SAA-C03 practice questions 381–390

1. Question 381 · 1017 in bank

   Select 2

   A solutions architect wants to use the following JSON text as an identity-based policy to grant specific permissions:

   

   Which IAM principals can the solutions architect attach this policy to? (Choose two.)

   • ARole
   • BGroup
   • COrganization
   • DAmazon Elastic Container Service (Amazon ECS) resource
   • EAmazon EC2 resource

   Show answer

   Answer: AB

   Explanation

   AB is correct, but the question is misleading because, according to the AWS IAM documentation, groups are not considered principals: https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal."

   Source: Adapted from community discussion — dkw2342

   References

   • AWS documentation

   Next question

2. Question 382 · 1017 in bank

   A company is running a custom application on Amazon EC2 On-Demand Instances. The application has frontend nodes that need to run 24 hours a day, 7 days a week and backend nodes that need to run only for a short time based on workload. The number of backend nodes varies during the day. The company needs to scale out and scale in more instances based on workload. Which solution will meet these requirements MOST cost-effectively?

   • AUse Reserved Instances for the frontend nodes. Use AWS Fargate for the backend nodes.
   • BUse Reserved Instances for the frontend nodes. Use Spot Instances for the backend nodes.
   • CUse Spot Instances for the frontend nodes. Use Reserved Instances for the backend nodes.
   • DUse Spot Instances for the frontend nodes. Use AWS Fargate for the backend nodes.

   Show answer

   Answer: B

   Explanation

   Not A because Fargate runs containers, not EC2 instances. But we have no indication that the workload would be containerized; it runs "on EC2 instances". Not C and D because frontend must run 24/7, can't use Spot. Thus B, yes, Spot instances are risky, but as they need to run "only for a short time" it seems acceptable. Technically ideal option would be Reserved Instances for frontend nodes and On-demand instances for backend nodes, but that is not an option here.

   Source: Adapted from community discussion — pentium75

   Next question

3. Question 383 · 1017 in bank

   A company uses high block storage capacity to runs its workloads on premises. The company's daily peak input and output transactions per second are not more than 15,000 IOPS. The company wants to migrate the workloads to Amazon EC2 and to provision disk performance independent of storage capacity. Which Amazon Elastic Block Store (Amazon EBS) volume type will meet these requirements MOST cost-effectively?

   • AGP2 volume type
   • Bio2 volume type
   • CGP3 volume type
   • Dio1 volume type

   Show answer

   Answer: C

   Explanation

   The GP3 (General Purpose SSD) volume type in Amazon Elastic Block Store (EBS) is the most cost-effective option for the given requirements. GP3 volumes offer a balance of price and performance and are suitable for a wide range of workloads, including those with moderate I/O needs. GP3 volumes allow you to provision performance independently from storage capacity, which means you can adjust the baseline performance (measured in IOPS) and throughput (measured in MiB/s) separately from the volume size. This flexibility allows you to optimize your costs while meeting the workload requirements. In this case, since the company's daily peak input and output transactions per second are not more than 15,000 IOPS, GP3 volumes provide a suitable and cost-effective option for their workloads.

   Source: Adapted from community discussion — alexandercamachop

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 384 · 1017 in bank

   A company needs to store data from its healthcare application. The application’s data frequently changes. A new regulation requires audit access at all levels of the stored data. The company hosts the application on an on-premises infrastructure that is running out of storage capacity. A solutions architect must securely migrate the existing data to AWS while satisfying the new regulation. Which solution will meet these requirements?

   • AUse AWS DataSync to move the existing data to Amazon S3. Use AWS CloudTrail to log data events.
   • BUse AWS Snowcone to move the existing data to Amazon S3. Use AWS CloudTrail to log management events.
   • CUse Amazon S3 Transfer Acceleration to move the existing data to Amazon S3. Use AWS CloudTrail to log data events.
   • DUse AWS Storage Gateway to move the existing data to Amazon S3. Use AWS CloudTrail to log management events.

   Show answer

   Answer: A

   Explanation

   A is better because: - Data sync is used for migrate. Storage gw is used to connect on-prem to AWS. - dataevents is to log for access, management events is for config or management

   Source: Adapted from community discussion — thanhnv142

   References

   • repost.aws documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 385 · 1017 in bank

   A solutions architect is implementing a complex Java application with a MySQL database. The Java application must be deployed on Apache Tomcat and must be highly available. What should the solutions architect do to meet these requirements?

   • ADeploy the application in AWS Lambda. Configure an Amazon API Gateway API to connect with the Lambda functions.
   • BDeploy the application by using AWS Elastic Beanstalk. Configure a load-balanced environment and a rolling deployment policy.
   • CMigrate the database to Amazon ElastiCache. Configure the ElastiCache security group to allow access from the application.
   • DLaunch an Amazon EC2 instance. Install a MySQL server on the EC2 instance. Configure the application on the server. Create an AMI. Use the AMI to create a launch template with an Auto Scaling group.

   Show answer

   Answer: B

   Explanation

   B AWS Elastic Beanstalk provides an easy and quick way to deploy, manage, and scale applications. It supports a variety of platforms, including Java and Apache Tomcat. By using Elastic Beanstalk, the solutions architect can upload the Java application and configure the environment to run Apache Tomcat.

   Source: Adapted from community discussion — cloudenthusiast

   References

   • AWS documentation

   Next question

6. Question 386 · 1017 in bank

   A serverless application uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The Lambda function needs permissions to read and write to the DynamoDB table. Which solution will give the Lambda function access to the DynamoDB table MOST securely?

   • ACreate an IAM user with programmatic access to the Lambda function. Attach a policy to the user that allows read and write access to the DynamoDB table. Store the access_key_id and secret_access_key parameters as part of the Lambda environment variables. Ensure that other AWS users do not have read and write access to the Lambda function configuration.
   • BCreate an IAM role that includes Lambda as a trusted service. Attach a policy to the role that allows read and write access to the DynamoDB table. Update the configuration of the Lambda function to use the new role as the execution role.
   • CCreate an IAM user with programmatic access to the Lambda function. Attach a policy to the user that allows read and write access to the DynamoDB table. Store the access_key_id and secret_access_key parameters in AWS Systems Manager Parameter Store as secure string parameters. Update the Lambda function code to retrieve the secure string parameters before connecting to the DynamoDB table.
   • DCreate an IAM role that includes DynamoDB as a trusted service. Attach a policy to the role that allows read and write access from the Lambda function. Update the code of the Lambda function to attach to the new role as an execution role.

   Show answer

   Answer: B

   Explanation

   DynamoDB needs to trust Lambda. NOT the other way around. So Lambda must be configured as a trusted service. Role for service which gives B and D options. D is setting up (somehow?) to allow Lambda to trust DynamoDB... or the wording makes no sense.

   Source: Adapted from community discussion — awsgeek75

   Next question

7. Question 387 · 1017 in bank

   The following IAM policy is attached to an IAM group. This is the only policy applied to the group.

   

   What are the effective IAM permissions of this policy for group members?

   • AGroup members are permitted any Amazon EC2 action within the us-east-1 Region. Statements after the Allow permission are not applied.
   • BGroup members are denied any Amazon EC2 permissions in the us-east-1 Region unless they are logged in with multi-factor authentication (MFA).
   • CGroup members are allowed the ec2:StopInstances and ec2:TerminateInstances permissions for all Regions when logged in with multi-factor authentication (MFA). Group members are permitted any other Amazon EC2 action.
   • DGroup members are allowed the ec2:StopInstances and ec2:TerminateInstances permissions for the us-east-1 Region only when logged in with multi-factor authentication (MFA). Group members are permitted any other Amazon EC2 action within the us-east-1 Region.

   Show answer

   Answer: D

   Explanation

   Ok ignore D is right as the first condition is what gives permission to make anything for EC2 but is restricted to us-east-1 region

   Source: Adapted from community discussion — pdragon1981

   Next question

8. Question 388 · 1017 in bank

   A company has an on-premises application that generates a large amount of time-sensitive data that is backed up to Amazon S3. The application has grown and there are user complaints about internet bandwidth limitations. A solutions architect needs to design a long-term solution that allows for both timely backups to Amazon S3 and with minimal impact on internet connectivity for internal users. Which solution meets these requirements?

   • AEstablish AWS VPN connections and proxy all traffic through a VPC gateway endpoint.
   • BEstablish a new AWS Direct Connect connection and direct backup traffic through this new connection.
   • COrder daily AWS Snowball devices. Load the data onto the Snowball devices and return the devices to AWS each day.
   • DSubmit a support ticket through the AWS Management Console. Request the removal of S3 service limits from the account.

   Show answer

   Answer: B

   Explanation

   A: VPN also goes through the internet and uses the bandwidth C: daily Snowball transfer is not really a long-term solution when it comes to cost and efficiency D: S3 limits don't change anything here So the answer is B

   Source: Adapted from community discussion — Sinaneos

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 389 · 1017 in bank

   Select 2

   A manufacturing company has machine sensors that upload .csv files to an Amazon S3 bucket. These .csv files must be converted into images and must be made available as soon as possible for the automatic generation of graphical reports. The images become irrelevant after 1 month, but the .csv files must be kept to train machine learning (ML) models twice a year. The ML trainings and audits are planned weeks in advance. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)

   • ALaunch an Amazon EC2 Spot Instance that downloads the .csv files every hour, generates the image files, and uploads the images to the S3 bucket.
   • BDesign an AWS Lambda function that converts the .csv files into images and stores the images in the S3 bucket. Invoke the Lambda function when a .csv file is uploaded.
   • CCreate S3 Lifecycle rules for .csv files and image files in the S3 bucket. Transition the .csv files from S3 Standard to S3 Glacier 1 day after they are uploaded. Expire the image files after 30 days.
   • DCreate S3 Lifecycle rules for .csv files and image files in the S3 bucket. Transition the .csv files from S3 Standard to S3 One Zone-Infrequent Access (S3 One Zone-IA) 1 day after they are uploaded. Expire the image files after 30 days.
   • ECreate S3 Lifecycle rules for .csv files and image files in the S3 bucket. Transition the .csv files from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) 1 day after they are uploaded. Keep the image files in Reduced Redundancy Storage (RRS).

   Show answer

   Answer: BC

   Explanation

   Answer is B&C. For D, you must store data for 30 days in s3 standard before move to IA tiers, glacier is fine https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-transition-general-considerations.html#:~:text=Before%20you%20transition%20objects%20to%20S3%20Standard%2DIA%20or%20S3%20One%20Zone%2DIA%2C%20you%20must%20store%20them%20for%20at%20least%2030%20days%20in%20Amazon%20S3

   Source: Adapted from community discussion — Xin123

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 390 · 1017 in bank

    A company has developed a new video game as a web application. The application is in a three-tier architecture in a VPC with Amazon RDS for MySQL in the database layer. Several players will compete concurrently online. The game’s developers want to display a top-10 scoreboard in near-real time and offer the ability to stop and restore the game while preserving the current scores. What should a solutions architect do to meet these requirements?

    • ASet up an Amazon ElastiCache for Memcached cluster to cache the scores for the web application to display.
    • BSet up an Amazon ElastiCache for Redis cluster to compute and cache the scores for the web application to display.
    • CPlace an Amazon CloudFront distribution in front of the web application to cache the scoreboard in a section of the application.
    • DCreate a read replica on Amazon RDS for MySQL to run queries to compute the scoreboard and serve the read traffic to the web application.

    Show answer

    Answer: B

    Explanation

    Real-time gaming leaderboards are easy to create with Amazon ElastiCache for Redis. Just use the Redis Sorted Set data structure, which provides uniqueness of elements while maintaining the list sorted by their scores. Creating a real-time ranked list is as simple as updating a user's score each time it changes. You can also use Sorted Sets to handle time series data by using timestamps as the score. https://aws.amazon.com/elasticache/redis/#:~:text=ElastiCache%20for%20Redis.-,Gaming,-Leaderboards

    Source: Adapted from community discussion — TariqKipkemei

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 381. 1017 questions available.