Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 101:

  A company is developing a content sharing platform that currently handles 500 GB of user-generated media files. The company expects the amount of content to grow significantly in the future. The company needs a storage solution that can automatically scale, provide high durability, and allow direct user uploads from web browsers.

  Which solution will meet these requirements?

  A. Store the data in an Amazon Elastic Block Store (Amazon EBS) volume with Multi-Attach enabled.
  B. Store the data in an Amazon Elastic File System (Amazon EFS) Standard file system.
  C. Store the data in an Amazon S3 Standard bucket.
  D. Store the data in an Amazon S3 Express One Zone bucket.
  C. Store the data in an Amazon S3 Standard bucket.

  ---

  Explanation

  Amazon S3 Standard provides virtually unlimited scalability, high durability (11 nines), and millisecond latency. It is designed for storing large volumes of unstructured content such as media files. S3 also supports pre-signed URLs and direct browser uploads, enabling users to upload files securely without passing through backend servers. EBS volumes (A) are block storage, limited to single AZ, and not suitable for web-scale storage. EFS (B) is a shared file system for POSIX workloads, not for direct browser uploads. S3 Express One Zone (D) offers higher performance for small objects but does not provide cross-AZ durability, making it unsuitable for growing global content. Therefore, Option C is the most scalable, durable, and cost-effective solution.

  References:

  Amazon S3 User Guide -- Direct browser uploads and durability?AWS Well-Architected Framework -- Performance Efficiency Pillar

• Question 102:

  A company wants to analyze and troubleshoot Access Denied errors and Unauthorized errors that are related to IAM permissions. The company has AWS CloudTrail turned on.

  Which solution will meet these requirements with the LEAST effort?

  A. Use AWS Glue and write custom scripts to query CloudTrail logs for the errors.
  B. Use AWS Batch and write custom scripts to query CloudTrail logs for the errors.
  C. Search CloudTrail logs with Amazon Athena queries to identify the errors.
  D. Search CloudTrail logs with Amazon QuickSight. Create a dashboard to identify the errors.
  C. Search CloudTrail logs with Amazon Athena queries to identify the errors.

• Question 103:

  A company is testing an application that runs on an Amazon EC2 Linux instance. A single 500 GB Amazon Elastic Block Store (Amazon EBS) General Purpose SSO (gp2) volume is attached to the EC2 instance.

  The company will deploy the application on multiple EC2 instances in an Auto Scaling group. All instances require access to the data that is stored in the EBS volume. The company needs a highly available and resilient solution that does not introduce significant changes to the application's code.

  Which solution will meet these requirements?

  A. Provision an EC2 instance that uses NFS server software. Attach a single 500 GB gp2 EBS volume to the instance.
  B. Provision an Amazon FSx for Windows File Server file system. Configure the file system as an SMB file store within a single Availability Zone.
  C. Provision an EC2 instance with two 250 GB Provisioned IOPS SSD EBS volumes.
  D. Provision an Amazon Elastic File System (Amazon EFS) file system. Configure the file system to use General Purpose performance mode.
  D. Provision an Amazon Elastic File System (Amazon EFS) file system. Configure the file system to use General Purpose performance mode.

• Question 104:

  A company experienced a breach that affected several applications in its on-premises data center. The attacker took advantage of vulnerabilities in the custom applications that were running on the servers. The company is now migrating its applications to run on Amazon EC2 instances. The company wants to implement a solution that actively scans for vulnerabilities on the EC2 instances and sends a report that details the findings.

  Which solution will meet these requirements?

  A. Deploy AWS Shield to scan the EC2 instances for vulnerabilities. Create an AWS Lambda function to log any findings to AWS CloudTrail.
  B. Deploy Amazon Macie and AWS Lambda functions to scan the EC2 instances for vulnerabilities. Log any findings to AWS CloudTrail.
  C. Turn on Amazon GuardDuty. Deploy the GuardDuty agents to the EC2 instances. Configure an AWS Lambda function to automate the generation and distribution of reports that detail the findings.
  D. Turn on Amazon Inspector. Deploy the Amazon Inspector agent to the EC2 instances. Configure an AWS Lambda function to automate the generation and distribution of reports that detail the findings.
  D. Turn on Amazon Inspector. Deploy the Amazon Inspector agent to the EC2 instances. Configure an AWS Lambda function to automate the generation and distribution of reports that detail the findings.

• Question 105:

  A solutions architect is configuring a VPC that has public subnets and private subnets. The VPC and subnets use IPv4 CIDR blocks. There is one public subnet and one private subnet in each of three Availability Zones (AZs). An internet gateway is attached to the VPC.

  The private subnets require access to the internet to allow Amazon EC2 instances to download software updates.

  Which solution will meet this requirement?

  A. Create a NAT gateway in one of the public subnets. Update the route tables that are attached to the private subnets to forward non-VPC traffic to the NAT gateway.
  B. Create three NAT instances in each private subnet. Create a private route table for each Availability Zone that forwards non-VPC traffic to the NAT instances.
  C. Attach an egress-only internet gateway in the VPC. Update the route tables of the private subnets to forward non-VPC traffic to the egress-only internet gateway.
  D. Create a NAT gateway in one of the private subnets. Update the route tables that are attached to the private subnets to forward non-VPC traffic to the NAT gateway.
  A. Create a NAT gateway in one of the public subnets. Update the route tables that are attached to the private subnets to forward non-VPC traffic to the NAT gateway.

  ---

  Explanation

  Private subnets require outbound internet access to download updates, but they must not have public IPs or direct inbound access.

  The recommended AWS solution is to create a NAT gateway in a public subnet. Private subnet route tables are updated to route internet-bound traffic (0.0.0.0/0) to the NAT gateway. The NAT gateway then uses the internet gateway attached to the VPC to communicate with the internet.

  Option B (NAT instances) is an older approach and less scalable/maintainable than NAT gateways.

  Option C (egress-only internet gateway) is for IPv6 outbound-only traffic, not IPv4.

  Option D is invalid because NAT gateways must be deployed in public subnets.

• Question 106:

  A company needs to provide its employees with secure access to confidential and sensitive files. The company wants to ensure that the files can be accessed only by authorized users. The files must be downloaded securely to the employees' devices. The files are stored in an on-premises Windows file server. However, due to an increase in remote usage, the file server is running out of capacity. .

  Which solution will meet these requirements?

  A. Migrate the file server to an Amazon EC2 instance in a public subnet. Configure the security group to limit inbound traffic to the employees' IP addresses.
  B. Migrate the files to an Amazon FSx for Windows File Server file system. Integrate the Amazon FSx file system with the on-premises Active Directory. Configure AWS Client VPN.
  C. Migrate the files to Amazon S3, and create a private VPC endpoint. Create a signed URL to allow download.
  D. Migrate the files to Amazon S3, and create a public VPC endpoint. Allow employees to sign on with AWS IAM Identity Center (AWS Single Sign-On).
  B. Migrate the files to an Amazon FSx for Windows File Server file system. Integrate the Amazon FSx file system with the on-premises Active Directory. Configure AWS Client VPN.

• Question 107:

  A company has applications hosted on Amazon EC2 instances with IPv6 addresses. The applications must initiate communications with other external applications using the internet. However the company's security policy states that any external service cannot initiate a connection to the EC2 instances.

  What should a solutions architect recommend to resolve this issue?

  A. Create a NAT gateway and make it the destination of the subnet's route table
  B. Create an internet gateway and make it the destination of the subnet's route table
  C. Create a virtual private gateway and make it the destination of the subnet's route table
  D. Create an egress-only internet gateway and make it the destination of the subnet's route table
  D. Create an egress-only internet gateway and make it the destination of the subnet's route table

• Question 108:

  A company has two VPCs named Management and Production. The Management VPC uses VPNs through a customer gateway to connect to a single device in the data center. The Production VPC uses a virtual private gateway with two attached AWS Direct Connect connections. The Management and Production VPCs both use a single VPC peering connection to allow communication between the applications.

  What should a solutions architect do to mitigate any single point of failure in this architecture?

  A. Add a set of VPNs between the Management and Production VPCs.
  B. Add a second virtual private gateway and attach it to the Management VPC.
  C. Add a second set of VPNs to the Management VPC from a second customer gateway device.
  D. Add a second VPC peering connection between the Management VPC and the Production VPC.
  C. Add a second set of VPNs to the Management VPC from a second customer gateway device.

• Question 109:

  A company that runs its application on AWS uses an Amazon Aurora DB cluster as its database. During peak usage hours when multiple users access and read the data, the monitoring system shows degradation of database performance for the write queries. The company wants to increase the scalability of the application to meet peak usage demands.

  Which solution will meet these requirements MOST cost-effectively?

  A. Create a second Aurora DB cluster. Configure a copy job to replicate the users' data to the new database. Update the application to use the second database to read the data.
  B. Create an Amazon DynamoDB Accelerator (DAX) cluster in front of the existing Aurora DB cluster. Update the application to use the DAX cluster for read-only queries. Write data directly to the Aurora DB cluster.
  C. Create an Aurora read replica in the existing Aurora DB cluster. Update the application to use the replica endpoint for read-only queries and to use the cluster endpoint for write queries.
  D. Create an Amazon Redshift cluster. Copy the users' data to the Redshift cluster. Update the application to connect to the Redshift cluster and to perform read-only queries on the Redshift cluster.
  C. Create an Aurora read replica in the existing Aurora DB cluster. Update the application to use the replica endpoint for read-only queries and to use the cluster endpoint for write queries.

• Question 110:

  A company hosts a data lake on AWS. The data lake consists of data in Amazon S3 and Amazon RDS for PostgreSQL.

  The company needs a reporting solution that provides data visualization and includes all the data sources within the data lake. Only the company's management team should have full access to all the visualizations. The rest of the company should have only limited access.

  Which solution will meet these requirements?

  A. Create an analysis in Amazon QuickSight. Connect all the data sources and create new datasets. Publish dashboards to visualize the data. Share the dashboards with the appropriate IAM roles.
  B. Create an analysis in Amazon QuickSight. Connect all the data sources and create new datasets. Publish dashboards to visualize the data. Share the dashboards with the appropriate users and groups.
  C. Create an AWS Glue table and crawler for the data in Amazon S3. Create an AWS Glue extract, transform, and load (ETL) job to produce reports. Publish the reports to Amazon S3. Use S3 bucket policies to limit access to the reports.
  D. Create an AWS Glue table and crawler for the data in Amazon S3. Use Amazon Athena Federated Query to access data within Amazon RDS for PostgreSQL. Generate reports by using Amazon Athena. Publish the reports to Amazon S3. Use S3 bucket policies to limit access to the reports.
  B. Create an analysis in Amazon QuickSight. Connect all the data sources and create new datasets. Publish dashboards to visualize the data. Share the dashboards with the appropriate users and groups.