SAA-C03 practice questions 951–960

1. Question 951 · 1017 in bank

   A company uses an Amazon RDS for MySQL instance. To prepare for end-of-year processing, the company added a read replica to accommodate extra read-only queries from the company's reporting tool. The read replica CPU usage was 60% and the primary instance CPU usage was 60%. After end-of-year activities are complete, the read replica has a constant 25% CPU usage. The primary instance still has a constant 60% CPU usage. The company wants to rightsize the database and still provide enough performance for future growth. Which solution will meet these requirements?

   • ADelete the read replica Do not make changes to the primary instance
   • BResize the read replica to a smaller instance size Do not make changes to the primary instance
   • CResize the read replica to a larger instance size Resize the primary instance to a smaller instance size
   • DDelete the read replica Resize the primary instance to a larger instance

   Show answer

   Answer: B

   Explanation

   Not A or D because they risk future scalability issues during traffic spikes. Moreover, when the end of next year comes, you have to bring back the deleted instance and configure it all over again. As a solutions architect, I wouldn't recommend things like that (personally).

   Source: Adapted from community discussion — LeonSauveterre

   Next question

2. Question 952 · 1017 in bank

   A company is designing an application where users upload small files into Amazon S3. After a user uploads a file, the file requires one-time simple processing to transform the data and save the data in JSON format for later analysis. Each file must be processed as quickly as possible after it is uploaded. Demand will vary. On some days, users will upload a high number of files. On other days, users will upload a few files or no files. Which solution meets these requirements with the LEAST operational overhead?

   • AConfigure Amazon EMR to read text files from Amazon S3. Run processing scripts to transform the data. Store the resulting JSON file in an Amazon Aurora DB cluster.
   • BConfigure Amazon S3 to send an event notification to an Amazon Simple Queue Service (Amazon SQS) queue. Use Amazon EC2 instances to read from the queue and process the data. Store the resulting JSON file in Amazon DynamoDB.
   • CConfigure Amazon S3 to send an event notification to an Amazon Simple Queue Service (Amazon SQS) queue. Use an AWS Lambda function to read from the queue and process the data. Store the resulting JSON file in Amazon DynamoDB.
   • DConfigure Amazon EventBridge (Amazon CloudWatch Events) to send an event to Amazon Kinesis Data Streams when a new file is uploaded. Use an AWS Lambda function to consume the event from the stream and process the data. Store the resulting JSON file in an Amazon Aurora DB cluster.

   Show answer

   Answer: C

   Explanation

   A. Configuring EMR and an Aurora DB cluster for this use case would introduce unnecessary complexity and operational overhead. EMR is typically used for processing large datasets and running big data frameworks like Apache Spark or Hadoop. B. While using S3 event notifications and SQS for decoupling is a good approach, using EC2 to process the data would introduce operational overhead in terms of managing and scaling the EC2. D. Using EventBridge and Kinesis Data Streams for this use case would introduce additional complexity and operational overhead compared to the other options. EventBridge and Kinesis are typically used for real-time streaming and processing of large volumes of data. In summary, option C is the recommended solution as it provides a serverless and scalable approach for processing uploaded files using S3 event notifications, SQS, and Lambda. It offers low operational overhead, automatic scaling, and efficient handling of varying demand. Storing the resulting JSON file in DynamoDB aligns with the requirement of saving the data for later analysis.

   Source: Adapted from community discussion — cookieMr

   Next question

3. Question 953 · 1017 in bank

   A company is migrating its databases to Amazon RDS for PostgreSQL. The company is migrating its applications to Amazon EC2 instances. The company wants to optimize costs for long-running workloads. Which solution will meet this requirement MOST cost-effectively?

   • AUse On-Demand Instances for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year Compute Savings Plan with the No Upfront option for the EC2 instances.
   • BPurchase Reserved Instances for a 1 year term with the No Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year EC2 Instance Savings Plan with the No Upfront option for the EC2 instances.
   • CPurchase Reserved Instances for a 1 year term with the Partial Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year EC2 Instance Savings Plan with the Partial Upfront option for the EC2 instances.
   • DPurchase Reserved Instances for a 3 year term with the All Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 3 year EC2 Instance Savings Plan with the All Upfront option for the EC2 instances.

   Show answer

   Answer: D

   Explanation

   What you should know: 1. No Upfront - Pay nothing at the time of purchase. Payments are spread out monthly over the term (1 or 3 years). Lowest savings with high flexibility. 2. Partial Upfront - Pay a portion of the cost upfront, with reduced monthly payments over the term. Moderate savings with moderate flexibility. 3. All Upfront - Pay the full cost upfront at the time of purchase. No additional payments required during the term. Highest savings with the least flexibility. Merely by the question, option D would be the answer because it's best for companies with a stable workload, long-term commitment, and sufficient budget for upfront payments. Just to add something, generally option C would be the best in real world cases because it strikes a good balance between savings and upfront investment, and uitable for mid-term commitments with moderate budget flexibility.

   Source: Adapted from community discussion — LeonSauveterre

   Next question

4. Question 954 · 1017 in bank

   Select 2

   A company is using an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company must ensure that Kubernetes service accounts in the EKS cluster have secure and granular access to specific AWS resources by using IAM roles for service accounts (IRSA). Which combination of solutions will meet these requirements? (Choose two.)

   • ACreate an IAM policy that defines the required permissions Attach the policy directly to the IAM role of the EKS nodes.
   • BImplement network policies within the EKS cluster to prevent Kubernetes service accounts from accessing specific AWS services.
   • CModify the EKS cluster's IAM role to include permissions for each Kubernetes service account. Ensure a one-to-one mapping between IAM roles and Kubernetes roles.
   • DDefine an IAM role that includes the necessary permissions. Annotate the Kubernetes service accounts with the Amazon ResourceName (ARN) of the IAM role.
   • ESet up a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider.

   Show answer

   Answer: DE

   Explanation

   chatgpt: D. Define an IAM role that includes the necessary permissions. Annotate the Kubernetes service accounts with the Amazon Resource Name (ARN) of the IAM role: Granular Access Control: By defining an IAM role with the necessary permissions and annotating the Kubernetes service accounts with the ARN of this IAM role, you can achieve fine-grained access control for specific AWS resources. This allows each service account to have only the permissions it needs. E. Set up a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider: IRSA Integration: To enable IRSA, your EKS cluster must be associated with an OpenID Connect (OIDC) identity provider. This trust relationship allows Kubernetes service accounts to assume IAM roles, enabling secure and granular access to AWS resources.

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 955 · 1017 in bank

   A company regularly uploads confidential data to Amazon S3 buckets for analysis. The company's security policies mandate that the objects must be encrypted at rest. The company must automatically rotate the encryption key every year. The company must be able to track key rotation by using AWS CloudTrail. The company also must minimize costs for the encryption key. Which solution will meet these requirements?

   • AUse server-side encryption with customer-provided keys (SSE-C)
   • BUse server-side encryption with Amazon S3 managed keys (SSE-S3)
   • CUse server-side encryption with AWS KMS keys (SSE-KMS)
   • DUse server-side encryption with customer managed AWS KMS keys

   Show answer

   Answer: C

   Explanation

   SSE keys provided usage fee application and there is no monthly charges, hence its a correct option. D is highly cost option with monthly and usage fee. which is incorrect.

   Source: Adapted from community discussion — nebajp

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 956 · 1017 in bank

   A company has migrated several applications to AWS in the past 3 months. The company wants to know the breakdown of costs for each of these applications. The company wants to receive a regular report that includes this information. Which solution will meet these requirements MOST cost-effectively?

   • AUse AWS Budgets to download data for the past 3 months into a .csv file. Look up the desired information.
   • BLoad AWS Cost and Usage Reports into an Amazon RDS DB instance. Run SQL queries to get the desired information.
   • CTag all the AWS resources with a key for cost and a value of the application's name. Activate cost allocation tags. Use Cost Explorerto get the desired information.
   • DTag all the AWS resources with a key for cost and a value of the application's name. Use the AWS Billing and Cost Management console todownload bills for the past 3 months. Look up the desired information.

   Show answer

   Answer: C

   Explanation

   - Organizing and tracking costs using AWS cost allocation tags https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html - Cost Explorer uses the same dataset that is used to generate the AWS Cost and Usage Reports and the detailed billing reports. For a comprehensive review of the data, you can download it into a comma-separated value (CSV) file. https://docs.aws.amazon.com/cost-management/latest/userguide/ce-what-is.html

   Source: Adapted from community discussion — spoved

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 957 · 1017 in bank

   An ecommerce company is preparing to deploy a web application on AWS to ensure continuous service for customers. The architecture includes a web application that the company hosts on Amazon EC2 instances, a relational database in Amazon RDS, and static assets that the company stores in Amazon S3. The company wants to design a robust and resilient architecture for the application. Which solution will meet these requirements?

   • ADeploy Amazon EC2 instances in a single Availability Zone. Deploy an RDS DB instance in the same Availability Zone. Use Amazon S3 with versioning enabled to store static assets.
   • BDeploy Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. Deploy a Multi-AZ RDS DB instance. Use Amazon CloudFront to distribute static assets.
   • CDeploy Amazon EC2 instances in a single Availability Zone. Deploy an RDS DB instance in a second Availability Zone for cross-AZ redundancy. Serve static assets directly from the EC2 instances.
   • DUse AWS Lambda functions to serve the web application. Use Amazon Aurora Serverless v2 for the database. Store static assets in Amazon Elastic File System (Amazon EFS) One Zone-Infrequent Access (One Zone-IA).

   Show answer

   Answer: B

   Next question

8. Question 958 · 1017 in bank

   An ecommerce company runs several internal applications in multiple AWS accounts. The company uses AWS Organizations to manage its AWS accounts. A security appliance in the company's networking account must inspect interactions between applications across AWS accounts. Which solution will meet these requirements?

   • ADeploy a Network Load Balancer (NLB) in the networking account to send traffic to the security appliance. Configure the application accounts to send traffic to the NLB by using an interface VPC endpoint in the application accounts.
   • BDeploy an Application Load Balancer (ALB) in the application accounts to send traffic directly to the security appliance.
   • CDeploy a Gateway Load Balancer (GWLB) in the networking account to send traffic to the security appliance. Configure the application accounts to send traffic to the GWLB by using an interface GWLB endpoint in the application accounts.
   • DDeploy an interface VPC endpoint in the application accounts to send traffic directly to the security appliance.

   Show answer

   Answer: C

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 959 · 1017 in bank

   A company runs its production workload on an Amazon Aurora MySQL DB cluster that includes six Aurora Replicas. The company wants near-real-time reporting queries from one of its departments to be automatically distributed across three of the Aurora Replicas. Those three replicas have a different compute and memory specification from the rest of the DB cluster. Which solution meets these requirements?

   • ACreate and use a custom endpoint for the workload
   • BCreate a three-node cluster clone and use the reader endpoint
   • CUse any of the instance endpoints for the selected three nodes
   • DUse the reader endpoint to automatically distribute the read-only workload

   Show answer

   Answer: A

   Explanation

   Custom Endpoints: Custom endpoints in Amazon Aurora allow you to group specific replicas together and route traffic only to those replicas. This is particularly useful when you have replicas with different compute and memory specifications and want to direct specific workloads, such as reporting queries, to those replicas. By creating a custom endpoint, you can include the three specific Aurora Replicas that have the required compute and memory configurations, ensuring that your near-real-time reporting queries are automatically distributed among these replicas.

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation

   Next question

10. Question 960 · 1017 in bank

    A company runs a Node js function on a server in its on-premises data center. The data center stores data in a PostgreSQL database. The company stores the credentials in a connection string in an environment variable on the server. The company wants to migrate its application to AWS and to replace the Node.js application server with AWS Lambda. The company also wants to migrate to Amazon RDS for PostgreSQL and to ensure that the database credentials are securely managed. Which solution will meet these requirements with the LEAST operational overhead?

    • AStore the database credentials as a parameter in AWS Systems Manager Parameter Store Configure Parameter Store to automatically rotate the secrets every 30 days. Update the Lambda function to retrieve the credentials from the parameter.
    • BStore the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret.
    • CStore the database credentials as an encrypted Lambda environment variable. Write a custom Lambda function to rotate the credentials. Schedule the Lambda function to run every 30 days.
    • DStore the database credentials as a key in AWS Key Management Service (AWS KMS). Configure automatic rotation for the key. Update the Lambda function to retneve the credentials from the KMS key.

    Show answer

    Answer: B

    Explanation

    Secrets Manager: AWS Secrets Manager is specifically designed to store and manage sensitive information like database credentials. It provides built-in functionality for securely storing, retrieving, and automatically rotating credentials. Automatic Rotation: Secrets Manager can be configured to automatically rotate the database credentials at regular intervals (e.g., every 30 days). This reduces operational overhead by eliminating the need for manual credential rotation or custom rotation logic. Integration with Lambda: Lambda functions can easily retrieve credentials stored in Secrets Manager by calling the Secrets Manager API, which simplifies the application code and enhances security.

    Source: Adapted from community discussion — [Removed]

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 951. 1017 questions available.