SAA-C03 practice questions 321–330

1. Question 321 · 1017 in bank

   A company recently launched a variety of new workloads on Amazon EC2 instances in its AWS account. The company needs to create a strategy to access and administer the instances remotely and securely. The company needs to implement a repeatable process that works with native AWS services and follows the AWS Well-Architected Framework. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse the EC2 serial console to directly access the terminal interface of each instance for administration.
   • BAttach the appropriate IAM role to each existing instance and new instance. Use AWS Systems Manager Session Manager to establish a remote SSH session.
   • CCreate an administrative SSH key pair. Load the public key into each EC2 instance. Deploy a bastion host in a public subnet to provide a tunnel for administration of each instance.
   • DEstablish an AWS Site-to-Site VPN connection. Instruct administrators to use their local on-premises machines to connect directly to the instances by using SSH keys across the VPN tunnel.

   Show answer

   Answer: B

   Explanation

   How can Session Manager benefit my organization? Ans: No open inbound ports and no need to manage bastion hosts or SSH keys https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html

   Source: Adapted from community discussion — BoboChow

   References

   • AWS documentation

   Next question

2. Question 322 · 1017 in bank

   A company runs a public three-tier web application in a VPC. The application runs on Amazon EC2 instances across multiple Availability Zones. The EC2 instances that run in private subnets need to communicate with a license server over the internet. The company needs a managed solution that minimizes operational maintenance. Which solution meets these requirements?

   • AProvision a NAT instance in a public subnet. Modify each private subnet's route table with a default route that points to the NAT instance.
   • BProvision a NAT instance in a private subnet. Modify each private subnet's route table with a default route that points to the NAT instance.
   • CProvision a NAT gateway in a public subnet. Modify each private subnet's route table with a default route that points to the NAT gateway.
   • DProvision a NAT gateway in a private subnet. Modify each private subnet's route table with a default route that points to the NAT gateway.

   Show answer

   Answer: C

   Explanation

   "The company needs a managed solution that minimizes operational maintenance" Watch out for NAT instances vs NAT Gateways. As the company needs a managed solution that minimizes operational maintenance - NAT Gateway is a public subnet is the answer.

   Source: Adapted from community discussion — UnluckyDucky

   References

   • AWS documentation

   Next question

3. Question 323 · 1017 in bank

   Select 2

   A company needs to create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to host a digital media streaming application. The EKS cluster will use a managed node group that is backed by Amazon Elastic Block Store (Amazon EBS) volumes for storage. The company must encrypt all data at rest by using a customer managed key that is stored in AWS Key Management Service (AWS KMS). Which combination of actions will meet this requirement with the LEAST operational overhead? (Choose two.)

   • AUse a Kubernetes plugin that uses the customer managed key to perform data encryption.
   • BAfter creation of the EKS cluster, locate the EBS volumes. Enable encryption by using the customer managed key.
   • CEnable EBS encryption by default in the AWS Region where the EKS cluster will be created. Select the customer managed key as the default key.
   • DCreate the EKS cluster. Create an IAM role that has a policy that grants permission to the customer managed key. Associate the role with the EKS cluster.
   • EStore the customer managed key as a Kubernetes secret in the EKS cluster. Use the customer managed key to encrypt the EBS volumes.

   Show answer

   Answer: CD

   Explanation

   It says: 'The company must encrypt ALL data at rest', so there is nothing wrong with 'enabling EBS encryption by default' . C & D

   Source: Adapted from community discussion — frmrkc

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 324 · 1017 in bank

   A company wants to migrate an Oracle database to AWS. The database consists of a single table that contains millions of geographic information systems (GIS) images that are high resolution and are identified by a geographic code. When a natural disaster occurs, tens of thousands of images get updated every few minutes. Each geographic code has a single image or row that is associated with it. The company wants a solution that is highly available and scalable during such events. Which solution meets these requirements MOST cost-effectively?

   • AStore the images and geographic codes in a database table. Use Oracle running on an Amazon RDS Multi-AZ DB instance.
   • BStore the images in Amazon S3 buckets. Use Amazon DynamoDB with the geographic code as the key and the image S3 URL as the value.
   • CStore the images and geographic codes in an Amazon DynamoDB table. Configure DynamoDB Accelerator (DAX) during times of high load.
   • DStore the images in Amazon S3 buckets. Store geographic codes and image S3 URLs in a database table. Use Oracle running on an Amazon RDS Multi-AZ DB instance.

   Show answer

   Answer: B

   Explanation

   They are currently using Oracle, but only for one simple table with a single key-value pair. This is a typical use case for a NoSQL database like DynamoDB (and whoever decided to use Oracle for this in the first place should be fired). Oracle is expensive as hell, so options A and D might work but are surely not cost-effective. C won't work because the images are too big for the database. Leaves B which would be the ideal solution and meet the availability and scalability requirements.

   Source: Adapted from community discussion — pentium75

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 325 · 1017 in bank

   A company has an application that collects data from IoT sensors on automobiles. The data is streamed and stored in Amazon S3 through Amazon Kinesis Data Firehose. The data produces trillions of S3 objects each year. Each morning, the company uses the data from the previous 30 days to retrain a suite of machine learning (ML) models. Four times each year, the company uses the data from the previous 12 months to perform analysis and train other ML models. The data must be available with minimal delay for up to 1 year. After 1 year, the data must be retained for archival purposes. Which storage solution meets these requirements MOST cost-effectively?

   • AUse the S3 Intelligent-Tiering storage class. Create an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 1 year.
   • BUse the S3 Intelligent-Tiering storage class. Configure S3 Intelligent-Tiering to automatically move objects to S3 Glacier Deep Archive after 1 year.
   • CUse the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Create an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 1 year.
   • DUse the S3 Standard storage class. Create an S3 Lifecycle policy to transition objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days, and then to S3 Glacier Deep Archive after 1 year.

   Show answer

   Answer: D

   Explanation

   D because: - First 30 days- data access every morning ( predictable and frequently) – S3 standard - After 30 days, accessed 4 times a year – S3 infrequently access - Data preserved- S3 Gllacier Deep Archive

   Source: Adapted from community discussion — [Removed]

   Next question

6. Question 326 · 1017 in bank

   A company is running several business applications in three separate VPCs within the us-east-1 Region. The applications must be able to communicate between VPCs. The applications also must be able to consistently send hundreds of gigabytes of data each day to a latency-sensitive application that runs in a single on-premises data center. A solutions architect needs to design a network connectivity solution that maximizes cost-effectiveness. Which solution meets these requirements?

   • AConfigure three AWS Site-to-Site VPN connections from the data center to AWS. Establish connectivity by configuring one VPN connection for each VPC.
   • BLaunch a third-party virtual network appliance in each VPC. Establish an IPsec VPN tunnel between the data center and each virtual appliance.
   • CSet up three AWS Direct Connect connections from the data center to a Direct Connect gateway in us-east-1. Establish connectivity by configuring each VPC to use one of the Direct Connect connections.
   • DSet up one AWS Direct Connect connection from the data center to AWS. Create a transit gateway, and attach each VPC to the transit gateway. Establish connectivity between the Direct Connect connection and the transit gateway.

   Show answer

   Answer: D

   Explanation

   AWS Transit Gateway connects your Amazon Virtual Private Clouds (VPCs) and on-premises networks through a central hub. This connection simplifies your network and puts an end to complex peering relationships. Transit Gateway acts as a highly scalable cloud router—each new connection is made only once. https://aws.amazon.com/transit-gateway/#:~:text=AWS-,Transit%20Gateway,-connects%20your%20Amazon

   Source: Adapted from community discussion — TariqKipkemei

   References

   • AWS documentation

   Next question

7. Question 327 · 1017 in bank

   An ecommerce company is building a distributed application that involves several serverless functions and AWS services to complete order-processing tasks. These tasks require manual approvals as part of the workflow. A solutions architect needs to design an architecture for the order-processing application. The solution must be able to combine multiple AWS Lambda functions into responsive serverless applications. The solution also must orchestrate data and services that run on Amazon EC2 instances, containers, or on-premises servers. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse AWS Step Functions to build the application.
   • BIntegrate all the application components in an AWS Glue job.
   • CUse Amazon Simple Queue Service (Amazon SQS) to build the application.
   • DUse AWS Lambda functions and Amazon EventBridge events to build the application.

   Show answer

   Answer: A

   Explanation

   AWS Step Functions is a fully managed service that makes it easy to build applications by coordinating the components of distributed applications and microservices using visual workflows. With Step Functions, you can combine multiple AWS Lambda functions into responsive serverless applications and orchestrate data and services that run on Amazon EC2 instances, containers, or on-premises servers. Step Functions also allows for manual approvals as part of the workflow. This solution meets all the requirements with the least operational overhead.

   Source: Adapted from community discussion — kinglong12

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 328 · 1017 in bank

   A company has launched an Amazon RDS for MySQL DB instance. Most of the connections to the database come from serverless applications. Application traffic to the database changes significantly at random intervals. At times of high demand, users report that their applications experience database connection rejection errors. Which solution will resolve this issue with the LEAST operational overhead?

   • ACreate a proxy in RDS Proxy. Configure the users’ applications to use the DB instance through RDS Proxy.
   • BDeploy Amazon ElastiCache for Memcached between the users’ applications and the DB instance.
   • CMigrate the DB instance to a different instance class that has higher I/O capacity. Configure the users’ applications to use the new DB instance.
   • DConfigure Multi-AZ for the DB instance. Configure the users’ applications to switch between the DB instances.

   Show answer

   Answer: A

   Explanation

   Many applications, including those built on modern serverless architectures, can have a large number of open connections to the database server and may open and close database connections at a high rate, exhausting database memory and compute resources. Amazon RDS Proxy allows applications to pool and share connections established with the database, improving database efficiency and application scalability. (https://aws.amazon.com/pt/rds/proxy/)

   Source: Adapted from community discussion — COTIT

   References

   • AWS documentation

   Next question

9. Question 329 · 1017 in bank

   A company recently deployed a new auditing system to centralize information about operating system versions, patching, and installed software for Amazon EC2 instances. A solutions architect must ensure all instances provisioned through EC2 Auto Scaling groups successfully send reports to the auditing system as soon as they are launched and terminated. Which solution achieves these goals MOST efficiently?

   • AUse a scheduled AWS Lambda function and run a script remotely on all EC2 instances to send data to the audit system.
   • BUse EC2 Auto Scaling lifecycle hooks to run a custom script to send data to the audit system when instances are launched and terminated.
   • CUse an EC2 Auto Scaling launch configuration to run a custom script through user data to send data to the audit system when instances are launched and terminated.
   • DRun a custom script on the instance operating system to send data to the audit system. Configure the script to be invoked by the EC2 Auto Scaling group when the instance starts and is terminated.

   Show answer

   Answer: B

   Explanation

   The most efficient solution for this scenario is to use EC2 Auto Scaling lifecycle hooks to run a custom script to send data to the audit system when instances are launched and terminated. The lifecycle hook can be used to delay instance termination until the script has completed, ensuring that all data is sent to the audit system before the instance is terminated. This solution is more efficient than using a scheduled AWS Lambda function, which would require running the function periodically and may not capture all instances launched and terminated within the interval. Running a custom script through user data is also not an optimal solution, as it may not guarantee that all instances send data to the audit system. Therefore, option B is the correct answer.

   Source: Adapted from community discussion — ktulu2602

   References

   • AWS documentation

   Next question

10. Question 330 · 1017 in bank

    A company is developing a real-time multiplayer game that uses UDP for communications between the client and servers in an Auto Scaling group. Spikes in demand are anticipated during the day, so the game server platform must adapt accordingly. Developers want to store gamer scores and other non-relational data in a database solution that will scale without intervention. Which solution should a solutions architect recommend?

    • AUse Amazon Route 53 for traffic distribution and Amazon Aurora Serverless for data storage.
    • BUse a Network Load Balancer for traffic distribution and Amazon DynamoDB on-demand for data storage.
    • CUse a Network Load Balancer for traffic distribution and Amazon Aurora Global Database for data storage.
    • DUse an Application Load Balancer for traffic distribution and Amazon DynamoDB global tables for data storage.

    Show answer

    Answer: B

    Explanation

    This option provides the most scalable and optimized architecture for the real-time multiplayer game: Network Load Balancer efficiently distributes UDP gaming traffic to the Auto Scaling group of game servers. DynamoDB On-Demand mode provides auto-scaling non-relational data storage for gamer scores and other game data. DynamoDB is optimized for fast, high-scale access patterns seen in gaming. Together, the Network Load Balancer and DynamoDB On-Demand provide an architecture that can smoothly scale up and down to match spikes in gaming demand.

    Source: Adapted from community discussion — Guru4Cloud

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 321. 1017 questions available.