🔍

SAA-C03 — questions

Page 5 of 51 · 1019 total questions.

SAA-C03 Question 81

Single page →
Topic 1 · Question 81

A solutions architect is designing the cloud architecture for a new application being deployed on AWS. The process should run in parallel while adding and removing application nodes as needed based on the number of jobs to be processed. The processor application is stateless. The solutions architect must ensure that the application is loosely coupled and the job items are durably stored. Which design should the solutions architect use?

  • ACreate an Amazon SNS topic to send the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch configuration that uses the AMI. Create an Auto Scaling group using the launch configuration. Set the scaling policy for the Auto Scaling group to add and remove nodes based on CPU usage.
  • BCreate an Amazon SQS queue to hold the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch configuration that uses the AMI. Create an Auto Scaling group using the launch configuration. Set the scaling policy for the Auto Scaling group to add and remove nodes based on network usage.
  • CCreate an Amazon SQS queue to hold the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch template that uses the AMI. Create an Auto Scaling group using the launch template. Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of items in the SQS queue. (correct answer)
  • DCreate an Amazon SNS topic to send the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch template that uses the AMI. Create an Auto Scaling group using the launch template. Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of messages published to the SNS topic.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an Amazon SQS queue to hold the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch template that uses the AMI. Create an Auto Scalin...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes. This option decouples the components so they scale independently and absorb load spikes.

SAA-C03 Question 82

Single page →
Topic 1 · Question 82

A company hosts its web applications in the AWS Cloud. The company configures Elastic Load Balancers to use certificates that are imported into AWS Certificate Manager (ACM). The company's security team must be notified 30 days before the expiration of each certificate. What should a solutions architect recommend to meet this requirement?

  • AAdd a rule in ACM to publish a custom message to an Amazon Simple Notification Service (Amazon SNS) topic every day, beginning 30 days before any certificate will expire.
  • BCreate an AWS Config rule that checks for certificates that will expire within 30 days. Configure Amazon EventBridge (Amazon CloudWatch Events) to invoke a custom alert by way of Amazon Simple Notification Service (Amazon SNS) when AWS Config reports a noncompliant resource.
  • CUse AWS Trusted Advisor to check for certificates that will expire within 30 days. Create an Amazon CloudWatch alarm that is based on Trusted Advisor metrics for check status changes. Configure the alarm to send a custom alert by way of Amazon Simple Notification Service (Amazon SNS).
  • DCreate an Amazon EventBridge (Amazon CloudWatch Events) rule to detect any certificates that will expire within 30 days. Configure the rule to invoke an AWS Lambda function. Configure the Lambda function to send a custom alert by way of Amazon Simple Notification Service (Amazon SNS). (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create an Amazon EventBridge (Amazon CloudWatch Events) rule to detect any certificates that will expire within 30 days. Configure the rule to invoke an AWS Lambda function. Configure the Lambda function to send a cus...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

SAA-C03 Question 83

Single page →
Topic 1 · Question 83

A company's dynamic website is hosted using on-premises servers in the United States. The company is launching its product in Europe, and it wants to optimize site loading times for new European users. The site's backend must remain in the United States. The product is being launched in a few days, and an immediate solution is needed. What should the solutions architect recommend?

  • ALaunch an Amazon EC2 instance in us-east-1 and migrate the site to it.
  • BMove the website to Amazon S3. Use Cross-Region Replication between Regions.
  • CUse Amazon CloudFront with a custom origin pointing to the on-premises servers. (correct answer)
  • DUse an Amazon Route 53 geoproximity routing policy pointing to on-premises servers.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use Amazon CloudFront with a custom origin pointing to the on-premises servers.

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SAA-C03 Question 84

Single page →
Topic 1 · Question 84

A company wants to reduce the cost of its existing three-tier web architecture. The web, application, and database servers are running on Amazon EC2 instances for the development, test, and production environments. The EC2 instances average 30% CPU utilization during peak hours and 10% CPU utilization during non-peak hours. The production EC2 instances run 24 hours a day. The development and test EC2 instances run for at least 8 hours each day. The company plans to implement automation to stop the development and test EC2 instances when they are not in use. Which EC2 instance purchasing solution will meet the company's requirements MOST cost-effectively?

  • AUse Spot Instances for the production EC2 instances. Use Reserved Instances for the development and test EC2 instances.
  • BUse Reserved Instances for the production EC2 instances. Use On-Demand Instances for the development and test EC2 instances. (correct answer)
  • CUse Spot blocks for the production EC2 instances. Use Reserved Instances for the development and test EC2 instances.
  • DUse On-Demand Instances for the production EC2 instances. Use Spot blocks for the development and test EC2 instances.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use Reserved Instances for the production EC2 instances. Use On-Demand Instances for the development and test EC2 instances.

Explanation

Reserved Instances lower cost for steady-state, predictable long-running workloads. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. This option delivers the requirement at the lowest cost.

SAA-C03 Question 85

Single page →
Topic 1 · Question 85

A company has a production web application in which users upload documents through a web interface or a mobile app. According to a new regulatory requirement. new documents cannot be modified or deleted after they are stored. What should a solutions architect do to meet this requirement?

  • AStore the uploaded documents in an Amazon S3 bucket with S3 Versioning and S3 Object Lock enabled. (correct answer)
  • BStore the uploaded documents in an Amazon S3 bucket. Configure an S3 Lifecycle policy to archive the documents periodically.
  • CStore the uploaded documents in an Amazon S3 bucket with S3 Versioning enabled. Configure an ACL to restrict all access to read-only.
  • DStore the uploaded documents on an Amazon Elastic File System (Amazon EFS) volume. Access the data by mounting the volume in read-only mode.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Store the uploaded documents in an Amazon S3 bucket with S3 Versioning and S3 Object Lock enabled.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SAA-C03 Question 86

Single page →
Topic 1 · Question 86

A company has several web servers that need to frequently access a common Amazon RDS MySQL Multi-AZ DB instance. The company wants a secure method for the web servers to connect to the database while meeting a security requirement to rotate user credentials frequently. Which solution meets these requirements?

  • AStore the database user credentials in AWS Secrets Manager. Grant the necessary IAM permissions to allow the web servers to access AWS Secrets Manager. (correct answer)
  • BStore the database user credentials in AWS Systems Manager OpsCenter. Grant the necessary IAM permissions to allow the web servers to access OpsCenter.
  • CStore the database user credentials in a secure Amazon S3 bucket. Grant the necessary IAM permissions to allow the web servers to retrieve credentials and access the database.
  • DStore the database user credentials in files encrypted with AWS Key Management Service (AWS KMS) on the web server file system. The web server should be able to decrypt the files and access the database.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Store the database user credentials in AWS Secrets Manager. Grant the necessary IAM permissions to allow the web servers to access AWS Secrets Manager.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Secrets Manager stores and automatically rotates secrets such as database credentials. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SAA-C03 Question 87

Single page →
Topic 1 · Question 87

A company hosts an application on AWS Lambda functions that are invoked by an Amazon API Gateway API. The Lambda functions save customer data to an Amazon Aurora MySQL database. Whenever the company upgrades the database, the Lambda functions fail to establish database connections until the upgrade is complete. The result is that customer data is not recorded for some of the event. A solutions architect needs to design a solution that stores customer data that is created during database upgrades. Which solution will meet these requirements?

  • AProvision an Amazon RDS proxy to sit between the Lambda functions and the database. Configure the Lambda functions to connect to the RDS proxy.
  • BIncrease the run time of the Lambda functions to the maximum. Create a retry mechanism in the code that stores the customer data in the database.
  • CPersist the customer data to Lambda local storage. Configure new Lambda functions to scan the local storage to save the customer data to the database.
  • DStore the customer data in an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Create a new Lambda function that polls the queue and stores the customer data in the database. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Store the customer data in an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Create a new Lambda function that polls the queue and stores the customer data in the database.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes.

SAA-C03 Question 88

Single page →
Topic 1 · Question 88

A survey company has gathered data for several years from areas in the United States. The company hosts the data in an Amazon S3 bucket that is 3 TB in size and growing. The company has started to share the data with a European marketing firm that has S3 buckets. The company wants to ensure that its data transfer costs remain as low as possible. Which solution will meet these requirements?

  • AConfigure the Requester Pays feature on the company's S3 bucket. (correct answer)
  • BConfigure S3 Cross-Region Replication from the company's S3 bucket to one of the marketing firm's S3 buckets.
  • CConfigure cross-account access for the marketing firm so that the marketing firm has access to the company's S3 bucket.
  • DConfigure the company's S3 bucket to use S3 Intelligent-Tiering. Sync the S3 bucket to one of the marketing firm's S3 buckets.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure the Requester Pays feature on the company's S3 bucket.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 89

Single page →
Topic 1 · Question 89

A company uses Amazon S3 to store its confidential audit documents. The S3 bucket uses bucket policies to restrict access to audit team IAM user credentials according to the principle of least privilege. Company managers are worried about accidental deletion of documents in the S3 bucket and want a more secure solution. What should a solutions architect do to secure the audit documents?

  • AEnable the versioning and MFA Delete features on the S3 bucket. (correct answer)
  • BEnable multi-factor authentication (MFA) on the IAM user credentials for each audit team IAM user account.
  • CAdd an S3 Lifecycle policy to the audit team's IAM user accounts to deny the s3:DeleteObject action during audit dates.
  • DUse AWS Key Management Service (AWS KMS) to encrypt the S3 bucket and restrict audit team IAM user accounts from accessing the KMS key.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable the versioning and MFA Delete features on the S3 bucket.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SAA-C03 Question 90

Single page →
Topic 1 · Question 90

A company is using a SQL database to store movie data that is publicly accessible. The database runs on an Amazon RDS Single-AZ DB instance. A script runs queries at random intervals each day to record the number of new movies that have been added to the database. The script must report a final total during business hours. The company's development team notices that the database performance is inadequate for development tasks when the script is running. A solutions architect must recommend a solution to resolve this issue. Which solution will meet this requirement with the LEAST operational overhead?

  • AModify the DB instance to be a Multi-AZ deployment.
  • BCreate a read replica of the database. Configure the script to query only the read replica. (correct answer)
  • CInstruct the development team to manually export the entries in the database at the end of each day.
  • DUse Amazon ElastiCache to cache the common queries that the script runs against the database.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a read replica of the database. Configure the script to query only the read replica.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 91

Single page →
Topic 1 · Question 91

A company has applications that run on Amazon EC2 instances in a VPC. One of the applications needs to call the Amazon S3 API to store and read objects. According to the company's security regulations, no traffic from the applications is allowed to travel across the internet. Which solution will meet these requirements?

  • AConfigure an S3 gateway endpoint. (correct answer)
  • BCreate an S3 bucket in a private subnet.
  • CCreate an S3 bucket in the same AWS Region as the EC2 instances.
  • DConfigure a NAT gateway in the same subnet as the EC2 instances.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure an S3 gateway endpoint.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 92

Single page →
Topic 1 · Question 92 · Select all that apply

A company is storing sensitive user information in an Amazon S3 bucket. The company wants to provide secure access to this bucket from the application tier running on Amazon EC2 instances inside a VPC. Which combination of steps should a solutions architect take to accomplish this? (Choose two.)

  • AConfigure a VPC gateway endpoint for Amazon S3 within the VPC. (correct answer)
  • BCreate a bucket policy to make the objects in the S3 bucket public.
  • CCreate a bucket policy that limits access to only the application tier running in the VPC. (correct answer)
  • DCreate an IAM user with an S3 access policy and copy the IAM credentials to the EC2 instance.
  • ECreate a NAT instance and have the EC2 instances use the NAT instance to access the S3 bucket.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Configure a VPC gateway endpoint for Amazon S3 within the VPC. Option C: Create a bucket policy that limits access to only the application tier running in the VPC.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 93

Single page →
Topic 1 · Question 93

A company runs an on-premises application that is powered by a MySQL database. The company is migrating the application to AWS to increase the application's elasticity and availability. The current architecture shows heavy read activity on the database during times of normal operation. Every 4 hours, the company's development team pulls a full export of the production database to populate a database in the staging environment. During this period, users experience unacceptable application latency. The development team is unable to use the staging environment until the procedure completes. A solutions architect must recommend replacement architecture that alleviates the application latency issue. The replacement architecture also must give the development team the ability to continue using the staging environment without delay. Which solution meets these requirements?

  • AUse Amazon Aurora MySQL with Multi-AZ Aurora Replicas for production. Populate the staging database by implementing a backup and restore process that uses the mysqldump utility.
  • BUse Amazon Aurora MySQL with Multi-AZ Aurora Replicas for production. Use database cloning to create the staging database on-demand. (correct answer)
  • CUse Amazon RDS for MySQL with a Multi-AZ deployment and read replicas for production. Use the standby instance for the staging database.
  • DUse Amazon RDS for MySQL with a Multi-AZ deployment and read replicas for production. Populate the staging database by implementing a backup and restore process that uses the mysqldump utility.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use Amazon Aurora MySQL with Multi-AZ Aurora Replicas for production. Use database cloning to create the staging database on-demand.

Explanation

Amazon Aurora is a high-performance managed relational database with built-in replication and failover.

SAA-C03 Question 94

Single page →
Topic 1 · Question 94

A company is designing an application where users upload small files into Amazon S3. After a user uploads a file, the file requires one-time simple processing to transform the data and save the data in JSON format for later analysis. Each file must be processed as quickly as possible after it is uploaded. Demand will vary. On some days, users will upload a high number of files. On other days, users will upload a few files or no files. Which solution meets these requirements with the LEAST operational overhead?

  • AConfigure Amazon EMR to read text files from Amazon S3. Run processing scripts to transform the data. Store the resulting JSON file in an Amazon Aurora DB cluster.
  • BConfigure Amazon S3 to send an event notification to an Amazon Simple Queue Service (Amazon SQS) queue. Use Amazon EC2 instances to read from the queue and process the data. Store the resulting JSON file in Amazon DynamoDB.
  • CConfigure Amazon S3 to send an event notification to an Amazon Simple Queue Service (Amazon SQS) queue. Use an AWS Lambda function to read from the queue and process the data. Store the resulting JSON file in Amazon DynamoDB. (correct answer)
  • DConfigure Amazon EventBridge (Amazon CloudWatch Events) to send an event to Amazon Kinesis Data Streams when a new file is uploaded. Use an AWS Lambda function to consume the event from the stream and process the data. Store the resulting JSON file in an Amazon Aurora DB cluster.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure Amazon S3 to send an event notification to an Amazon Simple Queue Service (Amazon SQS) queue. Use an AWS Lambda function to read from the queue and process the data. Store the resulting JSON file in Amazon D...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling.

SAA-C03 Question 95

Single page →
Topic 1 · Question 95

An application allows users at a company's headquarters to access product data. The product data is stored in an Amazon RDS MySQL DB instance. The operations team has isolated an application performance slowdown and wants to separate read traffic from write traffic. A solutions architect needs to optimize the application's performance quickly. What should the solutions architect recommend?

  • AChange the existing database to a Multi-AZ deployment. Serve the read requests from the primary Availability Zone.
  • BChange the existing database to a Multi-AZ deployment. Serve the read requests from the secondary Availability Zone.
  • CCreate read replicas for the database. Configure the read replicas with half of the compute and storage resources as the source database.
  • DCreate read replicas for the database. Configure the read replicas with the same compute and storage resources as the source database. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create read replicas for the database. Configure the read replicas with the same compute and storage resources as the source database.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 96

Single page →
Topic 1 · Question 96

An Amazon EC2 administrator created the following policy associated with an IAM group containing several users: What is the effect of this policy?

Exhibit 1 for question 96
  • AUsers can terminate an EC2 instance in any AWS Region except us-east-1.
  • BUsers can terminate an EC2 instance with the IP address 10.100.100.1 in the us-east-1 Region.
  • CUsers can terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.100.100.254. (correct answer)
  • DUsers cannot terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.100.100.254.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Users can terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.100.100.254.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SAA-C03 Question 97

Single page →
Topic 1 · Question 97

A company has a large Microsoft SharePoint deployment running on-premises that requires Microsoft Windows shared file storage. The company wants to migrate this workload to the AWS Cloud and is considering various storage options. The storage solution must be highly available and integrated with Active Directory for access control. Which solution will satisfy these requirements?

  • AConfigure Amazon EFS storage and set the Active Directory domain for authentication.
  • BCreate an SMB file share on an AWS Storage Gateway file gateway in two Availability Zones.
  • CCreate an Amazon S3 bucket and configure Microsoft Windows Server to mount it as a volume.
  • DCreate an Amazon FSx for Windows File Server file system on AWS and set the Active Directory domain for authentication. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create an Amazon FSx for Windows File Server file system on AWS and set the Active Directory domain for authentication.

Explanation

Amazon FSx for Windows File Server provides fully managed SMB/Windows shared file storage. Amazon FSx provides fully managed third-party file systems. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SAA-C03 Question 98

Single page →
Topic 1 · Question 98

An image-processing company has a web application that users use to upload images. The application uploads the images into an Amazon S3 bucket. The company has set up S3 event notifications to publish the object creation events to an Amazon Simple Queue Service (Amazon SQS) standard queue. The SQS queue serves as the event source for an AWS Lambda function that processes the images and sends the results to users through email. Users report that they are receiving multiple email messages for every uploaded image. A solutions architect determines that SQS messages are invoking the Lambda function more than once, resulting in multiple email messages. What should the solutions architect do to resolve this issue with the LEAST operational overhead?

  • ASet up long polling in the SQS queue by increasing the ReceiveMessage wait time to 30 seconds.
  • BChange the SQS standard queue to an SQS FIFO queue. Use the message deduplication ID to discard duplicate messages.
  • CIncrease the visibility timeout in the SQS queue to a value that is greater than the total of the function timeout and the batch window timeout. (correct answer)
  • DModify the Lambda function to delete each message from the SQS queue immediately after the message is read before processing.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Increase the visibility timeout in the SQS queue to a value that is greater than the total of the function timeout and the batch window timeout.

Explanation

AWS Batch schedules and runs batch computing jobs at any scale without managing clusters. Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes.

SAA-C03 Question 99

Single page →
Topic 1 · Question 99

A company is implementing a shared storage solution for a gaming application that is hosted in an on-premises data center. The company needs the ability to use Lustre clients to access data. The solution must be fully managed. Which solution meets these requirements?

  • ACreate an AWS Storage Gateway file gateway. Create a file share that uses the required client protocol. Connect the application server to the file share.
  • BCreate an Amazon EC2 Windows instance. Install and configure a Windows file share role on the instance. Connect the application server to the file share.
  • CCreate an Amazon Elastic File System (Amazon EFS) file system, and configure it to support Lustre. Attach the file system to the origin server. Connect the application server to the file system.
  • DCreate an Amazon FSx for Lustre file system. Attach the file system to the origin server. Connect the application server to the file system. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create an Amazon FSx for Lustre file system. Attach the file system to the origin server. Connect the application server to the file system.

Explanation

Amazon FSx for Lustre delivers high-performance file storage for compute-intensive workloads. Amazon FSx provides fully managed third-party file systems.

SAA-C03 Question 100

Single page →
Topic 1 · Question 100

A company's containerized application runs on an Amazon EC2 instance. The application needs to download security certificates before it can communicate with other business applications. The company wants a highly secure solution to encrypt and decrypt the certificates in near real time. The solution also needs to store data in highly available storage after the data is encrypted. Which solution will meet these requirements with the LEAST operational overhead?

  • ACreate AWS Secrets Manager secrets for encrypted certificates. Manually update the certificates as needed. Control access to the data by using fine-grained IAM access.
  • BCreate an AWS Lambda function that uses the Python cryptography library to receive and perform encryption operations. Store the function in an Amazon S3 bucket.
  • CCreate an AWS Key Management Service (AWS KMS) customer managed key. Allow the EC2 role to use the KMS key for encryption operations. Store the encrypted data on Amazon S3. (correct answer)
  • DCreate an AWS Key Management Service (AWS KMS) customer managed key. Allow the EC2 role to use the KMS key for encryption operations. Store the encrypted data on Amazon Elastic Block Store (Amazon EBS) volumes.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an AWS Key Management Service (AWS KMS) customer managed key. Allow the EC2 role to use the KMS key for encryption operations. Store the encrypted data on Amazon S3.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon S3 provides durable, scalable object storage that is fully managed. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

Showing questions 81–100 of 1019 · Page 5 of 51