SAA-C03 practice questions 891–900

1. Question 891 · 1017 in bank

   Select 3

   A solutions architect is designing a three-tier web application. The architecture consists of an internet-facing Application Load Balancer (ALB) and a web tier that is hosted on Amazon EC2 instances in private subnets. The application tier with the business logic runs on EC2 instances in private subnets. The database tier consists of Microsoft SQL Server that runs on EC2 instances in private subnets. Security is a high priority for the company. Which combination of security group configurations should the solutions architect use? (Choose three.)

   • AConfigure the security group for the web tier to allow inbound HTTPS traffic from the security group for the ALB.
   • BConfigure the security group for the web tier to allow outbound HTTPS traffic to 0.0.0.0/0.
   • CConfigure the security group for the database tier to allow inbound Microsoft SQL Server traffic from the security group for the application tier.
   • DConfigure the security group for the database tier to allow outbound HTTPS traffic and Microsoft SQL Server traffic to the security group for the web tier.
   • EConfigure the security group for the application tier to allow inbound HTTPS traffic from the security group for the web tier.
   • FConfigure the security group for the application tier to allow outbound HTTPS traffic and Microsoft SQL Server traffic to the security group for the web tier.

   Show answer

   Answer: ACE

   Explanation

   AnswerACE: Security Group is protecting instances, it's statefull. by defoult is allowing for outgoing traffic but not incomming. hence we need to allow for inboud traffic. path looks like below ALB >>HTTPS>> WEB tier >>HTTPS>> Application >>SQL traffic>> SQL DB hence we need allow for incoming https traffic on web tier then incomming http on app tier and on the end for incomming sql traffic on DB tier

   Source: Adapted from community discussion — Scheldon

   Next question

2. Question 892 · 1017 in bank

   Select 2

   A company has released a new version of its production application. The company's workload uses Amazon EC2, AWS Lambda, AWS Fargate, and Amazon SageMaker. The company wants to cost optimize the workload now that usage is at a steady state. The company wants to cover the most services with the fewest savings plans. Which combination of savings plans will meet these requirements? (Choose two.)

   • APurchase an EC2 Instance Savings Plan for Amazon EC2 and SageMaker.
   • BPurchase a Compute Savings Plan for Amazon EC2, Lambda, and SageMaker.
   • CPurchase a SageMaker Savings Plan.
   • DPurchase a Compute Savings Plan for Lambda, Fargate, and Amazon EC2.
   • EPurchase an EC2 Instance Savings Plan for Amazon EC2 and Fargate.

   Show answer

   Answer: CD

   Explanation

   It's pretty obvious, although it's called: Machine Learning Savings Plans for Amazon SageMaker (C) For the compute workloads we need a compute savings plan, that covers all the 3 compute options we use here (EC2, Lambda and Fargate) (D)

   Source: Adapted from community discussion — sandordini

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 893 · 1017 in bank

   Select 2

   A company uses a Microsoft SQL Server database. The company's applications are connected to the database. The company wants to migrate to an Amazon Aurora PostgreSQL database with minimal changes to the application code. Which combination of steps will meet these requirements? (Choose two.)

   • AUse the AWS Schema Conversion Tool (AWS SCT) to rewrite the SQL queries in the applications.
   • BEnable Babelfish on Aurora PostgreSQL to run the SQL queries from the applications.
   • CMigrate the database schema and data by using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS).
   • DUse Amazon RDS Proxy to connect the applications to Aurora PostgreSQL.
   • EUse AWS Database Migration Service (AWS DMS) to rewrite the SQL queries in the applications.

   Show answer

   Answer: BC

   Explanation

   AnswerBC DMS will allow for DATABASE migration and use AWS Schema Conversion Tool (AWS SCT) to create some or all of the target tables, indexes, views, triggers, and so on. https://docs.aws.amazon.com/dms/latest/userguide/Welcome.html To minimalize amount of code which need to me changes we need to use babelfish https://aws.amazon.com/rds/aurora/babelfish/

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 894 · 1017 in bank

   A company plans to rehost an application to Amazon EC2 instances that use Amazon Elastic Block Store (Amazon EBS) as the attached storage. A solutions architect must design a solution to ensure that all newly created Amazon EBS volumes are encrypted by default. The solution must also prevent the creation of unencrypted EBS volumes. Which solution will meet these requirements?

   • AConfigure the EC2 account attributes to always encrypt new EBS volumes.
   • BUse AWS Config. Configure the encrypted-volumes identifier. Apply the default AWS Key Management Service (AWS KMS) key.
   • CConfigure AWS Systems Manager to create encrypted copies of the EBS volumes. Reconfigure the EC2 instances to use the encrypted volumes.
   • DCreate a customer managed key in AWS Key Management Service (AWS KMS). Configure AWS Migration Hub to use the key when the company migrates workloads.

   Show answer

   Answer: A

   Explanation

   AnswerA The task is to force automatic encryption for every new EBS volume and prevent possibility of creation any unencrypted volume hence: https://docs.aws.amazon.com/ebs/latest/userguide/work-with-ebs-encr.html#ebs-encryption_key_mgmt To enable encryption by default for a Region Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/. From the navigation bar, select the Region. From the navigation pane, select EC2 Dashboard. In the upper-right corner of the page, choose Account Attributes, Data protection and security. Choose Manage. Select Enable. You keep the AWS managed key with the alias alias/aws/ebs created on your behalf as the default encryption key, or choose a symmetric customer managed encryption key. Choose Update EBS encryption.

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • aws.amazon.com documentation
   • AWS documentation
   • AWS documentation
   • repost.aws documentation

   Next question

5. Question 895 · 1017 in bank

   An ecommerce company wants to collect user clickstream data from the company's website for real-time analysis. The website experiences fluctuating traffic patterns throughout the day. The company needs a scalable solution that can adapt to varying levels of traffic. Which solution will meet these requirements?

   • AUse a data stream in Amazon Kinesis Data Streams in on-demand mode to capture the clickstream data. Use AWS Lambda to process the data in real time.
   • BUse Amazon Kinesis Data Firehose to capture the clickstream data. Use AWS Glue to process the data in real time.
   • CUse Amazon Kinesis Video Streams to capture the clickstream data. Use AWS Glue to process the data in real time.
   • DUse Amazon Managed Service for Apache Flink (previously known as Amazon Kinesis Data Analytics) to capture the clickstream data. Use AWS Lambda to process the data in real time.

   Show answer

   Answer: A

   Explanation

   AnswerA Apache Flink (previously known as Amazon Kinesis Data Analytics) seems to not allowing sent data directly to Lambda... Glue is allowing to integrate data from couple of sources in to one. Hence I think A is correct answer https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.html https://aws.amazon.com/kinesis/data-streams/features/?nc=sn&loc=2

   Source: Adapted from community discussion — Scheldon

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 896 · 1017 in bank

   A company uses Amazon S3 to store its confidential audit documents. The S3 bucket uses bucket policies to restrict access to audit team IAM user credentials according to the principle of least privilege. Company managers are worried about accidental deletion of documents in the S3 bucket and want a more secure solution. What should a solutions architect do to secure the audit documents?

   • AEnable the versioning and MFA Delete features on the S3 bucket.
   • BEnable multi-factor authentication (MFA) on the IAM user credentials for each audit team IAM user account.
   • CAdd an S3 Lifecycle policy to the audit team's IAM user accounts to deny the s3:DeleteObject action during audit dates.
   • DUse AWS Key Management Service (AWS KMS) to encrypt the S3 bucket and restrict audit team IAM user accounts from accessing the KMS key.

   Show answer

   Answer: A

   Explanation

   B. Enabling MFA on the IAM user credentials adds an extra layer of security to the user authentication process. However, it does not specifically address the concern of accidental deletion of documents in the S3 bucket. C. Adding an S3 Lifecycle policy to deny the delete action during audit dates would prevent intentional deletions during specific time periods. However, it does not address accidental deletions that can occur at any time. D. Using KMS for encryption and restricting access to the KMS key provides additional security for the data stored in the S3 . However, it does not directly prevent accidental deletion of documents in the S3. Enabling versioning and MFA Delete on the S3 (option A) is the most appropriate solution for securing the audit documents. Versioning ensures that multiple versions of the documents are stored, allowing for easy recovery in case of accidental deletions. Enabling MFA Delete requires the use of multi-factor authentication to authorize deletion actions, adding an extra layer of protection against unintended deletions.

   Source: Adapted from community discussion — cookieMr

   References

   • AWS documentation

   Next question

7. Question 897 · 1017 in bank

   A company needs to optimize its Amazon S3 storage costs for an application that generates many files that cannot be recreated. Each file is approximately 5 MB and is stored in Amazon S3 Standard storage. The company must store the files for 4 years before the files can be deleted. The files must be immediately accessible. The files are frequently accessed in the first 30 days of object creation, but they are rarely accessed after the first 30 days. Which solution will meet these requirements MOST cost-effectively?

   • ACreate an S3 Lifecycle policy to move the files to S3 Glacier Instant Retrieval 30 days after object creation. Delete the files 4 years after object creation.
   • BCreate an S3 Lifecycle policy to move the files to S3 One Zone-Infrequent Access (S3 One Zone-IA) 30 days after object creation. Delete the files 4 years after object creation.
   • CCreate an S3 Lifecycle policy to move the files to S3 Standard-Infrequent Access (S3 Standard-IA) 30 days after object creation. Delete the files 4 years after object creation.
   • DCreate an S3 Lifecycle policy to move the files to S3 Standard-Infrequent Access (S3 Standard-IA) 30 days after object creation. Move the files to S3 Glacier Flexible Retrieval 4 years after object creation.

   Show answer

   Answer: A

   Explanation

   Although it's not stated what is meant by 'rarely accessed', this scenario would primarily be a candidate for the Glacier Instant Retrieval tier as the storage price would be more than 3 times lower compared to Standard IA. In the specific case of files being more frequently retrieved than quarterly, it can qualify for consideration of Standard IA. Actually, we don't have the required info, so we have to guess what they are thinking.. which is pretty lame, to be honest..

   Source: Adapted from community discussion — sandordini

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 898 · 1017 in bank

   A company runs its critical storage application in the AWS Cloud. The application uses Amazon S3 in two AWS Regions. The company wants the application to send remote user data to the nearest S3 bucket with no public network congestion. The company also wants the application to fail over with the least amount of management of Amazon S3. Which solution will meet these requirements?

   • AImplement an active-active design between the two Regions. Configure the application to use the regional S3 endpoints closest to the user.
   • BUse an active-passive configuration with S3 Multi-Region Access Points. Create a global endpoint for each of the Regions.
   • CSend user data to the regional S3 endpoints closest to the user. Configure an S3 cross-account replication rule to keep the S3 buckets synchronized.
   • DSet up Amazon S3 to use Multi-Region Access Points in an active-active configuration with a single global endpoint. Configure S3 Cross-Region Replication.

   Show answer

   Answer: D

   Explanation

   Using a Multi-region Accesspoint in an Active-Active setup will send data to the closest Region, without accessing the internet: "send remote user data to the nearest S3 bucket with no public network congestion" Not very easy to read and understand but it's all there: https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPoints.html

   Source: Adapted from community discussion — sandordini

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 899 · 1017 in bank

   A company is migrating a data center from its on-premises location to AWS. The company has several legacy applications that are hosted on individual virtual servers. Changes to the application designs cannot be made. Each individual virtual server currently runs as its own EC2 instance. A solutions architect needs to ensure that the applications are reliable and fault tolerant after migration to AWS. The applications will run on Amazon EC2 instances. Which solution will meet these requirements?

   • ACreate an Auto Scaling group that has a minimum of one and a maximum of one. Create an Amazon Machine Image (AMI) of each application instance. Use the AMI to create EC2 instances in the Auto Scaling group Configure an Application Load Balancer in front of the Auto Scaling group.
   • BUse AWS Backup to create an hourly backup of the EC2 instance that hosts each application. Store the backup in Amazon S3 in a separate Availability Zone. Configure a disaster recovery process to restore the EC2 instance for each application from its most recent backup.
   • CCreate an Amazon Machine Image (AMI) of each application instance. Launch two new EC2 instances from the AMI. Place each EC2 instance in a separate Availability Zone. Configure a Network Load Balancer that has the EC2 instances as targets.
   • DUse AWS Mitigation Hub Refactor Spaces to migrate each application off the EC2 instance. Break down functionality from each application into individual components. Host each application on Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type.

   Show answer

   Answer: A

   Explanation

   Autoscaling with max=1 is what is needed to keep only one instance at a time - it will still fail, but it will spawn exactly one instance in case of failure (we are not allowed to change the design of the app) Having single instances in different AZ will not help - if one of the AZs is down, the app will still be affected

   Source: Adapted from community discussion — Vasiliy

   References

   • AWS documentation

   Next question

10. Question 900 · 1017 in bank

    A company wants to isolate its workloads by creating an AWS account for each workload. The company needs a solution that centrally manages networking components for the workloads. The solution also must create accounts with automatic security controls (guardrails). Which solution will meet these requirements with the LEAST operational overhead?

    • AUse AWS Control Tower to deploy accounts. Create a networking account that has a VPC with private subnets and public subnets. Use AWS Resource Access Manager (AWS RAM) to share the subnets with the workload accounts.
    • BUse AWS Organizations to deploy accounts. Create a networking account that has a VPC with private subnets and public subnets. Use AWS Resource Access Manager (AWS RAM) to share the subnets with the workload accounts.
    • CUse AWS Control Tower to deploy accounts. Deploy a VPC in each workload account. Configure each VPC to route through an inspection VPC by using a transit gateway attachment.
    • DUse AWS Organizations to deploy accounts. Deploy a VPC in each workload account. Configure each VPC to route through an inspection VPC by using a transit gateway attachment.

    Show answer

    Answer: A

    Explanation

    Statement: - The solution also must create accounts with automatic security controls (guardrails). https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html AWS Control Tower provides a pre-packaged set of guardrails (policies) and blueprints (best-practice configurations) to ensure that the environment complies with security and compliance standards. It’s designed to simplify the process of creating and managing a multi-account AWS environment while maintaining security and compliance.

    Source: Adapted from community discussion — bujuman

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 891. 1017 questions available.