SAA-C03 practice questions 591–600

1. Question 591 · 1017 in bank

   A company uses Amazon Elastic Kubernetes Service (Amazon EKS) to run a container application. The EKS cluster stores sensitive information in the Kubernetes secrets object. The company wants to ensure that the information is encrypted. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse the container application to encrypt the information by using AWS Key Management Service (AWS KMS).
   • BEnable secrets encryption in the EKS cluster by using AWS Key Management Service (AWS KMS).
   • CImplement an AWS Lambda function to encrypt the information by using AWS Key Management Service (AWS KMS).
   • DUse AWS Systems Manager Parameter Store to encrypt the information by using AWS Key Management Service (AWS KMS).

   Show answer

   Answer: B

   Explanation

   EKS supports encrypting Kubernetes secrets at the cluster level using AWS KMS keys. This provides an automated way to encrypt secrets. Enabling this feature requires minimal configuration changes to the EKS cluster and no code changes. Other options like using Lambda functions or modifying the application code to encrypt secrets require additional development effort and overhead. Systems Manager Parameter Store could store encrypted parameters but does not natively integrate with EKS to encrypt Kubernetes secrets. The EKS secrets encryption feature leverages AWS KMS without the need to directly call KMS APIs from the application.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation

   Next question

2. Question 592 · 1017 in bank

   A company is designing a new multi-tier web application that consists of the following components: • Web and application servers that run on Amazon EC2 instances as part of Auto Scaling groups • An Amazon RDS DB instance for data storage A solutions architect needs to limit access to the application servers so that only the web servers can access them. Which solution will meet these requirements?

   • ADeploy AWS PrivateLink in front of the application servers. Configure the network ACL to allow only the web servers to access the application servers.
   • BDeploy a VPC endpoint in front of the application servers. Configure the security group to allow only the web servers to access the application servers.
   • CDeploy a Network Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the network ACL to allow only the web servers to access the application servers.
   • DDeploy an Application Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the security group to allow only the web servers to access the application servers.

   Show answer

   Answer: D

   Explanation

   The key reasons are: An Application Load Balancer (ALB) allows directing traffic to the application servers and provides access control via security groups. Security groups act as a firewall at the instance level and can control access to the application servers from the web servers. Network ACLs work at the subnet level and are less flexible for security groups for instance-level access control. VPC endpoints are used to provide private access to AWS services, not for access between EC2 instances. AWS PrivateLink provides private connectivity between VPCs, which is not required in this single VPC scenario.

   Source: Adapted from community discussion — Guru4Cloud

   Next question

3. Question 593 · 1017 in bank

   A company runs a critical, customer-facing application on Amazon Elastic Kubernetes Service (Amazon EKS). The application has a microservices architecture. The company needs to implement a solution that collects, aggregates, and summarizes metrics and logs from the application in a centralized location. Which solution meets these requirements?

   • ARun the Amazon CloudWatch agent in the existing EKS cluster. View the metrics and logs in the CloudWatch console.
   • BRun AWS App Mesh in the existing EKS cluster. View the metrics and logs in the App Mesh console.
   • CConfigure AWS CloudTrail to capture data events. Query CloudTrail by using Amazon OpenSearch Service.
   • DConfigure Amazon CloudWatch Container Insights in the existing EKS cluster. View the metrics and logs in the CloudWatch console.

   Show answer

   Answer: D

   Explanation

   Use CloudWatch Container Insights to collect, aggregate, and summarize metrics and logs from your containerized applications and microservices. Container Insights is available for Amazon Elastic Container Service (Amazon ECS), Amazon Elastic Kubernetes Service (Amazon EKS), and Kubernetes platforms on Amazon EC2. Container Insights supports collecting metrics from clusters deployed on AWS Fargate for both Amazon ECS and Amazon EKS.

   Source: Adapted from community discussion — potomac

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 594 · 1017 in bank

   A company has deployed its newest product on AWS. The product runs in an Auto Scaling group behind a Network Load Balancer. The company stores the product’s objects in an Amazon S3 bucket. The company recently experienced malicious attacks against its systems. The company needs a solution that continuously monitors for malicious activity in the AWS account, workloads, and access patterns to the S3 bucket. The solution must also report suspicious activity and display the information on a dashboard. Which solution will meet these requirements?

   • AConfigure Amazon Macie to monitor and report findings to AWS Config.
   • BConfigure Amazon Inspector to monitor and report findings to AWS CloudTrail.
   • CConfigure Amazon GuardDuty to monitor and report findings to AWS Security Hub.
   • DConfigure AWS Config to monitor and report findings to Amazon EventBridge.

   Show answer

   Answer: C

   Explanation

   The key reasons are: Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It analyzes AWS CloudTrail, VPC Flow Logs, and DNS logs. GuardDuty can detect threats like instance or S3 bucket compromise, malicious IP addresses, or unusual API calls. Findings can be sent to AWS Security Hub which provides a centralized security dashboard and alerts. Amazon Macie and Amazon Inspector do not monitor the breadth of activity that GuardDuty does. They focus more on data security and application vulnerabilities respectively. AWS Config monitors for resource configuration changes, not malicious activity.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation

   Next question

5. Question 595 · 1017 in bank

   Select 2

   A company wants to migrate an on-premises data center to AWS. The data center hosts a storage server that stores data in an NFS-based file system. The storage server holds 200 GB of data. The company needs to migrate the data without interruption to existing services. Multiple resources in AWS must be able to access the data by using the NFS protocol. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)

   • ACreate an Amazon FSx for Lustre file system.
   • BCreate an Amazon Elastic File System (Amazon EFS) file system.
   • CCreate an Amazon S3 bucket to receive the data.
   • DManually use an operating system copy command to push the data into the AWS destination.
   • EInstall an AWS DataSync agent in the on-premises data center. Use a DataSync task between the on-premises location and AWS.

   Show answer

   Answer: BE

   Explanation

   Amazon EFS provides a scalable, high performance NFS file system that can be accessed from multiple resources in AWS. AWS DataSync can perform the migration from the on-prem NFS server to EFS without interruption to existing services. This avoids having to manually move the data which could cause downtime. DataSync incrementally syncs changed data. EFS and DataSync together provide a cost-optimized approach compared to using S3 or FSx, while still meeting the requirements. Manually copying 200 GB of data to AWS would be slow and risky compared to using DataSync.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation

   Next question

6. Question 596 · 1017 in bank

   A company wants to use Amazon FSx for Windows File Server for its Amazon EC2 instances that have an SMB file share mounted as a volume in the us-east-1 Region. The company has a recovery point objective (RPO) of 5 minutes for planned system maintenance or unplanned service disruptions. The company needs to replicate the file system to the us-west-2 Region. The replicated data must not be deleted by any user for 5 years. Which solution will meet these requirements?

   • ACreate an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
   • BCreate an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
   • CCreate an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
   • DCreate an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.

   Show answer

   Answer: C

   Explanation

   C is correct. A and C is potential answer because they mention compliance mode. But single AZ is recommended for test and development only. For production workloads, we need multi AZ, which is C

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

7. Question 597 · 1017 in bank

   A solutions architect is designing a security solution for a company that wants to provide developers with individual AWS accounts through AWS Organizations, while also maintaining standard security controls. Because the individual developers will have AWS account root user-level access to their own accounts, the solutions architect wants to ensure that the mandatory AWS CloudTrail configuration that is applied to new developer accounts is not modified. Which action meets these requirements?

   • ACreate an IAM policy that prohibits changes to CloudTrail. and attach it to the root user.
   • BCreate a new trail in CloudTrail from within the developer accounts with the organization trails option enabled.
   • CCreate a service control policy (SCP) that prohibits changes to CloudTrail, and attach it the developer accounts.
   • DCreate a service-linked role for CloudTrail with a policy condition that allows changes only from an Amazon Resource Name (ARN) in the management account.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

8. Question 598 · 1017 in bank

   A company is deploying a new public web application to AWS. The application will run behind an Application Load Balancer (ALB). The application needs to be encrypted at the edge with an SSL/TLS certificate that is issued by an external certificate authority (CA). The certificate must be rotated each year before the certificate expires. What should a solutions architect do to meet these requirements?

   • AUse AWS Certificate Manager (ACM) to issue an SSL/TLS certificate. Apply the certificate to the ALB. Use the managed renewal feature to automatically rotate the certificate.
   • BUse AWS Certificate Manager (ACM) to issue an SSL/TLS certificate. Import the key material from the certificate. Apply the certificate to the ALUse the managed renewal feature to automatically rotate the certificate.
   • CUse AWS Certificate Manager (ACM) Private Certificate Authority to issue an SSL/TLS certificate from the root CA. Apply the certificate to the ALB. Use the managed renewal feature to automatically rotate the certificate.
   • DUse AWS Certificate Manager (ACM) to import an SSL/TLS certificate. Apply the certificate to the ALB. Use Amazon EventBridge (Amazon CloudWatch Events) to send a notification when the certificate is nearing expiration. Rotate the certificate manually.

   Show answer

   Answer: D

   Explanation

   It's a third-party certificate, hence AWS cannot manage renewal automatically. The closest thing you can do is to send a notification to renew the 3rd party certificate.

   Source: Adapted from community discussion — Sinaneos

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 599 · 1017 in bank

   A company is planning to deploy a business-critical application in the AWS Cloud. The application requires durable storage with consistent, low-latency performance. Which type of storage should a solutions architect recommend to meet these requirements?

   • AInstance store volume
   • BAmazon ElastiCache for Memcached cluster
   • CProvisioned IOPS SSD Amazon Elastic Block Store (Amazon EBS) volume
   • DThroughput Optimized HDD Amazon Elastic Block Store (Amazon EBS) volume

   Show answer

   Answer: C

   Explanation

   Provisioned IOPS SSD — Provides high performance for mission-critical, low-latency, or high-throughput workloads. Throughput Optimized HDD — A low-cost HDD designed for frequently accessed, throughput-intensive workloads.

   Source: Adapted from community discussion — potomac

   References

   • AWS documentation

   Next question

10. Question 600 · 1017 in bank

    An online photo-sharing company stores its photos in an Amazon S3 bucket that exists in the us-west-1 Region. The company needs to store a copy of all new photos in the us-east-1 Region. Which solution will meet this requirement with the LEAST operational effort?

    • ACreate a second S3 bucket in us-east-1. Use S3 Cross-Region Replication to copy photos from the existing S3 bucket to the second S3 bucket.
    • BCreate a cross-origin resource sharing (CORS) configuration of the existing S3 bucket. Specify us-east-1 in the CORS rule's AllowedOrigin element.
    • CCreate a second S3 bucket in us-east-1 across multiple Availability Zones. Create an S3 Lifecycle rule to save photos into the second S3 bucket.
    • DCreate a second S3 bucket in us-east-1. Configure S3 event notifications on object creation and update events to invoke an AWS Lambda function to copy photos from the existing S3 bucket to the second S3 bucket.

    Show answer

    Answer: A

    Explanation

    S3 Cross-Region Replication handles automatically copying new objects added to the source bucket to the destination bucket in a different region. It continuously replicates new photos without needing to manually copy files or set up Lambda triggers. CORS only enables cross-origin access, it does not copy objects. Using Lifecycle rules or Lambda functions requires custom code and logic to handle the copying. S3 Cross-Region Replication provides automated replication that minimizes operational overhead.

    Source: Adapted from community discussion — Guru4Cloud

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 591. 1017 questions available.