Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 901:

  A company uses Amazon S3 to store its confidential audit documents. The S3 bucket uses bucket policies to restrict access to audit team IAM user credentials according to the principle of least privilege. Company managers are worried about accidental deletion of documents in the S3 bucket and want a more secure solution.

  What should a solutions architect do to secure the audit documents?

  A. Enable the versioning and MFA Delete features on the S3 bucket.
  B. Enable multi-factor authentication (MFA) on the IAM user credentials for each audit team IAM user account.
  C. Add an S3 Lifecycle policy to the audit team's IAM user accounts to deny the s3:DeleteObject action during audit dates.
  D. Use AWS Key Management Service (AWS KMS) to encrypt the S3 bucket and restrict audit team IAM user accounts from accessing the KMS key.
  A. Enable the versioning and MFA Delete features on the S3 bucket.

• Question 902:

  A company is migrating a new application from an on-premises data center to a new VPC in the AWS Cloud. The company has multiple AWS accounts and VPCs that share many subnets and applications.

  The company wants to have fine-grained access control for the new application. The company wants to ensure that all network resources across accounts and VPCs that are granted permission to access the new application can access the application.

  Which solution will meet these requirements?

  A. Set up a VPC peering connection for each VPC that needs access to the new application VPC. Update route tables in each VPC to enable connectivity.
  B. Deploy a transit gateway in the account that hosts the new application. Share the transit gateway with each account that needs to connect to the application. Update route tables in the VPC that hosts the new application and in the transit gateway to enable connectivity.
  C. Use an AWS PrivateLink endpoint service to make the new application accessible to other VPCs. Control access to the application by using an endpoint policy.
  D. Use an Application Load Balancer (ALB) to expose the new application to the internet. Configure authentication and authorization processes to ensure that only specified VPCs can access the application.
  C. Use an AWS PrivateLink endpoint service to make the new application accessible to other VPCs. Control access to the application by using an endpoint policy.

  ---

  Explanation

  AWS PrivateLinkis the most suitable solution for providing fine-grained access control while allowing multiple VPCs, potentially across multiple accounts, to access the new application. This approach offers the following advantages:

  Fine-grained control: Endpoint policies can restrict access to specific services or principals.

  No need for route table updates: Unlike VPC peering or transit gateways, AWS PrivateLink does not require complex route table management.

  Scalable architecture: PrivateLink scales to support traffic from multiple VPCs.

  Secure connectivity: Ensures private connectivity over the AWS network, without exposing resources to the internet.

  Why other options are not correct:

  Option A: VPC peering is not scalable when connecting multiple VPCs or accounts. Route table management becomes complex as the number of VPCs increases.Not scalable.

  Option B: While transit gateways provide scalable VPC connectivity, they are not ideal for fine-grained access control.

  Transit gateways allow connectivity but do not inherently restrict access to specific applications.Not ideal for fine-grained access control.

  Option D: Exposing the application through an ALB over the internet is not secure and does not align with the requirement to use private network resources.Security risk.

  References:

  AWS PrivateLink:AWS Documentation - PrivateLink

  AWS Networking Services Comparison:AWS Whitepaper - Networking Services

• Question 903:

  A company needs to retain application log files for a critical application for 10 years. The application team regularly accesses logs from the past month for troubleshooting, but logs older than 1 month are rarely accessed. The application generates more than 10 TB of logs per month.

  Which storage option meets these requirements MOST cost-effectively?

  A. Store the logs in Amazon S3. Use AWS Backup to move logs more than 1 month old to S3 Glacier Deep Archive.
  B. Store the logs in Amazon S3. Use S3 Lifecycle policies to move logs more than 1 month old to S3 Glacier Deep Archive.
  C. Store the logs in Amazon CloudWatch Logs. Use AWS Backup to move logs more than 1 month old to S3 Glacier Deep Archive.
  D. Store the logs in Amazon CloudWatch Logs. Use Amazon S3 Lifecycle policies to move logs more than 1 month old to S3 Glacier Deep Archive.
  B. Store the logs in Amazon S3. Use S3 Lifecycle policies to move logs more than 1 month old to S3 Glacier Deep Archive.

• Question 904:

  A solutions architect is designing the architecture for a company website that is composed of static content. The company's target customers are located in the United States and Europe.

  Which architecture should the solutions architect recommend to MINIMIZE cost?

  A. Store the website files on Amazon S3 in the us-east-2 Region. Use an Amazon CloudFront distribution with the price class configured to limit the edge locations in use.
  B. Store the website files on Amazon S3 in the us-east-2 Region. Use an Amazon CloudFront distribution with the price class configured to maximize the use of edge locations.
  C. Store the website files on Amazon S3 in the us-east-2 Region and the eu-west-1 Region. Use an Amazon CloudFront geolocation routing policy to route requests to the closest Region to the user.
  D. Store the website files on Amazon S3 in the us-east-2 Region and the eu-west-1 Region. Use an Amazon CloudFront distribution with an Amazon Route 53 latency routing policy to route requests to the closest Region to the user.
  A. Store the website files on Amazon S3 in the us-east-2 Region. Use an Amazon CloudFront distribution with the price class configured to limit the edge locations in use.

  ---

  Explanation

  The question focuses on minimizing costs while serving static content to users in the US and Europe.

  Option A uses a single S3 bucket and configures CloudFront to limit edge locations, reducing costs by using fewer edge locations while still improving performance.

  Option B maximizes edge locations, which increases costs unnecessarily.

  Options C and Option D involve storing data in multiple regions, which increases storage and operational costs.Thus,

  Option A is the most cost-effective solution.

• Question 905:

  A payment processing company records all voice communication with its customers and stores the audio files in an Amazon S3 bucket. The company needs to capture the text from the audio files. The company must remove from the text any personally identifiable information (PII) that belongs to customers.

  What should a solutions architect do to meet these requirements?

  A. Process the audio files by using Amazon Kinesis Video Streams. Use an AWS Lambda function to scan for known PII patterns.
  B. When an audio file is uploaded to the S3 bucket, invoke an AWS Lambda function to start an Amazon Textract task to analyze the call recordings.
  C. Configure an Amazon Transcribe transcription job with PII redaction turned on. When an audio file is uploaded to the S3 bucket, invoke an AWS Lambda function to start the transcription job. Store the output in a separate S3 bucket.
  D. Create an Amazon Connect contact flow that ingests the audio files with transcription turned on. Embed an AWS Lambda function to scan for known PII patterns. Use Amazon EventBridge to start the contact flow when an audio file is uploaded to the S3 bucket.
  C. Configure an Amazon Transcribe transcription job with PII redaction turned on. When an audio file is uploaded to the S3 bucket, invoke an AWS Lambda function to start the transcription job. Store the output in a separate S3 bucket.

• Question 906:

  A company is deploying an application that processes large quantities of data in parallel. The company plans to use Amazon EC2 instances for the workload. The network architecture must be configurable to prevent groups of nodes from sharing the same underlying hardware.

  Which networking solution meets these requirements?

  A. Run the EC2 instances in a spread placement group.
  B. Group the EC2 instances in separate accounts.
  C. Configure the EC2 instances with dedicated tenancy.
  D. Configure the EC2 instances with shared tenancy.
  A. Run the EC2 instances in a spread placement group.

• Question 907:

  A company runs a stateless web application in production on a group of Amazon EC2 On-Demand Instances behind an Application Load Balancer. The application experiences heavy usage during an 8- hour period each business day.

  Application usage is moderate and steady overnight. Application usage is low during weekends.

  The company wants to minimize its EC2 costs without affecting the availability of the application.

  Which solution will meet these requirements?

  A. Use Spot Instances for the entire workload.
  B. Use Reserved Instances for the baseline level of usage. Use Spot instances for any additional capacity that the application needs.
  C. Use On-Demand Instances for the baseline level of usage. Use Spot Instances for any additional capacity that the application needs.
  D. Use Dedicated Instances for the baseline level of usage. Use On-Demand Instances for any additional capacity that the application needs.
  B. Use Reserved Instances for the baseline level of usage. Use Spot instances for any additional capacity that the application needs.

• Question 908:

  An IAM user made several configuration changes to AWS resources in their company's account during a production deployment last week. A solutions architect learned that a couple of security group rules are not configured as desired. The solutions architect wants to confirm which IAM user was responsible for making changes.

  Which service should the solutions architect use to find the desired information?

  A. Amazon GuardDuty
  B. Amazon Inspector
  C. AWS CloudTrail
  D. AWS Config
  C. AWS CloudTrail

• Question 909:

  A solutions architect has created an AWS Lambda function that makes queries to an Amazon Aurora MySQL DB instance. When the solutions architect performs a test, the DB instance shows an error for too many connections.

  Which solution will meet these requirements with the LEAST operational effort?

  A. Create a read replica for the DB instance. Query the replica DB instance instead of the primary DB instance.
  B. Migrate the data to an Amazon DynamoDB database.
  C. Configure the Amazon Aurora MySQL DB instance for Multi-AZ deployment.
  D. Create a proxy in Amazon RDS Proxy. Query the proxy instead of the DB instance.
  D. Create a proxy in Amazon RDS Proxy. Query the proxy instead of the DB instance.

  ---

  Explanation

  AWS RDS Proxy is a fully managed, highly available database proxy that allows applications to pool and share database connections efficiently. In serverless architectures like Lambda, rapid invocations can open numerous concurrent connections to Aurora, potentially overwhelming the database and causing "too many connections" errors.

  By using Amazon RDS Proxy, the solution: Pools database connections.

  Maintains warm connections that can be reused.

  Supports IAM authentication and Secrets Manager integration.

  Requires minimal application change and low operational effort.

  This directly supports the Performance Efficiency pillar of the AWS Well-Architected Framework, ensuring the application scales without overloading the DB.

  References:

  Amazon RDS Proxy Documentation

  Lambda + RDS Best Practices

• Question 910:

  A company has a financial application that produces reports. The reports average 50 KB in size and are stored in Amazon S3. The reports are frequently accessed during the first week after production and must be stored for several years.

  The reports must be retrievable within 6 hours.

  Which solution meets these requirements MOST cost-effectively?

  A. Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier after 7 days.
  B. Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days.
  C. Use S3 Intelligent-Tiering. Configure S3 Intelligent-Tiering to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) and S3 Glacier.
  D. Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier Deep Archive after 7 days.
  A. Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier after 7 days.