SAA-C03 practice questions 741–750

1. Question 741 · 1017 in bank

   A company’s website is used to sell products to the public. The site runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). There is also an Amazon CloudFront distribution, and AWS WAF is being used to protect against SQL injection attacks. The ALB is the origin for the CloudFront distribution. A recent review of security logs revealed an external malicious IP that needs to be blocked from accessing the website. What should a solutions architect do to protect the application?

   • AModify the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address.
   • BModify the configuration of AWS WAF to add an IP match condition to block the malicious IP address.
   • CModify the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.
   • DModify the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.

   Show answer

   Answer: B

   Explanation

   There was option from disttribution Security Tab ==> Request logs for the specified time range where someone could target an IP address and block it - which action won't do more than creating a block rule under the associated Web ACL- but function has vanished, i don't ask me why. So the only feasable option in WEBACLv2 is to go for an Ipset and ad a WebACL ip match block condition. I really liked the option A the first time i experimented it.

   Source: Adapted from community discussion — bujuman

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 742 · 1017 in bank

   A company wants to move a multi-tiered application from on premises to the AWS Cloud to improve the application's performance. The application consists of application tiers that communicate with each other by way of RESTful services. Transactions are dropped when one tier becomes overloaded. A solutions architect must design a solution that resolves these issues and modernizes the application. Which solution meets these requirements and is the MOST operationally efficient?

   • AUse Amazon API Gateway and direct transactions to the AWS Lambda functions as the application layer. Use Amazon Simple Queue Service (Amazon SQS) as the communication layer between application services.
   • BUse Amazon CloudWatch metrics to analyze the application performance history to determine the servers' peak utilization during the performance failures. Increase the size of the application server's Amazon EC2 instances to meet the peak requirements.
   • CUse Amazon Simple Notification Service (Amazon SNS) to handle the messaging between application servers running on Amazon EC2 in an Auto Scaling group. Use Amazon CloudWatch to monitor the SNS queue length and scale up and down as required.
   • DUse Amazon Simple Queue Service (Amazon SQS) to handle the messaging between application servers running on Amazon EC2 in an Auto Scaling group. Use Amazon CloudWatch to monitor the SQS queue length and scale up when communication failures are detected.

   Show answer

   Answer: A

   Explanation

   The catch phrase is "scale up when communication failures are detected" Scaling should not be based on communication failures, that'll be crying over spilled milk ! or rather too late. So D is wrong.

   Source: Adapted from community discussion — LuckyAro

   References

   • AWS documentation

   Next question

3. Question 743 · 1017 in bank

   A company sets up an organization in AWS Organizations that contains 10 AWS accounts. A solutions architect must design a solution to provide access to the accounts for several thousand employees. The company has an existing identity provider (IdP). The company wants to use the existing IdP for authentication to AWS. Which solution will meet these requirements?

   • ACreate IAM users for the employees in the required AWS accounts. Connect IAM users to the existing IdP. Configure federated authentication for the IAM users.
   • BSet up AWS account root users with user email addresses and passwords that are synchronized from the existing IdP.
   • CConfigure AWS IAM Identity Center (AWS Single Sign-On). Connect IAM Identity Center to the existing IdP. Provision users and groups from the existing IdP.
   • DUse AWS Resource Access Manager (AWS RAM) to share access to the AWS accounts with the users in the existing IdP.

   Show answer

   Answer: C

   Explanation

   c--> Regardless of how you provision users, IAM Identity Center redirects the AWS Management Console, command line interface, and application authentication to your external IdP. IAM Identity Center then grants access to those resources based on policies you create in IAM Identity Center https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-idp.html#provisioning-when-external-idp

   Source: Adapted from community discussion — osmk

   References

   • AWS documentation

   Next question

4. Question 744 · 1017 in bank

   A solutions architect is designing an AWS Identity and Access Management (IAM) authorization model for a company's AWS account. The company has designated five specific employees to have full access to AWS services and resources in the AWS account. The solutions architect has created an IAM user for each of the five designated employees and has created an IAM user group. Which solution will meet these requirements?

   • AAttach the AdministratorAccess resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
   • BAttach the SystemAdministrator identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
   • CAttach the AdministratorAccess identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
   • DAttach the SystemAdministrator resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.

   Show answer

   Answer: C

   Explanation

   AnswerC We need identity-based policy and if we will compare System Admin and Administrator Access policy it clear that SysAdmin have is allowing for limited amount of actions, where Admin Access simple allow for all actions. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SystemAdministrator.html

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 745 · 1017 in bank

   Select 2

   A company has a multi-tier payment processing application that is based on virtual machines (VMs). The communication between the tiers occurs asynchronously through a third-party middleware solution that guarantees exactly-once delivery. The company needs a solution that requires the least amount of infrastructure management. The solution must guarantee exactly-once delivery for application messaging. Which combination of actions will meet these requirements? (Choose two.)

   • AUse AWS Lambda for the compute layers in the architecture.
   • BUse Amazon EC2 instances for the compute layers in the architecture.
   • CUse Amazon Simple Notification Service (Amazon SNS) as the messaging component between the compute layers.
   • DUse Amazon Simple Queue Service (Amazon SQS) FIFO queues as the messaging component between the compute layers.
   • EUse containers that are based on Amazon Elastic Kubernetes Service (Amazon EKS) for the compute layers in the architecture.

   Show answer

   Answer: AD

   Explanation

   AnswerAD, SQS FIFO will guarantee exactly one time execution for each operation. The problem is with processing as we do not know if whole process will be closed in 15 min (TTL for Lambda). I'm choosing Lambda as it is natural thing for Payment procesing in AWS but I'm not 100% sure

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation

   Next question

6. Question 746 · 1017 in bank

   A company has a nightly batch processing routine that analyzes report files that an on-premises file system receives daily through SFTP. The company wants to move the solution to the AWS Cloud. The solution must be highly available and resilient. The solution also must minimize operational effort. Which solution meets these requirements?

   • ADeploy AWS Transfer for SFTP and an Amazon Elastic File System (Amazon EFS) file system for storage. Use an Amazon EC2 instance in an Auto Scaling group with a scheduled scaling policy to run the batch operation.
   • BDeploy an Amazon EC2 instance that runs Linux and an SFTP service. Use an Amazon Elastic Block Store (Amazon EBS) volume for storage. Use an Auto Scaling group with the minimum number of instances and desired number of instances set to 1.
   • CDeploy an Amazon EC2 instance that runs Linux and an SFTP service. Use an Amazon Elastic File System (Amazon EFS) file system for storage. Use an Auto Scaling group with the minimum number of instances and desired number of instances set to 1.
   • DDeploy AWS Transfer for SFTP and an Amazon S3 bucket for storage. Modify the application to pull the batch files from Amazon S3 to an Amazon EC2 instance for processing. Use an EC2 instance in an Auto Scaling group with a scheduled scaling policy to run the batch operation.

   Show answer

   Answer: A

   Explanation

   The Answer should be A not D because ... Modify the application to pull the batch files from Amazon S3 to an Amazon EC2 instance for processing.--Why we need to do this when we can move the file directly to EFS in EC2 system AWS Transfer Family now also supports file transfers to Amazon Elastic File System (Amazon EFS) file systems as well as Amazon S3.

   Source: Adapted from community discussion — Sivaeas

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 747 · 1017 in bank

   A company has users all around the world accessing its HTTP-based application deployed on Amazon EC2 instances in multiple AWS Regions. The company wants to improve the availability and performance of the application. The company also wants to protect the application against common web exploits that may affect availability, compromise security, or consume excessive resources. Static IP addresses are required. What should a solutions architect recommend to accomplish this?

   • APut the EC2 instances behind Network Load Balancers (NLBs) in each Region. Deploy AWS WAF on the NLBs. Create an accelerator using AWS Global Accelerator and register the NLBs as endpoints.
   • BPut the EC2 instances behind Application Load Balancers (ALBs) in each Region. Deploy AWS WAF on the ALBs. Create an accelerator using AWS Global Accelerator and register the ALBs as endpoints.
   • CPut the EC2 instances behind Network Load Balancers (NLBs) in each Region. Deploy AWS WAF on the NLBs. Create an Amazon CloudFront distribution with an origin that uses Amazon Route 53 latency-based routing to route requests to the NLBs.
   • DPut the EC2 instances behind Application Load Balancers (ALBs) in each Region. Create an Amazon CloudFront distribution with an origin that uses Amazon Route 53 latency-based routing to route requests to the ALBs. Deploy AWS WAF on the CloudFront distribution.

   Show answer

   Answer: B

   Explanation

   HTTP based application so ALB is required. because static IP addresses are required, we should use global accelerator: "By default, Global Accelerator provides you with static IP addresses that you associate with your accelerator."

   Source: Adapted from community discussion — ogerber

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 748 · 1017 in bank

   A company’s data platform uses an Amazon Aurora MySQL database. The database has multiple read replicas and multiple DB instances across different Availability Zones. Users have recently reported errors from the database that indicate that there are too many connections. The company wants to reduce the failover time by 20% when a read replica is promoted to primary writer. Which solution will meet this requirement?

   • ASwitch from Aurora to Amazon RDS with Multi-AZ cluster deployment.
   • BUse Amazon RDS Proxy in front of the Aurora database.
   • CSwitch to Amazon DynamoDB with DynamoDB Accelerator (DAX) for read connections.
   • DSwitch to Amazon Redshift with relocation capability.

   Show answer

   Answer: B

   Explanation

   By using Amazon RDS Proxy, your applications can pool and share database connections. This pooling improves scalability by allowing multiple application instances to reuse existing connections. It also makes your applications more resilient to database failures. When a primary database instance fails, RDS Proxy automatically connects to a standby DB instance while preserving application connections. =>https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-proxy.html

   Source: Adapted from community discussion — osmk

   References

   • AWS documentation

   Next question

9. Question 749 · 1017 in bank

   A company stores text files in Amazon S3. The text files include customer chat messages, date and time information, and customer personally identifiable information (PII). The company needs a solution to provide samples of the conversations to an external service provider for quality control. The external service provider needs to randomly pick sample conversations up to the most recent conversation. The company must not share the customer PII with the external service provider. The solution must scale when the number of customer conversations increases. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate an Object Lambda Access Point. Create an AWS Lambda function that redacts the PII when the function reads the file. Instruct the external service provider to access the Object Lambda Access Point.
   • BCreate a batch process on an Amazon EC2 instance that regularly reads all new files, redacts the PII from the files, and writes the redacted files to a different S3 bucket. Instruct the external service provider to access the bucket that does not contain the PII. B. Create a web application on an Amazon EC2 instance that presents a list of the files, redacts the PII from the files, and allows the external service provider to download new versions of the files that have the PII redacted.
   • CCreate an Amazon DynamoDB table. Create an AWS Lambda function that reads only the data in the files that does not contain PII. Configure the Lambda function to store the non-PII data in the DynamoDB table when a new file is written to Amazon S3. Grant the external service provider access to the DynamoDB table.

   Show answer

   Answer: A

   Explanation

   Use AWS Lambda functions to change the Object before it is retrieved by the caller application. Only one S3 bucket is needed, on top of which we create S3 Access Point And S3 Object Lambda Access Points Use case: 1. Redact PII for analytics or non-production environment 2. Convert across data formats ex: XML to Json 3. Resizing and watermaking images on fly using caller-specific details ex: user who requested the object

   Source: Adapted from community discussion — trinh_le

   References

   • AWS documentation

   Next question

10. Question 750 · 1017 in bank

    A company is running a legacy system on an Amazon EC2 instance. The application code cannot be modified, and the system cannot run on more than one instance. A solutions architect must design a resilient solution that can improve the recovery time for the system. What should the solutions architect recommend to meet these requirements?

    • AEnable termination protection for the EC2 instance.
    • BConfigure the EC2 instance for Multi-AZ deployment.
    • CCreate an Amazon CloudWatch alarm to recover the EC2 instance in case of failure.
    • DLaunch the EC2 instance with two Amazon Elastic Block Store (Amazon EBS) volumes that use RAID configurations for storage redundancy.

    Show answer

    Answer: C

    Explanation

    A. Enable termination protection for the EC2 instance. No. Termination protection is about avoid accidentally delete the instance B. Configure the EC2 instance for Multi-AZ deployment. No. Question says "cannot run on more than one instance" C. Create an Amazon CloudWatch alarm to recover the EC2 instance in case of failure. Yes. CloudWatch can be used to recover the instance: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/UsingAlarmActions.html#AddingRecoverActions D. Launch the EC2 instance with two Amazon Elastic Block Store (Amazon EBS) volumes that use RAID configurations for storage redundancy. No. Raid could be helpful to increase resilience, but does not help with "improve the recovery time"

    Source: Adapted from community discussion — [Removed]

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 741. 1017 questions available.