Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 61:

  A company uses an Amazon EC2 instance to run a script to poll for and process messages in an Amazon Simple Queue Service (Amazon SQS) queue. The company wants to reduce operational overhead while maintaining its ability to process an increasing number of messages that are added to the queue.

  Which solution will meet these requirements?

  A. Increase the size of the EC2 instance to process messages in the SQS queue faster.
  B. Configure an Amazon EventBridge rule to turn off the EC2 instance when the SQS queue is empty.
  C. Migrate the script on the EC2 instance to an AWS Lambda function with an event source of the SQS queue.
  D. Configure an AWS Systems Manager Run Command to run the script on demand.
  C. Migrate the script on the EC2 instance to an AWS Lambda function with an event source of the SQS queue.

  ---

  Explanation

  AWS advises using serverless event-driven processing to minimize operational burden and scale automatically with demand. Amazon SQS can be directly configured as an event source for AWS Lambda.

  With this setup, Lambda polls the queue, invokes the function, and processes messages without requiring the customer to manage infrastructure. Scaling is automatic, based on the volume of messages in the queue.

  Option A (increasing instance size) still leaves scaling and management challenges.

  Option B reduces cost when idle but does not address scaling.

  Option D requires manual triggering and does not meet continuous processing requirements. Migrating the script to Lambda (C) fully eliminates the need for instance management, providing scalability, reliability, and reduced operational overhead

• Question 62:

  A company uses Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS) to run its self-managed database. The company has 350 TB of data spread across all EBS volumes. The company takes daily EBS snapshots and keeps the snapshots for 1 month. The daily change rate is 5% of the EBS volumes. Because of new regulations, the company needs to keep the monthly snapshots for 7 years. The company needs to change its backup strategy to comply with the new regulations and to ensure that data is available with minimal administrative effort.

  Which solution will meet these requirements MOST cost-effectively?

  A. Keep the daily snapshot in the EBS snapshot standard tier for 1 month. Copy the monthly snapshot to Amazon S3 Glacier Deep Archive with a 7-year retention period.
  B. Continue with the current EBS snapshot policy. Add a new policy to move the monthly snapshot to Amazon EBS Snapshots Archive with a 7-year retention period.
  C. Keep the daily snapshot in the EBS snapshot standard tier for 1 month. Keep the monthly snapshot in the standard tier for 7 years. Use incremental snapshots.
  D. Keep the daily snapshot in the EBS snapshot standard tier. Use EBS direct APIs to take snapshots of all the EBS volumes every month. Store the snapshots in an Amazon S3 bucket in the Infrequent Access tier for 7 years.
  B. Continue with the current EBS snapshot policy. Add a new policy to move the monthly snapshot to Amazon EBS Snapshots Archive with a 7-year retention period.

• Question 63:

  A solutions architect is designing the network architecture for an application that runs on Amazon EC2 instances in an Auto Scaling group. The application needs to access data that is in Amazon S3 buckets.

  Traffic to the S3 buckets must not use public IP addresses. The solutions architect will deploy the application in a VPC that has public and private subnets.

  Which solutions will meet these requirements? (Choose Two.)

  A. Deploy the EC2 instances in a private subnet. Configure a default route to an egress-only internet gateway.
  B. Deploy the EC2 instances in a public subnet. Create a gateway endpoint for Amazon S3. Associate the endpoint with the subnet's route table.
  C. Deploy the EC2 instances in a public subnet. Create an interface endpoint for Amazon S3. Configure DNS hostnames and DNS resolution for the VPC.
  D. Deploy the EC2 instances in a private subnet. Configure a default route to a NAT gateway in a public subnet.
  E. Deploy the EC2 instances in a private subnet. Configure a default route to a customer gateway.
  B. Deploy the EC2 instances in a public subnet. Create a gateway endpoint for Amazon S3. Associate the endpoint with the subnet's route table.
  D. Deploy the EC2 instances in a private subnet. Configure a default route to a NAT gateway in a public subnet.

  ---

  Explanation

  Option B:A gateway endpoint for S3 allows traffic to S3 without using public IPs and integrates with route tables.

  Option D:Deploying EC2 instances in a private subnet with a NAT gateway enables outbound internet connectivity for other requirements without public IPs.

  Option A:Egress-only internet gateways are for IPv6 traffic and do not work for IPv4 in this context.

  Option C:Interface endpoints are not required for S3 as gateway endpoints are more suitable and cost-effective.

  Option E:A customer gateway is for hybrid connectivity (e.g., on-premises), not suitable for this case.

  References:

  VPC Endpoints Amazon S3 Gateway Endpoints

• Question 64:

  A company is running a two-tier web-based application in an on-premises data center. The application layer consists of a single server running a stateful application. The application connects to a PostgreSQL database running on a separate server. The user base is expected to grow significantly, so the company is migrating the application and database to AWS. The solution will use Amazon Aurora PostgreSQL, Amazon EC2 Auto Scaling, and Elastic Load Balancing.

  Which solution will provide a consistent user experience that will allow the application and database tiers to scale?

  A. Enable Aurora Auto Scaling for Aurora Replicas. Use a Network Load Balancer with the least outstanding requests routing algorithm and sticky sessions enabled.
  B. Enable Aurora Auto Scaling for Aurora writers. Use an Application Load Balancer with the round robin routing algorithm and sticky sessions enabled.
  C. Enable Aurora Auto Scaling for Aurora Replicas. Use an Application Load Balancer with the round robin routing algorithm and sticky sessions enabled.
  D. Enable Aurora Auto Scaling for Aurora writers. Use a Network Load Balancer with the least outstanding requests routing algorithm and sticky sessions enabled.
  C. Enable Aurora Auto Scaling for Aurora Replicas. Use an Application Load Balancer with the round robin routing algorithm and sticky sessions enabled.

  ---

  Explanation

  The application is described as stateful, which means user sessions or state are likely stored in memory on the application server. When migrating to an Auto Scaling group behind a load balancer, a consistent user experience typically requires session stickiness, so a user's subsequent requests continue to be routed to the same backend instance that holds their session state (unless the application is refactored to externalize session state, which is not stated here). For HTTP/HTTPS web applications, an Application Load Balancer (ALB) is the correct Elastic Load Balancing choice because it operates at Layer 7 and provides built-in support for cookie-based sticky sessions.

  On the database side, Aurora PostgreSQL supports scaling read capacity by adding Aurora Replicas, and Aurora Auto Scaling can automatically adjust the number of replicas based on demand. This is the intended mechanism to scale the database tier for growing read traffic while preserving write consistency through a single writer. "Aurora writers" do not scale horizontally the same way; Aurora provides one writer endpoint at a time (with fast failover), so auto-scaling "writers" is not the right construct for demand-based scaling.

  Option C combines the correct load balancer type (ALB) with stickiness and the correct database scaling mechanism (Aurora Replicas with auto scaling).

  Option A uses an NLB, which is Layer 4 and does not provide the same Layer 7 sticky session behavior expected for a web application pattern. Options B and D incorrectly focus on scaling Aurora writers, which does not address scaling demand patterns as effectively as scaling read replicas.

  Therefore, C provides the most consistent user experience for a stateful web tier and enables the database tier to scale using Aurora Replica auto scaling.

• Question 65:

  A media company uses Amazon CloudFront for its publicly available streaming video content. The company wants to secure the video content that is hosted in Amazon S3 by controlling who has access.

  Some of the company's users are using a custom HTTP client that does not support cookies. Some of the company's users are unable to change the hardcoded URLs that they are using for access.

  Which services or methods will meet these requirements with the LEAST impact to the users? (Choose two.)

  A. Signed cookies
  B. Signed URLs
  C. AWS AppSync
  D. JSON Web Token (JWT)
  E. AWS Secrets Manager
  A. Signed cookies
  B. Signed URLs

• Question 66:

  A security team needs to enforce rotation of all IAM users' access keys every 90 days. Keys older than 90 days must be automatically deactivated and removed. A solutions architect must create a remediation solution with minimal operational effort.

  Which solution meets these requirements?

  A. Create an AWS Config rule to check key age. Configure the rule to run an AWS Batch job to remove the key.
  B. Create an Amazon EventBridge rule to check key age. Configure it to run an AWS Batch job to remove the key.
  C. Create an AWS Config rule to check key age. Define an EventBridge rule that schedules an AWS Lambda function to remove the key.
  D. Create an EventBridge rule to check key age. Define a second EventBridge rule to run an AWS Batch job to remove the key.
  C. Create an AWS Config rule to check key age. Define an EventBridge rule that schedules an AWS Lambda function to remove the key.

  ---

  Explanation

  AWS Config has a built-in managed rule (access-keys-rotated) that evaluates IAM access key age. Config rules detect non-compliant resources automatically, without building custom logic.

  After Config identifies old keys, EventBridge can trigger an AWS Lambda function to disable and delete the keys. Lambda provides a fully managed compute layer requiring no servers or batch environments.

  Using AWS Batch (Options A, B, and D) adds unnecessary operational overhead for a simple automation task.

• Question 67:

  A company is migrating some of its applications to AWS. The company wants to migrate and modernize the applications quickly after it finalizes networking and security strategies. The company has set up an AWS Direct Connect connection in a central network account. The company expects to have hundreds of AWS accounts and VPCs in the near future. The corporate network must be able to access the resources on AWS seamlessly and also must be able to communicate with all the VPCs. The company also wants to route its cloud resources to the internet through its on-premises data center.

  Which combination of steps will meet these requirements? (Choose Three.)

  A. Create a Direct Connect gateway in the central account. In each of the accounts, create an association proposal by using the Direct Connect gateway and the account ID for every virtual private gateway.
  B. Create a Direct Connect gateway and a transit gateway in the central network account. Attach the transit gateway to the Direct Connect gateway by using a transit VIF.
  C. Provision an internet gateway. Attach the internet gateway to subnets. Allow internet traffic through the gateway.
  D. Share the transit gateway with other accounts. Attach VPCs to the transit gateway.
  E. Provision VPC peering as necessary.
  F. Provision only private subnets. Open the necessary route on the transit gateway and customer gateway to allow outbound internet traffic from AWS to flow through NAT services that run in the data center.
  B. Create a Direct Connect gateway and a transit gateway in the central network account. Attach the transit gateway to the Direct Connect gateway by using a transit VIF.
  D. Share the transit gateway with other accounts. Attach VPCs to the transit gateway.
  F. Provision only private subnets. Open the necessary route on the transit gateway and customer gateway to allow outbound internet traffic from AWS to flow through NAT services that run in the data center.

  ---

  Explanation

  For a large-scale multi-account AWS environment with many VPCs and centralized Direct Connect, AWS recommends using a Transit Gateway (TGW) architecture combined with a Direct Connect gateway (DXGW). This setup allows scalable, centralized connectivity between on-premises and multiple VPCs across accounts.

  Option B: Creating a Direct Connect gateway and Transit Gateway in a central network account and connecting them via a transit VIF enables the on-premises network to access all connected VPCs.

  Option D: Sharing the transit gateway with other accounts via AWS Resource Access Manager (RAM) allows the central TGW to attach VPCs in multiple accounts, simplifying multi-account connectivity.

  Option F: To route cloud resources' internet traffic back through the on-premises data center (for centralized egress), provisioning only private subnets and routing outbound internet traffic through NAT or firewall services in the data center is necessary. This requires configuring transit gateway and customer gateway routes appropriately.

  Option A is partially correct in the use of Direct Connect gateway but association proposals are not scalable for hundreds of VPCs and accounts compared to transit gateway.

  Option C (internet gateway) is irrelevant here as traffic egress is required via on-premises data center, not directly to the internet. Option

  E (VPC peering) is not scalable for hundreds of VPCs.

• Question 68:

  A company is migrating applications to AWS. The applications are deployed in different accounts. The company manages the accounts centrally by using AWS Organizations. The company's security team needs a single sign-on (SSO) solution across all the company's accounts. The company must continue managing the users and groups in its on-premises self-managed Microsoft Active Directory.

  Which solution will meet these requirements?

  A. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console. Create a one-way forest trust or a one-way domain trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory.
  B. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console. Create a two-way forest trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory.
  C. Use AWS Directory Service. Create a two-way trust relationship with the company's self-managed Microsoft Active Directory.
  D. Deploy an identity provider (IdP) on premises. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console.
  B. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console. Create a two-way forest trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory.

• Question 69:

  A company wants to run a gaming application on Amazon EC2 instances that are part of an Auto Scaling group in the AWS Cloud. The application will transmit data by using UDP packets. The company wants to ensure that the application can scale out and in as traffic increases and decreases.

  What should a solutions architect do to meet these requirements?

  A. Attach a Network Load Balancer to the Auto Scaling group.
  B. Attach an Application Load Balancer to the Auto Scaling group.
  C. Deploy an Amazon Route 53 record set with a weighted policy to route traffic appropriately.
  D. Deploy a NAT instance that is configured with port forwarding to the EC2 instances in the Auto Scaling group.
  A. Attach a Network Load Balancer to the Auto Scaling group.

• Question 70:

  A software company needs to upgrade a critical web application. The application currently runs on a single Amazon EC2 instance that the company hosts in a public subnet. The EC2 instance runs a MySQL database. The application's DNS records are published in an Amazon Route 53 zone.

  A solutions architect must reconfigure the application to be scalable and highly available. The solutions architect must also reduce MySQL read latency.

  Which combination of solutions will meet these requirements? (Choose two.)

  A. Launch a second EC2 instance in a second AWS Region. Use a Route 53 failover routing policy to redirect the traffic to the second EC2 instance.
  B. Create and configure an Auto Scaling group to launch private EC2 instances in multiple Availability Zones. Add the instances to a target group behind a new Application Load Balancer.
  C. Migrate the database to an Amazon Aurora MySQL cluster. Create the primary DB instance and reader DB instance in separate Availability Zones.
  D. Create and configure an Auto Scaling group to launch private EC2 instances in multiple AWS Regions. Add the instances to a target group behind a new Application Load Balancer.
  E. Migrate the database to an Amazon Aurora MySQL cluster with cross-Region read replicas.
  B. Create and configure an Auto Scaling group to launch private EC2 instances in multiple Availability Zones. Add the instances to a target group behind a new Application Load Balancer.
  C. Migrate the database to an Amazon Aurora MySQL cluster. Create the primary DB instance and reader DB instance in separate Availability Zones.