SAA-C03 practice questions 661–670

1. Question 661 · 1017 in bank

   A company is developing an application that will run on a production Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster has managed node groups that are provisioned with On-Demand Instances. The company needs a dedicated EKS cluster for development work. The company will use the development cluster infrequently to test the resiliency of the application. The EKS cluster must manage all the nodes. Which solution will meet these requirements MOST cost-effectively?

   • ACreate a managed node group that contains only Spot Instances.
   • BCreate two managed node groups. Provision one node group with On-Demand Instances. Provision the second node group with Spot Instances.
   • CCreate an Auto Scaling group that has a launch configuration that uses Spot Instances. Configure the user data to add the nodes to the EKS cluster.
   • DCreate a managed node group that contains only On-Demand Instances.

   Show answer

   Answer: A

   Explanation

   I think the question is easy to misunderstand, whether you should create the whole setup or just the development cluster. But from the wording ("The [production] EKS cluster has (!) managed node groups ... The company needs a dedicated EKS cluster for development work"), I conclude that we should only create the development cluster. As this will be used "infrequently" for testing purposes only, and it must be "most cost-effective", I'd go with A - new cluster with "one managed node group that contains only Spot instances".

   Source: Adapted from community discussion — pentium75

   References

   • repost.aws documentation

   Next question

2. Question 662 · 1017 in bank

   A company stores sensitive data in Amazon S3. A solutions architect needs to create an encryption solution. The company needs to fully control the ability of users to create, rotate, and disable encryption keys with minimal effort for any data that must be encrypted. Which solution will meet these requirements?

   • AUse default server-side encryption with Amazon S3 managed encryption keys (SSE-S3) to store the sensitive data.
   • BCreate a customer managed key by using AWS Key Management Service (AWS KMS). Use the new key to encrypt the S3 objects by using server-side encryption with AWS KMS keys (SSE-KMS).
   • CCreate an AWS managed key by using AWS Key Management Service (AWS KMS). Use the new key to encrypt the S3 objects by using server-side encryption with AWS KMS keys (SSE-KMS).
   • DDownload S3 objects to an Amazon EC2 instance. Encrypt the objects by using customer managed keys. Upload the encrypted objects back into Amazon S3.

   Show answer

   Answer: B

   Explanation

   SSE-KMS with Customer Managed Key (Option B): This option allows you to create a customer managed key using AWS KMS. With a customer managed key, you have full control over key lifecycle management, including the ability to create, rotate, and disable keys with minimal effort. SSE-KMS also integrates with AWS Identity and Access Management (IAM) for fine-grained access control.

   Source: Adapted from community discussion — meenkaza

   Next question

3. Question 663 · 1017 in bank

   Select 3

   A company wants to back up its on-premises virtual machines (VMs) to AWS. The company's backup solution exports on-premises backups to an Amazon S3 bucket as objects. The S3 backups must be retained for 30 days and must be automatically deleted after 30 days. Which combination of steps will meet these requirements? (Choose three.)

   • ACreate an S3 bucket that has S3 Object Lock enabled.
   • BCreate an S3 bucket that has object versioning enabled.
   • CConfigure a default retention period of 30 days for the objects.
   • DConfigure an S3 Lifecycle policy to protect the objects for 30 days.
   • EConfigure an S3 Lifecycle policy to expire the objects after 30 days.
   • FConfigure the backup solution to tag the objects with a 30-day retention period

   Show answer

   Answer: ACE

   Explanation

   This is a good example for a completely non-sense AWS exam question. In order to delete the object like requested in the question you need (E). This is required in either versioned or non-versioned buckets. Basically the task is done here. But let's assume we want to make it extra secure and retain the files for 30 days. Then we need object lock (A). You cannot have object lock without versioning (B). You also need to set a retention period then (C). So you either have A,B,C,E or you have E. Choosing exactly 3 options is completely nonsense here. But what do i know.

   Source: Adapted from community discussion — te1973

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 664 · 1017 in bank

   A solutions architect is designing a new hybrid architecture to extend a company's on-premises infrastructure to AWS. The company requires a highly available connection with consistent low latency to an AWS Region. The company needs to minimize costs and is willing to accept slower traffic if the primary connection fails. What should the solutions architect do to meet these requirements?

   • AProvision an AWS Direct Connect connection to a Region. Provision a VPN connection as a backup if the primary Direct Connect connection fails.
   • BProvision a VPN tunnel connection to a Region for private connectivity. Provision a second VPN tunnel for private connectivity and as a backup if the primary VPN connection fails.
   • CProvision an AWS Direct Connect connection to a Region. Provision a second Direct Connect connection to the same Region as a backup if the primary Direct Connect connection fails.
   • DProvision an AWS Direct Connect connection to a Region. Use the Direct Connect failover attribute from the AWS CLI to automatically create a backup connection if the primary Direct Connect connection fails.

   Show answer

   Answer: A

   Explanation

   Direct Connect goes throught 1 Gbps, 10 Gbps or 100 Gbps and the VPN goes up to 1.25 Gbps. https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-vpn.html

   Source: Adapted from community discussion — mabotega

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 665 · 1017 in bank

   A solutions architect needs to copy files from an Amazon S3 bucket to an Amazon Elastic File System (Amazon EFS) file system and another S3 bucket. The files must be copied continuously. New files are added to the original S3 bucket consistently. The copied files should be overwritten only if the source file changes. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate an AWS DataSync location for both the destination S3 bucket and the EFS file system. Create a task for the destination S3 bucket and the EFS file system. Set the transfer mode to transfer only data that has changed.
   • BCreate an AWS Lambda function. Mount the file system to the function. Set up an S3 event notification to invoke the function when files are created and changed in Amazon S3. Configure the function to copy files to the file system and the destination S3 bucket.
   • CCreate an AWS DataSync location for both the destination S3 bucket and the EFS file system. Create a task for the destination S3 bucket and the EFS file system. Set the transfer mode to transfer all data.
   • DLaunch an Amazon EC2 instance in the same VPC as the file system. Mount the file system. Create a script to routinely synchronize all objects that changed in the origin S3 bucket to the destination S3 bucket and the mounted file system.

   Show answer

   Answer: A

   Explanation

   Transfer only data that has changed – DataSync copies only the data and metadata that differs between the source and destination location. Transfer all data – DataSync copies everything in the source to the destination without comparing differences between the locations. https://docs.aws.amazon.com/datasync/latest/userguide/configure-metadata.html (B would work too but is more "operational overhead.")

   Source: Adapted from community discussion — pentium75

   References

   • AWS documentation

   Next question

6. Question 666 · 1017 in bank

   A company uses Amazon EC2 instances and stores data on Amazon Elastic Block Store (Amazon EBS) volumes. The company must ensure that all data is encrypted at rest by using AWS Key Management Service (AWS KMS). The company must be able to control rotation of the encryption keys. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate a customer managed key. Use the key to encrypt the EBS volumes.
   • BUse an AWS managed key to encrypt the EBS volumes. Use the key to configure automatic key rotation.
   • CCreate an external KMS key with imported key material. Use the key to encrypt the EBS volumes.
   • DUse an AWS owned key to encrypt the EBS volumes.

   Show answer

   Answer: A

   Explanation

   option A (Create a customer managed key. Use the key to encrypt the EBS volumes) is the most suitable option with the least operational overhead for the given requirements.

   Source: Adapted from community discussion — meenkaza

   References

   • AWS documentation

   Next question

7. Question 667 · 1017 in bank

   A company needs a solution to enforce data encryption at rest on Amazon EC2 instances. The solution must automatically identify noncompliant resources and enforce compliance policies on findings. Which solution will meet these requirements with the LEAST administrative overhead?

   • AUse an IAM policy that allows users to create only encrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Config and AWS Systems Manager to automate the detection and remediation of unencrypted EBS volumes.
   • BUse AWS Key Management Service (AWS KMS) to manage access to encrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Lambda and Amazon EventBridge to automate the detection and remediation of unencrypted EBS volumes.
   • CUse Amazon Macie to detect unencrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Systems Manager Automation rules to automatically encrypt existing and new EBS volumes.
   • DUse Amazon inspector to detect unencrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Systems Manager Automation rules to automatically encrypt existing and new EBS volumes.

   Show answer

   Answer: A

   Explanation

   IAM Policy and AWS Config (Option A): By creating an IAM policy that allows users to create only encrypted EBS volumes, you proactively prevent the creation of unencrypted volumes. Using AWS Config, you can set up rules to detect noncompliant resources, and AWS Systems Manager Automation can be used for automated remediation. This approach provides a proactive and automated solution.

   Source: Adapted from community discussion — meenkaza

   References

   • AWS documentation

   Next question

8. Question 668 · 1017 in bank

   Select 2

   A company is migrating its multi-tier on-premises application to AWS. The application consists of a single-node MySQL database and a multi-node web tier. The company must minimize changes to the application during the migration. The company wants to improve application resiliency after the migration. Which combination of steps will meet these requirements? (Choose two.)

   • AMigrate the web tier to Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer.
   • BMigrate the database to Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer.
   • CMigrate the database to an Amazon RDS Multi-AZ deployment.
   • DMigrate the web tier to an AWS Lambda function.
   • EMigrate the database to an Amazon DynamoDB table.

   Show answer

   Answer: AC

   Explanation

   Web Tier Migration (Option A): Migrating the web tier to Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) provides horizontal scalability, automatic scaling, and improved resiliency. Auto Scaling helps in managing and maintaining the desired number of EC2 instances based on demand, and the ALB distributes incoming traffic across multiple instances. Database Migration to Amazon RDS Multi-AZ (Option C): Migrating the database to Amazon RDS in a Multi-AZ deployment provides high availability and automatic failover. In a Multi-AZ deployment, Amazon RDS maintains a standby replica in a different Availability Zone, and in the event of a failure, it automatically promotes the replica to the primary instance. This enhances the resiliency of the database.

   Source: Adapted from community discussion — meenkaza

   Next question

9. Question 669 · 1017 in bank

   A company wants to migrate its web applications from on premises to AWS. The company is located close to the eu-central-1 Region. Because of regulations, the company cannot launch some of its applications in eu-central-1. The company wants to achieve single-digit millisecond latency. Which solution will meet these requirements?

   • ADeploy the applications in eu-central-1. Extend the company’s VPC from eu-central-1 to an edge location in Amazon CloudFront.
   • BDeploy the applications in AWS Local Zones by extending the company's VPC from eu-central-1 to the chosen Local Zone.
   • CDeploy the applications in eu-central-1. Extend the company’s VPC from eu-central-1 to the regional edge caches in Amazon CloudFront.
   • DDeploy the applications in AWS Wavelength Zones by extending the company’s VPC from eu-central-1 to the chosen Wavelength Zone.

   Show answer

   Answer: B

   Explanation

   "AWS Local Zones are a type of AWS infrastructure deployment that place compute, storage, database, and other select services closer to large population, industry, and IT centers, enabling you to deliver applications that require single-digit millisecond latency to end-users." A and C tell us to "deploy the applications in eu-central-1" which is exactly what we're not supposed to do. AWS Wavelength zones are AWS deployments in CSP's networks, has nothing to do with this question. https://aws.amazon.com/about-aws/global-infrastructure/localzones/features/?nc1=h_ls

   Source: Adapted from community discussion — pentium75

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 670 · 1017 in bank

    A company’s ecommerce website has unpredictable traffic and uses AWS Lambda functions to directly access a private Amazon RDS for PostgreSQL DB instance. The company wants to maintain predictable database performance and ensure that the Lambda invocations do not overload the database with too many connections. What should a solutions architect do to meet these requirements?

    • APoint the client driver at an RDS custom endpoint. Deploy the Lambda functions inside a VPC.
    • BPoint the client driver at an RDS proxy endpoint. Deploy the Lambda functions inside a VPC.
    • CPoint the client driver at an RDS custom endpoint. Deploy the Lambda functions outside a VPC.
    • DPoint the client driver at an RDS proxy endpoint. Deploy the Lambda functions outside a VPC.

    Show answer

    Answer: B

    Explanation

    Option B. Reduce number of connection to RDS -> RDS Proxy. "A Lambda function that's outside of a VPC can't access an RDS instance that's inside a VPC." https://repost.aws/knowledge-center/connect-lambda-to-an-rds-instance

    Source: Adapted from community discussion — ogerber

    References

    • repost.aws documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 661. 1017 questions available.