SAA-C03 practice questions 501–510

1. Question 501 · 1017 in bank

   Select 3

   A company has a workload in an AWS Region. Customers connect to and access the workload by using an Amazon API Gateway REST API. The company uses Amazon Route 53 as its DNS provider. The company wants to provide individual and secure URLs for all customers. Which combination of steps will meet these requirements with the MOST operational efficiency? (Choose three.)

   • ARegister the required domain in a registrar. Create a wildcard custom domain name in a Route 53 hosted zone and record in the zone that points to the API Gateway endpoint.
   • BRequest a wildcard certificate that matches the domains in AWS Certificate Manager (ACM) in a different Region.
   • CCreate hosted zones for each customer as required in Route 53. Create zone records that point to the API Gateway endpoint.
   • DRequest a wildcard certificate that matches the custom domain name in AWS Certificate Manager (ACM) in the same Region.
   • ECreate multiple API endpoints for each customer in API Gateway.
   • FCreate a custom domain name in API Gateway for the REST API. Import the certificate from AWS Certificate Manager (ACM).

   Show answer

   Answer: ADF

   Explanation

   Step A involves registering the required domain in a registrar and creating a wildcard custom domain name in a Route 53 hosted zone. This allows you to map individual and secure URLs for all customers to your API Gateway endpoints. Step D is to request a wildcard certificate from AWS Certificate Manager (ACM) that matches the custom domain name you created in Step A. This wildcard certificate will cover all subdomains and ensure secure HTTPS communication. Step F is to create a custom domain name in API Gateway for your REST API. This allows you to associate the custom domain name with your API Gateway endpoints and import the certificate from ACM for secure communication.

   Source: Adapted from community discussion — AshishRocks

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 502 · 1017 in bank

   A company stores data in Amazon S3. According to regulations, the data must not contain personally identifiable information (PII). The company recently discovered that S3 buckets have some objects that contain PII. The company needs to automatically detect PII in S3 buckets and to notify the company’s security team. Which solution will meet these requirements?

   • AUse Amazon Macie. Create an Amazon EventBridge rule to filter the SensitiveData event type from Macie findings and to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
   • BUse Amazon GuardDuty. Create an Amazon EventBridge rule to filter the CRITICAL event type from GuardDuty findings and to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
   • CUse Amazon Macie. Create an Amazon EventBridge rule to filter the SensitiveData:S3Object/Personal event type from Macie findings and to send an Amazon Simple Queue Service (Amazon SQS) notification to the security team.
   • DUse Amazon GuardDuty. Create an Amazon EventBridge rule to filter the CRITICAL event type from GuardDuty findings and to send an Amazon Simple Queue Service (Amazon SQS) notification to the security team.

   Show answer

   Answer: A

   Explanation

   B and D are discarted as Macie is to identify PII. Now that we have between A and C. SNS is more suitable for this option as a pub/sub service, we subscribe the security team and then they will receive the notifications.

   Source: Adapted from community discussion — alexandercamachop

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 503 · 1017 in bank

   A company wants to build a logging solution for its multiple AWS accounts. The company currently stores the logs from all accounts in a centralized account. The company has created an Amazon S3 bucket in the centralized account to store the VPC flow logs and AWS CloudTrail logs. All logs must be highly available for 30 days for frequent analysis, retained for an additional 60 days for backup purposes, and deleted 90 days after creation. Which solution will meet these requirements MOST cost-effectively?

   • ATransition objects to the S3 Standard storage class 30 days after creation. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
   • BTransition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class 30 days after creation. Move all objects to the S3 Glacier Flexible Retrieval storage class after 90 days. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
   • CTransition objects to the S3 Glacier Flexible Retrieval storage class 30 days after creation. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
   • DTransition objects to the S3 One Zone-Infrequent Access (S3 One Zone-IA) storage class 30 days after creation. Move all objects to the S3 Glacier Flexible Retrieval storage class after 90 days. Write an expiration action that directs Amazon S3 to delete objects after 90 days.

   Show answer

   Answer: C

   Explanation

   C seems the most sutiable. Is the lowest cost. After 30 days is backup only, doesn't specify frequent access. Therefor we must transition the items after 30 days to Glacier Flexible Retrieval. Also it says deletion after 90 days, so all answers specifying a transition after 90 days makes no sense.

   Source: Adapted from community discussion — alexandercamachop

   References

   • AWS documentation

   Next question

4. Question 504 · 1017 in bank

   A company is building an Amazon Elastic Kubernetes Service (Amazon EKS) cluster for its workloads. All secrets that are stored in Amazon EKS must be encrypted in the Kubernetes etcd key-value store. Which solution will meet these requirements?

   • ACreate a new AWS Key Management Service (AWS KMS) key. Use AWS Secrets Manager to manage, rotate, and store all secrets in Amazon EKS.
   • BCreate a new AWS Key Management Service (AWS KMS) key. Enable Amazon EKS KMS secrets encryption on the Amazon EKS cluster.
   • CCreate the Amazon EKS cluster with default options. Use the Amazon Elastic Block Store (Amazon EBS) Container Storage Interface (CSI) driver as an add-on.
   • DCreate a new AWS Key Management Service (AWS KMS) key with the alias/aws/ebs alias. Enable default Amazon Elastic Block Store (Amazon EBS) volume encryption for the account.

   Show answer

   Answer: B

   Explanation

   B is the correct solution to meet the requirement of encrypting secrets in the etcd store for an Amazon EKS cluster. The key points: Create a new KMS key to use for encryption. Enable EKS secrets encryption using that KMS key on the EKS cluster. This will encrypt secrets in the Kubernetes etcd store. Option A uses Secrets Manager which does not encrypt the etcd store. Option C uses EBS CSI which is unrelated to etcd encryption. Option D enables EBS encryption but does not address etcd encryption.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 505 · 1017 in bank

   A company wants to provide data scientists with near real-time read-only access to the company's production Amazon RDS for PostgreSQL database. The database is currently configured as a Single-AZ database. The data scientists use complex queries that will not affect the production database. The company needs a solution that is highly available. Which solution will meet these requirements MOST cost-effectively?

   • AScale the existing production database in a maintenance window to provide enough power for the data scientists.
   • BChange the setup from a Single-AZ to a Multi-AZ instance deployment with a larger secondary standby instance. Provide the data scientists access to the secondary instance.
   • CChange the setup from a Single-AZ to a Multi-AZ instance deployment. Provide two additional read replicas for the data scientists.
   • DChange the setup from a Single-AZ to a Multi-AZ cluster deployment with two readable standby instances. Provide read endpoints to the data scientists.

   Show answer

   Answer: D

   Explanation

   Highly Available = Multi-AZ Cluster Read-only + Near Real time = readable standby. Read replicas are async whereas readable standby is synchronous. https://stackoverflow.com/questions/70663036/differences-b-w-aws-read-replica-and-the-standby-instances

   Source: Adapted from community discussion — NASHDBA

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 506 · 1017 in bank

   A company runs a three-tier web application in the AWS Cloud that operates across three Availability Zones. The application architecture has an Application Load Balancer, an Amazon EC2 web server that hosts user session states, and a MySQL database that runs on an EC2 instance. The company expects sudden increases in application traffic. The company wants to be able to scale to meet future application capacity demands and to ensure high availability across all three Availability Zones. Which solution will meet these requirements?

   • AMigrate the MySQL database to Amazon RDS for MySQL with a Multi-AZ DB cluster deployment. Use Amazon ElastiCache for Redis with high availability to store session data and to cache reads. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
   • BMigrate the MySQL database to Amazon RDS for MySQL with a Multi-AZ DB cluster deployment. Use Amazon ElastiCache for Memcached with high availability to store session data and to cache reads. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
   • CMigrate the MySQL database to Amazon DynamoDB Use DynamoDB Accelerator (DAX) to cache reads. Store the session data in DynamoDB. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
   • DMigrate the MySQL database to Amazon RDS for MySQL in a single Availability Zone. Use Amazon ElastiCache for Redis with high availability to store session data and to cache reads. Migrate the web server to an Auto Scaling group that is in three Availability Zones.

   Show answer

   Answer: A

   Explanation

   Memcached is best suited for caching data, while Redis is better for storing data that needs to be persisted. If you need to store data that needs to be accessed frequently, such as user profiles, session data, and application settings, then Redis is the better choice

   Source: Adapted from community discussion — alexandercamachop

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 507 · 1017 in bank

   A global video streaming company uses Amazon CloudFront as a content distribution network (CDN). The company wants to roll out content in a phased manner across multiple countries. The company needs to ensure that viewers who are outside the countries to which the company rolls out content are not able to view the content. Which solution will meet these requirements?

   • AAdd geographic restrictions to the content in CloudFront by using an allow list. Set up a custom error message.
   • BSet up a new URL tor restricted content. Authorize access by using a signed URL and cookies. Set up a custom error message.
   • CEncrypt the data for the content that the company distributes. Set up a custom error message.
   • DCreate a new URL for restricted content. Set up a time-restricted access policy for signed URLs.

   Show answer

   Answer: A

   Explanation

   The CloudFront geographic restrictions feature lets you control distribution of your content at the country level for all files that you're distributing with a given web distribution. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html

   Source: Adapted from community discussion — potomac

   References

   • AWS documentation

   Next question

8. Question 508 · 1017 in bank

   A company wants to use the AWS Cloud to improve its on-premises disaster recovery (DR) configuration. The company's core production business application uses Microsoft SQL Server Standard, which runs on a virtual machine (VM). The application has a recovery point objective (RPO) of 30 seconds or fewer and a recovery time objective (RTO) of 60 minutes. The DR solution needs to minimize costs wherever possible. Which solution will meet these requirements?

   • AConfigure a multi-site active/active setup between the on-premises server and AWS by using Microsoft SQL Server Enterprise with Always On availability groups.
   • BConfigure a warm standby Amazon RDS for SQL Server database on AWS. Configure AWS Database Migration Service (AWS DMS) to use change data capture (CDC).
   • CUse AWS Elastic Disaster Recovery configured to replicate disk changes to AWS as a pilot light.
   • DUse third-party backup software to capture backups every night. Store a secondary set of backups in Amazon S3.

   Show answer

   Answer: B

   Explanation

   Backup & Restore (RPO in hours, RTO in 24 hours or less) Pilot Light (RPO in minutes, RTO in hours) Warm Standby (RPO in seconds, RTO in minutes) *** Right Answer *** Active-Active (RPO is none or possibly seconds, RTO in seconds)

   Source: Adapted from community discussion — 1Alpha1

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 509 · 1017 in bank

   A company runs multiple Windows workloads on AWS. The company's employees use Windows file shares that are hosted on two Amazon EC2 instances. The file shares synchronize data between themselves and maintain duplicate copies. The company wants a highly available and durable storage solution that preserves how users currently access the files. What should a solutions architect do to meet these requirements?

   • AMigrate all the data to Amazon S3. Set up IAM authentication for users to access files.
   • BSet up an Amazon S3 File Gateway. Mount the S3 File Gateway on the existing EC2 instances.
   • CExtend the file share environment to Amazon FSx for Windows File Server with a Multi-AZ configuration. Migrate all the data to FSx for Windows File Server.
   • DExtend the file share environment to Amazon Elastic File System (Amazon EFS) with a Multi-AZ configuration. Migrate all the data to Amazon EFS.

   Show answer

   Answer: C

   Explanation

   EFS is not supported on Windows instances https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/AmazonEFS.html Amazon FSx for Windows File Server provides fully managed Microsoft Windows file servers, backed by a fully native Windows file system. https://docs.aws.amazon.com/fsx/latest/WindowsGuide/what-is.html

   Source: Adapted from community discussion — k1kavi1

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 510 · 1017 in bank

    A company has an on-premises server that uses an Oracle database to process and store customer information. The company wants to use an AWS database service to achieve higher availability and to improve application performance. The company also wants to offload reporting from its primary database system. Which solution will meet these requirements in the MOST operationally efficient way?

    • AUse AWS Database Migration Service (AWS DMS) to create an Amazon RDS DB instance in multiple AWS Regions. Point the reporting functions toward a separate DB instance from the primary DB instance.
    • BUse Amazon RDS in a Single-AZ deployment to create an Oracle database. Create a read replica in the same zone as the primary DB instance. Direct the reporting functions to the read replica.
    • CUse Amazon RDS deployed in a Multi-AZ cluster deployment to create an Oracle database. Direct the reporting functions to use the reader instance in the cluster deployment.
    • DUse Amazon RDS deployed in a Multi-AZ instance deployment to create an Amazon Aurora database. Direct the reporting functions to the reader instances.

    Show answer

    Answer: D

    Explanation

    Its D Multi-AZ DB clusters aren't available with the following engines: RDS for MariaDB RDS for Oracle RDS for SQL Server https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RDS_Fea_Regions_DB-eng.Feature.MultiAZDBClusters.html

    Source: Adapted from community discussion — mrsoa

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 501. 1017 questions available.