SAA-C03 practice questions 451–460

1. Question 451 · 1017 in bank

   A 4-year-old media company is using the AWS Organizations all features feature set to organize its AWS accounts. According to the company's finance team, the billing information on the member accounts must not be accessible to anyone, including the root user of the member accounts. Which solution will meet these requirements?

   • AAdd all finance team users to an IAM group. Attach an AWS managed policy named Billing to the group.
   • BAttach an identity-based policy to deny access to the billing information to all users, including the root user.
   • CCreate a service control policy (SCP) to deny access to the billing information. Attach the SCP to the root organizational unit (OU).
   • DConvert from the Organizations all features feature set to the Organizations consolidated billing feature set.

   Show answer

   Answer: C

   Explanation

   Service Control Policies (SCP): SCPs are an integral part of AWS Organizations and allow you to set fine-grained permissions on the organizational units (OUs) within your AWS Organization. SCPs provide central control over the maximum permissions that can be granted to member accounts, including the root user. Denying Access to Billing Information: By creating an SCP and attaching it to the root OU, you can explicitly deny access to billing information for all accounts within the organization. SCPs can be used to restrict access to various AWS services and actions, including billing-related services. Granular Control: SCPs enable you to define specific permissions and restrictions at the organizational unit level. By denying access to billing information at the root OU, you can ensure that no member accounts, including root users, have access to the billing information.

   Source: Adapted from community discussion — cloudenthusiast

   References

   • AWS documentation

   Next question

2. Question 452 · 1017 in bank

   An ecommerce company runs an application in the AWS Cloud that is integrated with an on-premises warehouse solution. The company uses Amazon Simple Notification Service (Amazon SNS) to send order messages to an on-premises HTTPS endpoint so the warehouse application can process the orders. The local data center team has detected that some of the order messages were not received. A solutions architect needs to retain messages that are not delivered and analyze the messages for up to 14 days. Which solution will meet these requirements with the LEAST development effort?

   • AConfigure an Amazon SNS dead letter queue that has an Amazon Kinesis Data Stream target with a retention period of 14 days.
   • BAdd an Amazon Simple Queue Service (Amazon SQS) queue with a retention period of 14 days between the application and Amazon SNS.
   • CConfigure an Amazon SNS dead letter queue that has an Amazon Simple Queue Service (Amazon SQS) target with a retention period of 14 days.
   • DConfigure an Amazon SNS dead letter queue that has an Amazon DynamoDB target with a TTL attribute set for a retention period of 14 days.

   Show answer

   Answer: C

   Explanation

   "Configuring an Amazon SNS dead-letter queue for a subscription ... A dead-letter queue is an Amazon SQS queue that an Amazon SNS subscription can target for messages that can't be delivered to subscribers successfully", this is exactly what C says. https://docs.aws.amazon.com/sns/latest/dg/sns-configure-dead-letter-queue.html B, an SQS queue "between the application and Amazon SNS" would change the application logic. SQS cannot push messages to the "on-premises https endpoint", rather the destination would have to retrieve messages from the queue. Besides, option B would eventually deliver the messages that failed on the first attempt, which is NOT what is asked for. The goal is to retain undeliverable messages for analysis (NOT to deliver them), and this is typically achieved with a dead letter queue.

   Source: Adapted from community discussion — pentium75

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 453 · 1017 in bank

   A company stores call transcript files on a monthly basis. Users access the files randomly within 1 year of the call, but users access the files infrequently after 1 year. The company wants to optimize its solution by giving users the ability to query and retrieve files that are less than 1-year-old as quickly as possible. A delay in retrieving older files is acceptable. Which solution will meet these requirements MOST cost-effectively?

   • AStore individual files with tags in Amazon S3 Glacier Instant Retrieval. Query the tags to retrieve the files from S3 Glacier Instant Retrieval.
   • BStore individual files in Amazon S3 Intelligent-Tiering. Use S3 Lifecycle policies to move the files to S3 Glacier Flexible Retrieval after 1 year. Query and retrieve the files that are in Amazon S3 by using Amazon Athena. Query and retrieve the files that are in S3 Glacier by using S3 Glacier Select.
   • CStore individual files with tags in Amazon S3 Standard storage. Store search metadata for each archive in Amazon S3 Standard storage. Use S3 Lifecycle policies to move the files to S3 Glacier Instant Retrieval after 1 year. Query and retrieve the files by searching for metadata from Amazon S3.
   • DStore individual files in Amazon S3 Standard storage. Use S3 Lifecycle policies to move the files to S3 Glacier Deep Archive after 1 year. Store search metadata in Amazon RDS. Query the files from Amazon RDS. Retrieve the files from S3 Glacier Deep Archive.

   Show answer

   Answer: B

   Explanation

   I think the answer is B: Users access the files randomly S3 Intelligent-Tiering is the ideal storage class for data with unknown, changing, or unpredictable access patterns, independent of object size or retention period. You can use S3 Intelligent-Tiering as the default storage class for virtually any workload, especially data lakes, data analytics, new applications, and user-generated content. https://aws.amazon.com/fr/s3/storage-classes/intelligent-tiering/

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 454 · 1017 in bank

   A gaming company uses Amazon DynamoDB to store user information such as geographic location, player data, and leaderboards. The company needs to configure continuous backups to an Amazon S3 bucket with a minimal amount of coding. The backups must not affect availability of the application and must not affect the read capacity units (RCUs) that are defined for the table. Which solution meets these requirements?

   • AUse an Amazon EMR cluster. Create an Apache Hive job to back up the data to Amazon S3.
   • BExport the data directly from DynamoDB to Amazon S3 with continuous backups. Turn on point-in-time recovery for the table.
   • CConfigure Amazon DynamoDB Streams. Create an AWS Lambda function to consume the stream and export the data to an Amazon S3 bucket.
   • DCreate an AWS Lambda function to export the data from the database tables to Amazon S3 on a regular basis. Turn on point-in-time recovery for the table.

   Show answer

   Answer: B

   Explanation

   Continuous backups is a native feature of DynamoDB, it works at any scale without having to manage servers or clusters and allows you to export data across AWS Regions and accounts to any point-in-time in the last 35 days at a per-second granularity. Plus, it doesn’t affect the read capacity or the availability of your production tables. https://aws.amazon.com/blogs/aws/new-export-amazon-dynamodb-table-data-to-data-lake-amazon-s3/

   Source: Adapted from community discussion — elmogy

   References

   • AWS documentation
   • AWS documentation
   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 455 · 1017 in bank

   A solutions architect is designing an asynchronous application to process credit card data validation requests for a bank. The application must be secure and be able to process each request at least once. Which solution will meet these requirements MOST cost-effectively?

   • AUse AWS Lambda event source mapping. Set Amazon Simple Queue Service (Amazon SQS) standard queues as the event source. Use AWS Key Management Service (SSE-KMS) for encryption. Add the kms:Decrypt permission for the Lambda execution role.
   • BUse AWS Lambda event source mapping. Use Amazon Simple Queue Service (Amazon SQS) FIFO queues as the event source. Use SQS managed encryption keys (SSE-SQS) for encryption. Add the encryption key invocation permission for the Lambda function.
   • CUse the AWS Lambda event source mapping. Set Amazon Simple Queue Service (Amazon SQS) FIFO queues as the event source. Use AWS KMS keys (SSE-KMS). Add the kms:Decrypt permission for the Lambda execution role.
   • DUse the AWS Lambda event source mapping. Set Amazon Simple Queue Service (Amazon SQS) standard queues as the event source. Use AWS KMS keys (SSE-KMS) for encryption. Add the encryption key invocation permission for the Lambda function.

   Show answer

   Answer: A

   Explanation

   SQS FIFO is slightly more expensive than standard queue https://calculator.aws/#/addService/SQS I would still go with the standard because of the keyword "at least once" because FIFO process "exactly once". That leaves us with A and D, I believe that lambda function only needs to decrypt so I would choose A

   Source: Adapted from community discussion — elmogy

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 456 · 1017 in bank

   A company has multiple AWS accounts for development work. Some staff consistently use oversized Amazon EC2 instances, which causes the company to exceed the yearly budget for the development accounts. The company wants to centrally restrict the creation of AWS resources in these accounts. Which solution will meet these requirements with the LEAST development effort?

   • ADevelop AWS Systems Manager templates that use an approved EC2 creation process. Use the approved Systems Manager templates to provision EC2 instances.
   • BUse AWS Organizations to organize the accounts into organizational units (OUs). Define and attach a service control policy (SCP) to control the usage of EC2 instance types.
   • CConfigure an Amazon EventBridge rule that invokes an AWS Lambda function when an EC2 instance is created. Stop disallowed EC2 instance types.
   • DSet up AWS Service Catalog products for the staff to create the allowed EC2 instance types. Ensure that staff can deploy EC2 instances only by using the Service Catalog products.

   Show answer

   Answer: B

   Explanation

   AWS Organizations: AWS Organizations is a service that helps you centrally manage multiple AWS accounts. It enables you to group accounts into organizational units (OUs) and apply policies across those accounts. Service Control Policies (SCPs): SCPs in AWS Organizations allow you to define fine-grained permissions and restrictions at the account or OU level. By attaching an SCP to the development accounts, you can control the creation and usage of EC2 instance types. Least Development Effort: Option B requires minimal development effort as it leverages the built-in features of AWS Organizations and SCPs. You can define the SCP to restrict the use of oversized EC2 instance types and apply it to the appropriate OUs or accounts.

   Source: Adapted from community discussion — cloudenthusiast

   Next question

7. Question 457 · 1017 in bank

   Select 3

   A company wants to use artificial intelligence (AI) to determine the quality of its customer service calls. The company currently manages calls in four different languages, including English. The company will offer new languages in the future. The company does not have the resources to regularly maintain machine learning (ML) models. The company needs to create written sentiment analysis reports from the customer service call recordings. The customer service call recording text must be translated into English. Which combination of steps will meet these requirements? (Choose three.)

   • AUse Amazon Comprehend to translate the audio recordings into English.
   • BUse Amazon Lex to create the written sentiment analysis reports.
   • CUse Amazon Polly to convert the audio recordings into text.
   • DUse Amazon Transcribe to convert the audio recordings in any language into text.
   • EUse Amazon Translate to translate text in any language to English.
   • FUse Amazon Comprehend to create the sentiment analysis reports.

   Show answer

   Answer: DEF

   Explanation

   Amazon Transcribe will convert the audio recordings into text, Amazon Translate will translate the text into English, and Amazon Comprehend will perform sentiment analysis on the translated text to generate sentiment analysis reports.

   Source: Adapted from community discussion — cloudenthusiast

   Next question

8. Question 458 · 1017 in bank

   A company uses Amazon EC2 instances to host its internal systems. As part of a deployment operation, an administrator tries to use the AWS CLI to terminate an EC2 instance. However, the administrator receives a 403 (Access Denied) error message. The administrator is using an IAM role that has the following IAM policy attached:

   

   What is the cause of the unsuccessful request?

   • AThe EC2 instance has a resource-based policy with a Deny statement.
   • BThe principal has not been specified in the policy statement.
   • CThe "Action" field does not grant the actions that are required to terminate the EC2 instance.
   • DThe request to terminate the EC2 instance does not originate from the CIDR blocks 192.0.2.0/24 or 203.0.113.0/24.

   Show answer

   Answer: D

   Explanation

   If you want to read more about this, see how it works: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-ip.html Same policy as in this question with almost same use case. D is correct answer.

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation

   Next question

9. Question 459 · 1017 in bank

   A company is conducting an internal audit. The company wants to ensure that the data in an Amazon S3 bucket that is associated with the company’s AWS Lake Formation data lake does not contain sensitive customer or employee data. The company wants to discover personally identifiable information (PII) or financial information, including passport numbers and credit card numbers. Which solution will meet these requirements?

   • AConfigure AWS Audit Manager on the account. Select the Payment Card Industry Data Security Standards (PCI DSS) for auditing.
   • BConfigure Amazon S3 Inventory on the S3 bucket Configure Amazon Athena to query the inventory.
   • CConfigure Amazon Macie to run a data discovery job that uses managed identifiers for the required data types.
   • DUse Amazon S3 Select to run a report across the S3 bucket.

   Show answer

   Answer: C

   Explanation

   Amazon Macie is a service that helps discover, classify, and protect sensitive data stored in AWS. It uses machine learning algorithms and managed identifiers to detect various types of sensitive information, including personally identifiable information (PII) and financial information. By configuring Amazon Macie to run a data discovery job with the appropriate managed identifiers for the required data types (such as passport numbers and credit card numbers), the company can identify and classify any sensitive data present in the S3 bucket.

   Source: Adapted from community discussion — cloudenthusiast

   Next question

10. Question 460 · 1017 in bank

    Select 2

    A company uses on-premises servers to host its applications. The company is running out of storage capacity. The applications use both block storage and NFS storage. The company needs a high-performing solution that supports local caching without re-architecting its existing applications. Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)

    • AMount Amazon S3 as a file system to the on-premises servers.
    • BDeploy an AWS Storage Gateway file gateway to replace NFS storage.
    • CDeploy AWS Snowball Edge to provision NFS mounts to on-premises servers.
    • DDeploy an AWS Storage Gateway volume gateway to replace the block storage.
    • EDeploy Amazon Elastic File System (Amazon EFS) volumes and mount them to on-premises servers.

    Show answer

    Answer: BD

    Explanation

    By combining the deployment of an AWS Storage Gateway file gateway and an AWS Storage Gateway volume gateway, the company can address both its block storage and NFS storage needs, while leveraging local caching capabilities for improved performance.

    Source: Adapted from community discussion — cloudenthusiast

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 451. 1017 questions available.