Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 81:

  A company is building a new web application on AWS. The application needs to consume files from a legacy on-premises application that runs a batch process and outputs approximately 1 GB of data every night to an NFS file mount.

  A solutions architect needs to design a storage solution that requires minimal changes to the legacy application and keeps costs low.

  Which solution will meet these requirements MOST cost-effectively?

  A. Deploy an Outpost in AWS Outposts to the on-premises location where the legacy application is stored. Configure the legacy application and the web application to store and retrieve the files in Amazon S3 on the Outpost.
  B. Deploy an AWS Storage Gateway Volume Gateway on premises. Point the legacy application to the Volume Gateway. Configure the web application to use the Amazon S3 bucket that the Volume Gateway uses.
  C. Deploy an Amazon S3 interface endpoint on AWS. Reconfigure the legacy application to store the files directly on an Amazon S3 endpoint. Configure the web application to retrieve the files from Amazon S3.
  D. Deploy an Amazon S3 File Gateway on premises. Point the legacy application to the File Gateway. Configure the web application to retrieve the files from the S3 bucket that the File Gateway uses.
  D. Deploy an Amazon S3 File Gateway on premises. Point the legacy application to the File Gateway. Configure the web application to retrieve the files from the S3 bucket that the File Gateway uses.

  ---

  Explanation

  Amazon S3 File Gateway provides a local NFS mount point, which can be used with minimal changes by the legacy application. Files are transparently uploaded to Amazon S3, allowing the web application to access them directly from S3. This is the most cost-effective and operationally simple way to bridge legacy on-premises NFS output with S3, requiring no changes to the batch process.

  Option A: Outposts is far more costly and complex than needed.

  Option B: Volume Gateway presents iSCSI block storage, not NFS.

  Option C: Requires re-coding the legacy app to use S3 APIs, not NFS.

  References:

  AWS Certified Solutions Architect?Official Study Guide, Hybrid Storage Solutions.

• Question 82:

  A company wants to move from many standalone AWS accounts to a consolidated, multi-account architecture. The company plans to create many new AWS accounts for different business units. The company needs to authenticate access to these AWS accounts by using a centralized corporate directory service.

  Which combination of actions should a solutions architect recommend to meet these requirements? (Choose two.)

  A. Create a new organization in AWS Organizations with all features turned on. Create the new AWS accounts in the organization.
  B. Set up an Amazon Cognito identity pool. Configure AWS IAM Identity Center (AWS Single Sign-On) to accept Amazon Cognito authentication.
  C. Configure a service control policy (SCP) to manage the AWS accounts. Add AWS IAM Identity Center (AWS Single Sign-On) to AWS Directory Service.
  D. Create a new organization in AWS Organizations. Configure the organization's authentication mechanism to use AWS Directory Service directly.
  E. Set up AWS IAM Identity Center (AWS Single Sign-On) in the organization. Configure IAM Identity Center, and integrate it with the company's corporate directory service.
  A. Create a new organization in AWS Organizations with all features turned on. Create the new AWS accounts in the organization.
  E. Set up AWS IAM Identity Center (AWS Single Sign-On) in the organization. Configure IAM Identity Center, and integrate it with the company's corporate directory service.

• Question 83:

  A company has several on-premises Internet Small Computer Systems Interface (ISCSI) network storage servers. The company wants to reduce the number of these servers by moving to the AWS Cloud. A solutions architect must provide low-latency access to frequently used data and reduce the dependency on on-premises servers with a minimal number of infrastructure changes.

  Which solution will meet these requirements?

  A. Deploy an Amazon S3 File Gateway.
  B. Deploy Amazon Elastic Block Store (Amazon EBS) storage with backups to Amazon S3.
  C. Deploy an AWS Storage Gateway volume gateway that is configured with stored volumes.
  D. Deploy an AWS Storage Gateway volume gateway that is configured with cached volumes.
  D. Deploy an AWS Storage Gateway volume gateway that is configured with cached volumes.

• Question 84:

  A company is running a business-critical web application on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances are in an Auto Scaling group. The application uses an Amazon Aurora PostgreSQL database that is deployed in a single Availability Zone. The company wants the application to be highly available with minimum downtime and minimum loss of data.

  Which solution will meet these requirements with the LEAST operational effort?

  A. Place the EC2 instances in different AWS Regions. Use Amazon Route 53 health checks to redirect traffic. Use Aurora PostgreSQL Cross-Region Replication.
  B. Configure the Auto Scaling group to use multiple Availability Zones. Configure the database as Multi-AZ. Configure an Amazon RDS Proxy instance for the database.
  C. Configure the Auto Scaling group to use one Availability Zone. Generate hourly snapshots of the database. Recover the database from the snapshots in the event of a failure.
  D. Configure the Auto Scaling group to use multiple AWS Regions. Write the data from the application to Amazon S3. Use S3 Event Notifications to launch an AWS Lambda function to write the data to the database.
  B. Configure the Auto Scaling group to use multiple Availability Zones. Configure the database as Multi-AZ. Configure an Amazon RDS Proxy instance for the database.

• Question 85:

  A company hosts an application on AWS. The application gives users the ability to upload photos and store the photos in an Amazon S3 bucket. The company wants to use Amazon CloudFront and a custom domain name to upload the photo files to the S3 bucket in the eu-west-1 Region.

  Which solution will meet these requirements? (Choose two.)

  A. Use AWS Certificate Manager (ACM) to create a public certificate in the us-east-1 Region. Use the certificate in CloudFront.
  B. Use AWS Certificate Manager (ACM) to create a public certificate in eu-west-1. Use the certificate in CloudFront.
  C. Configure Amazon S3 to allow uploads from CloudFront. Configure S3 Transfer Acceleration.
  D. Configure Amazon S3 to allow uploads from CloudFront origin access control (OAC).
  E. Configure Amazon S3 to allow uploads from CloudFront. Configure an Amazon S3 website endpoint.
  A. Use AWS Certificate Manager (ACM) to create a public certificate in the us-east-1 Region. Use the certificate in CloudFront.
  D. Configure Amazon S3 to allow uploads from CloudFront origin access control (OAC).

• Question 86:

  A company's web application consists of multiple Amazon EC2 instances that run behind an Application Load Balancer in a VPC. An Amazon RDS for MySQL DB instance contains the data. The company needs the ability to automatically detect and respond to suspicious or unexpected behavior in its AWS environment. The company already has added AWS WAF to its architecture.

  What should a solutions architect do next to protect against threats?

  A. Use Amazon GuardDuty to perform threat detection. Configure Amazon EventBridge to filter for GuardDuty findings and to invoke an AWS Lambda function to adjust the AWS WAF rules.
  B. Use AWS Firewall Manager to perform threat detection. Configure Amazon EventBridge to filter for Firewall Manager findings and to invoke an AWS Lambda function to adjust the AWS WAF web ACL.
  C. Use Amazon Inspector to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.
  D. Use Amazon Macie to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.
  A. Use Amazon GuardDuty to perform threat detection. Configure Amazon EventBridge to filter for GuardDuty findings and to invoke an AWS Lambda function to adjust the AWS WAF rules.

• Question 87:

  A solutions architect needs to help a company optimize the cost of running an application on AWS. The application will use Amazon EC2 instances, AWS Fargate, and AWS Lambda for compute within the architecture. The EC2 instances will run the data ingestion layer of the application. EC2 usage will be sporadic and unpredictable. Workloads that run on EC2 instances can be interrupted at any time. The application front end will run on Fargate, and Lambda will serve the API layer. The front-end utilization and API layer utilization will be predictable over the course of the next year.

  Which combination of purchasing options will provide the MOST cost-effective solution for hosting this application? (Choose two.)

  A. Use Spot Instances for the data ingestion layer
  B. Use On-Demand Instances for the data ingestion layer
  C. Purchase a 1-year Compute Savings Plan for the front end and API layer.
  D. Purchase 1-year All Upfront Reserved instances for the data ingestion layer.
  E. Purchase a 1-year EC2 instance Savings Plan for the front end and API layer.
  A. Use Spot Instances for the data ingestion layer
  C. Purchase a 1-year Compute Savings Plan for the front end and API layer.

• Question 88:

  A company is preparing to deploy a new serverless workload. A solutions architect must use the principle of least privilege to configure permissions that will be used to run an AWS Lambda function. An Amazon EventBridge (Amazon CloudWatch Events) rule will invoke the function.

  Which solution meets these requirements?

  A. Add an execution role to the function with lambda:InvokeFunction as the action and * as the principal.
  B. Add an execution role to the function with lambda:InvokeFunction as the action and Service: lambda.amazonaws.com as the principal.
  C. Add a resource-based policy to the function with lambda:* as the action and Service: events.amazonaws.com as the principal.
  D. Add a resource-based policy to the function with lambda:InvokeFunction as the action and Service: events.amazonaws.com as the principal.
  D. Add a resource-based policy to the function with lambda:InvokeFunction as the action and Service: events.amazonaws.com as the principal.

• Question 89:

  A company has an application that uses an Amazon DynamoDB table for storage. A solutions architect discovers that many requests to the table are not returning the latest data. The company's users have not reported any other issues with database performance. Latency is in an acceptable range.

  Which design change should the solutions architect recommend?

  A. Add read replicas to the table.
  B. Use a global secondary index (GSI).
  C. Request strongly consistent reads for the table.
  D. Request eventually consistent reads for the table.
  C. Request strongly consistent reads for the table.

• Question 90:

  A solutions architect is designing a multi-Region disaster recovery (DR) strategy for a company. The company runs an application on Amazon EC2 instances in Auto Scaling groups that are behind an Application Load Balancer (ALB). The company hosts the application in the company's primary and secondary AWS Regions.

  The application must respond to DNS queries from the secondary Region if the primary Region fails. Only one Region must serve traffic at a time.

  Which solution will meet these requirements?

  A. Create an outbound endpoint in Amazon Route 53 Resolver. Create forwarding rules that determine how queries will be forwarded to DNS resolvers on the network. Associate the rules with VPCs in each Region.
  B. Create primary and secondary DNS records in Amazon Route 53. Configure health checks and a failover routing policy.
  C. Create a traffic policy in Amazon Route 53. Use a geolocation routing policy and a value type of ELB Application Load Balancer.
  D. Create an Amazon Route 53 profile. Associate DNS resources to the profile. Associate the profile with VPCs in each Region.
  B. Create primary and secondary DNS records in Amazon Route 53. Configure health checks and a failover routing policy.

  ---

  Explanation

  Amazon Route 53 supports failover routing policies, which use health checks to route DNS queries to a secondary Region only if the primary endpoint fails. This design ensures only one Region is active for traffic at any given time. This is the recommended architecture for active-passive, multi-Region DR strategies.

  Option A, Option D: These options do not configure DNS failover for external users.

  Option C: Geolocation routing is for regional distribution, not DR failover.

  References:

  AWS Certified Solutions Architect?Official Study Guide, Multi-Region DR and Route 53.