Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 1361:

  A company stores customer data in a multitenant Amazon S3 bucket. Each customer's data is stored in a prefix that is unique to the customer. The company needs to migrate data for specific customers to a new. dedicated S3 bucket that is in the same AWS Region as the source bucket. The company must preserve object metadata such as creation date and version IDs.

  After the migration is finished, the company must delete the source data for the migrated customers from the original multitenant S3 bucket.

  Which combination of solutions will meet these requirements with the LEAST overhead? (Choose Three.)

  A. Create a new S3 bucket as a destination bucket. Enable versioning on the new bucket.
  B. Use S3 batch operations to copy objects from the specified prefixes to the destination bucket.
  C. Use the S3 CopyObject API, and create a script to copy data to the destination S3 bucket.
  D. Configure S3 Same-Region Replication (SRR) to replicate existing data from the specified prefixes in the source bucket to the destination bucket.
  E. Configure AWS DataSync to migrate data from the specified prefixes in the source bucket to the destination bucket.
  F. Use an S3 Lifecycle policy to delete objects from the source bucket after the data is migrated to the destination bucket.
  A. Create a new S3 bucket as a destination bucket. Enable versioning on the new bucket.
  B. Use S3 batch operations to copy objects from the specified prefixes to the destination bucket.
  F. Use an S3 Lifecycle policy to delete objects from the source bucket after the data is migrated to the destination bucket.

  ---

  Explanation

  The combination of these solutions provides an efficient and automated way to migrate data while preserving metadata and ensuring cleanup:

  Create a new S3 bucket with versioning enabled(Option A) to preserve object metadata like version IDs during migration.

  UseS3 batch operations(Option B) to efficiently copy data from specific prefixes in the source bucket to the destination bucket, ensuring minimal overhead.

  Use an S3 Lifecycle policy(Option F) to automatically delete the data from the source bucket after it has been migrated, reducing manual intervention.

  Option C (CopyObject API): This approach would require more manual scripting and effort.

  Option D (Same-Region Replication): SRR is designed for ongoing replication, not for one-time migrations.

  Option E (DataSync): DataSync adds more complexity than necessary for this task.

• Question 1362:

  A company is running a highly sensitive application on Amazon EC2 backed by an Amazon RDS database. Compliance regulations mandate that all personally identifiable information (PII) be encrypted at rest.

  Which solution should a solutions architect recommend to meet this requirement with the LEAST amount of changes to the infrastructure?

  A. Deploy AWS Certificate Manager to generate certificates. Use the certificates to encrypt the database volume.
  B. Deploy AWS CloudHSM, generate encryption keys, and use the keys to encrypt database volumes.
  C. Configure SSL encryption using AWS Key Management Service (AWS KMS) keys to encrypt database volumes.
  D. Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes.
  D. Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes.

• Question 1363:

  A company has a non-production application that runs on an Amazon EC2 instance. The EC2 instance has an instance profile and an associated IAM role.

  The company wants to automate patching for the EC2 instance.

  Which solution will meet this requirement?

  A. Create a new IAM role. Attach the AmazonSSMManagedInstanceCore policy to the new IAM role. Attach the new IAM role to the EC2 instance profile. Use AWS Systems Manager to patch the instance.
  B. Create an IAM user. Attach the AmazonSSMManagedInstanceCore policy to the IAM user. Configure AWS Systems Manager to use the IAM user to patch the instance.
  C. Attach the AmazonSSMManagedInstanceCore policy to the existing IAM role. Use AWS Systems Manager to patch the EC2 instance.
  D. Attach the AmazonSSMManagedInstanceCore policy to an existing IAM user. Use EC2 Image Builder to patch the EC2 instance.
  C. Attach the AmazonSSMManagedInstanceCore policy to the existing IAM role. Use AWS Systems Manager to patch the EC2 instance.

  ---

  Explanation

  To manage EC2 instances with AWS Systems Manager (SSM), the EC2 instance must be configured as a managed instance by attaching an IAM role that has the AmazonSSMManagedInstanceCore managed policy.

  This policy allows:

  SSM agent to register the instance with SSM

  Perform actions like patching, automation, session management, inventory collection, etc.

  Access to SSM endpoints (via internet or VPC endpoint if needed)

  Since the EC2 instance already has an IAM role, the least operational overhead option is to attach the required policy to the existing role (Option C). No need to create new IAM roles or users, which simplifies management and adheres to the principle of least privilege.

  Patching can then be automated via SSM Patch Manager, ensuring consistency, compliance, and operational efficiency.

  # References:

  SSM Managed Instance Setup

  AmazonSSMManagedInstanceCore Policy Patching EC2 with SSM

• Question 1364:

  A company is deploying an application that processes streaming data in near-real time. The company plans to use Amazon EC2 instances for the workload. The network architecture must be configurable to provide the lowest possible latency between nodes.

  Which combination of network solutions will meet these requirements? (Choose two.)

  A. Enable and configure enhanced networking on each EC2 instance.
  B. Group the EC2 instances in separate accounts.
  C. Run the EC2 instances in a cluster placement group.
  D. Attach multiple elastic network interfaces to each EC2 instance.
  E. Use Amazon Elastic Block Store (Amazon EBS) optimized instance types.
  A. Enable and configure enhanced networking on each EC2 instance.
  C. Run the EC2 instances in a cluster placement group.

• Question 1365:

  A company recently migrated to the AWS Cloud. The company wants a serverless solution for large-scale parallel on-demand processing of a semistructured dataset. The data consists of logs, media files, sales transactions, and IoT sensor data that is stored in Amazon S3. The company wants the solution to process thousands of items in the dataset in parallel.

  Which solution will meet these requirements with the MOST operational efficiency?

  A. Use the AWS Step Functions Map state in Inline mode to process the data in parallel.
  B. Use the AWS Step Functions Map state in Distributed mode to process the data in parallel.
  C. Use AWS Glue to process the data in parallel.
  D. Use several AWS Lambda functions to process the data in parallel.
  B. Use the AWS Step Functions Map state in Distributed mode to process the data in parallel.

• Question 1366:

  A company collects and processes data from a vendor. The vendor stores its data in an Amazon RDS for MySQL database in the vendor's own AWS account. The company's VPC does not have an internet gateway, an AWS Direct Connect connection, or an AWS Site-to-Site VPN connection. The company needs to access the data that is in the vendor database.

  Which solution will meet this requirement?

  A. Instruct the vendor to sign up for the AWS Hosted Connection Direct Connect Program. Use VPC peering to connect the company's VPC and the vendor's VPC.
  B. Configure a client VPN connection between the company's VPC and the vendor's VPC. Use VPC peering to connect the company's VPC and the vendor's VPC.
  C. Instruct the vendor to create a Network Load Balancer (NLB). Place the NLB in front of the Amazon RDS for MySQL database. Use AWS PrivateLink to integrate the company's VPC and the vendor's VPC.
  D. Use AWS Transit Gateway to integrate the company's VPC and the vendor's VPC. Use VPC peering to connect the company's VPC and the vendor's VPC.
  C. Instruct the vendor to create a Network Load Balancer (NLB). Place the NLB in front of the Amazon RDS for MySQL database. Use AWS PrivateLink to integrate the company's VPC and the vendor's VPC.

• Question 1367:

  A company wants to migrate a Microsoft SQL Server database server from an on-premises data center to AWS. The company needs access to the operating system of the SQL Server database.

  Which solution will meet these requirements?

  A. Migrate the database to Amazon Aurora Serverless.
  B. Migrate the database to Amazon RDS for SQL Server.
  C. Migrate the database to Amazon EC2 instances that run SQL Server.
  D. Migrate the database to Amazon Redshift.
  C. Migrate the database to Amazon EC2 instances that run SQL Server.

  ---

  Explanation

  Amazon EC2 allows you to install and manage SQL Server directly on a Windows or Linux VM, giving you full access to the underlying operating system. This is required when you need to install custom agents, configure OS-level features, or have complete control over the environment.

  Amazon RDS and Aurora are managed services and do not provide access to the underlying OS, nor does Redshift (which is a data warehouse, not SQL Server).

  AWS Documentation Extract:

  " If you require access to the underlying operating system or need to install custom software, use SQL Server on Amazon EC2. Amazon RDS is a managed service and does not provide OS-level access. " (Source: AWS Database Migration documentation, SQL Server Deployment Options)

  References:

  AWS Certified Solutions Architect?Official Study Guide, Database Migration Section.

• Question 1368:

  A company is planning to run a group of Amazon EC2 instances that connect to an Amazon Aurora database. The company has built an AWS CloudFormation template to deploy the EC2 instances and the Aurora DB cluster. The company wants to allow the instances to authenticate to the database in a secure way. The company does not want to maintain static database credentials.

  Which solution meets these requirements with the LEAST operational effort?

  A. Create a database user with a user name and password. Add parameters for the database user name and password to the CloudFormation template. Pass the parameters to the EC2 instances when the instances are launched.
  B. Create a database user with a user name and password. Store the user name and password in AWS Systems Manager Parameter Store. Configure the EC2 instances to retrieve the database credentials from Parameter Store.
  C. Configure the DB cluster to use IAM database authentication. Create a database user to use with IAM authentication. Associate a role with the EC2 instances to allow applications on the instances to access the database.
  D. Configure the DB cluster to use IAM database authentication with an IAM user. Create a database user that has a name that matches the IAM user. Associate the IAM user with the EC2 instances to allow applications on the instances to access the database.
  C. Configure the DB cluster to use IAM database authentication. Create a database user to use with IAM authentication. Associate a role with the EC2 instances to allow applications on the instances to access the database.

• Question 1369:

  A company wants to use Amazon FSx for Windows File Server for its Amazon EC2 instances that have an SMB file share mounted as a volume in the us-east-1 Region. The company has a recovery point objective (RPO) of 5 minutes for planned system maintenance or unplanned service disruptions. The company needs to replicate the file system to the us-west-2 Region.

  The replicated data must not be deleted by any user for 5 years.

  Which solution will meet these requirements?

  A. Create an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
  B. Create an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
  C. Create an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
  D. Create an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
  C. Create an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.

• Question 1370:

  A company has applications that run on Amazon EC2 instances. The EC2 instances connect to Amazon RDS databases by using an IAM role that has associated policies. The company wants to use AWS Systems Manager to patch the EC2 instances without disrupting the running applications.

  Which solution will meet these requirements?

  A. Create a new IAM role. Attach the AmazonSSMManagedInstanceCore policy to the new IAM role. Attach the new IAM role to the EC2 instances and the existing IAM role.
  B. Create an IAM user. Attach the AmazonSSMManagedInstanceCore policy to the IAM user. Configure Systems Manager to use the IAM user to manage the EC2 instances.
  C. Enable Default Host Configuration Management in Systems Manager to manage the EC2 instances.
  D. Remove the existing policies from the existing IAM role. Add the AmazonSSMManagedInstanceCore policy to the existing IAM role.
  C. Enable Default Host Configuration Management in Systems Manager to manage the EC2 instances.