SAA-C03 practice questions 851–860

1. Question 851 · 1017 in bank

   A company runs its application on Oracle Database Enterprise Edition. The company needs to migrate the application and the database to AWS. The company can use the Bring Your Own License (BYOL) model while migrating to AWS. The application uses third-party database features that require privileged access. A solutions architect must design a solution for the database migration. Which solution will meet these requirements MOST cost-effectively?

   • AMigrate the database to Amazon RDS for Oracle by using native tools. Replace the third-party features with AWS Lambda.
   • BMigrate the database to Amazon RDS Custom for Oracle by using native tools. Customize the new database settings to support the third-party features.
   • CMigrate the database to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS). Customize the new database settings to support the third-party features.
   • DMigrate the database to Amazon RDS for PostgreSQL by using AWS Database Migration Service (AWS DMS). Rewrite the application code to remove the dependency on third-party features.

   Show answer

   Answer: B

   Explanation

   AnswerB BYOL + third-party features/applications = RDS Custom. Hence customer is using Oracle so we should use RDS customer for Oracle https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-custom.html https://aws.amazon.com/blogs/aws/amazon-rds-custom-for-oracle-new-control-capabilities-in-database-environment/ https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/working-with-custom-oracle.html

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 852 · 1017 in bank

   A large international university has deployed all of its compute services in the AWS Cloud. These services include Amazon EC2, Amazon RDS, and Amazon DynamoDB. The university currently relies on many custom scripts to back up its infrastructure. However, the university wants to centralize management and automate data backups as much as possible by using AWS native options. Which solution will meet these requirements?

   • AUse third-party backup software with an AWS Storage Gateway tape gateway virtual tape library.
   • BUse AWS Backup to configure and monitor all backups for the services in use.
   • CUse AWS Config to set lifecycle management to take snapshots of all data sources on a schedule.
   • DUse AWS Systems Manager State Manager to manage the configuration and monitoring of backup tasks.

   Show answer

   Answer: B

   References

   • AWS documentation

   Next question

3. Question 853 · 1017 in bank

   A company has a production web application in which users upload documents through a web interface or a mobile app. According to a new regulatory requirement. new documents cannot be modified or deleted after they are stored. What should a solutions architect do to meet this requirement?

   • AStore the uploaded documents in an Amazon S3 bucket with S3 Versioning and S3 Object Lock enabled.
   • BStore the uploaded documents in an Amazon S3 bucket. Configure an S3 Lifecycle policy to archive the documents periodically.
   • CStore the uploaded documents in an Amazon S3 bucket with S3 Versioning enabled. Configure an ACL to restrict all access to read-only.
   • DStore the uploaded documents on an Amazon Elastic File System (Amazon EFS) volume. Access the data by mounting the volume in read-only mode.

   Show answer

   Answer: A

   Explanation

   You can use S3 Object Lock to store objects using a write-once-read-many (WORM) model. Object Lock can help prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely. You can use S3 Object Lock to meet regulatory requirements that require WORM storage, or add an extra layer of protection against object changes and deletion. Versioning is required and automatically activated as Object Lock is enabled. https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html

   Source: Adapted from community discussion — 123jhl0

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 854 · 1017 in bank

   A company wants to build a map of its IT infrastructure to identify and enforce policies on resources that pose security risks. The company's security team must be able to query data in the IT infrastructure map and quickly identify security risks. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse Amazon RDS to store the data. Use SQL to query the data to identify security risks.
   • BUse Amazon Neptune to store the data. Use SPARQL to query the data to identify security risks.
   • CUse Amazon Redshift to store the data. Use SQL to query the data to identify security risks.
   • DUse Amazon DynamoDB to store the data. Use PartiQL to query the data to identify security risks.

   Show answer

   Answer: B

   Explanation

   AnswerB Neptune is the only Graph database from all options which seems to be most suitable. I'm not sure about SPARQL but hence Neptun is the best option hence SPARQL should be to. https://docs.aws.amazon.com/neptune/latest/userguide/intro.html

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 855 · 1017 in bank

   A large company wants to provide its globally located developers separate, limited size, managed PostgreSQL databases for development purposes. The databases will be low volume. The developers need the databases only when they are actively working. Which solution will meet these requirements MOST cost-effectively?

   • AGive the developers the ability to launch separate Amazon Aurora instances. Set up a process to shut down Aurora instances at the end of the workday and to start Aurora instances at the beginning of the next workday.
   • BDevelop an AWS Service Catalog product that enforces size restrictions for launching Amazon Aurora instances. Give the developers access to launch the product when they need a development database.
   • CCreate an Amazon Aurora Serverless cluster. Develop an AWS Service Catalog product to launch databases in the cluster with the default capacity settings. Grant the developers access to the product.
   • DMonitor AWS Trusted Advisor checks for idle Amazon RDS databases. Create a process to terminate identified idle RDS databases.

   Show answer

   Answer: C

   Explanation

   Aurora Serverless = inicia, encerra e escala a capacidade automaticamente de acordo com as necessidades. AWS Service Catalog = catalogo de serviços que usuarios podem utilizar, dentro das configurações permitidas. https://aws.amazon.com/pt/rds/aurora/serverless/ https://aws.amazon.com/pt/servicecatalog/

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 856 · 1017 in bank

   A company is building a web application that serves a content management system. The content management system runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances run in an Auto Scaling group across multiple Availability Zones. Users are constantly adding and updating files, blogs, and other website assets in the content management system. A solutions architect must implement a solution in which all the EC2 instances share up-to-date website content with the least possible lag time. Which solution meets these requirements?

   • AUpdate the EC2 user data in the Auto Scaling group lifecycle policy to copy the website assets from the EC2 instance that was launched most recently. Configure the ALB to make changes to the website assets only in the newest EC2 instance.
   • BCopy the website assets to an Amazon Elastic File System (Amazon EFS) file system. Configure each EC2 instance to mount the EFS file system locally. Configure the website hosting application to reference the website assets that are stored in the EFS file system.
   • CCopy the website assets to an Amazon S3 bucket. Ensure that each EC2 instance downloads the website assets from the S3 bucket to the attached Amazon Elastic Block Store (Amazon EBS) volume. Run the S3 sync command once each hour to keep files up to date.
   • DRestore an Amazon Elastic Block Store (Amazon EBS) snapshot with the website assets. Attach the EBS snapshot as a secondary EBS volume when a new EC2 instance is launched. Configure the website hosting application to reference the website assets that are stored in the secondary EBS volume.

   Show answer

   Answer: B

   Next question

7. Question 857 · 1017 in bank

   A company's web application consists of multiple Amazon EC2 instances that run behind an Application Load Balancer in a VPC. An Amazon RDS for MySQL DB instance contains the data. The company needs the ability to automatically detect and respond to suspicious or unexpected behavior in its AWS environment. The company already has added AWS WAF to its architecture. What should a solutions architect do next to protect against threats?

   • AUse Amazon GuardDuty to perform threat detection. Configure Amazon EventBridge to filter for GuardDuty findings and to invoke an AWS Lambda function to adjust the AWS WAF rules.
   • BUse AWS Firewall Manager to perform threat detection. Configure Amazon EventBridge to filter for Firewall Manager findings and to invoke an AWS Lambda function to adjust the AWS WAF web ACL.
   • CUse Amazon Inspector to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.
   • DUse Amazon Macie to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.

   Show answer

   Answer: A

   Explanation

   AnswerA Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across your AWS environment. https://aws.amazon.com/guardduty/features/

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation

   Next question

8. Question 858 · 1017 in bank

   A company is planning to run a group of Amazon EC2 instances that connect to an Amazon Aurora database. The company has built an AWS CloudFormation template to deploy the EC2 instances and the Aurora DB cluster. The company wants to allow the instances to authenticate to the database in a secure way. The company does not want to maintain static database credentials. Which solution meets these requirements with the LEAST operational effort?

   • ACreate a database user with a user name and password. Add parameters for the database user name and password to the CloudFormation template. Pass the parameters to the EC2 instances when the instances are launched.
   • BCreate a database user with a user name and password. Store the user name and password in AWS Systems Manager Parameter Store. Configure the EC2 instances to retrieve the database credentials from Parameter Store.
   • CConfigure the DB cluster to use IAM database authentication. Create a database user to use with IAM authentication. Associate a role with the EC2 instances to allow applications on the instances to access the database.
   • DConfigure the DB cluster to use IAM database authentication with an IAM user. Create a database user that has a name that matches the IAM user. Associate the IAM user with the EC2 instances to allow applications on the instances to access the database.

   Show answer

   Answer: C

   Explanation

   AnswerC Customer would like to not manage password rotation from my understanding, hence A and B are not the best solution here. I don't think we can associate IAM user with EC2 instance, but we can associate IAM role. In summary C https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.html

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 859 · 1017 in bank

   A company wants to configure its Amazon CloudFront distribution to use SSL/TLS certificates. The company does not want to use the default domain name for the distribution. Instead, the company wants to use a different domain name for the distribution. Which solution will deploy the certificate without incurring any additional costs?

   • ARequest an Amazon issued private certificate from AWS Certificate Manager (ACM) in the us-east-1 Region.
   • BRequest an Amazon issued private certificate from AWS Certificate Manager (ACM) in the us-west-1 Region.
   • CRequest an Amazon issued public certificate from AWS Certificate Manager (ACM) in the us-east-1 Region.
   • DRequest an Amazon issued public certificate from AWS Certificate Manager (ACM) in the us-west-1 Region.

   Show answer

   Answer: C

   Explanation

   AnswerC Per AWS "Public SSL/TLS certificates provisioned through AWS Certificate Manager are free. You pay only for the AWS resources you create to run your application." https://aws.amazon.com/certificate-manager/pricing/?nc=sn&loc=3 But hence AWS is recommending to use US east 1 I think I would go with C Note We recommend that you use ACM to provision, manage, and deploy SSL/TLS certificates on AWS managed resources. You must request an ACM certificate in the US East (N. Virginia) Region. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-procedures.html

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 860 · 1017 in bank

    A company creates operations data and stores the data in an Amazon S3 bucket. For the company's annual audit, an external consultant needs to access an annual report that is stored in the S3 bucket. The external consultant needs to access the report for 7 days. The company must implement a solution to allow the external consultant access to only the report. Which solution will meet these requirements with the MOST operational efficiency?

    • ACreate a new S3 bucket that is configured to host a public static website. Migrate the operations data to the new S3 bucket. Share the S3 website URL with the external consultant.
    • BEnable public access to the S3 bucket for 7 days. Remove access to the S3 bucket when the external consultant completes the audit.
    • CCreate a new IAM user that has access to the report in the S3 bucket. Provide the access keys to the external consultant. Revoke the access keys after 7 days.
    • DGenerate a presigned URL that has the required access to the location of the report on the S3 bucket. Share the presigned URL with the external consultant.

    Show answer

    Answer: D

    Explanation

    AnswerD When using CLI to create presigned URL we can setup 7days (max) for URL expiration from the time of creation. https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html

    Source: Adapted from community discussion — Scheldon

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 851. 1017 questions available.