πŸ”

SAA-C03 β€” questions

Page 31 of 51 Β· 1019 total questions.

Topic 1 Β· Question 601

A company runs its critical database on an Amazon RDS for PostgreSQL DB instance. The company wants to migrate to Amazon Aurora PostgreSQL with minimal downtime and data loss. Which solution will meet these requirements with the LEAST operational overhead?

  • ACreate a DB snapshot of the RDS for PostgreSQL DB instance to populate a new Aurora PostgreSQL DB cluster.
  • BCreate an Aurora read replica of the RDS for PostgreSQL DB instance. Promote the Aurora read replicate to a new Aurora PostgreSQL DB cluster. (correct answer)
  • CUse data import from Amazon S3 to migrate the database to an Aurora PostgreSQL DB cluster.
  • DUse the pg_dump utility to back up the RDS for PostgreSQL database. Restore the backup to a new Aurora PostgreSQL DB cluster.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Aurora read replica of the RDS for PostgreSQL DB instance. Promote the Aurora read replicate to a new Aurora PostgreSQL DB cluster.

Explanation

Amazon Aurora is a high-performance managed relational database with built-in replication and failover. Amazon RDS is a managed relational database that handles patching, backups and failover.

Topic 1 Β· Question 602

A company's infrastructure consists of hundreds of Amazon EC2 instances that use Amazon Elastic Block Store (Amazon EBS) storage. A solutions architect must ensure that every EC2 instance can be recovered after a disaster. What should the solutions architect do to meet this requirement with the LEAST amount of effort?

  • ATake a snapshot of the EBS storage that is attached to each EC2 instance. Create an AWS CloudFormation template to launch new EC2 instances from the EBS storage.
  • BTake a snapshot of the EBS storage that is attached to each EC2 instance. Use AWS Elastic Beanstalk to set the environment based on the EC2 template and attach the EBS storage.
  • CUse AWS Backup to set up a backup plan for the entire group of EC2 instances. Use the AWS Backup API or the AWS CLI to speed up the restore process for multiple EC2 instances. (correct answer)
  • DCreate an AWS Lambda function to take a snapshot of the EBS storage that is attached to each EC2 instance and copy the Amazon Machine Images (AMIs). Create another Lambda function to perform the restores with the copied AMIs and attach the EBS storage.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use AWS Backup to set up a backup plan for the entire group of EC2 instances. Use the AWS Backup API or the AWS CLI to speed up the restore process for multiple EC2 instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Backup centrally automates and manages backups across AWS services.

Topic 1 Β· Question 603

A company recently migrated to the AWS Cloud. The company wants a serverless solution for large-scale parallel on-demand processing of a semistructured dataset. The data consists of logs, media files, sales transactions, and IoT sensor data that is stored in Amazon S3. The company wants the solution to process thousands of items in the dataset in parallel. Which solution will meet these requirements with the MOST operational efficiency?

  • AUse the AWS Step Functions Map state in Inline mode to process the data in parallel.
  • BUse the AWS Step Functions Map state in Distributed mode to process the data in parallel. (correct answer)
  • CUse AWS Glue to process the data in parallel.
  • DUse several AWS Lambda functions to process the data in parallel.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use the AWS Step Functions Map state in Distributed mode to process the data in parallel.

Explanation

AWS Step Functions coordinates multi-step workflows as a managed state machine.

Topic 1 Β· Question 604

A company will migrate 10 PB of data to Amazon S3 in 6 weeks. The current data center has a 500 Mbps uplink to the internet. Other on-premises applications share the uplink. The company can use 80% of the internet bandwidth for this one-time migration task. Which solution will meet these requirements?

  • AConfigure AWS DataSync to migrate the data to Amazon S3 and to automatically verify the data.
  • BUse rsync to transfer the data directly to Amazon S3.
  • CUse the AWS CLI and multiple copy processes to send the data directly to Amazon S3.
  • DOrder multiple AWS Snowball devices. Copy the data to the devices. Send the devices to AWS to copy the data to Amazon S3. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Order multiple AWS Snowball devices. Copy the data to the devices. Send the devices to AWS to copy the data to Amazon S3.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Snowball physically ships data to AWS, ideal when bandwidth is limited or data is very large.

Topic 1 Β· Question 605

A company has several on-premises Internet Small Computer Systems Interface (ISCSI) network storage servers. The company wants to reduce the number of these servers by moving to the AWS Cloud. A solutions architect must provide low-latency access to frequently used data and reduce the dependency on on-premises servers with a minimal number of infrastructure changes. Which solution will meet these requirements?

  • ADeploy an Amazon S3 File Gateway.
  • BDeploy Amazon Elastic Block Store (Amazon EBS) storage with backups to Amazon S3.
  • CDeploy an AWS Storage Gateway volume gateway that is configured with stored volumes.
  • DDeploy an AWS Storage Gateway volume gateway that is configured with cached volumes. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Deploy an AWS Storage Gateway volume gateway that is configured with cached volumes.

Explanation

AWS Storage Gateway bridges on-premises apps to AWS storage with local caching. AWS Config tracks resource configuration changes and evaluates compliance. This option meets the real-time / low-latency performance requirement.

Topic 1 Β· Question 606

A solutions architect is designing an application that will allow business users to upload objects to Amazon S3. The solution needs to maximize object durability. Objects also must be readily available at any time and for any length of time. Users will access objects frequently within the first 30 days after the objects are uploaded, but users are much less likely to access objects that are older than 30 days. Which solution meets these requirements MOST cost-effectively?

  • AStore all the objects in S3 Standard with an S3 Lifecycle rule to transition the objects to S3 Glacier after 30 days.
  • BStore all the objects in S3 Standard with an S3 Lifecycle rule to transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days. (correct answer)
  • CStore all the objects in S3 Standard with an S3 Lifecycle rule to transition the objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 30 days.
  • DStore all the objects in S3 Intelligent-Tiering with an S3 Lifecycle rule to transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Store all the objects in S3 Standard with an S3 Lifecycle rule to transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.

Explanation

S3 Standard-IA reduces cost for infrequently accessed data that still needs high availability. S3 Lifecycle policies automatically transition or expire objects to control storage cost. Amazon S3 provides durable, scalable object storage that is fully managed. This option delivers the requirement at the lowest cost.

Topic 1 Β· Question 607

A company has migrated a two-tier application from its on-premises data center to the AWS Cloud. The data tier is a Multi-AZ deployment of Amazon RDS for Oracle with 12 TB of General Purpose SSD Amazon Elastic Block Store (Amazon EBS) storage. The application is designed to process and store documents in the database as binary large objects (blobs) with an average document size of 6 MB. The database size has grown over time, reducing the performance and increasing the cost of storage. The company must improve the database performance and needs a solution that is highly available and resilient. Which solution will meet these requirements MOST cost-effectively?

  • AReduce the RDS DB instance size. Increase the storage capacity to 24 TiB. Change the storage type to Magnetic.
  • BIncrease the RDS DB instance size. Increase the storage capacity to 24 TiChange the storage type to Provisioned IOPS.
  • CCreate an Amazon S3 bucket. Update the application to store documents in the S3 bucket. Store the object metadata in the existing database. (correct answer)
  • DCreate an Amazon DynamoDB table. Update the application to use DynamoDB. Use AWS Database Migration Service (AWS DMS) to migrate data from the Oracle database to DynamoDB.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an Amazon S3 bucket. Update the application to store documents in the S3 bucket. Store the object metadata in the existing database.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. This option delivers the requirement at the lowest cost.

Topic 1 Β· Question 608

A company has an application that serves clients that are deployed in more than 20.000 retail storefront locations around the world. The application consists of backend web services that are exposed over HTTPS on port 443. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The retail locations communicate with the web application over the public internet. The company allows each retail location to register the IP address that the retail location has been allocated by its local ISP. The company's security team recommends to increase the security of the application endpoint by restricting access to only the IP addresses registered by the retail locations. What should a solutions architect do to meet these requirements?

  • AAssociate an AWS WAF web ACL with the ALB. Use IP rule sets on the ALB to filter traffic. Update the IP addresses in the rule to include the registered IP addresses. (correct answer)
  • BDeploy AWS Firewall Manager to manage the ALConfigure firewall rules to restrict traffic to the ALModify the firewall rules to include the registered IP addresses.
  • CStore the IP addresses in an Amazon DynamoDB table. Configure an AWS Lambda authorization function on the ALB to validate that incoming requests are from the registered IP addresses.
  • DConfigure the network ACL on the subnet that contains the public interface of the ALB. Update the ingress rules on the network ACL with entries for each of the registered IP addresses.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Associate an AWS WAF web ACL with the ALB. Use IP rule sets on the ALB to filter traffic. Update the IP addresses in the rule to include the registered IP addresses.

Explanation

AWS WAF protects web applications from common exploits and malicious requests.

Topic 1 Β· Question 609

A company is building a data analysis platform on AWS by using AWS Lake Formation. The platform will ingest data from different sources such as Amazon S3 and Amazon RDS. The company needs a secure solution to prevent access to portions of the data that contain sensitive information. Which solution will meet these requirements with the LEAST operational overhead?

  • ACreate an IAM role that includes permissions to access Lake Formation tables.
  • BCreate data filters to implement row-level security and cell-level security. (correct answer)
  • CCreate an AWS Lambda function that removes sensitive information before Lake Formation ingests the data.
  • DCreate an AWS Lambda function that periodically queries and removes sensitive information from Lake Formation tables.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create data filters to implement row-level security and cell-level security.

Topic 1 Β· Question 610

A company deploys Amazon EC2 instances that run in a VPC. The EC2 instances load source data into Amazon S3 buckets so that the data can be processed in the future. According to compliance laws, the data must not be transmitted over the public internet. Servers in the company's on-premises data center will consume the output from an application that runs on the EC2 instances. Which solution will meet these requirements?

  • ADeploy an interface VPC endpoint for Amazon EC2. Create an AWS Site-to-Site VPN connection between the company and the VPC.
  • BDeploy a gateway VPC endpoint for Amazon S3. Set up an AWS Direct Connect connection between the on-premises network and the VPC. (correct answer)
  • CSet up an AWS Transit Gateway connection from the VPC to the S3 buckets. Create an AWS Site-to-Site VPN connection between the company and the VPC.
  • DSet up proxy EC2 instances that have routes to NAT gateways. Configure the proxy EC2 instances to fetch S3 data and feed the application instances.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Deploy a gateway VPC endpoint for Amazon S3. Set up an AWS Direct Connect connection between the on-premises network and the VPC.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. A gateway VPC endpoint gives private, no-cost access to Amazon S3 and DynamoDB from within the VPC. A VPC endpoint provides private connectivity to AWS services without traversing the public internet.

Topic 1 Β· Question 611

A company has an application with a REST-based interface that allows data to be received in near-real time from a third-party vendor. Once received, the application processes and stores the data for further analysis. The application is running on Amazon EC2 instances. The third-party vendor has received many 503 Service Unavailable Errors when sending data to the application. When the data volume spikes, the compute capacity reaches its maximum limit and the application is unable to process all requests. Which design should a solutions architect recommend to provide a more scalable solution?

  • AUse Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions. (correct answer)
  • BUse Amazon API Gateway on top of the existing application. Create a usage plan with a quota limit for the third-party vendor.
  • CUse Amazon Simple Notification Service (Amazon SNS) to ingest the data. Put the EC2 instances in an Auto Scaling group behind an Application Load Balancer.
  • DRepackage the application as a container. Deploy the application using Amazon Elastic Container Service (Amazon ECS) using the EC2 launch type with an Auto Scaling group.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Kinesis Data Streams ingests and processes high-volume real-time streaming data. Amazon Kinesis ingests and processes real-time streaming data at scale. This option meets the real-time / low-latency performance requirement.

Topic 1 Β· Question 612

A company has an application that runs on Amazon EC2 instances in a private subnet. The application needs to process sensitive information from an Amazon S3 bucket. The application must not use the internet to connect to the S3 bucket. Which solution will meet these requirements?

  • AConfigure an internet gateway. Update the S3 bucket policy to allow access from the internet gateway. Update the application to use the new internet gateway.
  • BConfigure a VPN connection. Update the S3 bucket policy to allow access from the VPN connection. Update the application to use the new VPN connection.
  • CConfigure a NAT gateway. Update the S3 bucket policy to allow access from the NAT gateway. Update the application to use the new NAT gateway.
  • DConfigure a VPC endpoint. Update the S3 bucket policy to allow access from the VPC endpoint. Update the application to use the new VPC endpoint. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure a VPC endpoint. Update the S3 bucket policy to allow access from the VPC endpoint. Update the application to use the new VPC endpoint.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. A VPC endpoint provides private connectivity to AWS services without traversing the public internet. AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 Β· Question 613

A company uses Amazon Elastic Kubernetes Service (Amazon EKS) to run a container application. The EKS cluster stores sensitive information in the Kubernetes secrets object. The company wants to ensure that the information is encrypted. Which solution will meet these requirements with the LEAST operational overhead?

  • AUse the container application to encrypt the information by using AWS Key Management Service (AWS KMS).
  • BEnable secrets encryption in the EKS cluster by using AWS Key Management Service (AWS KMS). (correct answer)
  • CImplement an AWS Lambda function to encrypt the information by using AWS Key Management Service (AWS KMS).
  • DUse AWS Systems Manager Parameter Store to encrypt the information by using AWS Key Management Service (AWS KMS).
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable secrets encryption in the EKS cluster by using AWS Key Management Service (AWS KMS).

Explanation

Amazon EKS runs managed Kubernetes when you need the Kubernetes ecosystem. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

Topic 1 Β· Question 614

A company is designing a new multi-tier web application that consists of the following components: β€’ Web and application servers that run on Amazon EC2 instances as part of Auto Scaling groups β€’ An Amazon RDS DB instance for data storage A solutions architect needs to limit access to the application servers so that only the web servers can access them. Which solution will meet these requirements?

  • ADeploy AWS PrivateLink in front of the application servers. Configure the network ACL to allow only the web servers to access the application servers.
  • BDeploy a VPC endpoint in front of the application servers. Configure the security group to allow only the web servers to access the application servers.
  • CDeploy a Network Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the network ACL to allow only the web servers to access the application servers.
  • DDeploy an Application Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the security group to allow only the web servers to access the application servers. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Deploy an Application Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the security group to allow only the web servers to access the application servers.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale.

Topic 1 Β· Question 615

A company runs a critical, customer-facing application on Amazon Elastic Kubernetes Service (Amazon EKS). The application has a microservices architecture. The company needs to implement a solution that collects, aggregates, and summarizes metrics and logs from the application in a centralized location. Which solution meets these requirements?

  • ARun the Amazon CloudWatch agent in the existing EKS cluster. View the metrics and logs in the CloudWatch console.
  • BRun AWS App Mesh in the existing EKS cluster. View the metrics and logs in the App Mesh console.
  • CConfigure AWS CloudTrail to capture data events. Query CloudTrail by using Amazon OpenSearch Service.
  • DConfigure Amazon CloudWatch Container Insights in the existing EKS cluster. View the metrics and logs in the CloudWatch console. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure Amazon CloudWatch Container Insights in the existing EKS cluster. View the metrics and logs in the CloudWatch console.

Explanation

Amazon EKS runs managed Kubernetes when you need the Kubernetes ecosystem. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 Β· Question 616

A company has deployed its newest product on AWS. The product runs in an Auto Scaling group behind a Network Load Balancer. The company stores the product’s objects in an Amazon S3 bucket. The company recently experienced malicious attacks against its systems. The company needs a solution that continuously monitors for malicious activity in the AWS account, workloads, and access patterns to the S3 bucket. The solution must also report suspicious activity and display the information on a dashboard. Which solution will meet these requirements?

  • AConfigure Amazon Macie to monitor and report findings to AWS Config.
  • BConfigure Amazon Inspector to monitor and report findings to AWS CloudTrail.
  • CConfigure Amazon GuardDuty to monitor and report findings to AWS Security Hub. (correct answer)
  • DConfigure AWS Config to monitor and report findings to Amazon EventBridge.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure Amazon GuardDuty to monitor and report findings to AWS Security Hub.

Explanation

Amazon GuardDuty continuously monitors for threats and malicious activity. AWS Security Hub centralizes security findings and compliance checks. AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 Β· Question 617 Β· Select all that apply

A company wants to migrate an on-premises data center to AWS. The data center hosts a storage server that stores data in an NFS-based file system. The storage server holds 200 GB of data. The company needs to migrate the data without interruption to existing services. Multiple resources in AWS must be able to access the data by using the NFS protocol. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)

  • ACreate an Amazon FSx for Lustre file system.
  • BCreate an Amazon Elastic File System (Amazon EFS) file system. (correct answer)
  • CCreate an Amazon S3 bucket to receive the data.
  • DManually use an operating system copy command to push the data into the AWS destination.
  • EInstall an AWS DataSync agent in the on-premises data center. Use a DataSync task between the on-premises location and AWS. (correct answer)
Reveal answer & explanation
Correct answer: B, E

The correct answer is B, E. Option B: Create an Amazon Elastic File System (Amazon EFS) file system. Option E: Install an AWS DataSync agent in the on-premises data center. Use a DataSync task between the on-premises location and AWS.

Explanation

Amazon EFS is a shared, elastic NFS file system that multiple instances can mount concurrently across AZs. AWS DataSync automates and accelerates online data transfer to AWS with minimal effort. This option delivers the requirement at the lowest cost.

Topic 1 Β· Question 618

A company wants to use Amazon FSx for Windows File Server for its Amazon EC2 instances that have an SMB file share mounted as a volume in the us-east-1 Region. The company has a recovery point objective (RPO) of 5 minutes for planned system maintenance or unplanned service disruptions. The company needs to replicate the file system to the us-west-2 Region. The replicated data must not be deleted by any user for 5 years. Which solution will meet these requirements?

  • ACreate an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
  • BCreate an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
  • CCreate an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2. Configure a minimum duration of 5 years. (correct answer)
  • DCreate an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configu...

Explanation

Amazon FSx for Windows File Server provides fully managed SMB/Windows shared file storage. Amazon FSx provides fully managed third-party file systems. AWS Backup centrally automates and manages backups across AWS services.

Topic 1 Β· Question 619

A solutions architect is designing a security solution for a company that wants to provide developers with individual AWS accounts through AWS Organizations, while also maintaining standard security controls. Because the individual developers will have AWS account root user-level access to their own accounts, the solutions architect wants to ensure that the mandatory AWS CloudTrail configuration that is applied to new developer accounts is not modified. Which action meets these requirements?

  • ACreate an IAM policy that prohibits changes to CloudTrail. and attach it to the root user.
  • BCreate a new trail in CloudTrail from within the developer accounts with the organization trails option enabled.
  • CCreate a service control policy (SCP) that prohibits changes to CloudTrail, and attach it the developer accounts. (correct answer)
  • DCreate a service-linked role for CloudTrail with a policy condition that allows changes only from an Amazon Resource Name (ARN) in the management account.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a service control policy (SCP) that prohibits changes to CloudTrail, and attach it the developer accounts.

Explanation

Service Control Policies set guardrails on what accounts in an organization can do. AWS CloudTrail records API activity for auditing and governance.

Topic 1 Β· Question 620

A company is planning to deploy a business-critical application in the AWS Cloud. The application requires durable storage with consistent, low-latency performance. Which type of storage should a solutions architect recommend to meet these requirements?

  • AInstance store volume
  • BAmazon ElastiCache for Memcached cluster
  • CProvisioned IOPS SSD Amazon Elastic Block Store (Amazon EBS) volume (correct answer)
  • DThroughput Optimized HDD Amazon Elastic Block Store (Amazon EBS) volume
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Provisioned IOPS SSD Amazon Elastic Block Store (Amazon EBS) volume

Explanation

Amazon EBS provides block storage attached to a single EC2 instance. This option meets the real-time / low-latency performance requirement.

Showing questions 601–620 of 1019 Β· Page 31 of 51