Amazon Amazon Certifications SAA-C03 Questions & Answers

• Question 801:

  An Amazon EC2 instance is located in a private subnet in a new VPC. This subnet does not have outbound internet access, but the EC2 instance needs the ability to download monthly security updates from an outside vendor.

  What should a solutions architect do to meet these requirements?

  A. Create an internet gateway, and attach it to the VPC. Configure the private subnet route table to use the internet gateway as the default route.

  B. Create a NAT gateway, and place it in a public subnet. Configure the private subnet route table to use the NAT gateway as the default route.

  C. Create a NAT instance, and place it in the same subnet where the EC2 instance is located. Configure the private subnet route table to use the NAT instance as the default route.

  D. Create an internet gateway, and attach it to the VPC. Create a NAT instance, and place it in the same subnet where the EC2 instance is located. Configure the private subnet route table to use the internet gateway as the default route.

  Correct Answer: B

  This approach will allow the EC2 instance to access the internet and download the monthly security updates while still being located in a private subnet. By creating a NAT gateway and placing it in a public subnet, it will allow the instances in the private subnet to access the internet through the NAT gateway. And then, configure the private subnet route table to use the NAT gateway as the default route. This will ensure that all outbound traffic is directed through the NAT gateway, allowing the EC2 instance to access the internet while still maintaining the security of the private subnet.

• Question 802:

  A gaming company is moving its public scoreboard from a data center to the AWS Cloud. The company uses Amazon EC2 Windows Server instances behind an Application Load Balancer to host its dynamic application. The company needs a highly available storage solution for the application. The application consists of static files and dynamic server-side code.

  Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

  A. Store the static files on Amazon S3. Use Amazon CloudFront to cache objects at the edge.

  B. Store the static files on Amazon S3. Use Amazon ElastiCache to cache objects at the edge.

  C. Store the server-side code on Amazon Elastic File System (Amazon EFS). Mount the EFS volume on each EC2 instance to share the files.

  D. Store the server-side code on Amazon FSx for Windows File Server. Mount the FSx for Windows File Server volume on each EC2 instance to share the files.

  E. Store the server-side code on a General Purpose SSD (gp2) Amazon Elastic Block Store (Amazon EBS) volume. Mount the EBS volume on each EC2 instance to share the files.

  Correct Answer: AD

  "FSx is built for high performance and submillisecond latency using solid-state drive storage volumes. This design enables users to select storage capacity and latency independently. Thus, even a subterabyte file system can have 256 Mbps or higher throughput and support volumes up to 64 TB."

  https://www.techtarget.com/searchaws/tip/Amazon-FSx-vs-EFS-Compare-the-AWS-file-services

• Question 803:

  A company wants to use Amazon S3 for the secondary copy of its on-premises dataset. The company would rarely need to access this copy. The storage solution's cost should be minimal.

  Which storage solution meets these requirements?

  A. S3 Standard

  B. S3 Intelligent-Tiering

  C. S3 Standard-Infrequent Access (S3 Standard-IA)

  D. S3 One Zone-Infrequent Access (S3 One Zone-IA)

  Correct Answer: C

• Question 804:

  A company has implemented a self-managed DNS service on AWS. The solution consists of the following:

  1.

  Amazon EC2 instances in different AWS Regions

  2.

  Endpomts of a standard accelerator m AWS Global Accelerator

  The company wants to protect the solution against DDoS attacks What should a solutions architect do to meet this requirement?

  A. Subscribe to AWS Shield Advanced Add the accelerator as a resource to protect

  B. Subscribe to AWS Shield Advanced Add the EC2 instances as resources to protect

  C. Create an AWS WAF web ACL that includes a rate-based rule Associate the web ACL with the accelerator

  D. Create an AWS WAF web ACL that includes a rate-based rule Associate the web ACL with the EC2 instances

  Correct Answer: A

  AWS Shield is a managed service that provides protection against Distributed Denial of Service (DDoS) attacks for applications running on AWS. AWS Shield Standard is automatically enabled to all AWS customers at no additional cost. AWS Shield Advanced is an optional paid service. AWS Shield Advanced provides additional protections against more sophisticated and larger attacks for your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Route 53.

• Question 805:

  The customers of a finance company request appointments with financial advisors by sending text messages. A web application that runs on Amazon EC2 instances accepts the appointment requests. The text messages are published to an Amazon Simple Queue Service (Amazon SQS) queue through the web application. Another application that runs on EC2 instances then sends meeting invitations and meeting confirmation email messages to the customers. After successful scheduling, this application stores the meeting information in an Amazon DynamoDB database.

  As the company expands, customers report that their meeting invitations are taking longer to arrive.

  What should a solutions architect recommend to resolve this issue?

  A. Add a DynamoDB Accelerator (DAX) cluster in front of the DynamoDB database.

  B. Add an Amazon API Gateway API in front of the web application that accepts the appointment requests.

  C. Add an Amazon CloudFront distribution. Set the origin as the web application that accepts the appointment requests.

  D. Add an Auto Scaling group for the application that sends meeting invitations. Configure the Auto Scaling group to scale based on the depth of the SQS queue.

  Correct Answer: D

  To resolve the issue of longer delivery times for meeting invitations, the solutions architect can recommend adding an Auto Scaling group for the application that sends meeting invitations and configuring the Auto Scaling group to scale based on the depth of the SQS queue. This will allow the application to scale up as the number of appointment requests increases, improving the performance and delivery times of the meeting invitations.

• Question 806:

  A company has a custom application with embedded credentials that retrieves information from an Amazon RDS MySQL DB instance. Management says the application must be made more secure with the least amount of programming effort.

  What should a solutions architect do to meet these requirements?

  A. Use AWS Key Management Service (AWS KMS) customer master keys (CMKs) to create keys. Configure the application to load the database credentials from AWS KMS. Enable automatic key rotation.

  B. Create credentials on the RDS for MySQL database for the application user and store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Create an AWS Lambda function that rotates the credentials in Secret Manager.

  C. Create credentials on the RDS for MySQL database for the application user and store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule for the application user in the RDS for MySQL database using Secrets Manager.

  D. Create credentials on the RDS for MySQL database for the application user and store the credentials in AWS Systems Manager Parameter Store. Configure the application to load the database credentials from Parameter Store. Set up a credentials rotation schedule for the application user in the RDS for MySQL database using Parameter Store.

  Correct Answer: C

  C is a valid solution for securing the custom application with the least amount of programming effort. It involves creating credentials on the RDS for MySQL database for the application user and storing them in AWS Secrets Manager. The application can then be configured to load the database credentials from Secrets Manager. Additionally, the solution includes setting up a credentials rotation schedule for the application user in the RDS for MySQL database using Secrets Manager, which will automatically rotate the credentials at a specified interval without requiring any programming effort.

• Question 807:

  A company needs to create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to host a digital media streaming application. The EKS cluster will use a managed node group that is backed by Amazon Elastic Block Store (Amazon EBS) volumes for storage. The company must encrypt all data at rest by using a customer managed key that is stored in AWS Key Management Service (AWS KMS)

  Which combination of actions will meet this requirement with the LEAST operational overhead? (Select TWO.)

  A. Use a Kubernetes plugin that uses the customer managed key to perform data encryption.

  B. After creation of the EKS cluster, locate the EBS volumes. Enable encryption by using the customer managed key.

  C. Enable EBS encryption by default in the AWS Region where the EKS cluster will be created. Select the customer managed key as the default key.

  D. Create the EKS cluster Create an IAM role that has cuwlicy that grants permission to the customer managed key. Associate the role with the EKS cluster.

  E. Store the customer managed key as a Kubernetes secret in the EKS cluster. Use the customer managed key to encrypt the EBS volumes.

  Correct Answer: BD

  Option B is the simplest and most direct way to enable encryption for the EBS volumes associated with the EKS cluster. After the EKS cluster is created, you can manually locate the EBS volumes and enable encryption using the customer managed key through the AWS Management Console, AWS CLI, or SDKs.

  Option D involves creating an IAM role with a policy that grants permission to the customer managed key, and then associating that role with the EKS cluster. This allows the EKS cluster to have the necessary permissions to access the customer managed key for encrypting and decrypting data on the EBS volumes. This approach is more automated and can be easily managed through IAM, which provides centralized control and reduces operational overhead.

• Question 808:

  A company's application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. On the first day of every month at midnight. The application becomes much slower when the month-end financial calcualtion bath runs. This causes the CPU utilization of the EC2 instaces to immediately peak to 100%, which disrupts the application.

  What should a solution architect recommend to ensure the application is able to handle the workload and avoid downtime?

  A. Configure an Amazon CloudFront distribution in from of the ALB.

  B. Configure an EC2 Auto Scaling simple scaling policy based on CPU utilization.

  C. Configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule.

  D. Configure Amazon ElasticCache to remove some of the workload from tha EC2 instances.

  Correct Answer: C

  By configuring a scheduled scaling policy, the EC2 Auto Scaling group can proactively launch additional EC2 instances before the CPU utilization peaks to 100%. This will ensure that the application can handle the workload during the month-end financial calculation batch, and avoid any disruption or downtime.

  Configuring a simple scaling policy based on CPU utilization or adding Amazon CloudFront distribution or Amazon ElastiCache will not directly address the issue of handling the monthly peak workload.

• Question 809:

  A company has hundreds of Amazon EC2 Linux-based instances in the AWS Cloud. Systems administrators have used shared SSH keys to manage the instances After a recent audit, the company's security team is mandating the removal of all shared keys. A solutions architect must design a solution that provides secure access to the EC2 instances.

  Which solution will meet this requirement with the LEAST amount of administrative overhead?

  A. Use AWS Systems Manager Session Manager to connect to the EC2 instances.

  B. Use AWS Security Token Service (AWS STS) to generate one-time SSH keys on demand.

  C. Allow shared SSH access to a set of bastion instances. Configure all other instances to allow only SSH access from the bastion instances

  D. Use an Amazon Cognito custom authorizer to authenticate users. Invoke an AWS Lambda function to generate a temporary SSH key.

  Correct Answer: A

  AWS Systems Manager Session Manager provides secure shell access to EC2 instances without the need for SSH keys. It meets the security requirement to remove shared SSH keys while minimizing administrative overhead.

• Question 810:

  A medical research lab produces data that is related to a new study. The lab wants to make the data available with minimum latency to clinics across the country for their on-premises, file-based applications. The data files are stored in an Amazon S3 bucket that has read-only permissions for each clinic.

  What should a solutions architect recommend to meet these requirements?

  A. Deploy an AWS Storage Gateway file gateway as a virtual machine (VM) on premises at each clinic

  B. Migrate the files to each clinic's on-premises applications by using AWS DataSync for processing.

  C. Deploy an AWS Storage Gateway volume gateway as a virtual machine (VM) on premises at each clinic.

  D. Attach an Amazon Elastic File System (Amazon EFS) file system to each clinic's on-premises servers.

  Correct Answer: A

  AWS Storage Gateway is a service that connects an on-premises software appliance with cloud-based storage to provide seamless and secure integration between an organization's on-premises IT environment and AWS's storage infrastructure. By deploying a file gateway as a virtual machine on each clinic's premises, the medical research lab can provide low-latency access to the data stored in the S3 bucket while maintaining read-only permissions for each clinic. This solution allows the clinics to access the data files directly from their on-premises file-based applications without the need for data transfer or migration.