🔍

SAA-C03 — questions

Page 51 of 51 · 1019 total questions.

SAA-C03 Question 1001

Single page →
Topic 1 · Question 1001

A company operates a food delivery service. Because of recent growth, the company's order processing system is experiencing scaling problems during peak traffic hours. The current architecture includes Amazon EC2 instances in an Auto Scaling group that collect orders from an application. A second group of EC2 instances in an Auto Scaling group fulfills the orders. The order collection process occurs quickly, but the order fulfillment process can take longer. Data must not be lost because of a scaling event. A solutions architect must ensure that the order collection process and the order fulfillment process can both scale adequately during peak traffic hours. Which solution will meet these requirements?

  • AUse Amazon CloudWatch to monitor the CPUUtilization metric for each instance in both Auto Scaling groups. Configure each Auto Scaling group's minimum capacity to meet its peak workload value.
  • BUse Amazon CloudWatch to monitor the CPUUtilization metric for each instance in both Auto Scaling groups. Configure a CloudWatch alarm to invoke an Amazon Simple Notification Service (Amazon SNS) topic to create additional Auto Scaling groups on demand.
  • CProvision two Amazon Simple Queue Service (Amazon SQS) queues. Use one SQS queue for order collection. Use the second SQS queue for order fulfillment. Configure the EC2 instances to poll their respective queues. Scale the Auto Scaling groups based on notifications that the queues send.
  • DProvision two Amazon Simple Queue Service (Amazon SQS) queues. Use one SQS queue for order collection. Use the second SQS queue for order fulfillment. Configure the EC2 instances to poll their respective queues. Scale the Auto Scaling groups based on the number of messages in each queue. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Provision two Amazon Simple Queue Service (Amazon SQS) queues. Use one SQS queue for order collection. Use the second SQS queue for order fulfillment. Configure the EC2 instances to poll their respective queues. Scale...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes.

SAA-C03 Question 1002

Single page →
Topic 1 · Question 1002

An online gaming company is transitioning user data storage to Amazon DynamoDB to support the company's growing user base. The current architecture includes DynamoDB tables that contain user profiles, achievements, and in-game transactions. The company needs to design a robust, continuously available, and resilient DynamoDB architecture to maintain a seamless gaming experience for users. Which solution will meet these requirements MOST cost-effectively?

  • ACreate DynamoDB tables in a single AWS Region. Use on-demand capacity mode. Use global tables to replicate data across multiple Regions.
  • BUse DynamoDB Accelerator (DAX) to cache frequently accessed data. Deploy tables in a single AWS Region and enable auto scaling. Configure Cross-Region Replication manually to additional Regions.
  • CCreate DynamoDB tables in multiple AWS Regions. Use on-demand capacity mode. Use DynamoDB Streams for Cross-Region Replication between Regions.
  • DUse DynamoDB global tables for automatic multi-Region replication. Deploy tables in multiple AWS Regions. Use provisioned capacity mode. Enable auto scaling. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use DynamoDB global tables for automatic multi-Region replication. Deploy tables in multiple AWS Regions. Use provisioned capacity mode. Enable auto scaling.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. This option delivers the requirement at the lowest cost.

SAA-C03 Question 1003

Single page →
Topic 1 · Question 1003

A company runs its media rendering application on premises. The company wants to reduce storage costs and has moved all data to Amazon S3. The on-premises rendering application needs low-latency access to storage. The company needs to design a storage solution for the application. The storage solution must maintain the desired application performance. Which storage solution will meet these requirements in the MOST cost-effective way?

  • AUse Mountpoint for Amazon S3 to access the data in Amazon S3 for the on-premises application.
  • BConfigure an Amazon S3 File Gateway to provide storage for the on-premises application. (correct answer)
  • CCopy the data from Amazon S3 to Amazon FSx for Windows File Server. Configure an Amazon FSx File Gateway to provide storage for the on-premises application.
  • DConfigure an on-premises file server. Use the Amazon S3 API to connect to S3 storage. Configure the application to access the storage from the on-premises file server.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure an Amazon S3 File Gateway to provide storage for the on-premises application.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. S3 File Gateway presents S3 as an NFS/SMB file share to on-premises applications. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

SAA-C03 Question 1004

Single page →
Topic 1 · Question 1004

A company hosts its enterprise resource planning (ERP) system in the us-east-1 Region. The system runs on Amazon EC2 instances. Customers use a public API that is hosted on the EC2 instances to exchange information with the ERP system. International customers report slow API response times from their data centers. Which solution will improve response times for the international customers MOST cost-effectively?

  • ACreate an AWS Direct Connect connection that has a public virtual interface (VIF) to provide connectivity from each customer's data center to us-east-1. Route customer API requests by using a Direct Connect gateway to the ERP system API.
  • BSet up an Amazon CloudFront distribution in front of the API. Configure the CachingOptimized managed cache policy to provide improved cache efficiency.
  • CSet up AWS Global Accelerator. Configure listeners for the necessary ports. Configure endpoint groups for the appropriate Regions to distribute traffic. Create an endpoint in the group for the API. (correct answer)
  • DUse AWS Site-to-Site VPN to establish dedicated VPN tunnels between Regions and customer networks. Route traffic to the API over the VPN connections.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Set up AWS Global Accelerator. Configure listeners for the necessary ports. Configure endpoint groups for the appropriate Regions to distribute traffic. Create an endpoint in the group for the API.

Explanation

AWS Global Accelerator routes users over the AWS backbone to the optimal endpoint for lower latency and fast failover. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

SAA-C03 Question 1005

Single page →
Topic 1 · Question 1005

A company tracks customer satisfaction by using surveys that the company hosts on its website. The surveys sometimes reach thousands of customers every hour. Survey results are currently sent in email messages to the company so company employees can manually review results and assess customer sentiment. The company wants to automate the customer survey process. Survey results must be available for the previous 12 months. Which solution will meet these requirements in the MOST scalable way?

  • ASend the survey results data to an Amazon API Gateway endpoint that is connected to an Amazon Simple Queue Service (Amazon SQS) queue. Create an AWS Lambda function to poll the SQS queue, call Amazon Comprehend for sentiment analysis, and save the results to an Amazon DynamoDB table. Set the TTL for all records to 365 days in the future. (correct answer)
  • BSend the survey results data to an API that is running on an Amazon EC2 instance. Configure the API to store the survey results as a new record in an Amazon DynamoDB table, call Amazon Comprehend for sentiment analysis, and save the results in a second DynamoDB table. Set the TTL for all records to 365 days in the future.
  • CWrite the survey results data to an Amazon S3 bucket. Use S3 Event Notifications to invoke an AWS Lambda function to read the data and call Amazon Rekognition for sentiment analysis. Store the sentiment analysis results in a second S3 bucket. Use S3 lifecycle policies on each bucket to expire objects after 365 days.
  • DSend the survey results data to an Amazon API Gateway endpoint that is connected to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the SQS queue to invoke an AWS Lambda function that calls Amazon Lex for sentiment analysis and saves the results to an Amazon DynamoDB table. Set the TTL for all records to 365 days in the future.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Send the survey results data to an Amazon API Gateway endpoint that is connected to an Amazon Simple Queue Service (Amazon SQS) queue. Create an AWS Lambda function to poll the SQS queue, call Amazon Comprehend for se...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. Amazon RDS is a managed relational database that handles patching, backups and failover.

SAA-C03 Question 1006

Single page →
Topic 1 · Question 1006 · Select all that apply

A company uses AWS Systems Manager for routine management and patching of Amazon EC2 instances. The EC2 instances are in an IP address type target group behind an Application Load Balancer (ALB). New security protocols require the company to remove EC2 instances from service during a patch. When the company attempts to follow the security protocol during the next patch, the company receives errors during the patching window. Which combination of solutions will resolve the errors? (Choose two.)

  • AChange the target type of the target group from IP address type to instance type.
  • BContinue to use the existing Systems Manager document without changes because it is already optimized to handle instances that are in an IP address type target group behind an ALB.
  • CImplement the AWSEC2-PatchLoadBalanacerInstance Systems Manager Automation document to manage the patching process. (correct answer)
  • DUse Systems Manager Maintenance Windows to automatically remove the instances from service to patch the instances. (correct answer)
  • EConfigure Systems Manager State Manager to remove the instances from service and manage the patching schedule. Use ALB health checks to re-route traffic.
Reveal answer & explanation
Correct answer: C, D

The correct answer is C, D. Option C: Implement the AWSEC2-PatchLoadBalanacerInstance Systems Manager Automation document to manage the patching process. Option D: Use Systems Manager Maintenance Windows to automatically remove the instances from service to patch the instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Systems Manager operates and automates management of fleets of resources.

SAA-C03 Question 1007

Single page →
Topic 1 · Question 1007

A medical company wants to perform transformations on a large amount of clinical trial data that comes from several customers. The company must extract the data from a relational database that contains the customer data. Then the company will transform the data by using a series of complex rules. The company will load the data to Amazon S3 when the transformations are complete. All data must be encrypted where it is processed before the company stores the data in Amazon S3. All data must be encrypted by using customer-specific keys. Which solution will meet these requirements with the LEAST amount of operational effort?

  • ACreate one AWS Glue job for each customer. Attach a security configuration to each job that uses server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data.
  • BCreate one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses client-side encryption with a custom client-side root key (CSE-Custom) to encrypt the data.
  • CCreate one AWS Glue job for each customer. Attach a security configuration to each job that uses client-side encryption with AWS KMS managed keys (CSE-KMS) to encrypt the data. (correct answer)
  • DCreate one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create one AWS Glue job for each customer. Attach a security configuration to each job that uses client-side encryption with AWS KMS managed keys (CSE-KMS) to encrypt the data.

Explanation

AWS Glue is a serverless ETL and data-catalog service that prepares and integrates data. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 1008

Single page →
Topic 1 · Question 1008

A company hosts a website analytics application on a single Amazon EC2 On-Demand Instance. The analytics application is highly resilient and is designed to run in stateless mode. The company notices that the application is showing signs of performance degradation during busy times and is presenting 5xx errors. The company needs to make the application scale seamlessly. Which solution will meet these requirements MOST cost-effectively?

  • ACreate an Amazon Machine Image (AMI) of the web application. Use the AMI to launch a second EC2 On-Demand Instance. Use an Application Load Balancer to distribute the load across the two EC2 instances.
  • BCreate an Amazon Machine Image (AMI) of the web application. Use the AMI to launch a second EC2 On-Demand Instance. Use Amazon Route 53 weighted routing to distribute the load across the two EC2 instances.
  • CCreate an AWS Lambda function to stop the EC2 instance and change the instance type. Create an Amazon CloudWatch alarm to invoke the Lambda function when CPU utilization is more than 75%.
  • DCreate an Amazon Machine Image (AMI) of the web application. Apply the AMI to a launch template. Create an Auto Scaling group that includes the launch template. Configure the launch template to use a Spot Fleet. Attach an Application Load Balancer to the Auto Scaling group. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create an Amazon Machine Image (AMI) of the web application. Apply the AMI to a launch template. Create an Auto Scaling group that includes the launch template. Configure the launch template to use a Spot Fleet. Attac...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale. This option delivers the requirement at the lowest cost.

SAA-C03 Question 1009

Single page →
Topic 1 · Question 1009

A company runs an environment where data is stored in an Amazon S3 bucket. The objects are accessed frequently throughout the day. The company has strict da ta encryption requirements for data that is stored in the S3 bucket. The company currently uses AWS Key Management Service (AWS KMS) for encryption. The company wants to optimize costs associated with encrypting S3 objects without making additional calls to AWS KMS. Which solution will meet these requirements?

  • AUse server-side encryption with Amazon S3 managed keys (SSE-S3).
  • BUse an S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the new objects. (correct answer)
  • CUse client-side encryption with AWS KMS customer managed keys.
  • DUse server-side encryption with customer-provided keys (SSE-C) stored in AWS KMS.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use an S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the new objects.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SAA-C03 Question 1010

Single page →
Topic 1 · Question 1010 · Select all that apply

A company runs multiple workloads on virtual machines (VMs) in an on-premises data center. The company is expanding rapidly. The on-premises data center is not able to scale fast enough to meet business needs. The company wants to migrate the workloads to AWS. The migration is time sensitive. The company wants to use a lift-and-shift strategy for non-critical workloads. Which combination of steps will meet these requirements? (Choose three.)

  • AUse the AWS Schema Conversion Tool (AWS SCT) to collect data about the VMs.
  • BUse AWS Application Migration Service. Install the AWS Replication Agent on the VMs. (correct answer)
  • CComplete the initial replication of the VMs. Launch test instances to perform acceptance tests on the VMs. (correct answer)
  • DStop all operations on the VMs. Launch a cutover instance. (correct answer)
  • EUse AWS App2Container (A2C) to collect data about the VMs.
  • FUse AWS Database Migration Service (AWS DMS) to migrate the VMs.
Reveal answer & explanation
Correct answer: B, C, D

The correct answer is B, C, D. Option B: Use AWS Application Migration Service. Install the AWS Replication Agent on the VMs. Option C: Complete the initial replication of the VMs. Launch test instances to perform acceptance tests on the VMs. Option D: Stop all operations on the VMs. Launch a cutover instance.

Explanation

AWS Application Migration Service (MGN) rehosts servers to AWS with minimal effort.

SAA-C03 Question 1011

Single page →
Topic 1 · Question 1011 · Select all that apply

A company hosts an application in a private subnet. The company has already integrated the application with Amazon Cognito. The company uses an Amazon Cognito user pool to authenticate users. The company needs to modify the application so the application can securely store user documents in an Amazon S3 bucket. Which combination of steps will securely integrate Amazon S3 with the application? (Choose two.)

  • ACreate an Amazon Cognito identity pool to generate secure Amazon S3 access tokens for users when they successfully log in. (correct answer)
  • BUse the existing Amazon Cognito user pool to generate Amazon S3 access tokens for users when they successfully log in.
  • CCreate an Amazon S3 VPC endpoint in the same VPC where the company hosts the application. (correct answer)
  • DCreate a NAT gateway in the VPC where the company hosts the application. Assign a policy to the S3 bucket to deny any request that is not initiated from Amazon Cognito.
  • EAttach a policy to the S3 bucket that allows access only from the users' IP addresses.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Create an Amazon Cognito identity pool to generate secure Amazon S3 access tokens for users when they successfully log in. Option C: Create an Amazon S3 VPC endpoint in the same VPC where the company hosts the application.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. A VPC endpoint provides private connectivity to AWS services without traversing the public internet. Amazon Cognito manages user sign-up, sign-in and federated identity for applications.

SAA-C03 Question 1012

Single page →
Topic 1 · Question 1012

A company has a three-tier web application that processes orders from customers. The web tier consists of Amazon EC2 instances behind an Application Load Balancer. The processing tier consists of EC2 instances. The company decoupled the web tier and processing tier by using Amazon Simple Queue Service (Amazon SQS). The storage layer uses Amazon DynamoDB. At peak times, some users report order processing delays and halls. The company has noticed that during these delays, the EC2 instances are running at 100% CPU usage, and the SQS queue fills up. The peak times are variable and unpredictable. The company needs to improve the performance of the application. Which solution will meet these requirements?

  • AUse scheduled scaling for Amazon EC2 Auto Scaling to scale out the processing tier instances for the duration of peak usage times. Use the CPU Utilization metric to determine when to scale.
  • BUse Amazon ElastiCache for Redis in front of the DynamoDB backend tier. Use target utilization as a metric to determine when to scale.
  • CAdd an Amazon CloudFront distribution to cache the responses for the web tier. Use HTTP latency as a metric to determine when to scale.
  • DUse an Amazon EC2 Auto Scaling target tracking policy to scale out the processing tier instances. Use the ApproximateNumberOfMessages attribute to determine when to scale. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use an Amazon EC2 Auto Scaling target tracking policy to scale out the processing tier instances. Use the ApproximateNumberOfMessages attribute to determine when to scale.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. This option decouples the components so they scale independently and absorb load spikes.

SAA-C03 Question 1013

Single page →
Topic 1 · Question 1013

A company's production environment consists of Amazon EC2 On-Demand Instances that run constantly between Monday and Saturday. The instances must run for only 12 hours on Sunday and cannot tolerate interruptions. The company wants to cost-optimize the production environment. Which solution will meet these requirements MOST cost-effectively?

  • APurchase Scheduled Reserved Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday. (correct answer)
  • BPurchase Convertible Reserved Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.
  • CUse Spot Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.
  • DUse Spot Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Convertible Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Purchase Scheduled Reserved Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.

Explanation

Reserved Instances lower cost for steady-state, predictable long-running workloads. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. This option delivers the requirement at the lowest cost.

SAA-C03 Question 1014

Single page →
Topic 1 · Question 1014

A digital image processing company wants to migrate its on-premises monolithic application to the AWS Cloud. The company processes thousands of images and generates large files as part of the processing workflow. The company needs a solution to manage the growing number of image processing jobs. The solution must also reduce the manual tasks in the image processing workflow. The company does not want to manage the underlying infrastructure of the solution. Which solution will meet these requirements with the LEAST operational overhead?

  • AUse Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 Spot Instances to process the images. Configure Amazon Simple Queue Service (Amazon SQS) to orchestrate the workflow. Store the processed files in Amazon Elastic File System (Amazon EFS).
  • BUse AWS Batch jobs to process the images. Use AWS Step Functions to orchestrate the workflow. Store the processed files in an Amazon S3 bucket. (correct answer)
  • CUse AWS Lambda functions and Amazon EC2 Spot Instances to process the images. Store the processed files in Amazon FSx.
  • DDeploy a group of Amazon EC2 instances to process the images. Use AWS Step Functions to orchestrate the workflow. Store the processed files in an Amazon Elastic Block Store (Amazon EBS) volume.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use AWS Batch jobs to process the images. Use AWS Step Functions to orchestrate the workflow. Store the processed files in an Amazon S3 bucket.

Explanation

AWS Batch schedules and runs batch computing jobs at any scale without managing clusters. Amazon S3 provides durable, scalable object storage that is fully managed. AWS Step Functions coordinates multi-step workflows as a managed state machine.

SAA-C03 Question 1015

Single page →
Topic 1 · Question 1015

A company's image-hosting website gives users around the world the ability to up load, view, and download images from their mobile devices. The company currently hosts the static website in an Amazon S3 bucket. Because of the website's growing popularity, the website's performance has decreased. Users have reported latency issues when they upload and download images. The company must improve the performance of the website. Which solution will meet these requirements with the LEAST implementation effort?

  • AConfigure an Amazon CloudFront distribution for the S3 bucket to improve the download performance. Enable S3 Transfer Acceleration to improve the upload performance. (correct answer)
  • BConfigure Amazon EC2 instances of the right sizes in multiple AWS Regions. Migrate the application to the EC2 instances. Use an Application Load Balancer to distribute the website traffic equally among the EC2 instances. Configure AWS Global Accelerator to address global demand with low latency.
  • CConfigure an Amazon CloudFront distribution that uses the S3 bucket as an origin to improve the download performance. Configure the application to use CloudFront to upload images to improve the upload performance. Create S3 buckets in multiple AWS Regions. Configure replication rules for the buckets to replicate users' data based on the users' location. Redirect downloads to the S3 bucket that is closest to each user's location.
  • DConfigure AWS Global Accelerator for the S3 bucket to improve network performance. Create an endpoint for the application to use Global Accelerator instead of the S3 bucket.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure an Amazon CloudFront distribution for the S3 bucket to improve the download performance. Enable S3 Transfer Acceleration to improve the upload performance.

Explanation

S3 Transfer Acceleration speeds up long-distance uploads to S3 over the AWS edge network. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SAA-C03 Question 1016

Single page →
Topic 1 · Question 1016

A company runs an application in a private subnet behind an Application Load Balancer (ALB) in a VPC. The VPC has a NAT gateway and an internet gateway. The application calls the Amazon S3 API to store objects. According to the company's security policy, traffic from the application must not travel across the internet. Which solution will meet these requirements MOST cost-effectively?

  • AConfigure an S3 interface endpoint. Create a security group that allows outbound traffic to Amazon S3.
  • BConfigure an S3 gateway endpoint. Update the VPC route table to use the endpoint. (correct answer)
  • CConfigure an S3 bucket policy to allow traffic from the Elastic IP address that is assigned to the NAT gateway.
  • DCreate a second NAT gateway in the same subnet where the legacy application is deployed. Update the VPC route table to use the second NAT gateway.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure an S3 gateway endpoint. Update the VPC route table to use the endpoint.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

SAA-C03 Question 1017

Single page →
Topic 1 · Question 1017

A company has an application that runs on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2 instances. The application has a UI that uses Amazon DynamoDB and data services that use Amazon S3 as part of the application deployment. The company must ensure that the EKS Pods for the UI can access only Amazon DynamoDB and that the EKS Pods for the data services can access only Amazon S3. The company uses AWS Identity and Access Management (IAM). Which solution meals these requirements?

  • ACreate separate IAM policies for Amazon S3 and DynamoDB access with the required permissions. Attach both IAM policies to the EC2 instance profile. Use role-based access control (RBAC) to control access to Amazon S3 or DynamoDB for the respective EKS Pods.
  • BCreate separate IAM policies for Amazon S3 and DynamoDB access with the required permissions. Attach the Amazon S3 IAM policy directly to the EKS Pods for the data services and the DynamoDB policy to the EKS Pods for the UI.
  • CCreate separate Kubernetes service accounts for the UI and data services to assume an IAM role. Attach the AmazonS3FullAccess policy to the data services account and the AmazonDynamoDBFullAccess policy to the UI service account. (correct answer)
  • DCreate separate Kubernetes service accounts for the UI and data services to assume an IAM role. Use IAM Role for Service Accounts (IRSA) to provide access to the EKS Pods for the UI to Amazon S3 and the EKS Pods for the data services to DynamoDB.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create separate Kubernetes service accounts for the UI and data services to assume an IAM role. Attach the AmazonS3FullAccess policy to the data services account and the AmazonDynamoDBFullAccess policy to the UI servi...

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials.

SAA-C03 Question 1018

Single page →
Topic 1 · Question 1018

A company needs to give a globally distributed development team secure access to the company's AWS resources in a way that complies with security policies. The company currently uses an on-premises Active Directory for internal authentication. The company uses AWS Organizations to manage multiple AWS accounts that support multiple projects. The company needs a solution to integrate with the existing infrastructure to provide centralized identity management and access control. Which solution will meet these requirements with the LEAST operational overhead?

  • ASet up AWS Directory Service to create an AWS managed Microsoft Active Directory on AWS. Establish a trust relationship with the on-premises Active Directory. Use IAM rotes that are assigned to Active Directory groups to access AWS resources within the company's AWS accounts.
  • BCreate an IAM user for each developer. Manually manage permissions for each IAM user based on each user's involvement with each project. Enforce multi-factor authentication (MFA) as an additional layer of security.
  • CUse AD Connector in AWS Directory Service to connect to the on-premises Active Directory. Integrate AD Connector with AWS IAM Identity Center. Configure permissions sets to give each AD group access to specific AWS accounts and resources. (correct answer)
  • DUse Amazon Cognito to deploy an identity federation solution. Integrate the identity federation solution with the on-premises Active Directory. Use Amazon Cognito to provide access tokens for developers to access AWS accounts and resources.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use AD Connector in AWS Directory Service to connect to the on-premises Active Directory. Integrate AD Connector with AWS IAM Identity Center. Configure permissions sets to give each AD group access to specific AWS ac...

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS IAM Identity Center (SSO) centrally manages workforce access to multiple accounts and apps. AWS Directory Service provides managed Microsoft Active Directory in the cloud.

SAA-C03 Question 1019

Single page →
Topic 1 · Question 1019

A company is developing an application in the AWS Cloud. The application's HTTP API contains critical information that is published in Amazon API Gateway. The critical information must be accessible from only a limited set of trusted IP addresses that belong to the company's internal network. Which solution will meet these requirements?

  • ASet up an API Gateway private integration to restrict access to a predefined set of IP addresses.
  • BCreate a resource policy for the API that denies access to any IP address that is not specifically allowed. (correct answer)
  • CDirectly deploy the API in a private subnet. Create a network ACL. Set up rules to allow the traffic from specific IP addresses.
  • DModify the security group that is attached to API Gateway to allow inbound traffic from only the trusted IP addresses.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a resource policy for the API that denies access to any IP address that is not specifically allowed.

Showing questions 1001–1019 of 1019 · Page 51 of 51