SAA-C03 practice questions 821–830

1. Question 821 · 1017 in bank

   A company is migrating a legacy application from an on-premises data center to AWS. The application relies on hundreds of cron jobs that run between 1 and 20 minutes on different recurring schedules throughout the day. The company wants a solution to schedule and run the cron jobs on AWS with minimal refactoring. The solution must support running the cron jobs in response to an event in the future. Which solution will meet these requirements?

   • ACreate a container image for the cron jobs. Use Amazon EventBridge Scheduler to create a recurring schedule. Run the cron job tasks as AWS Lambda functions.
   • BCreate a container image for the cron jobs. Use AWS Batch on Amazon Elastic Container Service (Amazon ECS) with a scheduling policy to run the cron jobs.
   • CCreate a container image for the cron jobs. Use Amazon EventBridge Scheduler to create a recurring schedule. Run the cron job tasks on AWS Fargate.
   • DCreate a container image for the cron jobs. Create a workflow in AWS Step Functions that uses a Wait state to run the cron jobs at a specified time. Use the RunTask action to run the cron job tasks on AWS Fargate.

   Show answer

   Answer: C

   Explanation

   Lambda has 15 mins limit, so A is out. B works, but you have to run highly-available virtual machines or containers waiting for the event to happen. C is the best answer in this question, with AWS Fargate allows you to pay for only what you use and free you from provisioning, configuring, and scaling clusters of Amazon EC2 instances. https://aws.amazon.com/blogs/containers/migrate-cron-jobs-to-event-driven-architectures-using-amazon-elastic-container-service-and-amazon-eventbridge/

   Source: Adapted from community discussion — Linuslin

   References

   • AWS documentation

   Next question

2. Question 822 · 1017 in bank

   A company uses Salesforce. The company needs to load existing data and ongoing data changes from Salesforce to Amazon Redshift for analysis. The company does not want the data to travel over the public internet. Which solution will meet these requirements with the LEAST development effort?

   • AEstablish a VPN connection from the VPC to Salesforce. Use AWS Glue DataBrew to transfer data.
   • BEstablish an AWS Direct Connect connection from the VPC to Salesforce. Use AWS Glue DataBrew to transfer data.
   • CCreate an AWS PrivateLink connection in the VPC to Salesforce. Use Amazon AppFlow to transfer data.
   • DCreate a VPC peering connection to Salesforce. Use Amazon AppFlow to transfer data.

   Show answer

   Answer: C

   Explanation

   AnswerC To connect your own VPC with third-party VPC we need to use ProvateLink. AWS PrivateLink is a highly available, scalable technology that you can use to privately connect your VPC to services as if they were in your VPC. You do not need to use an internet gateway, NAT device, public IP address, AWS Direct Connect connection, or AWS Site-to-Site VPN connection to allow communication with the service from your private subnets. Therefore, you control the specific API endpoints, sites, and services that are reachable from your VPC. https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 823 · 1017 in bank

   A company recently migrated its application to AWS. The application runs on Amazon EC2 Linux instances in an Auto Scaling group across multiple Availability Zones. The application stores data in an Amazon Elastic File System (Amazon EFS) file system that uses EFS Standard-Infrequent Access storage. The application indexes the company's files. The index is stored in an Amazon RDS database. The company needs to optimize storage costs with some application and services changes. Which solution will meet these requirements MOST cost-effectively?

   • ACreate an Amazon S3 bucket that uses an Intelligent-Tiering lifecycle policy. Copy all files to the S3 bucket. Update the application to use Amazon S3 API to store and retrieve files.
   • BDeploy Amazon FSx for Windows File Server file shares. Update the application to use CIFS protocol to store and retrieve files.
   • CDeploy Amazon FSx for OpenZFS file system shares. Update the application to use the new mount point to store and retrieve files.
   • DCreate an Amazon S3 bucket that uses S3 Glacier Flexible Retrieval. Copy all files to the S3 bucket. Update the application to use Amazon S3 API to store and retrieve files as standard retrievals.

   Show answer

   Answer: A

   Explanation

   B, C, D off. B - Windows C - OpenZFS Costs ~ NFS Costs *3 (optimized mainly for high-performance Data analysis) D - Glacier Standard retrieval: 12 Hrs

   Source: Adapted from community discussion — sandordini

   References

   • AWS documentation

   Next question

4. Question 824 · 1017 in bank

   A robotics company is designing a solution for medical surgery. The robots will use advanced sensors, cameras, and AI algorithms to perceive their environment and to complete surgeries. The company needs a public load balancer in the AWS Cloud that will ensure seamless communication with backend services. The load balancer must be capable of routing traffic based on the query strings to different target groups. The traffic must also be encrypted. Which solution will meet these requirements?

   • AUse a Network Load Balancer with a certificate attached from AWS Certificate Manager (ACM). Use query parameter-based routing.
   • BUse a Gateway Load Balancer. Import a generated certificate in AWS Identity and Access Management (IAM). Attach the certificate to the load balancer. Use HTTP path-based routing.
   • CUse an Application Load Balancer with a certificate attached from AWS Certificate Manager (ACM). Use query parameter-based routing.
   • DUse a Network Load Balancer. Import a generated certificate in AWS Identity and Access Management (IAM). Attach the certificate to the load balancer. Use query parameter-based routing.

   Show answer

   Answer: C

   Explanation

   AnswerC I was thinking that it will be network LB but after checks it occurs that only Application LB is able to redirect/forward traffic based on query string. and for encrypted traffic ACM is needed We recommend that you create certificates for your load balancer using AWS Certificate Manager (ACM). ACM supports RSA certificates with 2048, 3072, and 4096-bit key lengths, and all ECDSA certificates. ACM integrates with Elastic Load Balancing so that you can deploy the certificate on your load balancer. For more information, see the AWS Certificate Manager User Guide. https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#rule-condition-types https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 825 · 1017 in bank

   A company has an application that runs on a single Amazon EC2 instance. The application uses a MySQL database that runs on the same EC2 instance. The company needs a highly available and automatically scalable solution to handle increased traffic. Which solution will meet these requirements?

   • ADeploy the application to EC2 instances that run in an Auto Scaling group behind an Application Load Balancer. Create an Amazon Redshift cluster that has multiple MySQL-compatible nodes.
   • BDeploy the application to EC2 instances that are configured as a target group behind an Application Load Balancer. Create an Amazon RDS for MySQL cluster that has multiple instances.
   • CDeploy the application to EC2 instances that run in an Auto Scaling group behind an Application Load Balancer. Create an Amazon Aurora Serverless MySQL cluster for the database layer.
   • DDeploy the application to EC2 instances that are configured as a target group behind an Application Load Balancer. Create an Amazon ElastiCache for Redis cluster that uses the MySQL connector.

   Show answer

   Answer: C

   Explanation

   Target groups are just a group of Ec2 instances. Target groups are closely associated with ELB and not ASG. We can just use ELB and Target groups to route requests to EC2 instances. With this setup, there is no autoscaling which means instances cannot be added or removed when your load increases/decreases.

   Source: Adapted from community discussion — haci

   Next question

6. Question 826 · 1017 in bank

   A company is planning to migrate data to an Amazon S3 bucket. The data must be encrypted at rest within the S3 bucket. The encryption key must be rotated automatically every year. Which solution will meet these requirements with the LEAST operational overhead?

   • AMigrate the data to the S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use the built-in key rotation behavior of SSE-S3 encryption keys.
   • BCreate an AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket.
   • CCreate an AWS Key Management Service (AWS KMS) customer managed key. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket. Manually rotate the KMS key every year.
   • DUse customer key material to encrypt the data. Migrate the data to the S3 bucket. Create an AWS Key Management Service (AWS KMS) key without key material. Import the customer key material into the KMS key. Enable automatic key rotation.

   Show answer

   Answer: B

   Explanation

   AnswerB Looks like key rotation is only possible when KMS is in use. If we will use AWS managed keys Rotation is forced and if we will not provide any specifications regarding rotation time for key, KMS will rotate key every 365days. https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-mgmt

   Source: Adapted from community discussion — Scheldon

   References

   • repost.aws documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 827 · 1017 in bank

   A company is migrating applications from an on-premises Microsoft Active Directory that the company manages to AWS. The company deploys the applications in multiple AWS accounts. The company uses AWS Organizations to manage the accounts centrally. The company's security team needs a single sign-on solution across all the company's AWS accounts. The company must continue to manage users and groups that are in the on-premises Active Directory. Which solution will meet these requirements?

   • ACreate an Enterprise Edition Active Directory in AWS Directory Service for Microsoft Active Directory. Configure the Active Directory to be the identity source for AWS IAM Identity Center.
   • BEnable AWS IAM Identity Center. Configure a two-way forest trust relationship to connect the company's self-managed Active Directory with IAM Identity Center by using AWS Directory Service for Microsoft Active Directory.
   • CUse AWS Directory Service and create a two-way trust relationship with the company's self-managed Active Directory.
   • DDeploy an identity provider (IdP) on Amazon EC2. Link the IdP as an identity source within AWS IAM Identity Center.

   Show answer

   Answer: B

   Explanation

   AnswerB AWS Directory Service lets you run Microsoft Active Directory (AD) as a managed service. AWS Directory Service for Microsoft Active Directory, also referred to as AWS Managed Microsoft AD, is powered by Windows Server 2019. With AWS Managed Microsoft AD, you can run directory-aware workloads in the AWS Cloud, including Microsoft SharePoint and custom .NET and SQL Server-based applications. You can also configure a trust relationship between AWS Managed Microsoft AD in the AWS Cloud and your existing on-premises Microsoft Active Directory, providing users and groups with access to resources in either domain, using AWS IAM Identity Center. https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 828 · 1017 in bank

   A company is planning to deploy its application on an Amazon Aurora PostgreSQL Serverless v2 cluster. The application will receive large amounts of traffic. The company wants to optimize the storage performance of the cluster as the load on the application increases. Which solution will meet these requirements MOST cost-effectively?

   • AConfigure the cluster to use the Aurora Standard storage configuration.
   • BConfigure the cluster storage type as Provisioned IOPS.
   • CConfigure the cluster storage type as General Purpose.
   • DConfigure the cluster to use the Aurora I/O-Optimized storage configuration.

   Show answer

   Answer: D

   Explanation

   AnswerD For Aurora we have 2 storage type/options: A - Standard B -- I/O-Optimized hence answers B and C options are incorrect. Because customer inform us that there will be a big amount of traffic for their application I would go with I/O-Optimized. Maybe we are giving more $$ per GB-month but we are not paing for I/O operations/request. https://aws.amazon.com/rds/aurora/pricing/ In general question is not precise and it is hard to say which option will be more beneficial (cost effective)

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 829 · 1017 in bank

   A financial services company that runs on AWS has designed its security controls to meet industry standards. The industry standards include the National Institute of Standards and Technology (NIST) and the Payment Card Industry Data Security Standard (PCI DSS). The company's third-party auditors need proof that the designed controls have been implemented and are functioning correctly. The company has hundreds of AWS accounts in a single organization in AWS Organizations. The company needs to monitor the current state of the controls across accounts. Which solution will meet these requirements?

   • ADesignate one account as the Amazon Inspector delegated administrator account from the Organizations management account. Integrate Inspector with Organizations to discover and scan resources across all AWS accounts. Enable Inspector industry standards for NIST and PCI DSS.
   • BDesignate one account as the Amazon GuardDuty delegated administrator account from the Organizations management account. In the designated GuardDuty administrator account, enable GuardDuty to protect all member accounts. Enable GuardDuty industry standards for NIST and PCI DSS.
   • CConfigure an AWS CloudTrail organization trail in the Organizations management account. Designate one account as the compliance account. Enable CloudTrail security standards for NIST and PCI DSS in the compliance account.
   • DDesignate one account as the AWS Security Hub delegated administrator account from the Organizations management account. In the designated Security Hub administrator account, enable Security Hub for all member accounts. Enable Security Hub standards for NIST and PCI DSS.

   Show answer

   Answer: D

   References

   • AWS documentation

   Next question

10. Question 830 · 1017 in bank

    A company uses an Amazon S3 bucket as its data lake storage platform. The S3 bucket contains a massive amount of data that is accessed randomly by multiple teams and hundreds of applications. The company wants to reduce the S3 storage costs and provide immediate availability for frequently accessed objects. What is the MOST operationally efficient solution that meets these requirements?

    • ACreate an S3 Lifecycle rule to transition objects to the S3 Intelligent-Tiering storage class.
    • BStore objects in Amazon S3 Glacier. Use S3 Select to provide applications with access to the data.
    • CUse data from S3 storage class analysis to create S3 Lifecycle rules to automatically transition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class.
    • DTransition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Create an AWS Lambda function to transition objects to the S3 Standard storage class when they are accessed by an application.

    Show answer

    Answer: A

    Explanation

    AnswerA The Amazon S3 Intelligent-Tiering storage class automatically stores objects in three access tiers. One tier is optimized for frequent access, one lower-cost tier is optimized for infrequent access, and another very low-cost tier is optimized for rarely accessed data. For a low monthly object monitoring and automation charge, S3 Intelligent-Tiering monitors access patterns and automatically moves objects to the Infrequent Access tier when they haven't been accessed for 30 consecutive days. After 90 days of no access, the objects are moved to the Archive Instant Access tier without performance impact or operational overhead. https://docs.aws.amazon.com/AmazonS3/latest/userguide/intelligent-tiering-overview.html

    Source: Adapted from community discussion — Scheldon

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 821. 1017 questions available.