Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 651:

  A company runs an environment where data is stored in an Amazon S3 bucket. The objects are accessed frequently throughout the day. The company has strict da ta encryption requirements for data that is stored in the S3 bucket. The company currently uses AWS Key Management Service (AWS KMS) for encryption.

  The company wants to optimize costs associated with encrypting S3 objects without making additional calls to AWS KMS.

  Which solution will meet these requirements?

  A. Use server-side encryption with Amazon S3 managed keys (SSE-S3).
  B. Use an S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the new objects.
  C. Use client-side encryption with AWS KMS customer managed keys.
  D. Use server-side encryption with customer-provided keys (SSE-C) stored in AWS KMS.
  B. Use an S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the new objects.

• Question 652:

  A company wants to deploy a new public web application on AWS. The application includes a web server tier that uses Amazon EC2 instances. The application also includes a database tier that uses an Amazon RDS for MySQL DB instance.

  The application must be secure and accessible for global customers that have dynamic IP addresses.

  How should a solutions architect configure the security groups to meet these requirements?

  A. Configure the security group for the web servers to allow inbound traffic on port 443 from 0.0.0.0/0. Configure the security group for the DB instance to allow inbound traffic on port 3306 from the security group of the web servers.
  B. Configure the security group for the web servers to allow inbound traffic on port 443 from the IP addresses of the customers. Configure the security group for the DB instance to allow inbound traffic on port 3306 from the security group of the web servers.
  C. Configure the security group for the web servers to allow inbound traffic on port 443 from the IP addresses of the customers. Configure the security group for the DB instance to allow inbound traffic on port 3306 from the IP addresses of the customers.
  D. Configure the security group for the web servers to allow inbound traffic on port 443 from 0.0.0.0/0. Configure the security group for the DB instance to allow inbound traffic on port 3306 from 0.0.0.0/0.
  A. Configure the security group for the web servers to allow inbound traffic on port 443 from 0.0.0.0/0. Configure the security group for the DB instance to allow inbound traffic on port 3306 from the security group of the web servers.

• Question 653:

  A company wants to use Amazon Elastic Container Service (Amazon ECS) clusters and Amazon RDS DB instances to build and run a payment processing application. The company will run the application in its on-premises data center for compliance purposes.

  A solutions architect wants to use AWS Outposts as part of the solution. The solutions architect is working with the company's operational team to build the application.

  Which activities are the responsibility of the company's operational team? (Choose three.)

  A. Providing resilient power and network connectivity to the Outposts racks
  B. Managing the virtualization hypervisor, storage systems, and the AWS services that run on Outposts
  C. Physical security and access controls of the data center environment
  D. Availability of the Outposts infrastructure including the power supplies, servers, and networking equipment within the Outposts racks
  E. Physical maintenance of Outposts components
  F. Providing extra capacity for Amazon ECS clusters to mitigate server failures and maintenance events
  A. Providing resilient power and network connectivity to the Outposts racks
  C. Physical security and access controls of the data center environment
  F. Providing extra capacity for Amazon ECS clusters to mitigate server failures and maintenance events

• Question 654:

  A company operates a data lake in Amazon S3. The company wants to query and filter data directly in S3 without downloading objects.

  Which solution will meet these requirements?

  A. Use Amazon Athena to query and filter the objects in Amazon S3.
  B. Use Amazon EMR to process and filter the objects.
  C. Use Amazon API Gateway to retrieve filtered results.
  D. Use Amazon ElastiCache to cache the objects.
  A. Use Amazon Athena to query and filter the objects in Amazon S3.

  ---

  Explanation

  Amazon Athena enables serverless SQL queries directly on S3 objects, eliminating the need to download or preprocess data. EMR adds operational overhead, and API Gateway/ElastiCache are not data lake query engines.

• Question 655:

  A solutions architect is designing an AWS Identity and Access Management (IAM) authorization model for a company's AWS account. The company has designated five specific employees to have full access to AWS services and resources in the AWS account. The solutions architect has created an IAM user for each of the five designated employees and has created an IAM user group.

  Which solution will meet these requirements?

  A. Attach the AdministratorAccess resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
  B. Attach the SystemAdministrator identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
  C. Attach the AdministratorAccess identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
  D. Attach the SystemAdministrator resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
  C. Attach the AdministratorAccess identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.

• Question 656:

  A company deployed a serverless application that uses Amazon DynamoDB as a database layer. The application has experienced a large increase in users. The company wants to improve database response time from milliseconds to microseconds and to cache requests to the database.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Use DynamoDB Accelerator (DAX).
  B. Migrate the database to Amazon Redshift.
  C. Migrate the database to Amazon RDS.
  D. Use Amazon ElastiCache for Redis.
  A. Use DynamoDB Accelerator (DAX).

• Question 657:

  A company has multiple AWS accounts with applications deployed in the us-west-2 Region. Application logs are stored within Amazon S3 buckets in each account. The company wants to build a centralized log analysis solution that uses a single S3 bucket. Logs must not leave us-west-2, and the company wants to incur minimal operational overhead.

  Which solution meets these requirements and is MOST cost-effective?

  A. Create an S3 Lifecycle policy that copies the objects from one of the application S3 buckets to the centralized S3 bucket.
  B. Use S3 Same-Region Replication to replicate logs from the S3 buckets to another S3 bucket in us-west-2. Use this S3 bucket for log analysis.
  C. Write a script that uses the PutObject API operation every day to copy the entire contents of the buckets to another S3 bucket in us-west-2. Use this S3 bucket for log analysis.
  D. Write AWS Lambda functions in these accounts that are triggered every time logs are delivered to the S3 buckets (s3:ObjectCreated:* event). Copy the logs to another S3 bucket in us-west-2. Use this S3 bucket for log analysis.
  B. Use S3 Same-Region Replication to replicate logs from the S3 buckets to another S3 bucket in us-west-2. Use this S3 bucket for log analysis.

• Question 658:

  A company is developing a two-tier web application on AWS. The company's developers have deployed the application on an Amazon EC2 instance that connects directly to a backend Amazon RDS database.

  The company must not hardcode database credentials in the application. The company must also implement a solution to automatically rotate the database credentials on a regular basis.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Store the database credentials in the instance metadata. Use Amazon EventBridge (Amazon CloudWatch Events) rules to run a scheduled AWS Lambda function that updates the RDS credentials and instance metadata at the same time.
  B. Store the database credentials in a configuration file in an encrypted Amazon S3 bucket. Use Amazon EventBridge (Amazon CloudWatch Events) rules to run a scheduled AWS Lambda function that updates the RDS credentials and the credentials in the configuration file at the same time. Use S3 Versioning to ensure the ability to fall back to previous values.
  C. Store the database credentials as a secret in AWS Secrets Manager. Turn on automatic rotation for the secret. Attach the required permission to the EC2 role to grant access to the secret.
  D. Store the database credentials as encrypted parameters in AWS Systems Manager Parameter Store. Turn on automatic rotation for the encrypted parameters. Attach the required permission to the EC2 role to grant access to the encrypted parameters.
  C. Store the database credentials as a secret in AWS Secrets Manager. Turn on automatic rotation for the secret. Attach the required permission to the EC2 role to grant access to the secret.

• Question 659:

  A company owns an asynchronous API that is used to ingest user requests and, based on the request type, dispatch requests to the appropriate microservice for processing. The company is using Amazon API Gateway to deploy the API front end, and an AWS Lambda function that invokes Amazon DynamoDB to store user requests before dispatching them to the processing microservices. The company provisioned as much DynamoDB throughput as its budget allows, but the company is still experiencing availability issues and is losing user requests.

  What should a solutions architect do to address this issue without impacting existing users?

  A. Add throttling on the API Gateway with server-side throttling limits.
  B. Use DynamoDB Accelerator (DAX) and Lambda to buffer writes to DynamoDB.
  C. Create a secondary index in DynamoDB for the table with the user requests.
  D. Use the Amazon Simple Queue Service (Amazon SQS) queue and Lambda to buffer writes to DynamoDB.
  D. Use the Amazon Simple Queue Service (Amazon SQS) queue and Lambda to buffer writes to DynamoDB.

• Question 660:

  A company launches a new web application that uses an Amazon Aurora PostgreSQL database. The company wants to add new features to the application that rely on AI. The company requires vector storage capability to use AI tools.

  Which solution will meet this requirement MOST cost-effectively?

  A. Use Amazon OpenSearch Service to create an OpenSearch service. Configure the application to write vector embeddings to a vector index.
  B. Create an Amazon DocumentDB cluster. Configure the application to write vector embeddings to a vector index.
  C. Create an Amazon Neptune ML cluster. Configure the application to write vector embeddings to a vector graph.
  D. Install the pgvector extension on the Aurora PostgreSQL database. Configure the application to write vector embeddings to a vector table.
  D. Install the pgvector extension on the Aurora PostgreSQL database. Configure the application to write vector embeddings to a vector table.

  ---

  Explanation

  Aurora PostgreSQL supports the pgvector extension, which allows storage and querying of vector embeddings directly inside the database. This eliminates the need for external vector databases and provides cost-effective and performant integration for AI workloads.

  References:

  AWS Documentation?Amazon Aurora PostgreSQL and pgvector Support