SAA-C03 practice questions 651–660

1. Question 651 · 1017 in bank

   A company created a new organization in AWS Organizations. The organization has multiple accounts for the company's development teams. The development team members use AWS IAM Identity Center (AWS Single Sign-On) to access the accounts. For each of the company's applications, the development teams must use a predefined application name to tag resources that are created. A solutions architect needs to design a solution that gives the development team the ability to create resources only if the application name tag has an approved value. Which solution will meet these requirements?

   • ACreate an IAM group that has a conditional Allow policy that requires the application name tag to be specified for resources to be created.
   • BCreate a cross-account role that has a Deny policy for any resource that has the application name tag.
   • CCreate a resource group in AWS Resource Groups to validate that the tags are applied to all resources in all accounts.
   • DCreate a tag policy in Organizations that has a list of allowed application names.

   Show answer

   Answer: D

   Explanation

   A: Don't think this is possible. B: Cross account role with deny policy? Never seen anything like this C: Resource groups have nothing to do with allowed tags D: Correct https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation

   Next question

2. Question 652 · 1017 in bank

   A company runs its databases on Amazon RDS for PostgreSQL. The company wants a secure solution to manage the master user password by rotating the password every 30 days. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse Amazon EventBridge to schedule a custom AWS Lambda function to rotate the password every 30 days.
   • BUse the modify-db-instance command in the AWS CLI to change the password.
   • CIntegrate AWS Secrets Manager with Amazon RDS for PostgreSQL to automate password rotation.
   • DIntegrate AWS Systems Manager Parameter Store with Amazon RDS for PostgreSQL to automate password rotation.

   Show answer

   Answer: C

   Explanation

   "Least operational overhead" A: Lambda overhead so not correct B: CLI = overhead D: Yes, it can be done but requires more work for integration. C: This is correct way of doing it. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-secrets-manager.html#rds-secrets-manager-overview

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation

   Next question

3. Question 653 · 1017 in bank

   A company hosts an application on multiple Amazon EC2 instances. The application processes messages from an Amazon SQS queue, writes to an Amazon RDS table, and deletes the message from the queue. Occasional duplicate records are found in the RDS table. The SQS queue does not contain any duplicate messages. What should a solutions architect do to ensure messages are being processed once only?

   • AUse the CreateQueue API call to create a new queue.
   • BUse the AddPermission API call to add appropriate permissions.
   • CUse the ReceiveMessage API call to set an appropriate wait time.
   • DUse the ChangeMessageVisibility API call to increase the visibility timeout.

   Show answer

   Answer: D

   Explanation

   In case of SQS - multi-consumers if one consumer has already picked the message and is processing, in meantime other consumer can pick it up and process the message there by two copies are added at the end. To avoid this the message is made invisible from the time its picked and deleted after processing. This visibility timeout is increased according to max time taken to process the message

   Source: Adapted from community discussion — KVK16

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 654 · 1017 in bank

   A company performs tests on an application that uses an Amazon DynamoDB table. The tests run for 4 hours once a week. The company knows how many read and write operations the application performs to the table each second during the tests. The company does not currently use DynamoDB for any other use case. A solutions architect needs to optimize the costs for the table. Which solution will meet these requirements?

   • AChoose on-demand mode. Update the read and write capacity units appropriately.
   • BChoose provisioned mode. Update the read and write capacity units appropriately.
   • CPurchase DynamoDB reserved capacity for a 1-year term.
   • DPurchase DynamoDB reserved capacity for a 3-year term.

   Show answer

   Answer: B

   Explanation

   CD are expensive as reserved capacity even with discounts would spend most time in idle mode (over paid, under utilized) A: On demand is good if you have unpredictable usage, https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.ReadWriteCapacityMode.html#HowItWorks.OnDemand B: Provisioned is good if you the usage: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ProvisionedThroughput.html "The company knows how many read and write operations the application performs to the table each second during the tests." so ideally they can set this as max

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 655 · 1017 in bank

   A company runs its applications on Amazon EC2 instances. The company performs periodic financial assessments of its AWS costs. The company recently identified unusual spending. The company needs a solution to prevent unusual spending. The solution must monitor costs and notify responsible stakeholders in the event of unusual spending. Which solution will meet these requirements?

   • AUse an AWS Budgets template to create a zero spend budget.
   • BCreate an AWS Cost Anomaly Detection monitor in the AWS Billing and Cost Management console.
   • CCreate AWS Pricing Calculator estimates for the current running workload pricing details.
   • DUse Amazon CloudWatch to monitor costs and to identify unusual spending.

   Show answer

   Answer: B

   Explanation

   AWS Cost Anomaly Detection (Option B): AWS Cost Anomaly Detection is designed to automatically detect unusual spending patterns based on machine learning algorithms. It can identify anomalies and send notifications when it detects unexpected changes in spending. This aligns well with the requirement to prevent unusual spending and notify stakeholders.

   Source: Adapted from community discussion — meenkaza

   References

   • AWS documentation

   Next question

6. Question 656 · 1017 in bank

   A marketing company receives a large amount of new clickstream data in Amazon S3 from a marketing campaign. The company needs to analyze the clickstream data in Amazon S3 quickly. Then the company needs to determine whether to process the data further in the data pipeline. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate external tables in a Spark catalog. Configure jobs in AWS Glue to query the data.
   • BConfigure an AWS Glue crawler to crawl the data. Configure Amazon Athena to query the data.
   • CCreate external tables in a Hive metastore. Configure Spark jobs in Amazon EMR to query the data.
   • DConfigure an AWS Glue crawler to crawl the data. Configure Amazon Kinesis Data Analytics to use SQL to query the data.

   Show answer

   Answer: B

   Explanation

   AWS Glue with Athena (Option B): AWS Glue is a fully managed extract, transform, and load (ETL) service, and Athena is a serverless query service that allows you to analyze data directly in Amazon S3 using SQL queries. By configuring an AWS Glue crawler to crawl the data, you can create a schema for the data, and then use Athena to query the data directly without the need to load it into a separate database. This minimizes operational overhead.

   Source: Adapted from community discussion — meenkaza

   References

   • AWS documentation

   Next question

7. Question 657 · 1017 in bank

   A company runs an SMB file server in its data center. The file server stores large files that the company frequently accesses for up to 7 days after the file creation date. After 7 days, the company needs to be able to access the files with a maximum retrieval time of 24 hours. Which solution will meet these requirements?

   • AUse AWS DataSync to copy data that is older than 7 days from the SMB file server to AWS.
   • BCreate an Amazon S3 File Gateway to increase the company's storage space. Create an S3 Lifecycle policy to transition the data to S3 Glacier Deep Archive after 7 days.
   • CCreate an Amazon FSx File Gateway to increase the company's storage space. Create an Amazon S3 Lifecycle policy to transition the data after 7 days.
   • DConfigure access to Amazon S3 for each user. Create an S3 Lifecycle policy to transition the data to S3 Glacier Flexible Retrieval after 7 days.

   Show answer

   Answer: B

   Explanation

   A: DataSync is not used for this C: FSx File Gateway requires NFS on both sides so won't work with S3 D: Doesn't say how to transfer data to S3 B: S3 File Gateway will connect SMB to S3. Lifecycle policy will move objects to S3 Glacier Deep Archive which support 12 hours retrieval https://aws.amazon.com/blogs/aws/new-amazon-s3-storage-class-glacier-deep-archive/

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 658 · 1017 in bank

   Select 2

   A company runs a web application on Amazon EC2 instances in an Auto Scaling group. The application uses a database that runs on an Amazon RDS for PostgreSQL DB instance. The application performs slowly when traffic increases. The database experiences a heavy read load during periods of high traffic. Which actions should a solutions architect take to resolve these performance issues? (Choose two.)

   • ATurn on auto scaling for the DB instance.
   • BCreate a read replica for the DB instance. Configure the application to send read traffic to the read replica.
   • CConvert the DB instance to a Multi-AZ DB instance deployment. Configure the application to send read traffic to the standby DB instance.
   • DCreate an Amazon ElastiCache cluster. Configure the application to cache query results in the ElastiCache cluster.
   • EConfigure the Auto Scaling group subnets to ensure that the EC2 instances are provisioned in the same Availability Zone as the DB instance.

   Show answer

   Answer: BD

   Explanation

   A: RDS DB instance Autoscaling is not a thing C: You cannot read from standby even if this was done. E: Does not solve any problem Correct answer B: Read replicas distribute load and help improving performance D: Caching of any kind will help with performance Remember: " The database experiences a heavy read load during periods of high traffic."

   Source: Adapted from community discussion — awsgeek75

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 659 · 1017 in bank

   A company uses Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS) volumes to run an application. The company creates one snapshot of each EBS volume every day to meet compliance requirements. The company wants to implement an architecture that prevents the accidental deletion of EBS volume snapshots. The solution must not change the administrative rights of the storage administrator user. Which solution will meet these requirements with the LEAST administrative effort?

   • ACreate an IAM role that has permission to delete snapshots. Attach the role to a new EC2 instance. Use the AWS CLI from the new EC2 instance to delete snapshots.
   • BCreate an IAM policy that denies snapshot deletion. Attach the policy to the storage administrator user.
   • CAdd tags to the snapshots. Create retention rules in Recycle Bin for EBS snapshots that have the tags.
   • DLock the EBS snapshots to prevent deletion.

   Show answer

   Answer: D

   Explanation

   Locking EBS Snapshots (Option D): The "lock" feature in AWS allows you to prevent accidental deletion of resources, including EBS snapshots. This can be set at the snapshot level, providing a straightforward and effective way to meet the requirements without changing the administrative rights of the storage administrator user.

   Source: Adapted from community discussion — meenkaza

   References

   • AWS documentation

   Next question

10. Question 660 · 1017 in bank

    A company's application uses Network Load Balancers, Auto Scaling groups, Amazon EC2 instances, and databases that are deployed in an Amazon VPC. The company wants to capture information about traffic to and from the network interfaces in near real time in its Amazon VPC. The company wants to send the information to Amazon OpenSearch Service for analysis. Which solution will meet these requirements?

    • ACreate a log group in Amazon CloudWatch Logs. Configure VPC Flow Logs to send the log data to the log group. Use Amazon Kinesis Data Streams to stream the logs from the log group to OpenSearch Service.
    • BCreate a log group in Amazon CloudWatch Logs. Configure VPC Flow Logs to send the log data to the log group. Use Amazon Kinesis Data Firehose to stream the logs from the log group to OpenSearch Service.
    • CCreate a trail in AWS CloudTrail. Configure VPC Flow Logs to send the log data to the trail. Use Amazon Kinesis Data Streams to stream the logs from the trail to OpenSearch Service.
    • DCreate a trail in AWS CloudTrail. Configure VPC Flow Logs to send the log data to the trail. Use Amazon Kinesis Data Firehose to stream the logs from the trail to OpenSearch Service.

    Show answer

    Answer: B

    Explanation

    CloudTrail is for logging administrative actions, we need CloudWatch. We want the data in another AWS service (OpenSearch), not Kinesis, thus we need Firehose, not Streams.

    Source: Adapted from community discussion — pentium75

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 651. 1017 questions available.