Amazon
SAA-C03 Exam
Questions

AWS Certified Solutions Architect - Associate SAA-C03

Amazon (SAA-C03) Exam Questions And Answers page 56

How can the application team improve performance for a public-facing web application with complex queries?

Multiple Choice

A public-facing web application queries a database hosted on an Amazon EC2 instance in a private subnet. A large number of queries involve multiple table joins, and the application performance has been degrading due to an increase in complex queries. The application team will be performing updates to improve performance.

What should a solutions architect recommend to the application team? (Choose two.)

Cache query data in Amazon SQS

Create a read replica to offload queries

Migrate the database to Amazon Athena

Implement Amazon DynamoDB Accelerator to cache data.

Migrate the database to Amazon RDS

Define Performant Architectures Specify Secure Applications and Architectures

How can a solutions architect simplify on-premises backup infrastructure and reduce costs?

Single Choice

A recent analysis of a company's IT expenses highlights the need to reduce backup costs. The company's chief information officer wants to simplify the on-premises backup infrastructure and reduce costs by eliminating the use of physical backup tapes. The company must preserve the existing investment in the on-premises backup applications and workflows.

What should a solutions architect recommend?

Set up AWS Storage Gateway to connect with the backup applications using the NFS interface.

Set up an Amazon EFS file system that connects with the backup applications using the NFS interface.

Set up an Amazon EFS file system that connects with the backup applications using the iSCSI interface.

Set up AWS Storage Gateway to connect with the backup applications using the iSCSI-virtual tape library (VTL) interface.

Design Cost-Optimized Architectures

How can a solutions architect simplify on-premises backup infrastructure and reduce costs?

Single Choice

Set up AWS Storage Gateway to connect with the backup applications using the NFS interface.

Set up an Amazon Elastic File System (Amazon EFS) file system that connects with the backup applications using the NFS interface.

Set up an Amazon Elastic File System (Amazon EFS) file system that connects with the backup applications using the iSCSI interface.

Set up AWS Storage Gateway to connect with the backup applications using the iSCSI-virtual tape library (VTL) interface.

Design Cost-Optimized Architectures

How can the company ensure secure network connectivity and data migration to AWS within a month?

Single Choice

A recently acquired company is required to build its own infrastructure on AWS and migrate multiple applications to the cloud within a month. Each application has approximately 50 TB of data to be transferred. After the migration is complete, this company and its parent company will both require secure network connectivity with consistent throughput from their data centers to the applications. A solutions architect must ensure one-time data migration and ongoing network connectivity.

Which solution will meet these requirements?

AWS Direct Connect for both the initial transfer and ongoing connectivity.

AWS Site-to-Site VPN for both the initial transfer and ongoing connectivity.

AWS Snowball for the initial transfer and AWS Direct Connect for ongoing connectivity.

AWS Snowball for the initial transfer and AWS Site-to-Site VPN for ongoing connectivity.

Define Performant Architectures Specify Secure Applications and Architectures

How can a solutions architect minimize operational overhead costs for a three-tier web application?

Single Choice

A recently created startup built a three-tier web application. The front end has static content. The application layer is based on microservices. User data is stored as JSON documents that need to be accessed with low latency. The company expects regular traffic to be low during the first year, with peaks in traffic when it publicizes new features every month. The startup team needs to minimize operational overhead costs.

What should a solutions architect recommend to accomplish this?

Use Amazon S3 static website hosting to store and serve the front end. Use AWS Elastic Beanstalk for the application layer. Use Amazon DynamoDB to store user data.

Use Amazon S3 static website hosting to store and serve the front end. Use Amazon Elastic KubernetesService (Amazon EKS) for the application layer. Use Amazon DynamoDB to store user data.

Use Amazon S3 static website hosting to store and serve the front end. Use Amazon API Gateway and AWS Lambda functions for the application layer. Use Amazon DynamoDB to store user data.

Use Amazon S3 static website hosting to store and serve the front end. Use Amazon API Gateway and AWS Lambda functions for the application layer. Use Amazon RDS with read replicas to store user data.

Design Cost-Optimized Architectures

What cost-effective solution should be recommended for performing SQL queries on structured .csv data files in Amazon S3?

Single Choice

A ride-sharing company stores historical service usage data as structured .csv data files in Amazon S3. A data analyst needs to perform SQL queries on this data. A solutions architect must recommend a solution that optimizes cost-effectiveness for the queries.

Which solution meets these requirements?

Create an Amazon EMR cluster. Load the data. Perform the queries.

Create an Amazon Redshift cluster. Import the data. Perform the queries.

Create an Amazon Aurora PostgreSQL DB cluster. Import the data. Perform the queries.

Create an Amazon Athena database. Associate the data in Amazon S3. Perform the queries.

Design Cost-Optimized Architectures

Which solution requires the least operational effort to enforce IAM user access key rotation every 90 days?

Single Choice

A security team needs to enforce the rotation of all IAM users access keys every 90 days. If an access key is found to be older, the key must be made inactive and removed. A solutions architect must create a solution that will check for and remediate any keys older than 90 days.

Which solution meets these requirements with the LEAST operational effort?

Create an AWS Config rule to check for the key age. Configure the AWS Config rule to run an AWS Batch job to remove the key.

Create an Amazon EventBridge (Amazon CloudWatch Events) rule to check for the key age. Configure the rule to run an AWS Batch job to remove the key.

Create an AWS Config rule to check for the key age. Define an Amazon EventBridge (Amazon CloudWatch Events) rule to schedule an AWS Lambda function to remove the key.

Create an Amazon EventBridge (Amazon CloudWatch Events) rule to check for the key age. Define an EventBridge (CloudWatch Events) rule to run an AWS Batch job to remove the key.

Specify Secure Applications and Architectures

How can a solutions architect limit access to specific services/actions in AWS accounts within an organization?

Single Choice

A security team to limit access to specific services or actions in all of the team s AWS accounts. All accounts belong to a large organization in AWS Organizations. The solution must be scalable and there must be a single point where permissions can be maintained.

What should a solutions architect do to accomplish this?

Create an ACL to provide access to the services or actions.

Create a security group to allow accounts and attach it to user groups.

Create cross-account roles in each account to deny access to the services or actions.

Create a service control policy in the root organizational unit to deny access to the services or actions.

Specify Secure Applications and Architectures

Correct Answer:

Create a service control policy in the root organizational unit to deny access to the services or actions.

Explanation:

Service Control Policy concepts
SCPs offer central access controls for all IAM entities in your accounts. You can use them to enforce the permissions you want everyone in your business to follow. Using SCPs, you can give your developers more freedom to manage their own permissions because you know they can only operate within the boundaries you define.
You create and apply SCPs through AWS Organizations. When you create an organization, AWS Organizations automatically creates a root, which forms the parent container for all the accounts in your organization. Inside the root, you can group accounts in your organization into organizational units (OUs) to simplify management of these accounts. You can create multiple OUs within a single organization, and you can create OUs within other OUs to form a hierarchical structure. You can attach SCPs to the organization root, OUs, and individual accounts. SCPs attached to the root and OUs apply to all OUs and accounts inside of
them.
SCPs use the AWS Identity and Access Management (IAM) policy language; however, they do not grant permissions. SCPs enable you set permission guardrails by defining the maximum available permissions for IAM entities in an account. If a SCP denies an action for an account, none of the entities in the account can
take that action, even if their IAM permissions allow them to do so. The guardrails set in SCPs apply to all
IAM entities in the account, which include all users, roles, and the account root user.
21 1 -1 9 0 " security administrators use service,users and roles
%20security%20administrators%20use%20service,users%20and%20roles)%20adhere%20to.&text=Now%2C%20using%20SCPs%2C%20you%20can,your%20organization%20or%20organizational%20unit
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html

References:

How can a solutions architect provide access to a SaaS solution hosted in a VPC without exposing it to the public internet?

Single Choice

A software vendor is deploying a new software-as-a-service (SaaS) solution that will be utilized by many AWS users. The service is hosted in a VPC behind a Network Load Balancer. The software vendor wants to provide access to this service to users with the least amount of administrative overhead and without exposing the service to the public internet.

What should a solutions architect do to accomplish this goal?

Create a peering VPC connection from each user s VPC to the software vendor s VPC.

Deploy a transit VPC in the software vendor s AWS account. Create a VPN connection with each user account.

Connect the service in the VPC with an AWS Private Link endpoint. Have users subscribe to the endpoint.

Deploy a transit VPC in the software vendor s AWS account. Create an AWS Direct Connect connection with each user account.

Define Performant Architectures Design Cost-Optimized Architectures

What is the most secure solution for designing a highly available application with HTTPS content delivery?

Single Choice

A solution architect needs to design a highly available application consisting of web, application, and database tiers. HTTPS content delivery should be as close to the edge as possible, with the least delivery time.

Which solution meets these requirements and is MOST secure?

Configure a public Application Load Balancer (ALB) with multiple redundant Amazon EC2 instances in public subnets. Configure Amazon CloudFront to deliver HTTPS content using the public ALB as the origin.

Amazon EC2 instances in private subnets Configure. Configure a public Application Load Balancer with multiple redundant Amazon CloudFront to deliver HTTPS content using the EC2 instances as the origin.

Configure a public Application Load Balancer (ALB) with multiple redundant Amazon EC2 instances in private subnets. Configure Amazon CloudFront to deliver HTTPS content using the public ALB as the origin.

Configure a public Application Load Balancer with multiple redundant Amazon EC2 instances in public subnets. Configure Amazon CloudFront to deliver HTTPS content using the EC2 instances as the origin.

Define Performant Architectures Specify Secure Applications and Architectures

Previous Questions

Next Questions

Amazon (SAA-C03) Exam Questions And Answers page 56

How can the application team improve performance for a public-facing web application with complex queries?

Comments

How can a solutions architect simplify on-premises backup infrastructure and reduce costs?

Comments

How can a solutions architect simplify on-premises backup infrastructure and reduce costs?

Comments

How can the company ensure secure network connectivity and data migration to AWS within a month?

Correct Answer:

Explanation:

References:

Comments

How can a solutions architect minimize operational overhead costs for a three-tier web application?

Comments

What cost-effective solution should be recommended for performing SQL queries on structured .csv data files in Amazon S3?

Correct Answer:

References:

Comments

Which solution requires the least operational effort to enforce IAM user access key rotation every 90 days?

Correct Answer:

References:

Comments

How can a solutions architect limit access to specific services/actions in AWS accounts within an organization?

Correct Answer:

Explanation:

References:

Comments

How can a solutions architect provide access to a SaaS solution hosted in a VPC without exposing it to the public internet?

Comments

What is the most secure solution for designing a highly available application with HTTPS content delivery?

Comments

{{ exam.shortName }}

{{ exam.longName }}