SAA-C03 practice questions 781–790

1. Question 781 · 1017 in bank

   A solutions architect is designing a payment processing application that runs on AWS Lambda in private subnets across multiple Availability Zones. The application uses multiple Lambda functions and processes millions of transactions each day. The architecture must ensure that the application does not process duplicate payments. Which solution will meet these requirements?

   • AUse Lambda to retrieve all due payments. Publish the due payments to an Amazon S3 bucket. Configure the S3 bucket with an event notification to invoke another Lambda function to process the due payments.
   • BUse Lambda to retrieve all due payments. Publish the due payments to an Amazon Simple Queue Service (Amazon SQS) queue. Configure another Lambda function to poll the SQS queue and to process the due payments.
   • CUse Lambda to retrieve all due payments. Publish the due payments to an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Configure another Lambda function to poll the FIFO queue and to process the due payments.
   • DUse Lambda to retrieve all due payments. Store the due payments in an Amazon DynamoDB table. Configure streams on the DynamoDB table to invoke another Lambda function to process the due payments.

   Show answer

   Answer: C

   Explanation

   Standard queues provide at-least-once delivery, which means that each message is delivered at least once. FIFO queues provide exactly-once processing , which means that each message is delivered once and remains available until a consumer processes it and deletes it. Duplicates are not introduced into the queue. OPTION C

   Source: Adapted from community discussion — hajra313

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 782 · 1017 in bank

   A company runs multiple workloads in its on-premises data center. The company's data center cannot scale fast enough to meet the company's expanding business needs. The company wants to collect usage and configuration data about the on-premises servers and workloads to plan a migration to AWS. Which solution will meet these requirements?

   • ASet the home AWS Region in AWS Migration Hub. Use AWS Systems Manager to collect data about the on-premises servers.
   • BSet the home AWS Region in AWS Migration Hub. Use AWS Application Discovery Service to collect data about the on-premises servers.
   • CUse the AWS Schema Conversion Tool (AWS SCT) to create the relevant templates. Use AWS Trusted Advisor to collect data about the on-premises servers.
   • DUse the AWS Schema Conversion Tool (AWS SCT) to create the relevant templates. Use AWS Database Migration Service (AWS DMS) to collect data about the on-premises servers.

   Show answer

   Answer: B

   Explanation

   AnswerB AWS Migration Hub delivers a guided end-to-end migration and modernization journey through discovery, assessment, planning, and execution. https://aws.amazon.com/migration-hub/ AWS Application Discovery Service helps you plan your migration to the AWS cloud by collecting usage and configuration data about your on-premises servers and databases. Application Discovery Service is integrated with AWS Migration Hub and AWS Database Migration Service Fleet Advisor. https://docs.aws.amazon.com/application-discovery/latest/userguide/what-is-appdiscovery.html

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 783 · 1017 in bank

   A company has an organization in AWS Organizations that has all features enabled. The company requires that all API calls and logins in any existing or new AWS account must be audited. The company needs a managed solution to prevent additional work and to minimize costs. The company also needs to know when any AWS account is not compliant with the AWS Foundational Security Best Practices (FSBP) standard. Which solution will meet these requirements with the LEAST operational overhead?

   • ADeploy an AWS Control Tower environment in the Organizations management account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment.
   • BDeploy an AWS Control Tower environment in a dedicated Organizations member account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment.
   • CUse AWS Managed Services (AMS) Accelerate to build a multi-account landing zone (MALZ). Submit an RFC to self-service provision Amazon GuardDuty in the MALZ.
   • DUse AWS Managed Services (AMS) Accelerate to build a multi-account landing zone (MALZ). Submit an RFC to self-service provision AWS Security Hub in the MALZ.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

4. Question 784 · 1017 in bank

   A company has stored 10 TB of log files in Apache Parquet format in an Amazon S3 bucket. The company occasionally needs to use SQL to analyze the log files. Which solution will meet these requirements MOST cost-effectively?

   • ACreate an Amazon Aurora MySQL database. Migrate the data from the S3 bucket into Aurora by using AWS Database Migration Service (AWS DMS). Issue SQL statements to the Aurora database.
   • BCreate an Amazon Redshift cluster. Use Redshift Spectrum to run SQL statements directly on the data in the S3 bucket.
   • CCreate an AWS Glue crawler to store and retrieve table metadata from the S3 bucket. Use Amazon Athena to run SQL statements directly on the data in the S3 bucket.
   • DCreate an Amazon EMR cluster. Use Apache Spark SQL to run SQL statements directly on the data in the S3 bucket.

   Show answer

   Answer: C

   Next question

5. Question 785 · 1017 in bank

   A company needs a solution to prevent AWS CloudFormation stacks from deploying AWS Identity and Access Management (IAM) resources that include an inline policy or “*” in the statement. The solution must also prohibit deployment of Amazon EC2 instances with public IP addresses. The company has AWS Control Tower enabled in its organization in AWS Organizations. Which solution will meet these requirements?

   • AUse AWS Control Tower proactive controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or “*”.
   • BUse AWS Control Tower detective controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or “*”.
   • CUse AWS Config to create rules for EC2 and IAM compliance. Configure the rules to run an AWS Systems Manager Session Manager automation to delete a resource when it is not compliant.
   • DUse a service control policy (SCP) to block actions for the EC2 instances and IAM resources if the actions lead to noncompliance.

   Show answer

   Answer: A

   Explanation

   Proactive controls are implemented using AWS CloudFormation hooks within AWS Control Tower. They operate before resources are deployed to determine compliance with activated controls. SCPs are part of AWS Organizations and are used to manage permissions. vs Define specific purposes for implementing controls.https://docs.aws.amazon.com/controltower/latest/userguide/proactive-controls.html

   Source: Adapted from community discussion — osmk

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 786 · 1017 in bank

   A company is planning to use an Amazon DynamoDB table for data storage. The company is concerned about cost optimization. The table will not be used on most mornings. In the evenings, the read and write traffic will often be unpredictable. When traffic spikes occur, they will happen very quickly. What should a solutions architect recommend?

   • ACreate a DynamoDB table in on-demand capacity mode.
   • BCreate a DynamoDB table with a global secondary index.
   • CCreate a DynamoDB table with provisioned capacity and auto scaling.
   • DCreate a DynamoDB table in provisioned capacity mode, and configure it as a global table.

   Show answer

   Answer: A

   Explanation

   On-demand mode is a good option if any of the following are true: - You create new tables with unknown workloads. - You have unpredictable application traffic. - You prefer the ease of paying for only what you use.

   Source: Adapted from community discussion — SimonPark

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 787 · 1017 in bank

   Select 2

   A company's web application that is hosted in the AWS Cloud recently increased in popularity. The web application currently exists on a single Amazon EC2 instance in a single public subnet. The web application has not been able to meet the demand of the increased web traffic. The company needs a solution that will provide high availability and scalability to meet the increased user demand without rewriting the web application. Which combination of steps will meet these requirements? (Choose two.)

   • AReplace the EC2 instance with a larger compute optimized instance.
   • BConfigure Amazon EC2 Auto Scaling with multiple Availability Zones in private subnets.
   • CConfigure a NAT gateway in a public subnet to handle web requests.
   • DReplace the EC2 instance with a larger memory optimized instance.
   • EConfigure an Application Load Balancer in a public subnet to distribute web traffic.

   Show answer

   Answer: BE

   Next question

8. Question 788 · 1017 in bank

   A company has AWS Lambda functions that use environment variables. The company does not want its developers to see environment variables in plaintext. Which solution will meet these requirements?

   • ADeploy code to Amazon EC2 instances instead of using Lambda functions.
   • BConfigure SSL encryption on the Lambda functions to use AWS CloudHSM to store and encrypt the environment variables.
   • CCreate a certificate in AWS Certificate Manager (ACM). Configure the Lambda functions to use the certificate to encrypt the environment variables.
   • DCreate an AWS Key Management Service (AWS KMS) key. Enable encryption helpers on the Lambda functions to use the KMS key to store and encrypt the environment variables.

   Show answer

   Answer: D

   Explanation

   "To configure encryption for your environment variables Enable console encryption helpers to use client-side encryption to protect your data in transit. Under Encryption in transit, choose Enable helpers for encryption in transit. For each environment variable that you want to enable console encryption helpers for, choose Encrypt next to the environment variable. Under AWS KMS key to encrypt in transit, choose a customer managed key that you created at the beginning of this procedure."

   Source: Adapted from community discussion — MatAlves

   References

   • AWS documentation

   Next question

9. Question 789 · 1017 in bank

   An analytics company uses Amazon VPC to run its multi-tier services. The company wants to use RESTful APIs to offer a web analytics service to millions of users. Users must be verified by using an authentication service to access the APIs. Which solution will meet these requirements with the MOST operational efficiency?

   • AConfigure an Amazon Cognito user pool for user authentication. Implement Amazon API Gateway REST APIs with a Cognito authorizer.
   • BConfigure an Amazon Cognito identity pool for user authentication. Implement Amazon API Gateway HTTP APIs with a Cognito authorizer.
   • CConfigure an AWS Lambda function to handle user authentication. Implement Amazon API Gateway REST APIs with a Lambda authorizer.
   • DConfigure an IAM user to handle user authentication. Implement Amazon API Gateway HTTP APIs with an IAM authorizer.

   Show answer

   Answer: A

   Explanation

   User pools are for authentication. Your app users can sign in through the user pool, Identity pools are for authorization, give them access to other AWS services.

   Source: Adapted from community discussion — sandordini

   References

   • repost.aws documentation

   Next question

10. Question 790 · 1017 in bank

    A company has a mobile app for customers. The app’s data is sensitive and must be encrypted at rest. The company uses AWS Key Management Service (AWS KMS). The company needs a solution that prevents the accidental deletion of KMS keys. The solution must use Amazon Simple Notification Service (Amazon SNS) to send an email notification to administrators when a user attempts to delete a KMS key. Which solution will meet these requirements with the LEAST operational overhead?

    • ACreate an Amazon EventBridge rule that reacts when a user tries to delete a KMS key. Configure an AWS Config rule that cancels any deletion of a KMS key. Add the AWS Config rule as a target of the EventBridge rule. Create an SNS topic that notifies the administrators.
    • BCreate an AWS Lambda function that has custom logic to prevent KMS key deletion. Create an Amazon CloudWatch alarm that is activated when a user tries to delete a KMS key. Create an Amazon EventBridge rule that invokes the Lambda function when the DeleteKey operation is performed. Create an SNS topic. Configure the EventBridge rule to publish an SNS message that notifies the administrators.
    • CCreate an Amazon EventBridge rule that reacts when the KMS DeleteKey operation is performed. Configure the rule to initiate an AWS Systems Manager Automation runbook. Configure the runbook to cancel the deletion of the KMS key. Create an SNS topic. Configure the EventBridge rule to publish an SNS message that notifies the administrators.
    • DCreate an AWS CloudTrail trail. Configure the trail to deliver logs to a new Amazon CloudWatch log group. Create a CloudWatch alarm based on the metric filter for the CloudWatch log group. Configure the alarm to use Amazon SNS to notify the administrators when the KMS DeleteKey operation is performed.

    Show answer

    Answer: C

    Explanation

    option c bcz Option C emerges as the clear winner due to its: Direct event monitoring for the DeleteKey operation Pre-built automation using Systems Manager Automation runbooks Efficient notification via Amazon SNS Minimal code development and operational overhead Reduced risk of accidental deletion with faster response times

    Source: Adapted from community discussion — hajra313

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 781. 1017 questions available.