SAA-C03 practice questions 461–470

1. Question 461 · 1017 in bank

   A company has a service that reads and writes large amounts of data from an Amazon S3 bucket in the same AWS Region. The service is deployed on Amazon EC2 instances within the private subnet of a VPC. The service communicates with Amazon S3 over a NAT gateway in the public subnet. However, the company wants a solution that will reduce the data output costs. Which solution will meet these requirements MOST cost-effectively?

   • AProvision a dedicated EC2 NAT instance in the public subnet. Configure the route table for the private subnet to use the elastic network interface of this instance as the destination for all S3 traffic.
   • BProvision a dedicated EC2 NAT instance in the private subnet. Configure the route table for the public subnet to use the elastic network interface of this instance as the destination for all S3 traffic.
   • CProvision a VPC gateway endpoint. Configure the route table for the private subnet to use the gateway endpoint as the route for all S3 traffic.
   • DProvision a second NAT gateway. Configure the route table for the private subnet to use this NAT gateway as the destination for all S3 traffic.

   Show answer

   Answer: C

   Explanation

   A VPC gateway endpoint allows you to privately access Amazon S3 from within your VPC without using a NAT gateway or NAT instance. By provisioning a VPC gateway endpoint for S3, the service in the private subnet can directly communicate with S3 without incurring data transfer costs for traffic going through a NAT gateway.

   Source: Adapted from community discussion — cloudenthusiast

   Next question

2. Question 462 · 1017 in bank

   A company uses Amazon S3 to store high-resolution pictures in an S3 bucket. To minimize application changes, the company stores the pictures as the latest version of an S3 object. The company needs to retain only the two most recent versions of the pictures. The company wants to reduce costs. The company has identified the S3 bucket as a large expense. Which solution will reduce the S3 costs with the LEAST operational overhead?

   • AUse S3 Lifecycle to delete expired object versions and retain the two most recent versions.
   • BUse an AWS Lambda function to check for older versions and delete all but the two most recent versions.
   • CUse S3 Batch Operations to delete noncurrent object versions and retain only the two most recent versions.
   • DDeactivate versioning on the S3 bucket and retain the two most recent versions.

   Show answer

   Answer: A

   Explanation

   S3 Lifecycle policies allow you to define rules that automatically transition or expire objects based on their age or other criteria. By configuring an S3 Lifecycle policy to delete expired object versions and retain only the two most recent versions, you can effectively manage the storage costs while maintaining the desired retention policy. This solution is highly automated and requires minimal operational overhead as the lifecycle management is handled by S3 itself.

   Source: Adapted from community discussion — cloudenthusiast

   References

   • AWS documentation

   Next question

3. Question 463 · 1017 in bank

   A company needs to minimize the cost of its 1 Gbps AWS Direct Connect connection. The company's average connection utilization is less than 10%. A solutions architect must recommend a solution that will reduce the cost without compromising security. Which solution will meet these requirements?

   • ASet up a new 1 Gbps Direct Connect connection. Share the connection with another AWS account.
   • BSet up a new 200 Mbps Direct Connect connection in the AWS Management Console.
   • CContact an AWS Direct Connect Partner to order a 1 Gbps connection. Share the connection with another AWS account.
   • DContact an AWS Direct Connect Partner to order a 200 Mbps hosted connection for an existing AWS account.

   Show answer

   Answer: D

   Explanation

   company need to setup a cheaper connection (200 M) but B is incorrect because you can only order port speeds of 1, 10, or 100 Gbps for more flexibility you can go with hosted connection, You can order port speeds between 50 Mbps and 10 Gbps. https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect.html

   Source: Adapted from community discussion — elmogy

   References

   • AWS documentation

   Next question

4. Question 464 · 1017 in bank

   A company is hosting a web application on AWS using a single Amazon EC2 instance that stores user-uploaded documents in an Amazon EBS volume. For better scalability and availability, the company duplicated the architecture and created a second EC2 instance and EBS volume in another Availability Zone, placing both behind an Application Load Balancer. After completing this change, users reported that, each time they refreshed the website, they could see one subset of their documents or the other, but never all of the documents at the same time. What should a solutions architect propose to ensure users see all of their documents at once?

   • ACopy the data so both EBS volumes contain all the documents
   • BConfigure the Application Load Balancer to direct a user to the server with the documents
   • CCopy the data from both EBS volumes to Amazon EFS. Modify the application to save new documents to Amazon EFS
   • DConfigure the Application Load Balancer to send the request to both servers. Return each document from the correct server

   Show answer

   Answer: C

   Explanation

   Keyword: second EC2 instance and EBS volume. They could see one subset of their documents or the other, but never all of the documents at the same time. EBS: attached to one instance (special EBS io1, io2 can attached to multiple instances but not much) EFS: can attached to multiple instances A: Incorrect - EBS volumes don't have function to copy data from running EBS volume to running EBS volume. B: Incorrect - We can use sticky session to forward same user to the same server but when user lose the session the user might be forward to another server. C: Correct - Because 2 instance now point to one EFS data storage, user will see both data. D: Incorrect - We only use Traffic Mirroring to sent request to both servers. Application Load Balancer don't support send request to both servers because it's design it balance workload between server. And also ALB cannot combine document from both servers and return.

   Source: Adapted from community discussion — PhucVuu

   Next question

5. Question 465 · 1017 in bank

   A company has a production workload that runs on 1,000 Amazon EC2 Linux instances. The workload is powered by third-party software. The company needs to patch the third-party software on all EC2 instances as quickly as possible to remediate a critical security vulnerability. What should a solutions architect do to meet these requirements?

   • ACreate an AWS Lambda function to apply the patch to all EC2 instances.
   • BConfigure AWS Systems Manager Patch Manager to apply the patch to all EC2 instances.
   • CSchedule an AWS Systems Manager maintenance window to apply the patch to all EC2 instances.
   • DUse AWS Systems Manager Run Command to run a custom command that applies the patch to all EC2 instances.

   Show answer

   Answer: D

   Explanation

   The primary focus of Patch Manager, a capability of AWS Systems Manager, is on installing operating systems security-related updates on managed nodes. By default, Patch Manager doesn't install all available patches, but rather a smaller set of patches focused on security. (Ref https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-how-it-works-selection.html) Run Command allows you to automate common administrative tasks and perform one-time configuration changes at scale. (Ref https://docs.aws.amazon.com/systems-manager/latest/userguide/execute-remote-commands.html) Seems like patch manager is meant for OS level patches and not 3rd party applications. And this falls under run command wheelhouse to carry out one-time configuration changes (update of 3rd part application) at scale.

   Source: Adapted from community discussion — tinyfoot

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 466 · 1017 in bank

   Select 2

   A company has multiple Windows file servers on premises. The company wants to migrate and consolidate its files into an Amazon FSx for Windows File Server file system. File permissions must be preserved to ensure that access rights do not change. Which solutions will meet these requirements? (Choose two.)

   • ADeploy AWS DataSync agents on premises. Schedule DataSync tasks to transfer the data to the FSx for Windows File Server file system.
   • BCopy the shares on each file server into Amazon S3 buckets by using the AWS CLI. Schedule AWS DataSync tasks to transfer the data to the FSx for Windows File Server file system.
   • CRemove the drives from each file server. Ship the drives to AWS for import into Amazon S3. Schedule AWS DataSync tasks to transfer the data to the FSx for Windows File Server file system.
   • DOrder an AWS Snowcone device. Connect the device to the on-premises network. Launch AWS DataSync agents on the device. Schedule DataSync tasks to transfer the data to the FSx for Windows File Server file system.
   • EOrder an AWS Snowball Edge Storage Optimized device. Connect the device to the on-premises network. Copy data to the device by using the AWS CLI. Ship the device back to AWS for import into Amazon S3. Schedule AWS DataSync tasks to transfer the data to the FSx for Windows File Server file system.

   Show answer

   Answer: AD

   Explanation

   A This option involves deploying DataSync agents on your on-premises file servers and using DataSync to transfer the data directly to the FSx for Windows File Server. DataSync ensures that file permissions are preserved during the migration process. D This option involves using an AWS Snowcone device, a portable data transfer device. You would connect the Snowcone device to your on-premises network, launch DataSync agents on the device, and schedule DataSync tasks to transfer the data to FSx for Windows File Server. DataSync handles the migration process while preserving file permissions.

   Source: Adapted from community discussion — cloudenthusiast

   Next question

7. Question 467 · 1017 in bank

   A company wants to ingest customer payment data into the company's data lake in Amazon S3. The company receives payment data every minute on average. The company wants to analyze the payment data in real time. Then the company wants to ingest the data into the data lake. Which solution will meet these requirements with the MOST operational efficiency?

   • AUse Amazon Kinesis Data Streams to ingest data. Use AWS Lambda to analyze the data in real time.
   • BUse AWS Glue to ingest data. Use Amazon Kinesis Data Analytics to analyze the data in real time.
   • CUse Amazon Kinesis Data Firehose to ingest data. Use Amazon Kinesis Data Analytics to analyze the data in real time.
   • DUse Amazon API Gateway to ingest data. Use AWS Lambda to analyze the data in real time.

   Show answer

   Answer: C

   Explanation

   By leveraging the combination of Amazon Kinesis Data Firehose and Amazon Kinesis Data Analytics, you can efficiently ingest and analyze the payment data in real time without the need for manual processing or additional infrastructure management. This solution provides a streamlined and scalable approach to handle continuous data ingestion and analysis requirements.

   Source: Adapted from community discussion — cloudenthusiast

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 468 · 1017 in bank

   Select 2

   A company runs a website that uses a content management system (CMS) on Amazon EC2. The CMS runs on a single EC2 instance and uses an Amazon Aurora MySQL Multi-AZ DB instance for the data tier. Website images are stored on an Amazon Elastic Block Store (Amazon EBS) volume that is mounted inside the EC2 instance. Which combination of actions should a solutions architect take to improve the performance and resilience of the website? (Choose two.)

   • AMove the website images into an Amazon S3 bucket that is mounted on every EC2 instance
   • BShare the website images by using an NFS share from the primary EC2 instance. Mount this share on the other EC2 instances.
   • CMove the website images onto an Amazon Elastic File System (Amazon EFS) file system that is mounted on every EC2 instance.
   • DCreate an Amazon Machine Image (AMI) from the existing EC2 instance. Use the AMI to provision new instances behind an Application Load Balancer as part of an Auto Scaling group. Configure the Auto Scaling group to maintain a minimum of two instances. Configure an accelerator in AWS Global Accelerator for the website
   • ECreate an Amazon Machine Image (AMI) from the existing EC2 instance. Use the AMI to provision new instances behind an Application Load Balancer as part of an Auto Scaling group. Configure the Auto Scaling group to maintain a minimum of two instances. Configure an Amazon CloudFront distribution for the website.

   Show answer

   Answer: CE

   Explanation

   By combining the use of Amazon EFS for shared file storage and Amazon CloudFront for content delivery, you can achieve improved performance and resilience for the website.

   Source: Adapted from community discussion — cloudenthusiast

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 469 · 1017 in bank

   A company runs an infrastructure monitoring service. The company is building a new feature that will enable the service to monitor data in customer AWS accounts. The new feature will call AWS APIs in customer accounts to describe Amazon EC2 instances and read Amazon CloudWatch metrics. What should the company do to obtain access to customer accounts in the MOST secure way?

   • AEnsure that the customers create an IAM role in their account with read-only EC2 and CloudWatch permissions and a trust policy to the company’s account.
   • BCreate a serverless API that implements a token vending machine to provide temporary AWS credentials for a role with read-only EC2 and CloudWatch permissions.
   • CEnsure that the customers create an IAM user in their account with read-only EC2 and CloudWatch permissions. Encrypt and store customer access and secret keys in a secrets management system.
   • DEnsure that the customers create an Amazon Cognito user in their account to use an IAM role with read-only EC2 and CloudWatch permissions. Encrypt and store the Amazon Cognito user and password in a secrets management system.

   Show answer

   Answer: A

   Explanation

   By having customers create an IAM role with the necessary permissions in their own accounts, the company can use AWS Identity and Access Management (IAM) to establish cross-account access. The trust policy allows the company's AWS account to assume the customer's IAM role temporarily, granting access to the specified resources (EC2 instances and CloudWatch metrics) within the customer's account. This approach follows the principle of least privilege, as the company only requests the necessary permissions and does not require long-term access keys or user credentials from the customers.

   Source: Adapted from community discussion — cloudenthusiast

   Next question

10. Question 470 · 1017 in bank

    A company needs to connect several VPCs in the us-east-1 Region that span hundreds of AWS accounts. The company's networking team has its own AWS account to manage the cloud network. What is the MOST operationally efficient solution to connect the VPCs?

    • ASet up VPC peering connections between each VPC. Update each associated subnet’s route table
    • BConfigure a NAT gateway and an internet gateway in each VPC to connect each VPC through the internet
    • CCreate an AWS Transit Gateway in the networking team’s AWS account. Configure static routes from each VPC.
    • DDeploy VPN gateways in each VPC. Create a transit VPC in the networking team’s AWS account to connect to each VPC.

    Show answer

    Answer: C

    Explanation

    The main difference between AWS Transit Gateway and VPC peering is that AWS Transit Gateway is designed to connect multiple VPCs together in a hub-and-spoke model, while VPC peering is designed to connect two VPCs together in a peer-to-peer model. As we have several VPCs here, the answer should be C.

    Source: Adapted from community discussion — hsinchang

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 461. 1017 questions available.