SAA-C03 practice questions 911–920

1. Question 911 · 1017 in bank

   A company wants to migrate an application to AWS. The company wants to increase the application's current availability. The company wants to use AWS WAF in the application's architecture. Which solution will meet these requirements?

   • ACreate an Auto Scaling group that contains multiple Amazon EC2 instances that host the application across two Availability Zones. Configure an Application Load Balancer (ALB) and set the Auto Scaling group as the target. Connect a WAF to the ALB.
   • BCreate a cluster placement group that contains multiple Amazon EC2 instances that hosts the application. Configure an Application Load Balancer and set the EC2 instances as the targets. Connect a WAF to the placement group.
   • CCreate two Amazon EC2 instances that host the application across two Availability Zones. Configure the EC2 instances as the targets of an Application Load Balancer (ALB). Connect a WAF to the ALB.
   • DCreate an Auto Scaling group that contains multiple Amazon EC2 instances that host the application across two Availability Zones. Configure an Application Load Balancer (ALB) and set the Auto Scaling group as the target. Connect a WAF to the Auto Scaling group.

   Show answer

   Answer: A

   Explanation

   Not D because AWS WAF cannot be directly connected to an Auto Scaling Group, it should be associated with the ALB which managing the incoming web traffic

   Source: Adapted from community discussion — trinh_le

   Next question

2. Question 912 · 1017 in bank

   A company manages a data lake in an Amazon S3 bucket that numerous applications access. The S3 bucket contains a unique prefix for each application. The company wants to restrict each application to its specific prefix and to have granular control of the objects under each prefix. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate dedicated S3 access points and access point policies for each application.
   • BCreate an S3 Batch Operations job to set the ACL permissions for each object in the S3 bucket.
   • CReplicate the objects in the S3 bucket to new S3 buckets for each application. Create replication rules by prefix.
   • DReplicate the objects in the S3 bucket to new S3 buckets for each application. Create dedicated S3 access points for each application.

   Show answer

   Answer: A

   Explanation

   Answer A By creating separate access points for each application, you can enforce access controls specific to their respective prefixes while minimizing administrative complexity. This approach provides a clean separation of permissions and reduces the risk of misconfigurations. Options B, C, and D are not as efficient or straightforward: Option B (S3 Batch Operations) involves setting ACL permissions for each object individually, which can be cumbersome and time-consuming. Option C (replicating objects to new S3 buckets) introduces additional buckets and replication rules, increasing management overhead. Option D (replicating objects and creating dedicated S3 access points) adds unnecessary complexity by combining replication and access point creation.

   Source: Adapted from community discussion — anirudhsharma

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 913 · 1017 in bank

   A company has an application that customers use to upload images to an Amazon S3 bucket. Each night, the company launches an Amazon EC2 Spot Fleet that processes all the images that the company received that day. The processing for each image takes 2 minutes and requires 512 MB of memory. A solutions architect needs to change the application to process the images when the images are uploaded. Which change will meet these requirements MOST cost-effectively?

   • AUse S3 Event Notifications to write a message with image details to an Amazon Simple Queue Service (Amazon SQS) queue. Configure an AWS Lambda function to read the messages from the queue and to process the images.
   • BUse S3 Event Notifications to write a message with image details to an Amazon Simple Queue Service (Amazon SQS) queue. Configure an EC2 Reserved Instance to read the messages from the queue and to process the images.
   • CUse S3 Event Notifications to publish a message with image details to an Amazon Simple Notification Service (Amazon SNS) topic. Configure a container instance in Amazon Elastic Container Service (Amazon ECS) to subscribe to the topic and to process the images.
   • DUse S3 Event Notifications to publish a message with image details to an Amazon Simple Notification Service (Amazon SNS) topic. Configure an AWS Elastic Beanstalk application to subscribe to the topic and to process the images.

   Show answer

   Answer: A

   Explanation

   Answer A I would go with Lambda and SQS. when using SQS we will be sure that all images will be processed and hence to process we need 2 min and 512 MB of memory (Lambda is allowing upto 15 min and upto10K MB) Lambda should be perfect scalable solution which will allow for almost in real time image processing.

   Source: Adapted from community discussion — Scheldon

   Next question

4. Question 914 · 1017 in bank

   Select 2

   A company wants to improve the availability and performance of its hybrid application. The application consists of a stateful TCP-based workload hosted on Amazon EC2 instances in different AWS Regions and a stateless UDP-based workload hosted on premises. Which combination of actions should a solutions architect take to improve availability and performance? (Choose two.)

   • ACreate an accelerator using AWS Global Accelerator. Add the load balancers as endpoints.
   • BCreate an Amazon CloudFront distribution with an origin that uses Amazon Route 53 latency-based routing to route requests to the load balancers.
   • CConfigure two Application Load Balancers in each Region. The first will route to the EC2 endpoints, and the second will route to the on-premises endpoints.
   • DConfigure a Network Load Balancer in each Region to address the EC2 endpoints. Configure a Network Load Balancer in each Region that routes to the on-premises endpoints.
   • EConfigure a Network Load Balancer in each Region to address the EC2 endpoints. Configure an Application Load Balancer in each Region that routes to the on-premises endpoints.

   Show answer

   Answer: AD

   Next question

5. Question 915 · 1017 in bank

   A company runs a self-managed Microsoft SQL Server on Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS). Daily snapshots are taken of the EBS volumes. Recently, all the company’s EBS snapshots were accidentally deleted while running a snapshot cleaning script that deletes all expired EBS snapshots. A solutions architect needs to update the architecture to prevent data loss without retaining EBS snapshots indefinitely. Which solution will meet these requirements with the LEAST development effort?

   • AChange the IAM policy of the user to deny EBS snapshot deletion.
   • BCopy the EBS snapshots to another AWS Region after completing the snapshots daily.
   • CCreate a 7-day EBS snapshot retention rule in Recycle Bin and apply the rule for all snapshots.
   • DCopy EBS snapshots to Amazon S3 Standard-Infrequent Access (S3 Standard-IA).

   Show answer

   Answer: C

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 916 · 1017 in bank

   A company wants to use an AWS CloudFormation stack for its application in a test environment. The company stores the CloudFormation template in an Amazon S3 bucket that blocks public access. The company wants to grant CloudFormation access to the template in the S3 bucket based on specific user requests to create the test environment. The solution must follow security best practices. Which solution will meet these requirements?

   • ACreate a gateway VPC endpoint for Amazon S3. Configure the CloudFormation stack to use the S3 object URL.
   • BCreate an Amazon API Gateway REST API that has the S3 bucket as the target. Configure the CloudFormation stack to use the API Gateway URL.
   • CCreate a presigned URL for the template object. Configure the CloudFormation stack to use the presigned URL.
   • DAllow public access to the template object in the S3 bucket. Block the public access after the test environment is created.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

7. Question 917 · 1017 in bank

   A company has applications that run in an organization in AWS Organizations. The company outsources operational support of the applications. The company needs to provide access for the external support engineers without compromising security. The external support engineers need access to the AWS Management Console. The external support engineers also need operating system access to the company’s fleet ofAmazon EC2 instances that run Amazon Linux in private subnets. Which solution will meet these requirements MOST securely?

   • AConfirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use AWS IAM Identity Center to provide the external support engineers console access. Use Systems Manager Session Manager to assign the required permissions.
   • BConfirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use Systems Manager Session Manager to provide local IAM user credentials in each AWS account to the external support engineers for console access.
   • CConfirm that all instances have a security group that allows SSH access only from the external support engineers’ source IP address ranges. Provide local IAM user credentials in each AWS account to the external support engineers for console access. Provide each external support engineer an SSH key pair to log in to the application instances.
   • DCreate a bastion host in a public subnet. Set up the bastion host security group to allow access from only the external engineers’ IP address ranges. Ensure that all instances have a security group that allows SSH access from the bastion host. Provide each external support engineer an SSH key pair to log in to the application instances. Provide local account IAM user credentials to the engineers for console access.

   Show answer

   Answer: A

   Explanation

   Systems Manager Session Manager allows secure, auditable, and controlled access to your EC2 instances without needing to open SSH ports or manage SSH keys, reducing the attack surface. Local IAM user credentials are less secure and harder to manage at scale compared to using IAM Identity Center.

   Source: Adapted from community discussion — officedepotadmin

   Next question

8. Question 918 · 1017 in bank

   A company uses Amazon RDS for PostgreSQL to run its applications in the us-east-1 Region. The company also uses machine learning (ML) models to forecast annual revenue based on near real-time reports. The reports are generated by using the same RDS for PostgreSQL database. The database performance slows during business hours. The company needs to improve database performance. Which solution will meet these requirements MOST cost-effectively?

   • ACreate a cross-Region read replica. Configure the reports to be generated from the read replica.
   • BActivate Multi-AZ DB instance deployment for RDS for PostgreSQL. Configure the reports to be generated from the standby database.
   • CUse AWS Data Migration Service (AWS DMS) to logically replicate data to a new database. Configure the reports to be generated from the new database.
   • DCreate a read replica in us-east-1. Configure the reports to be generated from the read replica.

   Show answer

   Answer: D

   Next question

9. Question 919 · 1017 in bank

   A company has applications that run on Amazon EC2 instances in a VPC. One of the applications needs to call the Amazon S3 API to store and read objects. According to the company's security regulations, no traffic from the applications is allowed to travel across the internet. Which solution will meet these requirements?

   • AConfigure an S3 gateway endpoint.
   • BCreate an S3 bucket in a private subnet.
   • CCreate an S3 bucket in the same AWS Region as the EC2 instances.
   • DConfigure a NAT gateway in the same subnet as the EC2 instances.

   Show answer

   Answer: A

   Explanation

   Gateway endpoints provide reliable connectivity to Amazon S3 and DynamoDB without requiring an internet gateway or a NAT device for your VPC. It should be option A. https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html

   Source: Adapted from community discussion — ArielSchivo

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 920 · 1017 in bank

    A company hosts its multi-tier, public web application in the AWS Cloud. The web application runs on Amazon EC2 instances, and its database runs on Amazon RDS. The company is anticipating a large increase in sales during an upcoming holiday weekend. A solutions architect needs to build a solution to analyze the performance of the web application with a granularity of no more than 2 minutes. What should the solutions architect do to meet this requirement?

    • ASend Amazon CloudWatch logs to Amazon Redshift. Use Amazon QuickS ght to perform further analysis.
    • BEnable detailed monitoring on all EC2 instances. Use Amazon CloudWatch metrics to perform further analysis.
    • CCreate an AWS Lambda function to fetch EC2 logs from Amazon CloudWatch Logs. Use Amazon CloudWatch metrics to perform further analysis.
    • DSend EC2 logs to Amazon S3. Use Amazon Redshift to fetch logs from the S3 bucket to process raw data for further analysis with Amazon QuickSight.

    Show answer

    Answer: B

    Explanation

    Enabling detailed monitoring on EC2 instances provides metrics at a 1-minute granularity, which is well within the required 2-minute granularity for performance analysis.

    Source: Adapted from community discussion — officedepotadmin

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 911. 1017 questions available.