Amazon SAA-C01 Online Practice Questions and Exam Preparation

Amazon SAA-C01 Online Questions & Answers

• Question 151:

  You are designing a data leak prevention solution for your VPC environment. You want your VPC Instances to be able to access software depots and distributions on the Internet for product updates. The depots and distributions are

  accessible via third party CONs by their URLs. You want to explicitly deny any other outbound connections from your VPC instances to hosts on the Internet.

  Which of the following options would you consider?

  A. Configure a web proxy server in your VPC and enforce URL-based rules for outbound access Remove default routes.
  B. Implement security groups and configure outbound rules to only permit traffic to software depots.
  C. Move all your instances into private VPC subnets remove default routes from all routing tables and add specific routes to the software depots and distributions only.
  D. Implement network access control lists to all specific destinations, with an Implicit deny as a rule.
  A. Configure a web proxy server in your VPC and enforce URL-based rules for outbound access Remove default routes.

• Question 152:

  Does Amazon RDS support SSL encryption for SQL Server DB Instances?

  A. Yes, for all supported SQL Server editions
  B. No
  C. Yes, but only when the instances are in a single region
  D. No, encryption using SSL is supported only in the GovCloud.
  A. Yes, for all supported SQL Server editions

• Question 153:

  A Lambda function must execute a query against an Amazon RDS database in a private subnet.

  Which steps are required to allow the Lambda function to access the Amazon RDS database? (Select two.)

  A. Create a VPC Endpoint for Amazon RDS.
  B. Create the Lambda function within the Amazon RDS VPC.
  C. Change the ingress rules of Lambda security group, allowing the Amazon RDS security group.
  D. Change the ingress rules of the Amazon RDS security group, allowing the Lambda security group.
  E. Add an Internet Gateway (IGW) to the VPC, route the private subnet to the IGW.
  A. Create a VPC Endpoint for Amazon RDS.
  D. Change the ingress rules of the Amazon RDS security group, allowing the Lambda security group.

• Question 154:

  An Administrator is hosting an application on a single Amazon EC2 instance, which users can access by the public hostname. The administrator is adding a second instance, but does not want users to have to decide between many public hostnames.

  Which AWS service will decouple the users from specific Amazon EC2 instances?

  A. Amazon SQS
  B. Auto Scaling group
  C. Amazon EC2 security group
  D. Amazon ELB
  D. Amazon ELB

• Question 155:

  An insurance company stores all documents related to annual policies for the duration of the policies. The documents are created once and then stored until they are required, typically at the end of the policy. A document must be capable of being retrieved immediately. The company is now moving their document management to the AWS Cloud.

  Which service should a Solutions Architect recommend as a cost-effective solution that meets the company's requirements?

  A. Amazon RDS MySQL
  B. Amazon S3 Standard-Infrequent Access
  C. Amazon Glacier
  D. Amazon S3 Standard
  B. Amazon S3 Standard-Infrequent Access

• Question 156:

  A company has gigabytes of web log files stored in an Amazon S3 bucket. A Solutions Architect wants to copy those files into Amazon Redshift for analysis. The company's security policy mandates that data is encrypted at rest both in the Amazon Redshift cluster and the Amazon S3 bucket.

  Which process will fulfill the security requirements?

  A. Enable server-side encryption on the Amazon S3 bucket. Launch an unencrypted Amazon Redshift cluster. Copy the data into the Amazon Redshift cluster.
  B. Enable server-side encryption on the Amazon S3 bucket. Copy data from the Amazon S3 bucket into an unencrypted Redshift cluster. Enable encryption on the cluster.
  C. Launch an encrypted Amazon Redshift cluster. Copy the data from the Amazon S3 bucket into the Amazon Redshift cluster. Copy data back to the Amazon S3 bucket in encrypted form.
  D. Enable server-side encryption on the Amazon S3 bucket. Launch an encrypted Amazon Redshift cluster. Copy the data into the Amazon Redshift cluster.
  D. Enable server-side encryption on the Amazon S3 bucket. Launch an encrypted Amazon Redshift cluster. Copy the data into the Amazon Redshift cluster.

• Question 157:

  A Solutions Architect is working on a PCI-compliant architecture that needs to call an external service provider's API. The external provider requires IP whitelisting to verify the calling party. How should the Solutions Architect provide the external party with the IP addresses for whitelisting?

  A. Use an API Gateway in proxy mode, and provide the API Gateway's IP address to the external service provider.
  B. Associate a public elastic network interface to a published stage/endpoint in API Gateway, exposing the AWS Lambda function, and provide the IP address for the public network interface to the external party to whitelist.
  C. Deploy the Lambda function in private subnets and route outbound traffic through a NAT gateway. Provide the NAT gateway's Elastic IP address to the external service provider.
  D. Provide the external party the allocated AWS IP address range for Lambda functions, and send change notifications by using a subscription to the AmazonIpSpaceChanged SNS topic.
  C. Deploy the Lambda function in private subnets and route outbound traffic through a NAT gateway. Provide the NAT gateway's Elastic IP address to the external service provider.

• Question 158:

  Your company previously configured a heavily used, dynamically routed VPN connection between your on-premises data center and AWS. You recently provisioned a DirectConnect connection and would like to start using the new connection. After configuring DirectConnect settings in the AWS Console, which of the following options win provide the most seamless transition for your users?

  A. Delete your existing VPN connection to avoid routing loops configure your DirectConnect router with the appropriate settings and verity network traffic is leveraging DirectConnect.
  B. Configure your DirectConnect router with a higher 8GP priority man your VPN router, verify network traffic is leveraging Directconnect and then delete your existing VPN connection.
  C. Update your VPC route tables to point to the DirectConnect connection configure your DirectConnect router with the appropriate settings verify network traffic is leveraging DirectConnect and then delete the VPN connection.
  D. Configure your DirectConnect router, update your VPC route tables to point to the DirectConnect connection, configure your VPN connection with a higher BGP pointy. And verify network traffic is leveraging the DirectConnect connection.
  C. Update your VPC route tables to point to the DirectConnect connection configure your DirectConnect router with the appropriate settings verify network traffic is leveraging DirectConnect and then delete the VPN connection.

• Question 159:

  A customer set up an Amazon VPC with one private subnet and one public subnet with a NAT gateway. The VPC will contain a group of Amazon EC2 instances. All instances will configure themselves at startup by downloading a bootstrap script from an Amazon S3 bucket with a policy that only allows access from the customer's Amazon EC2 instances and then deploys an application through GIT. A Solutions Architect has been asked to design a solution that provides the highest level of security regarding network connectivity to the Amazon EC2 instances.

  How should the Architect design the infrastructure?

  A. Place the Amazon EC2 instances in the public subnet, with no EIPs; route outgoing traffic through the internet gateway.
  B. Place the Amazon EC2 instances in a public subnet, and assign EIPs; route outgoing traffic through the NAT gateway.
  C. Place the Amazon EC2 instances in a private subnet, and assign EIPs; route outgoing traffic through the internet gateway.
  D. Place the Amazon EC2 instances in a private subnet, with no EIPs; route outgoing traffic through the NAT gateway
  D. Place the Amazon EC2 instances in a private subnet, with no EIPs; route outgoing traffic through the NAT gateway

• Question 160:

  A company is using an Amazon S3 bucket located in us-west-2 to serve videos to their customers. Their customers are located all around the world and the videos are requested a lot during peak hours. Customers in Europe complain about

  experiencing slow downloaded speeds, and during peak hours, customers in all locations report experiencing HTTP 500 errors.

  What can a Solutions Architect do to address these issues?

  A. Place an elastic load balancer in front of the Amazon S3 bucket to distribute the load during peak hours.
  B. Cache the web content with Amazon CloudFront and use all Edge locations for content delivery.
  C. Replicate the bucket in eu-west-1 and use an Amazon Route 53 failover routing policy to determine which bucket it should serve the request to.
  D. Use an Amazon Route 53 weighted routing policy for the CloudFront domain name to distribute the GET request between CloudFront and the Amazon S3 bucket directly.
  D. Use an Amazon Route 53 weighted routing policy for the CloudFront domain name to distribute the GET request between CloudFront and the Amazon S3 bucket directly.