Amazon Amazon Certifications SAA-C03 Questions & Answers

• Question 831:

  A company is using a centralized AWS account to store log data in various Amazon S3 buckets. A solutions architect needs to ensure that the data is encrypted at rest before the data is uploaded to the S3 buckets. The data also must be encrypted in transit.

  Which solution meets these requirements?

  A. Use client-side encryption to encrypt the data that is being uploaded to the S3 buckets.

  B. Use server-side encryption to encrypt the data that is being uploaded to the S3 buckets.

  C. Create bucket policies that require the use of server-side encryption with S3 managed encryption keys (SSE-S3) for S3 uploads.

  D. Enable the security option to encrypt the S3 buckets through the use of a default AWS Key Management Service (AWS KMS) key.

  Correct Answer: A

  Use client-side encryption to encrypt the data that is being uploaded to the S3 buckets

• Question 832:

  A solutions architect is designing a new API using Amazon API Gateway that will receive requests from users. The volume of requests is highly variable; several hours can pass without receiving a single request. The data processing will take place asynchronously, but should be completed within a few seconds after a request is made.

  Which compute service should the solutions architect have the API invoke to deliver the requirements at the lowest cost?

  A. An AWS Glue job

  B. An AWS Lambda function

  C. A containerized service hosted in Amazon Elastic Kubernetes Service (Amazon EKS)

  D. A containerized service hosted in Amazon ECS with Amazon EC2

  Correct Answer: B

  API Gateway + Lambda is the perfect solution for modern applications with serverless architecture.

• Question 833:

  A solutions architect observes that a nightly batch processing job is automatically scaled up for 1 hour before the desired Amazon EC2 capacity is reached. The peak capacity is the `same every night and the batch jobs always start at 1 AM. The solutions architect needs to find a cost-effective solution that will allow for the desired EC2 capacity to be reached quickly and allow the Auto Scaling group to scale down after the batch jobs are complete.

  What should the solutions architect do to meet these requirements?

  A. Increase the minimum capacity for the Auto Scaling group.

  B. Increase the maximum capacity for the Auto Scaling group.

  C. Configure scheduled scaling to scale up to the desired compute level.

  D. Change the scaling policy to add more EC2 instances during each scaling operation.

  Correct Answer: C

  By configuring scheduled scaling, the solutions architect can set the Auto Scaling group to automatically scale up to the desired compute level at a specific time (IAM) when the batch job starts and then automatically scale down after the job is complete. This will allow the desired EC2 capacity to be reached quickly and also help in reducing the cost.

• Question 834:

  A company has a Microsoft NET application that runs on an on-premises Windows Server Trie application stores data by using an Oracle Database Standard Edition server The company is planning a migration to AWS and wants to minimize development changes while moving the application The AWS application environment should be highly available

  Which combination of actions should the company take to meet these requirements? (Select TWO )

  A. Refactor the application as serverless with AWS Lambda functions running NET Cote

  B. Rehost the application in AWS Elastic Beanstalk with the NET platform in a Multi-AZ deployment

  C. Replatform the application to run on Amazon EC2 with the Amazon Linux Amazon Machine Image (AMI)

  D. Use AWS Database Migration Service (AWS DMS) to migrate from the Oracle database to Amazon DynamoDB in a Multi-AZ deployment

  E. Use AWS Database Migration Service (AWS DMS) to migrate from the Oracle database to Oracle on Amazon RDS in a Multi-AZ deployment

  Correct Answer: BE

  B. Rehost the application in AWS Elastic Beanstalk with the .NET platform in a Multi-AZ deployment.

  E. Use AWS Database Migration Service (AWS DMS) to migrate from the Oracle database to Oracle on Amazon RDS in a Multi-AZ deployment.

  Rehosting the application in Elastic Beanstalk with the .NET platform can minimize development changes. Multi-AZ deployment of Elastic Beanstalk will increase the availability of application, so it meets the requirement of high availability.

  Using AWS Database Migration Service (DMS) to migrate the database to Amazon RDS Oracle will ensure compatibility, so the application can continue to use the same database technology, and the development team can use their existing

  skills. It also migrates to a managed service, which will handle the availability, so the team do not have to worry about it. Multi-AZ deployment will increase the availability of the database.

• Question 835:

  An application that is hosted on Amazon EC2 instances needs to access an Amazon S3 bucket Traffic must not traverse the internet How should a solutions architect configure access to meet these requirements?

  A. Create a private hosted zone by using Amazon Route 53

  B. Set up a gateway VPC endpoint for Amazon S3 in the VPC

  C. Configure the EC2 instances to use a NAT gateway to access the S3 bucket

  D. Establish an AWS Site-to-Site VPN connection between the VPC and the S3 bucket

  Correct Answer: B

  S3 and DynamoDB are the only services with Gateway endpoint options

• Question 836:

  A solutions architect has created a new AWS account and must secure AWS account root user access. Which combination of actions will accomplish this? (Choose two.)

  A. Ensure the root user uses a strong password.

  B. Enable multi-factor authentication to the root user.

  C. Store root user access keys in an encrypted Amazon S3 bucket.

  D. Add the root user to a group containing administrative permissions.

  E. Apply the required permissions to the root user with an inline policy document.

  Correct Answer: AB

  https://docs.aws.amazon.com/SetUp/latest/UserGuide/best-practices-root-user.html

• Question 837:

  A solutions architect is designing the architecture of a new application being deployed to the AWS Cloud. The application will run on Amazon EC2 On-Demand Instances and will automatically scale across multiple Availability Zones. The EC2 instances will scale up and down frequently throughout the day. An Application Load Balancer (ALB) will handle the load distribution. The architecture needs to support distributed session data management. The company is willing to make changes to code if needed.

  What should the solutions architect do to ensure that the architecture supports distributed session data management?

  A. Use Amazon ElastiCache to manage and store session data.

  B. Use session affinity (sticky sessions) of the ALB to manage session data.

  C. Use Session Manager from AWS Systems Manager to manage the session.

  D. Use the GetSessionToken API operation in AWS Security Token Service (AWS STS) to manage the session

  Correct Answer: A

  https://aws.amazon.com/vi/caching/session-management/ In order to address scalability and to provide a shared data storage for sessions that can be accessible from any individual web server, you can abstract the HTTP sessions from the web servers themselves. A common solution to for this is to leverage an In-Memory Key/Value store such as Redis and Memcached. ElastiCache offerings for In-Memory key/value stores include ElastiCache for Redis, which can support replication, and ElastiCache for Memcached which does not support replication.

• Question 838:

  A solution architect must create a disaster recovery (DR) plan for a high-volume software as a service (SaaS) platform. All data for the platform is stored in an Amazon Aurora MySQL DB cluster.

  The DR plan must replcate data to a secondary AWS Region.

  Which solution will meet these requirements MOST cost-effectively?

  Use MySQL binary log replication to an Aurora cluster

  A. Use MySQL binary log replication to an Aurora cluster in the secondary Region Provision one DB instance for the Aurora cluster in the secondary Region.

  B. Set up an Aurora global database for the DB cluster. When setup is complete, remove the DB instance from the secondary Region.

  C. Use AWS Database Migration Service (AWS QMS) to continuously replicate data to an Aurora cluster in the secondary Region Remove theDB instance from the secondary Region.

  D. Set up an Aurora global database for the DB cluster Specify a minimum of one DB instance in the secondary Region

  Correct Answer: D

  https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html

• Question 839:

  A company is reviewing a recent migration of a three-tier application to a VPC. The security team discovers that the principle of least privilege is not being applied to Amazon EC2 security group ingress and egress rules between the application tiers.

  What should a solutions architect do to correct this issue?

  A. Create security group rules using the instance ID as the source or destination.

  B. Create security group rules using the security group ID as the source or destination.

  C. Create security group rules using the VPC CIDR blocks as the source or destination.

  D. Create security group rules using the subnet CIDR blocks as the source or destination.

  Correct Answer: B

  This way, the security team can ensure that the least privileged access is given to the application tiers by allowing only the necessary communication between the security groups. For example, the web tier security group should only allow

  incoming traffic from the load balancer security group and outgoing traffic to the application tier security group. This approach provides a more granular and secure way to control traffic between the different tiers of the application and also

  allows for easy modification of access if needed.

  It's also worth noting that it's good practice to minimize the number of open ports and protocols, and use security groups as a first line of defense, in addition to network access control lists (ACLs) to control traffic between subnets.

  https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html

• Question 840:

  A company is planning on deploying a newly built application on AWS in a default VPC. The application will consist of a web layer and database layer. The web server was created in public subnets, and the MySQL database was created in private subnet. All subnets are created with the default network ACL settings, and the default security group in the VPC will be replaced with new custom security groups.

  A. Create a database server security group with inbound and outbound rules for MySQL port 3306 traffic to and from anywhere (0.0.0.0/0).

  B. Create a database server security group with an inbound rule for MySQL port 3300 and specify the source as a web server security group.

  C. Create a web server security group within an inbound allow rule for HTTPS port 443 traffic from anywbere (0.0.0.0/0) and an inbound deny rule for IP range 182. 20.0.0/16.

  D. Create a web server security group with an inbound rule for HTTPS port 443 traffic from anywhere (0.0.0.0/0). Create network ACL inbound and outbound deny rules for IP range 182. 20.0.0/16.

  E. Create a web server security group with an inbound and outbound rules for HTTPS port 443 traffic to and from anywbere (0.0.0.0/0). Create a network ACL inbound deny rule for IP range 182. 20.0.0/16.

  Correct Answer: BD