SAA-C03 practice questions 391–400

1. Question 391 · 1017 in bank

   An ecommerce company wants to use machine learning (ML) algorithms to build and train models. The company will use the models to visualize complex scenarios and to detect trends in customer data. The architecture team wants to integrate its ML models with a reporting platform to analyze the augmented data and use the data directly in its business intelligence dashboards. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse AWS Glue to create an ML transform to build and train models. Use Amazon OpenSearch Service to visualize the data.
   • BUse Amazon SageMaker to build and train models. Use Amazon QuickSight to visualize the data.
   • CUse a pre-built ML Amazon Machine Image (AMI) from the AWS Marketplace to build and train models. Use Amazon OpenSearch Service to visualize the data.
   • DUse Amazon QuickSight to build and train models by using calculated fields. Use Amazon QuickSight to visualize the data.

   Show answer

   Answer: B

   Explanation

   Question keyword "machine learning", answer keyword "Amazon SageMaker". Choose B. Use Amazon QuickSight for visualization. See "Gaining insights with machine learning (ML) in Amazon QuickSight" at https://docs.aws.amazon.com/quicksight/latest/user/making-data-driven-decisions-with-ml-in-quicksight.html

   Source: Adapted from community discussion — james2033

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 392 · 1017 in bank

   A company is running its production and nonproduction environment workloads in multiple AWS accounts. The accounts are in an organization in AWS Organizations. The company needs to design a solution that will prevent the modification of cost usage tags. Which solution will meet these requirements?

   • ACreate a custom AWS Config rule to prevent tag modification except by authorized principals.
   • BCreate a custom trail in AWS CloudTrail to prevent tag modification.
   • CCreate a service control policy (SCP) to prevent tag modification except by authorized principals.
   • DCreate custom Amazon CloudWatch logs to prevent tag modification.

   Show answer

   Answer: C

   Explanation

   D "Amazon CloudWatch" just for logging, not for prevent tag modification https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies-cwe.html Amazon Organziaton has "Service Control Policy (SCP)" with "tag policy" https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html . Choose C. AWS Config for technical stuff, not for tag policies. Not A.

   Source: Adapted from community discussion — james2033

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 393 · 1017 in bank

   A company hosts its application in the AWS Cloud. The application runs on Amazon EC2 instances behind an Elastic Load Balancer in an Auto Scaling group and with an Amazon DynamoDB table. The company wants to ensure the application can be made available in anotherAWS Region with minimal downtime. What should a solutions architect do to meet these requirements with the LEAST amount of downtime?

   • ACreate an Auto Scaling group and a load balancer in the disaster recovery Region. Configure the DynamoDB table as a global table. Configure DNS failover to point to the new disaster recovery Region's load balancer.
   • BCreate an AWS CloudFormation template to create EC2 instances, load balancers, and DynamoDB tables to be launched when needed Configure DNS failover to point to the new disaster recovery Region's load balancer.
   • CCreate an AWS CloudFormation template to create EC2 instances and a load balancer to be launched when needed. Configure the DynamoDB table as a global table. Configure DNS failover to point to the new disaster recovery Region's load balancer.
   • DCreate an Auto Scaling group and load balancer in the disaster recovery Region. Configure the DynamoDB table as a global table. Create an Amazon CloudWatch alarm to trigger an AWS Lambda function that updates Amazon Route 53 pointing to the disaster recovery load balancer.

   Show answer

   Answer: A

   Explanation

   A and D is correct. But Route 53 haves a feature DNS failover when instances down so we dont need use Cloudwatch and lambda to trigger -> A correct

   Source: Adapted from community discussion — lucdt4

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 394 · 1017 in bank

   A company needs to migrate a MySQL database from its on-premises data center to AWS within 2 weeks. The database is 20 TB in size. The company wants to complete the migration with minimal downtime. Which solution will migrate the database MOST cost-effectively?

   • AOrder an AWS Snowball Edge Storage Optimized device. Use AWS Database Migration Service (AWS DMS) with AWS Schema Conversion Tool (AWS SCT) to migrate the database with replication of ongoing changes. Send the Snowball Edge device to AWS to finish the migration and continue the ongoing replication.
   • BOrder an AWS Snowmobile vehicle. Use AWS Database Migration Service (AWS DMS) with AWS Schema Conversion Tool (AWS SCT) to migrate the database with ongoing changes. Send the Snowmobile vehicle back to AWS to finish the migration and continue the ongoing replication.
   • COrder an AWS Snowball Edge Compute Optimized with GPU device. Use AWS Database Migration Service (AWS DMS) with AWS Schema Conversion Tool (AWS SCT) to migrate the database with ongoing changes. Send the Snowball device to AWS to finish the migration and continue the ongoing replication
   • DOrder a 1 GB dedicated AWS Direct Connect connection to establish a connection with the data center. Use AWS Database Migration Service (AWS DMS) with AWS Schema Conversion Tool (AWS SCT) to migrate the database with replication of ongoing changes.

   Show answer

   Answer: A

   Explanation

   Direct Connect takes at least 1 month to setup - D is invalid AWS Snowmobile is used for transferring large amounts of data (petabytes) from remote locations where establishing a connection to the cloud is impossible - B is invalid AWS Snowball Edge Compute Optimized provides higher vCPU performance and lower storage as compared to Snowball storage optimized. As our need is solely data transfer, high vCPU performance is not required but high storage is - C is invalid

   Source: Adapted from community discussion — Goutham4981

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 395 · 1017 in bank

   A company moved its on-premises PostgreSQL database to an Amazon RDS for PostgreSQL DB instance. The company successfully launched a new product. The workload on the database has increased. The company wants to accommodate the larger workload without adding infrastructure. Which solution will meet these requirements MOST cost-effectively?

   • ABuy reserved DB instances for the total workload. Make the Amazon RDS for PostgreSQL DB instance larger.
   • BMake the Amazon RDS for PostgreSQL DB instance a Multi-AZ DB instance.
   • CBuy reserved DB instances for the total workload. Add another Amazon RDS for PostgreSQL DB instance.
   • DMake the Amazon RDS for PostgreSQL DB instance an on-demand DB instance.

   Show answer

   Answer: A

   Explanation

   B - Multi-AZ is for HA, does not help 'accommodating the larger workload' C - Adding "another instance" will not help, we can't split the workload between two instances D - On-demand instance is a good choice for unknown workload, but here we know the workload, it's just higher than before

   Source: Adapted from community discussion — pentium75

   References

   • AWS documentation

   Next question

6. Question 396 · 1017 in bank

   A company operates an ecommerce website on Amazon EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The site is experiencing performance issues related to a high request rate from illegitimate external systems with changing IP addresses. The security team is worried about potential DDoS attacks against the website. The company must block the illegitimate incoming requests in a way that has a minimal impact on legitimate users. What should a solutions architect recommend?

   • ADeploy Amazon Inspector and associate it with the ALB.
   • BDeploy AWS WAF, associate it with the ALB, and configure a rate-limiting rule.
   • CDeploy rules to the network ACLs associated with the ALB to block the incomingtraffic.
   • DDeploy Amazon GuardDuty and enable rate-limiting protection when configuring GuardDuty.

   Show answer

   Answer: B

   Explanation

   AWS Web Application Firewall (WAF) + ALB (Application Load Balancer) See image at https://aws.amazon.com/waf/ . https://docs.aws.amazon.com/waf/latest/developerguide/ddos-responding.html . Question keyword "high request rate", answer keyword "rate-limiting rule" https://docs.aws.amazon.com/waf/latest/developerguide/waf-rate-based-example-limit-login-page-keys.html Amazon GuardDuty for theat detection https://aws.amazon.com/guardduty/ , not for DDoS.

   Source: Adapted from community discussion — james2033

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 397 · 1017 in bank

   A company wants to share accounting data with an external auditor. The data is stored in an Amazon RDS DB instance that resides in a private subnet. The auditor has its own AWS account and requires its own copy of the database. What is the MOST secure way for the company to share the database with the auditor?

   • ACreate a read replica of the database. Configure IAM standard database authentication to grant the auditor access.
   • BExport the database contents to text files. Store the files in an Amazon S3 bucket. Create a new IAM user for the auditor. Grant the user access to the S3 bucket.
   • CCopy a snapshot of the database to an Amazon S3 bucket. Create an IAM user. Share the user's keys with the auditor to grant access to the object in the S3 bucket.
   • DCreate an encrypted snapshot of the database. Share the snapshot with the auditor. Allow access to the AWS Key Management Service (AWS KMS) encryption key.

   Show answer

   Answer: D

   Explanation

   The most secure way for the company to share the database with the auditor is option D: Create an encrypted snapshot of the database, share the snapshot with the auditor, and allow access to the AWS Key Management Service (AWS KMS) encryption key. By creating an encrypted snapshot, the company ensures that the database data is protected at rest. Sharing the encrypted snapshot with the auditor allows them to have their own copy of the database securely. In addition, granting access to the AWS KMS encryption key ensures that the auditor has the necessary permissions to decrypt and access the encrypted snapshot. This allows the auditor to restore the snapshot and access the data securely. This approach provides both data protection and access control, ensuring that the database is securely shared with the auditor while maintaining the confidentiality and integrity of the data.

   Source: Adapted from community discussion — alexandercamachop

   References

   • AWS documentation

   Next question

8. Question 398 · 1017 in bank

   A solutions architect configured a VPC that has a small range of IP addresses. The number of Amazon EC2 instances that are in the VPC is increasing, and there is an insufficient number of IP addresses for future workloads. Which solution resolves this issue with the LEAST operational overhead?

   • AAdd an additional IPv4 CIDR block to increase the number of IP addresses and create additional subnets in the VPC. Create new resources in the new subnets by using the new CIDR.
   • BCreate a second VPC with additional subnets. Use a peering connection to connect the second VPC with the first VPC Update the routes and create new resources in the subnets of the second VPC.
   • CUse AWS Transit Gateway to add a transit gateway and connect a second VPC with the first VPUpdate the routes of the transit gateway and VPCs. Create new resources in the subnets of the second VPC.
   • DCreate a second VPC. Create a Site-to-Site VPN connection between the first VPC and the second VPC by using a VPN-hosted solution on Amazon EC2 and a virtual private gateway. Update the route between VPCs to the traffic through the VPN. Create new resources in the subnets of the second VPC.

   Show answer

   Answer: A

   Explanation

   A is correct: You assign a single CIDR IP address range as the primary CIDR block when you create a VPC and can add up to four secondary CIDR blocks after creation of the VPC.

   Source: Adapted from community discussion — antropaws

   Next question

9. Question 399 · 1017 in bank

   Select 2

   A company has an Amazon S3 bucket that contains critical data. The company must protect the data from accidental deletion. Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)

   • AEnable versioning on the S3 bucket.
   • BEnable MFA Delete on the S3 bucket.
   • CCreate a bucket policy on the S3 bucket.
   • DEnable default encryption on the S3 bucket.
   • ECreate a lifecycle policy for the objects in the S3 bucket.

   Show answer

   Answer: AB

   Explanation

   The correct solution is AB, as you can see here: https://aws.amazon.com/it/premiumsupport/knowledge-center/s3-audit-deleted-missing-objects/ It states the following: To prevent or mitigate future accidental deletions, consider the following features: Enable versioning to keep historical versions of an object. Enable Cross-Region Replication of objects. Enable MFA delete to require multi-factor authentication (MFA) when deleting an object version.

   Source: Adapted from community discussion — Uhrien

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 400 · 1017 in bank

    Select 2

    A company used an Amazon RDS for MySQL DB instance during application testing. Before terminating the DB instance at the end of the test cycle, a solutions architect created two backups. The solutions architect created the first backup by using the mysqldump utility to create a database dump. The solutions architect created the second backup by enabling the final DB snapshot option on RDS termination. The company is now planning for a new test cycle and wants to create a new DB instance from the most recent backup. The company has chosen a MySQL-compatible edition ofAmazon Aurora to host the DB instance. Which solutions will create the new DB instance? (Choose two.)

    • AImport the RDS snapshot directly into Aurora.
    • BUpload the RDS snapshot to Amazon S3. Then import the RDS snapshot into Aurora.
    • CUpload the database dump to Amazon S3. Then import the database dump into Aurora.
    • DUse AWS Database Migration Service (AWS DMS) to import the RDS snapshot into Aurora.
    • EUpload the database dump to Amazon S3. Then use AWS Database Migration Service (AWS DMS) to import the database dump into Aurora.

    Show answer

    Answer: AC

    Explanation

    A,C A because the snapshot is already stored in AWS. C because you dont need a migration tool going from MySQL to MySQL. You would use the MySQL utility.

    Source: Adapted from community discussion — Axaus

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • repost.aws documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 391. 1017 questions available.