SAA-C03 practice questions 371–380

1. Question 371 · 1017 in bank

   A company has a business system that generates hundreds of reports each day. The business system saves the reports to a network share in CSV format. The company needs to store this data in the AWS Cloud in near-real time for analysis. Which solution will meet these requirements with the LEAST administrative overhead?

   • AUse AWS DataSync to transfer the files to Amazon S3. Create a scheduled task that runs at the end of each day.
   • BCreate an Amazon S3 File Gateway. Update the business system to use a new network share from the S3 File Gateway.
   • CUse AWS DataSync to transfer the files to Amazon S3. Create an application that uses the DataSync API in the automation workflow.
   • DDeploy an AWS Transfer for SFTP endpoint. Create a script that checks for new files on the network share and uploads the new files by using SFTP.

   Show answer

   Answer: B

   Explanation

   Both Amazon S3 File Gateway and AWS DataSync are suitable for this scenario. But there is a requirement for 'LEAST administrative overhead'. Option C involves the creation of an entirely new application to consume the DataSync API, this rules out this option.

   Source: Adapted from community discussion — TariqKipkemei

   References

   • AWS documentation

   Next question

2. Question 372 · 1017 in bank

   A company is storing petabytes of data in Amazon S3 Standard. The data is stored in multiple S3 buckets and is accessed with varying frequency. The company does not know access patterns for all the data. The company needs to implement a solution for each S3 bucket to optimize the cost of S3 usage. Which solution will meet these requirements with the MOST operational efficiency?

   • ACreate an S3 Lifecycle configuration with a rule to transition the objects in the S3 bucket to S3 Intelligent-Tiering.
   • BUse the S3 storage class analysis tool to determine the correct tier for each object in the S3 bucket. Move each object to the identified storage tier.
   • CCreate an S3 Lifecycle configuration with a rule to transition the objects in the S3 bucket to S3 Glacier Instant Retrieval.
   • DCreate an S3 Lifecycle configuration with a rule to transition the objects in the S3 bucket to S3 One Zone-Infrequent Access (S3 One Zone-IA).

   Show answer

   Answer: A

   Explanation

   The correct answer is A. Creating an S3 Lifecycle configuration with a rule to transition the objects in the S3 bucket to S3 Intelligent-Tiering would be the most efficient solution to optimize the cost of S3 usage. S3 Intelligent-Tiering is a storage class that automatically moves objects between two access tiers (frequent and infrequent) based on changing access patterns. It is a cost-effective solution that does not require any manual intervention to move data to different storage classes, unlike the other options.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • AWS documentation

   Next question

3. Question 373 · 1017 in bank

   Select 2

   A rapidly growing global ecommerce company is hosting its web application on AWS. The web application includes static content and dynamic content. The website stores online transaction processing (OLTP) data in an Amazon RDS database The website’s users are experiencing slow page loads. Which combination of actions should a solutions architect take to resolve this issue? (Choose two.)

   • AConfigure an Amazon Redshift cluster.
   • BSet up an Amazon CloudFront distribution.
   • CHost the dynamic web content in Amazon S3.
   • DCreate a read replica for the RDS DB instance.
   • EConfigure a Multi-AZ deployment for the RDS DB instance.

   Show answer

   Answer: BD

   Explanation

   To resolve the issue of slow page loads for a rapidly growing e-commerce website hosted on AWS, a solutions architect can take the following two actions: 1. Set up an Amazon CloudFront distribution 2. Create a read replica for the RDS DB instance Configuring an Amazon Redshift cluster is not relevant to this issue since Redshift is a data warehousing service and is typically used for the analytical processing of large amounts of data. Hosting the dynamic web content in Amazon S3 may not necessarily improve performance since S3 is an object storage service, not a web application server. While S3 can be used to host static web content, it may not be suitable for hosting dynamic web content since S3 doesn't support server-side scripting or processing. Configuring a Multi-AZ deployment for the RDS DB instance will improve high availability but may not necessarily improve performance.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • AWS documentation

   Next question

4. Question 374 · 1017 in bank

   A company uses Amazon EC2 instances and AWS Lambda functions to run its application. The company has VPCs with public subnets and private subnets in its AWS account. The EC2 instances run in a private subnet in one of the VPCs. The Lambda functions need direct network access to the EC2 instances for the application to work. The application will run for at least 1 year. The company expects the number of Lambda functions that the application uses to increase during that time. The company wants to maximize its savings on all application resources and to keep network latency between the services low. Which solution will meet these requirements?

   • APurchase an EC2 Instance Savings Plan Optimize the Lambda functions’ duration and memory usage and the number of invocations. Connect the Lambda functions to the private subnet that contains the EC2 instances.
   • BPurchase an EC2 Instance Savings Plan Optimize the Lambda functions' duration and memory usage, the number of invocations, and the amount of data that is transferred. Connect the Lambda functions to a public subnet in the same VPC where the EC2 instances run.
   • CPurchase a Compute Savings Plan. Optimize the Lambda functions’ duration and memory usage, the number of invocations, and the amount of data that is transferred. Connect the Lambda functions to the private subnet that contains the EC2 instances.
   • DPurchase a Compute Savings Plan. Optimize the Lambda functions’ duration and memory usage, the number of invocations, and the amount of data that is transferred. Keep the Lambda functions in the Lambda service VPC.

   Show answer

   Answer: C

   Explanation

   Answer C is the best solution that meets the company’s requirements. By purchasing a Compute Savings Plan, the company can save on the costs of running both EC2 instances and Lambda functions. The Lambda functions can be connected to the private subnet that contains the EC2 instances through a VPC endpoint for AWS services or a VPC peering connection. This provides direct network access to the EC2 instances while keeping the traffic within the private network, which helps to minimize network latency. Optimizing the Lambda functions’ duration, memory usage, number of invocations, and amount of data transferred can help to further minimize costs and improve performance. Additionally, using a private subnet helps to ensure that the EC2 instances are not directly accessible from the public internet, which is a security best practice.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 375 · 1017 in bank

   A solutions architect needs to allow team members to access Amazon S3 buckets in two different AWS accounts: a development account and a production account. The team currently has access to S3 buckets in the development account by using unique IAM users that are assigned to an IAM group that has appropriate permissions in the account. The solutions architect has created an IAM role in the production account. The role has a policy that grants access to an S3 bucket in the production account. Which solution will meet these requirements while complying with the principle of least privilege?

   • AAttach the Administrator Access policy to the development account users.
   • BAdd the development account as a principal in the trust policy of the role in the production account.
   • CTurn off the S3 Block Public Access feature on the S3 bucket in the production account.
   • DCreate a user in the production account with unique credentials for each team member.

   Show answer

   Answer: B

   Explanation

   By adding the development account as a principal in the trust policy of the IAM role in the production account, you are allowing users from the development account to assume the role in the production account. This allows the team members to access the S3 bucket in the production account without granting them unnecessary privileges.

   Source: Adapted from community discussion — gpt_test

   References

   • AWS documentation

   Next question

6. Question 376 · 1017 in bank

   Select 2

   A company uses AWS Organizations with all features enabled and runs multiple Amazon EC2 workloads in the ap-southeast-2 Region. The company has a service control policy (SCP) that prevents any resources from being created in any other Region. A security policy requires the company to encrypt all data at rest. An audit discovers that employees have created Amazon Elastic Block Store (Amazon EBS) volumes for EC2 instances without encrypting the volumes. The company wants any new EC2 instances that any IAM user or root user launches in ap-southeast-2 to use encrypted EBS volumes. The company wants a solution that will have minimal effect on employees who create EBS volumes. Which combination of steps will meet these requirements? (Choose two.)

   • AIn the Amazon EC2 console, select the EBS encryption account attribute and define a default encryption key.
   • BCreate an IAM permission boundary. Attach the permission boundary to the root organizational unit (OU). Define the boundary to deny the ec2:CreateVolume action when the ec2:Encrypted condition equals false.
   • CCreate an SCP. Attach the SCP to the root organizational unit (OU). Define the SCP to deny the ec2:CreateVolume action whenthe ec2:Encrypted condition equals false.
   • DUpdate the IAM policies for each account to deny the ec2:CreateVolume action when the ec2:Encrypted condition equals false.
   • EIn the Organizations management account, specify the Default EBS volume encryption setting.

   Show answer

   Answer: CE

   Explanation

   The correct answer is (C) and (E). Option (C): Creating an SCP and attaching it to the root organizational unit (OU) will deny the ec2:CreateVolume action when the ec2:Encrypted condition equals false. This means that any IAM user or root user in any account in the organization will not be able to create an EBS volume without encrypting it. Option (E): Specifying the Default EBS volume encryption setting in the Organizations management account will ensure that all new EBS volumes created in any account in the organization are encrypted by default.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation

   Next question

7. Question 377 · 1017 in bank

   A company runs a highly available image-processing application on Amazon EC2 instances in a single VPC. The EC2 instances run inside several subnets across multiple Availability Zones. The EC2 instances do not communicate with each other. However, the EC2 instances download images from Amazon S3 and upload images to Amazon S3 through a single NAT gateway. The company is concerned about data transfer charges. What is the MOST cost-effective way for the company to avoid Regional data transfer charges?

   • ALaunch the NAT gateway in each Availability Zone.
   • BReplace the NAT gateway with a NAT instance.
   • CDeploy a gateway VPC endpoint for Amazon S3.
   • DProvision an EC2 Dedicated Host to run the EC2 instances.

   Show answer

   Answer: C

   Explanation

   Deploying a gateway VPC endpoint for Amazon S3 is the most cost-effective way for the company to avoid Regional data transfer charges. A gateway VPC endpoint is a network gateway that allows communication between instances in a VPC and a service, such as Amazon S3, without requiring an Internet gateway or a NAT device. Data transfer between the VPC and the service through a gateway VPC endpoint is free of charge, while data transfer between the VPC and the Internet through an Internet gateway or NAT device is subject to data transfer charges. By using a gateway VPC endpoint, the company can reduce its data transfer costs by eliminating the need to transfer data through the NAT gateway to access Amazon S3. This option would provide the required connectivity to Amazon S3 and minimize data transfer charges.

   Source: Adapted from community discussion — SilentMilli

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 378 · 1017 in bank

   A company wants to use an Amazon RDS for PostgreSQL DB cluster to simplify time-consuming database administrative tasks for production database workloads. The company wants to ensure that its database is highly available and will provide automatic failover support in most scenarios in less than 40 seconds. The company wants to offload reads off of the primary instance and keep costs as low as possible. Which solution will meet these requirements?

   • AUse an Amazon RDS Multi-AZ DB instance deployment. Create one read replica and point the read workload to the read replica.
   • BUse an Amazon RDS Multi-AZ DB duster deployment Create two read replicas and point the read workload to the read replicas.
   • CUse an Amazon RDS Multi-AZ DB instance deployment. Point the read workload to the secondary instances in the Multi-AZ pair.
   • DUse an Amazon RDS Multi-AZ DB cluster deployment Point the read workload to the reader endpoint.

   Show answer

   Answer: D

   Explanation

   The correct answer is: D. Use an Amazon RDS Multi-AZ DB cluster deployment. Point the read workload to the reader endpoint. Explanation: The company wants high availability, automatic failover support in less than 40 seconds, read offloading from the primary instance, and cost-effectiveness. Answer D is the best choice for several reasons: 1. Amazon RDS Multi-AZ deployments provide high availability and automatic failover support. 2. In a Multi-AZ DB cluster, Amazon RDS automatically provisions and maintains a standby in a different Availability Zone. If a failure occurs, Amazon RDS performs an automatic failover to the standby, minimizing downtime. 3. The "Reader endpoint" for an Amazon RDS DB cluster provides load-balancing support for read-only connections to the DB cluster. Directing read traffic to the reader endpoint helps in offloading read operations from the primary instance.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 379 · 1017 in bank

   A company runs a highly available SFTP service. The SFTP service uses two Amazon EC2 Linux instances that run with elastic IP addresses to accept traffic from trusted IP sources on the internet. The SFTP service is backed by shared storage that is attached to the instances. User accounts are created and managed as Linux users in the SFTP servers. The company wants a serverless option that provides high IOPS performance and highly configurable security. The company also wants to maintain control over user permissions. Which solution will meet these requirements?

   • ACreate an encrypted Amazon Elastic Block Store (Amazon EBS) volume. Create an AWS Transfer Family SFTP service with a public endpoint that allows only trusted IP addresses. Attach the EBS volume to the SFTP service endpoint. Grant users access to the SFTP service.
   • BCreate an encrypted Amazon Elastic File System (Amazon EFS) volume. Create an AWS Transfer Family SFTP service with elastic IP addresses and a VPC endpoint that has internet-facing access. Attach a security group to the endpoint that allows only trusted IP addresses. Attach the EFS volume to the SFTP service endpoint. Grant users access to the SFTP service.
   • CCreate an Amazon S3 bucket with default encryption enabled. Create an AWS Transfer Family SFTP service with a public endpoint that allows only trusted IP addresses. Attach the S3 bucket to the SFTP service endpoint. Grant users access to the SFTP service.
   • DCreate an Amazon S3 bucket with default encryption enabled. Create an AWS Transfer Family SFTP service with a VPC endpoint that has internal access in a private subnet. Attach a security group that allows only trusted IP addresses. Attach the S3 bucket to the SFTP service endpoint. Grant users access to the SFTP service.

   Show answer

   Answer: B

   Explanation

   Not A - Transfer Family canj't use EBS B - Possible and meets requirement Not C - S3 doesn't guarantee "high IOPS performance"; also there is no "public endpoint that allows only trusted IP addresses" (you can assign a Security Group to a public endpoint but that is not mentioned here) Not D - Endpoint would be in private subnet, not accessible from Internet at all

   Source: Adapted from community discussion — pentium75

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 380 · 1017 in bank

    A company is developing a new machine learning (ML) model solution on AWS. The models are developed as independent microservices that fetch approximately 1 GB of model data from Amazon S3 at startup and load the data into memory. Users access the models through an asynchronous API. Users can send a request or a batch of requests and specify where the results should be sent. The company provides models to hundreds of users. The usage patterns for the models are irregular. Some models could be unused for days or weeks. Other models could receive batches of thousands of requests at a time. Which design should a solutions architect recommend to meet these requirements?

    • ADirect the requests from the API to a Network Load Balancer (NLB). Deploy the models as AWS Lambda functions that are invoked by the NLB.
    • BDirect the requests from the API to an Application Load Balancer (ALB). Deploy the models as Amazon Elastic Container Service (Amazon ECS) services that read from an Amazon Simple Queue Service (Amazon SQS) queue. Use AWS App Mesh to scale the instances of the ECS cluster based on the SQS queue size.
    • CDirect the requests from the API into an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the models as AWS Lambda functions that are invoked by SQS events. Use AWS Auto Scaling to increase the number of vCPUs for the Lambda functions based on the SQS queue size.
    • DDirect the requests from the API into an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the models as Amazon Elastic Container Service (Amazon ECS) services that read from the queue. Enable AWS Auto Scaling on Amazon ECS for both the cluster and copies of the service based on the queue size.

    Show answer

    Answer: D

    Explanation

    For once examtopic answer is correct :) haha... Batch requests/async = Amazon SQS Microservices = Amazon ECS Workload variations = AWS Auto Scaling on Amazon ECS

    Source: Adapted from community discussion — TariqKipkemei

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 371. 1017 questions available.