SAA-C03 practice questions 931–940

1. Question 931 · 1017 in bank

   A company is migrating from a monolithic architecture for a web application that is hosted on Amazon EC2 to a serverless microservices architecture. The company wants to use AWS services that support an event-driven, loosely coupled architecture. The company wants to use the publish/subscribe (pub/sub) pattern. Which solution will meet these requirements MOST cost-effectively?

   • AConfigure an Amazon API Gateway REST API to invoke an AWS Lambda function that publishes events to an Amazon Simple Queue Service (Amazon SQS) queue. Configure one or more subscribers to read events from the SQS queue.
   • BConfigure an Amazon API Gateway REST API to invoke an AWS Lambda function that publishes events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure one or more subscribers to receive events from the SNS topic.
   • CConfigure an Amazon API Gateway WebSocket API to write to a data stream in Amazon Kinesis Data Streams with enhanced fan-out. Configure one or more subscribers to receive events from the data stream.
   • DConfigure an Amazon API Gateway HTTP API to invoke an AWS Lambda function that publishes events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure one or more subscribers to receive events from the topic.

   Show answer

   Answer: D

   Explanation

   HTTP API is cheaper. The difference in pricing is steep. REST APIs will run you USD $3.50 per one million requests plus charges for data transferred out. By contrast, HTTP APIs cost a mere $1.00 per request for the first million requests and then $0.90 per million requests after that.

   Source: Adapted from community discussion — 78b9037

   Next question

2. Question 932 · 1017 in bank

   A company recently migrated a monolithic application to an Amazon EC2 instance and Amazon RDS. The application has tightly coupled modules. The existing design of the application gives the application the ability to run on only a single EC2 instance. The company has noticed high CPU utilization on the EC2 instance during peak usage times. The high CPU utilization corresponds to degraded performance on Amazon RDS for read requests. The company wants to reduce the high CPU utilization and improve read request performance. Which solution will meet these requirements?

   • AResize the EC2 instance to an EC2 instance type that has more CPU capacity. Configure an Auto Scaling group with a minimum and maximum size of 1. Configure an RDS read replica for read requests.
   • BResize the EC2 instance to an EC2 instance type that has more CPU capacity. Configure an Auto Scaling group with a minimum and maximum size of 1. Add an RDS read replica and redirect all read/write traffic to the replica.
   • CConfigure an Auto Scaling group with a minimum size of 1 and maximum size of 2. Resize the RDS DB instance to an instance type that has more CPU capacity.
   • DResize the EC2 instance to an EC2 instance type that has more CPU capacity. Configure an Auto Scaling group with a minimum and maximum size of 1. Resize the RDS DB instance to an instance type that has more CPU capacity.

   Show answer

   Answer: A

   Explanation

   Option B incorrectly suggests redirecting all read/write traffic to the replica. RDS read replicas are designed to handle read operations only, not write operations. Writes must still be handled by the primary DB instance

   Source: Adapted from community discussion — ltetti

   Next question

3. Question 933 · 1017 in bank

   A company needs to grant a team of developers access to the company's AWS resources. The company must maintain a high level of security for the resources. The company requires an access control solution that will prevent unauthorized access to the sensitive data. Which solution will meet these requirements?

   • AShare the IAM user credentials for each development team member with the rest of the team to simplify access management and to streamline development workflows.
   • BDefine IAM roles that have fine-grained permissions based on the principle of least privilege. Assign an IAM role to each developer.
   • CCreate IAM access keys to grant programmatic access to AWS resources. Allow only developers to interact with AWS resources through API calls by using the access keys.
   • DCreate an AWS Cognito user pool. Grant developers access to AWS resources by using the user pool.

   Show answer

   Answer: B

   Next question

4. Question 934 · 1017 in bank

   Select 2

   A company hosts a monolithic web application on an Amazon EC2 instance. Application users have recently reported poor performance at specific times. Analysis of Amazon CloudWatch metrics shows that CPU utilization is 100% during the periods of poor performance. The company wants to resolve this performance issue and improve application availability. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)

   • AUse AWS Compute Optimizer to obtain a recommendation for an instance type to scale vertically.
   • BCreate an Amazon Machine Image (AMI) from the web server. Reference the AMI in a new launch template.
   • CCreate an Auto Scaling group and an Application Load Balancer to scale vertically.
   • DUse AWS Compute Optimizer to obtain a recommendation for an instance type to scale horizontally.
   • ECreate an Auto Scaling group and an Application Load Balancer to scale horizontally.

   Show answer

   Answer: AE

   Explanation

   What you should know: 1. Horizontal Scaling (Scaling Out/In): Adding or removing instances to distribute the load across multiple servers, improving availability and fault tolerance. Example: Using an Auto Scaling group with a load balancer to add more EC2 instances dynamically as demand increases. 2. Vertical Scaling (Scaling Up/Down): Increasing or decreasing the size (compute power, memory, etc) of a single instance, which is easier to implement for monolithic applications but has limitations (limited instance types). Example: Upgrading an instance from "t3.medium" to "m5.large". If you can understand above, then A & E are perfect choices. B - The performance issue is still there! C - Auto Scaling and Load Balancers are used for horizontal scaling, not vertical scaling. D - Horizontal scaling involves adding more instances, not changing the instance type.

   Source: Adapted from community discussion — LeonSauveterre

   Next question

5. Question 935 · 1017 in bank

   A company runs all its business applications in the AWS Cloud. The company uses AWS Organizations to manage multiple AWS accounts. A solutions architect needs to review all permissions that are granted to IAM users to determine which IAM users have more permissions than required. Which solution will meet these requirements with the LEAST administrative overhead?

   • AUse Network Access Analyzer to review all access permissions in the company's AWS accounts.
   • BCreate an AWS CloudWatch alarm that activates when an IAM user creates or modifies resources in an AWS account.
   • CUse AWS Identity and Access Management (IAM) Access Analyzer to review all the company’s resources and accounts.
   • DUse Amazon Inspector to find vulnerabilities in existing IAM policies.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

6. Question 936 · 1017 in bank

   A company needs to implement a new data retention policy for regulatory compliance. As part of this policy, sensitive documents that are stored in an Amazon S3 bucket must be protected from deletion or modification for a fixed period of time. Which solution will meet these requirements?

   • AActivate S3 Object Lock on the required objects and enable governance mode.
   • BActivate S3 Object Lock on the required objects and enable compliance mode.
   • CEnable versioning on the S3 bucket. Set a lifecycle policy to delete the objects after a specified period.
   • DConfigure an S3 Lifecycle policy to transition objects to S3 Glacier Flexible Retrieval for the retention duration.

   Show answer

   Answer: B

   Explanation

   S3 Object Lock: - This feature allows you to lock objects in an S3 bucket, preventing them from being deleted or modified for a specified retention period. Compliance mode: - When enabled, S3 Object Lock in compliance mode provides the most stringent protection, ensuring that once an object is locked, even the account root user cannot delete or modify it, making it ideal for regulatory compliance scenarios where data must be preserved for a fixed period

   Source: Adapted from community discussion — JA2018

   Next question

7. Question 937 · 1017 in bank

   A company runs its customer-facing web application on containers. The workload uses Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The web application is resource intensive. The web application needs to be available 24 hours a day, 7 days a week for customers. The company expects the application to experience short bursts of high traffic. The workload must be highly available. Which solution will meet these requirements MOST cost-effectively?

   • AConfigure an ECS capacity provider with Fargate. Conduct load testing by using a third-party tool. Rightsize the Fargate tasks in Amazon CloudWatch.
   • BConfigure an ECS capacity provider with Fargate for steady state and Fargate Spot for burst traffic.
   • CConfigure an ECS capacity provider with Fargate Spot for steady state and Fargate for burst traffic.
   • DConfigure an ECS capacity provider with Fargate. Use AWS Compute Optimizer to rightsize the Fargate task.

   Show answer

   Answer: D

   Explanation

   It's D. Compute Optimizer supports recommendations for Fargate Tasks https://aws.amazon.com/about-aws/whats-new/2022/12/aws-compute-optimizer-amazon-ecs-services-aws-fargate/ Option B and C recommend Spot, but that's not an option since the the question asks for 24x7 availability.

   Source: Adapted from community discussion — Liongeek

   References

   • AWS documentation
   • repost.aws documentation
   • AWS documentation

   Next question

8. Question 938 · 1017 in bank

   A company is building an application in the AWS Cloud. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 for the DNS. The company needs a managed solution with proactive engagement to detect against DDoS attacks. Which solution will meet these requirements?

   • AEnable AWS Config. Configure an AWS Config managed rule that detects DDoS attacks.
   • BEnable AWS WAF on the ALCreate an AWS WAF web ACL with rules to detect and prevent DDoS attacks. Associate the web ACL with the ALB.
   • CStore the ALB access logs in an Amazon S3 bucket. Configure Amazon GuardDuty to detect and take automated preventative actions for DDoS attacks.
   • DSubscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.

   Show answer

   Answer: D

   Explanation

   For your references: 1. AWS WAF (Web Application Firewall) - SQL injections, cross-site scripting (XSS), and other common web exploits. 2. Shield Standard - common DDoS attacks; Shield Advanced - Provides advanced DDoS protection with 24/7 support, cost protection for scaling due to attacks, and more detailed attack analytics. 3. AWS Network Firewall - Blocks unauthorized access and inspect traffic for VPCs. 4. Amazon GuardDuty - Detects threats by analyzing AWS logs like CloudTrail, DNS, and VPC Flow Logs. Identifies potential malicious activities like brute force attacks and data exfiltration. 5. AWS Macie - Helps identify and protect sensitive data like PII stored in S3 buckets.

   Source: Adapted from community discussion — LeonSauveterre

   Next question

9. Question 939 · 1017 in bank

   A company hosts a video streaming web application in a VPC. The company uses a Network Load Balancer (NLB) to handle TCP traffic for real-time data processing. There have been unauthorized attempts to access the application. The company wants to improve application security with minimal architectural change to prevent unauthorized attempts to access the application. Which solution will meet these requirements?

   • AImplement a series of AWS WAF rules directly on the NLB to filter out unauthorized traffic.
   • BRecreate the NLB with a security group to allow only trusted IP addresses.
   • CDeploy a second NLB in parallel with the existing NLB configured with a strict IP address allow list.
   • DUse AWS Shield Advanced to provide enhanced DDoS protection and prevent unauthorized access attempts.

   Show answer

   Answer: B

   Explanation

   Tricky one. About option A > AWS WAF does not support Network Load Balancers (NLBs) directly. NLBs operate at the transport layer (Layer 4), while AWS WAF is designed to work with Application Load Balancers (ALBs) at the application layer (Layer 7).....Given that the requirement is to improve application security for a Network Load Balancer with minimal architectural changes, the most appropriate solution would be Option B

   Source: Adapted from community discussion — Denise123

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 940 · 1017 in bank

    Select 3

    A healthcare company is developing an AWS Lambda function that publishes notifications to an encrypted Amazon Simple Notification Service (Amazon SNS) topic. The notifications contain protected health information (PHI). The SNS topic uses AWS Key Management Service (AWS KMS) customer managed keys for encryption. The company must ensure that the application has the necessary permissions to publish messages securely to the SNS topic. Which combination of steps will meet these requirements? (Choose three.)

    • ACreate a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic.
    • BUse server-side encryption with AWS KMS keys (SSE-KMS) for the SNS topic instead of customer managed keys.
    • CCreate a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions.
    • DSpecify the Lambda function's Amazon Resource Name (ARN) in the SNS topic's resource policy.
    • EAssociate an Amazon API Gateway HTTP API with the SNS topic to control access to the topic by using API Gateway resource policies.
    • FConfigure a Lambda execution role that has the necessary IAM permissions to use a customer managed key in AWS KMS.

    Show answer

    Answer: ACF

    Explanation

    I don't understand why lambda needs KMS to encrypt message. In this scenario, the Lambda function does not need direct permissions to use the KMS key because the encryption and decryption are fully managed by Amazon SNS as part of the SSE-KMS feature. SNS is the only service lambda will talk to, The Lambda interacts with SNS using HTTPS and does not directly deal with the encrypted data or the KMS key. so Lambda only needs the permission to publish messages to the SNS topic. I would like to choose F only if #F answer can be updated as below: F. Configure a Lambda execution role that has the necessary IAM permissions to publish to the SNS topic. A: Create a resource policy for the SNS topic => grants lambda the ability to publish messages to the topic C: The KMS key resource policy must allow SNS to use the key for encryption and decryption. F: Configure the Lambda Execution Role => SNS permissions to publish to the topic

    Source: Adapted from community discussion — EllenLiu

    References

    • AWS documentation
    • repost.aws documentation
    • repost.aws documentation
    • repost.aws documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 931. 1017 questions available.