SAA-C03 practice questions 161–170

1. Question 161 · 1017 in bank

   A media company collects and analyzes user activity data on premises. The company wants to migrate this capability to AWS. The user activity data store will continue to grow and will be petabytes in size. The company needs to build a highly available data ingestion solution that facilitates on-demand analytics of existing data and new data with SQL. Which solution will meet these requirements with the LEAST operational overhead?

   • ASend activity data to an Amazon Kinesis data stream. Configure the stream to deliver the data to an Amazon S3 bucket.
   • BSend activity data to an Amazon Kinesis Data Firehose delivery stream. Configure the stream to deliver the data to an Amazon Redshift cluster.
   • CPlace activity data in an Amazon S3 bucket. Configure Amazon S3 to run an AWS Lambda function on the data as the data arrives in the S3 bucket.
   • DCreate an ingestion service on Amazon EC2 instances that are spread across multiple Availability Zones. Configure the service to forward data to an Amazon RDS Multi-AZ database.

   Show answer

   Answer: B

   Explanation

   This solution meets the requirements as follows: • Kinesis Data Firehose can scale to ingest and process multiple terabytes per hour of streaming data. This can easily handle the petabyte-scale data volumes. • Firehose can deliver the data to Redshift, a petabyte-scale data warehouse, enabling on-demand SQL analytics of the data. • Redshift is a fully managed service, minimizing operational overhead. Firehose is also fully managed, handling scalability, availability, and durability of the streaming data ingestion.

   Source: Adapted from community discussion — kruasan

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 162 · 1017 in bank

   Select 2

   A company collects data from thousands of remote devices by using a RESTful web services application that runs on an Amazon EC2 instance. The EC2 instance receives the raw data, transforms the raw data, and stores all the data in an Amazon S3 bucket. The number of remote devices will increase into the millions soon. The company needs a highly scalable solution that minimizes operational overhead. Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)

   • AUse AWS Glue to process the raw data in Amazon S3.
   • BUse Amazon Route 53 to route traffic to different EC2 instances.
   • CAdd more EC2 instances to accommodate the increasing amount of incoming data.
   • DSend the raw data to Amazon Simple Queue Service (Amazon SQS). Use EC2 instances to process the data.
   • EUse Amazon API Gateway to send the raw data to an Amazon Kinesis data stream. Configure Amazon Kinesis Data Firehose to use the data stream as a source to deliver the data to Amazon S3.

   Show answer

   Answer: AE

   Explanation

   A, E is the correct answer "RESTful web services" => API Gateway. "EC2 instance receives the raw data, transforms the raw data, and stores all the data in an Amazon S3 bucket" => GLUE with (Extract - Transform - Load)

   Source: Adapted from community discussion — Parsons

   Next question

3. Question 163 · 1017 in bank

   A company needs to retain its AWS CloudTrail logs for 3 years. The company is enforcing CloudTrail across a set of AWS accounts by using AWS Organizations from the parent account. The CloudTrail target S3 bucket is configured with S3 Versioning enabled. An S3 Lifecycle policy is in place to delete current objects after 3 years. After the fourth year of use of the S3 bucket, the S3 bucket metrics show that the number of objects has continued to rise. However, the number of new CloudTrail logs that are delivered to the S3 bucket has remained consistent. Which solution will delete objects that are older than 3 years in the MOST cost-effective manner?

   • AConfigure the organization’s centralized CloudTrail trail to expire objects after 3 years.
   • BConfigure the S3 Lifecycle policy to delete previous versions as well as current versions.
   • CCreate an AWS Lambda function to enumerate and delete objects from Amazon S3 that are older than 3 years.
   • DConfigure the parent account as the owner of all objects that are delivered to the S3 bucket.

   Show answer

   Answer: B

   Explanation

   This is the most cost-effective option because: • Versioning has caused the number of objects to increase over time, even as current objects are deleted after 3 years. By deleting previous versions as well, this will clean up old object versions and reduce storage costs. • An S3 Lifecycle policy incurs no additional charges and requires no additional resources to configure and run. It is a native S3 tool for managing object lifecycles cost-effectively.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 164 · 1017 in bank

   A company has an API that receives real-time data from a fleet of monitoring devices. The API stores this data in an Amazon RDS DB instance for later analysis. The amount of data that the monitoring devices send to the API fluctuates. During periods of heavy traffic, the API often returns timeout errors. After an inspection of the logs, the company determines that the database is not capable of processing the volume of write traffic that comes from the API. A solutions architect must minimize the number of connections to the database and must ensure that data is not lost during periods of heavy traffic. Which solution will meet these requirements?

   • AIncrease the size of the DB instance to an instance type that has more available memory.
   • BModify the DB instance to be a Multi-AZ DB instance. Configure the application to write to all active RDS DB instances.
   • CModify the API to write incoming data to an Amazon Simple Queue Service (Amazon SQS) queue. Use an AWS Lambda function that Amazon SQS invokes to write data from the queue to the database.
   • DModify the API to write incoming data to an Amazon Simple Notification Service (Amazon SNS) topic. Use an AWS Lambda function that Amazon SNS invokes to write data from the topic to the database.

   Show answer

   Answer: C

   Explanation

   By leveraging SQS as a buffer and using an Lambda to process and write data from the queue to the database, the solution provides scalability, decoupling, and reliability while minimizing the number of connections to the database. This approach handles fluctuations in traffic and ensures data integrity during high-traffic periods. A. Increasing the size of the DB instance may provide more memory, but it does not address the issue of handling high write traffic efficiently and minimizing connections to the database. B. Modifying the DB instance to be a Multi-AZ instance and writing to all active instances can improve availability but does not address the issue of efficiently handling high write traffic and minimizing connections to the database. D. Using SNS and an Lambda can provide decoupling and scalability, but it is not suitable for handling heavy write traffic efficiently and minimizing connections to the database.

   Source: Adapted from community discussion — cookieMr

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 165 · 1017 in bank

   A company manages its own Amazon EC2 instances that run MySQL databases. The company is manually managing replication and scaling as demand increases or decreases. The company needs a new solution that simplifies the process of adding or removing compute capacity to or from its database tier as needed. The solution also must offer improved performance, scaling, and durability with minimal effort from operations. Which solution meets these requirements?

   • AMigrate the databases to Amazon Aurora Serverless for Aurora MySQL.
   • BMigrate the databases to Amazon Aurora Serverless for Aurora PostgreSQL.
   • CCombine the databases into one larger MySQL database. Run the larger database on larger EC2 instances.
   • DCreate an EC2 Auto Scaling group for the database tier. Migrate the existing databases to the new environment.

   Show answer

   Answer: A

   Explanation

   Migrating the databases to Aurora Serverless provides automated scaling and replication capabilities. Aurora Serverless automatically scales the capacity based on the workload, allowing for seamless addition or removal of compute capacity as needed. It also offers improved performance, durability, and high availability without requiring manual management of replication and scaling. B. Incorrect because it suggests migrating to a different database engine, which may introduce compatibility issues and require significant code modifications. C. Incorrect because consolidating into a larger MySQL database on larger EC2 instances does not provide the desired scalability and automation. D. Incorrect because using EC2 Auto Scaling groups for the database tier still requires manual management of replication and scaling.

   Source: Adapted from community discussion — cookieMr

   References

   • AWS documentation

   Next question

6. Question 166 · 1017 in bank

   A company is storing backup files by using Amazon S3 Standard storage. The files are accessed frequently for 1 month. However, the files are not accessed after 1 month. The company must keep the files indefinitely. Which storage solution will meet these requirements MOST cost-effectively?

   • AConfigure S3 Intelligent-Tiering to automatically migrate objects.
   • BCreate an S3 Lifecycle configuration to transition objects from S3 Standard to S3 Glacier Deep Archive after 1 month.
   • CCreate an S3 Lifecycle configuration to transition objects from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) after 1 month.
   • DCreate an S3 Lifecycle configuration to transition objects from S3 Standard to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 1 month.

   Show answer

   Answer: B

   Explanation

   The storage solution that will meet these requirements most cost-effectively is B: Create an S3 Lifecycle configuration to transition objects from S3 Standard to S3 Glacier Deep Archive after 1 month. Amazon S3 Glacier Deep Archive is a secure, durable, and extremely low-cost Amazon S3 storage class for long-term retention of data that is rarely accessed and for which retrieval times of several hours are acceptable. It is the lowest-cost storage option in Amazon S3, making it a cost-effective choice for storing backup files that are not accessed after 1 month. You can use an S3 Lifecycle configuration to automatically transition objects from S3 Standard to S3 Glacier Deep Archive after 1 month. This will minimize the storage costs for the backup files that are not accessed frequently.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • AWS documentation

   Next question

7. Question 167 · 1017 in bank

   A company is concerned that two NAT instances in use will no longer be able to support the traffic needed for the company’s application. A solutions architect wants to implement a solution that is highly available, fault tolerant, and automatically scalable. What should the solutions architect recommend?

   • ARemove the two NAT instances and replace them with two NAT gateways in the same Availability Zone.
   • BUse Auto Scaling groups with Network Load Balancers for the NAT instances in different Availability Zones.
   • CRemove the two NAT instances and replace them with two NAT gateways in different Availability Zones.
   • DReplace the two NAT instances with Spot Instances in different Availability Zones and deploy a Network Load Balancer.

   Show answer

   Answer: C

   Explanation

   This recommendation ensures high availability and fault tolerance by distributing the NAT gateways across multiple AZs. NAT gateways are managed AWS services that provide scalable and highly available outbound NAT functionality. By deploying NAT gateways in differentAZs, the company can achieve redundancy and avoid a single point of failure. This solution also provides automatic scaling to handle increasing traffic without manual intervention. Option A is incorrect because placing both NAT gateways in the same Availability Zone does not provide fault tolerance. Option B is incorrect because using Auto Scaling groups with Network Load Balancers is not the recommended approach for NAT instances. Option D is incorrect because Spot Instances are not suitable for critical infrastructure components like NAT instances.

   Source: Adapted from community discussion — cookieMr

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 168 · 1017 in bank

   An application runs on an Amazon EC2 instance that has an Elastic IP address in VPC A. The application requires access to a database in VPC B. Both VPCs are in the same AWS account. Which solution will provide the required access MOST securely?

   • ACreate a DB instance security group that allows all traffic from the public IP address of the application server in VPC A.
   • BConfigure a VPC peering connection between VPC A and VPC B.
   • CMake the DB instance publicly accessible. Assign a public IP address to the DB instance.
   • DLaunch an EC2 instance with an Elastic IP address into VPC B. Proxy all requests through the new EC2 instance.

   Show answer

   Answer: B

   Explanation

   A is correct. B will work but is not the most secure method, since it will allow everything in VPC A to talk to everything in VPC B and vice versa, not at all secure. A on the other hand will only allow the application (since you select it's IP address) to talk to the application server in VPC A - you are allowing only the required connectivity. See the link for this exact use case: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html

   Source: Adapted from community discussion — JayBee65

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 169 · 1017 in bank

   A company runs demonstration environments for its customers on Amazon EC2 instances. Each environment is isolated in its own VPC. The company’s operations team needs to be notified when RDP or SSH access to an environment has been established.

   • AConfigure Amazon CloudWatch Application Insights to create AWS Systems Manager OpsItems when RDP or SSH access is detected.
   • BConfigure the EC2 instances with an IAM instance profile that has an IAM role with the AmazonSSMManagedInstanceCore policy attached.
   • CPublish VPC flow logs to Amazon CloudWatch Logs. Create required metric filters. Create an Amazon CloudWatch metric alarm with a notification action for when the alarm is in the ALARM state.
   • DConfigure an Amazon EventBridge rule to listen for events of type EC2 Instance State-change Notification. Configure an Amazon Simple Notification Service (Amazon SNS) topic as a target. Subscribe the operations team to the topic.

   Show answer

   Answer: C

   Explanation

   By publishing VPC flow logs to CloudWatch Logs and creating metric filters to detect RDP or SSH access, the operations team can configure an CloudWatch metric alarm to notify them when the alarm is triggered. This will provide the desired notification when RDP or SSH access to an environment is established. Option A is incorrect because CloudWatch Application Insights is not designed for detecting RDP or SSH access. Option B is also incorrect because configuring an IAM instance profile with the AmazonSSMManagedInstanceCore policy does not directly address the requirement of notifying the operations team when RDP or SSH access occurs. Option D is wrong beacuse configuring an EventBridge rule to listen for EC2 Instance State-change Notification events and using an SNS topic as a target will notify the operations team about changes in the instance state, such as starting or stopping instances. However, it does not specifically detect or notify when RDP or SSH access is established, which is the requirement stated in the question.

   Source: Adapted from community discussion — cookieMr

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 170 · 1017 in bank

    Select 2

    A solutions architect has created a new AWS account and must secure AWS account root user access. Which combination of actions will accomplish this? (Choose two.)

    • AEnsure the root user uses a strong password.
    • BEnable multi-factor authentication to the root user.
    • CStore root user access keys in an encrypted Amazon S3 bucket.
    • DAdd the root user to a group containing administrative permissions.
    • EApply the required permissions to the root user with an inline policy document.

    Show answer

    Answer: AB

    Explanation

    A. Setting a strong password for the root user is an essential security measure to prevent unauthorized access. B. Enabling MFA adds an extra layer of security by requiring an additional authentication factor, such as a code from a mobile app or a hardware token, in addition to the password. C. Root user access keys should be avoided whenever possible, and it is best to use IAM users with restricted permissions instead. D. The root user already has unrestricted access to all resources and services in the account, so granting additional administrative permissions could increase the risk of unauthorized actions. E. Instead, it is recommended to create IAM users with appropriate permissions and use those users for day-to-day operations, while keeping the root user secured and only using it for necessary administrative tasks.

    Source: Adapted from community discussion — cookieMr

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 161. 1017 questions available.