SAA-C03 practice questions 981–990

1. Question 981 · 1017 in bank

   A company wants to create an Amazon EMR cluster that multiple teams will use. The company wants to ensure that each team’s big data workloads can access only the AWS services that each team needs to interact with. The company does not want the workloads to have access to Instance Metadata Service Version 2 (IMDSv2) on the cluster’s underlying EC2 instances. Which solution will meet these requirements?

   • AConfigure interface VPC endpoints for each AWS service that the teams need. Use the required interface VPC endpoints to submit the big data workloads.
   • BCreate EMR runtime roles. Configure the cluster to use the runtime roles. Use the runtime roles to submit the big data workloads.
   • CCreate an EC2 IAM instance profile that has the required permissions for each team. Use the instance profile to submit the big data workloads.
   • DCreate an EMR security configuration that has the EnableApplicationScopedIAMRole option set to false. Use the security configuration to submit the big data workloads.

   Show answer

   Answer: B

   Explanation

   When you specify a runtime role for an Amazon EMR step, the jobs or queries that you submit can only access AWS resources that the policies attached to the runtime role allow. These jobs and queries can't access the Instance Metadata Service on the EC2 instances of the cluster or use the EC2 instance profile of the cluster to access any AWS resources. https://aws.amazon.com/blogs/big-data/introducing-runtime-roles-for-amazon-emr-steps-use-iam-roles-and-aws-lake-formation-for-access-control-with-amazon-emr/ https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-steps-runtime-roles.html

   Source: Adapted from community discussion — FlyingHawk

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 982 · 1017 in bank

   A solutions architect is designing an application that helps users fill out and submit registration forms. The solutions architect plans to use a two-tier architecture that includes a web application server tier and a worker tier. The application needs to process submitted forms quickly. The application needs to process each form exactly once. The solution must ensure that no data is lost. Which solution will meet these requirements?

   • AUse an Amazon Simple Queue Service (Amazon SQS) FIFO queue between the web application server tier and the worker tier to store and forward form data.
   • BUse an Amazon API Gateway HTTP API between the web application server tier and the worker tier to store and forward form data.
   • CUse an Amazon Simple Queue Service (Amazon SQS) standard queue between the web application server tier and the worker tier to store and forward form data.
   • DUse an AWS Step Functions workflow. Create a synchronous workflow between the web application server tier and the worker tier that stores and forwards form data.

   Show answer

   Answer: A

   Explanation

   Unlike standard queues, FIFO queues don't introduce duplicate messages. FIFO queues help you avoid sending duplicates to a queue. If you retry the SendMessage action within the 5-minute deduplication interval, Amazon SQS doesn't introduce any duplicates into the queue. https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/FIFO-queues-exactly-once-processing.html

   Source: Adapted from community discussion — blehbleh

   References

   • AWS documentation

   Next question

3. Question 983 · 1017 in bank

   A finance company uses an on-premises search application to collect streaming data from various producers. The application provides real-time updates to search and visualization features. The company is planning to migrate to AWS and wants to use an AWS native solution. Which solution will meet these requirements?

   • AUse Amazon EC2 instances to ingest and process the data streams to Amazon S3 buckets tor storage. Use Amazon Athena to search the data. Use Amazon Managed Grafana to create visualizations.
   • BUse Amazon EMR to ingest and process the data streams to Amazon Redshift for storage. Use Amazon Redshift Spectrum to search the data. Use Amazon QuickSight to create visualizations.
   • CUse Amazon Elastic Kubernetes Service (Amazon EKS) to ingest and process the data streams to Amazon DynamoDB for storage. Use Amazon CloudWatch to create graphical dashboards to search and visualize the data.
   • DUse Amazon Kinesis Data Streams to ingest and process the data streams to Amazon OpenSearch Service. Use OpenSearch Service to search the data. Use Amazon QuickSight to create visualizations.

   Show answer

   Answer: D

   Explanation

   Answer is D using Amazon Kinesis Data Streams, Amazon OpenSearch Service, and Amazon QuickSight provides a comprehensive and AWS-native solution that meets the requirements of real-time data ingestion, search, and visualization

   Source: Adapted from community discussion — Gbemi

   Next question

4. Question 984 · 1017 in bank

   A company currently runs an on-premises application that usesASP.NET on Linux machines. The application is resource-intensive and serves customers directly. The company wants to modernize the application to .NET. The company wants to run the application on containers and to scale based on Amazon CloudWatch metrics. The company also wants to reduce the time spent on operational maintenance activities. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse AWS App2Container to containerize the application. Use an AWS CloudFormation template to deploy the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.
   • BUse AWS App2Container to containerize the application. Use an AWS CloudFormation template to deploy the application to Amazon Elastic Container Service (Amazon ECS) on Amazon EC2 instances.
   • CUse AWS App Runner to containerize the application. Use App Runner to deploy the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.
   • DUse AWS App Runner to containerize the application. Use App Runner to deploy the application to Amazon Elastic Kubernetes Service (Amazon EKS) on Amazon EC2 instances.

   Show answer

   Answer: A

   Explanation

   AWS App2Container: This service helps you easily containerize existing applications, such as your ASP.NET application, reducing the complexity of the containerization process. Amazon ECS on AWS Fargate: Fargate is a serverless compute engine for containers that eliminates the need to manage the underlying EC2 instances, significantly reducing operational overhead. You only need to focus on your containerized application, while AWS handles the infrastructure.

   Source: Adapted from community discussion — [Removed]

   Next question

5. Question 985 · 1017 in bank

   A company has a large Microsoft SharePoint deployment running on-premises that requires Microsoft Windows shared file storage. The company wants to migrate this workload to the AWS Cloud and is considering various storage options. The storage solution must be highly available and integrated with Active Directory for access control. Which solution will satisfy these requirements?

   • AConfigure Amazon EFS storage and set the Active Directory domain for authentication.
   • BCreate an SMB file share on an AWS Storage Gateway file gateway in two Availability Zones.
   • CCreate an Amazon S3 bucket and configure Microsoft Windows Server to mount it as a volume.
   • DCreate an Amazon FSx for Windows File Server file system on AWS and set the Active Directory domain for authentication.

   Show answer

   Answer: D

   Explanation

   D. Create an Amazon FSx for Windows File Server file system on AWS and set the Active Directory domain for authentication. Amazon FSx for Windows File Server is a fully managed file storage service that is designed to be used with Microsoft Windows workloads. It is integrated with Active Directory for access control and is highly available, as it stores data across multiple availability zones. Additionally, FSx can be used to migrate data from on-premises Microsoft Windows file servers to the AWS Cloud. This makes it a good fit for the requirements described in the question.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • AWS documentation

   Next question

6. Question 986 · 1017 in bank

   A company is designing a new internal web application in the AWS Cloud. The new application must securely retrieve and store multiple employee usernames and passwords from an AWS managed service. Which solution will meet these requirements with the LEAST operational overhead?

   • AStore the employee credentials in AWS Systems Manager Parameter Store. Use AWS CloudFormation and the BatchGetSecretValue API to retrieve usernames and passwords from Parameter Store.
   • BStore the employee credentials in AWS Secrets Manager. Use AWS CloudFormation and AWS Batch with the BatchGetSecretValue API to retrieve the usernames and passwords from Secrets Manager.
   • CStore the employee credentials in AWS Systems Manager Parameter Store. Use AWS CloudFormation and AWS Batch with the BatchGetSecretValue API to retrieve the usernames and passwords from Parameter Store.
   • DStore the employee credentials in AWS Secrets Manager. Use AWS CloudFormation and the BatchGetSecretValue API to retrieve the usernames and passwords from Secrets Manager.

   Show answer

   Answer: D

   Explanation

   Option D is similar to option B, but option B unnecessarily introduces AWS Batch into the solution. AWS Batch is designed for executing batch jobs and is not required for the use case of retrieving secrets in a web application. This adds complexity and overhead without benefit.

   Source: Adapted from community discussion — JoeTromundo

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 987 · 1017 in bank

   A company that is in the ap-northeast-1 Region has a fleet of thousands of AWS Outposts servers. The company has deployed the servers at remote locations around the world. All the servers regularly download new software versions that consist of 100 files. There is significant latency before all servers run the new software versions. The company must reduce the deployment latency for new software versions. Which solution will meet this requirement with the LEAST operational overhead?

   • ACreate an Amazon S3 bucket in ap-northeast-1. Set up an Amazon CloudFront distribution in ap-northeast-1 that includes a CachingDisabled cache policy. Configure the S3 bucket as the origin. Download the software by using signed URLs.
   • BCreate an Amazon S3 bucket in ap-northeast-1. Create a second S3 bucket in the us-east-1 Region. Configure replication between the buckets. Set up an Amazon CloudFront distribution that uses ap-northeast-1 as the primary origin and us-east-1 as the secondary origin. Download the software by using signed URLs.
   • CCreate an Amazon S3 bucket in ap-northeast-1. Configure Amazon S3 Transfer Acceleration. Download the software by using the S3 Transfer Acceleration endpoint.
   • DCreate an Amazon S3 bucket in ap-northeast-1. Set up an Amazon CloudFront distribution. Configure the S3 bucket as the origin. Download the software by using signed URLs.

   Show answer

   Answer: D

   Explanation

   By setting up a CloudFront distribution with the S3 bucket as the origin, the software versions can be cached at edge locations close to the remote AWS Outposts servers. This reduces the latency of downloading new software versions because the servers can access the content from the nearest CloudFront edge location instead of downloading it directly from the S3 bucket in the ap-northeast-1 Region. About option C: S3 Transfer Acceleration optimizes the upload and download of files to S3 by routing through optimized network paths. However, it is primarily designed to improve performance when transferring data over long distances to S3 (uploads). It does not provide the same level of global caching and latency reduction as CloudFront for large-scale distribution.

   Source: Adapted from community discussion — JoeTromundo

   Next question

8. Question 988 · 1017 in bank

   A company currently runs an on-premises stock trading application by using Microsoft Windows Server. The company wants to migrate the application to the AWS Cloud. The company needs to design a highly available solution that provides low-latency access to block storage across multiple Availability Zones. Which solution will meet these requirements with the LEAST implementation effort?

   • AConfigure a Windows Server cluster that spans two Availability Zones on Amazon EC2 instances. Install the application on both cluster nodes. Use Amazon FSx for Windows File Server as shared storage between the two cluster nodes.
   • BConfigure a Windows Server cluster that spans two Availability Zones on Amazon EC2 instances. Install the application on both cluster nodes. Use Amazon Elastic Block Store (Amazon EBS) General Purpose SSD (gp3) volumes as storage attached to the EC2 instances. Set up application-level replication to sync data from one EBS volume in one Availability Zone to another EBS volume in the second Availability Zone.
   • CDeploy the application on Amazon EC2 instances in two Availability Zones. Configure one EC2 instance as active and the second EC2 instance in standby mode. Use an Amazon FSx for NetApp ONTAP Multi-AZ file system to access the data by using Internet Small Computer Systems Interface (iSCSI) protocol.
   • DDeploy the application on Amazon EC2 instances in two Availability Zones. Configure one EC2 instance as active and the second EC2 instance in standby mode. Use Amazon Elastic Block Store (Amazon EBS) Provisioned IOPS SSD (io2) volumes as storage attached to the EC2 instances. Set up Amazon EBS level replication to sync data from one io2 volume in one Availability Zone to another io2 volume in the second Availability Zone.

   Show answer

   Answer: C

   Explanation

   Using Amazon FSx for Windows File Server would not be the best solution, as the company requires block storage, not file storage. D. Deploying the application on EC2 instances and using Amazon EBS Provisioned IOPS SSD (io2) volumes with EBS-level replication is the solution with the least implementation effort for the following reasons: EBS volumes provide the required block storage for the application. Using EBS-level replication to sync data between Availability Zones is a built-in feature, requiring less implementation effort compared to setting up custom replication mechanisms. Provisioned IOPS SSD (io2) volumes ensure the low-latency access to the block storage required by the application. By using Amazon EBS Provisioned IOPS SSD (io2) volumes with EBS-level replication, the company can meet the requirements for high availability and low-latency access to block storage with the least implementation effort.

   Source: Adapted from community discussion — martinadurcakova1

   Next question

9. Question 989 · 1017 in bank

   Select 3

   A company is designing a web application with an internet-facing Application Load Balancer (ALB). The company needs the ALB to receive HTTPS web traffic from the public internet. The ALB must send only HTTPS traffic to the web application servers hosted on the Amazon EC2 instances on port 443. The ALB must perform a health check of the web application servers over HTTPS on port 8443. Which combination of configurations of the security group that is associated with the ALB will meet these requirements? (Choose three.)

   • AAllow HTTPS inbound traffic from 0.0.0.0/0 for port 443.
   • BAllow all outbound traffic to 0.0.0.0/0 for port 443.
   • CAllow HTTPS outbound traffic to the web application instances for port 443.
   • DAllow HTTPS inbound traffic from the web application instances for port 443.
   • EAllow HTTPS outbound traffic to the web application instances for the health check on port 8443.
   • FAllow HTTPS inbound traffic from the web application instances for the health check on port 8443.

   Show answer

   Answer: ACE

   Explanation

   A. Allow HTTPS inbound traffic from 0.0.0.0/0 for port 443. This allows the ALB to receive HTTPS traffic from the public internet on port 443. C. Allow HTTPS outbound traffic to the web application instances for port 443. This allows the ALB to forward HTTPS traffic to the web application servers on port 443. E. Allow HTTPS outbound traffic to the web application instances for the health check on port 8443. This allows the ALB to perform health checks on the web application servers over HTTPS on port 8443.

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation

   Next question

10. Question 990 · 1017 in bank

    Select 2

    A company hosts an application on AWS. The application gives users the ability to upload photos and store the photos in an Amazon S3 bucket. The company wants to use Amazon CloudFront and a custom domain name to upload the photo files to the S3 bucket in the eu-west-1 Region. Which solution will meet these requirements? (Choose two.)

    • AUse AWS Certificate Manager (ACM) to create a public certificate in the us-east-1 Region. Use the certificate in CloudFront.
    • BUse AWS Certificate Manager (ACM) to create a public certificate in eu-west-1. Use the certificate in CloudFront.
    • CConfigure Amazon S3 to allow uploads from CloudFront. Configure S3 Transfer Acceleration.
    • DConfigure Amazon S3 to allow uploads from CloudFront origin access control (OAC).
    • EConfigure Amazon S3 to allow uploads from CloudFront. Configure an Amazon S3 website endpoint.

    Show answer

    Answer: AD

    Explanation

    Amazon CloudFront requires an SSL/TLS certificate to use HTTPS with a custom domain name. This certificate MUST be provisioned in the us-east-1 Region, regardless of where your content is hosted. This is because CloudFront only supports certificates in the us-east-1 Region for use with custom domain names. Origin Access Control (OAC) is a feature that allows you to securely upload content to an S3 bucket using CloudFront. It provides fine-grained access control and ensures that only CloudFront can upload files to the S3 bucket, preventing direct access. Configuring S3 to allow uploads from CloudFront using OAC ensures that only CloudFront can interact with the S3 bucket, adding an extra layer of security.

    Source: Adapted from community discussion — JoeTromundo

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 981. 1017 questions available.