SAA-C03 practice questions 171–180

1. Question 171 · 1017 in bank

   A company is building a new web-based customer relationship management application. The application will use several Amazon EC2 instances that are backed by Amazon Elastic Block Store (Amazon EBS) volumes behind an Application Load Balancer (ALB). The application will also use an Amazon Aurora database. All data for the application must be encrypted at rest and in transit. Which solution will meet these requirements?

   • AUse AWS Key Management Service (AWS KMS) certificates on the ALB to encrypt data in transit. Use AWS Certificate Manager (ACM) to encrypt the EBS volumes and Aurora database storage at rest.
   • BUse the AWS root account to log in to the AWS Management Console. Upload the company’s encryption certificates. While in the root account, select the option to turn on encryption for all data at rest and in transit for the account.
   • CUse AWS Key Management Service (AWS KMS) to encrypt the EBS volumes and Aurora database storage at rest. Attach an AWS Certificate Manager (ACM) certificate to the ALB to encrypt data in transit.
   • DUse BitLocker to encrypt all data at rest. Import the company’s TLS certificate keys to AWS Key Management Service (AWS KMS) Attach the KMS keys to the ALB to encrypt data in transit.

   Show answer

   Answer: C

   Explanation

   AWS KMS can be used to encrypt the EBS and Aurora database storage at rest. ACM can be used to obtain an SSL/TLS certificate and attach it to the ALB. This encrypts the data in transit between the clients and the ALB. A is incorrect because it suggests using ACM to encrypt the EBS, which is not the correct service for encrypting EBS. B is incorrect because relying on the AWS root account and selecting an option in the AWS Management Console to enable encryption for all data at rest and in transit is not a valid approach. D is incorrect because BitLocker is not a suitable solution for encrypting data in AWS services. It is primarily used for encrypting data on Windows-based operating systems. Additionally, importing TLS certificate keys to AWS KMS and attaching them to the ALB is not the recommended approach for encrypting data in transit.

   Source: Adapted from community discussion — cookieMr

   Next question

2. Question 172 · 1017 in bank

   A company is moving its on-premises Oracle database to Amazon Aurora PostgreSQL. The database has several applications that write to the same tables. The applications need to be migrated one by one with a month in between each migration. Management has expressed concerns that the database has a high number of reads and writes. The data must be kept in sync across both databases throughout the migration. What should a solutions architect recommend?

   • AUse AWS DataSync for the initial migration. Use AWS Database Migration Service (AWS DMS) to create a change data capture (CDC) replication task and a table mapping to select all tables.
   • BUse AWS DataSync for the initial migration. Use AWS Database Migration Service (AWS DMS) to create a full load plus change data capture (CDC) replication task and a table mapping to select all tables.
   • CUse the AWS Schema Conversion Tool with AWS Database Migration Service (AWS DMS) using a memory optimized replication instance. Create a full load plus change data capture (CDC) replication task and a table mapping to select all tables.
   • DUse the AWS Schema Conversion Tool with AWS Database Migration Service (AWS DMS) using a compute optimized replication instance. Create a full load plus change data capture (CDC) replication task and a table mapping to select the largest tables.

   Show answer

   Answer: C

   Explanation

   A memory-optimized replication instance is recommended because the database has a high number of reads and writes. Memory-optimized instances are designed to deliver fast performance for workloads that process large data sets in memory.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation
   • AWS documentation
   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 173 · 1017 in bank

   A company has a three-tier application for image sharing. The application uses an Amazon EC2 instance for the front-end layer, another EC2 instance for the application layer, and a third EC2 instance for a MySQL database. A solutions architect must design a scalable and highly available solution that requires the least amount of change to the application. Which solution meets these requirements?

   • AUse Amazon S3 to host the front-end layer. Use AWS Lambda functions for the application layer. Move the database to an Amazon DynamoDB table. Use Amazon S3 to store and serve users’ images.
   • BUse load-balanced Multi-AZ AWS Elastic Beanstalk environments for the front-end layer and the application layer. Move the database to an Amazon RDS DB instance with multiple read replicas to serve users’ images.
   • CUse Amazon S3 to host the front-end layer. Use a fleet of EC2 instances in an Auto Scaling group for the application layer. Move the database to a memory optimized instance type to store and serve users’ images.
   • DUse load-balanced Multi-AZ AWS Elastic Beanstalk environments for the front-end layer and the application layer. Move the database to an Amazon RDS Multi-AZ DB instance. Use Amazon S3 to store and serve users’ images.

   Show answer

   Answer: D

   Explanation

   for "Highly available": Multi-AZ & for "least amount of changes to the application": Elastic Beanstalk automatically handles the deployment, from capacity provisioning, load balancing, auto-scaling to application health monitoring

   Source: Adapted from community discussion — Aninina

   Next question

4. Question 174 · 1017 in bank

   An application running on an Amazon EC2 instance in VPC-A needs to access files in another EC2 instance in VPC-B. Both VPCs are in separate AWS accounts. The network administrator needs to design a solution to configure secure access to EC2 instance in VPC-B from VPC-A. The connectivity should not have a single point of failure or bandwidth concerns. Which solution will meet these requirements?

   • ASet up a VPC peering connection between VPC-A and VPC-B.
   • BSet up VPC gateway endpoints for the EC2 instance running in VPC-B.
   • CAttach a virtual private gateway to VPC-B and set up routing from VPC-A.
   • DCreate a private virtual interface (VIF) for the EC2 instance running in VPC-B and add appropriate routes from VPC-A.

   Show answer

   Answer: A

   Explanation

   A VPC peering connection allows secure communication between instances in different VPCs using private IP addresses without the need for internet gateways, VPN connections, or NAT devices. By setting it up, the application running in VPC-A can directly access the EC2 in VPC-B without going through the public internet or any single point of failure. B is incorrect because VPC gateway endpoints are used for accessing S3 or DynamoDB from a VPC without going over the internet. They are not designed for establishing connectivity between EC2 instances in different VPCs. C is incorrect because it would require configuring a VPN connection between the VPCs. This would introduce additional complexity and potential single points of failure. D is incorrect because creating a private VIF and adding routes would be applicable for establishing a direct connection between on-premises infrastructure and VPC-B using Direct Connect, but it is not suitable for the scenario of communication between EC2 instances in separate VPCs within different AWS accounts.

   Source: Adapted from community discussion — cookieMr

   References

   • AWS documentation

   Next question

5. Question 175 · 1017 in bank

   A company wants to experiment with individual AWS accounts for its engineer team. The company wants to be notified as soon as the Amazon EC2 instance usage for a given month exceeds a specific threshold for each account. What should a solutions architect do to meet this requirement MOST cost-effectively?

   • AUse Cost Explorer to create a daily report of costs by service. Filter the report by EC2 instances. Configure Cost Explorer to send an Amazon Simple Email Service (Amazon SES) notification when a threshold is exceeded.
   • BUse Cost Explorer to create a monthly report of costs by service. Filter the report by EC2 instances. Configure Cost Explorer to send an Amazon Simple Email Service (Amazon SES) notification when a threshold is exceeded.
   • CUse AWS Budgets to create a cost budget for each account. Set the period to monthly. Set the scope to EC2 instances. Set an alert threshold for the budget. Configure an Amazon Simple Notification Service (Amazon SNS) topic to receive a notification when a threshold is exceeded.
   • DUse AWS Cost and Usage Reports to create a report with hourly granularity. Integrate the report data with Amazon Athena. Use Amazon EventBridge to schedule an Athena query. Configure an Amazon Simple Notification Service (Amazon SNS) topic to receive a notification when a threshold is exceeded.

   Show answer

   Answer: C

   Explanation

   AWS Budgets allows you to create budgets for your AWS accounts and set alerts when usage exceeds a certain threshold. By creating a budget for each account, specifying the period as monthly and the scope as EC2 instances, you can effectively track the EC2 usage for each account and be notified when a threshold is exceeded. This solution is the most cost-effective option as it does not require additional resources such as Amazon Athena or Amazon EventBridge.

   Source: Adapted from community discussion — Aninina

   References

   • AWS documentation

   Next question

6. Question 176 · 1017 in bank

   A solutions architect needs to design a new microservice for a company’s application. Clients must be able to call an HTTPS endpoint to reach the microservice. The microservice also must use AWS Identity and Access Management (IAM) to authenticate calls. The solutions architect will write the logic for this microservice by using a single AWS Lambda function that is written in Go 1.x. Which solution will deploy the function in the MOST operationally efficient way?

   • ACreate an Amazon API Gateway REST API. Configure the method to use the Lambda function. Enable IAM authentication on the API.
   • BCreate a Lambda function URL for the function. Specify AWS_IAM as the authentication type.
   • CCreate an Amazon CloudFront distribution. Deploy the function to Lambda@Edge. Integrate IAM authentication logic into the Lambda@Edge function.
   • DCreate an Amazon CloudFront distribution. Deploy the function to CloudFront Functions. Specify AWS_IAM as the authentication type.

   Show answer

   Answer: A

   Explanation

   A. Create an Amazon API Gateway REST API. Configure the method to use the Lambda function. Enable IAM authentication on the API. This option is the most operationally efficient as it allows you to use API Gateway to handle the HTTPS endpoint and also allows you to use IAM to authenticate the calls to the microservice. API Gateway also provides many additional features such as caching, throttling, and monitoring, which can be useful for a microservice.

   Source: Adapted from community discussion — mhmt4438

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 177 · 1017 in bank

   A company observes an increase in Amazon EC2 costs in its most recent bill. The billing team notices unwanted vertical scaling of instance types for a couple of EC2 instances. A solutions architect needs to create a graph comparing the last 2 months of EC2 costs and perform an in-depth analysis to identify the root cause of the vertical scaling. How should the solutions architect generate the information with the LEAST operational overhead?

   • AUse AWS Budgets to create a budget report and compare EC2 costs based on instance types.
   • BUse Cost Explorer's granular filtering feature to perform an in-depth analysis of EC2 costs based on instance types.
   • CUse graphs from the AWS Billing and Cost Management dashboard to compare EC2 costs based on instance types for the last 2 months.
   • DUse AWS Cost and Usage Reports to create a report and send it to an Amazon S3 bucket. Use Amazon QuickSight with Amazon S3 as a source to generate an interactive graph based on instance types.

   Show answer

   Answer: B

   Explanation

   B. Use Cost Explorer's granular filtering feature to perform an in-depth analysis of EC2 costs based on instance types. Explanation: Cost Explorer provides an easy way to analyze AWS costs and usage visually. It allows you to filter data by multiple parameters, such as instance types, regions, and time periods. It also enables you to drill down and identify specific cost drivers, such as unwanted vertical scaling. This option is suitable because it provides granular insights with minimal operational overhead, as it is a built-in AWS tool specifically designed for cost analysis.

   Source: Adapted from community discussion — mzeynalli

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 178 · 1017 in bank

   A company previously migrated its data warehouse solution to AWS. The company also has an AWS Direct Connect connection. Corporate office users query the data warehouse using a visualization tool. The average size of a query returned by the data warehouse is 50 MB and each webpage sent by the visualization tool is approximately 500 KB. Result sets returned by the data warehouse are not cached. Which solution provides the LOWEST data transfer egress cost for the company?

   • AHost the visualization tool on premises and query the data warehouse directly over the internet.
   • BHost the visualization tool in the same AWS Region as the data warehouse. Access it over the internet.
   • CHost the visualization tool on premises and query the data warehouse directly over a Direct Connect connection at a location in the same AWS Region.
   • DHost the visualization tool in the same AWS Region as the data warehouse and access it over a Direct Connect connection at a location in the same Region.

   Show answer

   Answer: D

   Explanation

   A. --> No since if you access via internet you are creating egress traffic. B. -->It's a good choice to have both DWH and visualization in the same region to lower the egress transfer (i.e. data going egress/out of the region) but if you access over internet you might still have egress transfer. C. -> Valid but in this case you send out of AWS 50MB if you query the DWH instead of the visualization tool, D removes this need since puts the visualization tools in AWS with the DWH so reduces data returned out of AWS from 50MB to 500KB D. --> Correct, see explanation on answer C ------------------------------------------------------------------------------------------------------------------------------------------- Useful links: AWS Direct Connect connection create a connection in an AWS Direct Connect location to establish a network connection from your premises to an AWS Region. https://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html

   Source: Adapted from community discussion — AlessandraSAA

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 179 · 1017 in bank

   An online learning company is migrating to the AWS Cloud. The company maintains its student records in a PostgreSQL database. The company needs a solution in which its data is available and online across multiple AWS Regions at all times. Which solution will meet these requirements with the LEAST amount of operational overhead?

   • AMigrate the PostgreSQL database to a PostgreSQL cluster on Amazon EC2 instances.
   • BMigrate the PostgreSQL database to an Amazon RDS for PostgreSQL DB instance with the Multi-AZ feature turned on.
   • CMigrate the PostgreSQL database to an Amazon RDS for PostgreSQL DB instance. Create a read replica in another Region.
   • DMigrate the PostgreSQL database to an Amazon RDS for PostgreSQL DB instance. Set up DB snapshots to be copied to another Region.

   Show answer

   Answer: C

   Explanation

   By migrating the PostgreSQL database to an RDS for PostgreSQL DB instance and creating a read replica in another AWS Region, you can achieve data availability and online access across multiple Regions. This solution requires less operational overhead compared to managing a PostgreSQL cluster on EC2 instances (Option A) or setting up manual replication using snapshots (Option D). Additionally, Amazon RDS handles the underlying infrastructure and replication setup, reducing the operational complexity for the company. Option B, is a valid solution for achieving high availability within a single AWS Region. However, it does not meet the requirement of having the data available and online across multiple AWS Regions at all times, which is specified in the question. The Multi-AZ feature in RDS provides automatic failover within the same Region, but it does not replicate the data to multiple Regions.

   Source: Adapted from community discussion — cookieMr

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 180 · 1017 in bank

    A company hosts its web application on AWS using seven Amazon EC2 instances. The company requires that the IP addresses of all healthy EC2 instances be returned in response to DNS queries. Which policy should be used to meet this requirement?

    • ASimple routing policy
    • BLatency routing policy
    • CMultivalue routing policy
    • DGeolocation routing policy

    Show answer

    Answer: C

    Explanation

    The Multivalue routing policy allows Route 53 to respond to DNS queries with multiple healthy IP addresses for the same resource. This is particularly useful in scenarios where multiple instances are serving the same purpose and need to be load balanced or failover capable. With the Multivalue routing policy, Route 53 returns multiple IP addresses in a random order to distribute the traffic across all healthy instances. Option A (Simple routing policy) would only return a single IP address in response to DNS queries and does not support returning multiple addresses. Option B (Latency routing policy) is used to route traffic based on the lowest latency to the resource and does not fulfill the requirement of returning all healthy IP addresses. Option D (Geolocation routing policy) is used to route traffic based on the geographic location of the user and does not fulfill the requirement of returning all healthy IP addresses. Therefore, the Multivalue routing policy is the most suitable option for returning the IP addresses of all healthy EC2 instances in response to DNS queries.

    Source: Adapted from community discussion — cookieMr

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 171. 1017 questions available.