Amazon Amazon Certifications SAA-C03 Questions & Answers

• Question 501:

  A company sells datasets to customers who do research in artificial intelligence and machine learning (Al/ML) The datasets are large, formatted files that are stored in an Amazon S3 bucket in the us-east-1 Region The company hosts a web application that the customers use to purchase access to a given dataset The web application is deployed on multiple Amazon EC2 instances behind an Application Load Balancer After a purchase is made customers receive an S3 signed URL that allows access to the files.

  The customers are distributed across North America and Europe The company wants to reduce the cost that is associated with data transfers and wants to maintain or improve performance.

  What should a solutions architect do to meet these requirements?

  A. Configure S3 Transfer Acceleration on the existing S3 bucket Direct customer requests to the S3 Transfer Acceleration endpoint Continue to use S3 signed URLs for access control

  B. Deploy an Amazon CloudFront distribution with the existing S3 bucket as the origin Direct customer requests to the CloudFront URL Switch to CloudFront signed URLs for access control

  C. Set up a second S3 bucket in the eu-central-1 Region with S3 Cross-Region Replication between the buckets Direct customer requests to the closest Region Continue to use S3 signed URLs for access control

  D. Modify the web application to enable streaming of the datasets to end users. Configure the web application to read the data from the existing S3 bucket Implement access control directly in the application

  Correct Answer: B

  To reduce the cost associated with data transfers and maintain or improve performance, a solutions architect should use Amazon CloudFront, a content delivery network (CDN) service that securely delivers data, videos, applications, and

  APIs to customers globally with low latency and high transfer speeds.

  Deploying a CloudFront distribution with the existing S3 bucket as the origin will allow the company to serve the data to customers from edge locations that are closer to them, reducing data transfer costs and improving performance.

  Directing customer requests to the CloudFront URL and switching to CloudFront signed URLs for access control will enable customers to access the data securely and efficiently.

  https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html

• Question 502:

  A company collects data from thousands of remote devices by using a RESTful web services application that runs on an Amazon EC2 instance. The EC2 instance receives the raw data, transforms the raw data, and stores all the data in an Amazon S3 bucket. The number of remote devices will increase into the millions soon. The company needs a highly scalable solution that minimizes operational overhead.

  Which combination of steps should a solutions architect take to meet these requirements9 (Select TWO.)

  A. Use AWS Glue to process the raw data in Amazon S3.

  B. Use Amazon Route 53 to route traffic to different EC2 instances.

  C. Add more EC2 instances to accommodate the increasing amount of incoming data.

  D. Send the raw data to Amazon Simple Queue Service (Amazon SOS). Use EC2 instances to process the data.

  E. Use Amazon API Gateway to send the raw data to an Amazon Kinesis data stream. Configure Amazon Kinesis Data Firehose to use the data stream as a source to deliver the data to Amazon S3.

  Correct Answer: AE

  "RESTful web services" => API Gateway.

  "EC2 instance receives the raw data, transforms the raw data, and stores all the data in an Amazon S3 bucket" => GLUE with (Extract-Transform-Load)

• Question 503:

  A company is running a publicly accessible serverless application that uses Amazon API Gateway and AWS Lambda. The application's traffic recently spiked due to fraudulent requests from botnets. Which steps should a solutions architect take to block requests from unauthorized users? (Select TWO.)

  A. Create a usage plan with an API key that is shared with genuine users only.

  B. Integrate logic within the Lambda function to ignore the requests from fraudulent IP addresses.

  C. Implement an AWS WAF rule to target malicious requests and trigger actions to filter them out.

  D. Convert the existing public API to a private API. Update the DNS records to redirect users to the new API endpoint.

  E. Create an IAM role for each user attempting to access the API. A user will assume the role when making the API call.

  Correct Answer: AC

  https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-usage-plans.html#:~:text=Don%27t%20rely%20on%20API%20keys%20as%20your%20only%20means%20of%20authentication%20and%20authorization% 20for%20your%20APIs

  https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-usage-plans.html

• Question 504:

  A rapidly growing ecommerce company is running its workloads in a single AWS Region. A solutions architect must create a disaster recovery (DR) strategy that includes a different AWS Region The company wants its database to be up to date in the DR Region with the least possible latency The remaining infrastructure in the DR Region needs to run at reduced capacity and must be able to scale up it necessary

  Which solution will meet these requirements with the LOWEST recovery time objective (RTO)?

  A. Use an Amazon Aurora global database with a pilot light deployment

  B. Use an Amazon Aurora global database with a warm standby deployment

  C. Use an Amazon RDS Multi-AZ DB instance with a pilot light deployment

  D. Use an Amazon RDS Multi-AZ DB instance with a warm standby deployment

  Correct Answer: B

  Note: The difference between pilot light and warm standby can sometimes be difficult to understand. Both include an environment in your DR Region with copies of your primary Region assets. The distinction is that pilot light cannot process requests without additional action taken first, whereas warm standby can handle traffic (at reduced capacity levels) immediately. The pilot light approach requires you to "turn on" servers, possibly deploy additional (non-core) infrastructure, and scale up, whereas warm standby only requires you to scale up (everything is already deployed and running). Use your RTO and RPO needs to help you choose between these approaches.

  https://docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/disaster-recovery-options-in-the-cloud.html

• Question 505:

  An ecommerce company is experiencing an increase in user traffic. The company's store is deployed on Amazon EC2 instances as a two-tier web application consisting of a web tier and a separate database tier. As traffic increases, the

  company notices that the architecture is causing significant delays in sending timely marketing and order confirmation email to users. The company wants to reduce the time it spends resolving complex email delivery issues and minimize

  operational overhead.

  What should a solutions architect do to meet these requirements?

  A. Create a separate application tier using EC2 instances dedicated to email processing.

  B. Configure the web instance to send email through Amazon Simple Email Service (Amazon SES).

  C. Configure the web instance to send email through Amazon Simple Notification Service (Amazon SNS)

  D. Create a separate application tier using EC2 instances dedicated to email processing. Place the instances in an Auto Scaling group.

  Correct Answer: B

  Amazon SES is a cost-effective and scalable email service that enables businesses to send and receive email using their own email addresses and domains. Configuring the web instance to send email through Amazon SES is a simple and

  effective solution that can reduce the time spent resolving complex email delivery issues and minimize operational overhead.

• Question 506:

  A company has a web server running on an Amazon EC2 instance in a public subnet with an Elastic IP address. The default security group is assigned to the EC2 instance. The default network ACL has been modified to block all traffic. A solutions architect needs to make the web server accessible from everywhere on port 443.

  Which combination of steps will accomplish this task? (Choose two.)

  A. Create a security group with a rule to allow TCP port 443 from source 0.0.0.0/0.

  B. Create a security group with a rule to allow TCP port 443 to destination 0.0.0.0/0.

  C. Update the network ACL to allow TCP port 443 from source 0.0.0.0/0.

  D. Update the network ACL to allow inbound/outbound TCP port 443 from source 0.0.0.0/0 and to destination 0.0.0.0/0.

  E. Update the network ACL to allow inbound TCP port 443 from source 0.0.0.0/0 and outbound TCP port 32768-65535 to destination 0.0.0.0/0.

  Correct Answer: AE

• Question 507:

  A company must migrate 20 TB of data from a data center to the AWS Cloud within 30 days. The company's network bandwidth is limited to 15 Mbps and cannot exceed 70% utilization. What should a solutions architect do to meet these requirements?

  A. Use AWS Snowball.

  B. Use AWS DataSync.

  C. Use a secure VPN connection.

  D. Use Amazon S3 Transfer Acceleration.

  Correct Answer: A

  AWS Snowball is a secure data transport solution that accelerates moving large amounts of data into and out of the AWS cloud. It can move up to 80 TB of data at a time, and provides a network bandwidth of up to 50 Mbps, so it is well-suited for the task. Additionally, it is secure and easy to use, making it the ideal solution for this migration.

• Question 508:

  A company needs to provide its employee with secure access to confidential and sensitive files. The company wants to ensure that the files can be accessed only by authorized users. The files must be downloaded security to the employees devices.

  The files are stored in an on-premises Windows files server. However, due to an increase in remote usage, the file server out of capacity.

  Which solution will meet these requirement?

  A. Migrate the file server to an Amazon EC2 instance in a public subnet. Configure the security group to limit inbound traffic to the employees ,IP addresses.

  B. Migrate the files to an Amazon FSx for Windows File Server file system. Integrate the Amazon FSx file system with the on-premises Active Directory Configure AWS Client VPN.

  C. Migrate the files to Amazon S3, and create a private VPC endpoint. Create a signed URL to allow download.

  D. Migrate the files to Amazon S3, and create a public VPC endpoint Allow employees to sign on with AWS IAM identity Center (AWS Sing-On).

  Correct Answer: B

  This solution addresses the need for secure access to confidential and sensitive files, as well as the increase in remote usage. Migrating the files to Amazon FSx for Windows File Server provides a scalable, fully managed file storage solution in the AWS Cloud that is accessible from on-premises and cloud environments. Integration with the on-premises Active Directory allows for a consistent user experience and centralized access control. AWS Client VPN provides a secure and managed VPN solution that can be used by employees to access the files securely.

• Question 509:

  A company experienced a breach that affected several applications in its on-premises data center The attacker took advantage of vulnerabilities in the custom applications that were running on the servers The company is now migrating its applications to run on Amazon EC2 instances The company wants to implement a solution that actively scans for vulnerabilities on the EC2 instances and sends a report that details the findings

  Which solution will meet these requirements?

  A. Deploy AWS Shield to scan the EC2 instances for vulnerabilities Create an AWS Lambda function to log any findings to AWS CloudTrail.

  B. Deploy Amazon Macie and AWS Lambda functions to scan the EC2 instances for vulnerabilities Log any findings to AWS CloudTrail

  C. Turn on Amazon GuardDuty Deploy the GuardDuty agents to the EC2 instances Configure an AWS Lambda function to automate the generation and distribution of reports that detail the findings

  D. Turn on Amazon Inspector Deploy the Amazon Inspector agent to the EC2 instances Configure an AWS Lambda function to automate the generation and distribution of reports that detail the findings

  Correct Answer: D

  1.

  Performs active vulnerability scans of EC2 instances. It looks for software vulnerabilities, unintended network accessibility, and other security issues.

  2.

  Requires installing an agent on EC2 instances to perform scans. The agent must be deployed to each instance.

  3.

  Provides scheduled scan reports detailing any findings of security risks or vulnerabilities. These reports can be used to patch or remediate issues.

  4.

  Is best suited for proactively detecting security weaknesses and misconfigurations in your AWS environment.

• Question 510:

  A company has deployed a server less application that invokes an AWS Lambda function when new documents are uploaded to an Amazon S3 bucket The application uses the Lambda function to process the documents After a recent marketing campaign the company noticed that the application did not process many of The documents

  What should a solutions architect do to improve the architecture of this application?

  A. Set the Lambda function's runtime timeout value to 15 minutes

  B. Configure an S3 bucket replication policy Stage the documents m the S3 bucket for later processing

  C. Deploy an additional Lambda function Load balance the processing of the documents across the two Lambda functions

  D. Create an Amazon Simple Queue Service (Amazon SOS) queue Send the requests to the queue Configure the queue as an event source for Lambda.

  Correct Answer: D

  To improve the architecture of this application, the best solution would be to use Amazon Simple Queue Service (Amazon SQS) to buffer the requests and decouple the S3 bucket from the Lambda function. This will ensure that the documents are not lost and can be processed at a later time if the Lambda function is not available.

  This will ensure that the documents are not lost and can be processed at a later time if the Lambda function is not available. By using Amazon SQS, the architecture is decoupled and the Lambda function can process the documents in a scalable and fault-tolerant manner.