Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 1201:

  A company runs an application on Amazon EC2 instances. The application is deployed in private subnets in three Availability Zones of the us-east-1 Region. The instances must be able to connect to the internet to download files. The company wants a design that is highly available across the Region.

  Which solution should be implemented to ensure that there are no disruptions to internet connectivity?

  A. Deploy a NAT instance in a private subnet of each Availability Zone.
  B. Deploy a NAT gateway in a public subnet of each Availability Zone.
  C. Deploy a transit gateway in a private subnet of each Availability Zone.
  D. Deploy an internet gateway in a public subnet of each Availability Zone.
  B. Deploy a NAT gateway in a public subnet of each Availability Zone.

  ---

  Explanation

  Explanation (AWS Docs): To allow private subnets to access the internet, deploy NAT gateways in a public subnet in each AZ for high availability. NAT instances are less scalable and less fault-tolerant. "To create a highly available architecture, create a NAT gateway in each Availability Zone and configure your routing to use it."

• Question 1202:

  A company runs a web application in a single AWS Region. A solutions architect wants to ensure that the web application can continue to operate if the application becomes unavailable in the Region.

  Which solution will meet this requirement?

  A. Deploy the application in multiple Regions. Use Amazon Route 53 DNS health checks to route traffic to a healthy Region.
  B. Deploy the application in multiple Availability Zones within a single Region. Use Amazon Route 53 DNS health checks to route traffic to healthy application resources.
  C. Deploy the application in multiple Regions. Use an Amazon Route 53 simple routing record to route traffic to a healthy Region.
  D. Deploy the application in multiple Availability Zones within a single Region. Use an Amazon Route 53 latency record in each Availability Zone to route traffic to a healthy Availability Zone.
  A. Deploy the application in multiple Regions. Use Amazon Route 53 DNS health checks to route traffic to a healthy Region.

  ---

  Explanation

  To protect against a Regional failure, the application must be deployed in multiple Regions. Amazon Route 53 DNS failover with health checks allows traffic to be automatically routed to a healthy Region when the primary becomes unavailable, meeting high availability and disaster recovery requirements.

  References:

  AWS Well-Architected Framework?Multi-Region High Availability with Route 53 Health Checks

• Question 1203:

  A company wants to create an Amazon EMR cluster that multiple teams will use. The company wants to ensure that each team's big data workloads can access only the AWS services that each team needs to interact with. The company does not want the workloads to have access to Instance Metadata Service Version 2 (IMDSv2) on the cluster's underlying EC2 instances.

  Which solution will meet these requirements?

  A. Configure interface VPC endpoints for each AWS service that the teams need. Use the required interface VPC endpoints to submit the big data workloads.
  B. Create EMR runtime roles. Configure the cluster to use the runtime roles. Use the runtime roles to submit the big data workloads.
  C. Create an EC2 IAM instance profile that has the required permissions for each team. Use the instance profile to submit the big data workloads.
  D. Create an EMR security configuration that has the EnableApplicationScopedIAMRole option set to false. Use the security configuration to submit the big data workloads.
  B. Create EMR runtime roles. Configure the cluster to use the runtime roles. Use the runtime roles to submit the big data workloads.

• Question 1204:

  A company deployed a three-tier web application in a single Availability Zone in the us-east-1 Region on a single Amazon EC2 instance. Usage of the application is growing.

  A solutions architect needs to ensure that the application can handle the growing amount of traffic and that the application is resilient. The solution must be cost-effective.

  Which solution will meet these requirements MOST cost-effectively?

  A. Create two additional EC2 instances spread across two separate Availability Zones. Create an Application Load Balancer (ALB). Configure the ALB to route traffic to a target group that contains all three instances. Create an Amazon CloudWatch alarm to scale the EC2 instances vertically to handle the application traffic.
  B. Create eight additional EC2 instances spread across three separate Availability Zones. Create an Application Load Balancer (ALB). Configure the ALB to route traffic to a target group that contains all nine instances. Create an Amazon CloudWatch alarm to scale the EC2 instances horizontally to handle the application traffic.
  C. Create an EC2 Auto Scaling group that contains a minimum of three EC2 instances in the same Availability Zone. Create an Application Load Balancer (ALB). Configure the ALB to route traffic to a target group that contains all the instances. Configure scheduled scaling for the Auto Scaling group.
  D. Create an EC2 Auto Scaling group that contains a minimum of three EC2 instances spread across Availability Zones. Create an Application Load Balancer (ALB). Configure the ALB to route traffic to a target group that contains all the instances. Create an Amazon CloudWatch alarm to scale the EC2 instances horizontally to handle the application traffic.
  D. Create an EC2 Auto Scaling group that contains a minimum of three EC2 instances spread across Availability Zones. Create an Application Load Balancer (ALB). Configure the ALB to route traffic to a target group that contains all the instances. Create an Amazon CloudWatch alarm to scale the EC2 instances horizontally to handle the application traffic.

  ---

  Explanation

  AWS best practice for a highly available, resilient web application is:

  Run EC2 instances in an Auto Scaling group across multiple Availability Zones.

  Put an Application Load Balancer (ALB) in front of the Auto Scaling group.

  Use CloudWatch alarms and scaling policies for horizontal scaling based on demand.

  Option D implements exactly this: a minimum of three instances spread across AZs (resilience to AZ failure), behind an ALB, with automatic horizontal scaling. This provides both elasticity and high availability with good cost efficiency (instances scale out/in based on traffic).

  Option A uses only three fixed instances and relies on vertical scaling, which does not scale as well and is less resilient.

  Option B overprovisions to nine instances from the start, which is unnecessarily expensive.

  Option C keeps all instances in a single AZ, which does not meet resilience requirements.

• Question 1205:

  A company has a large data workload that runs for 6 hours each day. The company cannot lose any data while the process is running. A solutions architect is designing an Amazon EMR cluster configuration to support this critical data workload.

  Which solution will meet these requirements MOST cost-effectively?

  A. Configure a long-running cluster that runs the primary node and core nodes on On-Demand Instances and the task nodes on Spot Instances.
  B. Configure a transient cluster that runs the primary node and core nodes on On-Demand Instances and the task nodes on Spot Instances.
  C. Configure a transient cluster that runs the primary node on an On-Demand Instance and the core nodes and task nodes on Spot Instances.
  D. Configure a long-running cluster that runs the primary node on an On-Demand Instance, the core nodes on Spot Instances, and the task nodes on Spot Instances.
  B. Configure a transient cluster that runs the primary node and core nodes on On-Demand Instances and the task nodes on Spot Instances.

• Question 1206:

  A serverless application uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The Lambda function needs permissions to read and write to the DynamoDB table.

  Which solution will give the Lambda function access to the DynamoDB table MOST securely?

  A. Create an IAM user with programmatic access to the Lambda function. Attach a policy to the user that allows read and write access to the DynamoDB table. Store the access_key_id and secret_access_key parameters as part of the Lambda environment variables. Ensure that other AWS users do not have read and write access to the Lambda function configuration.
  B. Create an IAM role that includes Lambda as a trusted service. Attach a policy to the role that allows read and write access to the DynamoDB table. Update the configuration of the Lambda function to use the new role as the execution role.
  C. Create an IAM user with programmatic access to the Lambda function. Attach a policy to the user that allows read and write access to the DynamoDB table. Store the access_key_id and secret_access_key parameters in AWS Systems Manager Parameter Store as secure string parameters. Update the Lambda function code to retrieve the secure string parameters before connecting to the DynamoDB table.
  D. Create an IAM role that includes DynamoDB as a trusted service. Attach a policy to the role that allows read and write access from the Lambda function. Update the code of the Lambda function to attach to the new role as an execution role.
  B. Create an IAM role that includes Lambda as a trusted service. Attach a policy to the role that allows read and write access to the DynamoDB table. Update the configuration of the Lambda function to use the new role as the execution role.

• Question 1207:

  A company uses high concurrency AWS Lambda functions to process a constantly increasing number of messages in a message queue during marketing events. The Lambda functions use CPU intensive code to process the messages.

  The company wants to reduce the compute costs and to maintain service latency for its customers.

  Which solution will meet these requirements?

  A. Configure reserved concurrency for the Lambda functions. Decrease the memory allocated to the Lambda functions.
  B. Configure reserved concurrency for the Lambda functions. Increase the memory according to AWS Compute Optimizer recommendations.
  C. Configure provisioned concurrency for the Lambda functions. Decrease the memory allocated to the Lambda functions.
  D. Configure provisioned concurrency for the Lambda functions. Increase the memory according to AWS Compute Optimizer recommendations.
  D. Configure provisioned concurrency for the Lambda functions. Increase the memory according to AWS Compute Optimizer recommendations.

• Question 1208:

  A company uses an Amazon S3 bucket as its data lake storage platform. The S3 bucket contains a massive amount of data that is accessed randomly by multiple teams and hundreds of applications. The company wants to reduce the S3 storage costs and provide immediate availability for frequently accessed objects.

  What is the MOST operationally efficient solution that meets these requirements?

  A. Create an S3 Lifecycle rule to transition objects to the S3 Intelligent-Tiering storage class.
  B. Store objects in Amazon S3 Glacier. Use S3 Select to provide applications with access to the data.
  C. Use data from S3 storage class analysis to create S3 Lifecycle rules to automatically transition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class.
  D. Transition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Create an AWS Lambda function to transition objects to the S3 Standard storage class when they are accessed by an application.
  A. Create an S3 Lifecycle rule to transition objects to the S3 Intelligent-Tiering storage class.

• Question 1209:

  A company is implementing a new policy to enhance the security of its AWS environment. The policy requires all administrative actions that users perform on the AWS Management Console to be secured by multi-factor authentication (MFA).

  Which solution will allow the company to enforce this policy in the MOST operationally efficient way?

  A. Enable MFA on the root account. Ensure that all administrators use the root account to perform administrative actions.
  B. Create an IAM policy that requires MFA to be enabled for the IAM roles that administrators assume to perform administrative actions.
  C. Configure an Amazon CloudWatch alarm that sends an email notification when an administrator performs an administrative action without MFA.
  D. Use AWS Config to periodically audit IAM users and to automatically attach an IAM policy that requires MFA when AWS Config detects administrative actions.
  B. Create an IAM policy that requires MFA to be enabled for the IAM roles that administrators assume to perform administrative actions.

• Question 1210:

  A global company is using Amazon API Gateway to design REST APIs for its loyalty club users in the us-east-1 Region and the ap-southeast-2 Region. A solutions architect must design a solution to protect these API Gateway managed REST APIs across multiple accounts from SQL injection and cross-site scripting attacks.

  Which solution will meet these requirements with the LEAST amount of administrative effort?

  A. Set up AWS WAF in both Regions. Associate Regional web ACLs with an API stage.
  B. Set up AWS Firewall Manager in both Regions. Centrally configure AWS WAF rules.
  C. Set up AWS Shield in bath Regions. Associate Regional web ACLs with an API stage.
  D. Set up AWS Shield in one of the Regions. Associate Regional web ACLs with an API stage.
  B. Set up AWS Firewall Manager in both Regions. Centrally configure AWS WAF rules.