SAA-C03 practice questions 361–370

1. Question 361 · 1017 in bank

   Select 2

   A solutions architect is designing the architecture for a software demonstration environment. The environment will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The system will experience significant increases in traffic during working hours but is not required to operate on weekends. Which combination of actions should the solutions architect take to ensure that the system can scale to meet demand? (Choose two.)

   • AUse AWS Auto Scaling to adjust the ALB capacity based on request rate.
   • BUse AWS Auto Scaling to scale the capacity of the VPC internet gateway.
   • CLaunch the EC2 instances in multiple AWS Regions to distribute the load across Regions.
   • DUse a target tracking scaling policy to scale the Auto Scaling group based on instance CPU utilization.
   • EUse scheduled scaling to change the Auto Scaling group minimum, maximum, and desired capacity to zero for weekends. Revert to the default values at the start of the week.

   Show answer

   Answer: DE

   Explanation

   Not A - "AWS Auto Scaling" cannot adjust "ALB capacity" (https://aws.amazon.com/autoscaling/faqs/) Not B - VPC internet gateway has nothing to do with this Not C - Regions have nothing to do with scaling "The system will experience significant increases in traffic during working hours" -> addressed by D "But is not required to operate on weekends" -> addressed by E

   Source: Adapted from community discussion — pentium75

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 362 · 1017 in bank

   Select 2

   A solutions architect is designing a two-tiered architecture that includes a public subnet and a database subnet. The web servers in the public subnet must be open to the internet on port 443. The Amazon RDS for MySQL DB instance in the database subnet must be accessible only to the web servers on port 3306. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

   • ACreate a network ACL for the public subnet. Add a rule to deny outbound traffic to 0.0.0.0/0 on port 3306.
   • BCreate a security group for the DB instance. Add a rule to allow traffic from the public subnet CIDR block on port 3306.
   • CCreate a security group for the web servers in the public subnet. Add a rule to allow traffic from 0.0.0.0/0 on port 443.
   • DCreate a security group for the DB instance. Add a rule to allow traffic from the web servers’ security group on port 3306.
   • ECreate a security group for the DB instance. Add a rule to deny all traffic except traffic from the web servers’ security group on port 3306.

   Show answer

   Answer: CD

   Explanation

   To meet the requirements of allowing access to the web servers in the public subnet on port 443 and the Amazon RDS for MySQL DB instance in the database subnet on port 3306, the best solution would be to create a security group for the web servers and another security group for the DB instance, and then define the appropriate inbound and outbound rules for each security group. 1. Create a security group for the web servers in the public subnet. Add a rule to allow traffic from 0.0.0.0/0 on port 443. 2. Create a security group for the DB instance. Add a rule to allow traffic from the web servers' security group on port 3306. This will allow the web servers in the public subnet to receive traffic from the internet on port 443, and the Amazon RDS for MySQL DB instance in the database subnet to receive traffic only from the web servers on port 3306.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • AWS documentation

   Next question

3. Question 363 · 1017 in bank

   A company is implementing a shared storage solution for a gaming application that is hosted in the AWS Cloud. The company needs the ability to use Lustre clients to access data. The solution must be fully managed. Which solution meets these requirements?

   • ACreate an AWS DataSync task that shares the data as a mountable file system. Mount the file system to the application server.
   • BCreate an AWS Storage Gateway file gateway. Create a file share that uses the required client protocol. Connect the application server to the file share.
   • CCreate an Amazon Elastic File System (Amazon EFS) file system, and configure it to support Lustre. Attach the file system to the origin server. Connect the application server to the file system.
   • DCreate an Amazon FSx for Lustre file system. Attach the file system to the origin server. Connect the application server to the file system.

   Show answer

   Answer: D

   Explanation

   To meet the requirements of a shared storage solution for a gaming application that can be accessed using Lustre clients and is fully managed, the best solution would be to use Amazon FSx for Lustre. Amazon FSx for Lustre is a fully managed file system that is optimized for compute-intensive workloads, such as high-performance computing, machine learning, and gaming. It provides a POSIX-compliant file system that can be accessed using Lustre clients and offers high performance, scalability, and data durability. This solution provides a highly available, scalable, and fully managed shared storage solution that can be accessed using Lustre clients. Amazon FSx for Lustre is optimized for compute-intensive workloads and provides high performance and durability.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   Next question

4. Question 364 · 1017 in bank

   A company runs an application that receives data from thousands of geographically dispersed remote devices that use UDP. The application processes the data immediately and sends a message back to the device if necessary. No data is stored. The company needs a solution that minimizes latency for the data transmission from the devices. The solution also must provide rapid failover to another AWS Region. Which solution will meet these requirements?

   • AConfigure an Amazon Route 53 failover routing policy. Create a Network Load Balancer (NLB) in each of the two Regions. Configure the NLB to invoke an AWS Lambda function to process the data.
   • BUse AWS Global Accelerator. Create a Network Load Balancer (NLB) in each of the two Regions as an endpoint. Create an Amazon Elastic Container Service (Amazon ECS) cluster with the Fargate launch type. Create an ECS service on the cluster. Set the ECS service as the target for the NLProcess the data in Amazon ECS.
   • CUse AWS Global Accelerator. Create an Application Load Balancer (ALB) in each of the two Regions as an endpoint. Create an Amazon Elastic Container Service (Amazon ECS) cluster with the Fargate launch type. Create an ECS service on the cluster. Set the ECS service as the target for the ALB. Process the data in Amazon ECS.
   • DConfigure an Amazon Route 53 failover routing policy. Create an Application Load Balancer (ALB) in each of the two Regions. Create an Amazon Elastic Container Service (Amazon ECS) cluster with the Fargate launch type. Create an ECS service on the cluster. Set the ECS service as the target for the ALB. Process the data in Amazon ECS.

   Show answer

   Answer: B

   Explanation

   Key words: geographically dispersed, UDP. Geographically dispersed (related to UDP) - Global Accelerator - multiple entrances worldwide to the AWS network to provide better transfer rates. UDP - NLB (Network Load Balancer).

   Source: Adapted from community discussion — UnluckyDucky

   Next question

5. Question 365 · 1017 in bank

   A solutions architect must migrate a Windows Internet Information Services (IIS) web application to AWS. The application currently relies on a file share hosted in the user's on-premises network-attached storage (NAS). The solutions architect has proposed migrating the IIS web servers to Amazon EC2 instances in multiple Availability Zones that are connected to the storage solution, and configuring an Elastic Load Balancer attached to the instances. Which replacement to the on-premises file share is MOST resilient and durable?

   • AMigrate the file share to Amazon RDS.
   • BMigrate the file share to AWS Storage Gateway.
   • CMigrate the file share to Amazon FSx for Windows File Server.
   • DMigrate the file share to Amazon Elastic File System (Amazon EFS).

   Show answer

   Answer: C

   Explanation

   A) RDS is a database service B) Storage Gateway is a hybrid cloud storage service that connects on-premises applications to AWS storage services. D) provides shared file storage for Linux-based workloads, but it does not natively support Windows-based workloads.

   Source: Adapted from community discussion — channn

   Next question

6. Question 366 · 1017 in bank

   A company's application integrates with multiple software-as-a-service (SaaS) sources for data collection. The company runs Amazon EC2 instances to receive the data and to upload the data to an Amazon S3 bucket for analysis. The same EC2 instance that receives and uploads the data also sends a notification to the user when an upload is complete. The company has noticed slow application performance and wants to improve the performance as much as possible. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate an Auto Scaling group so that EC2 instances can scale out. Configure an S3 event notification to send events to an Amazon Simple Notification Service (Amazon SNS) topic when the upload to the S3 bucket is complete.
   • BCreate an Amazon AppFlow flow to transfer data between each SaaS source and the S3 bucket. Configure an S3 event notification to send events to an Amazon Simple Notification Service (Amazon SNS) topic when the upload to the S3 bucket is complete.
   • CCreate an Amazon EventBridge (Amazon CloudWatch Events) rule for each SaaS source to send output data. Configure the S3 bucket as the rule's target. Create a second EventBridge (Cloud Watch Events) rule to send events when the upload to the S3 bucket is complete. Configure an Amazon Simple Notification Service (Amazon SNS) topic as the second rule's target.
   • DCreate a Docker container to use instead of an EC2 instance. Host the containerized application on Amazon Elastic Container Service (Amazon ECS). Configure Amazon CloudWatch Container Insights to send events to an Amazon Simple Notification Service (Amazon SNS) topic when the upload to the S3 bucket is complete.

   Show answer

   Answer: B

   Explanation

   configuring Auto-Scaling also takes time when compared to AppFlow, in AWS's words "in just a few clicks" > Amazon AppFlow is a fully managed integration service that enables you to securely transfer data between Software-as-a-Service (SaaS) applications like Salesforce, SAP, Zendesk, Slack, and ServiceNow, and AWS services like Amazon S3 and Amazon Redshift, in just a few clicks

   Source: Adapted from community discussion — Six_Fingered_Jose

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 367 · 1017 in bank

   A company is deploying a new application on Amazon EC2 instances. The application writes data to Amazon Elastic Block Store (Amazon EBS) volumes. The company needs to ensure that all data that is written to the EBS volumes is encrypted at rest. Which solution will meet this requirement?

   • ACreate an IAM role that specifies EBS encryption. Attach the role to the EC2 instances.
   • BCreate the EBS volumes as encrypted volumes. Attach the EBS volumes to the EC2 instances.
   • CCreate an EC2 instance tag that has a key of Encrypt and a value of True. Tag all instances that require encryption at the EBS level.
   • DCreate an AWS Key Management Service (AWS KMS) key policy that enforces EBS encryption in the account. Ensure that the key policy is active.

   Show answer

   Answer: B

   Explanation

   The solution that will meet the requirement of ensuring that all data that is written to the EBS volumes is encrypted at rest is B. Create the EBS volumes as encrypted volumes and attach the encrypted EBS volumes to the EC2 instances. When you create an EBS volume, you can specify whether to encrypt the volume. If you choose to encrypt the volume, all data written to the volume is automatically encrypted at rest using AWS-managed keys. You can also use customer-managed keys (CMKs) stored in AWS KMS to encrypt and protect your EBS volumes. You can create encrypted EBS volumes and attach them to EC2 instances to ensure that all data written to the volumes is encrypted at rest. Answer A is incorrect because attaching an IAM role to the EC2 instances does not automatically encrypt the EBS volumes. Answer C is incorrect because adding an EC2 instance tag does not ensure that the EBS volumes are encrypted.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   Next question

8. Question 368 · 1017 in bank

   A company has a web application with sporadic usage patterns. There is heavy usage at the beginning of each month, moderate usage at the start of each week, and unpredictable usage during the week. The application consists of a web server and a MySQL database server running inside the data center. The company would like to move the application to the AWS Cloud, and needs to select a cost-effective database platform that will not require database modifications. Which solution will meet these requirements?

   • AAmazon DynamoDB
   • BAmazon RDS for MySQL
   • CMySQL-compatible Amazon Aurora Serverless
   • DMySQL deployed on Amazon EC2 in an Auto Scaling group

   Show answer

   Answer: C

   Explanation

   C: Aurora Serverless is a MySQL-compatible relational database engine that automatically scales compute and memory resources based on application usage. no upfront costs or commitments required. A: DynamoDB is a NoSQL B: Fixed cost on RDS class D: More operation requires

   Source: Adapted from community discussion — channn

   Next question

9. Question 369 · 1017 in bank

   An image-hosting company stores its objects in Amazon S3 buckets. The company wants to avoid accidental exposure of the objects in the S3 buckets to the public. All S3 objects in the entire AWS account need to remain private. Which solution will meet these requirements?

   • AUse Amazon GuardDuty to monitor S3 bucket policies. Create an automatic remediation action rule that uses an AWS Lambda function to remediate any change that makes the objects public.
   • BUse AWS Trusted Advisor to find publicly accessible S3 buckets. Configure email notifications in Trusted Advisor when a change is detected. Manually change the S3 bucket policy if it allows public access.
   • CUse AWS Resource Access Manager to find publicly accessible S3 buckets. Use Amazon Simple Notification Service (Amazon SNS) to invoke an AWS Lambda function when a change is detected. Deploy a Lambda function that programmatically remediates the change.
   • DUse the S3 Block Public Access feature on the account level. Use AWS Organizations to create a service control policy (SCP) that prevents IAM users from changing the setting. Apply the SCP to the account.

   Show answer

   Answer: D

   Explanation

   Answer is D ladies and gentlemen. While guard duty helps to monitor s3 for potential threats its a reactive action. We should always be proactive and not reactive in our solutions so D, block public access to avoid any possibility of the info becoming publicly accessible

   Source: Adapted from community discussion — Ruhi02

   References

   • AWS documentation

   Next question

10. Question 370 · 1017 in bank

    An ecommerce company is experiencing an increase in user traffic. The company’s store is deployed on Amazon EC2 instances as a two-tier web application consisting of a web tier and a separate database tier. As traffic increases, the company notices that the architecture is causing significant delays in sending timely marketing and order confirmation email to users. The company wants to reduce the time it spends resolving complex email delivery issues and minimize operational overhead. What should a solutions architect do to meet these requirements?

    • ACreate a separate application tier using EC2 instances dedicated to email processing.
    • BConfigure the web instance to send email through Amazon Simple Email Service (Amazon SES).
    • CConfigure the web instance to send email through Amazon Simple Notification Service (Amazon SNS).
    • DCreate a separate application tier using EC2 instances dedicated to email processing. Place the instances in an Auto Scaling group.

    Show answer

    Answer: B

    Explanation

    Amazon SES is a cost-effective and scalable email service that enables businesses to send and receive email using their own email addresses and domains. Configuring the web instance to send email through Amazon SES is a simple and effective solution that can reduce the time spent resolving complex email delivery issues and minimize operational overhead.

    Source: Adapted from community discussion — elearningtakai

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 361. 1017 questions available.