SAA-C03 practice questions 521–530

1. Question 521 · 1017 in bank

   Select 2

   A company is using AWS Key Management Service (AWS KMS) keys to encrypt AWS Lambda environment variables. A solutions architect needs to ensure that the required permissions are in place to decrypt and use the environment variables. Which steps must the solutions architect take to implement the correct permissions? (Choose two.)

   • AAdd AWS KMS permissions in the Lambda resource policy.
   • BAdd AWS KMS permissions in the Lambda execution role.
   • CAdd AWS KMS permissions in the Lambda function policy.
   • DAllow the Lambda execution role in the AWS KMS key policy.
   • EAllow the Lambda resource policy in the AWS KMS key policy.

   Show answer

   Answer: BD

   Explanation

   To decrypt environment variables encrypted with AWS KMS, Lambda needs to be granted permissions to call KMS APIs. This is done in two places: The Lambda execution role needs kms:Decrypt and kms:GenerateDataKey permissions added. The execution role governs what AWS services the function code can access. The KMS key policy needs to allow the Lambda execution role to have kms:Decrypt and kms:GenerateDataKey permissions for that specific key. This allows the execution role to use that particular key.

   Source: Adapted from community discussion — Guru4Cloud

   Next question

2. Question 522 · 1017 in bank

   A company has a financial application that produces reports. The reports average 50 KB in size and are stored in Amazon S3. The reports are frequently accessed during the first week after production and must be stored for several years. The reports must be retrievable within 6 hours. Which solution meets these requirements MOST cost-effectively?

   • AUse S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier after 7 days.
   • BUse S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days.
   • CUse S3 Intelligent-Tiering. Configure S3 Intelligent-Tiering to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) and S3 Glacier.
   • DUse S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier Deep Archive after 7 days.

   Show answer

   Answer: A

   Explanation

   Answer is A Amazon S3 Glacier: Expedited Retrieval: Provides access to data within 1-5 minutes. Standard Retrieval: Provides access to data within 3-5 hours. Bulk Retrieval: Provides access to data within 5-12 hours. Amazon S3 Glacier Deep Archive: Standard Retrieval: Provides access to data within 12 hours. Bulk Retrieval: Provides access to data within 48 hours.

   Source: Adapted from community discussion — zjcorpuz

   References

   • AWS documentation

   Next question

3. Question 523 · 1017 in bank

   A company needs to optimize the cost of its Amazon EC2 instances. The company also needs to change the type and family of its EC2 instances every 2-3 months. What should the company do to meet these requirements?

   • APurchase Partial Upfront Reserved Instances for a 3-year term.
   • BPurchase a No Upfront Compute Savings Plan for a 1-year term.
   • CPurchase All Upfront Reserved Instances for a 1-year term.
   • DPurchase an All Upfront EC2 Instance Savings Plan for a 1-year term.

   Show answer

   Answer: B

   Explanation

   The key considerations are: The company needs flexibility to change EC2 instance types and families every 2-3 months. This rules out Reserved Instances which lock you into an instance type and family for 1-3 years. A Compute Savings Plan allows switching instance types and families freely within the term as needed. No Upfront is more flexible than All Upfront. A 1-year term balances commitment and flexibility better than a 3-year term given the company's changing needs. With No Upfront, the company only pays for usage monthly without an upfront payment. This optimizes cost.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation

   Next question

4. Question 524 · 1017 in bank

   A solutions architect needs to review a company's Amazon S3 buckets to discover personally identifiable information (PII). The company stores the PII data in the us-east-1 Region and us-west-2 Region. Which solution will meet these requirements with the LEAST operational overhead?

   • AConfigure Amazon Macie in each Region. Create a job to analyze the data that is in Amazon S3.
   • BConfigure AWS Security Hub for all Regions. Create an AWS Config rule to analyze the data that is in Amazon S3.
   • CConfigure Amazon Inspector to analyze the data that is in Amazon S3.
   • DConfigure Amazon GuardDuty to analyze the data that is in Amazon S3.

   Show answer

   Answer: A

   Explanation

   The key reasons are: Amazon Macie is designed specifically for discovering and classifying sensitive data like PII in S3. This makes it the optimal service to use. Macie can be enabled directly in the required Regions rather than enabling it across all Regions which is unnecessary. This minimizes overhead. Macie can be set up to automatically scan the specified S3 buckets on a schedule. No need to create separate jobs. Security Hub is for security monitoring across AWS accounts, not specific for PII discovery. More overhead than needed. Inspector and GuardDuty are not built for PII discovery in S3 buckets. They provide broader security capabilities.

   Source: Adapted from community discussion — Guru4Cloud

   Next question

5. Question 525 · 1017 in bank

   A company's SAP application has a backend SQL Server database in an on-premises environment. The company wants to migrate its on-premises application and database server to AWS. The company needs an instance type that meets the high demands of its SAP database. On-premises performance data shows that both the SAP application and the database have high memory utilization. Which solution will meet these requirements?

   • AUse the compute optimized instance family for the application. Use the memory optimized instance family for the database.
   • BUse the storage optimized instance family for both the application and the database.
   • CUse the memory optimized instance family for both the application and the database.
   • DUse the high performance computing (HPC) optimized instance family for the application. Use the memory optimized instance family for the database.

   Show answer

   Answer: C

   Explanation

   Since both the app and database have high memory needs, the memory optimized family like R5 instances meet those requirements well. Using the same instance family simplifies management and operations, rather than mixing instance types. Compute optimized instances may not provide enough memory for the SAP app's needs. Storage optimized is overkill for the database's compute and memory needs. HPC is overprovisioned for the SAP app.

   Source: Adapted from community discussion — Guru4Cloud

   Next question

6. Question 526 · 1017 in bank

   A company runs an application in a VPC with public and private subnets. The VPC extends across multiple Availability Zones. The application runs on Amazon EC2 instances in private subnets. The application uses an Amazon Simple Queue Service (Amazon SQS) queue. A solutions architect needs to design a secure solution to establish a connection between the EC2 instances and the SQS queue. Which solution will meet these requirements?

   • AImplement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the private subnets. Add to the endpoint a security group that has an inbound access rule that allows traffic from the EC2 instances that are in the private subnets.
   • BImplement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the public subnets. Attach to the interface endpoint a VPC endpoint policy that allows access from the EC2 instances that are in the private subnets.
   • CImplement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the public subnets. Attach an Amazon SQS access policy to the interface VPC endpoint that allows requests from only a specified VPC endpoint.
   • DImplement a gateway endpoint for Amazon SQS. Add a NAT gateway to the private subnets. Attach an IAM role to the EC2 instances that allows access to the SQS queue.

   Show answer

   Answer: A

   Explanation

   An interface VPC endpoint is a private way to connect to AWS services without having to expose your VPC to the public internet. This is the most secure way to connect to Amazon SQS from the private subnets. Configuring the endpoint to use the private subnets ensures that the traffic between the EC2 instances and the SQS queue is only within the VPC. This helps to protect the traffic from being intercepted by a malicious actor. Adding a security group to the endpoint that has an inbound access rule that allows traffic from the EC2 instances that are in the private subnets further restricts the traffic to only the authorized sources. This helps to prevent unauthorized access to the SQS queue.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation

   Next question

7. Question 527 · 1017 in bank

   A solutions architect is using an AWS CloudFormation template to deploy a three-tier web application. The web application consists of a web tier and an application tier that stores and retrieves user data in Amazon DynamoDB tables. The web and application tiers are hosted on Amazon EC2 instances, and the database tier is not publicly accessible. The application EC2 instances need to access the DynamoDB tables without exposing API credentials in the template. What should the solutions architect do to meet these requirements?

   • ACreate an IAM role to read the DynamoDB tables. Associate the role with the application instances by referencing an instance profile.
   • BCreate an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile, and associate the instance profile with the application instances.
   • CUse the parameter section in the AWS CloudFormation template to have the user input access and secret keys from an already-created IAM user that has the required permissions to read and write from the DynamoDB tables.
   • DCreate an IAM user in the AWS CloudFormation template that has the required permissions to read and write from the DynamoDB tables. Use the GetAtt function to retrieve the access and secret keys, and pass them to the application instances through the user data.

   Show answer

   Answer: B

   Explanation

   Explanation. Both A and B seems suitable. But Option A is incorrect because it says “Associate the role with the application instances by referencing an instance profile”. Which just only a Part of the solution. In API/AWS CLI following steps are required to complete the Role-> instance profile association-> to instance. 1. Create an IAM Role 2. add-role-to-instance-profile (aws iam add-role-to-instance-profile --role-name S3Access --instance-profile-name Webserver) 3. associate-iam-instance-profile (aws ec2 associate-iam-instance-profile --instance-id i-123456789abcde123 --iam-instance-profile Name=admin-role) hence Option B is correct.

   Source: Adapted from community discussion — anibinaadi

   Next question

8. Question 528 · 1017 in bank

   A solutions architect manages an analytics application. The application stores large amounts of semistructured data in an Amazon S3 bucket. The solutions architect wants to use parallel data processing to process the data more quickly. The solutions architect also wants to use information that is stored in an Amazon Redshift database to enrich the data. Which solution will meet these requirements?

   • AUse Amazon Athena to process the S3 data. Use AWS Glue with the Amazon Redshift data to enrich the S3 data.
   • BUse Amazon EMR to process the S3 data. Use Amazon EMR with the Amazon Redshift data to enrich the S3 data.
   • CUse Amazon EMR to process the S3 data. Use Amazon Kinesis Data Streams to move the S3 data into Amazon Redshift so that the data can be enriched.
   • DUse AWS Glue to process the S3 data. Use AWS Lake Formation with the Amazon Redshift data to enrich the S3 data.

   Show answer

   Answer: B

   Explanation

   Option B is the correct solution that meets the requirements: Use Amazon EMR to process the semi-structured data in Amazon S3. EMR provides a managed Hadoop framework optimized for processing large datasets in S3. EMR supports parallel data processing across multiple nodes to speed up the processing. EMR can integrate directly with Amazon Redshift using the EMR-Redshift integration. This allows querying the Redshift data from EMR and joining it with the S3 data. This enables enriching the semi-structured S3 data with the information stored in Redshift

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 529 · 1017 in bank

   A company has two VPCs that are located in the us-west-2 Region within the same AWS account. The company needs to allow network traffic between these VPCs. Approximately 500 GB of data transfer will occur between the VPCs each month. What is the MOST cost-effective solution to connect these VPCs?

   • AImplement AWS Transit Gateway to connect the VPCs. Update the route tables of each VPC to use the transit gateway for inter-VPC communication.
   • BImplement an AWS Site-to-Site VPN tunnel between the VPCs. Update the route tables of each VPC to use the VPN tunnel for inter-VPC communication.
   • CSet up a VPC peering connection between the VPCs. Update the route tables of each VPC to use the VPC peering connection for inter-VPC communication.
   • DSet up a 1 GB AWS Direct Connect connection between the VPCs. Update the route tables of each VPC to use the Direct Connect connection for inter-VPC communication.

   Show answer

   Answer: C

   Explanation

   C is the correct answer. VPC peering is the most cost-effective way to connect two VPCs within the same region and AWS account. There are no additional charges for VPC peering beyond standard data transfer rates. Transit Gateway and VPN add additional hourly and data processing charges that are not necessary for simple VPC peering. Direct Connect provides dedicated network connectivity, but is overkill for the relatively low inter-VPC data transfer needs described here. It has high fixed costs plus data transfer rates. For occasional inter-VPC communication of moderate data volumes within the same region and account, VPC peering is the most cost-effective solution. It provides simple private connectivity without transfer charges or network appliances.

   Source: Adapted from community discussion — luiscc

   References

   • AWS documentation

   Next question

10. Question 530 · 1017 in bank

    Select 2

    A company hosts multiple applications on AWS for different product lines. The applications use different compute resources, including Amazon EC2 instances and Application Load Balancers. The applications run in different AWS accounts under the same organization in AWS Organizations across multiple AWS Regions. Teams for each product line have tagged each compute resource in the individual accounts. The company wants more details about the cost for each product line from the consolidated billing feature in Organizations. Which combination of steps will meet these requirements? (Choose two.)

    • ASelect a specific AWS generated tag in the AWS Billing console.
    • BSelect a specific user-defined tag in the AWS Billing console.
    • CSelect a specific user-defined tag in the AWS Resource Groups console.
    • DActivate the selected tag from each AWS account.
    • EActivate the selected tag from the Organizations management account.

    Show answer

    Answer: BE

    Explanation

    The reasons are: User-defined tags were created by each product team to identify resources. Selecting the relevant tag in the Billing console will group costs. The tag must be activated from the Organizations management account to consolidate billing across all accounts. AWS generated tags are predefined by AWS and won't align to product lines. Resource Groups (Option C) helps manage resources but not billing. Activating the tag from each account (Option D) is not needed since Organizations centralizes billing.

    Source: Adapted from community discussion — Guru4Cloud

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 521. 1017 questions available.