Amazon SAA-C02 Online Practice Questions and Exam Preparation

Amazon SAA-C02 Online Questions & Answers

• Question 51:

  A medical company is designing a new application that gathers symptoms from patients The company has decided to use Amazon Simple Queue Service (Amazon SQS) and Amazon Simple Notification Service (Amazon SNS) in the architecture

  A solutions architect is reviewing the infrastructure design Data must be encrypted while at rest and in transit Only authorized personnel of the company can access the data

  Which combination of steps should the solutions architect take to meet these requirements'? (Select TWO )

  A. Turn on server-side encryption on the SQS components Update the default key policy to restrict key usage to a set of authorized principals
  B. Turn on server-side encryption on the SNS components by using a custom CMK Apply a key policy to restrict key usage to a set of authorized principals
  C. Turn on encryption on the SNS components Update the default key policy to restrict key usage to a set of authorized principals Set a condition in the topic policy to allow only encrypted connections over TLS.
  D. Turn on server-side encryption on the SQS components by using a custom CMK. Apply a key policy to restrict key usage to a set of authonzed pnncipals Set a condition in the queue policy to allow only encrypted connections over TLS.
  E. Turn on server-side encryption on the SQS components by using a custom CMK. Apply an IAM policy to restrict key usage to a set of authorized principals Set a condition in the queue policy to allow only encrypted connections over TLS.
  C. Turn on encryption on the SNS components Update the default key policy to restrict key usage to a set of authorized principals Set a condition in the topic policy to allow only encrypted connections over TLS.
  D. Turn on server-side encryption on the SQS components by using a custom CMK. Apply a key policy to restrict key usage to a set of authonzed pnncipals Set a condition in the queue policy to allow only encrypted connections over TLS.

• Question 52:

  A company is deploying a web portal. The company wants to ensure that only the web portion of the application is publicly accessible. To accomplish this, the VPC was designed with two public subnets and two private subnets. The application will run on several Amazon EC2 instances in an Auto Scaling group. SSL termination must be offloaded from the EC2 instances. What should a solutions architect do to ensure these requirements are met?

  A. Configure the Network Load Balancer in the public subnets. Configure the Auto Scaling group in the private subnets and associate it with the Application Load Balancer
  B. Configure the Network Load Balancer in the public subnets. Configure the Auto Scaling group in the public subnets and associate it with the Application Load Balancer
  C. Configure the Application Load Balancer in the public subnets. Configure the Auto Scaling group in the private subnets and associate it with the Application Load Balancer
  D. Configure the Application Load Balancer in the private subnets. Configure the Auto Scaling group in the private subnets and associate it with the Application Load Balancer
  C. Configure the Application Load Balancer in the public subnets. Configure the Auto Scaling group in the private subnets and associate it with the Application Load Balancer

• Question 53:

  A company that develops web applications has launched hundreds of Application Load Balancers (ALBs) in multiple Regions. The company wants to create an allow list (or the IPs of all the load balancers on its firewall device. A solutions

  architect is looking for a one-time, highly available solution to address this request, which will also help reduce the number of IPs that need to be allowed by the firewall.

  What should the solutions architect recommend to meet these requirements?

  A. Create a AWS Lambda function to keep track of the IPs for all the ALBs in different Regions Keep refreshing this list.
  B. Set up a Network Load Balancer (NLB) with Elastic IPs. Register the private IPs of all the ALBs as targets to this NLB.
  C. Launch AWS Global Accelerator and create endpoints for all the Regions. Register all the ALBs in different Regions to the corresponding endpoints
  D. Set up an Amazon EC2 instance, assign an Elastic IP to this EC2 instance, and configure the instance as a proxy to forward traffic to all the ALBs.
  C. Launch AWS Global Accelerator and create endpoints for all the Regions. Register all the ALBs in different Regions to the corresponding endpoints

• Question 54:

  A company is creating an architecture for a mobile app that requires minimal latency for its users The company's architecture consists of Amazon EC2 instances behind an Application Load Balancer running in an Auto Scaling group The EC2 instances connect to Amazon RDS. Application beta testing showed there was a slowdown when reading the data However the metrics indicate that the EC2 instances do not cross any CPU utilization thresholds

  How can this issue be addressed1?

  A. Reduce the threshold for CPU utilization in the Auto Scaling group
  B. Replace the Application Load Balancer with a Network Load Balancer.
  C. Add read replicas for the RDS instances and direct read traffic to the replica.
  D. Add Multi-AZ support to the RDS instances and direct read traffic to the new EC2 instance.
  C. Add read replicas for the RDS instances and direct read traffic to the replica.

  ---

  Explanation/Reference:

• Question 55:

  A developer is creating an AWS Lambda function to perform dynamic updates to a database when an item is added to an Amazon Simple Queue Service (Amazon SQS) queue A solutions architect must recommend a solution that tracks any usage of database credentials in AWS CloudTrail. The solution also must provide auditing capabilities.

  Which solution will meet these requirements?

  A. Store the encrypted credentials in a Lambda environment variable
  B. Create an Amazon DynamoDB table to store the credentials Encrypt the table
  C. Store the credentials as a secure string in AWS Systems Manager Parameter Store
  D. Use an AWS Key Management Service (AWS KMS) key store to store the credentials
  D. Use an AWS Key Management Service (AWS KMS) key store to store the credentials

  ---

  Explanation/Reference:

• Question 56:

  A company has an on-premises application that collects data and stores it to an on-premises NFS server. The company recently set up a 10 Gbps AWS Direct Connect connection.

  The company is running out of storage capacity on premises. The company needs to migrate the application data from on premises to the AWS Cloud while maintaining low-latency access to the data from the on-premises application.

  What should a solutions architect do to meet these requirements?

  A. Deploy AWS Storage Gateway for the application data, and use the file gateway to store the data in Amazon S3. Connect the on-premises application servers to the file gateway using NFS.
  B. Attach an Amazon Elastic File System (Amazon EFS) file system to the NFS server, and copy the application data to the EFS file system. Then connect the on-premises application to Amazon EFS.
  C. Configure AWS Storage Gateway as a volume gateway. Make the application data available to the on-premises application from the NFS server and with Amazon Elastic Block Store (Amazon EBS) snapshots.
  D. Create an AWS DataSync agent with the NFS server as the source location and an Amazon Elastic File System (Amazon EFS) file system as the destination for application data transfer. Connect the on- premises application to the EFS file system.
  D. Create an AWS DataSync agent with the NFS server as the source location and an Amazon Elastic File System (Amazon EFS) file system as the destination for application data transfer. Connect the on- premises application to the EFS file system.

  ---

  Explanation/Reference:

• Question 57:

  A company has an application mat provides marketing services to stores. The services are based on previous purchases by store customers. The stores upload transaction data to the company through SFTP, and the data is processed and

  analyzed to generate new marketing offers Some of the files can exceed 200 GB in size.

  Recently, the company discovered that some of the stores have uploaded tiles that contain personally identifiable information (PII) mat should not have been included. The company wants administrators to be alerted if Pll is shared again. The

  company also wants to automate remediation. What should a solutions architect do to meet these requirements with the LEAS F development effort?

  A. Use an Amazon S3 bucket as a secure transfer point Use Amazon inspector to scan the objects in the bucket. If objects contain Pll, trigger an S3 Lifecycle policy to remove the objects that contain Pll.
  B. Use an Amazon S3 bucket as a secure transfer point. Use Amazon Macie to scan the objects in the bucket. if objects contain Pll, use Amazon Simple Notification Service (Amazon SNS) to trigger a notification to the administrators to remove the objects that contain Pll.
  C. Implement custom scanning algorithms in an AWS Lambda function. Trigger the function when objects are loaded into the bucket. IF objects contain PLL, use Amazon Simple Notification Service (Amazon SNS) to trigger a notification to the administrators to remove the objects that contain PII.
  D. Implement custom scanning algorithms in an AWS Lambda function. Trigger the function when objects are loaded into the bucket. If objects contain Pll, use Amazon Simple Email Service (Amazon SES) to Trigger a notification to the administrators and trigger an S3 Lifecycle policy to remove the objects that contain Pll.
  B. Use an Amazon S3 bucket as a secure transfer point. Use Amazon Macie to scan the objects in the bucket. if objects contain Pll, use Amazon Simple Notification Service (Amazon SNS) to trigger a notification to the administrators to remove the objects that contain Pll.

  ---

  Explanation/Reference:

• Question 58:

  A company recently migrated a message processing system to AWS. The system receives messages into an ActiveMQ queue running on an Amazon EC2 instance. Messages are processed by a consumer application running on Amazon EC2 The consumer application processes the messages and writes results to a MySQL database running on Amazon EC2. The company wants this application to be highly available with low operational complexity Which architecture offers the HIGHEST availability?

  A. Add a second ActiveMQ server to another Availability Zone Add an additional consumer EC2 instance in another Availability Zone Replicate the MySQL database to another Availability Zone.
  B. Use Amazon MQ with active/standby brokers configured across two Availability Zones Add an additional consumer EC2 instance in another Availability Zone.Replicate the MySQL database to another Availability Zone
  C. Use Amazon MQ with active/standby brokers configured across two Availability Zones. Add an additional consumer EC2 instance in another Availability Zone. Use Amazon RDS for MySQL with Multi-AZ enabled
  D. Use Amazon MQ with active/standby brokers configured across two Availability Zones Add an Auto Scaling group for the consumer EC2 instances across two Availability Zones Use Amazon RDS for MySQL with Multi-AZ enabled.
  D. Use Amazon MQ with active/standby brokers configured across two Availability Zones Add an Auto Scaling group for the consumer EC2 instances across two Availability Zones Use Amazon RDS for MySQL with Multi-AZ enabled.

• Question 59:

  A company has a three-tier environment on AWS that ingests sensor data from its usersA. Configure a TLS listener and add the server certificate on the NLB.
  B. Configure AWS Shield Advanced and enable AWS WAF on the NLB
  C. Change the load balancer to an Application Load Balancer and attach AWS WAF to it.
  D. Encrypt the Amazon Elastic Block Store (Amazon EBS) volume on the EC2 instances using AWS Key Management Service (AWS KMS)

  A. Configure a TLS listener and add the server certificate on the NLB.

  ---

  Explanation/Reference:

• Question 60:

  A company uses Application Load Balancers (ALBs) in different AWS Regions. The ALBs receive inconsistent traffic that can spike and drop throughout the year The company's networking team needs to allow the IP addresses of the ALBs in the on-premises firewall to enable connectivity.

  Which solution is the MOST scalable with minimal configuration changes?

  A. Write an AWS Lambda script to get the IP addresses of the ALBs in different Regions Update the on-premises firewall's rule to allow the IP addresses of the ALBs.
  B. Migrate all ALBs in different Regions to the Network Load Balancers (NLBs) Update the on- premises firewall's rule to allow the Elastic IP addresses of all the NLBs.
  C. Launch AWS Global Accelerator Register the ALBs in different Regions to the accelerator. Update the on-premises firewall's rule to allow static IP addresses associated with the accelerator.
  D. Launch a Network Load Balancer (NLB) in one Region Register the private IP addresses of the ALBs m different Regions with the NLB Update the on-premises firewall's rule to allow the Elastic IP address attached to the NLB.
  C. Launch AWS Global Accelerator Register the ALBs in different Regions to the accelerator. Update the on-premises firewall's rule to allow static IP addresses associated with the accelerator.

  ---

  Explanation/Reference: