead?

  • AConfigure Amazon Macie in each Region. Create a job to analyze the data that is in Amazon S3. (correct answer)
  • BConfigure AWS Security Hub for all Regions. Create an AWS Config rule to analyze the data that is in Amazon S3.
  • CConfigure Amazon Inspector to analyze the data that is in Amazon S3.
  • DConfigure Amazon GuardDuty to analyze the data that is in Amazon S3.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure Amazon Macie in each Region. Create a job to analyze the data that is in Amazon S3.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Macie discovers and protects sensitive data such as PII in S3. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 554

Single page →
Topic 1 · Question 554

A company's SAP application has a backend SQL Server database in an on-premises environment. The company wants to migrate its on-premises application and database server to AWS. The company needs an instance type that meets the high demands of its SAP database. On-premises performance data shows that both the SAP application and the database have high memory utilization. Which solution will meet these requirements?

  • AUse the compute optimized instance family for the application. Use the memory optimized instance family for the database.
  • BUse the storage optimized instance family for both the application and the database.
  • CUse the memory optimized instance family for both the application and the database. (correct answer)
  • DUse the high performance computing (HPC) optimized instance family for the application. Use the memory optimized instance family for the database.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use the memory optimized instance family for both the application and the database.

SAA-C03 Question 555

Single page →
Topic 1 · Question 555

A company runs an application in a VPC with public and private subnets. The VPC extends across multiple Availability Zones. The application runs on Amazon EC2 instances in private subnets. The application uses an Amazon Simple Queue Service (Amazon SQS) queue. A solutions architect needs to design a secure solution to establish a connection between the EC2 instances and the SQS queue. Which solution will meet these requirements?

  • AImplement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the private subnets. Add to the endpoint a security group that has an inbound access rule that allows traffic from the EC2 instances that are in the private subnets. (correct answer)
  • BImplement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the public subnets. Attach to the interface endpoint a VPC endpoint policy that allows access from the EC2 instances that are in the private subnets.
  • CImplement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the public subnets. Attach an Amazon SQS access policy to the interface VPC endpoint that allows requests from only a specified VPC endpoint.
  • DImplement a gateway endpoint for Amazon SQS. Add a NAT gateway to the private subnets. Attach an IAM role to the EC2 instances that allows access to the SQS queue.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Implement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the private subnets. Add to the endpoint a security group that has an inbound access rule that allows traffic from the EC2 instances th...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. A VPC endpoint provides private connectivity to AWS services without traversing the public internet. Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SAA-C03 Question 556

Single page →
Topic 1 · Question 556

A solutions architect is using an AWS CloudFormation template to deploy a three-tier web application. The web application consists of a web tier and an application tier that stores and retrieves user data in Amazon DynamoDB tables. The web and application tiers are hosted on Amazon EC2 instances, and the database tier is not publicly accessible. The application EC2 instances need to access the DynamoDB tables without exposing API credentials in the template. What should the solutions architect do to meet these requirements?

  • ACreate an IAM role to read the DynamoDB tables. Associate the role with the application instances by referencing an instance profile.
  • BCreate an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile, and associate the instance profile with the application instances. (correct answer)
  • CUse the parameter section in the AWS CloudFormation template to have the user input access and secret keys from an already-created IAM user that has the required permissions to read and write from the DynamoDB tables.
  • DCreate an IAM user in the AWS CloudFormation template that has the required permissions to read and write from the DynamoDB tables. Use the GetAtt function to retrieve the access and secret keys, and pass them to the application instances through the user data.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile, and associate the instance profile with the application instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials.

SAA-C03 Question 557

Single page →
Topic 1 · Question 557

A solutions architect manages an analytics application. The application stores large amounts of semistructured data in an Amazon S3 bucket. The solutions architect wants to use parallel data processing to process the data more quickly. The solutions architect also wants to use information that is stored in an Amazon Redshift database to enrich the data. Which solution will meet these requirements?

  • AUse Amazon Athena to process the S3 data. Use AWS Glue with the Amazon Redshift data to enrich the S3 data.
  • BUse Amazon EMR to process the S3 data. Use Amazon EMR with the Amazon Redshift data to enrich the S3 data. (correct answer)
  • CUse Amazon EMR to process the S3 data. Use Amazon Kinesis Data Streams to move the S3 data into Amazon Redshift so that the data can be enriched.
  • DUse AWS Glue to process the S3 data. Use AWS Lake Formation with the Amazon Redshift data to enrich the S3 data.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use Amazon EMR to process the S3 data. Use Amazon EMR with the Amazon Redshift data to enrich the S3 data.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Redshift is a managed petabyte-scale data warehouse for complex analytical queries. Amazon EMR runs big-data frameworks like Spark and Hadoop on managed clusters.

SAA-C03 Question 558

Single page →
Topic 1 · Question 558

A company has two VPCs that are located in the us-west-2 Region within the same AWS account. The company needs to allow network traffic between these VPCs. Approximately 500 GB of data transfer will occur between the VPCs each month. What is the MOST cost-effective solution to connect these VPCs?

  • AImplement AWS Transit Gateway to connect the VPCs. Update the route tables of each VPC to use the transit gateway for inter-VPC communication.
  • BImplement an AWS Site-to-Site VPN tunnel between the VPCs. Update the route tables of each VPC to use the VPN tunnel for inter-VPC communication.
  • CSet up a VPC peering connection between the VPCs. Update the route tables of each VPC to use the VPC peering connection for inter-VPC communication. (correct answer)
  • DSet up a 1 GB AWS Direct Connect connection between the VPCs. Update the route tables of each VPC to use the Direct Connect connection for inter-VPC communication.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Set up a VPC peering connection between the VPCs. Update the route tables of each VPC to use the VPC peering connection for inter-VPC communication.

Explanation

VPC peering privately connects two VPCs without a gateway. This option delivers the requirement at the lowest cost.

SAA-C03 Question 559

Single page →
Topic 1 · Question 559 · Select all that apply

A company hosts multiple applications on AWS for different product lines. The applications use different compute resources, including Amazon EC2 instances and Application Load Balancers. The applications run in different AWS accounts under the same organization in AWS Organizations across multiple AWS Regions. Teams for each product line have tagged each compute resource in the individual accounts. The company wants more details about the cost for each product line from the consolidated billing feature in Organizations. Which combination of steps will meet these requirements? (Choose two.)

  • ASelect a specific AWS generated tag in the AWS Billing console.
  • BSelect a specific user-defined tag in the AWS Billing console. (correct answer)
  • CSelect a specific user-defined tag in the AWS Resource Groups console.
  • DActivate the selected tag from each AWS account.
  • EActivate the selected tag from the Organizations management account. (correct answer)
Reveal answer & explanation
Correct answer: B, E

The correct answer is B, E. Option B: Select a specific user-defined tag in the AWS Billing console. Option E: Activate the selected tag from the Organizations management account.

Explanation

AWS Organizations centrally governs and secures multiple AWS accounts.

SAA-C03 Question 560

Single page →
Topic 1 · Question 560

A company's solutions architect is designing an AWS multi-account solution that uses AWS Organizations. The solutions architect has organized the company's accounts into organizational units (OUs). The solutions architect needs a solution that will identify any changes to the OU hierarchy. The solution also needs to notify the company's operations team of any changes. Which solution will meet these requirements with the LEAST operational overhead?

  • AProvision the AWS accounts by using AWS Control Tower. Use account drift notifications to identify the changes to the OU hierarchy. (correct answer)
  • BProvision the AWS accounts by using AWS Control Tower. Use AWS Config aggregated rules to identify the changes to the OU hierarchy.
  • CUse AWS Service Catalog to create accounts in Organizations. Use an AWS CloudTrail organization trail to identify the changes to the OU hierarchy.
  • DUse AWS CloudFormation templates to create accounts in Organizations. Use the drift detection operation on a stack to identify the changes to the OU hierarchy.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Provision the AWS accounts by using AWS Control Tower. Use account drift notifications to identify the changes to the OU hierarchy.

Explanation

AWS Control Tower sets up and governs a secure multi-account landing zone.

Showing questions 541–560 of 1019 · Page 28 of 51