SAA-C03 practice questions 881–890

1. Question 881 · 1017 in bank

   A company runs an application on Amazon EC2 instances in a private subnet. The application needs to store and retrieve data in Amazon S3 buckets. According to regulatory requirements, the data must not travel across the public internet. What should a solutions architect do to meet these requirements MOST cost-effectively?

   • ADeploy a NAT gateway to access the S3 buckets.
   • BDeploy AWS Storage Gateway to access the S3 buckets.
   • CDeploy an S3 interface endpoint to access the S3 buckets.
   • DDeploy an S3 gateway endpoint to access the S3 buckets.

   Show answer

   Answer: D

   Explanation

   AnswerD https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html taking into consideration that in both cases (s3 Instance Endpoint and S3Gateway endpoint), network traffic remains on the AWS network we need to think about other data which we have. For example application is in AWS cloud hence there is no need for access from on-premises. in that situation S3 Gateway endpoint seems to be better (and it is for free) https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation

   Next question

2. Question 882 · 1017 in bank

   Select 2

   A company hosts an application on Amazon EC2 instances that run in a single Availability Zone. The application is accessible by using the transport layer of the Open Systems Interconnection (OSI) model. The company needs the application architecture to have high availability. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)

   • AConfigure new EC2 instances in a different Availability Zone. Use Amazon Route 53 to route traffic to all instances.
   • BConfigure a Network Load Balancer in front of the EC2 instances.
   • CConfigure a Network Load Balancer for TCP traffic to the instances. Configure an Application Load Balancer for HTTP and HTTPS traffic to the instances.
   • DCreate an Auto Scaling group for the EC2 instances. Configure the Auto Scaling group to use multiple Availability Zones. Configure the Auto Scaling group to run application health checks on the instances.
   • ECreate an Amazon CloudWatch alarm. Configure the alarm to restart EC2 instances that transition to a stopped state.

   Show answer

   Answer: BD

   Explanation

   AnswerBD There is no information about the ports numbers and only that means that we need to use NLB, ALB is only for HTTP hence there is no point of using that solution as connection can be done via any port for exampl 4000 Autoscaling with instances in multiple AZ is the best solution. it will allow run new EC2 if it fail and in case if whole AZ will go down we will have 2nd one.

   Source: Adapted from community discussion — Scheldon

   Next question

3. Question 883 · 1017 in bank

   A company uses Amazon S3 to host its static website. The company wants to add a contact form to the webpage. The contact form will have dynamic server-side components for users to input their name, email address, phone number, and user message. The company expects fewer than 100 site visits each month. The contact form must notify the company by email when a customer fills out the form. Which solution will meet these requirements MOST cost-effectively?

   • AHost the dynamic contact form in Amazon Elastic Container Service (Amazon ECS). Set up Amazon Simple Email Service (Amazon SES) to connect to a third-party email provider.
   • BCreate an Amazon API Gateway endpoint that returns the contact form from an AWS Lambda function. Configure another Lambda function on the API Gateway to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic.
   • CHost the website by using AWS Amplify Hosting for static content and dynamic content. Use server-side scripting to build the contact form. Configure Amazon Simple Queue Service (Amazon SQS) to deliver the message to the company.
   • DMigrate the website from Amazon S3 to Amazon EC2 instances that run Windows Server. Use Internet Information Services (IIS) for Windows Server to host the webpage. Use client-side scripting to build the contact form. Integrate the form with Amazon WorkMail.

   Show answer

   Answer: B

   Explanation

   AnswerB API gateway + Lambda seems to be the best option expecially when SNS is in use which is specially created to push messaged to the subscribers (company appropraiate team in this situation)

   Source: Adapted from community discussion — Scheldon

   Next question

4. Question 884 · 1017 in bank

   A company creates dedicated AWS accounts in AWS Organizations for its business units. Recently, an important notification was sent to the root user email address of a business unit account instead of the assigned account owner. The company wants to ensure that all future notifications can be sent to different employees based on the notification categories of billing, operations, or security. Which solution will meet these requirements MOST securely?

   • AConfigure each AWS account to use a single email address that the company manages. Ensure that all account owners can access the email account to receive notifications. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
   • BConfigure each AWS account to use a different email distribution list for each business unit that the company manages. Configure each distribution list with administrator email addresses that can respond to alerts. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
   • CConfigure each AWS account root user email address to be the individual company managed email address of one person from each business unit. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
   • DConfigure each AWS account root user to use email aliases that go to a centralized mailbox. Configure alternate contacts for each account by using a single business managed email distribution list each for the billing team, the security team, and the operations team.

   Show answer

   Answer: D

   Explanation

   D is correct answer. Configuring each AWS account's root user to use email aliases that go to a centralized mailbox ensures that sensitive notifications are not directly sent to individual email addresses. Instead, they are directed to a centralized mailbox, reducing the risk of unauthorized access to sensitive information. Additionally, configuring alternate contacts for each account using a single business-managed email distribution list for the billing team, the security team, and the operations team ensures that notifications are appropriately routed to the respective teams based on the categories of billing, operations, or security. This approach centralizes control and reduces the likelihood of misconfiguration or unauthorized access to sensitive notifications.

   Source: Adapted from community discussion — Linuslin

   References

   • AWS documentation

   Next question

5. Question 885 · 1017 in bank

   Select 2

   A company runs an ecommerce application on AWS. Amazon EC2 instances process purchases and store the purchase details in an Amazon Aurora PostgreSQL DB cluster. Customers are experiencing application timeouts during times of peak usage. A solutions architect needs to rearchitect the application so that the application can scale to meet peak usage demands. Which combination of actions will meet these requirements MOST cost-effectively? (Choose two.)

   • AConfigure an Auto Scaling group of new EC2 instances to retry the purchases until the processing is complete. Update the applications to connect to the DB cluster by using Amazon RDS Proxy.
   • BConfigure the application to use an Amazon ElastiCache cluster in front of the Aurora PostgreSQL DB cluster.
   • CUpdate the application to send the purchase requests to an Amazon Simple Queue Service (Amazon SQS) queue. Configure an Auto Scaling group of new EC2 instances that read from the SQS queue.
   • DConfigure an AWS Lambda function to retry the ticket purchases until the processing is complete.
   • EConfigure an Amazon AP! Gateway REST API with a usage plan.

   Show answer

   Answer: AC

   Explanation

   A) uses RDS Proxy which is mainly for connection pooling and availability issues. Proxy is for too many connections(, not for performance: read replicas, caching) B is caching which is designed for solving read-issues. (Here we have timeouts, and connection issues.) C: SQS is good method for decoupling.

   Source: Adapted from community discussion — sandordini

   References

   • AWS documentation

   Next question

6. Question 886 · 1017 in bank

   A survey company has gathered data for several years from areas in the United States. The company hosts the data in an Amazon S3 bucket that is 3 TB in size and growing. The company has started to share the data with a European marketing firm that has S3 buckets. The company wants to ensure that its data transfer costs remain as low as possible. Which solution will meet these requirements?

   • AConfigure the Requester Pays feature on the company's S3 bucket.
   • BConfigure S3 Cross-Region Replication from the company's S3 bucket to one of the marketing firm's S3 buckets.
   • CConfigure cross-account access for the marketing firm so that the marketing firm has access to the company's S3 bucket.
   • DConfigure the company's S3 bucket to use S3 Intelligent-Tiering. Sync the S3 bucket to one of the marketing firm's S3 buckets.

   Show answer

   Answer: A

   Explanation

   "Typically, you configure buckets to be Requester Pays buckets when you want to share data but not incur charges associated with others accessing the data. For example, you might use Requester Pays buckets when making available large datasets, such as zip code directories, reference data, geospatial information, or web crawling data." https://docs.aws.amazon.com/AmazonS3/latest/userguide/RequesterPaysBuckets.html

   Source: Adapted from community discussion — 123jhl0

   References

   • AWS documentation

   Next question

7. Question 887 · 1017 in bank

   A company that uses AWS Organizations runs 150 applications across 30 different AWS accounts. The company used AWS Cost and Usage Report to create a new report in the management account. The report is delivered to an Amazon S3 bucket that is replicated to a bucket in the data collection account. The company’s senior leadership wants to view a custom dashboard that provides NAT gateway costs each day starting at the beginning of the current month. Which solution will meet these requirements?

   • AShare an Amazon QuickSight dashboard that includes the requested table visual. Configure QuickSight to use AWS DataSync to query the new report.
   • BShare an Amazon QuickSight dashboard that includes the requested table visual. Configure QuickSight to use Amazon Athena to query the new report.
   • CShare an Amazon CloudWatch dashboard that includes the requested table visual. Configure CloudWatch to use AWS DataSync to query the new report.
   • DShare an Amazon CloudWatch dashboard that includes the requested table visual. Configure CloudWatch to use Amazon Athena to query the new report.

   Show answer

   Answer: B

   Explanation

   You definitely use Athena to request S3. Both cloudwatch and quicksight can interact with S3. Since we are taking about "The company’s senior leadership" I'd tend to use quicksight for a better format.

   Source: Adapted from community discussion — Mikado211

   Next question

8. Question 888 · 1017 in bank

   Select 2

   A company is hosting a high-traffic static website on Amazon S3 with an Amazon CloudFront distribution that has a default TTL of 0 seconds. The company wants to implement caching to improve performance for the website. However, the company also wants to ensure that stale content is not served for more than a few minutes after a deployment. Which combination of caching methods should a solutions architect implement to meet these requirements? (Choose two.)

   • ASet the CloudFront default TTL to 2 minutes.
   • BSet a default TTL of 2 minutes on the S3 bucket.
   • CAdd a Cache-Control private directive to the objects in Amazon S3.
   • DCreate an AWS Lambda@Edge function to add an Expires header to HTTP responses. Configure the function to run on viewer response.
   • EAdd a Cache-Control max-age directive of 24 hours to the objects in Amazon S3. On deployment, create a CloudFront invalidation to clear any changed files from edge caches.

   Show answer

   Answer: AE

   Explanation

   AE. By default, each file automatically expires after 24 hours, but you can change the default behavior in two ways: 1. To change the cache duration for all files that match the same path pattern, you can change the CloudFront settings for Minimum TTL, Maximum TTL, and Default TTL for a cache behavior. 2. To change the cache duration for an individual file, you can configure your origin to add a Cache-Control header with the max-age or s-maxage directive, or an Expires header to the file. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html#expiration-individual-objects

   Source: Adapted from community discussion — BBR01

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 889 · 1017 in bank

   A company runs its application by using Amazon EC2 instances and AWS Lambda functions. The EC2 instances run in private subnets of a VPC. The Lambda functions need direct network access to the EC2 instances for the application to work. The application will run for 1 year. The number of Lambda functions that the application uses will increase during the 1-year period. The company must minimize costs on all application resources. Which solution will meet these requirements?

   • APurchase an EC2 Instance Savings Plan. Connect the Lambda functions to the private subnets that contain the EC2 instances.
   • BPurchase an EC2 Instance Savings Plan. Connect the Lambda functions to new public subnets in the same VPC where the EC2 instances run.
   • CPurchase a Compute Savings Plan. Connect the Lambda functions to the private subnets that contain the EC2 instances.
   • DPurchase a Compute Savings Plan. Keep the Lambda functions in the Lambda service VPC.

   Show answer

   Answer: C

   Explanation

   Compute Savings Plan: This plan offers significant discounts on Lambda functions compared to on-demand pricing. Since the application will run for a year, a sustained use discount like Compute Savings Plan is ideal. Private Subnets: Lambda functions in private subnets can directly access EC2 instances within the VPC without needing internet access, reducing security risks and potential egress costs.

   Source: Adapted from community discussion — Guru4Cloud

   References

   • AWS documentation

   Next question

10. Question 890 · 1017 in bank

    A company has deployed a multi-account strategy on AWS by using AWS Control Tower. The company has provided individual AWS accounts to each of its developers. The company wants to implement controls to limit AWS resource costs that the developers incur. Which solution will meet these requirements with the LEAST operational overhead?

    • AInstruct each developer to tag all their resources with a tag that has a key of CostCenter and a value of the developer's name. Use the required-tags AWS Config managed rule to check for the tag. Create an AWS Lambda function to terminate resources that do not have the tag. Configure AWS Cost Explorer to send a daily report to each developer to monitor their spending.
    • BUse AWS Budgets to establish budgets for each developer account. Set up budget alerts for actual and forecast values to notify developers when they exceed or expect to exceed their assigned budget. Use AWS Budgets actions to apply a DenyAll policy to the developer's IAM role to prevent additional resources from being launched when the assigned budget is reached.
    • CUse AWS Cost Explorer to monitor and report on costs for each developer account. Configure Cost Explorer to send a daily report to each developer to monitor their spending. Use AWS Cost Anomaly Detection to detect anomalous spending and provide alerts.
    • DUse AWS Service Catalog to allow developers to launch resources within a limited cost range. Create AWS Lambda functions in each AWS account to stop running resources at the end of each work day. Configure the Lambda functions to resume the resources at the start of each work day.

    Show answer

    Answer: B

    Explanation

    AnswerB https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-controls.html Taking into consideration that AWS Budgets is allowing to will inform you that you exceeded budged and execute actions like for example IAM actions to prevent running new resources in cloud, I think this option is a good and resonable move. In case of need budged can be always increased and "chains" disabled.

    Source: Adapted from community discussion — Scheldon

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 881. 1017 questions available.