SAA-C03 practice questions 231–240

1. Question 231 · 1017 in bank

   A company has an AWS Lambda function that needs read access to an Amazon S3 bucket that is located in the same AWS account. Which solution will meet these requirements in the MOST secure manner?

   • AApply an S3 bucket policy that grants read access to the S3 bucket.
   • BApply an IAM role to the Lambda function. Apply an IAM policy to the role to grant read access to the S3 bucket.
   • CEmbed an access key and a secret key in the Lambda function’s code to grant the required IAM permissions for read access to the S3 bucket.
   • DApply an IAM role to the Lambda function. Apply an IAM policy to the role to grant read access to all S3 buckets in the account.

   Show answer

   Answer: B

   Explanation

   This solution satisfies the needs in the most secure manner: • An IAM role provides temporary credentials to the Lambda function to access AWS resources. The function does not have persistent credentials. • The IAM policy grants least privilege access by specifying read access only to the specific S3 bucket needed. Access is not granted to all S3 buckets. • If the Lambda function is compromised, the attacker would only gain access to the one specified S3 bucket. They would not receive broad access to resources.

   Source: Adapted from community discussion — kruasan

   References

   • AWS documentation

   Next question

2. Question 232 · 1017 in bank

   A company provides a Voice over Internet Protocol (VoIP) service that uses UDP connections. The service consists of Amazon EC2 instances that run in an Auto Scaling group. The company has deployments across multiple AWS Regions. The company needs to route users to the Region with the lowest latency. The company also needs automated failover between Regions. Which solution will meet these requirements?

   • ADeploy a Network Load Balancer (NLB) and an associated target group. Associate the target group with the Auto Scaling group. Use the NLB as an AWS Global Accelerator endpoint in each Region.
   • BDeploy an Application Load Balancer (ALB) and an associated target group. Associate the target group with the Auto Scaling group. Use the ALB as an AWS Global Accelerator endpoint in each Region.
   • CDeploy a Network Load Balancer (NLB) and an associated target group. Associate the target group with the Auto Scaling group. Create an Amazon Route 53 latency record that points to aliases for each NLB. Create an Amazon CloudFront distribution that uses the latency record as an origin.
   • DDeploy an Application Load Balancer (ALB) and an associated target group. Associate the target group with the Auto Scaling group. Create an Amazon Route 53 weighted record that points to aliases for each ALB. Deploy an Amazon CloudFront distribution that uses the weighted record as an origin.

   Show answer

   Answer: A

   Explanation

   CloudFront uses Edge Locations to cache content while Global Accelerator uses Edge Locations to find an optimal pathway to the nearest regional endpoint. CloudFront is designed to handle HTTP protocol meanwhile Global Accelerator is best used for both HTTP and non-HTTP protocols such as TCP and UDP. so i think A is a better answer

   Source: Adapted from community discussion — mouhannadhaj

   References

   • AWS documentation

   Next question

3. Question 233 · 1017 in bank

   A company hosts a web application on multiple Amazon EC2 instances. The EC2 instances are in an Auto Scaling group that scales in response to user demand. The company wants to optimize cost savings without making a long-term commitment. Which EC2 instance purchasing option should a solutions architect recommend to meet these requirements?

   • ADedicated Instances only
   • BOn-Demand Instances only
   • CA mix of On-Demand Instances and Spot Instances
   • DA mix of On-Demand Instances and Reserved Instances

   Show answer

   Answer: C

   Explanation

   There is a little trap here, because in the way this question is asked, both B and C are true since we don't know if it's production or not. In a production environment C is absolutely forbidden and B is the good solution, we even have questions in this dump about this case. In a dev environment spot instances are good if you don't care about stability so C can be a good answer. Since this question is all about cost, let's go for the stingy rat solution, spot instances are cheaper, so C is correct.

   Source: Adapted from community discussion — Mikado211

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 234 · 1017 in bank

   Select 2

   A media company uses Amazon CloudFront for its publicly available streaming video content. The company wants to secure the video content that is hosted in Amazon S3 by controlling who has access. Some of the company’s users are using a custom HTTP client that does not support cookies. Some of the company’s users are unable to change the hardcoded URLs that they are using for access. Which services or methods will meet these requirements with the LEAST impact to the users? (Choose two.)

   • ASigned cookies
   • BSigned URLs
   • CAWS AppSync
   • DJSON Web Token (JWT)
   • EAWS Secrets Manager

   Show answer

   Answer: AB

   Explanation

   I thought that option A was totally wrong, because the question mentions "HTTP client does not support cookies". However it is right, along with option B. Check the link bellow, first paragraph. https://aws.amazon.com/blogs/media/secure-content-using-cloudfront-functions/

   Source: Adapted from community discussion — leoattf

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 235 · 1017 in bank

   Select 2

   A company is preparing a new data platform that will ingest real-time streaming data from multiple sources. The company needs to transform the data before writing the data to Amazon S3. The company needs the ability to use SQL to query the transformed data. Which solutions will meet these requirements? (Choose two.)

   • AUse Amazon Kinesis Data Streams to stream the data. Use Amazon Kinesis Data Analytics to transform the data. Use Amazon Kinesis Data Firehose to write the data to Amazon S3. Use Amazon Athena to query the transformed data from Amazon S3.
   • BUse Amazon Managed Streaming for Apache Kafka (Amazon MSK) to stream the data. Use AWS Glue to transform the data and to write the data to Amazon S3. Use Amazon Athena to query the transformed data from Amazon S3.
   • CUse AWS Database Migration Service (AWS DMS) to ingest the data. Use Amazon EMR to transform the data and to write the data to Amazon S3. Use Amazon Athena to query the transformed data from Amazon S3.
   • DUse Amazon Managed Streaming for Apache Kafka (Amazon MSK) to stream the data. Use Amazon Kinesis Data Analytics to transform the data and to write the data to Amazon S3. Use the Amazon RDS query editor to query the transformed data from Amazon S3.
   • EUse Amazon Kinesis Data Streams to stream the data. Use AWS Glue to transform the data. Use Amazon Kinesis Data Firehose to write the data to Amazon S3. Use the Amazon RDS query editor to query the transformed data from Amazon S3.

   Show answer

   Answer: AB

   Explanation

   OK, for B I did some research, https://docs.aws.amazon.com/glue/latest/dg/add-job-streaming.html "You can create streaming extract, transform, and load (ETL) jobs that run continuously, consume data from streaming sources like Amazon Kinesis Data Streams, Apache Kafka, and Amazon Managed Streaming for Apache Kafka (Amazon MSK). The jobs cleanse and transform the data, and then load the results into Amazon S3 data lakes or JDBC data stores."

   Source: Adapted from community discussion — Steve_4542636

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 236 · 1017 in bank

   A company has an on-premises volume backup solution that has reached its end of life. The company wants to use AWS as part of a new backup solution and wants to maintain local access to all the data while it is backed up on AWS. The company wants to ensure that the data backed up on AWS is automatically and securely transferred. Which solution meets these requirements?

   • AUse AWS Snowball to migrate data out of the on-premises solution to Amazon S3. Configure on-premises systems to mount the Snowball S3 endpoint to provide local access to the data.
   • BUse AWS Snowball Edge to migrate data out of the on-premises solution to Amazon S3. Use the Snowball Edge file interface to provide on-premises systems with local access to the data.
   • CUse AWS Storage Gateway and configure a cached volume gateway. Run the Storage Gateway software appliance on premises and configure a percentage of data to cache locally. Mount the gateway storage volumes to provide local access to the data.
   • DUse AWS Storage Gateway and configure a stored volume gateway. Run the Storage Gateway software appliance on premises and map the gateway storage volumes to on-premises storage. Mount the gateway storage volumes to provide local access to the data.

   Show answer

   Answer: D

   Explanation

   The question states, "wants to maintain local access to all the data" This is storage gateway. Cached gateway stores only the frequently accessed data locally which is not what the problem statement asks for.

   Source: Adapted from community discussion — Steve_4542636

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 237 · 1017 in bank

   An application that is hosted on Amazon EC2 instances needs to access an Amazon S3 bucket. Traffic must not traverse the internet. How should a solutions architect configure access to meet these requirements?

   • ACreate a private hosted zone by using Amazon Route 53.
   • BSet up a gateway VPC endpoint for Amazon S3 in the VPC.
   • CConfigure the EC2 instances to use a NAT gateway to access the S3 bucket.
   • DEstablish an AWS Site-to-Site VPN connection between the VPC and the S3 bucket.

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Set up a gateway VPC endpoint for Amazon S3 in the VPC. A gateway VPC endpoint is a private way for Amazon EC2 instances in a VPC to access AWS services, such as Amazon S3, without having to go through the internet. This can help to improve security and performance.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation

   Next question

8. Question 238 · 1017 in bank

   An ecommerce company stores terabytes of customer data in the AWS Cloud. The data contains personally identifiable information (PII). The company wants to use the data in three applications. Only one of the applications needs to process the PII. The PII must be removed before the other two applications process the data. Which solution will meet these requirements with the LEAST operational overhead?

   • AStore the data in an Amazon DynamoDB table. Create a proxy application layer to intercept and process the data that each application requests.
   • BStore the data in an Amazon S3 bucket. Process and transform the data by using S3 Object Lambda before returning the data to the requesting application.
   • CProcess the data and store the transformed data in three separate Amazon S3 buckets so that each application has its own custom dataset. Point each application to its respective S3 bucket.
   • DProcess the data and store the transformed data in three separate Amazon DynamoDB tables so that each application has its own custom dataset. Point each application to its respective DynamoDB table.

   Show answer

   Answer: B

   Explanation

   "Today, I’m very happy to announce the availability of S3 Object Lambda, a new capability that allows you to add your own code to process data retrieved from S3 before returning it to an application. S3 Object Lambda works with your existing applications and uses AWS Lambda functions to automatically process and transform your data as it is being retrieved from S3. The Lambda function is invoked inline with a standard S3 GET request, so you don’t need to change your application code." https://aws.amazon.com/de/blogs/aws/introducing-amazon-s3-object-lambda-use-your-code-to-process-data-as-it-is-being-retrieved-from-s3/

   Source: Adapted from community discussion — pentium75

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 239 · 1017 in bank

   A development team has launched a new application that is hosted on Amazon EC2 instances inside a development VPC. A solutions architect needs to create a new VPC in the same account. The new VPC will be peered with the development VPC. The VPC CIDR block for the development VPC is 192.168.0.0/24. The solutions architect needs to create a CIDR block for the new VPC. The CIDR block must be valid for a VPC peering connection to the development VPC. What is the SMALLEST CIDR block that meets these requirements?

   • A10.0.1.0/32
   • B192.168.0.0/24
   • C192.168.1.0/32
   • D10.0.1.0/24

   Show answer

   Answer: D

   Explanation

   10.0.1.0/32 and 192.168.1.0/32 are too small for VPC, and /32 network is only 1 host 192.168.0.0/24 is overlapping with existing VPC

   Source: Adapted from community discussion — BrainOBrain

   References

   • AWS documentation

   Next question

10. Question 240 · 1017 in bank

    A company deploys an application on five Amazon EC2 instances. An Application Load Balancer (ALB) distributes traffic to the instances by using a target group. The average CPU usage on each of the instances is below 10% most of the time, with occasional surges to 65%. A solutions architect needs to implement a solution to automate the scalability of the application. The solution must optimize the cost of the architecture and must ensure that the application has enough CPU resources when surges occur. Which solution will meet these requirements?

    • ACreate an Amazon CloudWatch alarm that enters the ALARM state when the CPUUtilization metric is less than 20%. Create an AWS Lambda function that the CloudWatch alarm invokes to terminate one of the EC2 instances in the ALB target group.
    • BCreate an EC2 Auto Scaling group. Select the existing ALB as the load balancer and the existing target group as the target group. Set a target tracking scaling policy that is based on the ASGAverageCPUUtilization metric. Set the minimum instances to 2, the desired capacity to 3, the maximum instances to 6, and the target value to 50%. Add the EC2 instances to the Auto Scaling group.
    • CCreate an EC2 Auto Scaling group. Select the existing ALB as the load balancer and the existing target group as the target group. Set the minimum instances to 2, the desired capacity to 3, and the maximum instances to 6. Add the EC2 instances to the Auto Scaling group.
    • DCreate two Amazon CloudWatch alarms. Configure the first CloudWatch alarm to enter the ALARM state when the average CPUUtilization metric is below 20%. Configure the second CloudWatch alarm to enter the ALARM state when the average CPUUtilization matric is above 50%. Configure the alarms to publish to an Amazon Simple Notification Service (Amazon SNS) topic to send an email message. After receiving the message, log in to decrease or increase the number of EC2 instances that are running.

    Show answer

    Answer: B

    Explanation

    Reasons: • An Auto Scaling group will automatically scale the EC2 instances to match changes in demand. This optimizes cost by only running as many instances as needed. • A target tracking scaling policy monitors the ASGAverageCPUUtilization metric and scales to keep the average CPU around the 50% target value. This ensures there are enough resources during CPU surges. • The ALB and target group are reused, so the application architecture does not change. The Auto Scaling group is associated to the existing load balancer setup. • A minimum of 2 and maximum of 6 instances provides the ability to scale between 3 and 6 instances as needed based on demand. • Costs are optimized by starting with only 3 instances (the desired capacity) and scaling up as needed. When CPU usage drops, instances are terminated to match the desired capacity.

    Source: Adapted from community discussion — kruasan

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 231. 1017 questions available.