AWS Certified Solutions Architect – Associate practice questions

1. Question 1 of 25

   Select 2

   A company wants to migrate an on-premises data center to AWS. The data center hosts an SFTP server that stores its data on an NFS-based file system. The server holds 200 GB of data that needs to be transferred. The server must be hosted on an Amazon EC2 instance that uses an Amazon Elastic File System (Amazon EFS) file system. Which combination of steps should a solutions architect take to automate this task? (Choose two.)

   • ALaunch the EC2 instance into the same Availability Zone as the EFS file system.
   • BInstall an AWS DataSync agent in the on-premises data center.
   • CCreate a secondary Amazon Elastic Block Store (Amazon EBS) volume on the EC2 instance for the data.
   • DManually use an operating system copy command to push the data to the EC2 instance.
   • EUse AWS DataSync to create a suitable location configuration for the on-premises SFTP server.

   Show answer

   Correct answer: B, E

   How others answered

   • BE56%
   • AB40%

   Only 56% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Answer and HOW-TO B. Install an AWS DataSync agent in the on-premises data center. E. Use AWS DataSync to create a suitable location configuration for the on-premises SFTP server. To automate the process of transferring the data from the on-premises SFTP server to an EC2 instance with an EFS file system, you can use AWS DataSync. AWS DataSync is a fully managed data transfer service that simplifies, automates, and accelerates transferring data between on-premises storage systems and Amazon S3, Amazon EFS, or Amazon FSx for Windows File Server. To use AWS DataSync for this task, you should first install an AWS DataSync agent in the on-premises data center. This agent is a lightweight software application that you install on your on-premises data source. The agent communicates with the AWS DataSync service to transfer data between the data source and target locations.

   Adapted from community discussion by Buruguduystunstugudunstuy · 2022-12-21 · 69 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

   1. B

      Buruguduystunstugudunstuy

      2022-12-21

      Selected B, E69 upvotes

      Answer and HOW-TO B. Install an AWS DataSync agent in the on-premises data center. E. Use AWS DataSync to create a suitable location configuration for the on-premises SFTP server. To automate the process of transferring the data from the on-premises SFTP server to an EC2 instance with an EFS file system, you can use AWS DataSync. AWS DataSync is a fully managed data transfer service that simplifies, automates, and accelerates transferring data between on-premises storage systems and Amazon S3, Amazon EFS, or Amazon FSx for Windows File Server. To use AWS DataSync for this task, you should first install an AWS DataSync agent in the on-premises data center. This agent is a lightweight software application that you install on your on-premises data source. The agent communicates with the AWS DataSync service to transfer data between the data source and target locations.

   2. B

      Buruguduystunstugudunstuy

      2022-12-21

      21 upvotes

      Next, you should use AWS DataSync to create a suitable location configuration for the on-premises SFTP server. A location represents a data source or a data destination in an AWS DataSync task. You can create a location for the on-premises SFTP server by specifying the IP address, the path to the data, and the necessary credentials to access the data. Once you have created the location configuration for the on-premises SFTP server, you can use AWS DataSync to transfer the data to the EC2 instance with the EFS file system. AWS DataSync handles the data transfer process automatically and efficiently, transferring the data at high speeds and minimizing downtime.

   3. B

      Buruguduystunstugudunstuy

      2022-12-21

      15 upvotes

      Explanation of other options A. Launch the EC2 instance into the same Availability Zone as the EFS file system. This option is not wrong, but it is not directly related to automating the process of transferring the data from the on-premises SFTP server to the EC2 instance with the EFS file system. Launching the EC2 instance into the same Availability Zone as the EFS file system can improve the performance and reliability of the file system, as it reduces the latency between the EC2 instance and the file system. However, it is not necessary for automating the data transfer process.

   4. L

      Lalo

      2023-02-17

      16 upvotes

      CORRECT ANSWER: B&E Steps 4 &5 https://aws.amazon.com/datasync/getting-started/?nc1=h_ls

2. Question 2 of 25

   Select 2

   A social media company allows users to upload images to its website. The website runs on Amazon EC2 instances. During upload requests, the website resizes the images to a standard size and stores the resized images in Amazon S3. Users are experiencing slow upload requests to the website. The company needs to reduce coupling within the application and improve website performance. A solutions architect must design the most operationally efficient process for image uploads. Which combination of actions should the solutions architect take to meet these requirements? (Choose two.)

   • AConfigure the application to upload images to S3 Glacier.
   • BConfigure the web server to upload the original images to Amazon S3.
   • CConfigure the application to upload images directly from each user's browser to Amazon S3 through the use of a presigned URL
   • DConfigure S3 Event Notifications to invoke an AWS Lambda function when an image is uploaded. Use the function to resize the image.
   • ECreate an Amazon EventBridge (Amazon CloudWatch Events) rule that invokes an AWS Lambda function on a schedule to resize uploaded images.

   Show answer

   Correct answer: C, D

   How others answered

   • CD53%
   • BD45%

   Only 53% agreed on this answer — treat it as contested rather than settled.

   Explanation

   To meet the requirements of reducing coupling within the application and improving website performance, the solutions architect should consider taking the following actions: C. Configure the application to upload images directly from each user's browser to Amazon S3 through the use of a pre-signed URL. This will allow the application to upload images directly to S3 without having to go through the web server, which can reduce the load on the web server and improve performance. D. Configure S3 Event Notifications to invoke an AWS Lambda function when an image is uploaded. Use the function to resize the image. This will allow the application to resize images asynchronously, rather than having to do it synchronously during the upload request, which can improve performance.

   Adapted from community discussion by Buruguduystunstugudunstuy · 2022-12-21 · 59 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

   1. B

      Buruguduystunstugudunstuy

      2022-12-21

      Selected C, D59 upvotes

      To meet the requirements of reducing coupling within the application and improving website performance, the solutions architect should consider taking the following actions: C. Configure the application to upload images directly from each user's browser to Amazon S3 through the use of a pre-signed URL. This will allow the application to upload images directly to S3 without having to go through the web server, which can reduce the load on the web server and improve performance. D. Configure S3 Event Notifications to invoke an AWS Lambda function when an image is uploaded. Use the function to resize the image. This will allow the application to resize images asynchronously, rather than having to do it synchronously during the upload request, which can improve performance.

   2. J

      jdr75

      2023-04-05

      16 upvotes

      presigned URL is for download the data from S3, not for uploads, so the user does not upload anything. C is no correct.

   3. Y

      Yelizaveta

      2023-02-12

      7 upvotes

      Here it means to decouple the processes, so that the web server don't have to do the resizing, so it doesn't slow down. The customers access the web server, so the web server have to be involved in the process, and how the others already wrote, the pre-signed URL is not the right solution because, of the explanation you can read in the other comments. And additional! "Configure the application to upload images directly from EACH USER'S BROWSER to Amazon S3 through the use of a pre-signed URL" I am not an expert, but I can't imagine that you can store an image that an user uploads in his browser etc.

   4. P

      PoisonBlack

      2023-04-29

      9 upvotes

      https://docs.aws.amazon.com/AmazonS3/latest/userguide/PresignedUrlUploadObject.html

3. Question 3 of 25

   Select 2

   A company uses a popular content management system (CMS) for its corporate website. However, the required patching and maintenance are burdensome. The company is redesigning its website and wants anew solution. The website will be updated four times a year and does not need to have any dynamic content available. The solution must provide high scalability and enhanced security. Which combination of changes will meet these requirements with the LEAST operational overhead? (Choose two.)

   • AConfigure Amazon CloudFront in front of the website to use HTTPS functionality.
   • BDeploy an AWS WAF web ACL in front of the website to provide HTTPS functionality.
   • CCreate and deploy an AWS Lambda function to manage and serve the website content.
   • DCreate the new website and an Amazon S3 bucket. Deploy the website on the S3 bucket with static website hosting enabled.
   • ECreate the new website. Deploy the website by using an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer.

   Show answer

   Correct answer: A, D

   How others answered

   • AD89%

   Explanation

   A -> We can configure CloudFront to require HTTPS from clients (enhanced security) https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html D -> storing static website on S3 provides scalability and less operational overhead, then configuration of Application LB and EC2 instances (hence E is out) B is out since AWS WAF Web ACL does not to provide HTTPS functionality, but to protect HTTPS only.

   Adapted from community discussion by palermo777 · 2022-10-20 · 36 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

   1. P

      palermo777

      2022-10-20

      36 upvotes

      A -> We can configure CloudFront to require HTTPS from clients (enhanced security) https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html D -> storing static website on S3 provides scalability and less operational overhead, then configuration of Application LB and EC2 instances (hence E is out) B is out since AWS WAF Web ACL does not to provide HTTPS functionality, but to protect HTTPS only.

   2. S

      Six_Fingered_Jose

      2022-10-26

      Selected A, D10 upvotes

      agree with A and D static website -> obviously S3, and S3 is super scalable CDN -> CloudFront obviously as well, and with HTTPS security is enhanced. B does not make sense because you are not replacing the CDN with anything, E works too but takes too much effort and compared to S3, S3 still wins in term of scalability. plus why use EC2 when you are only hosting static website

   3. O

      ocbn3wby

      2022-11-27

      6 upvotes

      Please provide informed answers. You are truly correct, but in this case, there is no specific need to host the website/cms on EC2 + ALB. It only requires static website - which can be achieved with scalable S3.

   4. C

      cookieMr

      2023-06-22

      Selected A, D2 upvotes

      A. Amazon CloudFront provides scalable content delivery with HTTPS functionality, meeting security and scalability requirements. D. Deploying the website on an Amazon S3 bucket with static website hosting reduces operational overhead by eliminating server maintenance and patching. Why other options are incorrect: B. AWS WAF does not provide HTTPS functionality or address patching and maintenance. C. Using AWS Lambda introduces complexity and does not directly address patching and maintenance. E. Managing EC2 instances and an Application Load Balancer increases operational overhead and does not minimize patching and maintenance tasks. In summary, configuring Amazon CloudFront for HTTPS and deploying on Amazon S3 with static website hosting provide security, scalability, and reduced operational overhead.

4. Question 4 of 25

   A global company is using Amazon API Gateway to design REST APIs for its loyalty club users in the us-east-1 Region and the ap-southeast-2 Region. A solutions architect must design a solution to protect these API Gateway managed REST APIs across multiple accounts from SQL injection and cross-site scripting attacks. Which solution will meet these requirements with the LEAST amount of administrative effort?

   • ASet up AWS WAF in both Regions. Associate Regional web ACLs with an API stage.
   • BSet up AWS Firewall Manager in both Regions. Centrally configure AWS WAF rules.
   • CSet up AWS Shield in bath Regions. Associate Regional web ACLs with an API stage.
   • DSet up AWS Shield in one of the Regions. Associate Regional web ACLs with an API stage.

   Show answer

   Correct answer: B

   How others answered

   • B69%
   • A30%

   Only 69% agreed on this answer — treat it as contested rather than settled.

   Explanation

   If you want to use AWS WAF across accounts, accelerate WAF configuration, automate the protection of new resources, use Firewall Manager with AWS WAF

   Adapted from community discussion by Gil80 · 2022-11-08 · 42 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

   1. G

      Gil80

      2022-11-08

      Selected B42 upvotes

      If you want to use AWS WAF across accounts, accelerate WAF configuration, automate the protection of new resources, use Firewall Manager with AWS WAF

   2. N

      Nigma

      2022-11-08

      18 upvotes

      B Using AWS WAF has several benefits. Additional protection against web attacks using criteria that you specify. You can define criteria using characteristics of web requests such as the following: Presence of SQL code that is likely to be malicious (known as SQL injection). Presence of a script that is likely to be malicious (known as cross-site scripting). AWS Firewall Manager simplifies your administration and maintenance tasks across multiple accounts and resources for a variety of protections. https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html

   3. B

      baku98

      2023-12-09

      8 upvotes

      B is wrong: AWS Firewall Manager cannot create security policies across regions. Q: Can I create security policies across regions? No, AWS Firewall Manager security policies are region specific. Each Firewall Manager policy can only include resources available in that specified AWS Region. You can create a new policy for each region where you operate. https://aws.amazon.com/firewall-manager/faqs/#:~:text=No%2C%20AWS%20Firewall%20Manager%20security,in%20that%20specified%20AWS%20Region.

   4. L

      lofzee

      2024-05-27

      9 upvotes

      wtf? the question says "to protect these API Gateway managed REST APIs across multiple accounts from SQL injection and cross-site scripting attack"

5. Question 5 of 25

   A company has implemented a self-managed DNS solution on three Amazon EC2 instances behind a Network Load Balancer (NLB) in the us-west-2 Region. Most of the company's users are located in the United States and Europe. The company wants to improve the performance and availability of the solution. The company launches and configures three EC2 instances in the eu-west-1 Region and adds the EC2 instances as targets for a new NLB. Which solution can the company use to route traffic to all the EC2 instances?

   • ACreate an Amazon Route 53 geolocation routing policy to route requests to one of the two NLBs. Create an Amazon CloudFront distribution. Use the Route 53 record as the distribution’s origin.
   • BCreate a standard accelerator in AWS Global Accelerator. Create endpoint groups in us-west-2 and eu-west-1. Add the two NLBs as endpoints for the endpoint groups.
   • CAttach Elastic IP addresses to the six EC2 instances. Create an Amazon Route 53 geolocation routing policy to route requests to one of the six EC2 instances. Create an Amazon CloudFront distribution. Use the Route 53 record as the distribution's origin.
   • DReplace the two NLBs with two Application Load Balancers (ALBs). Create an Amazon Route 53 latency routing policy to route requests to one of the two ALBs. Create an Amazon CloudFront distribution. Use the Route 53 record as the distribution’s origin.

   Show answer

   Correct answer: B

   How others answered

   • B79%
   • A18%

   Explanation

   B is the correct one for seld manage DNS If need to use Route53, ALB (layar 7 ) needs to be used as end points for 2 reginal x 3 EC2s, if it the case answer would be the option 4

   Adapted from community discussion by dokaedu · 2022-10-29 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

   1. D

      dokaedu

      2022-10-29

      21 upvotes

      B is the correct one for seld manage DNS If need to use Route53, ALB (layar 7 ) needs to be used as end points for 2 reginal x 3 EC2s, if it the case answer would be the option 4

   2. M

      Masakichen

      2023-11-23

      8 upvotes

      Option B. Create a standard accelerator in AWS Global Accelerator. Establish endpoint groups in us-west-2 and eu-west-1. Add two NLBs as endpoints of the endpoint group. AWS Global Accelerator is a network service that can provide a global traffic management solution. By creating a standard accelerator in AWS Global Accelerator, you can guide user traffic to the endpoint closest to them, thereby improving the performance and availability of the application. In this case, you can establish endpoint groups in the us-west-2 and eu-west-1 regions, and add two NLBs as endpoints. In this way, no matter where the user is located, their requests will be routed to the EC2 instance closest to them, thereby improving the performance and availability of DNS resolution. In addition, this design can also provide flexibility and scalability to handle a large amount of traffic. Therefore, this solution can meet your needs.

   3. G

      Guru4Cloud

      2023-08-16

      Selected B6 upvotes

      B is the best solution to route traffic to all the EC2 instances across regions. The key reasons are: AWS Global Accelerator allows routing traffic to endpoints in multiple AWS Regions. It uses the AWS global network to optimize availability and performance. Creating an accelerator with endpoint groups in us-west-2 and eu-west-1 allows traffic to be distributed across both regions. Adding the NLBs in each region as endpoints allows the traffic to be routed to the EC2 instances behind them. This provides improved performance and availability compared to just using Route 53 geolocation routing.

   4. C

      cookieMr

      2023-06-22

      Selected B4 upvotes

      Option B offers a global solution by utilizing Global Accelerator. By creating a standard accelerator and configuring endpoint groups in both Regions, the company can route traffic to all the EC2 across multiple regions. Adding the two NLBs as endpoints ensures that traffic is distributed effectively. Option A does not directly address the requirement of routing traffic to all EC2 instances. It focuses on routing based on geolocation and using CloudFront as a distribution, which may not achieve the desired outcome. Option C involves managing Elastic IP addresses and routing based on geolocation. However, it may not provide the same level of performance and availability as AWS Global Accelerator. Option D focuses on ALBs and latency-based routing. While it can be a valid solution, it does not utilize AWS Global Accelerator and may require more configuration and management compared to option B.

6. Question 6 of 25

   Select 2

   A company runs its two-tier ecommerce website on AWS. The web tier consists of a load balancer that sends traffic to Amazon EC2 instances. The database tier uses an Amazon RDS DB instance. The EC2 instances and the RDS DB instance should not be exposed to the public internet. The EC2 instances require internet access to complete payment processing of orders through a third-party web service. The application must be highly available. Which combination of configuration options will meet these requirements? (Choose two.)

   • AUse an Auto Scaling group to launch the EC2 instances in private subnets. Deploy an RDS Multi-AZ DB instance in private subnets.
   • BConfigure a VPC with two private subnets and two NAT gateways across two Availability Zones. Deploy an Application Load Balancer in the private subnets.
   • CUse an Auto Scaling group to launch the EC2 instances in public subnets across two Availability Zones. Deploy an RDS Multi-AZ DB instance in private subnets.
   • DConfigure a VPC with one public subnet, one private subnet, and two NAT gateways across two Availability Zones. Deploy an Application Load Balancer in the public subnet. D. Configure a VPC with two public subnets, two private subnets, and two NAT gateways across two Availability Zones. Deploy an Application Load Balancer in the public subnets.

   Show answer

   Correct answer: A, D

   How others answered

   • AD62%
   • AB19%

   Only 62% agreed on this answer — treat it as contested rather than settled.

   Explanation

   A and E! Application has to be highly available while the instance and database should not be exposed to the public internet, but the instances still requires access to the internet. NAT gateway has to be deployed in public subnets in this case while instances and database remain in private subnets in the VPC, therefore answer is (A) and (E). https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html If the instances did not require access to the internet, then the answer could have been (B) to use a private NAT gateway and keep it in the private subnets to communicate only to the VPCs. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html

   Adapted from community discussion by HayLLlHuK · 2023-01-02 · 30 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

   1. H

      HayLLlHuK

      2023-01-02

      30 upvotes

      A and E! Application has to be highly available while the instance and database should not be exposed to the public internet, but the instances still requires access to the internet. NAT gateway has to be deployed in public subnets in this case while instances and database remain in private subnets in the VPC, therefore answer is (A) and (E). https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html If the instances did not require access to the internet, then the answer could have been (B) to use a private NAT gateway and keep it in the private subnets to communicate only to the VPCs. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html

   2. M

      mabotega

      2022-11-12

      Selected A, D28 upvotes

      Answer A for: The EC2 instances and the RDS DB instance should not be exposed to the public internet. Answer D for: The EC2 instances require internet access to complete payment processing of orders through a third-party web service. Answer A for: The application must be highly available.

   3. R

      ruqui

      2023-05-21

      8 upvotes

      B option wrong! NAT gateways must be created in public subnets!!

   4. R

      rlamberti

      2023-10-20

      Selected A, D5 upvotes

      AE Two public subnets = two addresses for ALB = high availability two private subnets with NAT gateway to allow eggress traffic to internet - application tier will be able to complete payment

7. Question 7 of 25

   A media company is evaluating the possibility of moving its systems to the AWS Cloud. The company needs at least 10 TB of storage with the maximum possible I/O performance for video processing, 300 TB of very durable storage for storing media content, and 900 TB of storage to meet requirements for archival media that is not in use anymore. Which set of services should a solutions architect recommend to meet these requirements?

   • AAmazon EBS for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage
   • BAmazon EBS for maximum performance, Amazon EFS for durable data storage, and Amazon S3 Glacier for archival storage
   • CAmazon EC2 instance store for maximum performance, Amazon EFS for durable data storage, and Amazon S3 for archival storage
   • DAmazon EC2 instance store for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage

   Show answer

   Correct answer: D

   How others answered

   • D58%
   • A42%

   Only 58% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Max instance store possible at this time is 30TB for NVMe which has the higher I/O compared to EBS. is4gen.8xlarge 4 x 7,500 GB (30 TB) NVMe SSD https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#instance-store-volumes

   Adapted from community discussion by Sauran · 2022-10-19 · 38 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

   1. S

      Sauran

      2022-10-19

      Selected D38 upvotes

      Max instance store possible at this time is 30TB for NVMe which has the higher I/O compared to EBS. is4gen.8xlarge 4 x 7,500 GB (30 TB) NVMe SSD https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#instance-store-volumes

   2. P

      pentium75

      2023-12-26

      14 upvotes

      "The company's requirements were to have the maximum possible I/O performance and required durable data storage." Yeah, but not for the same data. 10 TB "maximum possible I/O performance" for processing (= temporary) 300 TB "very durable" (= S3) 900 TB "for archival" (= Glacier)

   3. G

      Guru4Cloud

      2023-08-16

      Selected D8 upvotes

      The best set of services to meet the storage requirements are: D) Amazon EC2 instance store for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage The rationale is: EC2 instance store provides the highest performance storage for I/O intensive video processing. S3 provides durable, scalable object storage for the media content library. Glacier provides the lowest cost archival storage for media no longer in active use. EBS volumes don't offer the IOPS needed for video processing. EFS file storage isn't as durable or cost effective for large media libraries as S3. By matching each storage need with the optimal storage service - EC2, S3, Glacier - this combination meets the performance, durability, and cost requirements for each storage use case.

   4. S

      Six_Fingered_Jose

      2022-10-26

      Selected D8 upvotes

      agree with D, since it is only used for video processing instance store should be the fastest here (being ephemeral shouldnt be an issue because they are moving the data to S3 after processing)

8. Question 8 of 25

   A company wants to run applications in containers in the AWS Cloud. These applications are stateless and can tolerate disruptions within the underlying infrastructure. The company needs a solution that minimizes cost and operational overhead. What should a solutions architect do to meet these requirements?

   • AUse Spot Instances in an Amazon EC2 Auto Scaling group to run the application containers.
   • BUse Spot Instances in an Amazon Elastic Kubernetes Service (Amazon EKS) managed node group.
   • CUse On-Demand Instances in an Amazon EC2 Auto Scaling group to run the application containers.
   • DUse On-Demand Instances in an Amazon Elastic Kubernetes Service (Amazon EKS) managed node group.

   Show answer

   Correct answer: B

   How others answered

   • B74%
   • A25%

   Only 74% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Option B is the recommended solution. Using Spot Instances within an Amazon EKS managed node group allows you to run containers in a managed Kubernetes environment while taking advantage of the cost savings offered by Spot Instances. Spot Instances provide access to spare EC2 capacity at significantly lower prices than On-Demand Instances. By utilizing Spot Instances in an EKS managed node group, you can reduce costs while maintaining high availability for your stateless applications. Option A suggests using Spot Instances in an EC2 Auto Scaling group, which is a valid approach. However, utilizing Amazon EKS provides a more streamlined and managed environment for running containers. Options C and D suggest using On-Demand Instances, which would provide stable capacity but may not be the most cost-effective solution for minimizing costs, as On-Demand Instances typically have higher prices compared to Spot Instances.

   Adapted from community discussion by cookieMr · 2023-06-23 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

   1. G

      GalileoEC2

      2023-03-07

      10 upvotes

      Answer is A: Amazon ECS: ECS itself is free, you pay only for Amazon EC2 resources you use. Amazon EKS: The EKS management layer incurs an additional cost of $144 per month per cluster. Advantages of Amazon ECS include: Spot instances: Because containers are immutable, you can run many workloads using Amazon EC2 Spot Instances (which can be shut down with no advance notice) and save 90% on on-demand instance costs.

   2. C

      cookieMr

      2023-06-23

      Selected B6 upvotes

      Option B is the recommended solution. Using Spot Instances within an Amazon EKS managed node group allows you to run containers in a managed Kubernetes environment while taking advantage of the cost savings offered by Spot Instances. Spot Instances provide access to spare EC2 capacity at significantly lower prices than On-Demand Instances. By utilizing Spot Instances in an EKS managed node group, you can reduce costs while maintaining high availability for your stateless applications. Option A suggests using Spot Instances in an EC2 Auto Scaling group, which is a valid approach. However, utilizing Amazon EKS provides a more streamlined and managed environment for running containers. Options C and D suggest using On-Demand Instances, which would provide stable capacity but may not be the most cost-effective solution for minimizing costs, as On-Demand Instances typically have higher prices compared to Spot Instances.

   3. L

      Lalo

      2023-06-04

      10 upvotes

      USING SPOT INSTANCES WITH EKS https://ec2spotworkshops.com/using_ec2_spot_instances_with_eks.html

   4. B

      Buruguduystunstugudunstuy

      2022-12-28

      Selected B6 upvotes

      The correct answer is B. To minimize cost and operational overhead, the solutions architect should use Spot Instances in an Amazon Elastic Kubernetes Service (Amazon EKS) managed node group to run the application containers. Amazon EKS is a fully managed service that makes it easy to run Kubernetes on AWS. By using a managed node group, the company can take advantage of the operational benefits of Amazon EKS while minimizing the operational overhead of managing the Kubernetes infrastructure. Spot Instances provide a cost-effective way to run stateless, fault-tolerant applications in containers, making them a good fit for the company's requirements.

9. Question 9 of 25

   A company runs an Oracle database on premises. As part of the company’s migration to AWS, the company wants to upgrade the database to the most recent available version. The company also wants to set up disaster recovery (DR) for the database. The company needs to minimize the operational overhead for normal operations and DR setup. The company also needs to maintain access to the database's underlying operating system. Which solution will meet these requirements?

   • AMigrate the Oracle database to an Amazon EC2 instance. Set up database replication to a different AWS Region.
   • BMigrate the Oracle database to Amazon RDS for Oracle. Activate Cross-Region automated backups to replicate the snapshots to another AWS Region.
   • CMigrate the Oracle database to Amazon RDS Custom for Oracle. Create a read replica for the database in another AWS Region.
   • DMigrate the Oracle database to Amazon RDS for Oracle. Create a standby database in another Availability Zone.

   Show answer

   Correct answer: C

   How others answered

   • C51%
   • A39%

   Only 51% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Option C since RDS Custom has access to the underlying OS and it provides less operational overhead. Also, a read replica in another Region can be used for DR activities. https://aws.amazon.com/blogs/database/implementing-a-disaster-recovery-strategy-with-amazon-rds/

   Adapted from community discussion by ArielSchivo · 2022-11-09 · 45 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

   1. A

      ArielSchivo

      2022-11-09

      45 upvotes

      Option C since RDS Custom has access to the underlying OS and it provides less operational overhead. Also, a read replica in another Region can be used for DR activities. https://aws.amazon.com/blogs/database/implementing-a-disaster-recovery-strategy-with-amazon-rds/

   2. K

      KalarAzar

      2023-06-15

      23 upvotes

      You can't create cross-Region replicas in RDS Custom for Oracle: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-rr.html#custom-rr.limitations

   3. B

      brushek

      2022-10-13

      Selected C21 upvotes

      It should be C: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-custom.html and https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/working-with-custom-oracle.html

   4. W

      wsdasdasdqwdaw

      2023-10-27

      10 upvotes

      If the source DB instance fails, you can promote your Read Replica to a standalone source server.

10. Question 10 of 25

    A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing and new data by using SL. The company stores the data in an Amazon S3 bucket. The data requires encryption and must be replicated to a different AWS Region. Which solution will meet these requirements with the LEAST operational overhead?

    • ACreate a new S3 bucket. Load the data into the new S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with AWS KMS multi-Region kays (SSE-KMS). Use Amazon Athena to query the data.
    • BCreate a new S3 bucket. Load the data into the new S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon RDS to query the data.
    • CLoad the data into the existing S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Use Amazon Athena to query the data.
    • DLoad the data into the existing S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Use Amazon RDS to query the data.

    Show answer

    Correct answer: C

    How others answered

    • C54%
    • A46%

    Only 54% agreed on this answer — treat it as contested rather than settled.

    Explanation

    SSE-KMS vs SSE-S3 - The last seems to have less overhead (as the keys are automatically generated by S3 and applied on data at upload, and don't require further actions. KMS provides more flexibility, but in turn involves a different service, which finally is more "complex" than just managing one (S3). So A and B are excluded. If you are in doubt, you are having 2 buckets in A and B, while just keeping one in C and D. https://s3browser.com/server-side-encryption-types.aspx Decide between C and D is deciding on Athena or RDS. RDS is a relational db, and we have documents on S3, which is the use case for Athena. Athena is also serverless, which eliminates the need of controlling the underlying infrastructure and capacity. So C is the answer. https://aws.amazon.com/athena/

    Adapted from community discussion by 123jhl0 · 2022-10-20 · 63 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. 1

       123jhl0

       2022-10-20

       Selected C63 upvotes

       SSE-KMS vs SSE-S3 - The last seems to have less overhead (as the keys are automatically generated by S3 and applied on data at upload, and don't require further actions. KMS provides more flexibility, but in turn involves a different service, which finally is more "complex" than just managing one (S3). So A and B are excluded. If you are in doubt, you are having 2 buckets in A and B, while just keeping one in C and D. https://s3browser.com/server-side-encryption-types.aspx Decide between C and D is deciding on Athena or RDS. RDS is a relational db, and we have documents on S3, which is the use case for Athena. Athena is also serverless, which eliminates the need of controlling the underlying infrastructure and capacity. So C is the answer. https://aws.amazon.com/athena/

    2. D

       dokaedu

       2022-10-30

       29 upvotes

       Answer is A: Amazon S3 Bucket Keys reduce the cost of Amazon S3 server-side encryption using AWS Key Management Service (SSE-KMS). This new bucket-level key for SSE can reduce AWS KMS request costs by up to 99 percent by decreasing the request traffic from Amazon S3 to AWS KMS. With a few clicks in the AWS Management Console, and without any changes to your client applications, you can configure your bucket to use an S3 Bucket Key for AWS KMS-based encryption on new objects. The Existing S3 bucket might have uncrypted data - encryption will apply new data received after the applying of encryption on the new bucket.

    3. K

       kels1

       2023-04-18

       13 upvotes

       Crap man! I hate these at 51/49 % where's the truth man? I'm just here to study... lol :)

    4. P

       pentium75

       2023-12-26

       Selected C7 upvotes

       Data in S3 is queried with Athena, not RDS, thus B and D are out. A requires a new bucket and loading data into that - Why, since data is already in S3? It says to enable CRR only after loading the data, so existing data won't be replicated anyway. C uses existing data (less operational overhead compared to loading data into a new bucket) and SSE-E3 (less operational overhead than SSE-KMS).

11. Question 11 of 25

    Select 2

    A company is migrating its on-premises PostgreSQL database to Amazon Aurora PostgreSQL. The on-premises database must remain online and accessible during the migration. The Aurora database must remain synchronized with the on-premises database. Which combination of actions must a solutions architect take to meet these requirements? (Choose two.)

    • ACreate an ongoing replication task.
    • BCreate a database backup of the on-premises database.
    • CCreate an AWS Database Migration Service (AWS DMS) replication server.
    • DConvert the database schema by using the AWS Schema Conversion Tool (AWS SCT).
    • ECreate an Amazon EventBridge (Amazon CloudWatch Events) rule to monitor the database synchronization.

    Show answer

    Correct answer: A, C

    How others answered

    • AC92%

    Explanation

    AWS Database Migration Service (AWS DMS) helps you migrate databases to AWS quickly and securely. The source database remains fully operational during the migration, minimizing downtime to applications that rely on the database. ... With AWS Database Migration Service, you can also continuously replicate data with low latency from any supported source to any supported target. https://aws.amazon.com/dms/

    Adapted from community discussion by 123jhl0 · 2022-10-20 · 33 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. 1

       123jhl0

       2022-10-20

       Selected A, C33 upvotes

       AWS Database Migration Service (AWS DMS) helps you migrate databases to AWS quickly and securely. The source database remains fully operational during the migration, minimizing downtime to applications that rely on the database. ... With AWS Database Migration Service, you can also continuously replicate data with low latency from any supported source to any supported target. https://aws.amazon.com/dms/

    2. G

       gustavtd

       2023-01-02

       Selected A, C11 upvotes

       AC, here it is clearly shown https://docs.aws.amazon.com/zh_cn/dms/latest/sbs/chap-manageddatabases.postgresql-rds-postgresql.html

    3. B

       Buruguduystunstugudunstuy

       2022-12-28

       Selected A, C5 upvotes

       To meet the requirements of maintaining an online and accessible on-premises database while migrating to Amazon Aurora PostgreSQL and keeping the databases synchronized, a solutions architect should take the following actions: Option A. Create an ongoing replication task. This will allow the architect to continuously replicate data from the on-premises database to the Aurora database. Option C. Create an AWS Database Migration Service (AWS DMS) replication server. This will allow the architect to use AWS DMS to migrate data from the on-premises database to the Aurora database. AWS DMS can also be used to continuously replicate data between the two databases to keep them synchronized.

    4. C

       cookieMr

       2023-06-23

       Selected A, C4 upvotes

       These two actions (AC) will help meet the requirements of migrating the on-premises PostgreSQL database to Amazon Aurora PostgreSQL while keeping the on-premises database accessible and synchronized with the Aurora database. The ongoing replication task will ensure continuous data replication between the on-premises database and Aurora. The AWS DMS replication server will facilitate the migration process and handle the data replication. B. Creating a database backup does not ensure ongoing synchronization. D. Converting the database schema does not address the requirement of synchronization. E. Creating an EventBridge rule only monitors synchronization, but doesn't handle migration. The correct combination is A and C.

12. Question 12 of 25

    A reporting team receives files each day in an Amazon S3 bucket. The reporting team manually reviews and copies the files from this initial S3 bucket to an analysis S3 bucket each day at the same time to use with Amazon QuickSight. Additional teams are starting to send more files in larger sizes to the initial S3 bucket. The reporting team wants to move the files automatically analysis S3 bucket as the files enter the initial S3 bucket. The reporting team also wants to use AWS Lambda functions to run pattern-matching code on the copied data. In addition, the reporting team wants to send the data files to a pipeline in Amazon SageMaker Pipelines. What should a solutions architect do to meet these requirements with the LEAST operational overhead?

    • ACreate a Lambda function to copy the files to the analysis S3 bucket. Create an S3 event notification for the analysis S3 bucket. Configure Lambda and SageMaker Pipelines as destinations of the event notification. Configure s3:ObjectCreated:Put as the event type.
    • BCreate a Lambda function to copy the files to the analysis S3 bucket. Configure the analysis S3 bucket to send event notifications to Amazon EventBridge (Amazon CloudWatch Events). Configure an ObjectCreated rule in EventBridge (CloudWatch Events). Configure Lambda and SageMaker Pipelines as targets for the rule.
    • CConfigure S3 replication between the S3 buckets. Create an S3 event notification for the analysis S3 bucket. Configure Lambda and SageMaker Pipelines as destinations of the event notification. Configure s3:ObjectCreated:Put as the event type.
    • DConfigure S3 replication between the S3 buckets. Configure the analysis S3 bucket to send event notifications to Amazon EventBridge (Amazon CloudWatch Events). Configure an ObjectCreated rule in EventBridge (CloudWatch Events). Configure Lambda and SageMaker Pipelines as targets for the rule.

    Show answer

    Correct answer: D

    How others answered

    • D77%

    Explanation

    i go for D here A and B says you are copying the file to another bucket using lambda, C an D just uses S3 replication to copy the files, They are doing exactly the same thing while C and D do not require setting up of lambda, which should be more efficient The question says the team is manually copying the files, automatically replicating the files should be the most efficient method vs manually copying or copying with lambda.

    Adapted from community discussion by Six_Fingered_Jose · 2022-10-26 · 31 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. S

       Six_Fingered_Jose

       2022-10-26

       Selected D31 upvotes

       i go for D here A and B says you are copying the file to another bucket using lambda, C an D just uses S3 replication to copy the files, They are doing exactly the same thing while C and D do not require setting up of lambda, which should be more efficient The question says the team is manually copying the files, automatically replicating the files should be the most efficient method vs manually copying or copying with lambda.

    2. V

       vipyodha

       2023-06-19

       22 upvotes

       yes d because of least operational overhead and also s3 event notification can only send to sns.sqs.and lambda , not to sagemaker.eventbridge can send to sagemaker

    3. A

       AntonioMinolfi

       2023-10-09

       Selected D11 upvotes

       Utilizing a lambda function would introduce additional operational overhead, eliminating options A and B. S3 replication offers a simpler setup and efficiently accomplishes the task. S3 notifications cannot use SageMaker as a destination; the permissible destinations include SQS, SNS, Lambda, and Eventbridge, so C is out.

    4. J

       JayBee65

       2022-12-22

       9 upvotes

       I think you are mis-interpreting the question. I think you need to use all files, including the ones provided by other teams, otherwise how can you tell what files to copy? I think the point of this statement is to show that more files are in use, and being copied at different times, rather than suggesting you need to differentiate between the two sources of files.

13. Question 13 of 25

    A company runs a web-based portal that provides users with global breaking news, local alerts, and weather updates. The portal delivers each user a personalized view by using mixture of static and dynamic content. Content is served over HTTPS through an API server running on an Amazon EC2 instance behind an Application Load Balancer (ALB). The company wants the portal to provide this content to its users across the world as quickly as possible. How should a solutions architect design the application to ensure the LEAST amount of latency for all users?

    • ADeploy the application stack in a single AWS Region. Use Amazon CloudFront to serve all static and dynamic content by specifying the ALB as an origin.
    • BDeploy the application stack in two AWS Regions. Use an Amazon Route 53 latency routing policy to serve all content from the ALB in the closest Region.
    • CDeploy the application stack in a single AWS Region. Use Amazon CloudFront to serve the static content. Serve the dynamic content directly from the ALB.
    • DDeploy the application stack in two AWS Regions. Use an Amazon Route 53 geolocation routing policy to serve all content from the ALB in the closest Region.

    Show answer

    Correct answer: A

    How others answered

    • A72%
    • B24%

    Only 72% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answer is A. Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content https://www.examtopics.com/discussions/amazon/view/81081-exam-aws-certified-solutions-architect-associate-saa-c02/

    Adapted from community discussion by huiy · 2022-10-14 · 34 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. H

       huiy

       2022-10-14

       Selected A34 upvotes

       Answer is A. Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content https://www.examtopics.com/discussions/amazon/view/81081-exam-aws-certified-solutions-architect-associate-saa-c02/

    2. P

       pentium75

       2023-12-26

       Selected A9 upvotes

       "Least amount of latency for all users" "across the world" = CloudFront, thus B and D are out. Also, deploying the stack in "two regions" would benefit those two regions, but not users "across the world". CloudFront can also cache dynamic content, thus A.

    3. L

       lofzee

       2024-05-28

       9 upvotes

       All it takes is for you to go to the Amazon Cloudfront webpage hosted by AWS where it tells you "Amazon CloudFront is a content delivery network (CDN) service that helps you distribute your static and dynamic content quickly and reliably with high speed". Answer is A bro. Your answer is B literally makes no sense. Do some studying.

    4. J

       Joxtat

       2023-01-17

       8 upvotes

       Amazon CloudFront speeds up distribution of your static and dynamic web content, such as .html, .css, .php, image, and media files. When users request your content, CloudFront delivers it through a worldwide network of edge locations that provide low latency and high performance.

14. Question 14 of 25

    Select 2

    A company wants to migrate its on-premises data center to AWS. According to the company's compliance requirements, the company can use only the ap-northeast-3 Region. Company administrators are not permitted to connect VPCs to the internet. Which solutions will meet these requirements? (Choose two.)

    • AUse AWS Control Tower to implement data residency guardrails to deny internet access and deny access to all AWS Regions except ap-northeast-3.
    • BUse rules in AWS WAF to prevent internet access. Deny access to all AWS Regions except ap-northeast-3 in the AWS account settings.
    • CUse AWS Organizations to configure service control policies (SCPS) that prevent VPCs from gaining internet access. Deny access to all AWS Regions except ap-northeast-3.
    • DCreate an outbound rule for the network ACL in each VPC to deny all traffic from 0.0.0.0/0. Create an IAM policy for each user to prevent the use of any AWS Region other than ap-northeast-3.
    • EUse AWS Config to activate managed rules to detect and alert for internet gateways and to detect and alert for new resources deployed outside of ap-northeast-3.

    Show answer

    Correct answer: A, C

    How others answered

    • AC77%

    Explanation

    A. By using Control Tower, the company can enforce data residency guardrails and restrict internet access for VPCs and denies access to all Regions except the required ap-northeast-3 Region. C. With Organizations, the company can configure SCPs to prevent VPCs from gaining internet access. By denying access to all Regions except ap-northeast-3, the company ensures that VPCs can only be deployed in the specified Region. Option B is incorrect because using rules in AWS WAF alone does not address the requirement of denying access to all AWS Regions except ap-northeast-3. Option D is incorrect because configuring outbound rules in network ACLs and IAM policies for users can help restrict traffic and access, but it does not enforce the company's requirement of denying access to all Regions except ap-northeast-3. Option E is incorrect because using AWS Config and managed rules can help detect and alert for specific resources and configurations, but it does not directly enforce the restriction of internet access or deny access to specific Regions.

    Adapted from community discussion by cookieMr · 2023-06-24 · 19 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. C

       cookieMr

       2023-06-24

       Selected A, C19 upvotes

       A. By using Control Tower, the company can enforce data residency guardrails and restrict internet access for VPCs and denies access to all Regions except the required ap-northeast-3 Region. C. With Organizations, the company can configure SCPs to prevent VPCs from gaining internet access. By denying access to all Regions except ap-northeast-3, the company ensures that VPCs can only be deployed in the specified Region. Option B is incorrect because using rules in AWS WAF alone does not address the requirement of denying access to all AWS Regions except ap-northeast-3. Option D is incorrect because configuring outbound rules in network ACLs and IAM policies for users can help restrict traffic and access, but it does not enforce the company's requirement of denying access to all Regions except ap-northeast-3. Option E is incorrect because using AWS Config and managed rules can help detect and alert for specific resources and configurations, but it does not directly enforce the restriction of internet access or deny access to specific Regions.

    2. S

       Six_Fingered_Jose

       2022-10-26

       Selected A, C20 upvotes

       agree with A and C https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_vpc.html#example_vpc_2

    3. R

       rjam

       2022-11-15

       11 upvotes

       https://aws.amazon.com/blogs/aws/new-for-aws-control-tower-region-deny-and-guardrails-to-help-you-meet-data-residency-requirements/ *Disallow internet access for an Amazon VPC instance managed by a customer

    4. M

       moaaz86

       2023-02-24

       4 upvotes

       From ChatGPT :) Control Tower: Can Yes, AWS Control Tower can implement data residency guardrails to deny internet access and restrict access to AWS Regions except for one. To restrict access to AWS regions, you can create a guardrail using AWS Organizations to deny access to all AWS regions except for the one that you want to allow. This can be done by creating an organizational policy that restricts access to specific AWS services and resources based on region. Config: Can(not). Yes, AWS Config can help you enforce restrictions on internet access and control access to specific AWS Regions using AWS Config Rules. It's worth noting that AWS Config is a monitoring service that provides continuous assessment of your AWS resources against desired configurations. While AWS Config can alert you when a configuration change occurs, it cannot directly restrict access to resources or enforce specific policies. For that, you may need to use other AWS services such as AWS Identity and Access Management (IAM), AWS Firewall Manager, or AWS Organizations.

15. Question 15 of 25

    A company uses a three-tier web application to provide training to new employees. The application is accessed for only 12 hours every day. The company is using an Amazon RDS for MySQL DB instance to store information and wants to minimize costs. What should a solutions architect do to meet these requirements?

    • AConfigure an IAM policy for AWS Systems Manager Session Manager. Create an IAM role for the policy. Update the trust relationship of the role. Set up automatic start and stop for the DB instance.
    • BCreate an Amazon ElastiCache for Redis cache cluster that gives users the ability to access the data from the cache when the DB instance is stopped. Invalidate the cache after the DB instance is started.
    • CLaunch an Amazon EC2 instance. Create an IAM role that grants access to Amazon RDS. Attach the role to the EC2 instance. Configure a cron job to start and stop the EC2 instance on the desired schedule.
    • DCreate AWS Lambda functions to start and stop the DB instance. Create Amazon EventBridge (Amazon CloudWatch Events) scheduled rules to invoke the Lambda functions. Configure the Lambda functions as event targets for the rules.

    Show answer

    Correct answer: D

    How others answered

    • D83%

    Explanation

    https://aws.amazon.com/blogs/database/schedule-amazon-rds-stop-and-start-using-aws-lambda/ It is option D. Option A could have been applicable had it been AWS Systems Manager State Manager & not AWS Systems Manager Session Manager

    Adapted from community discussion by study_aws1 · 2022-10-30 · 40 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • repost.aws documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. S

       study_aws1

       2022-10-30

       40 upvotes

       https://aws.amazon.com/blogs/database/schedule-amazon-rds-stop-and-start-using-aws-lambda/ It is option D. Option A could have been applicable had it been AWS Systems Manager State Manager & not AWS Systems Manager Session Manager

    2. A

       ArielSchivo

       2022-11-09

       13 upvotes

       Option A refers to Session Manager, not State Manager as you pointed, so it is wrong. Option D is valid.

    3. M

       Musti35

       2023-04-18

       Selected D5 upvotes

       In a typical development environment, dev and test databases are mostly utilized for 8 hours a day and sit idle when not in use. However, the databases are billed for the compute and storage costs during this idle time. To reduce the overall cost, Amazon RDS allows instances to be stopped temporarily. While the instance is stopped, you’re charged for storage and backups, but not for the DB instance hours. Please note that a stopped instance will automatically be started after 7 days. This post presents a solution using AWS Lambda and Amazon EventBridge that allows you to schedule a Lambda function to stop and start the idle databases with specific tags to save on compute costs. The second post presents a solution that accomplishes stop and start of the idle Amazon RDS databases using AWS Systems Manager.

    4. C

       cookieMr

       2023-06-24

       Selected D4 upvotes

       By using AWS Lambda functions triggered by Amazon EventBridge scheduled rules, the company can automate the start and stop actions for the Amazon RDS for MySQL DB instance based on the 12-hour access period. This allows them to minimize costs by only running the DB instance when it is needed. Option A is not the most suitable solution because it refers to IAM policies for AWS Systems Manager Session Manager, which is primarily used for interactive shell access to EC2 instances and does not directly address the requirement of starting and stopping the DB instance. Option B is not the most suitable solution because it suggests using Amazon ElastiCache for Redis as a cache cluster, which may not provide the desired cost optimization for the DB instance. Option C is not the most suitable solution because launching an EC2 instance and configuring cron jobs to start and stop it does not directly address the requirement of minimizing costs for the Amazon RDS DB instance.

16. Question 16 of 25

    A company sells ringtones created from clips of popular songs. The files containing the ringtones are stored in Amazon S3 Standard and are at least 128 KB in size. The company has millions of files, but downloads are infrequent for ringtones older than 90 days. The company needs to save money on storage while keeping the most accessed files readily available for its users. Which action should the company take to meet these requirements MOST cost-effectively?

    • AConfigure S3 Standard-Infrequent Access (S3 Standard-IA) storage for the initial storage tier of the objects.
    • BMove the files to S3 Intelligent-Tiering and configure it to move objects to a less expensive storage tier after 90 days.
    • CConfigure S3 inventory to manage objects and move them to S3 Standard-Infrequent Access (S3 Standard-1A) after 90 days.
    • DImplement an S3 Lifecycle policy that moves the objects from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-1A) after 90 days.

    Show answer

    Correct answer: D

    How others answered

    • D66%
    • B34%

    Only 66% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answer D Why Optoin D ? The Question talks about downloads are infrequent older than 90 days which means files less than 90 days are accessed frequently. Standard-Infrequent Access (S3 Standard-IA) needs a minimum 30 days if accessed before, it costs more. So to access the files frequently you need a S3 Standard . After 90 days you can move it to Standard-Infrequent Access (S3 Standard-IA) as its going to be less frequently accessed

    Adapted from community discussion by rjam · 2022-11-15 · 40 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. R

       rjam

       2022-11-15

       Selected D40 upvotes

       Answer D Why Optoin D ? The Question talks about downloads are infrequent older than 90 days which means files less than 90 days are accessed frequently. Standard-Infrequent Access (S3 Standard-IA) needs a minimum 30 days if accessed before, it costs more. So to access the files frequently you need a S3 Standard . After 90 days you can move it to Standard-Infrequent Access (S3 Standard-IA) as its going to be less frequently accessed

    2. M

       MutiverseAgent

       2023-07-19

       8 upvotes

       I am taking back my answer, the right is D) as the "Archive access tier" check present in the "Intelligent-Tiering Archive configurations" is for "S3 Glacier flexible retrieval" which is not instant retrieval.

    3. W

       Wajif

       2022-12-04

       7 upvotes

       S3 Intelligent tiering is used when the access frequency is not known. I think 128KB is a deflector.

    4. E

       egmiranda

       2023-01-27

       Selected D5 upvotes

       I think that the cost of transition from the Intelligent to the Standard infrequent should be considered. In option D, going from standard to standard infrequent is free. In option B, the transfer of the files after 90 days has a cost. The question asks for most-cost effectly, I think it is D

17. Question 17 of 25

    A solutions architect is optimizing a website for an upcoming musical event. Videos of the performances will be streamed in real time and then will be available on demand. The event is expected to attract a global online audience. Which service will improve the performance of both the real-time and on-demand streaming?

    • AAmazon CloudFront
    • BAWS Global Accelerator
    • CAmazon Route 53
    • DAmazon S3 Transfer Acceleration

    Show answer

    Correct answer: A

    How others answered

    • A75%
    • B25%

    Explanation

    A is right You can use CloudFront to deliver video on demand (VOD) or live streaming video using any HTTP origin Global Accelerator is a good fit for non-HTTP use cases, such as gaming (UDP), IoT (MQTT), or Voice over IP, as well as for HTTP use cases that specifically require static IP addresses

    Adapted from community discussion by Nigma · 2022-11-15 · 45 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. N

       Nigma

       2022-11-15

       45 upvotes

       A is right You can use CloudFront to deliver video on demand (VOD) or live streaming video using any HTTP origin Global Accelerator is a good fit for non-HTTP use cases, such as gaming (UDP), IoT (MQTT), or Voice over IP, as well as for HTTP use cases that specifically require static IP addresses

    2. M

       mr123dd

       2024-01-10

       Selected A12 upvotes

       website = http = cloudfront, if it is UDP, then global accelerator

    3. M

       mhka1988

       2023-10-20

       Selected A4 upvotes

       CloudFront offers several options for streaming your media to global viewers—both pre-recorded files and live events. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/IntroductionUseCases.html#IntroductionUseCasesStreaming For video on demand (VOD) streaming, you can use CloudFront to stream in common formats such as MPEG DASH, Apple HLS, Microsoft Smooth Streaming, and CMAF, to any device. For broadcasting a live stream, you can cache media fragments at the edge, so that multiple requests for the manifest file that delivers the fragments in the right order can be combined, to reduce the load on your origin server.

    4. C

       cookieMr

       2023-06-24

       4 upvotes

       Amazon CloudFront is a content delivery network (CDN) that can deliver both real-time and on-demand streaming. It caches content at edge locations worldwide, providing low-latency delivery to a global audience. B. AWS Global Accelerator: Global Accelerator is more suitable for non-HTTP use cases or when static IP addresses are required. C. Amazon Route 53: Route 53 is a DNS service and not designed specifically for streaming video. D. Amazon S3 Transfer Acceleration: S3 Transfer Acceleration improves upload speeds to Amazon S3 but does not directly enhance streaming performance.

18. Question 18 of 25

    A company has two applications: a sender application that sends messages with payloads to be processed and a processing application intended to receive the messages with payloads. The company wants to implement an AWS service to handle messages between the two applications. The sender application can send about 1,000 messages each hour. The messages may take up to 2 days to be processed: If the messages fail to process, they must be retained so that they do not impact the processing of any remaining messages. Which solution meets these requirements and is the MOST operationally efficient?

    • ASet up an Amazon EC2 instance running a Redis database. Configure both applications to use the instance. Store, process, and delete the messages, respectively.
    • BUse an Amazon Kinesis data stream to receive the messages from the sender application. Integrate the processing application with the Kinesis Client Library (KCL).
    • CIntegrate the sender and processor applications with an Amazon Simple Queue Service (Amazon SQS) queue. Configure a dead-letter queue to collect the messages that failed to process.
    • DSubscribe the processing application to an Amazon Simple Notification Service (Amazon SNS) topic to receive notifications to process. Integrate the sender application to write to the SNS topic.

    Show answer

    Correct answer: C

    How others answered

    • C89%

    Explanation

    Amazon SQS supports dead-letter queues (DLQ), which other queues (source queues) can target for messages that can't be processed (consumed) successfully. https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html

    Adapted from community discussion by aba2s · 2023-01-04 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. A

       aba2s

       2023-01-04

       Selected C13 upvotes

       Amazon SQS supports dead-letter queues (DLQ), which other queues (source queues) can target for messages that can't be processed (consumed) successfully. https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html

    2. C

       cookieMr

       2023-06-26

       Selected C6 upvotes

       By integrating both the sender and processor applications with an SQS, messages can be reliably sent from the sender to the processor application for processing. SQS provides at-least-once delivery, ensuring that messages are not lost in transit. If a message fails to process, it can be retained in the queue and retried without impacting the processing of other messages. Configuring a DLQ allows for the collection of messages that repeatedly fail to process, providing visibility into failed messages for troubleshooting and analysis. A is not the optimal choice as it involves managing and configuring an EC2 instance running a Redis, which adds operational overhead and maintenance requirements. B is not the most operationally efficient solution as it introduces additional complexity by using Amazon Kinesis data streams and integrating with the Kinesis Client Library for message processing. D, using SNS, is not the best fit for the scenario as it is more suitable for pub/sub messaging and broadcasting notifications rather than the specific requirement of message processing between two applications.

    3. O

       ocbn3wby

       2022-12-04

       Selected C5 upvotes

       This matches mostly the job of Dead Letter Q: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html vs https://docs.aws.amazon.com/streams/latest/dev/shared-throughput-kcl-consumers.html

    4. D

       dkw2342

       2024-02-29

       4 upvotes

       C) This option works. There is a 12h maximum visibility timeout, but: "If you don't know how long it takes to process a message, create a heartbeat for your consumer process: Specify the initial visibility timeout (for example, 2 minutes) and then—as long as your consumer still works on the message—keep extending the visibility timeout by 2 minutes every minute." https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/working-with-messages.html

19. Question 19 of 25

    A solutions architect must design a solution that uses Amazon CloudFront with an Amazon S3 origin to store a static website. The company’s security policy requires that all website traffic be inspected by AWS WAF. How should the solutions architect comply with these requirements?

    • AConfigure an S3 bucket policy to accept requests coming from the AWS WAF Amazon Resource Name (ARN) only.
    • BConfigure Amazon CloudFront to forward all incoming requests to AWS WAF before requesting content from the S3 origin.
    • CConfigure a security group that allows Amazon CloudFront IP addresses to access Amazon S3 only. Associate AWS WAF to CloudFront.
    • DConfigure Amazon CloudFront and Amazon S3 to use an origin access identity (OAI) to restrict access to the S3 bucket. Enable AWS WAF on the distribution.

    Show answer

    Correct answer: D

    How others answered

    • D69%
    • B31%

    Only 69% agreed on this answer — treat it as contested rather than settled.

    Explanation

    There are two ways you can serve static websites on AWS S3 origin, either using website endpoints or REST API endpoints. Website endpoints does not support HTTPS. Note that the question does not mention which endpoint is used. https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteEndpoints.html#WebsiteRestEndpointDiff B is incorrect because we do not 'forward' requests to AWS WAF, we attach WAF on the Cloudfront distribution itself. Could be bad wording of the question. D is totally valid because it doesn't mention using website endpoints. D also uses OAI to restrict direct access to objects in AWS S3. Although OAI is still viable in this point of time, it is still a legacy method and it is more recommended to use OAC instead. https://repost.aws/knowledge-center/cloudfront-serve-static-website

    Adapted from community discussion by keehua · 2024-04-05 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • repost.aws documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. N

       Nigma

       2022-11-15

       35 upvotes

       Answer D. Use an OAI to lockdown CloudFront to S3 origin & enable WAF on CF distribution

    2. F

       FNJ1111

       2022-12-29

       14 upvotes

       https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-access-to-amazon-s3/ confirms use of OAI (and option D).

    3. C

       CaoMengde09

       2023-02-06

       6 upvotes

       For people who chose B as the right Answer, look at this link : https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html "When you create a web ACL, you can specify one or more CloudFront distributions that you want AWS WAF to inspect. AWS WAF starts to inspect and manage web requests for those distributions based on the criteria that you identify in the web ACL" You don't configure Cloudfront to redirect traffic to WAF. You just create an ACL and points to the Cloudfront distribution. So D is the best solution to secure and integrate Cloudfront with S3 and WAF. From one side it protects your S3 Content by allowing user requests to access only the OAI. And from other side it enable WAF to control traffic before reaching Cloudfront by creating a WAF Rule or ACL (Not redirecting Cloudfront traffic to WAF which as a solution architect you cannot do)

    4. K

       keehua

       2024-04-05

       Selected D4 upvotes

       There are two ways you can serve static websites on AWS S3 origin, either using website endpoints or REST API endpoints. Website endpoints does not support HTTPS. Note that the question does not mention which endpoint is used. https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteEndpoints.html#WebsiteRestEndpointDiff B is incorrect because we do not 'forward' requests to AWS WAF, we attach WAF on the Cloudfront distribution itself. Could be bad wording of the question. D is totally valid because it doesn't mention using website endpoints. D also uses OAI to restrict direct access to objects in AWS S3. Although OAI is still viable in this point of time, it is still a legacy method and it is more recommended to use OAC instead. https://repost.aws/knowledge-center/cloudfront-serve-static-website

20. Question 20 of 25

    Select 2

    A company needs to store contract documents. A contract lasts for 5 years. During the 5-year period, the company must ensure that the documents cannot be overwritten or deleted. The company needs to encrypt the documents at rest and rotate the encryption keys automatically every year. Which combination of steps should a solutions architect take to meet these requirements with the LEAST operational overhead? (Choose two.)

    • AStore the documents in Amazon S3. Use S3 Object Lock in governance mode.
    • BStore the documents in Amazon S3. Use S3 Object Lock in compliance mode.
    • CUse server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Configure key rotation.
    • DUse server-side encryption with AWS Key Management Service (AWS KMS) customer managed keys. Configure key rotation.
    • EUse server-side encryption with AWS Key Management Service (AWS KMS) customer provided (imported) keys. Configure key rotation.

    Show answer

    Correct answer: B, D

    How others answered

    • BD79%
    • BC20%

    Explanation

    Originally answered B and C due to least operational overhead. after research its bugging me that the s3 key rotation is determined based on AWS master Key rotation which cannot guarantee the key is rotated with in a 365 day period. stated as "varies" in the documentation. also its impossible to configure this in the console. KMS-C is a tick box in the console to turn on annual key rotation but requires more operational overhead than SSE-S3. C - will not guarantee the questions objectives but requires little overhead. D - will guarantee the questions objective with more overhead.

    Adapted from community discussion by [Removed] · 2022-11-28 · 26 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • repost.aws documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. [

       [Removed]

       2022-11-28

       Selected B, D26 upvotes

       Originally answered B and C due to least operational overhead. after research its bugging me that the s3 key rotation is determined based on AWS master Key rotation which cannot guarantee the key is rotated with in a 365 day period. stated as "varies" in the documentation. also its impossible to configure this in the console. KMS-C is a tick box in the console to turn on annual key rotation but requires more operational overhead than SSE-S3. C - will not guarantee the questions objectives but requires little overhead. D - will guarantee the questions objective with more overhead.

    2. P

       pentium75

       2023-12-27

       Selected B, D9 upvotes

       A - Governance mode allows exceptions B - Yes C - SSE-S3 rotates keys when AWS thinks is right, not when customer wants ("every year") D - Yes E - "customer provided (imported) keys" can obviously not be 'rotated automatically', the customer would have to provide/import new keys.

    3. C

       cookieMr

       2023-06-26

       Selected B, D6 upvotes

       B. By using S3 Object Lock in compliance mode, it enforces a strict retention policy on the objects, preventing any modifications or deletions. D. By using server-side encryption with AWS KMS customer managed keys, the documents are encrypted with a customer-controlled key. Enabling key rotation ensures that a new encryption key is generated automatically at the defined rotation interval, enhancing security. Option A: S3 Object Lock in governance mode does not provide the required immutability for the documents, allowing potential modifications or deletions. Option C: Server-side encryption with SSE-S3 alone does not fulfill the requirement of encryption key rotation, which is explicitly specified. Option E: Server-side encryption with customer-provided (imported) keys (SSE-C) is not necessary when AWS KMS customer managed keys (Option D) can be used, which provide a more integrated and manageable solution.

    4. L

       LeGloupier

       2022-11-16

       Selected B, D8 upvotes

       should be BD C could have been fine, but key rotation is activate per default on SSE-S3, and no way to deactivate it if I am not wrong

21. Question 21 of 25

    A company needs to run a critical application on AWS. The company needs to use Amazon EC2 for the application’s database. The database must be highly available and must fail over automatically if a disruptive event occurs. Which solution will meet these requirements?

    • ALaunch two EC2 instances, each in a different Availability Zone in the same AWS Region. Install the database on both EC2 instances. Configure the EC2 instances as a cluster. Set up database replication.
    • BLaunch an EC2 instance in an Availability Zone. Install the database on the EC2 instance. Use an Amazon Machine Image (AMI) to back up the data. Use AWS CloudFormation to automate provisioning of the EC2 instance if a disruptive event occurs.
    • CLaunch two EC2 instances, each in a different AWS Region. Install the database on both EC2 instances. Set up database replication. Fail over the database to a second Region.
    • DLaunch an EC2 instance in an Availability Zone. Install the database on the EC2 instance. Use an Amazon Machine Image (AMI) to back up the data. Use EC2 automatic recovery to recover the instance if a disruptive event occurs.

    Show answer

    Correct answer: A

    How others answered

    • A62%
    • C38%

    Only 62% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Changing my vote to A. After reviewing a Udemy course of SAA-C03, it seems that A (multi-AZ and Clusters) is sufficient for HA.

    Adapted from community discussion by Gil80 · 2022-12-04 · 39 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. G

       Gil80

       2022-12-04

       Selected A39 upvotes

       Changing my vote to A. After reviewing a Udemy course of SAA-C03, it seems that A (multi-AZ and Clusters) is sufficient for HA.

    2. A

       aussiehoa

       2023-05-14

       12 upvotes

       Design for region failure? may as well design for AWS failure and put replica in GCP and Azure :v

    3. B

       Burrito69

       2024-03-21

       6 upvotes

       Option C proposes launching two EC2 instances in different AWS Regions and setting up database replication, with failover to a second Region. While this solution does provide geographic redundancy, it may introduce higher latency due to cross-region communication and data replication. Additionally, failover to a different Region typically involves more complex configurations and longer recovery times compared to failover within the same Region. While Option C may offer a level of redundancy, it might not provide the same level of responsiveness and automatic failover capabilities as Option A, which leverages Availability Zones within the same Region. In scenarios where low latency and rapid failover are critical, Option A is often preferred. However, if geographic redundancy is a top priority and the potential trade-offs in latency and failover time are acceptable, Option C could still be a viable solution.

    4. T

       thewalker

       2024-01-30

       Selected A8 upvotes

       A. High Availability - multiple Zones. Disaster Recovery - multiple Regions.

22. Question 22 of 25

    A telemarketing company is designing its customer call center functionality on AWS. The company needs a solution that provides multiple speaker recognition and generates transcript files. The company wants to query the transcript files to analyze the business patterns. The transcript files must be stored for 7 years for auditing purposes. Which solution will meet these requirements?

    • AUse Amazon Rekognition for multiple speaker recognition. Store the transcript files in Amazon S3. Use machine learning models for transcript file analysis.
    • BUse Amazon Transcribe for multiple speaker recognition. Use Amazon Athena for transcript file analysis.
    • CUse Amazon Translate for multiple speaker recognition. Store the transcript files in Amazon Redshift. Use SQL queries for transcript file analysis.
    • DUse Amazon Rekognition for multiple speaker recognition. Store the transcript files in Amazon S3. Use Amazon Textract for transcript file analysis.

    Show answer

    Correct answer: B

    How others answered

    • B92%

    Explanation

    The correct answer is B: Use Amazon Transcribe for multiple speaker recognition. Use Amazon Athena for transcript file analysis. Amazon Transcribe is a service that automatically transcribes spoken language into written text. It can handle multiple speakers and can generate transcript files in real-time or asynchronously. These transcript files can be stored in Amazon S3 for long-term storage. Amazon Athena is a query service that allows you to analyze data stored in Amazon S3 using SQL. You can use it to analyze the transcript files and identify patterns in the data. Option A is incorrect because Amazon Rekognition is a service for analyzing images and videos, not transcribing spoken language. Option C is incorrect because Amazon Translate is a service for translating text from one language to another, not transcribing spoken language. Option D is incorrect because Amazon Textract is a service for extracting text and data from documents and images, not transcribing spoken language.

    Adapted from community discussion by Buruguduystunstugudunstuy · 2023-06-23 · 26 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. B

       Buruguduystunstugudunstuy

       2023-06-23

       Selected B26 upvotes

       The correct answer is B: Use Amazon Transcribe for multiple speaker recognition. Use Amazon Athena for transcript file analysis. Amazon Transcribe is a service that automatically transcribes spoken language into written text. It can handle multiple speakers and can generate transcript files in real-time or asynchronously. These transcript files can be stored in Amazon S3 for long-term storage. Amazon Athena is a query service that allows you to analyze data stored in Amazon S3 using SQL. You can use it to analyze the transcript files and identify patterns in the data. Option A is incorrect because Amazon Rekognition is a service for analyzing images and videos, not transcribing spoken language. Option C is incorrect because Amazon Translate is a service for translating text from one language to another, not transcribing spoken language. Option D is incorrect because Amazon Textract is a service for extracting text and data from documents and images, not transcribing spoken language.

    2. A

       awsgeek75

       2024-06-30

       Selected B6 upvotes

       This is a poorly worded question with poorly worded options. Rekognition and Translate cannot convert speech to text so those options A, C & D are gone. B is the closes option but it does not mention S3 or retention policy of 7 years. Just a best guess on massive assumptions.

    3. G

       Gil80

       2023-05-29

       Selected B3 upvotes

       Cannot be Rekognition, because it's for: • Find objects, people, text, scenes in images and videos using ML • Facial analysis and facial search to do user verification, people counting • Create a database of "familiar faces" or compare against celebrities Transcribe is for: • Automatically convert speech to text • Uses a deep learning process called automatic speech recognition (ASR) to convert speech to text quickly and accurately • Automatically remove PII using reduction • Use cases: ○ Transcribe customer service calls ○ Automate closed captioning and subtitling ○ Generate metadata for media assets to create a fully searchable archive

    4. T

       Thornessen

       2024-01-21

       Selected B3 upvotes

       Tricky or incomplete question.. B is the answer because Transcribe is the right service for processing voice calls. But 7 years of storage is not covered (should add S3 storage) And Athena querying is just SQL querying, it cannot help you much to recognize business patterns, for that I would think some text analysis service like Comprehend would be needed. Unless... We use Transcribe not only to transcribe, but also to recognize some key words, and then create a DB/S3 record with multiple fields, e.g. if it is a telemarketing questionnaire, record answer for each question. Then SQL querying might be useful.

23. Question 23 of 25

    A company is developing a marketing communications service that targets mobile app users. The company needs to send confirmation messages with Short Message Service (SMS) to its users. The users must be able to reply to the SMS messages. The company must store the responses for a year for analysis. What should a solutions architect do to meet these requirements?

    • ACreate an Amazon Connect contact flow to send the SMS messages. Use AWS Lambda to process the responses.
    • BBuild an Amazon Pinpoint journey. Configure Amazon Pinpoint to send events to an Amazon Kinesis data stream for analysis and archiving.
    • CUse Amazon Simple Queue Service (Amazon SQS) to distribute the SMS messages. Use AWS Lambda to process the responses.
    • DCreate an Amazon Simple Notification Service (Amazon SNS) FIFO topic. Subscribe an Amazon Kinesis data stream to the SNS topic for analysis and archiving.

    Show answer

    Correct answer: B

    How others answered

    • B90%

    Explanation

    By using Pinpoint, the company can effectively send SMS messages to its mobile app users. Additionally, Pinpoint allows the configuration of journeys, which enable the tracking and management of user interactions. The events generated during the journey, including user responses to SMS, can be captured and sent to an Kinesis data stream. This data stream can then be used for analysis and archiving purposes. A. Creating an Amazon Connect contact flow is primarily focused on customer support and engagement, and it lacks the capability to store and process SMS responses for analysis. C. Using SQS is a message queuing service and is not specifically designed for handling SMS responses or capturing them for analysis. D. Creating an SNS FIFO topic and subscribing a Kinesis data stream is not the most appropriate solution for capturing and storing SMS responses, as SNS is primarily used for message publishing and distribution. In summary, option B is the best choice as it leverages Pinpoint to send SMS messages and captures user responses for analysis and archiving using an Kinesis data stream.

    Adapted from community discussion by cookieMr · 2023-12-26 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. C

       cookieMr

       2023-12-26

       Selected B10 upvotes

       By using Pinpoint, the company can effectively send SMS messages to its mobile app users. Additionally, Pinpoint allows the configuration of journeys, which enable the tracking and management of user interactions. The events generated during the journey, including user responses to SMS, can be captured and sent to an Kinesis data stream. This data stream can then be used for analysis and archiving purposes. A. Creating an Amazon Connect contact flow is primarily focused on customer support and engagement, and it lacks the capability to store and process SMS responses for analysis. C. Using SQS is a message queuing service and is not specifically designed for handling SMS responses or capturing them for analysis. D. Creating an SNS FIFO topic and subscribing a Kinesis data stream is not the most appropriate solution for capturing and storing SMS responses, as SNS is primarily used for message publishing and distribution. In summary, option B is the best choice as it leverages Pinpoint to send SMS messages and captures user responses for analysis and archiving using an Kinesis data stream.

    2. B

       Buruguduystunstugudunstuy

       2023-06-23

       Selected B5 upvotes

       To send SMS messages and store the responses for a year for analysis, the company can use Amazon Pinpoint. Amazon Pinpoint is a fully-managed service that allows you to send targeted and personalized SMS messages to your users and track the results. To meet the requirements of the company, a solutions architect can build an Amazon Pinpoint journey and configure Amazon Pinpoint to send events to an Amazon Kinesis data stream for analysis and archiving. The Kinesis data stream can be configured to store the data for a year, allowing the company to analyze the responses over time. So, Option B is the correct answer. Option B. Build an Amazon Pinpoint journey. Configure Amazon Pinpoint to send events to an Amazon Kinesis data stream for analysis and archiving.

    3. L

       LuckyAro

       2023-07-17

       Selected B3 upvotes

       https://aws.amazon.com/pinpoint/product-details/sms/ Two-Way Messaging: Receive SMS messages from your customers and reply back to them in a chat-like interactive experience. With Amazon Pinpoint, you can create automatic responses when customers send you messages that contain certain keywords. You can even use Amazon Lex to create conversational bots. A majority of mobile phone users read incoming SMS messages almost immediately after receiving them. If you need to be able to provide your customers with urgent or important information, SMS messaging may be the right solution for you. You can use Amazon Pinpoint to create targeted groups of customers, and then send them campaign-based messages. You can also use Amazon Pinpoint to send direct messages, such as appointment confirmations, order updates, and one-time passwords.

    4. R

       Rameez1

       2023-06-04

       Selected B5 upvotes

       Amazon Pinpoint is perfect choice for this scenario, as it provides 2 way communication and can stream events to kinesis Data stream for further analysis.

24. Question 24 of 25

    A company is planning to move its data to an Amazon S3 bucket. The data must be encrypted when it is stored in the S3 bucket. Additionally, the encryption key must be automatically rotated every year. Which solution will meet these requirements with the LEAST operational overhead?

    • AMove the data to the S3 bucket. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Use the built-in key rotation behavior of SSE-S3 encryption keys.
    • BCreate an AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Set the S3 bucket’s default encryption behavior to use the customer managed KMS key. Move the data to the S3 bucket.
    • CCreate an AWS Key Management Service (AWS KMS) customer managed key. Set the S3 bucket’s default encryption behavior to use the customer managed KMS key. Move the data to the S3 bucket. Manually rotate the KMS key every year.
    • DEncrypt the data with customer key material before moving the data to the S3 bucket. Create an AWS Key Management Service (AWS KMS) key without key material. Import the customer key material into the KMS key. Enable automatic key rotation.

    Show answer

    Correct answer: A

    How others answered

    • A52%
    • B48%

    Only 52% agreed on this answer — treat it as contested rather than settled.

    Explanation

    KEYWORD: LEAST operational overhead To encrypt the data when it is stored in the S3 bucket and automatically rotate the encryption key every year with the least operational overhead, the company can use server-side encryption with Amazon S3-managed encryption keys (SSE-S3). SSE-S3 uses keys that are managed by Amazon S3, and the built-in key rotation behavior of SSE-S3 encryption keys automatically rotates the keys every year. To meet the requirements of the company, the solutions architect can move the data to the S3 bucket and enable server-side encryption with SSE-S3. This solution requires no additional configuration or maintenance and has the least operational overhead. Hence, the correct answer is; Option A. Move the data to the S3 bucket. Use server-side encryption with Amazon S3-managed encryption keys (SSE-S3). Use the built-in key rotation behavior of SSE-S3 encryption keys.

    Adapted from community discussion by Buruguduystunstugudunstuy · 2022-12-23 · 44 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • repost.aws documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. B

       Buruguduystunstugudunstuy

       2022-12-23

       Selected A44 upvotes

       KEYWORD: LEAST operational overhead To encrypt the data when it is stored in the S3 bucket and automatically rotate the encryption key every year with the least operational overhead, the company can use server-side encryption with Amazon S3-managed encryption keys (SSE-S3). SSE-S3 uses keys that are managed by Amazon S3, and the built-in key rotation behavior of SSE-S3 encryption keys automatically rotates the keys every year. To meet the requirements of the company, the solutions architect can move the data to the S3 bucket and enable server-side encryption with SSE-S3. This solution requires no additional configuration or maintenance and has the least operational overhead. Hence, the correct answer is; Option A. Move the data to the S3 bucket. Use server-side encryption with Amazon S3-managed encryption keys (SSE-S3). Use the built-in key rotation behavior of SSE-S3 encryption keys.

    2. J

       JayBee65

       2023-01-10

       29 upvotes

       But... For A there is no reference to how often these keys are rotated, and to rotate to a new key, you need to upload it, which is operational overhead. So not only does it not necessarily meet the 'rotate keys every year' requirement, but every year it requires operational overhead. More importantly, the question states move the objects first, and then configure encryption, but ..."There is no change to the encryption of the objects that existed in the bucket before default encryption was enabled." from https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html So A is clearly wrong. For B, whilst you have to set up KMS once, you then don't have to anything else, which i would say is LEAST operational overhead.

    3. B

       bicrasse

       2023-11-15

       17 upvotes

       The good answer was B before may 2022, because the rotation schedule for AWS managed keys was 3 years (SSE-S3 is based on it)... From may 2022 the schedule rotation is 1 year, then A is now the best answer because there is NO operational task to do: S3 is by default encrypted at rest with SSE-S3 (rotation every year)... So it depends if the question has been updated since 2022

    4. L

       lofzee

       2024-05-28

       Selected A8 upvotes

       Interestingly the answer for this used to be B, and now its A. After May 2022 AWS changed the rotation schedule for SSE-S3. See documentation here: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-aws-managed-keys . AWS managed keys AWS KMS automatically rotates AWS managed keys every year (approximately 365 days). You cannot enable or disable key rotation for AWS managed keys. In May 2022, AWS KMS changed the rotation schedule for AWS managed keys from every three years (approximately 1,095 days) to every year (approximately 365 days). New AWS managed keys are automatically rotated one year after they are created, and approximately every year thereafter. Existing AWS managed keys are automatically rotated one year after their most recent rotation, and every year thereafter. ---- If this comes up in the exam, remember ! you can use SSE-S3 for yearly rotation now.

25. Question 25 of 25

    An online retail company has more than 50 million active customers and receives more than 25,000 orders each day. The company collects purchase data for customers and stores this data in Amazon S3. Additional customer data is stored in Amazon RDS. The company wants to make all the data available to various teams so that the teams can perform analytics. The solution must provide the ability to manage fine-grained permissions for the data and must minimize operational overhead. Which solution will meet these requirements?

    • AMigrate the purchase data to write directly to Amazon RDS. Use RDS access controls to limit access.
    • BSchedule an AWS Lambda function to periodically copy data from Amazon RDS to Amazon S3. Create an AWS Glue crawler. Use Amazon Athena to query the data. Use S3 policies to limit access.
    • CCreate a data lake by using AWS Lake Formation. Create an AWS Glue JDBC connection to Amazon RDS. Register the S3 bucket in Lake Formation. Use Lake Formation access controls to limit access.
    • DCreate an Amazon Redshift cluster. Schedule an AWS Lambda function to periodically copy data from Amazon S3 and Amazon RDS to Amazon Redshift. Use Amazon Redshift access controls to limit access.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    You can manage fine grained using redshift as well - https://aws.amazon.com/blogs/big-data/achieve-fine-grained-data-security-with-row-level-access-control-in-amazon-redshift/ But, I believe the keyword to look for is "minimize operational overhead", which lakeformation does without duplicating much of the data. Redshift is operational overhead and duplication of data. not sure why the answer is D. i vote C as well.

    Adapted from community discussion by markw92 · 2023-06-17 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAA-C03 or CertExamHQ.

    1. A

       anhike

       2022-12-12

       27 upvotes

       Answer : C keyword "manage-fine-grained" https://aws.amazon.com/blogs/big-data/manage-fine-grained-access-control-using-aws-lake-formation/

    2. M

       markw92

       2023-06-17

       9 upvotes

       You can manage fine grained using redshift as well - https://aws.amazon.com/blogs/big-data/achieve-fine-grained-data-security-with-row-level-access-control-in-amazon-redshift/ But, I believe the keyword to look for is "minimize operational overhead", which lakeformation does without duplicating much of the data. Redshift is operational overhead and duplication of data. not sure why the answer is D. i vote C as well.

    3. B

       Buruguduystunstugudunstuy

       2022-12-23

       Selected C5 upvotes

       Option C. Create a data lake by using AWS Lake Formation. Create an AWS Glue JDBC connection to Amazon RDS. Register the S3 bucket in Lake Formation. Use Lake Formation access controls to limit access. To make all the data available to various teams and minimize operational overhead, the company can create a data lake by using AWS Lake Formation. This will allow the company to centralize all the data in one place and use fine-grained access controls to manage access to the data. To meet the requirements of the company, the solutions architect can create a data lake by using AWS Lake Formation, create an AWS Glue JDBC connection to Amazon RDS, and register the S3 bucket in Lake Formation. The solutions architect can then use Lake Formation access controls to limit access to the data. This solution will provide the ability to manage fine-grained permissions for the data and minimize operational overhead.

    4. C

       cookieMr

       2023-06-27

       Selected C4 upvotes

       Lake Formation enables the creation of a secure and scalable data lake on AWS, allowing centralized access controls for both S3 and RDS data. By using Lake Formation, the company can manage permissions effectively and integrate RDS data through the AWS Glue JDBC connection. Registering the S3 in Lake Formation ensures unified access control. This solution reduces operational overhead while providing fine-grained permissions management. A. Directly writing purchase data to Amazon RDS with RDS access controls lacks comprehensive permissions management for both S3 and RDS data. B. Periodically copying data from RDS to S3 using Lambda and using AWS Glue and Athena for querying does not offer fine-grained permissions management and introduces data synchronization complexities. D. Creating an Redshift cluster and copying data from S3 and RDS to Redshift adds complexity and operational overhead without the flexibility of Lake Formation's permissions management capabilities.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 1 of 25