SAA-C03 practice questions 991–1,000

1. Question 991 · 1017 in bank

   A weather forecasting company collects temperature readings from various sensors on a continuous basis. An existing data ingestion process collects the readings and aggregates the readings into larger Apache Parquet files. Then the process encrypts the files by using client-side encryption with KMS managed keys (CSE-KMS). Finally, the process writes the files to an Amazon S3 bucket with separate prefixes for each calendar day. The company wants to run occasional SQL queries on the data to take sample moving averages for a specific calendar day. Which solution will meet these requirements MOST cost-effectively?

   • AConfigure Amazon Athena to read the encrypted files. Run SQL queries on the data directly in Amazon S3.
   • BUse Amazon S3 Select to run SQL queries on the data directly in Amazon S3.
   • CConfigure Amazon Redshift to read the encrypted files. Use Redshift Spectrum and Redshift query editor v2 to run SQL queries on the data directly in Amazon S3.
   • DConfigure Amazon EMR Serverless to read the encrypted files. Use Apache SparkSQL to run SQL queries on the data directly in Amazon S3.

   Show answer

   Answer: A

   Explanation

   Seems like "sample moving averages" is a typo of "simple moving averages". A simple moving average is formed by computing the average price of a security over a specific number of periods, but let's just ignore it if you don't care one bit haha A - Athena is serverless, works perfectly with Parquet files, can handle encrypted data, and super cost-effective because you only pay for the amount of data you query. B - Amazon S3 Select is fast for simple filtering or lightweight queries, not for complex queries like calculating moving averages. C - Redshift with Redshift Spectrum is extremely powerful and competent to crunch heavy-duty data, so overkill for occasional SQL queries. D - EMR is scalable and fast but is usually for heavy data pipelines, not casual SQL analysis. Like C, this is overkill.

   Source: Adapted from community discussion — LeonSauveterre

   References

   • AWS documentation

   Next question

2. Question 992 · 1017 in bank

   A company is implementing a new application on AWS. The company will run the application on multiple Amazon EC2 instances across multiple Availability Zones within multiple AWS Regions. The application will be available through the internet. Users will access the application from around the world. The company wants to ensure that each user who accesses the application is sent to the EC2 instances that are closest to the user’s location. Which solution will meet these requirements?

   • AImplement an Amazon Route 53 geolocation routing policy. Use an internet-facing Application Load Balancer to distribute the traffic across all Availability Zones within the same Region.
   • BImplement an Amazon Route 53 geoproximity routing policy. Use an internet-facing Network Load Balancer to distribute the traffic across all Availability Zones within the same Region.
   • CImplement an Amazon Route 53 multivalue answer routing policy. Use an internet-facing Application Load Balancer to distribute the traffic across all Availability Zones within the same Region.
   • DImplement an Amazon Route 53 weighted routing policy. Use an internet-facing Network Load Balancer to distribute the traffic across all Availability Zones within the same Region.

   Show answer

   Answer: B

   Explanation

   Keyword closest. Amazon Route 53 Geoproximity Routing: This routing policy directs traffic based on the geographic location of your users and your resources, ensuring that users are routed to the closest EC2 instances.

   Source: Adapted from community discussion — dhewa

   References

   • AWS documentation

   Next question

3. Question 993 · 1017 in bank

   A financial services company plans to launch a new application on AWS to handle sensitive financial transactions. The company will deploy the application on Amazon EC2 instances. The company will use Amazon RDS for MySQL as the database. The company’s security policies mandate that data must be encrypted at rest and in transit. Which solution will meet these requirements with the LEAST operational overhead?

   • AConfigure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure AWS Certificate Manager (ACM) SSL/TLS certificates for encryption in transit.
   • BConfigure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure IPsec tunnels for encryption in transit.
   • CImplement third-party application-level data encryption before storing data in Amazon RDS for MySQL. Configure AWS Certificate Manager (ACM) SSL/TLS certificates for encryption in transit.
   • DConfigure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure a VPN connection to enable private connectivity to encrypt data in transit.

   Show answer

   Answer: A

   Explanation

   Amazon RDS for MySQL supports encryption at rest using AWS Key Management Service (KMS) managed keys. This encryption is easy to enable during the creation of the RDS instance and requires minimal configuration. AWS KMS provides a fully managed solution for managing encryption keys, and using KMS managed keys reduces operational overhead related to key management and rotation. Encryption in transit ensures that data transmitted between the application and the RDS database is secure. AWS Certificate Manager (ACM) can be used to provide SSL/TLS certificates, which are required to encrypt data in transit. ACM simplifies the management of SSL/TLS certificates by handling certificate renewal and deployment, reducing operational overhead.

   Source: Adapted from community discussion — JoeTromundo

   Next question

4. Question 994 · 1017 in bank

   A company is migrating its on-premises Oracle database to an Amazon RDS for Oracle database. The company needs to retain data for 90 days to meet regulatory requirements. The company must also be able to restore the database to a specific point in time for up to 14 days. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate Amazon RDS automated backups. Set the retention period to 90 days.
   • BCreate an Amazon RDS manual snapshot every day. Delete manual snapshots that are older than 90 days.
   • CUse the Amazon Aurora Clone feature for Oracle to create a point-in-time restore. Delete clones that are older than 90 days.
   • DCreate a backup plan that has a retention period of 90 days by using AWS Backup for Amazon RDS.

   Show answer

   Answer: D

   Explanation

   A: Amazon RDS automated backups support a maximum retention period of 35 days. This option does not meet the requirement to retain backups for 90 days. B: This approach requires manual snapshot management, including scheduling snapshots and deleting old ones. This increases operational overhead and is prone to human error. C: This option is not applicable as Aurora Clone is a feature specific to Amazon Aurora and not available for Amazon RDS for Oracle. Additionally, it would require manual management of clones, increasing complexity. D: AWS Backup supports point-in-time recovery for Amazon RDS, enabling you to restore the database to any specific point within the defined retention period, up to 35 days. For the requirement of 14 days, AWS Backup easily supports this capability.

   Source: Adapted from community discussion — JoeTromundo

   References

   • AWS documentation

   Next question

5. Question 995 · 1017 in bank

   A company is developing a new application that uses a relational database to store user data and application configurations. The company expects the application to have steady user growth. The company expects the database usage to be variable and read-heavy, with occasional writes. The company wants to cost-optimize the database solution. The company wants to use an AWS managed database solution that will provide the necessary performance. Which solution will meet these requirements MOST cost-effectively?

   • ADeploy the database on Amazon RDS. Use Provisioned IOPS SSD storage to ensure consistent performance for read and write operations.
   • BDeploy the database on Amazon Aurora Serverless to automatically scale the database capacity based on actual usage to accommodate the workload.
   • CDeploy the database on Amazon DynamoDB. Use on-demand capacity mode to automatically scale throughput to accommodate the workload.
   • DDeploy the database on Amazon RDS. Use magnetic storage and use read replicas to accommodate the workload.

   Show answer

   Answer: B

   Explanation

   A - You’d pay for high performance even when you don’t need it B - You only pay for the database capacity you use, making it cost-efficient for unpredictable traffic. C - DynamoDB is not even a relational database. D - Magnetic disks have significantly slower IOPS compared to SSDs. P.S. In the AWS context, magnetic storage refers to standard storage volumes (previously called "Magnetic" volumes) in EBS. It offers lower performance compared to modern SSD storage but is cheaper per GB.

   Source: Adapted from community discussion — LeonSauveterre

   Next question

6. Question 996 · 1017 in bank

   An image-processing company has a web application that users use to upload images. The application uploads the images into an Amazon S3 bucket. The company has set up S3 event notifications to publish the object creation events to an Amazon Simple Queue Service (Amazon SQS) standard queue. The SQS queue serves as the event source for an AWS Lambda function that processes the images and sends the results to users through email. Users report that they are receiving multiple email messages for every uploaded image. A solutions architect determines that SQS messages are invoking the Lambda function more than once, resulting in multiple email messages. What should the solutions architect do to resolve this issue with the LEAST operational overhead?

   • ASet up long polling in the SQS queue by increasing the ReceiveMessage wait time to 30 seconds.
   • BChange the SQS standard queue to an SQS FIFO queue. Use the message deduplication ID to discard duplicate messages.
   • CIncrease the visibility timeout in the SQS queue to a value that is greater than the total of the function timeout and the batch window timeout.
   • DModify the Lambda function to delete each message from the SQS queue immediately after the message is read before processing.

   Show answer

   Answer: C

   Explanation

   answer should be C, users get duplicated messages because -> lambda polls the message, and starts processing the message. However, before the first lambda can finish processing the message, the visibility timeout runs out on SQS, and SQS returns the message to the poll, causing another Lambda node to process that same message. By increasing the visibility timeout, it should prevent SQS from returning a message back to the poll before Lambda can finish processing the message

   Source: Adapted from community discussion — Six_Fingered_Jose

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 997 · 1017 in bank

   A company hosts its application on several Amazon EC2 instances inside a VPC. The company creates a dedicated Amazon S3 bucket for each customer to store their relevant information in Amazon S3. The company wants to ensure that the application running on EC2 instances can securely access only the S3 buckets that belong to the company’s AWS account. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate a gateway endpoint for Amazon S3 that is attached to the VPC. Update the IAM instance profile policy to provide access to only the specific buckets that the application needs.
   • BCreate a NAT gateway in a public subnet with a security group that allows access to only Amazon S3. Update the route tables to use the NAT Gateway.
   • CCreate a gateway endpoint for Amazon S3 that is attached to the VPUpdate the IAM instance profile policy with a Deny action and the following condition key:
   • DCreate a NAT Gateway in a public subnet. Update route tables to use the NAT Gateway. Assign bucket policies for all buckets with a Deny action and the following condition key:

   Show answer

   Answer: C

   Explanation

   The requirement in the question is to ensure that the EC2 instances can securely access only the S3 buckets that belong to (are owned by) the company's AWS account. In that context, using the "StringNotEquals": {"S3ResourceAccount":["CompanyAWSAcctNumber"]} condition key in the IAM instance profile policy is a valid approach. This condition key restricts access to S3 buckets that are not owned by the specified AWS account number (the company's account). By setting a Deny with this condition, it effectively allows access only to the S3 buckets owned by the company's AWS account.

   Source: Adapted from community discussion — Denise123

   Next question

8. Question 998 · 1017 in bank

   A company is building a cloud-based application on AWS that will handle sensitive customer data. The application uses Amazon RDS for the database, Amazon S3 for object storage, and S3 Event Notifications that invoke AWS Lambda for serverless processing. The company uses AWS IAM Identity Center to manage user credentials. The development, testing, and operations teams need secure access to Amazon RDS and Amazon S3 while ensuring the confidentiality of sensitive customer data. The solution must comply with the principle of least privilege. Which solution meets these requirements with the LEAST operational overhead?

   • AUse IAM roles with least privilege to grant all the teams access. Assign IAM roles to each team with customized IAM policies defining specific permission for Amazon RDS and S3 object access based on team responsibilities.
   • BEnable IAM Identity Center with an Identity Center directory. Create and configure permission sets with granular access to Amazon RDS and Amazon S3. Assign all the teams to groups that have specific access with the permission sets.
   • CCreate individual IAM users for each member in all the teams with role-based permissions. Assign the IAM roles with predefined policies for RDS and S3 access to each user based on user needs. Implement IAM Access Analyzer for periodic credential evaluation.
   • DUse AWS Organizations to create separate accounts for each team. Implement cross-account IAM roles with least privilege. Grant specific permission for RDS and S3 access based on team roles and responsibilities.

   Show answer

   Answer: B

   Explanation

   Is there anyone who has recently passed the exam who can tell me approximately how many of the original questions are in the actual exam?

   Source: Adapted from community discussion — kevindu

   Next question

9. Question 999 · 1017 in bank

   A company has an Amazon S3 bucket that contains sensitive data files. The company has an application that runs on virtual machines in an on-premises data center. The company currently uses AWS IAM Identity Center. The application requires temporary access to files in the S3 bucket. The company wants to grant the application secure access to the files in the S3 bucket. Which solution will meet these requirements?

   • ACreate an S3 bucket policy that permits access to the bucket from the public IP address range of the company’s on-premises data center.
   • BUse IAM Roles Anywhere to obtain security credentials in IAM Identity Center that grant access to the S3 bucket. Configure the virtual machines to assume the role by using the AWS CLI.
   • CInstall the AWS CLI on the virtual machine. Configure the AWS CLI with access keys from an IAM user that has access to the bucket.
   • DCreate an IAM user and policy that grants access to the bucket. Store the access key and secret key for the IAM user in AWS Secrets Manager. Configure the application to retrieve the access key and secret key at startup.

   Show answer

   Answer: B

   Explanation

   You can use AWS Identity and Access Management Roles Anywhere to obtain temporary security credentials in IAM for workloads such as servers, containers, and applications that run outside of AWS. Your workloads can use the same IAM policies and IAM roles that you use with AWS applications to access AWS resources. Using IAM Roles Anywhere means you don't need to manage long-term credentials for workloads running outside of AWS. https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html

   Source: Adapted from community discussion — FlyingHawk

   References

   • AWS documentation

   Next question

10. Question 1000 · 1017 in bank

    A company hosts its core network services, including directory services and DNS, in its on-premises data center. The data center is connected to the AWS Cloud using AWS Direct Connect (DX). Additional AWS accounts are planned that will require quick, cost-effective, and consistent access to these network services. What should a solutions architect implement to meet these requirements with the LEAST amount of operational overhead?

    • ACreate a DX connection in each new account. Route the network traffic to the on-premises servers.
    • BConfigure VPC endpoints in the DX VPC for all required services. Route the network traffic to the on-premises servers.
    • CCreate a VPN connection between each new account and the DX VPRoute the network traffic to the on-premises servers.
    • DConfigure AWS Transit Gateway between the accounts. Assign DX to the transit gateway and route network traffic to the on-premises servers.

    Show answer

    Answer: D

    Explanation

    New AWS accounts need consistent, quick, and cost-effective access to these services, so we can't do something for each of these accounts. We should find a way to manage these accounts fast. A - Managing separate DX connections for every account is too much work and DX connections are expensive. B - VPC endpoints are for accessing AWS services, not on-premises services. C - Managing individual VPNs for multiple accounts is too much work and VPNs bring more latency. D - Transit Gateway simplifies the network by acting as a hub for all VPCs and the on-premises network. Instead of multiple DX or VPN connections, you're using one centralized DX connection with Transit Gateway. The best part is that you can easily add new accounts or VPCs without reconfiguring DX or VPN connections.

    Source: Adapted from community discussion — LeonSauveterre

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 991. 1017 questions available.