Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 461:

  A company is hosting a high-traffic static website on Amazon S3 with an Amazon CloudFront distribution that has a default TTL of 0 seconds. The company wants to implement caching to improve performance for the website. However, the company also wants to ensure that stale content is not served for more than a few minutes after a deployment.

  Which combination of caching methods should a solutions architect implement to meet these requirements? (Choose two.)

  A. Set the CloudFront default TTL to 2 minutes.
  B. Set a default TTL of 2 minutes on the S3 bucket.
  C. Add a Cache-Control private directive to the objects in Amazon S3.
  D. Create an AWS Lambda@Edge function to add an Expires header to HTTP responses. Configure the function to run on viewer response.
  E. Add a Cache-Control max-age directive of 24 hours to the objects in Amazon S3. On deployment, create a CloudFront invalidation to clear any changed files from edge caches.
  A. Set the CloudFront default TTL to 2 minutes.
  E. Add a Cache-Control max-age directive of 24 hours to the objects in Amazon S3. On deployment, create a CloudFront invalidation to clear any changed files from edge caches.

• Question 462:

  A solutions architect needs to optimize a large data analytics job that runs on an Amazon EMR cluster. The job takes 13 hours to finish. The cluster has multiple core nodes and worker nodes deployed on large, compute-optimized instances.

  After reviewing EMR logs, the solutions architect discovers that several nodes are idle for more than 5 hours while the job is running. The solutions architect needs to optimize cluster performance.

  Which solution will meet this requirement MOST cost-effectively?

  A. Increase the number of core nodes to ensure there is enough processing power to handle the analytics job without any idle time.
  B. Use the EMR managed scaling feature to automatically resize the cluster based on workload.
  C. Migrate the analytics job to a set of AWS Lambda functions. Configure reserved concurrency for the functions.
  D. Migrate the analytics job core nodes to a memory-optimized instance type to reduce the total job runtime.
  B. Use the EMR managed scaling feature to automatically resize the cluster based on workload.

  ---

  Explanation

  EMR managed scaling dynamically resizes the cluster by adding or removing nodes based on the workload. This feature helps minimize idle time and reduces costs by scaling the cluster to meet processing demands efficiently.

  Option A: Increasing the number of core nodes might increase idle time further, as it does not address the root cause of underutilization.

  Option C: Migrating the job to Lambda is infeasible for large analytics jobs due to resource and runtime constraints.

  Option D: Changing to memory-optimized instances may not necessarily reduce idle time or optimize costs.

  References:

  EMR Managed Scaling

• Question 463:

  A company is deploying a critical application by using Amazon RDS for MySQL. The application must be highly available and must recover automatically. The company needs to support interactive users (transactional queries) and batch reporting (analytical queries) with no more than a 4-hour lag. The analytical queries must not affect the performance of the transactional queries.

  Which solution will meet these requirements?

  A. Configure Amazon RDS for MySQL in a Multi-AZ DB instance deployment with one standby instance. Point the transactional queries to the primary DB instance. Point the analytical queries to a secondary DB instance that runs in a different Availability Zone.
  B. Configure Amazon RDS for MySQL in a Multi-AZ DB cluster deployment with two standby instances. Point the transactional queries to the primary DB instance. Point the analytical queries to the reader endpoint.
  C. Configure Amazon RDS for MySQL to use multiple read replicas across multiple Availability Zones. Point the transactional queries to the primary DB instance. Point the analytical queries to one of the replicas in a different Availability Zone.
  D. Configure Amazon RDS for MySQL as the primary database for the transactional queries with automated backups enabled. Configure automated backups. Each night, create a read-only database from the most recent snapshot to support the analytical queries. Terminate the previously created database.
  C. Configure Amazon RDS for MySQL to use multiple read replicas across multiple Availability Zones. Point the transactional queries to the primary DB instance. Point the analytical queries to one of the replicas in a different Availability Zone.

  ---

  Explanation

  Key Requirements:

  High availability and automatic recovery.

  Separate transactional and analytical queries with minimal performance impact.

  Allow up to a 4-hour lag for analytical queries.

  Analysis of Options:

  Option A:

  Multi-AZ deployments provide high availability but do not include read replicas for separating transactional and analytical queries.

  Analytical queries on the secondary DB instance would impact the transactional workload.

  Incorrect Approach:Does not meet the requirement of query separation.

  Option B:

  Multi-AZ DB clusters provide high availability and include a reader endpoint. However, these are better suited for Aurora and not RDS for MySQL.

  Incorrect Approach:Not applicable to standard RDS for MySQL.

  Option C:

  Multiple read replicas allow separation of transactional and analytical workloads.

  Queries can be pointed to a replica in a different AZ, ensuring no impact on transactional queries.

  Correct Approach:Meets all requirements with high availability and query separation.

  Option D:

  Creating nightly snapshots and read-only databases adds significant operational overhead and does not support the 4-hour lag requirement.

  Incorrect Approach:Not practical for dynamic query separation.

  References:

  Amazon RDS Read Replicas

  Multi-AZ Deployments

• Question 464:

  A multinational company operates in multiple AWS Regions. The company must ensure that its developers and administrators have secure, role-based access to AWS resources.

  The roles must be specific to each user's geographic location and job responsibilities.

  The company wants to implement a solution to ensure that each team can access only resources within the team's Region. The company wants to use its existing directory service to manage user access. The existing directory service organizes users into roles based on location. The system must be capable of integrating seamlessly with multi-factor authentication (MFA).

  Which solution will meet these requirements?

  A. Use AWS Security Token Service (AWS STS) to generate temporary access tokens. Integrate STS with the directory service. Assign Region-specific roles.
  B. Configure AWS IAM Identity Center with federated access. Integrate IAM Identity Center with the directory service to set up Region-specific IAM roles.
  C. Create IAM managed policies that restrict access by location. Apply policies based on group membership in the directory.
  D. Use custom Lambda functions to dynamically assign IAM policies based on login location and job function.
  B. Configure AWS IAM Identity Center with federated access. Integrate IAM Identity Center with the directory service to set up Region-specific IAM roles.

  ---

  Explanation

  IAM Identity Center (formerly AWS SSO) is designed for:

  Federated access from external directories (e.g., Active Directory, Okta)

  Centralized permission management

  Support for MFA

  Granular control via Attribute-based access control (ABAC)

  "IAM Identity Center allows you to manage SSO access to AWS accounts and business applications centrally. You can assign users and groups permissions based on directory attributes such as Region and job role."

  -- IAM Identity Center Docs

  This option ensures:

  Federated, centralized access

  Region-specific permissions MFA and role mapping via existing directory service

  References:

  IAM Identity Center (SSO) Overview Set Up Attribute-Based Access Control

• Question 465:

  A company is expanding a secure on-premises network to the AWS Cloud by using an AWS Direct Connect connection. The on-premises network has no direct internet access. An application that runs on the on-premises network needs to use an Amazon S3 bucket.

  Which solution will meet these requirements MOST cost-effectively?

  A. Create a public virtual interface (VIF). Route the AWS traffic over the public VIF.
  B. Create a VPC and a NAT gateway. Route the AWS traffic from the on-premises network to the NAT gateway.
  C. Create a VPC and an Amazon S3 interface endpoint. Route the AWS traffic from the on-premises network to the S3 interface endpoint.
  D. Create a VPC peering connection between the on-premises network and Direct Connect. Route the AWS traffic over the peering connection.
  C. Create a VPC and an Amazon S3 interface endpoint. Route the AWS traffic from the on-premises network to the S3 interface endpoint.

• Question 466:

  A company recently migrated a large amount of research data to an Amazon S3 bucket. The company needs an automated solution to identify sensitive data in the bucket. A security team also needs to monitor access patterns for the data 24 hours a day, 7 days a week to identify suspicious activities or evidence of tampering with security controls.

  Which solution will meet these requirements?

  A. Set up AWS CloudTrail reporting, and grant the security team read-only access to the CloudTrail reports. Set up an Amazon S3 Inventory report to identify sensitive data. Review the findings with the security team.
  B. Enable Amazon Macie and Amazon GuardDuty on the account. Grant the security team access to Macie and GuardDuty. Review the findings with the security team.
  C. Set up an Amazon S3 Inventory report. Use Amazon Athena and Amazon QuickSight to identify sensitive data. Create a dashboard for the security team to review findings.
  D. Use AWS Identity and Access Management (IAM) Access Advisor to monitor for suspicious activity and tampering. Create a dashboard for the security team. Set up an Amazon S3 Inventory report to identify sensitive data. Review the findings with the security team.
  B. Enable Amazon Macie and Amazon GuardDuty on the account. Grant the security team access to Macie and GuardDuty. Review the findings with the security team.

  ---

  Explanation

  To automatically identify sensitive data in Amazon S3 and monitor access patterns for suspicious activities:

  Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data in S3. It provides visibility into data security risks and enables automated protection against those risks.

  Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads. It analyzes events from AWS CloudTrail, VPC Flow Logs, and DNS logs. By enabling both services, the company can automate the discovery of sensitive data and continuously monitor access patterns for potential security threats.

• Question 467:

  A company is making a prototype of the infrastructure for its new website by manually provisioning the necessary infrastructure. This infrastructure includes an Auto Scaling group, an Application Load Balancer and an Amazon RDS database. After the configuration has been thoroughly validated, the company wants the capability to immediately deploy the infrastructure for development and production use in two Availability Zones in an automated fashion.

  What should a solutions architect recommend to meet these requirements?

  A. Use AWS Systems Manager to replicate and provision the prototype infrastructure in two Availability Zones
  B. Define the infrastructure as a template by using the prototype infrastructure as a guide. Deploy the infrastructure with AWS CloudFormation.
  C. Use AWS Config to record the inventory of resources that are used in the prototype infrastructure. Use AWS Config to deploy the prototype infrastructure into two Availability Zones.
  D. Use AWS Elastic Beanstalk and configure it to use an automated reference to the prototype infrastructure to automatically deploy new environments in two Availability Zones.
  B. Define the infrastructure as a template by using the prototype infrastructure as a guide. Deploy the infrastructure with AWS CloudFormation.

• Question 468:

  A company wants to provide users with access to AWS resources. The company has 1,500 users and manages their access to on-premises resources through Active Directory user groups on the corporate network. However, the company does not want users to have to maintain another identity to access the resources. A solutions architect must manage user access to the AWS resources while preserving access to the on-premises resources.

  What should the solutions architect do to meet these requirements?

  A. Create an IAM user for each user in the company. Attach the appropriate policies to each user.
  B. Use Amazon Cognito with an Active Directory user pool. Create roles with the appropriate policies attached.
  C. Define cross-account roles with the appropriate policies attached. Map the roles to the Active Directory groups.
  D. Configure Security Assertion Markup Language (SAML) 2 0-based federation. Create roles with the appropriate policies attached Map the roles to the Active Directory groups.
  D. Configure Security Assertion Markup Language (SAML) 2 0-based federation. Create roles with the appropriate policies attached Map the roles to the Active Directory groups.

• Question 469:

  A company runs a mobile game app that stores session data (up to 256 KB) for up to 48 hours. The data updates frequently and must be deleted automatically after expiration. Restorability is also required.

  Which solution will meet these requirements?

  A. Use an Amazon DynamoDB table to store the session data. Enable point-in-time recovery (PITR) and TTL.
  B. Use Amazon MemoryDB and enable PITR and TTL.
  C. Store session data in S3 Standard. Enable Versioning and a Lifecycle rule to expire objects after 48 hours.
  D. Store data in S3 Intelligent-Tiering with Versioning and a Lifecycle rule to expire after 48 hours.
  A. Use an Amazon DynamoDB table to store the session data. Enable point-in-time recovery (PITR) and TTL.

  ---

  Explanation

  Amazon DynamoDB supports both TTL (Time to Live) for automatic deletion and Point-in-Time Recovery (PITR) for backup and restore of table data. It's ideal for frequently updated data with short retention requirements and minimal operational overhead.

  TTL attribute ensures expired items are automatically removed.

  PITR enables recovery from accidental deletes or application errors.

• Question 470:

  A company wants to provide data scientists with near real-time read-only access to the company's production Amazon RDS for PostgreSQL database. The database is currently configured as a Single-AZ database. The data scientists use complex queries that will not affect the production database. The company needs a solution that is highly available.

  Which solution will meet these requirements MOST cost-effectively?

  A. Scale the existing production database in a maintenance window to provide enough power for the data scientists.
  B. Change the setup from a Single-AZ to a Multi-AZ instance deployment with a larger secondary standby instance. Provide the data scientists access to the secondary instance.
  C. Change the setup from a Single-AZ to a Multi-AZ instance deployment. Provide two additional read replicas for the data scientists.
  D. Change the setup from a Single-AZ to a Multi-AZ cluster deployment with two readable standby instances. Provide read endpoints to the data scientists.
  D. Change the setup from a Single-AZ to a Multi-AZ cluster deployment with two readable standby instances. Provide read endpoints to the data scientists.