SAA-C03 practice questions 481–490

1. Question 481 · 1017 in bank

   A company is running a microservices application on Amazon EC2 instances. The company wants to migrate the application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster for scalability. The company must configure the Amazon EKS control plane with endpoint private access set to true and endpoint public access set to false to maintain security compliance. The company must also put the data plane in private subnets. However, the company has received error notifications because the node cannot join the cluster. Which solution will allow the node to join the cluster?

   • AGrant the required permission in AWS Identity and Access Management (IAM) to the AmazonEKSNodeRole IAM role.
   • BCreate interface VPC endpoints to allow nodes to access the control plane.
   • CRecreate nodes in the public subnet. Restrict security groups for EC2 nodes.
   • DAllow outbound traffic in the security group of the nodes.

   Show answer

   Answer: B

   Explanation

   By creating interface VPC endpoints, you can enable the necessary communication between the Amazon EKS control plane and the nodes in private subnets. This solution ensures that the control plane maintains endpoint private access (set to true) and endpoint public access (set to false) for security compliance.

   Source: Adapted from community discussion — cloudenthusiast

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 482 · 1017 in bank

   Select 3

   A company is migrating an on-premises application to AWS. The company wants to use Amazon Redshift as a solution. Which use cases are suitable for Amazon Redshift in this scenario? (Choose three.)

   • ASupporting data APIs to access data with traditional, containerized, and event-driven applications
   • BSupporting client-side and server-side encryption
   • CBuilding analytics workloads during specified hours and when the application is not active
   • DCaching data to reduce the pressure on the backend database
   • EScaling globally to support petabytes of data and tens of millions of requests per minute
   • FCreating a secondary replica of the cluster by using the AWS Management Console

   Show answer

   Answer: BCE

   Explanation

   Amazon Redshift is a data warehouse solution, so it is suitable for: -Supporting encryption (client-side and server-side) -Handling analytics workloads, especially during off-peak hours when the application is less active -Scaling to large amounts of data and high query volumes for analytics purposes The following options are incorrect because: A) Data APIs are not typically used with Redshift. It is more for running SQL queries and analytics. D) Redshift is not typically used for caching data. It is for analytics and data warehouse purposes. F) Redshift clusters do not create replicas in the management console. They are standalone clusters. you could create DR cluster from snapshot and restore to another region (automated or manual) but I do not think this what is meant in this option.

   Source: Adapted from community discussion — elmogy

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 483 · 1017 in bank

   A company provides an API interface to customers so the customers can retrieve their financial information. Еhe company expects a larger number of requests during peak usage times of the year. The company requires the API to respond consistently with low latency to ensure customer satisfaction. The company needs to provide a compute host for the API. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse an Application Load Balancer and Amazon Elastic Container Service (Amazon ECS).
   • BUse Amazon API Gateway and AWS Lambda functions with provisioned concurrency.
   • CUse an Application Load Balancer and an Amazon Elastic Kubernetes Service (Amazon EKS) cluster.
   • DUse Amazon API Gateway and AWS Lambda functions with reserved concurrency.

   Show answer

   Answer: B

   Explanation

   In the context of the given scenario, where the company wants low latency and consistent performance for their API during peak usage times, it would be more suitable to use provisioned concurrency. By allocating a specific number of concurrent executions, the company can ensure that there are enough function instances available to handle the expected load and minimize the impact of cold starts. This will result in lower latency and improved performance for the API.

   Source: Adapted from community discussion — cloudenthusiast

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 484 · 1017 in bank

   A company wants to send all AWS Systems Manager Session Manager logs to an Amazon S3 bucket for archival purposes. Which solution will meet this requirement with the MOST operational efficiency?

   • AEnable S3 logging in the Systems Manager console. Choose an S3 bucket to send the session data to.
   • BInstall the Amazon CloudWatch agent. Push all logs to a CloudWatch log group. Export the logs to an S3 bucket from the group for archival purposes.
   • CCreate a Systems Manager document to upload all server logs to a central S3 bucket. Use Amazon EventBridge to run the Systems Manager document against all servers that are in the account daily.
   • DInstall an Amazon CloudWatch agent. Push all logs to a CloudWatch log group. Create a CloudWatch logs subscription that pushes any incoming log events to an Amazon Kinesis Data Firehose delivery stream. Set Amazon S3 as the destination.

   Show answer

   Answer: A

   Explanation

   send logs to Amazon S3 from AWS Systems Manager Session Manager. Here are the steps to do so: Enable S3 Logging: Open the AWS Systems Manager console. In the navigation pane, choose Session Manager. Choose the Preferences tab, and then choose Edit. Select the check box next to Enable under S3 logging. Create an S3 Bucket: To store the Session Manager logs, create an S3 bucket to hold the audit logs from the Session Manager interactive shell usage. Configure IAM Role: AWS Systems Manager Agent (SSM Agent) uses the same AWS Identity and Access Management (IAM) role to activate itself and upload logs to Amazon S3. You can use either an IAM instance profile that’s attached to an Amazon Elastic Compute Cloud (Amazon EC2) instance or the IAM role that’s configured for the Default Host Management Configuration.

   Source: Adapted from community discussion — master9

   References

   • AWS documentation
   • AWS documentation
   • aws.amazon.com documentation

   Next question

5. Question 485 · 1017 in bank

   An application uses an Amazon RDS MySQL DB instance. The RDS database is becoming low on disk space. A solutions architect wants to increase the disk space without downtime. Which solution meets these requirements with the LEAST amount of effort?

   • AEnable storage autoscaling in RDS
   • BIncrease the RDS database instance size
   • CChange the RDS database instance storage type to Provisioned IOPS
   • DBack up the RDS database, increase the storage capacity, restore the database, and stop the previous instance

   Show answer

   Answer: A

   Explanation

   Enabling storage autoscaling allows RDS to automatically adjust the storage capacity based on the application's needs. When the storage usage exceeds a predefined threshold, RDS will automatically increase the allocated storage without requiring manual intervention or causing downtime. This ensures that the RDS database has sufficient disk space to handle the increasing storage requirements.

   Source: Adapted from community discussion — cloudenthusiast

   References

   • AWS documentation

   Next question

6. Question 486 · 1017 in bank

   A consulting company provides professional services to customers worldwide. The company provides solutions and tools for customers to expedite gathering and analyzing data on AWS. The company needs to centrally manage and deploy a common set of solutions and tools for customers to use for self-service purposes. Which solution will meet these requirements?

   • ACreate AWS CloudFormation templates for the customers.
   • BCreate AWS Service Catalog products for the customers.
   • CCreate AWS Systems Manager templates for the customers.
   • DCreate AWS Config items for the customers.

   Show answer

   Answer: B

   Explanation

   AWS Service Catalog allows you to create and manage catalogs of IT services that can be deployed within your organization. With Service Catalog, you can define a standardized set of products (solutions and tools in this case) that customers can self-service provision. By creating Service Catalog products, you can control and enforce the deployment of approved and validated solutions and tools.

   Source: Adapted from community discussion — cloudenthusiast

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 487 · 1017 in bank

   A company wants to migrate its on-premises application to AWS. The application produces output files that vary in size from tens of gigabytes to hundreds of terabytes. The application data must be stored in a standard file system structure. The company wants a solution that scales automatically. is highly available, and requires minimum operational overhead. Which solution will meet these requirements?

   • AMigrate the application to run as containers on Amazon Elastic Container Service (Amazon ECS). Use Amazon S3 for storage.
   • BMigrate the application to run as containers on Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon Elastic Block Store (Amazon EBS) for storage.
   • CMigrate the application to Amazon EC2 instances in a Multi-AZ Auto Scaling group. Use Amazon Elastic File System (Amazon EFS) for storage.
   • DMigrate the application to Amazon EC2 instances in a Multi-AZ Auto Scaling group. Use Amazon Elastic Block Store (Amazon EBS) for storage.

   Show answer

   Answer: C

   Explanation

   I have absolutely no idea... Output files that vary in size from tens of gigabytes to hundreds of terabytes Simit size for a single object: S3 5To TiB https://aws.amazon.com/fr/blogs/aws/amazon-s3-object-size-limit/ EBS 64 Tib https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/volume_constraints.html EFS 47.9 TiB https://docs.aws.amazon.com/efs/latest/ug/limits.html

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 488 · 1017 in bank

   A company is designing a new web application that will run on Amazon EC2 Instances. The application will use Amazon DynamoDB for backend data storage. The application traffic will be unpredictable. The company expects that the application read and write throughput to the database will be moderate to high. The company needs to scale in response to application traffic. Which DynamoDB table configuration will meet these requirements MOST cost-effectively?

   • AConfigure DynamoDB with provisioned read and write by using the DynamoDB Standard table class. Set DynamoDB auto scaling to a maximum defined capacity.
   • BConfigure DynamoDB in on-demand mode by using the DynamoDB Standard table class.
   • CConfigure DynamoDB with provisioned read and write by using the DynamoDB Standard Infrequent Access (DynamoDB Standard-IA) table class. Set DynamoDB auto scaling to a maximum defined capacity.
   • DConfigure DynamoDB in on-demand mode by using the DynamoDB Standard Infrequent Access (DynamoDB Standard-IA) table class.

   Show answer

   Answer: B

   Explanation

   On demand https://docs.aws.amazon.com/wellarchitected/latest/serverless-applications-lens/capacity.html "With on-demand capacity mode, DynamoDB charges you for the data reads and writes your application performs on your tables. You do not need to specify how much read and write throughput you expect your application to perform because DynamoDB instantly accommodates your workloads as they ramp up or down."

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 489 · 1017 in bank

   A retail company has several businesses. The IT team for each business manages its own AWS account. Each team account is part of an organization in AWS Organizations. Each team monitors its product inventory levels in an Amazon DynamoDB table in the team's own AWS account. The company is deploying a central inventory reporting application into a shared AWS account. The application must be able to read items from all the teams' DynamoDB tables. Which authentication option will meet these requirements MOST securely?

   • AIntegrate DynamoDB with AWS Secrets Manager in the inventory application account. Configure the application to use the correct secret from Secrets Manager to authenticate and read the DynamoDB table. Schedule secret rotation for every 30 days.
   • BIn every business account, create an IAM user that has programmatic access. Configure the application to use the correct IAM user access key ID and secret access key to authenticate and read the DynamoDB table. Manually rotate IAM access keys every 30 days.
   • CIn every business account, create an IAM role named BU_ROLE with a policy that gives the role access to the DynamoDB table and a trust policy to trust a specific role in the inventory application account. In the inventory account, create a role named APP_ROLE that allows access to the STS AssumeRole API operation. Configure the application to use APP_ROLE and assume the crossaccount role BU_ROLE to read the DynamoDB table.
   • DIntegrate DynamoDB with AWS Certificate Manager (ACM). Generate identity certificates to authenticate DynamoDB. Configure the application to use the correct certificate to authenticate and read the DynamoDB table.

   Show answer

   Answer: C

   Explanation

   IAM Roles: IAM roles provide a secure way to grant permissions to entities within AWS. By creating an IAM role in each business account named BU_ROLE with the necessary permissions to access the DynamoDB table, the access can be controlled at the IAM role level. Cross-Account Access: By configuring a trust policy in the BU_ROLE that trusts a specific role in the inventory application account (APP_ROLE), you establish a trusted relationship between the two accounts. Least Privilege: By creating a specific IAM role (BU_ROLE) in each business account and granting it access only to the required DynamoDB table, you can ensure that each team's table is accessed with the least privilege principle. Security Token Service (STS): The use of STS AssumeRole API operation in the inventory application account allows the application to assume the cross-account role (BU_ROLE) in each business account.

   Source: Adapted from community discussion — cloudenthusiast

   Next question

10. Question 490 · 1017 in bank

    Select 2

    A company runs container applications by using Amazon Elastic Kubernetes Service (Amazon EKS). The company's workload is not consistent throughout the day. The company wants Amazon EKS to scale in and out according to the workload. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)

    • AUse an AWS Lambda function to resize the EKS cluster.
    • BUse the Kubernetes Metrics Server to activate horizontal pod autoscaling.
    • CUse the Kubernetes Cluster Autoscaler to manage the number of nodes in the cluster.
    • DUse Amazon API Gateway and connect it to Amazon EKS.
    • EUse AWS App Mesh to observe network activity.

    Show answer

    Answer: BC

    Explanation

    B and C are the correct options. Using the Kubernetes Metrics Server (B) enables horizontal pod autoscaling to dynamically scale pods based on CPU/memory usage. This allows scaling at the application tier level. The Kubernetes Cluster Autoscaler (C) automatically adjusts the number of nodes in the EKS cluster in response to pod resource requirements and events. This allows scaling at the infrastructure level.

    Source: Adapted from community discussion — Guru4Cloud

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 481. 1017 questions available.