SAA-C03 practice questions 511–520

1. Question 511 · 1017 in bank

   Select 3

   A company wants to build a web application on AWS. Client access requests to the website are not predictable and can be idle for a long time. Only customers who have paid a subscription fee can have the ability to sign in and use the web application. Which combination of steps will meet these requirements MOST cost-effectively? (Choose three.)

   • ACreate an AWS Lambda function to retrieve user information from Amazon DynamoDB. Create an Amazon API Gateway endpoint to accept RESTful APIs. Send the API calls to the Lambda function.
   • BCreate an Amazon Elastic Container Service (Amazon ECS) service behind an Application Load Balancer to retrieve user information from Amazon RDS. Create an Amazon API Gateway endpoint to accept RESTful APIs. Send the API calls to the Lambda function.
   • CCreate an Amazon Cognito user pool to authenticate users.
   • DCreate an Amazon Cognito identity pool to authenticate users.
   • EUse AWS Amplify to serve the frontend web content with HTML, CSS, and JS. Use an integrated Amazon CloudFront configuration.
   • FUse Amazon S3 static web hosting with PHP, CSS, and JS. Use Amazon CloudFront to serve the frontend web content.

   Show answer

   Answer: ACE

   Explanation

   If in doubt between E or F. S3 doesn't support server-side scripts, PHP is a server-side script. The answer is ACE. https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.html

   Source: Adapted from community discussion — manOfThePeople

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 512 · 1017 in bank

   A media company uses an Amazon CloudFront distribution to deliver content over the internet. The company wants only premium customers to have access to the media streams and file content. The company stores all content in an Amazon S3 bucket. The company also delivers content on demand to customers for a specific purpose, such as movie rentals or music downloads. Which solution will meet these requirements?

   • AGenerate and provide S3 signed cookies to premium customers.
   • BGenerate and provide CloudFront signed URLs to premium customers.
   • CUse origin access control (OAC) to limit the access of non-premium customers.
   • DGenerate and activate field-level encryption to block non-premium customers.

   Show answer

   Answer: B

   Explanation

   Use CloudFront signed URLs or signed cookies to restrict access to documents, business data, media streams, or content that is intended for selected users, for example, users who have paid a fee. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html#:~:text=CloudFront%20signed%20URLs

   Source: Adapted from community discussion — TariqKipkemei

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 513 · 1017 in bank

   Select 2

   A company runs Amazon EC2 instances in multiple AWS accounts that are individually bled. The company recently purchased a Savings Pian. Because of changes in the company’s business requirements, the company has decommissioned a large number of EC2 instances. The company wants to use its Savings Plan discounts on its other AWS accounts. Which combination of steps will meet these requirements? (Choose two.)

   • AFrom the AWS Account Management Console of the management account, turn on discount sharing from the billing preferences section.
   • BFrom the AWS Account Management Console of the account that purchased the existing Savings Plan, turn on discount sharing from the billing preferences section. Include all accounts.
   • CFrom the AWS Organizations management account, use AWS Resource Access Manager (AWS RAM) to share the Savings Plan with other accounts.
   • DCreate an organization in AWS Organizations in a new payer account. Invite the other AWS accounts to join the organization from the management account.
   • ECreate an organization in AWS Organizations in the existing AWS account with the existing EC2 instances and Savings Plan. Invite the other AWS accounts to join the organization from the management account.

   Show answer

   Answer: AD

   Explanation

   Not E - it mentions using an account with existing EC2s as the management account, which goes against the best practice for a management account https://docs.aws.amazon.com/organizations/latest/userguide/orgs_best-practices_mgmt-acct.html

   Source: Adapted from community discussion — lemur88

   References

   • AWS documentation
   • repost.aws documentation
   • AWS documentation

   Next question

4. Question 514 · 1017 in bank

   A retail company uses a regional Amazon API Gateway API for its public REST APIs. The API Gateway endpoint is a custom domain name that points to an Amazon Route 53 alias record. A solutions architect needs to create a solution that has minimal effects on customers and minimal data loss to release the new version of APIs. Which solution will meet these requirements?

   • ACreate a canary release deployment stage for API Gateway. Deploy the latest API version. Point an appropriate percentage of traffic to the canary stage. After API verification, promote the canary stage to the production stage.
   • BCreate a new API Gateway endpoint with a new version of the API in OpenAPI YAML file format. Use the import-to-update operation in merge mode into the API in API Gateway. Deploy the new version of the API to the production stage.
   • CCreate a new API Gateway endpoint with a new version of the API in OpenAPI JSON file format. Use the import-to-update operation in overwrite mode into the API in API Gateway. Deploy the new version of the API to the production stage.
   • DCreate a new API Gateway endpoint with new versions of the API definitions. Create a custom domain name for the new API Gateway API. Point the Route 53 alias record to the new API Gateway API custom domain name.

   Show answer

   Answer: A

   Explanation

   In a canary release deployment, total API traffic is separated at random into a production release and a canary release with a pre-configured ratio. Typically, the canary release receives a small percentage of API traffic and the production release takes up the rest. The updated API features are only visible to API traffic through the canary. You can adjust the canary traffic percentage to optimize test coverage or performance. https://docs.aws.amazon.com/apigateway/latest/developerguide/canary-release.html

   Source: Adapted from community discussion — potomac

   References

   • AWS documentation

   Next question

5. Question 515 · 1017 in bank

   A company wants to direct its users to a backup static error page if the company's primary website is unavailable. The primary website's DNS records are hosted in Amazon Route 53. The domain is pointing to an Application Load Balancer (ALB). The company needs a solution that minimizes changes and infrastructure overhead. Which solution will meet these requirements?

   • AUpdate the Route 53 records to use a latency routing policy. Add a static error page that is hosted in an Amazon S3 bucket to the records so that the traffic is sent to the most responsive endpoints.
   • BSet up a Route 53 active-passive failover configuration. Direct traffic to a static error page that is hosted in an Amazon S3 bucket when Route 53 health checks determine that the ALB endpoint is unhealthy.
   • CSet up a Route 53 active-active configuration with the ALB and an Amazon EC2 instance that hosts a static error page as endpoints. Configure Route 53 to send requests to the instance only if the health checks fail for the ALB.
   • DUpdate the Route 53 records to use a multivalue answer routing policy. Create a health check. Direct traffic to the website if the health check passes. Direct traffic to a static error page that is hosted in Amazon S3 if the health check does not pass.

   Show answer

   Answer: B

   Explanation

   Set up a Route 53 active-passive failover configuration. Direct traffic to a static error page that is hosted in an Amazon S3 bucket when Route 53 health checks determine that the ALB endpoint is unhealthy.

   Source: Adapted from community discussion — TariqKipkemei

   References

   • repost.aws documentation

   Next question

6. Question 516 · 1017 in bank

   A recent analysis of a company's IT expenses highlights the need to reduce backup costs. The company's chief information officer wants to simplify the on-premises backup infrastructure and reduce costs by eliminating the use of physical backup tapes. The company must preserve the existing investment in the on-premises backup applications and workflows. What should a solutions architect recommend?

   • ASet up AWS Storage Gateway to connect with the backup applications using the NFS interface.
   • BSet up an Amazon EFS file system that connects with the backup applications using the NFS interface.
   • CSet up an Amazon EFS file system that connects with the backup applications using the iSCSI interface.
   • DSet up AWS Storage Gateway to connect with the backup applications using the iSCSI-virtual tape library (VTL) interface.

   Show answer

   Answer: D

   Explanation

   Use Tape Gateway to replace physical tapes on premises with virtual tapes on AWS—reducing your data storage costs without changing your tape-based backup workflows. Tape Gateway supports all leading backup applications and caches virtual tapes on premises for low-latency data access. It compresses your tape data, encrypts it, and stores it in a virtual tape library in Amazon Simple Storage Service (Amazon S3). From there, you can transfer it to either Amazon S3 Glacier Flexible Retrieval or Amazon S3 Glacier Deep Archive to help minimize your long-term storage costs. https://aws.amazon.com/storagegateway/vtl/#:~:text=Use-,Tape%20Gateway,-to%20replace%20physical

   Source: Adapted from community discussion — TariqKipkemei

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 517 · 1017 in bank

   A company has data collection sensors at different locations. The data collection sensors stream a high volume of data to the company. The company wants to design a platform on AWS to ingest and process high-volume streaming data. The solution must be scalable and support data collection in near real time. The company must store the data in Amazon S3 for future reporting. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3.
   • BUse AWS Glue to deliver streaming data to Amazon S3.
   • CUse AWS Lambda to deliver streaming data and store the data to Amazon S3.
   • DUse AWS Database Migration Service (AWS DMS) to deliver streaming data to Amazon S3.

   Show answer

   Answer: A

   Explanation

   Amazon Kinesis Data Firehose is a fully managed service for delivering real-time streaming data to destinations such as Amazon S3, Amazon Redshift, Amazon Elasticsearch Service, and Splunk. It requires minimal setup and maintenance, automatically scales to match the throughput of your data, and offers near real-time data delivery with minimal operational overhead.

   Source: Adapted from community discussion — emakid

   References

   • AWS documentation

   Next question

8. Question 518 · 1017 in bank

   A company has separate AWS accounts for its finance, data analytics, and development departments. Because of costs and security concerns, the company wants to control which services each AWS account can use. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse AWS Systems Manager templates to control which AWS services each department can use.
   • BCreate organization units (OUs) for each department in AWS Organizations. Attach service control policies (SCPs) to the OUs.
   • CUse AWS CloudFormation to automatically provision only the AWS services that each department can use.
   • DSet up a list of products in AWS Service Catalog in the AWS accounts to manage and control the usage of specific AWS services.

   Show answer

   Answer: B

   Explanation

   "Separate AWS accounts" just says that it's multiple accounts, it does not indicate that they are NOT connected into a organization. Service Catalog alone does not restrict anything. You'd need to create a service in Service Catalog for everything you're allowing to use, then grant permissions on those services, and you'd need to remove other permissions from everyone. All of which is not mentioned in D. Just "setting up a list of products in AWS Service Catalog in the AWS accounts" will not restrict anyone from doing what he could do before.

   Source: Adapted from community discussion — pentium75

   Next question

9. Question 519 · 1017 in bank

   A company has created a multi-tier application for its ecommerce website. The website uses an Application Load Balancer that resides in the public subnets, a web tier in the public subnets, and a MySQL cluster hosted on Amazon EC2 instances in the private subnets. The MySQL database needs to retrieve product catalog and pricing information that is hosted on the internet by a third-party provider. A solutions architect must devise a strategy that maximizes security without increasing operational overhead. What should the solutions architect do to meet these requirements?

   • ADeploy a NAT instance in the VPC. Route all the internet-based traffic through the NAT instance.
   • BDeploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet-bound traffic to the NAT gateway.
   • CConfigure an internet gateway and attach it to the VPModify the private subnet route table to direct internet-bound traffic to the internet gateway.
   • DConfigure a virtual private gateway and attach it to the VPC. Modify the private subnet route table to direct internet-bound traffic to the virtual private gateway.

   Show answer

   Answer: B

   Explanation

   Deploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet-bound traffic to the NAT gateway

   Source: Adapted from community discussion — TariqKipkemei

   Next question

10. Question 520 · 1017 in bank

    A solutions architect is developing a VPC architecture that includes multiple subnets. The architecture will host applications that use Amazon EC2 instances and Amazon RDS DB instances. The architecture consists of six subnets in two Availability Zones. Each Availability Zone includes a public subnet, a private subnet, and a dedicated subnet for databases. Only EC2 instances that run in the private subnets can have access to the RDS databases. Which solution will meet these requirements?

    • ACreate a new route table that excludes the route to the public subnets' CIDR blocks. Associate the route table with the database subnets.
    • BCreate a security group that denies inbound traffic from the security group that is assigned to instances in the public subnets. Attach the security group to the DB instances.
    • CCreate a security group that allows inbound traffic from the security group that is assigned to instances in the private subnets. Attach the security group to the DB instances.
    • DCreate a new peering connection between the public subnets and the private subnets. Create a different peering connection between the private subnets and the database subnets.

    Show answer

    Answer: C

    Explanation

    A: doesn't fully configure the traffic flow B: security groups don't have deny rules D: peering is mostly between VPCs, doesn't really help here answer is C, most mainstream way

    Source: Adapted from community discussion — Sinaneos

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 511. 1017 questions available.