🔍

SAA-C03 — questions

Page 4 of 51 · 1019 total questions.

SAA-C03 Question 61

Single page →
Topic 1 · Question 61

A company is developing a two-tier web application on AWS. The company's developers have deployed the application on an Amazon EC2 instance that connects directly to a backend Amazon RDS database. The company must not hardcode database credentials in the application. The company must also implement a solution to automatically rotate the database credentials on a regular basis. Which solution will meet these requirements with the LEAST operational overhead?

  • AStore the database credentials in the instance metadata. Use Amazon EventBridge (Amazon CloudWatch Events) rules to run a scheduled AWS Lambda function that updates the RDS credentials and instance metadata at the same time.
  • BStore the database credentials in a configuration file in an encrypted Amazon S3 bucket. Use Amazon EventBridge (Amazon CloudWatch Events) rules to run a scheduled AWS Lambda function that updates the RDS credentials and the credentials in the configuration file at the same time. Use S3 Versioning to ensure the ability to fall back to previous values.
  • CStore the database credentials as a secret in AWS Secrets Manager. Turn on automatic rotation for the secret. Attach the required permission to the EC2 role to grant access to the secret. (correct answer)
  • DStore the database credentials as encrypted parameters in AWS Systems Manager Parameter Store. Turn on automatic rotation for the encrypted parameters. Attach the required permission to the EC2 role to grant access to the encrypted parameters.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Store the database credentials as a secret in AWS Secrets Manager. Turn on automatic rotation for the secret. Attach the required permission to the EC2 role to grant access to the secret.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Secrets Manager stores and automatically rotates secrets such as database credentials.

SAA-C03 Question 62

Single page →
Topic 1 · Question 62

A company is deploying a new public web application to AWS. The application will run behind an Application Load Balancer (ALB). The application needs to be encrypted at the edge with an SSL/TLS certificate that is issued by an external certificate authority (CA). The certificate must be rotated each year before the certificate expires. What should a solutions architect do to meet these requirements?

  • AUse AWS Certificate Manager (ACM) to issue an SSL/TLS certificate. Apply the certificate to the ALB. Use the managed renewal feature to automatically rotate the certificate.
  • BUse AWS Certificate Manager (ACM) to issue an SSL/TLS certificate. Import the key material from the certificate. Apply the certificate to the ALUse the managed renewal feature to automatically rotate the certificate.
  • CUse AWS Certificate Manager (ACM) Private Certificate Authority to issue an SSL/TLS certificate from the root CA. Apply the certificate to the ALB. Use the managed renewal feature to automatically rotate the certificate.
  • DUse AWS Certificate Manager (ACM) to import an SSL/TLS certificate. Apply the certificate to the ALB. Use Amazon EventBridge (Amazon CloudWatch Events) to send a notification when the certificate is nearing expiration. Rotate the certificate manually. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use AWS Certificate Manager (ACM) to import an SSL/TLS certificate. Apply the certificate to the ALB. Use Amazon EventBridge (Amazon CloudWatch Events) to send a notification when the certificate is nearing expiration...

Explanation

Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Certificate Manager provisions and renews TLS certificates automatically. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SAA-C03 Question 63

Single page →
Topic 1 · Question 63

A company runs its infrastructure on AWS and has a registered base of 700,000 users for its document management application. The company intends to create a product that converts large .pdf files to .jpg image files. The .pdf files average 5 MB in size. The company needs to store the original files and the converted files. A solutions architect must design a scalable solution to accommodate demand that will grow rapidly over time. Which solution meets these requirements MOST cost-effectively?

  • ASave the .pdf files to Amazon S3. Configure an S3 PUT event to invoke an AWS Lambda function to convert the files to .jpg format and store them back in Amazon S3. (correct answer)
  • BSave the .pdf files to Amazon DynamoDUse the DynamoDB Streams feature to invoke an AWS Lambda function to convert the files to .jpg format and store them back in DynamoDB.
  • CUpload the .pdf files to an AWS Elastic Beanstalk application that includes Amazon EC2 instances, Amazon Elastic Block Store (Amazon EBS) storage, and an Auto Scaling group. Use a program in the EC2 instances to convert the files to .jpg format. Save the .pdf files and the .jpg files in the EBS store.
  • DUpload the .pdf files to an AWS Elastic Beanstalk application that includes Amazon EC2 instances, Amazon Elastic File System (Amazon EFS) storage, and an Auto Scaling group. Use a program in the EC2 instances to convert the file to .jpg format. Save the .pdf files and the .jpg files in the EBS store.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Save the.pdf files to Amazon S3. Configure an S3 PUT event to invoke an AWS Lambda function to convert the files to.jpg format and store them back in Amazon S3.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

SAA-C03 Question 64

Single page →
Topic 1 · Question 64

A company has more than 5 TB of file data on Windows file servers that run on premises. Users and applications interact with the data each day. The company is moving its Windows workloads to AWS. As the company continues this process, the company requires access to AWS and on-premises file storage with minimum latency. The company needs a solution that minimizes operational overhead and requires no significant changes to the existing file access patterns. The company uses an AWS Site-to-Site VPN connection for connectivity to AWS. What should a solutions architect do to meet these requirements?

  • ADeploy and configure Amazon FSx for Windows File Server on AWS. Move the on-premises file data to FSx for Windows File Server. Reconfigure the workloads to use FSx for Windows File Server on AWS.
  • BDeploy and configure an Amazon S3 File Gateway on premises. Move the on-premises file data to the S3 File Gateway. Reconfigure the on-premises workloads and the cloud workloads to use the S3 File Gateway.
  • CDeploy and configure an Amazon S3 File Gateway on premises. Move the on-premises file data to Amazon S3. Reconfigure the workloads to use either Amazon S3 directly or the S3 File Gateway. depending on each workload's location.
  • DDeploy and configure Amazon FSx for Windows File Server on AWS. Deploy and configure an Amazon FSx File Gateway on premises. Move the on-premises file data to the FSx File Gateway. Configure the cloud workloads to use FSx for Windows File Server on AWS. Configure the on-premises workloads to use the FSx File Gateway. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Deploy and configure Amazon FSx for Windows File Server on AWS. Deploy and configure an Amazon FSx File Gateway on premises. Move the on-premises file data to the FSx File Gateway. Configure the cloud workloads to use...

Explanation

Amazon FSx for Windows File Server provides fully managed SMB/Windows shared file storage. Amazon FSx provides fully managed third-party file systems. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 65

Single page →
Topic 1 · Question 65

A hospital recently deployed a RESTful API with Amazon API Gateway and AWS Lambda. The hospital uses API Gateway and Lambda to upload reports that are in PDF format and JPEG format. The hospital needs to modify the Lambda code to identify protected health information (PHI) in the reports. Which solution will meet these requirements with the LEAST operational overhead?

  • AUse existing Python libraries to extract the text from the reports and to identify the PHI from the extracted text.
  • BUse Amazon Textract to extract the text from the reports. Use Amazon SageMaker to identify the PHI from the extracted text.
  • CUse Amazon Textract to extract the text from the reports. Use Amazon Comprehend Medical to identify the PHI from the extracted text. (correct answer)
  • DUse Amazon Rekognition to extract the text from the reports. Use Amazon Comprehend Medical to identify the PHI from the extracted text.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use Amazon Textract to extract the text from the reports. Use Amazon Comprehend Medical to identify the PHI from the extracted text.

Explanation

Amazon Comprehend extracts insights and entities from text using NLP. Amazon Textract extracts text and data from scanned documents.

SAA-C03 Question 66

Single page →
Topic 1 · Question 66

A company has an application that generates a large number of files, each approximately 5 MB in size. The files are stored in Amazon S3. Company policy requires the files to be stored for 4 years before they can be deleted. Immediate accessibility is always required as the files contain critical business data that is not easy to reproduce. The files are frequently accessed in the first 30 days of the object creation but are rarely accessed after the first 30 days. Which storage solution is MOST cost-effective?

  • ACreate an S3 bucket lifecycle policy to move files from S3 Standard to S3 Glacier 30 days from object creation. Delete the files 4 years after object creation.
  • BCreate an S3 bucket lifecycle policy to move files from S3 Standard to S3 One Zone-Infrequent Access (S3 One Zone-IA) 30 days from object creation. Delete the files 4 years after object creation.
  • CCreate an S3 bucket lifecycle policy to move files from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) 30 days from object creation. Delete the files 4 years after object creation. (correct answer)
  • DCreate an S3 bucket lifecycle policy to move files from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) 30 days from object creation. Move the files to S3 Glacier 4 years after object creation.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an S3 bucket lifecycle policy to move files from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) 30 days from object creation. Delete the files 4 years after object creation.

Explanation

S3 Standard-IA reduces cost for infrequently accessed data that still needs high availability. Amazon S3 provides durable, scalable object storage that is fully managed. This option delivers the requirement at the lowest cost.

SAA-C03 Question 67

Single page →
Topic 1 · Question 67

A company hosts an application on multiple Amazon EC2 instances. The application processes messages from an Amazon SQS queue, writes to an Amazon RDS table, and deletes the message from the queue. Occasional duplicate records are found in the RDS table. The SQS queue does not contain any duplicate messages. What should a solutions architect do to ensure messages are being processed once only?

  • AUse the CreateQueue API call to create a new queue.
  • BUse the AddPermission API call to add appropriate permissions.
  • CUse the ReceiveMessage API call to set an appropriate wait time.
  • DUse the ChangeMessageVisibility API call to increase the visibility timeout. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use the ChangeMessageVisibility API call to increase the visibility timeout.

SAA-C03 Question 68

Single page →
Topic 1 · Question 68

A solutions architect is designing a new hybrid architecture to extend a company's on-premises infrastructure to AWS. The company requires a highly available connection with consistent low latency to an AWS Region. The company needs to minimize costs and is willing to accept slower traffic if the primary connection fails. What should the solutions architect do to meet these requirements?

  • AProvision an AWS Direct Connect connection to a Region. Provision a VPN connection as a backup if the primary Direct Connect connection fails. (correct answer)
  • BProvision a VPN tunnel connection to a Region for private connectivity. Provision a second VPN tunnel for private connectivity and as a backup if the primary VPN connection fails.
  • CProvision an AWS Direct Connect connection to a Region. Provision a second Direct Connect connection to the same Region as a backup if the primary Direct Connect connection fails.
  • DProvision an AWS Direct Connect connection to a Region. Use the Direct Connect failover attribute from the AWS CLI to automatically create a backup connection if the primary Direct Connect connection fails.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Provision an AWS Direct Connect connection to a Region. Provision a VPN connection as a backup if the primary Direct Connect connection fails.

Explanation

AWS Backup centrally automates and manages backups across AWS services. AWS Direct Connect provides a dedicated, consistent private network link between on premises and AWS. This option delivers the requirement at the lowest cost.

SAA-C03 Question 69

Single page →
Topic 1 · Question 69

A company is running a business-critical web application on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances are in an Auto Scaling group. The application uses an Amazon Aurora PostgreSQL database that is deployed in a single Availability Zone. The company wants the application to be highly available with minimum downtime and minimum loss of data. Which solution will meet these requirements with the LEAST operational effort?

  • APlace the EC2 instances in different AWS Regions. Use Amazon Route 53 health checks to redirect traffic. Use Aurora PostgreSQL Cross-Region Replication.
  • BConfigure the Auto Scaling group to use multiple Availability Zones. Configure the database as Multi-AZ. Configure an Amazon RDS Proxy instance for the database. (correct answer)
  • CConfigure the Auto Scaling group to use one Availability Zone. Generate hourly snapshots of the database. Recover the database from the snapshots in the event of a failure.
  • DConfigure the Auto Scaling group to use multiple AWS Regions. Write the data from the application to Amazon S3. Use S3 Event Notifications to launch an AWS Lambda function to write the data to the database.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure the Auto Scaling group to use multiple Availability Zones. Configure the database as Multi-AZ. Configure an Amazon RDS Proxy instance for the database.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon RDS Proxy pools and shares database connections to improve scalability and resilience. Amazon RDS is a managed relational database that handles patching, backups and failover.

SAA-C03 Question 70

Single page →
Topic 1 · Question 70

A company's HTTP application is behind a Network Load Balancer (NLB). The NLB's target group is configured to use an Amazon EC2 Auto Scaling group with multiple EC2 instances that run the web service. The company notices that the NLB is not detecting HTTP errors for the application. These errors require a manual restart of the EC2 instances that run the web service. The company needs to improve the application's availability without writing custom scripts or code. What should a solutions architect do to meet these requirements?

  • AEnable HTTP health checks on the NLB, supplying the URL of the company's application.
  • BAdd a cron job to the EC2 instances to check the local application's logs once each minute. If HTTP errors are detected. the application will restart.
  • CReplace the NLB with an Application Load Balancer. Enable HTTP health checks by supplying the URL of the company's application. Configure an Auto Scaling action to replace unhealthy instances. (correct answer)
  • DCreate an Amazon Cloud Watch alarm that monitors the UnhealthyHostCount metric for the NLB. Configure an Auto Scaling action to replace unhealthy instances when the alarm is in the ALARM state.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Replace the NLB with an Application Load Balancer. Enable HTTP health checks by supplying the URL of the company's application. Configure an Auto Scaling action to replace unhealthy instances.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale. This option needs the least custom development effort.

SAA-C03 Question 71

Single page →
Topic 1 · Question 71

A company runs a shopping application that uses Amazon DynamoDB to store customer information. In case of data corruption, a solutions architect needs to design a solution that meets a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 1 hour. What should the solutions architect recommend to meet these requirements?

  • AConfigure DynamoDB global tables. For RPO recovery, point the application to a different AWS Region.
  • BConfigure DynamoDB point-in-time recovery. For RPO recovery, restore to the desired point in time. (correct answer)
  • CExport the DynamoDB data to Amazon S3 Glacier on a daily basis. For RPO recovery, import the data from S3 Glacier to DynamoDB.
  • DSchedule Amazon Elastic Block Store (Amazon EBS) snapshots for the DynamoDB table every 15 minutes. For RPO recovery, restore the DynamoDB table by using the EBS snapshot.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure DynamoDB point-in-time recovery. For RPO recovery, restore to the desired point in time.

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 72

Single page →
Topic 1 · Question 72

A company runs a photo processing application that needs to frequently upload and download pictures from Amazon S3 buckets that are located in the same AWS Region. A solutions architect has noticed an increased cost in data transfer fees and needs to implement a solution to reduce these costs. How can the solutions architect meet this requirement?

  • ADeploy Amazon API Gateway into a public subnet and adjust the route table to route S3 calls through it.
  • BDeploy a NAT gateway into a public subnet and attach an endpoint policy that allows access to the S3 buckets.
  • CDeploy the application into a public subnet and allow it to route through an internet gateway to access the S3 buckets.
  • DDeploy an S3 VPC gateway endpoint into the VPC and attach an endpoint policy that allows access to the S3 buckets. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Deploy an S3 VPC gateway endpoint into the VPC and attach an endpoint policy that allows access to the S3 buckets.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SAA-C03 Question 73

Single page →
Topic 1 · Question 73 · Select all that apply

A company recently launched Linux-based application instances on Amazon EC2 in a private subnet and launched a Linux-based bastion host on an Amazon EC2 instance in a public subnet of a VPC. A solutions architect needs to connect from the on-premises network, through the company's internet connection, to the bastion host, and to the application servers. The solutions architect must make sure that the security groups of all the EC2 instances will allow that access. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

  • AReplace the current security group of the bastion host with one that only allows inbound access from the application instances.
  • BReplace the current security group of the bastion host with one that only allows inbound access from the internal IP range for the company.
  • CReplace the current security group of the bastion host with one that only allows inbound access from the external IP range for the company. (correct answer)
  • DReplace the current security group of the application instances with one that allows inbound SSH access from only the private IP address of the bastion host. (correct answer)
  • EReplace the current security group of the application instances with one that allows inbound SSH access from only the public IP address of the bastion host.
Reveal answer & explanation
Correct answer: C, D

The correct answer is C, D. Option C: Replace the current security group of the bastion host with one that only allows inbound access from the external IP range for the company. Option D: Replace the current security group of the application instances with one that allows inbound SSH access from only the private IP address of the bastion host.

SAA-C03 Question 74

Single page →
Topic 1 · Question 74 · Select all that apply

A solutions architect is designing a two-tier web application. The application consists of a public-facing web tier hosted on Amazon EC2 in public subnets. The database tier consists of Microsoft SQL Server running on Amazon EC2 in a private subnet. Security is a high priority for the company. How should security groups be configured in this situation? (Choose two.)

  • AConfigure the security group for the web tier to allow inbound traffic on port 443 from 0.0.0.0/0. (correct answer)
  • BConfigure the security group for the web tier to allow outbound traffic on port 443 from 0.0.0.0/0.
  • CConfigure the security group for the database tier to allow inbound traffic on port 1433 from the security group for the web tier. (correct answer)
  • DConfigure the security group for the database tier to allow outbound traffic on ports 443 and 1433 to the security group for the web tier.
  • EConfigure the security group for the database tier to allow inbound traffic on ports 443 and 1433 from the security group for the web tier.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Configure the security group for the web tier to allow inbound traffic on port 443 from 0.0.0.0/0. Option C: Configure the security group for the database tier to allow inbound traffic on port 1433 from the security group for the web tier.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 75

Single page →
Topic 1 · Question 75

A company wants to move a multi-tiered application from on premises to the AWS Cloud to improve the application's performance. The application consists of application tiers that communicate with each other by way of RESTful services. Transactions are dropped when one tier becomes overloaded. A solutions architect must design a solution that resolves these issues and modernizes the application. Which solution meets these requirements and is the MOST operationally efficient?

  • AUse Amazon API Gateway and direct transactions to the AWS Lambda functions as the application layer. Use Amazon Simple Queue Service (Amazon SQS) as the communication layer between application services. (correct answer)
  • BUse Amazon CloudWatch metrics to analyze the application performance history to determine the servers' peak utilization during the performance failures. Increase the size of the application server's Amazon EC2 instances to meet the peak requirements.
  • CUse Amazon Simple Notification Service (Amazon SNS) to handle the messaging between application servers running on Amazon EC2 in an Auto Scaling group. Use Amazon CloudWatch to monitor the SNS queue length and scale up and down as required.
  • DUse Amazon Simple Queue Service (Amazon SQS) to handle the messaging between application servers running on Amazon EC2 in an Auto Scaling group. Use Amazon CloudWatch to monitor the SQS queue length and scale up when communication failures are detected.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use Amazon API Gateway and direct transactions to the AWS Lambda functions as the application layer. Use Amazon Simple Queue Service (Amazon SQS) as the communication layer between application services.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes. Amazon API Gateway is a fully managed front door for creating and securing APIs at scale.

SAA-C03 Question 76

Single page →
Topic 1 · Question 76

A company receives 10 TB of instrumentation data each day from several machines located at a single factory. The data consists of JSON files stored on a storage area network (SAN) in an on-premises data center located within the factory. The company wants to send this data to Amazon S3 where it can be accessed by several additional systems that provide critical near-real-time analytics. A secure transfer is important because the data is considered sensitive. Which solution offers the MOST reliable data transfer?

  • AAWS DataSync over public internet
  • BAWS DataSync over AWS Direct Connect (correct answer)
  • CAWS Database Migration Service (AWS DMS) over public internet
  • DAWS Database Migration Service (AWS DMS) over AWS Direct Connect
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: AWS DataSync over AWS Direct Connect

Explanation

AWS DataSync automates and accelerates online data transfer to AWS with minimal effort. AWS Direct Connect provides a dedicated, consistent private network link between on premises and AWS. This option meets the real-time / low-latency performance requirement.

SAA-C03 Question 77

Single page →
Topic 1 · Question 77

A company needs to configure a real-time data ingestion architecture for its application. The company needs an API, a process that transforms data as the data is streamed, and a storage solution for the data. Which solution will meet these requirements with the LEAST operational overhead?

  • ADeploy an Amazon EC2 instance to host an API that sends data to an Amazon Kinesis data stream. Create an Amazon Kinesis Data Firehose delivery stream that uses the Kinesis data stream as a data source. Use AWS Lambda functions to transform the data. Use the Kinesis Data Firehose delivery stream to send the data to Amazon S3.
  • BDeploy an Amazon EC2 instance to host an API that sends data to AWS Glue. Stop source/destination checking on the EC2 instance. Use AWS Glue to transform the data and to send the data to Amazon S3.
  • CConfigure an Amazon API Gateway API to send data to an Amazon Kinesis data stream. Create an Amazon Kinesis Data Firehose delivery stream that uses the Kinesis data stream as a data source. Use AWS Lambda functions to transform the data. Use the Kinesis Data Firehose delivery stream to send the data to Amazon S3. (correct answer)
  • DConfigure an Amazon API Gateway API to send data to AWS Glue. Use AWS Lambda functions to transform the data. Use AWS Glue to send the data to Amazon S3.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure an Amazon API Gateway API to send data to an Amazon Kinesis data stream. Create an Amazon Kinesis Data Firehose delivery stream that uses the Kinesis data stream as a data source. Use AWS Lambda functions to...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. Kinesis Data Firehose delivers streaming data to destinations like S3/Redshift with no servers to manage.

SAA-C03 Question 78

Single page →
Topic 1 · Question 78

A company needs to keep user transaction data in an Amazon DynamoDB table. The company must retain the data for 7 years. What is the MOST operationally efficient solution that meets these requirements?

  • AUse DynamoDB point-in-time recovery to back up the table continuously.
  • BUse AWS Backup to create backup schedules and retention policies for the table. (correct answer)
  • CCreate an on-demand backup of the table by using the DynamoDB console. Store the backup in an Amazon S3 bucket. Set an S3 Lifecycle configuration for the S3 bucket.
  • DCreate an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function. Configure the Lambda function to back up the table and to store the backup in an Amazon S3 bucket. Set an S3 Lifecycle configuration for the S3 bucket.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use AWS Backup to create backup schedules and retention policies for the table.

Explanation

AWS Backup centrally automates and manages backups across AWS services.

SAA-C03 Question 79

Single page →
Topic 1 · Question 79

A company is planning to use an Amazon DynamoDB table for data storage. The company is concerned about cost optimization. The table will not be used on most mornings. In the evenings, the read and write traffic will often be unpredictable. When traffic spikes occur, they will happen very quickly. What should a solutions architect recommend?

  • ACreate a DynamoDB table in on-demand capacity mode. (correct answer)
  • BCreate a DynamoDB table with a global secondary index.
  • CCreate a DynamoDB table with provisioned capacity and auto scaling.
  • DCreate a DynamoDB table in provisioned capacity mode, and configure it as a global table.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a DynamoDB table in on-demand capacity mode.

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. This option decouples the components so they scale independently and absorb load spikes.

SAA-C03 Question 80

Single page →
Topic 1 · Question 80

A company recently signed a contract with an AWS Managed Service Provider (MSP) Partner for help with an application migration initiative. A solutions architect needs ta share an Amazon Machine Image (AMI) from an existing AWS account with the MSP Partner's AWS account. The AMI is backed by Amazon Elastic Block Store (Amazon EBS) and uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt EBS volume snapshots. What is the MOST secure way for the solutions architect to share the AMI with the MSP Partner's AWS account?

  • AMake the encrypted AMI and snapshots publicly available. Modify the key policy to allow the MSP Partner's AWS account to use the key.
  • BModify the launchPermission property of the AMI. Share the AMI with the MSP Partner's AWS account only. Modify the key policy to allow the MSP Partner's AWS account to use the key. (correct answer)
  • CModify the launchPermission property of the AMI. Share the AMI with the MSP Partner's AWS account only. Modify the key policy to trust a new KMS key that is owned by the MSP Partner for encryption.
  • DExport the AMI from the source account to an Amazon S3 bucket in the MSP Partner's AWS account, Encrypt the S3 bucket with a new KMS key that is owned by the MSP Partner. Copy and launch the AMI in the MSP Partner's AWS account.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Modify the launchPermission property of the AMI. Share the AMI with the MSP Partner's AWS account only. Modify the key policy to allow the MSP Partner's AWS account to use the key.

Showing questions 61–80 of 1019 · Page 4 of 51