SAA-C03 practice questions 581–590

1. Question 581 · 1017 in bank

   A company will migrate 10 PB of data to Amazon S3 in 6 weeks. The current data center has a 500 Mbps uplink to the internet. Other on-premises applications share the uplink. The company can use 80% of the internet bandwidth for this one-time migration task. Which solution will meet these requirements?

   • AConfigure AWS DataSync to migrate the data to Amazon S3 and to automatically verify the data.
   • BUse rsync to transfer the data directly to Amazon S3.
   • CUse the AWS CLI and multiple copy processes to send the data directly to Amazon S3.
   • DOrder multiple AWS Snowball devices. Copy the data to the devices. Send the devices to AWS to copy the data to Amazon S3.

   Show answer

   Answer: D

   Explanation

   7 Years, 5 Months, 3 Weeks, 5 Days required to transfer 10PB on 400 Mbps. Finger cross the upload don't drop or timeout on year 7.

   Source: Adapted from community discussion — Cyberkayu

   Next question

2. Question 582 · 1017 in bank

   A company has several on-premises Internet Small Computer Systems Interface (ISCSI) network storage servers. The company wants to reduce the number of these servers by moving to the AWS Cloud. A solutions architect must provide low-latency access to frequently used data and reduce the dependency on on-premises servers with a minimal number of infrastructure changes. Which solution will meet these requirements?

   • ADeploy an Amazon S3 File Gateway.
   • BDeploy Amazon Elastic Block Store (Amazon EBS) storage with backups to Amazon S3.
   • CDeploy an AWS Storage Gateway volume gateway that is configured with stored volumes.
   • DDeploy an AWS Storage Gateway volume gateway that is configured with cached volumes.

   Show answer

   Answer: D

   Explanation

   The key reasons are: The Storage Gateway volume gateway provides iSCSI block storage using cached volumes. This allows replacing the on-premises iSCSI servers with minimal changes. Cached volumes store frequently accessed data locally for low latency access, while storing less frequently accessed data in S3. This reduces the number of on-premises servers while still providing low latency access to hot data. EBS does not provide iSCSI support to replace the existing servers. S3 File Gateway is for file storage, not block storage. Stored volumes would store all data on-premises, not in S3.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 583 · 1017 in bank

   A solutions architect is designing an application that will allow business users to upload objects to Amazon S3. The solution needs to maximize object durability. Objects also must be readily available at any time and for any length of time. Users will access objects frequently within the first 30 days after the objects are uploaded, but users are much less likely to access objects that are older than 30 days. Which solution meets these requirements MOST cost-effectively?

   • AStore all the objects in S3 Standard with an S3 Lifecycle rule to transition the objects to S3 Glacier after 30 days.
   • BStore all the objects in S3 Standard with an S3 Lifecycle rule to transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.
   • CStore all the objects in S3 Standard with an S3 Lifecycle rule to transition the objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 30 days.
   • DStore all the objects in S3 Intelligent-Tiering with an S3 Lifecycle rule to transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.

   Show answer

   Answer: B

   Explanation

   Minimum Days for Transition to S3 Standard-IA or S3 One Zone-IA Before you transition objects to S3 Standard-IA or S3 One Zone-IA, you must store them for at least 30 days in Amazon S3. For example, you cannot create a Lifecycle rule to transition objects to the S3 Standard-IA storage class one day after you create them. Amazon S3 doesn't support this transition within the first 30 days because newer objects are often accessed more frequently or deleted sooner than is suitable for S3 Standard-IA or S3 One Zone-IA storage. Similarly, if you are transitioning noncurrent objects (in versioned buckets), you can transition only objects that are at least 30 days noncurrent to S3 Standard-IA or S3 One Zone-IA storage. https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-transition-general-considerations.html

   Source: Adapted from community discussion — Sugarbear_01

   References

   • AWS documentation

   Next question

4. Question 584 · 1017 in bank

   A company has migrated a two-tier application from its on-premises data center to the AWS Cloud. The data tier is a Multi-AZ deployment of Amazon RDS for Oracle with 12 TB of General Purpose SSD Amazon Elastic Block Store (Amazon EBS) storage. The application is designed to process and store documents in the database as binary large objects (blobs) with an average document size of 6 MB. The database size has grown over time, reducing the performance and increasing the cost of storage. The company must improve the database performance and needs a solution that is highly available and resilient. Which solution will meet these requirements MOST cost-effectively?

   • AReduce the RDS DB instance size. Increase the storage capacity to 24 TiB. Change the storage type to Magnetic.
   • BIncrease the RDS DB instance size. Increase the storage capacity to 24 TiChange the storage type to Provisioned IOPS.
   • CCreate an Amazon S3 bucket. Update the application to store documents in the S3 bucket. Store the object metadata in the existing database.
   • DCreate an Amazon DynamoDB table. Update the application to use DynamoDB. Use AWS Database Migration Service (AWS DMS) to migrate data from the Oracle database to DynamoDB.

   Show answer

   Answer: C

   Explanation

   C. Create an Amazon S3 bucket. Update the application to store documents in the S3 bucket. Store the object metadata in the existing database.

   Source: Adapted from community discussion — Guru4Cloud

   Next question

5. Question 585 · 1017 in bank

   A company has an application that serves clients that are deployed in more than 20.000 retail storefront locations around the world. The application consists of backend web services that are exposed over HTTPS on port 443. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The retail locations communicate with the web application over the public internet. The company allows each retail location to register the IP address that the retail location has been allocated by its local ISP. The company's security team recommends to increase the security of the application endpoint by restricting access to only the IP addresses registered by the retail locations. What should a solutions architect do to meet these requirements?

   • AAssociate an AWS WAF web ACL with the ALB. Use IP rule sets on the ALB to filter traffic. Update the IP addresses in the rule to include the registered IP addresses.
   • BDeploy AWS Firewall Manager to manage the ALConfigure firewall rules to restrict traffic to the ALModify the firewall rules to include the registered IP addresses.
   • CStore the IP addresses in an Amazon DynamoDB table. Configure an AWS Lambda authorization function on the ALB to validate that incoming requests are from the registered IP addresses.
   • DConfigure the network ACL on the subnet that contains the public interface of the ALB. Update the ingress rules on the network ACL with entries for each of the registered IP addresses.

   Show answer

   Answer: A

   Explanation

   Associate an AWS WAF web ACL with the ALB. Use IP rule sets on the ALB to filter traffic. Update the IP addresses in the rule to include the registered IP addresses.

   Source: Adapted from community discussion — Passexam4sure_com

   References

   • AWS documentation

   Next question

6. Question 586 · 1017 in bank

   A company is building a data analysis platform on AWS by using AWS Lake Formation. The platform will ingest data from different sources such as Amazon S3 and Amazon RDS. The company needs a secure solution to prevent access to portions of the data that contain sensitive information. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate an IAM role that includes permissions to access Lake Formation tables.
   • BCreate data filters to implement row-level security and cell-level security.
   • CCreate an AWS Lambda function that removes sensitive information before Lake Formation ingests the data.
   • DCreate an AWS Lambda function that periodically queries and removes sensitive information from Lake Formation tables.

   Show answer

   Answer: B

   Explanation

   The key reasons are: Lake Formation data filters allow restricting access to rows or cells in data tables based on conditions. This allows preventing access to sensitive data. Data filters are implemented within Lake Formation and do not require additional coding or Lambda functions. Lambda functions to pre-process data or purge tables would require ongoing development and maintenance. IAM roles only provide user-level permissions, not row or cell level security. Data filters give granular access control over Lake Formation data with minimal configuration, avoiding complex custom code.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation

   Next question

7. Question 587 · 1017 in bank

   A company is developing a two-tier web application on AWS. The company's developers have deployed the application on an Amazon EC2 instance that connects directly to a backend Amazon RDS database. The company must not hardcode database credentials in the application. The company must also implement a solution to automatically rotate the database credentials on a regular basis. Which solution will meet these requirements with the LEAST operational overhead?

   • AStore the database credentials in the instance metadata. Use Amazon EventBridge (Amazon CloudWatch Events) rules to run a scheduled AWS Lambda function that updates the RDS credentials and instance metadata at the same time.
   • BStore the database credentials in a configuration file in an encrypted Amazon S3 bucket. Use Amazon EventBridge (Amazon CloudWatch Events) rules to run a scheduled AWS Lambda function that updates the RDS credentials and the credentials in the configuration file at the same time. Use S3 Versioning to ensure the ability to fall back to previous values.
   • CStore the database credentials as a secret in AWS Secrets Manager. Turn on automatic rotation for the secret. Attach the required permission to the EC2 role to grant access to the secret.
   • DStore the database credentials as encrypted parameters in AWS Systems Manager Parameter Store. Turn on automatic rotation for the encrypted parameters. Attach the required permission to the EC2 role to grant access to the encrypted parameters.

   Show answer

   Answer: C

   Explanation

   The correct solution is C. Store the database credentials as a secret in AWS Secrets Manager. Turn on automatic rotation for the secret. Attach the required permission to the EC2 role to grant access to the secret. AWS Secrets Manager is a service that enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. By storing the database credentials as a secret in Secrets Manager, you can ensure that they are not hardcoded in the application and that they are automatically rotated on a regular basis. To grant the EC2 instance access to the secret, you can attach the required permission to the EC2 role. This will allow the application to retrieve the secret from Secrets Manager as needed.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • AWS documentation

   Next question

8. Question 588 · 1017 in bank

   A company deploys Amazon EC2 instances that run in a VPC. The EC2 instances load source data into Amazon S3 buckets so that the data can be processed in the future. According to compliance laws, the data must not be transmitted over the public internet. Servers in the company's on-premises data center will consume the output from an application that runs on the EC2 instances. Which solution will meet these requirements?

   • ADeploy an interface VPC endpoint for Amazon EC2. Create an AWS Site-to-Site VPN connection between the company and the VPC.
   • BDeploy a gateway VPC endpoint for Amazon S3. Set up an AWS Direct Connect connection between the on-premises network and the VPC.
   • CSet up an AWS Transit Gateway connection from the VPC to the S3 buckets. Create an AWS Site-to-Site VPN connection between the company and the VPC.
   • DSet up proxy EC2 instances that have routes to NAT gateways. Configure the proxy EC2 instances to fetch S3 data and feed the application instances.

   Show answer

   Answer: B

   Explanation

   A gateway VPC endpoint for Amazon S3 allows the EC2 instances within the VPC to access Amazon S3 buckets without using the public internet. The traffic between the VPC and S3 is routed within the AWS network. AWS Direct Connect establishes a private connection between the on-premises data center and AWS infrastructure, avoiding data transfer over the public internet and ensuring compliance with the specified requirements. It provides a dedicated network link with higher bandwidth options and potentially more consistent network performance than internet-based connections. Whereas Option A uses Site-to-Site VPN connection which is secure. However it typically runs over the public internet, which would not meet the company's requirement of avoiding public internet data transit.

   Source: Adapted from community discussion — OSHOAIB

   Next question

9. Question 589 · 1017 in bank

   A company has an application with a REST-based interface that allows data to be received in near-real time from a third-party vendor. Once received, the application processes and stores the data for further analysis. The application is running on Amazon EC2 instances. The third-party vendor has received many 503 Service Unavailable Errors when sending data to the application. When the data volume spikes, the compute capacity reaches its maximum limit and the application is unable to process all requests. Which design should a solutions architect recommend to provide a more scalable solution?

   • AUse Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions.
   • BUse Amazon API Gateway on top of the existing application. Create a usage plan with a quota limit for the third-party vendor.
   • CUse Amazon Simple Notification Service (Amazon SNS) to ingest the data. Put the EC2 instances in an Auto Scaling group behind an Application Load Balancer.
   • DRepackage the application as a container. Deploy the application using Amazon Elastic Container Service (Amazon ECS) using the EC2 launch type with an Auto Scaling group.

   Show answer

   Answer: A

   Explanation

   The key reasons are: Kinesis Data Streams provides an auto-scaling stream that can handle large amounts of streaming data ingestion and throughput. This removes the bottlenecks around receiving the data. AWS Lambda can process and store the data in a scalable serverless manner, avoiding EC2 capacity limits. API Gateway adds API management capabilities but does not improve the underlying scalability of the EC2 application. SNS is for event publishing/notifications, not large scale data ingestion. ECS still relies on EC2 capacity.

   Source: Adapted from community discussion — Guru4Cloud

   Next question

10. Question 590 · 1017 in bank

    A company has an application that runs on Amazon EC2 instances in a private subnet. The application needs to process sensitive information from an Amazon S3 bucket. The application must not use the internet to connect to the S3 bucket. Which solution will meet these requirements?

    • AConfigure an internet gateway. Update the S3 bucket policy to allow access from the internet gateway. Update the application to use the new internet gateway.
    • BConfigure a VPN connection. Update the S3 bucket policy to allow access from the VPN connection. Update the application to use the new VPN connection.
    • CConfigure a NAT gateway. Update the S3 bucket policy to allow access from the NAT gateway. Update the application to use the new NAT gateway.
    • DConfigure a VPC endpoint. Update the S3 bucket policy to allow access from the VPC endpoint. Update the application to use the new VPC endpoint.

    Show answer

    Answer: D

    Explanation

    The solution that will meet these requirements is to: Configure a VPC endpoint for Amazon S3 Update the S3 bucket policy to allow access from the VPC endpoint Update the application to use the new VPC endpoint The key reasons are: VPC endpoints allow private connectivity from VPCs to AWS services like S3 without using an internet gateway. The application can connect to S3 through the VPC endpoint while remaining in the private subnet, without internet access.

    Source: Adapted from community discussion — Guru4Cloud

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 581. 1017 questions available.