SAA-C03 practice questions 111–120

1. Question 111 · 1017 in bank

   Select 2

   A company is designing a cloud communications platform that is driven by APIs. The application is hosted on Amazon EC2 instances behind a Network Load Balancer (NLB). The company uses Amazon API Gateway to provide external users with access to the application through APIs. The company wants to protect the platform against web exploits like SQL injection and also wants to detect and mitigate large, sophisticated DDoS attacks. Which combination of solutions provides the MOST protection? (Choose two.)

   • AUse AWS WAF to protect the NLB.
   • BUse AWS Shield Advanced with the NLB.
   • CUse AWS WAF to protect Amazon API Gateway.
   • DUse Amazon GuardDuty with AWS Shield Standard
   • EUse AWS Shield Standard with Amazon API Gateway.

   Show answer

   Answer: BC

   Explanation

   Shield - Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Route 53. WAF - Amazon CloudFront, the Application Load Balancer (ALB), Amazon API Gateway, and AWS AppSync

   Source: Adapted from community discussion — YogK

   References

   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 112 · 1017 in bank

   A company has a legacy data processing application that runs on Amazon EC2 instances. Data is processed sequentially, but the order of results does not matter. The application uses a monolithic architecture. The only way that the company can scale the application to meet increased demand is to increase the size of the instances. The company’s developers have decided to rewrite the application to use a microservices architecture on Amazon Elastic Container Service (Amazon ECS). What should a solutions architect recommend for communication between the microservices?

   • ACreate an Amazon Simple Queue Service (Amazon SQS) queue. Add code to the data producers, and send data to the queue. Add code to the data consumers to process data from the queue.
   • BCreate an Amazon Simple Notification Service (Amazon SNS) topic. Add code to the data producers, and publish notifications to the topic. Add code to the data consumers to subscribe to the topic.
   • CCreate an AWS Lambda function to pass messages. Add code to the data producers to call the Lambda function with a data object. Add code to the data consumers to receive a data object that is passed from the Lambda function.
   • DCreate an Amazon DynamoDB table. Enable DynamoDB Streams. Add code to the data producers to insert data into the table. Add code to the data consumers to use the DynamoDB Streams API to detect new table entries and retrieve the data.

   Show answer

   Answer: A

   Explanation

   Option B, using Amazon Simple Notification Service (SNS), would not be suitable for this use case, as SNS is a pub/sub messaging service that is designed for one-to-many communication, rather than point-to-point communication between specific microservices. Option C, using an AWS Lambda function to pass messages, would not be suitable for this use case, as it would require the data producers and data consumers to have a direct connection and invoke the Lambda function, rather than being decoupled through a message queue. Option D, using an Amazon DynamoDB table with DynamoDB Streams, would not be suitable for this use case, as it would require the data consumers to continuously poll the DynamoDB Streams API to detect new table entries, rather than being notified of new data through a message queue.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • AWS documentation

   Next question

3. Question 113 · 1017 in bank

   A company wants to migrate its MySQL database from on premises to AWS. The company recently experienced a database outage that significantly impacted the business. To ensure this does not happen again, the company wants a reliable database solution on AWS that minimizes data loss and stores every transaction on at least two nodes. Which solution meets these requirements?

   • ACreate an Amazon RDS DB instance with synchronous replication to three nodes in three Availability Zones.
   • BCreate an Amazon RDS MySQL DB instance with Multi-AZ functionality enabled to synchronously replicate the data.
   • CCreate an Amazon RDS MySQL DB instance and then create a read replica in a separate AWS Region that synchronously replicates the data.
   • DCreate an Amazon EC2 instance with a MySQL engine installed that triggers an AWS Lambda function to synchronously replicate the data to an Amazon RDS MySQL DB instance.

   Show answer

   Answer: B

   Explanation

   Amazon RDS MySQL DB instance with Multi-AZ functionality enabled to synchronously replicate the data Standby DB in Multi-AZ- synchronous replication Read Replica always asynchronous. so option C is ignored.

   Source: Adapted from community discussion — rjam

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 114 · 1017 in bank

   A company is building a new dynamic ordering website. The company wants to minimize server maintenance and patching. The website must be highly available and must scale read and write capacity as quickly as possible to meet changes in user demand. Which solution will meet these requirements?

   • AHost static content in Amazon S3. Host dynamic content by using Amazon API Gateway and AWS Lambda. Use Amazon DynamoDB with on-demand capacity for the database. Configure Amazon CloudFront to deliver the website content.
   • BHost static content in Amazon S3. Host dynamic content by using Amazon API Gateway and AWS Lambda. Use Amazon Aurora with Aurora Auto Scaling for the database. Configure Amazon CloudFront to deliver the website content.
   • CHost all the website content on Amazon EC2 instances. Create an Auto Scaling group to scale the EC2 instances. Use an Application Load Balancer to distribute traffic. Use Amazon DynamoDB with provisioned write capacity for the database.
   • DHost all the website content on Amazon EC2 instances. Create an Auto Scaling group to scale the EC2 instances. Use an Application Load Balancer to distribute traffic. Use Amazon Aurora with Aurora Auto Scaling for the database.

   Show answer

   Answer: A

   Explanation

   A - is correct, because Dynamodb on-demand scales write and read capacity B - Aurora auto scaling scales only read replicas

   Source: Adapted from community discussion — romko

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 115 · 1017 in bank

   A company has an AWS account used for software engineering. The AWS account has access to the company’s on-premises data center through a pair of AWS Direct Connect connections. All non-VPC traffic routes to the virtual private gateway. A development team recently created an AWS Lambda function through the console. The development team needs to allow the function to access a database that runs in a private subnet in the company’s data center. Which solution will meet these requirements?

   • AConfigure the Lambda function to run in the VPC with the appropriate security group.
   • BSet up a VPN connection from AWS to the data center. Route the traffic from the Lambda function through the VPN.
   • CUpdate the route tables in the VPC to allow the Lambda function to access the on-premises data center through Direct Connect.
   • DCreate an Elastic IP address. Configure the Lambda function to send traffic through the Elastic IP address without an elastic network interface.

   Show answer

   Answer: A

   Explanation

   To configure a VPC for an existing function: 1. Open the Functions page of the Lambda console. 2. Choose a function. 3. Choose Configuration and then choose VPC. 4. Under VPC, choose Edit. 5. Choose a VPC, subnets, and security groups. <-- **That's why I believe the answer is A**. Note: If your function needs internet access, use network address translation (NAT). Connecting a function to a public subnet doesn't give it internet access or a public IP address.

   Source: Adapted from community discussion — Gil80

   References

   • repost.aws documentation
   • AWS documentation
   • AWS documentation
   • repost.aws documentation

   Next question

6. Question 116 · 1017 in bank

   A company runs an application using Amazon ECS. The application creates resized versions of an original image and then makes Amazon S3 API calls to store the resized images in Amazon S3. How can a solutions architect ensure that the application has permission to access Amazon S3?

   • AUpdate the S3 role in AWS IAM to allow read/write access from Amazon ECS, and then relaunch the container.
   • BCreate an IAM role with S3 permissions, and then specify that role as the taskRoleArn in the task definition.
   • CCreate a security group that allows access from Amazon ECS to Amazon S3, and update the launch configuration used by the ECS cluster.
   • DCreate an IAM user with S3 permissions, and then relaunch the Amazon EC2 instances for the ECS cluster while logged in as this account.

   Show answer

   Answer: B

   Explanation

   To ensure that an Amazon Elastic Container Service (ECS) application has permission to access Amazon Simple Storage Service (S3), the correct solution is to create an AWS Identity and Access Management (IAM) role with the necessary S3 permissions and specify that role as the taskRoleArn in the task definition for the ECS application. Option B, creating an IAM role with S3 permissions and specifying that role as the taskRoleArn in the task definition, is the correct solution to meet the requirement.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • repost.aws documentation
   • AWS documentation

   Next question

7. Question 117 · 1017 in bank

   A company has a Windows-based application that must be migrated to AWS. The application requires the use of a shared Windows file system attached to multiple Amazon EC2 Windows instances that are deployed across multiple Availability Zone: What should a solutions architect do to meet this requirement?

   • AConfigure AWS Storage Gateway in volume gateway mode. Mount the volume to each Windows instance.
   • BConfigure Amazon FSx for Windows File Server. Mount the Amazon FSx file system to each Windows instance.
   • CConfigure a file system by using Amazon Elastic File System (Amazon EFS). Mount the EFS file system to each Windows instance.
   • DConfigure an Amazon Elastic Block Store (Amazon EBS) volume with the required size. Attach each EC2 instance to the volume. Mount the file system within the volume to each Windows instance.

   Show answer

   Answer: B

   Explanation

   A. Configure AWS Storage Gateway in volume gateway mode. Mount the volume to each Windows instance. This option is incorrect because AWS Storage Gateway is not a file storage service. It is a hybrid storage service that allows you to store data in the cloud while maintaining low-latency access to frequently accessed data. It is designed to integrate with on-premises storage systems, not to provide file storage for Amazon EC2 instances. B. Configure Amazon FSx for Windows File Server. Mount the Amazon FSx file system to each Windows instance. This is the correct answer. Amazon FSx for Windows File Server is a fully managed file storage service that provides a native Windows file system that can be accessed over the SMB protocol. It is specifically designed for use with Windows-based applications, and it can be easily integrated with existing applications by mounting the file system to each EC2 instance.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • AWS documentation

   Next question

8. Question 118 · 1017 in bank

   Select 2

   A company is developing an ecommerce application that will consist of a load-balanced front end, a container-based application, and a relational database. A solutions architect needs to create a highly available solution that operates with as little manual intervention as possible. Which solutions meet these requirements? (Choose two.)

   • ACreate an Amazon RDS DB instance in Multi-AZ mode.
   • BCreate an Amazon RDS DB instance and one or more replicas in another Availability Zone.
   • CCreate an Amazon EC2 instance-based Docker cluster to handle the dynamic application load.
   • DCreate an Amazon Elastic Container Service (Amazon ECS) cluster with a Fargate launch type to handle the dynamic application load.
   • ECreate an Amazon Elastic Container Service (Amazon ECS) cluster with an Amazon EC2 launch type to handle the dynamic application load.

   Show answer

   Answer: AD

   Explanation

   https://containersonaws.com/introduction/ec2-or-aws-fargate/ A.(O) multi-az <= 'little intervention' B.(X) read replica <= Promoting a read replica to be a standalone DB instance You can promote a read replica into a standalone DB instance. When you promote a read replica, the DB instance is rebooted before it becomes available. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html C.(X) use Amazon ECS instead of EC2-based docker for little human intervention D.(O) Amazon ECS on AWS Fargate : AWS Fargate is a technology that you can use with Amazon ECS to run containers without having to manage servers or clusters of Amazon EC2 instances. E.(X) EC2 launch type The EC2 launch type can be used to run your containerized applications on Amazon EC2 instances that you register to your Amazon ECS cluster and manage yourself.

   Source: Adapted from community discussion — techhb

   References

   • AWS documentation

   Next question

9. Question 119 · 1017 in bank

   A company uses Amazon S3 as its data lake. The company has a new partner that must use SFTP to upload data files. A solutions architect needs to implement a highly available SFTP solution that minimizes operational overhead. Which solution will meet these requirements?

   • AUse AWS Transfer Family to configure an SFTP-enabled server with a publicly accessible endpoint. Choose the S3 data lake as the destination.
   • BUse Amazon S3 File Gateway as an SFTP server. Expose the S3 File Gateway endpoint URL to the new partner. Share the S3 File Gateway endpoint with the new partner.
   • CLaunch an Amazon EC2 instance in a private subnet in a VPInstruct the new partner to upload files to the EC2 instance by using a VPN. Run a cron job script, on the EC2 instance to upload files to the S3 data lake.
   • DLaunch Amazon EC2 instances in a private subnet in a VPC. Place a Network Load Balancer (NLB) in front of the EC2 instances. Create an SFTP listener port for the NLB. Share the NLB hostname with the new partner. Run a cron job script on the EC2 instances to upload files to the S3 data lake.

   Show answer

   Answer: A

   Explanation

   Answer is A AWS Transfer Family securely scales your recurring business-to-business file transfers to AWS Storage services using SFTP, FTPS, FTP, and AS2 protocols. https://aws.amazon.com/aws-transfer-family/

   Source: Adapted from community discussion — Chirantan

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 120 · 1017 in bank

    Select 2

    A company needs to store contract documents. A contract lasts for 5 years. During the 5-year period, the company must ensure that the documents cannot be overwritten or deleted. The company needs to encrypt the documents at rest and rotate the encryption keys automatically every year. Which combination of steps should a solutions architect take to meet these requirements with the LEAST operational overhead? (Choose two.)

    • AStore the documents in Amazon S3. Use S3 Object Lock in governance mode.
    • BStore the documents in Amazon S3. Use S3 Object Lock in compliance mode.
    • CUse server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Configure key rotation.
    • DUse server-side encryption with AWS Key Management Service (AWS KMS) customer managed keys. Configure key rotation.
    • EUse server-side encryption with AWS Key Management Service (AWS KMS) customer provided (imported) keys. Configure key rotation.

    Show answer

    Answer: BD

    Explanation

    Originally answered B and C due to least operational overhead. after research its bugging me that the s3 key rotation is determined based on AWS master Key rotation which cannot guarantee the key is rotated with in a 365 day period. stated as "varies" in the documentation. also its impossible to configure this in the console. KMS-C is a tick box in the console to turn on annual key rotation but requires more operational overhead than SSE-S3. C - will not guarantee the questions objectives but requires little overhead. D - will guarantee the questions objective with more overhead.

    Source: Adapted from community discussion — [Removed]

    References

    • AWS documentation
    • repost.aws documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 111. 1017 questions available.