SAA-C03 Part 7

A city has deployed a web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's users have reported sporadic performance, which appears to be related to DDoS attacks originating from random IP addresses. The city needs a solution that requires minimal configuration changes and provides an audit trail for the DDoS sources.

Which solution meets these requirements?

• • A. Enable an AWS WAF web ACL on the ALB, and configure rules to block traffic from unknown sources.

• • B. Subscribe to Amazon Inspector. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service.

• • C. Subscribe to AWS Shield Advanced. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service.

• • D. Create an Amazon CloudFront distribution for the application, and set the ALB as the origin. Enable an AWS WAF web ACL on the distribution, and configure rules to block traffic from unknown sources

A company copies 200 TB of data from a recent ocean survey onto AWS Snowball Edge Storage Optimized devices. The company has a high performance computing (HPC) cluster that is hosted on AWS to look for oil and gas deposits. A solutions architect must provide the cluster with consistent sub-millisecond latency and high-throughput access to the data on the Snowball Edge Storage Optimized devices. The company is sending the devices back to AWS.

Which solution will meet these requirements?

• • A. Create an Amazon S3 bucket. Import the data into the S3 bucket. Configure an AWS Storage Gateway file gateway to use the S3 bucket. Access the file gateway from the HPC cluster instances.

• • B. Create an Amazon S3 bucket. Import the data into the S3 bucket. Configure an Amazon FSx for Lustre file system, and integrate it with the S3 bucket. Access the FSx for Lustre file system from the HPC cluster instances.

• • C. Create an Amazon S3 bucket and an Amazon Elastic File System (Amazon EFS) file system. Import the data into the S3 bucket. Copy the data from the S3 bucket to the EFS file system. Access the EFS file system from the HPC cluster instances.

• • D. Create an Amazon FSx for Lustre file system. Import the data directly into the FSx for Lustre file system. Access the FSx for Lustre file system from the HPC cluster instances.

A company has NFS servers in an on-premises data center that need to periodically back up small amounts of data to Amazon S3.

Which solution meets these requirements and is MOST cost-effective?

• • A. Set up AWS Glue to copy the data from the on-premises servers to Amazon S3.

• • B. Set up an AWS DataSync agent on the on-premises servers, and sync the data to Amazon S3.

• • C. Set up an SFTP sync using AWS Transfer for SFTP to sync data from on premises to Amazon S3.

• • D. Set up an AWS Direct Connect connection between the on-premises data center and a VPC, and copy the data to Amazon S3.

An online video game company must maintain ultra-low latency for its game servers. The game servers run on Amazon EC2 instances. The company needs a solution that can handle millions of UDP internet traffic requests each second.

Which solution will meet these requirements MOST cost-effectively?

• • A. Configure an Application Load Balancer with the required protocol and ports for the internet traffic. Specify the EC2 instances as the targets.

• B. Configure a Gateway Load Balancer for the internet traffic. Specify the EC2 instances as the targets.

• • C. Configure a Network Load Balancer with the required protocol and ports for the internet traffic. Specify the EC2 instances as the targets.

• • D. Launch an identical set of game servers on EC2 instances in separate AWS Regions. Route internet traffic to both sets of EC2 instances.

A company runs a three-tier application in a VPC. The database tier uses an Amazon RDS for MySQL DB instance.

The company plans to migrate the RDS for MySQL DB instance to an Amazon Aurora PostgreSQL DB cluster. The company needs a solution that replicates the data changes that happen during the migration to the new database.

Which combination of steps will meet these requirements? (Choose two.)

• • A. Use AWS Database Migration Service (AWS DMS) Schema Conversion to transform the database objects.

• • B. Use AWS Database Migration Service (AWS DMS) Schema Conversion to create an Aurora PostgreSQL read replica on the RDS for MySQL DB instance.

• • C. Configure an Aurora MySQL read replica for the RDS for MySQL DB instance.

• • D. Define an AWS Database Migration Service (AWS DMS) task with change data capture (CDC) to migrate the data.

• • E. Promote the Aurora PostgreSQL read replica to a standalone Aurora PostgreSQL DB cluster when the replica lag is zero.

A company hosts a database that runs on an Amazon RDS instance that is deployed to multiple Availability Zones. The company periodically runs a script against the database to report new entries that are added to the database. The script that runs against the database negatively affects the performance of a critical application. The company needs to improve application performance with minimal costs.

Which solution will meet these requirements with the LEAST operational overhead?

• • A. Add functionality to the script to identify the instance that has the fewest active connections. Configure the script to read from that instance to report the total new entries.

• • B. Create a read replica of the database. Configure the script to query only the read replica to report the total new entries.

• • C. Instruct the development team to manually export the new entries for the day in the database at the end of each day.

• • D. Use Amazon ElastiCache to cache the common queries that the script runs against the database.

A company is using an Application Load Balancer (ALB) to present its application to the internet. The company finds abnormal traffic access patterns across the application. A solutions architect needs to improve visibility into the infrastructure to help the company understand these abnormalities better.

What is the MOST operationally efficient solution that meets these requirements?

• • A. Create a table in Amazon Athena for AWS CloudTrail logs. Create a query for the relevant information.

• • B. Enable ALB access logging to Amazon S3. Create a table in Amazon Athena, and query the logs.

• • C. Enable ALB access logging to Amazon S3. Open each file in a text editor, and search each line for the relevant information.

• • D. Use Amazon EMR on a dedicated Amazon EC2 instance to directly query the ALB to acquire traffic access log information.

A company wants to use NAT gateways in its AWS environment. The company's Amazon EC2 instances in private subnets must be able to connect to the public internet through the NAT gateways.

Which solution will meet these requirements?

• • A. Create public NAT gateways in the same private subnets as the EC2 instances.

• • B. Create private NAT gateways in the same private subnets as the EC2 instances.

• • C. Create public NAT gateways in public subnets in the same VPCs as the EC2 instances.

• • D. Create private NAT gateways in public subnets in the same VPCs as the EC2 instances.

A company has an organization in AWS Organizations. The company runs Amazon EC2 instances across four AWS accounts in the root organizational unit (OU). There are three nonproduction accounts and one production account. The company wants to prohibit users from launching EC2 instances of a certain size in the nonproduction accounts. The company has created a service control policy (SCP) to deny access to launch instances that use the prohibited types.

Which solutions to deploy the SCP will meet these requirements? (Choose two.)

• • A. Attach the SCP to the root OU for the organization.

• • B. Attach the SCP to the three nonproduction Organizations member accounts.

• • C. Attach the SCP to the Organizations management account.

• D. Create an OU for the production account. Attach the SCP to the OU. Move the production member account into the new OU.

• • E. Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU.

A company’s website hosted on Amazon EC2 instances processes classified data stored in Amazon S3. Due to security concerns, the company requires a private and secure connection between its EC2 resources and Amazon S3.

Which solution meets these requirements?

• • A. Set up S3 bucket policies to allow access from a VPC endpoint.

• • B. Set up an IAM policy to grant read-write access to the S3 bucket.

• • C. Set up a NAT gateway to access resources outside the private subnet.

• • D. Set up an access key ID and a secret access key to access the S3 bucket.