SAA-C03 practice questions 261–270

1. Question 261 · 1017 in bank

   A company experienced a breach that affected several applications in its on-premises data center. The attacker took advantage of vulnerabilities in the custom applications that were running on the servers. The company is now migrating its applications to run on Amazon EC2 instances. The company wants to implement a solution that actively scans for vulnerabilities on the EC2 instances and sends a report that details the findings. Which solution will meet these requirements?

   • ADeploy AWS Shield to scan the EC2 instances for vulnerabilities. Create an AWS Lambda function to log any findings to AWS CloudTrail.
   • BDeploy Amazon Macie and AWS Lambda functions to scan the EC2 instances for vulnerabilities. Log any findings to AWS CloudTrail.
   • CTurn on Amazon GuardDuty. Deploy the GuardDuty agents to the EC2 instances. Configure an AWS Lambda function to automate the generation and distribution of reports that detail the findings.
   • DTurn on Amazon Inspector. Deploy the Amazon Inspector agent to the EC2 instances. Configure an AWS Lambda function to automate the generation and distribution of reports that detail the findings.

   Show answer

   Answer: D

   Explanation

   AWS Shield for DDOS Amazon Macie for discover and protect sensitive date Amazon GuardDuty for intelligent thread discovery to protect AWS account Amazon Inspector for automated security assessment. like known Vulnerability

   Source: Adapted from community discussion — siyam008

   References

   • AWS documentation

   Next question

2. Question 262 · 1017 in bank

   A company uses an Amazon EC2 instance to run a script to poll for and process messages in an Amazon Simple Queue Service (Amazon SQS) queue. The company wants to reduce operational costs while maintaining its ability to process a growing number of messages that are added to the queue. What should a solutions architect recommend to meet these requirements?

   • AIncrease the size of the EC2 instance to process messages faster.
   • BUse Amazon EventBridge to turn off the EC2 instance when the instance is underutilized.
   • CMigrate the script on the EC2 instance to an AWS Lambda function with the appropriate runtime.
   • DUse AWS Systems Manager Run Command to run the script on demand.

   Show answer

   Answer: C

   Explanation

   By migrating the script to AWS Lambda, the company can take advantage of the auto-scaling feature of the service. AWS Lambda will automatically scale resources to match the size of the workload. This means that the company will not have to worry about provisioning or managing instances as the number of messages increases, resulting in lower operational costs

   Source: Adapted from community discussion — kpato87

   Next question

3. Question 263 · 1017 in bank

   A company uses a legacy application to produce data in CSV format. The legacy application stores the output data in Amazon S3. The company is deploying a new commercial off-the-shelf (COTS) application that can perform complex SQL queries to analyze data that is stored in Amazon Redshift and Amazon S3 only. However, the COTS application cannot process the .csv files that the legacy application produces. The company cannot update the legacy application to produce data in another format. The company needs to implement a solution so that the COTS application can use the data that the legacy application produces. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate an AWS Glue extract, transform, and load (ETL) job that runs on a schedule. Configure the ETL job to process the .csv files and store the processed data in Amazon Redshift.
   • BDevelop a Python script that runs on Amazon EC2 instances to convert the .csv files to .sql files. Invoke the Python script on a cron schedule to store the output files in Amazon S3.
   • CCreate an AWS Lambda function and an Amazon DynamoDB table. Use an S3 event to invoke the Lambda function. Configure the Lambda function to perform an extract, transform, and load (ETL) job to process the .csv files and store the processed data in the DynamoDB table.
   • DUse Amazon EventBridge to launch an Amazon EMR cluster on a weekly schedule. Configure the EMR cluster to perform an extract, transform, and load (ETL) job to process the .csv files and store the processed data in an Amazon Redshift table.

   Show answer

   Answer: A

   Explanation

   Time to sell some Glue. I believe these kind of questions are there to indoctrinate us into acknowledging how blessed we are to have managed services like AWS Glue when you look at other horrible and painful options

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 264 · 1017 in bank

   Select 2

   A company recently migrated its entire IT environment to the AWS Cloud. The company discovers that users are provisioning oversized Amazon EC2 instances and modifying security group rules without using the appropriate change control process. A solutions architect must devise a strategy to track and audit these inventory and configuration changes. Which actions should the solutions architect take to meet these requirements? (Choose two.)

   • AEnable AWS CloudTrail and use it for auditing.
   • BUse data lifecycle policies for the Amazon EC2 instances.
   • CEnable AWS Trusted Advisor and reference the security dashboard.
   • DEnable AWS Config and create rules for auditing and compliance purposes.
   • ERestore previous resource configurations with an AWS CloudFormation template.

   Show answer

   Answer: AD

   Explanation

   A. Enable AWS CloudTrail and use it for auditing. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS Command Line Interface (CLI), and AWS SDKs and APIs. By enabling CloudTrail, the company can track user activity and changes to AWS resources, and monitor compliance with internal policies and external regulations. D. Enable AWS Config and create rules for auditing and compliance purposes. AWS Config provides a detailed inventory of the AWS resources in your account, and continuously records changes to the configurations of those resources. By creating rules in AWS Config, the company can automate the evaluation of resource configurations against desired state, and receive alerts when configurations drift from compliance. Options B, C, and E are not directly relevant to the requirement of tracking and auditing inventory and configuration changes.

   Source: Adapted from community discussion — LuckyAro

   Next question

5. Question 265 · 1017 in bank

   A company has hundreds of Amazon EC2 Linux-based instances in the AWS Cloud. Systems administrators have used shared SSH keys to manage the instances. After a recent audit, the company’s security team is mandating the removal of all shared keys. A solutions architect must design a solution that provides secure access to the EC2 instances. Which solution will meet this requirement with the LEAST amount of administrative overhead?

   • AUse AWS Systems Manager Session Manager to connect to the EC2 instances.
   • BUse AWS Security Token Service (AWS STS) to generate one-time SSH keys on demand.
   • CAllow shared SSH access to a set of bastion instances. Configure all other instances to allow only SSH access from the bastion instances.
   • DUse an Amazon Cognito custom authorizer to authenticate users. Invoke an AWS Lambda function to generate a temporary SSH key.

   Show answer

   Answer: A

   Explanation

   Answer is A Using AWS Systems Manager Session Manager to connect to the EC2 instances is a secure option as it eliminates the need for inbound SSH ports and removes the requirement to manage SSH keys manually. It also provides a complete audit trail of user activity. This solution requires no additional software to be installed on the EC2 instances.

   Source: Adapted from community discussion — VIad

   References

   • AWS documentation

   Next question

6. Question 266 · 1017 in bank

   A development team needs to host a website that will be accessed by other teams. The website contents consist of HTML, CSS, client-side JavaScript, and images. Which method is the MOST cost-effective for hosting the website?

   • AContainerize the website and host it in AWS Fargate.
   • BCreate an Amazon S3 bucket and host the website there.
   • CDeploy a web server on an Amazon EC2 instance to host the website.
   • DConfigure an Application Load Balancer with an AWS Lambda target that uses the Express.js framework.

   Show answer

   Answer: B

   Explanation

   By using Amazon S3 to host the website, you can take advantage of its durability, scalability, and low-cost pricing model. You only pay for the storage and data transfer associated with your website, without the need for managing and maintaining web servers or containers. This reduces the operational overhead and infrastructure costs. Containerizing the website and hosting it in AWS Fargate (option A) would involve additional complexity and costs associated with managing the container environment and scaling resources. Deploying a web server on an Amazon EC2 instance (option C) would require provisioning and managing the EC2 instance, which may not be cost-effective for a static website. Configuring an Application Load Balancer with an AWS Lambda target (option D) adds unnecessary complexity and may not be the most efficient solution for hosting a static website.

   Source: Adapted from community discussion — cookieMr

   Next question

7. Question 267 · 1017 in bank

   A company is using a fleet of Amazon EC2 instances to ingest data from on-premises data sources. The data is in JSON format and ingestion rates can be as high as 1 MB/s. When an EC2 instance is rebooted, the data in-flight is lost. The company’s data science team wants to query ingested data in near-real time. Which solution provides near-real-time data querying that is scalable with minimal data loss?

   • APublish data to Amazon Kinesis Data Streams, Use Kinesis Data Analytics to query the data.
   • BPublish data to Amazon Kinesis Data Firehose with Amazon Redshift as the destination. Use Amazon Redshift to query the data.
   • CStore ingested data in an EC2 instance store. Publish data to Amazon Kinesis Data Firehose with Amazon S3 as the destination. Use Amazon Athena to query the data.
   • DStore ingested data in an Amazon Elastic Block Store (Amazon EBS) volume. Publish data to Amazon ElastiCache for Redis. Subscribe to the Redis channel to query the data.

   Show answer

   Answer: A

   Explanation

   A: is the solution for the company's requirements. Publishing data to Amazon Kinesis Data Streams can support ingestion rates as high as 1 MB/s and provide real-time data processing. Kinesis Data Analytics can query the ingested data in real-time with low latency, and the solution can scale as needed to accommodate increases in ingestion rates or querying needs. This solution also ensures minimal data loss in the event of an EC2 instance reboot since Kinesis Data Streams has a persistent data store for up to 7 days by default.

   Source: Adapted from community discussion — LuckyAro

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 268 · 1017 in bank

   What should a solutions architect do to ensure that all objects uploaded to an Amazon S3 bucket are encrypted?

   • AUpdate the bucket policy to deny if the PutObject does not have an s3:x-amz-acl header set.
   • BUpdate the bucket policy to deny if the PutObject does not have an s3:x-amz-acl header set to private.
   • CUpdate the bucket policy to deny if the PutObject does not have an aws:SecureTransport header set to true.
   • DUpdate the bucket policy to deny if the PutObject does not have an x-amz-server-side-encryption header set.

   Show answer

   Answer: D

   Explanation

   Related reading because (as of Jan 2023) S3 buckets have encryption enabled by default. https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html "If you require your data uploads to be encrypted using only Amazon S3 managed keys, you can use the following bucket policy. For example, the following bucket policy denies permissions to upload an object unless the request includes the x-amz-server-side-encryption header to request server-side encryption:"

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 269 · 1017 in bank

   A solutions architect is designing a multi-tier application for a company. The application's users upload images from a mobile device. The application generates a thumbnail of each image and returns a message to the user to confirm that the image was uploaded successfully. The thumbnail generation can take up to 60 seconds, but the company wants to provide a faster response time to its users to notify them that the original image was received. The solutions architect must design the application to asynchronously dispatch requests to the different application tiers. What should the solutions architect do to meet these requirements?

   • AWrite a custom AWS Lambda function to generate the thumbnail and alert the user. Use the image upload process as an event source to invoke the Lambda function.
   • BCreate an AWS Step Functions workflow. Configure Step Functions to handle the orchestration between the application tiers and alert the user when thumbnail generation is complete.
   • CCreate an Amazon Simple Queue Service (Amazon SQS) message queue. As images are uploaded, place a message on the SQS queue for thumbnail generation. Alert the user through an application message that the image was received.
   • DCreate Amazon Simple Notification Service (Amazon SNS) notification topics and subscriptions. Use one subscription with the application to generate the thumbnail after the image upload is complete. Use a second subscription to message the user's mobile app by way of a push notification after thumbnail generation is complete.

   Show answer

   Answer: C

   Explanation

   Answers B and D alert the user when thumbnail generation is complete. Answer C alerts the user through an application message that the image was received.

   Source: Adapted from community discussion — Zox42

   Next question

10. Question 270 · 1017 in bank

    A company’s facility has badge readers at every entrance throughout the building. When badges are scanned, the readers send a message over HTTPS to indicate who attempted to access that particular entrance. A solutions architect must design a system to process these messages from the sensors. The solution must be highly available, and the results must be made available for the company’s security team to analyze. Which system architecture should the solutions architect recommend?

    • ALaunch an Amazon EC2 instance to serve as the HTTPS endpoint and to process the messages. Configure the EC2 instance to save the results to an Amazon S3 bucket.
    • BCreate an HTTPS endpoint in Amazon API Gateway. Configure the API Gateway endpoint to invoke an AWS Lambda function to process the messages and save the results to an Amazon DynamoDB table.
    • CUse Amazon Route 53 to direct incoming sensor messages to an AWS Lambda function. Configure the Lambda function to process the messages and save the results to an Amazon DynamoDB table.
    • DCreate a gateway VPC endpoint for Amazon S3. Configure a Site-to-Site VPN connection from the facility network to the VPC so that sensor data can be written directly to an S3 bucket by way of the VPC endpoint.

    Show answer

    Answer: B

    Explanation

    - Option A would not provide high availability. A single EC2 instance is a single point of failure. - Option B provides a scalable, highly available solution using serverless services. API Gateway and Lambda can scale automatically, and DynamoDB provides a durable data store. - Option C would expose the Lambda function directly to the public Internet, which is not a recommended architecture. API Gateway provides an abstraction layer and additional features like access control. - Option D requires configuring a VPN to AWS which adds complexity. It also saves the raw sensor data to S3, rather than processing it and storing the results.

    Source: Adapted from community discussion — kruasan

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 261. 1017 questions available.