SAA-C03 practice questions 731–740

1. Question 731 · 1017 in bank

   Select 2

   A solutions architect is designing a two-tier web application. The application consists of a public-facing web tier hosted on Amazon EC2 in public subnets. The database tier consists of Microsoft SQL Server running on Amazon EC2 in a private subnet. Security is a high priority for the company. How should security groups be configured in this situation? (Choose two.)

   • AConfigure the security group for the web tier to allow inbound traffic on port 443 from 0.0.0.0/0.
   • BConfigure the security group for the web tier to allow outbound traffic on port 443 from 0.0.0.0/0.
   • CConfigure the security group for the database tier to allow inbound traffic on port 1433 from the security group for the web tier.
   • DConfigure the security group for the database tier to allow outbound traffic on ports 443 and 1433 to the security group for the web tier.
   • EConfigure the security group for the database tier to allow inbound traffic on ports 443 and 1433 from the security group for the web tier.

   Show answer

   Answer: AC

   Explanation

   Web Server Rules: Inbound traffic from 443 (HTTPS) Source 0.0.0.0/0 - Allows inbound HTTPS access from any IPv4 address Database Rules : 1433 (MS SQL)The default port to access a Microsoft SQL Server database, for example, on an Amazon RDS instance https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html

   Source: Adapted from community discussion — Athena

   References

   • AWS documentation

   Next question

2. Question 732 · 1017 in bank

   A company migrated millions of archival files to Amazon S3. A solutions architect needs to implement a solution that will encrypt all the archival data by using a customer-provided key. The solution must encrypt existing unencrypted objects and future objects. Which solution will meet these requirements?

   • ACreate a list of unencrypted objects by filtering an Amazon S3 Inventory report. Configure an S3 Batch Operations job to encrypt the objects from the list with a server-side encryption with a customer-provided key (SSE-C). Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C).
   • BUse S3 Storage Lens metrics to identify unencrypted S3 buckets. Configure the S3 default encryption feature to use a server-side encryption with AWS KMS keys (SSE-KMS).
   • CCreate a list of unencrypted objects by filtering the AWS usage report for Amazon S3. Configure an AWS Batch job to encrypt the objects from the list with a server-side encryption with AWS KMS keys (SSE-KMS). Configure the S3 default encryption feature to use a server-side encryption with AWS KMS keys (SSE-KMS).
   • DCreate a list of unencrypted objects by filtering the AWS usage report for Amazon S3. Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C).

   Show answer

   Answer: A

   Explanation

   S3 inventory list has "Encryption status" field so you can use this to filter the unencrypted objects. and use S3 batch to encrypt it with SSE-C key. AWS Usage report does not provide details about encryption status of individual objects

   Source: Adapted from community discussion — BillaRanga

   References

   • AWS documentation

   Next question

3. Question 733 · 1017 in bank

   The DNS provider that hosts a company's domain name records is experiencing outages that cause service disruption for a website running on AWS. The company needs to migrate to a more resilient managed DNS service and wants the service to run on AWS. What should a solutions architect do to rapidly migrate the DNS hosting service?

   • ACreate an Amazon Route 53 public hosted zone for the domain name. Import the zone file containing the domain records hosted by the previous provider.
   • BCreate an Amazon Route 53 private hosted zone for the domain name. Import the zone file containing the domain records hosted by the previous provider.
   • CCreate a Simple AD directory in AWS. Enable zone transfer between the DNS provider and AWS Directory Service for Microsoft Active Directory for the domain records.
   • DCreate an Amazon Route 53 Resolver inbound endpoint in the VPC. Specify the IP addresses that the provider's DNS will forward DNS queries to. Configure the provider's DNS to forward DNS queries for the domain to the IP addresses that are specified in the inbound endpoint.

   Show answer

   Answer: A

   Explanation

   A -> Correct as we need to route to a Company in public network. B -> No, because it routes only within one or more VPC C -> Added as a distractor D -> Inbound resolver is for traffic from On-Prem to VPC

   Source: Adapted from community discussion — BillaRanga

   References

   • AWS documentation

   Next question

4. Question 734 · 1017 in bank

   A company is building an application on AWS that connects to an Amazon RDS database. The company wants to manage the application configuration and to securely store and retrieve credentials for the database and other services. Which solution will meet these requirements with the LEAST administrative overhead?

   • AUse AWS AppConfig to store and manage the application configuration. Use AWS Secrets Manager to store and retrieve the credentials.
   • BUse AWS Lambda to store and manage the application configuration. Use AWS Systems Manager Parameter Store to store and retrieve the credentials.
   • CUse an encrypted application configuration file. Store the file in Amazon S3 for the application configuration. Create another S3 file to store and retrieve the credentials.
   • DUse AWS AppConfig to store and manage the application configuration. Use Amazon RDS to store and retrieve the credentials.

   Show answer

   Answer: A

   Explanation

   AppConfig useCase = You can use AWS AppConfig to deploy configuration data stored in the AWS AppConfig hosted configuration store, AWS Secrets Manager, Systems Manager Parameter Store, or Amazon S3. So B and C are out. use RDS to store credentials is not a good practise. So D is out. Ans is A

   Source: Adapted from community discussion — BillaRanga

   Next question

5. Question 735 · 1017 in bank

   To meet security requirements, a company needs to encrypt all of its application data in transit while communicating with an Amazon RDS MySQL DB instance. A recent security audit revealed that encryption at rest is enabled using AWS Key Management Service (AWS KMS), but data in transit is not enabled. What should a solutions architect do to satisfy the security requirements?

   • AEnable IAM database authentication on the database.
   • BProvide self-signed certificates. Use the certificates in all connections to the RDS instance.
   • CTake a snapshot of the RDS instance. Restore the snapshot to a new instance with encryption enabled.
   • DDownload AWS-provided root certificates. Provide the certificates in all connections to the RDS instance.

   Show answer

   Answer: D

   Explanation

   Amazon RDS creates an SSL certificate and installs the certificate on the DB instance when the instance is provisioned. So it is AWS provided.

   Source: Adapted from community discussion — BillaRanga

   References

   • AWS documentation

   Next question

6. Question 736 · 1017 in bank

   A company is designing a new web service that will run on Amazon EC2 instances behind an Elastic Load Balancing (ELB) load balancer. However, many of the web service clients can only reach IP addresses authorized on their firewalls. What should a solutions architect recommend to meet the clients’ needs?

   • AA Network Load Balancer with an associated Elastic IP address.
   • BAn Application Load Balancer with an associated Elastic IP address.
   • CAn A record in an Amazon Route 53 hosted zone pointing to an Elastic IP address.
   • DAn EC2 instance with a public IP address running as a proxy in front of the load balancer.

   Show answer

   Answer: A

   Explanation

   A for sure. The same question was in "AWS Certified Solutions Architect Associate Practice Test 3" on Udemy. There was an explaination that NLB needs to be before ALB because only NLB can have static IP.

   Source: Adapted from community discussion — 67a3f49

   References

   • AWS documentation

   Next question

7. Question 737 · 1017 in bank

   A company has established a new AWS account. The account is newly provisioned and no changes have been made to the default settings. The company is concerned about the security of the AWS account root user. What should be done to secure the root user?

   • ACreate IAM users for daily administrative tasks. Disable the root user.
   • BCreate IAM users for daily administrative tasks. Enable multi-factor authentication on the root user.
   • CGenerate an access key for the root user. Use the access key for daily administration tasks instead of the AWS Management Console.
   • DProvide the root user credentials to the most senior solutions architect. Have the solutions architect use the root user for daily administration tasks.

   Show answer

   Answer: B

   Explanation

   "As a best practice, do not use the AWS account root user for any task where it's not required. Instead, create a new IAM user for each person that requires administrator access." It's B :)

   Source: Adapted from community discussion — BillaRanga

   Next question

8. Question 738 · 1017 in bank

   Select 2

   A company is deploying an application that processes streaming data in near-real time. The company plans to use Amazon EC2 instances for the workload. The network architecture must be configurable to provide the lowest possible latency between nodes. Which combination of network solutions will meet these requirements? (Choose two.)

   • AEnable and configure enhanced networking on each EC2 instance.
   • BGroup the EC2 instances in separate accounts.
   • CRun the EC2 instances in a cluster placement group.
   • DAttach multiple elastic network interfaces to each EC2 instance.
   • EUse Amazon Elastic Block Store (Amazon EBS) optimized instance types.

   Show answer

   Answer: AC

   Explanation

   A. Enable and configure enhanced networking on each EC2 instance. Enhanced networking provides higher bandwidth, higher packet per second (PPS) performance, and consistently lower inter-instance latencies. C. Run the EC2 instances in a cluster placement group. A cluster placement group is a logical grouping of instances within a single Availability Zone. This configuration is recommended for applications that need low network latency, high network throughput, or both.

   Source: Adapted from community discussion — mestule

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 739 · 1017 in bank

   A financial services company wants to shut down two data centers and migrate more than 100 TB of data to AWS. The data has an intricate directory structure with millions of small files stored in deep hierarchies of subfolders. Most of the data is unstructured, and the company’s file storage consists of SMB-based storage types from multiple vendors. The company does not want to change its applications to access the data after migration. What should a solutions architect do to meet these requirements with the LEAST operational overhead?

   • AUse AWS Direct Connect to migrate the data to Amazon S3.
   • BUse AWS DataSync to migrate the data to Amazon FSx for Lustre.
   • CUse AWS DataSync to migrate the data to Amazon FSx for Windows File Server.
   • DUse AWS Direct Connect to migrate the data on-premises file storage to an AWS Storage Gateway volume gateway.

   Show answer

   Answer: C

   Explanation

   AWS DataSync is a data transfer service that simplifies, automates, and accelerates moving and replicating data between on-premises storage systems and AWS storage services over the internet or AWS Direct Connect. DataSync can transfer your file data, and also file system metadata such as ownership, time stamps, and access permissions. In DataSync, a location for Amazon FSx for Windows is an endpoint for an FSx for Windows File Server. You can transfer files between a location for Amazon FSx for Windows and a location for other file systems. For information, see Working with Locations in the AWS DataSync User Guide. DataSync accesses your FSx for Windows File Server using the Server Message Block (SMB) protocol.

   Source: Adapted from community discussion — Sivaeas

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 740 · 1017 in bank

    A company uses an organization in AWS Organizations to manage AWS accounts that contain applications. The company sets up a dedicated monitoring member account in the organization. The company wants to query and visualize observability data across the accounts by using Amazon CloudWatch. Which solution will meet these requirements?

    • AEnable CloudWatch cross-account observability for the monitoring account. Deploy an AWS CloudFormation template provided by the monitoring account in each AWS account to share the data with the monitoring account.
    • BSet up service control policies (SCPs) to provide access to CloudWatch in the monitoring account under the Organizations root organizational unit (OU).
    • CConfigure a new IAM user in the monitoring account. In each AWS account, configure an IAM policy to have access to query and visualize the CloudWatch data in the account. Attach the new IAM policy to the new IAM user.
    • DCreate a new IAM user in the monitoring account. Create cross-account IAM policies in each AWS account. Attach the IAM policies to the new IAM user.

    Show answer

    Answer: A

    Explanation

    "If you have multiple Amazon accounts, you can set up CloudWatch cross-account observability and then create rich cross-account dashboards in your monitoring accounts. You can seamlessly search, visualize, and analyze your metrics, logs, and traces without account boundaries." Nice catch!

    Source: Adapted from community discussion — MatAlves

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 731. 1017 questions available.