SAA-C03 practice questions 621–630

1. Question 621 · 1017 in bank

   Select 2

   A company has an application workflow that uses an AWS Lambda function to download and decrypt files from Amazon S3. These files are encrypted using AWS Key Management Service (AWS KMS) keys. A solutions architect needs to design a solution that will ensure the required permissions are set correctly. Which combination of actions accomplish this? (Choose two.)

   • AAttach the kms:decrypt permission to the Lambda function’s resource policy
   • BGrant the decrypt permission for the Lambda IAM role in the KMS key's policy
   • CGrant the decrypt permission for the Lambda resource policy in the KMS key's policy.
   • DCreate a new IAM policy with the kms:decrypt permission and attach the policy to the Lambda function.
   • ECreate a new IAM role with the kms:decrypt permission and attach the execution role to the Lambda function.

   Show answer

   Answer: BE

   Explanation

   BE is right. The key policy has to be modified to give lambda execution role access. You can't set another resource policy as principle. So C is not right

   Source: Adapted from community discussion — NickGordon

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 622 · 1017 in bank

   A company wants to monitor its AWS costs for financial review. The cloud operations team is designing an architecture in the AWS Organizations management account to query AWS Cost and Usage Reports for all member accounts. The team must run this query once a month and provide a detailed analysis of the bill. Which solution is the MOST scalable and cost-effective way to meet these requirements?

   • AEnable Cost and Usage Reports in the management account. Deliver reports to Amazon Kinesis. Use Amazon EMR for analysis.
   • BEnable Cost and Usage Reports in the management account. Deliver the reports to Amazon S3 Use Amazon Athena for analysis.
   • CEnable Cost and Usage Reports for member accounts. Deliver the reports to Amazon S3 Use Amazon Redshift for analysis.
   • DEnable Cost and Usage Reports for member accounts. Deliver the reports to Amazon Kinesis. Use Amazon QuickSight tor analysis.

   Show answer

   Answer: B

   Explanation

   Scalable and cost-effective way = Enable Cost and Usage Reports in the management account. Deliver the reports to Amazon S3 Use Amazon Athena for analysis

   Source: Adapted from community discussion — TariqKipkemei

   References

   • AWS documentation

   Next question

3. Question 623 · 1017 in bank

   A company wants to run a gaming application on Amazon EC2 instances that are part of an Auto Scaling group in the AWS Cloud. The application will transmit data by using UDP packets. The company wants to ensure that the application can scale out and in as traffic increases and decreases. What should a solutions architect do to meet these requirements?

   • AAttach a Network Load Balancer to the Auto Scaling group.
   • BAttach an Application Load Balancer to the Auto Scaling group.
   • CDeploy an Amazon Route 53 record set with a weighted policy to route traffic appropriately.
   • DDeploy a NAT instance that is configured with port forwarding to the EC2 instances in the Auto Scaling group.

   Show answer

   Answer: A

   Explanation

   UDP can only be monitored by NLB. ALB is for application layer (HTTP etc) R53 is DNS NAT is for port forwarding/address translation etc which is not going to help with scaling A is correct

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation

   Next question

4. Question 624 · 1017 in bank

   A company runs several websites on AWS for its different brands. Each website generates tens of gigabytes of web traffic logs each day. A solutions architect needs to design a scalable solution to give the company's developers the ability to analyze traffic patterns across all the company's websites. This analysis by the developers will occur on demand once a week over the course of several months. The solution must support queries with standard SQL. Which solution will meet these requirements MOST cost-effectively?

   • AStore the logs in Amazon S3. Use Amazon Athena tor analysis.
   • BStore the logs in Amazon RDS. Use a database client for analysis.
   • CStore the logs in Amazon OpenSearch Service. Use OpenSearch Service for analysis.
   • DStore the logs in an Amazon EMR cluster Use a supported open-source framework for SQL-based analysis.

   Show answer

   Answer: A

   Explanation

   Scalable + "The solution must support queries with standard SQL" = A B not scalable C OpenSearch is like ElasticSearch so does not support SQL syntax D EMR is processing not storage. Map-Reduce can use SQL like syntax but this option does not solve scalable storage issues. You normally run EMR on some stored data

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation

   Next question

5. Question 625 · 1017 in bank

   Select 2

   An international company has a subdomain for each country that the company operates in. The subdomains are formatted as example.com, country1.example.com, and country2.example.com. The company's workloads are behind an Application Load Balancer. The company wants to encrypt the website data that is in transit. Which combination of steps will meet these requirements? (Choose two.)

   • AUse the AWS Certificate Manager (ACM) console to request a public certificate for the apex top domain example com and a wildcard certificate for *.example.com.
   • BUse the AWS Certificate Manager (ACM) console to request a private certificate for the apex top domain example.com and a wildcard certificate for *.example.com.
   • CUse the AWS Certificate Manager (ACM) console to request a public and private certificate for the apex top domain example.com.
   • DValidate domain ownership by email address. Switch to DNS validation by adding the required DNS records to the DNS provider.
   • EValidate domain ownership for the domain by adding the required DNS records to the DNS provider.

   Show answer

   Answer: AE

   Explanation

   B is private certificate so won't help as that is for internal use C is for apex domain only and won't help with wildcard domain A is correct DE are both doable as per these articles D: https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html E: https://docs.aws.amazon.com/acm/latest/userguide/domain-ownership-validation.html D is less applicable because it does not say if R53 is being used for DNS. You only validate ownership to R53 C makes more sense as it applies to both R53 and other DNS providers

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 626 · 1017 in bank

   A company is required to use cryptographic keys in its on-premises key manager. The key manager is outside of the AWS Cloud because of regulatory and compliance requirements. The company wants to manage encryption and decryption by using cryptographic keys that are retained outside of the AWS Cloud and that support a variety of external key managers from different vendors. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse AWS CloudHSM key store backed by a CloudHSM cluster.
   • BUse an AWS Key Management Service (AWS KMS) external key store backed by an external key manager.
   • CUse the default AWS Key Management Service (AWS KMS) managed key store.
   • DUse a custom key store backed by an AWS CloudHSM cluster.

   Show answer

   Answer: B

   Explanation

   Answer A does not comply because aws cloudHSM is within aws Answer B is the correct answer because the company is required to use its on-premises key manager. Following https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html gives :An external key store is an AWS KMS custom key store backed by an external key manager outside of AWS that you own and control.(...) Answer C and D are both solutions in the aws cloud so that does not fit.

   Source: Adapted from community discussion — 1rob

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 627 · 1017 in bank

   A solutions architect needs to host a high performance computing (HPC) workload in the AWS Cloud. The workload will run on hundreds of Amazon EC2 instances and will require parallel access to a shared file system to enable distributed processing of large datasets. Datasets will be accessed across multiple instances simultaneously. The workload requires access latency within 1 ms. After processing has completed, engineers will need access to the dataset for manual postprocessing. Which solution will meet these requirements?

   • AUse Amazon Elastic File System (Amazon EFS) as a shared file system. Access the dataset from Amazon EFS.
   • BMount an Amazon S3 bucket to serve as the shared file system. Perform postprocessing directly from the S3 bucket.
   • CUse Amazon FSx for Lustre as a shared file system. Link the file system to an Amazon S3 bucket for postprocessing.
   • DConfigure AWS Resource Access Manager to share an Amazon S3 bucket so that it can be mounted to all instances for processing and postprocessing.

   Show answer

   Answer: C

   Explanation

   Amazon FSx for Lustre is a fully managed, high-performance file system optimized for HPC workloads. It is designed to deliver sub-millisecond latencies and high throughput, making it ideal for applications that require parallel access to shared storage, such as simulations and data analytics.

   Source: Adapted from community discussion — potomac

   Next question

8. Question 628 · 1017 in bank

   A gaming company is building an application with Voice over IP capabilities. The application will serve traffic to users across the world. The application needs to be highly available with an automated failover across AWS Regions. The company wants to minimize the latency of users without relying on IP address caching on user devices. What should a solutions architect do to meet these requirements?

   • AUse AWS Global Accelerator with health checks.
   • BUse Amazon Route 53 with a geolocation routing policy.
   • CCreate an Amazon CloudFront distribution that includes multiple origins.
   • DCreate an Application Load Balancer that uses path-based routing.

   Show answer

   Answer: A

   Explanation

   Global Accelerator is a good fit for non-HTTP use cases, such as gaming (UDP), IoT (MQTT), or Voice over IP, as well as for HTTP use cases that specifically require static IP addresses or deterministic, fast regional failover.

   Source: Adapted from community discussion — potomac

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 629 · 1017 in bank

   A weather forecasting company needs to process hundreds of gigabytes of data with sub-millisecond latency. The company has a high performance computing (HPC) environment in its data center and wants to expand its forecasting capabilities. A solutions architect must identify a highly available cloud storage solution that can handle large amounts of sustained throughput. Files that are stored in the solution should be accessible to thousands of compute instances that will simultaneously access and process the entire dataset. What should the solutions architect do to meet these requirements?

   • AUse Amazon FSx for Lustre scratch file systems.
   • BUse Amazon FSx for Lustre persistent file systems.
   • CUse Amazon Elastic File System (Amazon EFS) with Bursting Throughput mode.
   • DUse Amazon Elastic File System (Amazon EFS) with Provisioned Throughput mode.

   Show answer

   Answer: B

   Explanation

   Option A (Amazon FSx for Lustre scratch file systems) is designed for temporary data storage and does not provide the data persistence required for this scenario.

   Source: Adapted from community discussion — potomac

   References

   • AWS documentation

   Next question

10. Question 630 · 1017 in bank

    An ecommerce company runs a PostgreSQL database on premises. The database stores data by using high IOPS Amazon Elastic Block Store (Amazon EBS) block storage. The daily peak I/O transactions per second do not exceed 15,000 IOPS. The company wants to migrate the database to Amazon RDS for PostgreSQL and provision disk IOPS performance independent of disk storage capacity. Which solution will meet these requirements MOST cost-effectively?

    • AConfigure the General Purpose SSD (gp2) EBS volume storage type and provision 15,000 IOPS.
    • BConfigure the Provisioned IOPS SSD (io1) EBS volume storage type and provision 15,000 IOPS.
    • CConfigure the General Purpose SSD (gp3) EBS volume storage type and provision 15,000 IOPS.
    • DConfigure the EBS magnetic volume type to achieve maximum IOPS.

    Show answer

    Answer: C

    Explanation

    GP2 - • Size of the volume and IOPS are linked, max IOPS is 16,000 GP3 - Can increase IOPS up to 16,000 and throughput up to 1000 MiB/s independently GP3 is 20% cheaper than GP2

    Source: Adapted from community discussion — BillaRanga

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 621. 1017 questions available.