πŸ”

SAA-C03 β€” questions

Page 9 of 51 Β· 1019 total questions.

Topic 1 Β· Question 161

A company has a small Python application that processes JSON documents and outputs the results to an on-premises SQL database. The application runs thousands of times each day. The company wants to move the application to the AWS Cloud. The company needs a highly available solution that maximizes scalability and minimizes operational overhead. Which solution will meet these requirements?

  • APlace the JSON documents in an Amazon S3 bucket. Run the Python code on multiple Amazon EC2 instances to process the documents. Store the results in an Amazon Aurora DB cluster.
  • BPlace the JSON documents in an Amazon S3 bucket. Create an AWS Lambda function that runs the Python code to process the documents as they arrive in the S3 bucket. Store the results in an Amazon Aurora DB cluster. (correct answer)
  • CPlace the JSON documents in an Amazon Elastic Block Store (Amazon EBS) volume. Use the EBS Multi-Attach feature to attach the volume to multiple Amazon EC2 instances. Run the Python code on the EC2 instances to process the documents. Store the results on an Amazon RDS DB instance.
  • DPlace the JSON documents in an Amazon Simple Queue Service (Amazon SQS) queue as messages. Deploy the Python code as a container on an Amazon Elastic Container Service (Amazon ECS) cluster that is configured with the Amazon EC2 launch type. Use the container to process the SQS messages. Store the results on an Amazon RDS DB instance.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Place the JSON documents in an Amazon S3 bucket. Create an AWS Lambda function that runs the Python code to process the documents as they arrive in the S3 bucket. Store the results in an Amazon Aurora DB cluster.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Aurora is a high-performance managed relational database with built-in replication and failover. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Topic 1 Β· Question 162

A company wants to use high performance computing (HPC) infrastructure on AWS for financial risk modeling. The company’s HPC workloads run on Linux. Each HPC workflow runs on hundreds of Amazon EC2 Spot Instances, is short-lived, and generates thousands of output files that are ultimately stored in persistent storage for analytics and long-term future use. The company seeks a cloud storage solution that permits the copying of on-premises data to long-term persistent storage to make data available for processing by all EC2 instances. The solution should also be a high performance file system that is integrated with persistent storage to read and write datasets and output files. Which combination of AWS services meets these requirements?

  • AAmazon FSx for Lustre integrated with Amazon S3 (correct answer)
  • BAmazon FSx for Windows File Server integrated with Amazon S3
  • CAmazon S3 Glacier integrated with Amazon Elastic Block Store (Amazon EBS)
  • DAmazon S3 bucket with a VPC endpoint integrated with an Amazon Elastic Block Store (Amazon EBS) General Purpose SSD (gp2) volume
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Amazon FSx for Lustre integrated with Amazon S3

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon FSx for Lustre delivers high-performance file storage for compute-intensive workloads. Amazon FSx provides fully managed third-party file systems.

Topic 1 Β· Question 163

A company is building a containerized application on premises and decides to move the application to AWS. The application will have thousands of users soon after it is deployed. The company is unsure how to manage the deployment of containers at scale. The company needs to deploy the containerized application in a highly available architecture that minimizes operational overhead. Which solution will meet these requirements?

  • AStore container images in an Amazon Elastic Container Registry (Amazon ECR) repository. Use an Amazon Elastic Container Service (Amazon ECS) cluster with the AWS Fargate launch type to run the containers. Use target tracking to scale automatically based on demand. (correct answer)
  • BStore container images in an Amazon Elastic Container Registry (Amazon ECR) repository. Use an Amazon Elastic Container Service (Amazon ECS) cluster with the Amazon EC2 launch type to run the containers. Use target tracking to scale automatically based on demand.
  • CStore container images in a repository that runs on an Amazon EC2 instance. Run the containers on EC2 instances that are spread across multiple Availability Zones. Monitor the average CPU utilization in Amazon CloudWatch. Launch new EC2 instances as needed.
  • DCreate an Amazon EC2 Amazon Machine Image (AMI) that contains the container image. Launch EC2 instances in an Auto Scaling group across multiple Availability Zones. Use an Amazon CloudWatch alarm to scale out EC2 instances when the average CPU utilization threshold is breached.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Store container images in an Amazon Elastic Container Registry (Amazon ECR) repository. Use an Amazon Elastic Container Service (Amazon ECS) cluster with the AWS Fargate launch type to run the containers. Use target t...

Explanation

AWS Fargate runs containers serverlessly so there are no EC2 hosts to manage or patch. Amazon ECS orchestrates containers and integrates natively with AWS networking and IAM. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Topic 1 Β· Question 164

A company has two applications: a sender application that sends messages with payloads to be processed and a processing application intended to receive the messages with payloads. The company wants to implement an AWS service to handle messages between the two applications. The sender application can send about 1,000 messages each hour. The messages may take up to 2 days to be processed: If the messages fail to process, they must be retained so that they do not impact the processing of any remaining messages. Which solution meets these requirements and is the MOST operationally efficient?

  • ASet up an Amazon EC2 instance running a Redis database. Configure both applications to use the instance. Store, process, and delete the messages, respectively.
  • BUse an Amazon Kinesis data stream to receive the messages from the sender application. Integrate the processing application with the Kinesis Client Library (KCL).
  • CIntegrate the sender and processor applications with an Amazon Simple Queue Service (Amazon SQS) queue. Configure a dead-letter queue to collect the messages that failed to process. (correct answer)
  • DSubscribe the processing application to an Amazon Simple Notification Service (Amazon SNS) topic to receive notifications to process. Integrate the sender application to write to the SNS topic.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Integrate the sender and processor applications with an Amazon Simple Queue Service (Amazon SQS) queue. Configure a dead-letter queue to collect the messages that failed to process.

Explanation

Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes. AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 Β· Question 165

A solutions architect must design a solution that uses Amazon CloudFront with an Amazon S3 origin to store a static website. The company’s security policy requires that all website traffic be inspected by AWS WAF. How should the solutions architect comply with these requirements?

  • AConfigure an S3 bucket policy to accept requests coming from the AWS WAF Amazon Resource Name (ARN) only.
  • BConfigure Amazon CloudFront to forward all incoming requests to AWS WAF before requesting content from the S3 origin.
  • CConfigure a security group that allows Amazon CloudFront IP addresses to access Amazon S3 only. Associate AWS WAF to CloudFront.
  • DConfigure Amazon CloudFront and Amazon S3 to use an origin access identity (OAI) to restrict access to the S3 bucket. Enable AWS WAF on the distribution. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure Amazon CloudFront and Amazon S3 to use an origin access identity (OAI) to restrict access to the S3 bucket. Enable AWS WAF on the distribution.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS WAF protects web applications from common exploits and malicious requests.

Topic 1 Β· Question 166

Organizers for a global event want to put daily reports online as static HTML pages. The pages are expected to generate millions of views from users around the world. The files are stored in an Amazon S3 bucket. A solutions architect has been asked to design an efficient and effective solution. Which action should the solutions architect take to accomplish this?

  • AGenerate presigned URLs for the files.
  • BUse cross-Region replication to all Regions.
  • CUse the geoproximity feature of Amazon Route 53.
  • DUse Amazon CloudFront with the S3 bucket as its origin. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use Amazon CloudFront with the S3 bucket as its origin.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

Topic 1 Β· Question 167

A company runs a production application on a fleet of Amazon EC2 instances. The application reads the data from an Amazon SQS queue and processes the messages in parallel. The message volume is unpredictable and often has intermittent traffic. This application should continually process messages without any downtime. Which solution meets these requirements MOST cost-effectively?

  • AUse Spot Instances exclusively to handle the maximum capacity required.
  • BUse Reserved Instances exclusively to handle the maximum capacity required.
  • CUse Reserved Instances for the baseline capacity and use Spot Instances to handle additional capacity.
  • DUse Reserved Instances for the baseline capacity and use On-Demand Instances to handle additional capacity. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use Reserved Instances for the baseline capacity and use On-Demand Instances to handle additional capacity.

Explanation

Reserved Instances lower cost for steady-state, predictable long-running workloads. This option delivers the requirement at the lowest cost.

Topic 1 Β· Question 168

A security team wants to limit access to specific services or actions in all of the team’s AWS accounts. All accounts belong to a large organization in AWS Organizations. The solution must be scalable and there must be a single point where permissions can be maintained. What should a solutions architect do to accomplish this?

  • ACreate an ACL to provide access to the services or actions.
  • BCreate a security group to allow accounts and attach it to user groups.
  • CCreate cross-account roles in each account to deny access to the services or actions.
  • DCreate a service control policy in the root organizational unit to deny access to the services or actions. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a service control policy in the root organizational unit to deny access to the services or actions.

Topic 1 Β· Question 169

A company is concerned about the security of its public web application due to recent web attacks. The application uses an Application Load Balancer (ALB). A solutions architect must reduce the risk of DDoS attacks against the application. What should the solutions architect do to meet this requirement?

  • AAdd an Amazon Inspector agent to the ALB.
  • BConfigure Amazon Macie to prevent attacks.
  • CEnable AWS Shield Advanced to prevent attacks. (correct answer)
  • DConfigure Amazon GuardDuty to monitor the ALB.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enable AWS Shield Advanced to prevent attacks.

Explanation

AWS Shield provides managed DDoS protection.

Topic 1 Β· Question 170

A company’s web application is running on Amazon EC2 instances behind an Application Load Balancer. The company recently changed its policy, which now requires the application to be accessed from one specific country only. Which configuration will meet this requirement?

  • AConfigure the security group for the EC2 instances.
  • BConfigure the security group on the Application Load Balancer.
  • CConfigure AWS WAF on the Application Load Balancer in a VPC. (correct answer)
  • DConfigure the network ACL for the subnet that contains the EC2 instances.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure AWS WAF on the Application Load Balancer in a VPC.

Explanation

An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale. AWS WAF protects web applications from common exploits and malicious requests.

Topic 1 Β· Question 171

A company provides an API to its users that automates inquiries for tax computations based on item prices. The company experiences a larger number of inquiries during the holiday season only that cause slower response times. A solutions architect needs to design a solution that is scalable and elastic. What should the solutions architect do to accomplish this?

  • AProvide an API hosted on an Amazon EC2 instance. The EC2 instance performs the required computations when the API request is made.
  • BDesign a REST API using Amazon API Gateway that accepts the item names. API Gateway passes item names to AWS Lambda for tax computations. (correct answer)
  • CCreate an Application Load Balancer that has two Amazon EC2 instances behind it. The EC2 instances will compute the tax on the received item names.
  • DDesign a REST API using Amazon API Gateway that connects with an API hosted on an Amazon EC2 instance. API Gateway accepts and passes the item names to the EC2 instance for tax computations.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Design a REST API using Amazon API Gateway that accepts the item names. API Gateway passes item names to AWS Lambda for tax computations.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon API Gateway is a fully managed front door for creating and securing APIs at scale.

Topic 1 Β· Question 172

A solutions architect is creating a new Amazon CloudFront distribution for an application. Some of the information submitted by users is sensitive. The application uses HTTPS but needs another layer of security. The sensitive information should.be protected throughout the entire application stack, and access to the information should be restricted to certain applications. Which action should the solutions architect take?

  • AConfigure a CloudFront signed URL.
  • BConfigure a CloudFront signed cookie.
  • CConfigure a CloudFront field-level encryption profile. (correct answer)
  • DConfigure CloudFront and set the Origin Protocol Policy setting to HTTPS Only for the Viewer Protocol Policy.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure a CloudFront field-level encryption profile.

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 Β· Question 173

A gaming company hosts a browser-based application on AWS. The users of the application consume a large number of videos and images that are stored in Amazon S3. This content is the same for all users. The application has increased in popularity, and millions of users worldwide accessing these media files. The company wants to provide the files to the users while reducing the load on the origin. Which solution meets these requirements MOST cost-effectively?

  • ADeploy an AWS Global Accelerator accelerator in front of the web servers.
  • BDeploy an Amazon CloudFront web distribution in front of the S3 bucket. (correct answer)
  • CDeploy an Amazon ElastiCache for Redis instance in front of the web servers.
  • DDeploy an Amazon ElastiCache for Memcached instance in front of the web servers.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Deploy an Amazon CloudFront web distribution in front of the S3 bucket.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. This option delivers the requirement at the lowest cost.

Topic 1 Β· Question 174

A company has a multi-tier application that runs six front-end web servers in an Amazon EC2 Auto Scaling group in a single Availability Zone behind an Application Load Balancer (ALB). A solutions architect needs to modify the infrastructure to be highly available without modifying the application. Which architecture should the solutions architect choose that provides high availability?

  • ACreate an Auto Scaling group that uses three instances across each of two Regions.
  • BModify the Auto Scaling group to use three instances across each of two Availability Zones. (correct answer)
  • CCreate an Auto Scaling template that can be used to quickly create more instances in another Region.
  • DChange the ALB in front of the Amazon EC2 instances in a round-robin configuration to balance traffic to the web tier.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Modify the Auto Scaling group to use three instances across each of two Availability Zones.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Topic 1 Β· Question 175

An ecommerce company has an order-processing application that uses Amazon API Gateway and an AWS Lambda function. The application stores data in an Amazon Aurora PostgreSQL database. During a recent sales event, a sudden surge in customer orders occurred. Some customers experienced timeouts, and the application did not process the orders of those customers. A solutions architect determined that the CPU utilization and memory utilization were high on the database because of a large number of open connections. The solutions architect needs to prevent the timeout errors while making the least possible changes to the application. Which solution will meet these requirements?

  • AConfigure provisioned concurrency for the Lambda function. Modify the database to be a global database in multiple AWS Regions.
  • BUse Amazon RDS Proxy to create a proxy for the database. Modify the Lambda function to use the RDS Proxy endpoint instead of the database endpoint. (correct answer)
  • CCreate a read replica for the database in a different AWS Region. Use query string parameters in API Gateway to route traffic to the read replica.
  • DMigrate the data from Aurora PostgreSQL to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS). Modify the Lambda function to use the DynamoDB table.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use Amazon RDS Proxy to create a proxy for the database. Modify the Lambda function to use the RDS Proxy endpoint instead of the database endpoint.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon RDS Proxy pools and shares database connections to improve scalability and resilience. Amazon RDS is a managed relational database that handles patching, backups and failover.

Topic 1 Β· Question 176

An application runs on Amazon EC2 instances in private subnets. The application needs to access an Amazon DynamoDB table. What is the MOST secure way to access the table while ensuring that the traffic does not leave the AWS network?

  • AUse a VPC endpoint for DynamoDB. (correct answer)
  • BUse a NAT gateway in a public subnet.
  • CUse a NAT instance in a private subnet.
  • DUse the internet gateway attached to the VPC.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use a VPC endpoint for DynamoDB.

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. A VPC endpoint provides private connectivity to AWS services without traversing the public internet.

Topic 1 Β· Question 177

An entertainment company is using Amazon DynamoDB to store media metadata. The application is read intensive and experiencing delays. The company does not have staff to handle additional operational overhead and needs to improve the performance efficiency of DynamoDB without reconfiguring the application. What should a solutions architect recommend to meet this requirement?

  • AUse Amazon ElastiCache for Redis.
  • BUse Amazon DynamoDB Accelerator (DAX). (correct answer)
  • CReplicate data by using DynamoDB global tables.
  • DUse Amazon ElastiCache for Memcached with Auto Discovery enabled.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use Amazon DynamoDB Accelerator (DAX).

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. DynamoDB Accelerator (DAX) adds an in-memory cache for microsecond DynamoDB reads.

Topic 1 Β· Question 178

A company’s infrastructure consists of Amazon EC2 instances and an Amazon RDS DB instance in a single AWS Region. The company wants to back up its data in a separate Region. Which solution will meet these requirements with the LEAST operational overhead?

  • AUse AWS Backup to copy EC2 backups and RDS backups to the separate Region. (correct answer)
  • BUse Amazon Data Lifecycle Manager (Amazon DLM) to copy EC2 backups and RDS backups to the separate Region.
  • CCreate Amazon Machine Images (AMIs) of the EC2 instances. Copy the AMIs to the separate Region. Create a read replica for the RDS DB instance in the separate Region.
  • DCreate Amazon Elastic Block Store (Amazon EBS) snapshots. Copy the EBS snapshots to the separate Region. Create RDS snapshots. Export the RDS snapshots to Amazon S3. Configure S3 Cross-Region Replication (CRR) to the separate Region.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use AWS Backup to copy EC2 backups and RDS backups to the separate Region.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Backup centrally automates and manages backups across AWS services. Amazon RDS is a managed relational database that handles patching, backups and failover.

Topic 1 Β· Question 179

A solutions architect needs to securely store a database user name and password that an application uses to access an Amazon RDS DB instance. The application that accesses the database runs on an Amazon EC2 instance. The solutions architect wants to create a secure parameter in AWS Systems Manager Parameter Store. What should the solutions architect do to meet this requirement?

  • ACreate an IAM role that has read access to the Parameter Store parameter. Allow Decrypt access to an AWS Key Management Service (AWS KMS) key that is used to encrypt the parameter. Assign this IAM role to the EC2 instance. (correct answer)
  • BCreate an IAM policy that allows read access to the Parameter Store parameter. Allow Decrypt access to an AWS Key Management Service (AWS KMS) key that is used to encrypt the parameter. Assign this IAM policy to the EC2 instance.
  • CCreate an IAM trust relationship between the Parameter Store parameter and the EC2 instance. Specify Amazon RDS as a principal in the trust policy.
  • DCreate an IAM trust relationship between the DB instance and the EC2 instance. Specify Systems Manager as a principal in the trust policy.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an IAM role that has read access to the Parameter Store parameter. Allow Decrypt access to an AWS Key Management Service (AWS KMS) key that is used to encrypt the parameter. Assign this IAM role to the EC2 inst...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

Topic 1 Β· Question 180 Β· Select all that apply

A company is designing a cloud communications platform that is driven by APIs. The application is hosted on Amazon EC2 instances behind a Network Load Balancer (NLB). The company uses Amazon API Gateway to provide external users with access to the application through APIs. The company wants to protect the platform against web exploits like SQL injection and also wants to detect and mitigate large, sophisticated DDoS attacks. Which combination of solutions provides the MOST protection? (Choose two.)

  • AUse AWS WAF to protect the NLB.
  • BUse AWS Shield Advanced with the NLB. (correct answer)
  • CUse AWS WAF to protect Amazon API Gateway. (correct answer)
  • DUse Amazon GuardDuty with AWS Shield Standard
  • EUse AWS Shield Standard with Amazon API Gateway.
Reveal answer & explanation
Correct answer: B, C

The correct answer is B, C. Option B: Use AWS Shield Advanced with the NLB. Option C: Use AWS WAF to protect Amazon API Gateway.

Explanation

Amazon API Gateway is a fully managed front door for creating and securing APIs at scale. AWS WAF protects web applications from common exploits and malicious requests. AWS Shield provides managed DDoS protection.

Showing questions 161–180 of 1019 Β· Page 9 of 51