A company uses Amazon EC2 instances to host a website. The website uses an Amazon S3 bucket to store media files. The company wants to automate infrastructure creation across multiple Regions and securely grant EC2 access to S3 using IAM.
Which solution will meet these requirements MOST securely?
A. Store IAM access keys in UserData. B. Store access keys in S3 and reference them in CloudFormation. C. Use an IAM role and instance profile in CloudFormation. D. Retrieve access keys dynamically and store them on EC2.
C. Use an IAM role and instance profile in CloudFormation.
Explanation
The most secure and AWS-recommended way for EC2 instances to access AWS services is by using IAM roles attached through instance profiles. Option C correctly implements this pattern.
IAM roles provide temporary credentials via the EC2 metadata service, eliminating the need for long-term access keys. Using CloudFormation ensures consistent, repeatable deployments across Regions while maintaining security best practices.
All other options expose long-term credentials, increasing the risk of compromise and violating AWS security guidance. Therefore, C is the correct and most secure solution.
Question 372:
A company runs workloads on AWS. The company needs to connect to a service from an external provider. The service is hosted in the provider's VPC. According to the company's security team, the connectivity must be private and must be restricted to the target service. The connection must be initiated only from the company's VPC.
Which solution will mast these requirements?
A. Create a VPC peering connection between the company's VPC and the provider's VPC. Update the route table to connect to the target service. B. Ask the provider to create a virtual private gateway in its VPC. Use AWS PrivateLink to connect to the target service. C. Create a NAT gateway in a public subnet of the company's VPUpdate the route table to connect to the target service. D. Ask the provider to create a VPC endpoint for the target service. Use AWS PrivateLink to connect to the target service.
D. Ask the provider to create a VPC endpoint for the target service. Use AWS PrivateLink to connect to the target service.
Question 373:
A company uses an Amazon CloudFront distribution to serve thousands of media files to users. The CloudFront distribution uses a private Amazon S3 bucket as an origin. A solutions architect must prevent users in specific countries from accessing the company's files.
Which solution will meet these requirements in the MOST operationally-efficient way?
A. Require users to access the files by using CloudFront signed URLs. B. Configure geographic restrictions in CloudFront. C. Require users to access the files by using CloudFront signed cookies. D. Configure an origin access control (OAC) between CloudFront and the S3 bucket.
B. Configure geographic restrictions in CloudFront.
Explanation
CloudFront geographic restrictions (also known as geo-blocking) allow you to allow or deny content delivery to specific countries with minimal configuration. "You can use geo restriction, also known as geoblocking, to prevent users in specific geographic locations from accessing content that you ' re distributing through a CloudFront web distribution." -- CloudFront Geo Restriction.
This is the most operationally efficient approach -- no code, no signed URL logic.
Incorrect Options:
A/C: Signed URLs/cookies are for individual access control, not geo-blocking.
OptionD: OAC controls access between CloudFront and S3, not to block specific countries.
References:
Geographic Restrictions in CloudFront
Question 374:
A company is building a cloud-based application on AWS that will handle sensitive customer data. The application uses Amazon RDS for the database, Amazon S3 for object storage, and S3 Event Notifications that invoke AWS Lambda for serverless processing. The company uses AWS IAM Identity Center to manage user credentials. The development, testing, and operations teams need secure access to Amazon RDS and Amazon S3 while ensuring the confidentiality of sensitive customer data.
The solution must comply with the principle of least privilege.
Which solution meets these requirements with the LEAST operational overhead?
A. Use IAM roles with least privilege to grant all the teams access. Assign IAM roles to each team with customized IAM policies defining specific permission for Amazon RDS and S3 object access based on team responsibilities. B. Enable IAM Identity Center with an Identity Center directory. Create and configure permission sets with granular access to Amazon RDS and Amazon S3. Assign all the teams to groups that have specific access with the permission sets. C. Create individual IAM users for each member in all the teams with role-based permissions. Assign the IAM roles with predefined policies for RDS and S3 access to each user based on user needs. Implement IAM Access Analyzer for periodic credential evaluation. D. Use AWS Organizations to create separate accounts for each team. Implement cross-account IAM roles with least privilege. Grant specific permission for RDS and S3 access based on team roles and responsibilities.
B. Enable IAM Identity Center with an Identity Center directory. Create and configure permission sets with granular access to Amazon RDS and Amazon S3. Assign all the teams to groups that have specific access with the permission sets.
Question 375:
A company is building a serverless application that processes large volumes of data from a mobile app.
The application uses an AWS Lambda function to process the data and store the data in an Amazon DynamoDB table.
The company needs to ensure that the application can recover from failures and continue processing data without losing any records.
A. Configure the Lambda function to use a dead-letter queue with an Amazon Simple Queue Service (Amazon SQS) queue. Configure Lambda to retry failed records from the dead-letter queue. Use a retry mechanism by implementing an exponential backoff algorithm. B. Configure the Lambda function to read records from Amazon Data Firehose. Replay the Firehose records in case of any failures. C. Use Amazon OpenSearch Service to store failed records. Configure AWS Lambda to retry failed records from OpenSearch Service. Use Amazon EventBridge to orchestrate the retry logic. D. Use Amazon Simple Notification Service (Amazon SNS) to store the failed records. Configure Lambda to retry failed records from the SNS topic. Use Amazon API Gateway to orchestrate the retry calls.
A. Configure the Lambda function to use a dead-letter queue with an Amazon Simple Queue Service (Amazon SQS) queue. Configure Lambda to retry failed records from the dead-letter queue. Use a retry mechanism by implementing an exponential backoff algorithm.
Explanation
Dead-letter queues (DLQs) with Amazon SQS allow Lambda functions to offload failed events for later inspection or retry. Using retry logic with exponential backoff ensures resilience and compliance with best practices for fault-tolerant serverless architectures. This guarantees no data is lost due to transient errors.
References:
AWS Documentation?Lambda Error Handling and Dead-Letter Queues.
Question 376:
A large company wants to provide its globally located developers separate, limited size, managed PostgreSQL databases for development purposes. The databases will be low volume. The developers need the databases only when they are actively working.
Which solution will meet these requirements MOST cost-effectively?
A. Give the developers the ability to launch separate Amazon Aurora instances. Set up a process to shut down Aurora instances at the end of the workday and to start Aurora instances at the beginning of the next workday. B. Develop an AWS Service Catalog product that enforces size restrictions for launching Amazon Aurora instances. Give the developers access to launch the product when they need a development database. C. Create an Amazon Aurora Serverless cluster. Develop an AWS Service Catalog product to launch databases in the cluster with the default capacity settings. Grant the developers access to the product. D. Monitor AWS Trusted Advisor checks for idle Amazon RDS databases. Create a process to terminate identified idle RDS databases.
C. Create an Amazon Aurora Serverless cluster. Develop an AWS Service Catalog product to launch databases in the cluster with the default capacity settings. Grant the developers access to the product.
Question 377:
A manufacturing company develops an application to give a small team of executives the ability to track sales performance globally. The application provides a real-time simulator in a popular programming language. The company uses AWS Lambda functions to support the simulator. The simulator is an algorithm that predicts sales performance based on specific variables. Although the solution works well initially, the company notices that the time required to complete simulations is increasing exponentially. A solutions architect needs to improve the response time of the simulator.
Which solution will meet this requirement in the MOST cost-effective way?
A. Use AWS Fargate to run the simulator. Serve requests through an Application Load Balancer (ALB). B. Use Amazon EC2 instances to run the simulator. Serve requests through an Application Load Balancer (ALB). C. Use AWS Batch to run the simulator. Serve requests through a Network Load Balancer (NLB). D. Use Lambda provisioned concurrency for the simulator functions.
D. Use Lambda provisioned concurrency for the simulator functions.
Explanation
When an AWS Lambda function is invoked, especially after periods of inactivity, it may experience cold starts that delay execution. As demand increases, the scaling behavior and latency of Lambda can affect performance. Provisioned Concurrency is an AWS feature designed specifically to solve this issue.
Why Option D is correct:
Provisioned Concurrency ensures that a specified number of Lambda function instances are always warm and ready to serve requests, eliminating cold start latency.
It's cost-effective for workloads with consistent usage patterns, like real-time simulations for a small user group.
Maintains scalability and low overhead of Lambda without moving to managed container or EC2 platforms.
Why the other options are incoreect:
Option A (Fargate) and Option B (EC2): Introduce more infrastructure and higher ongoing costs for a small team with likely intermittent usage.
Option C (AWS Batch): Ideal for batch jobs, not real-time simulations; also incurs higher latency due to job queuing.
Question 378:
A company is developing a platform to process large volumes of data for complex analytics and machine learning (ML) tasks. The platform must handle compute-intensive workloads. The workloads currently require 20 to 30 minutes for each data processing step.
The company wants a solution to accelerate data processing.
Which solution will meet these requirements with the LEAST operational overhead?
A. Deploy three Amazon EC2 instances. Distribute the EC2 instances across three Availability Zones. Use traditional batch processing techniques for data processing. B. Create an Amazon EMR cluster. Use managed scaling. Install Apache Spark to assist with data processing. C. Create an AWS Lambda function for each data processing step. Deploy an Amazon Simple Queue Service (Amazon SQS) queue to relay data between Lambda functions. D. Create a series of AWS Lambda functions to process the data. Use AWS Step Functions to orchestrate the Lambda functions into data processing steps.
B. Create an Amazon EMR cluster. Use managed scaling. Install Apache Spark to assist with data processing.
Explanation
Amazon EMR provides a managed big data framework that supports Apache Spark, which is ideal for distributed and compute-intensive data transformations. Managed scaling dynamically adjusts cluster resources, ensuring high performance with minimal management.
From AWS Documentation: "Amazon EMR provides a managed environment for big data frameworks such as Apache Spark and Hadoop. With managed scaling, EMR automatically resizes clusters to meet workload demands." (Source: Amazon EMR Developer Guide)
Why Option B is correct:
Provides distributed parallel processing for large datasets.
Reduces operational overhead with managed scaling and auto-termination.
Integrates easily with S3, Glue, and ML pipelines.
Optimized for heavy ETL and analytics workloads.
Why others are incorrect:
Option A: Manual scaling and limited processing capacity.
Options C & D: Lambda has execution time and memory limits unsuitable for 30-minute compute-intensive tasks.
A company has a production web application in which users upload documents through a web interface or a mobile app. According to a new regulatory requirement. new documents cannot be modified or deleted after they are stored.
What should a solutions architect do to meet this requirement?
A. Store the uploaded documents in an Amazon S3 bucket with S3 Versioning and S3 Object Lock enabled. B. Store the uploaded documents in an Amazon S3 bucket. Configure an S3 Lifecycle policy to archive the documents periodically. C. Store the uploaded documents in an Amazon S3 bucket with S3 Versioning enabled. Configure an ACL to restrict all access to read-only. D. Store the uploaded documents on an Amazon Elastic File System (Amazon EFS) volume. Access the data by mounting the volume in read-only mode.
A. Store the uploaded documents in an Amazon S3 bucket with S3 Versioning and S3 Object Lock enabled.
Question 380:
A company has a legacy data processing application that runs on Amazon EC2 instances. Data is processed sequentially, but the order of results does not matter. The application uses a monolithic architecture. The only way that the company can scale the application to meet increased demand is to increase the size of the instances. The company's developers have decided to rewrite the application to use a microservices architecture on Amazon Elastic Container Service (Amazon ECS).
What should a solutions architect recommend for communication between the microservices?
A. Create an Amazon Simple Queue Service (Amazon SQS) queue. Add code to the data producers, and send data to the queue. Add code to the data consumers to process data from the queue. B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Add code to the data producers, and publish notifications to the topic. Add code to the data consumers to subscribe to the topic. C. Create an AWS Lambda function to pass messages. Add code to the data producers to call the Lambda function with a data object. Add code to the data consumers to receive a data object that is passed from the Lambda function. D. Create an Amazon DynamoDB table. Enable DynamoDB Streams. Add code to the data producers to insert data into the table. Add code to the data consumers to use the DynamoDB Streams API to detect new table entries and retrieve the data.
A. Create an Amazon Simple Queue Service (Amazon SQS) queue. Add code to the data producers, and send data to the queue. Add code to the data consumers to process data from the queue.
Nowadays, the certification exams become more and more important and required by more and more
enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare
for the exam in a short time with less efforts? How to get a ideal result and how to find the
most reliable resources? Here on Vcedump.com, you will find all the answers.
Vcedump.com provide not only Amazon exam questions,
answers and explanations but also complete assistance on your exam preparation and certification
application. If you are confused on your SAA-C03 exam preparations
and Amazon certification application, do not hesitate to visit our
Vcedump.com to find your solutions here.