SAA-C03 (161-182)

A company has two applications: a sender application that sends messages with payloads to be processed and a processing application intended to receive the messages with payloads. The company wants to implement an AWS service to handle messages between the two applications. The sender application can send about 1,000 messages each hour. The messages may take up to 2 days to be processed: If the messages fail to process, they must be retained so that they do not impact the processing of any remaining messages. Which solution meets these requirements and is the MOST operationally efficient?

• Set up an Amazon EC2 instance running a Redis database. Configure both applications to use the instance. Store, process, and delete the messages, respectively.

• Use an Amazon Kinesis data stream to receive the messages from the sender application. Integrate the processing application with the Kinesis Client Library (KCL).

• Integrate the sender and processor applications with an Amazon Simple Queue Service (Amazon SQS) queue. Configure a dead-letter queue to collect the messages that failed to process.

• Subscribe the processing application to an Amazon Simple Notification Service (Amazon SNS) topic to receive notifications to process. Integrate the sender application to write to the SNS topic.

A solutions architect must design a solution that uses Amazon CloudFront with an Amazon S3 origin to store a static website. The company’s security policy requires that all website traffic be inspected by AWS WAF. How should the solutions architect comply with these requirements?

• Configure an S3 bucket policy to accept requests coming from the AWS WAF Amazon Resource Name (ARN) only.

• Configure Amazon CloudFront to forward all incoming requests to AWS WAF before requesting content from the S3 origin.

• Configure a security group that allows Amazon CloudFront IP addresses to access Amazon S3 only. Associate AWS WAF to CloudFront.

• Configure Amazon CloudFront and Amazon S3 to use an origin access identity (OAI) to restrict access to the S3 bucket. Enable AWS WAF on the distribution.

Organizers for a global event want to put daily reports online as static HTML pages. The pages are expected to generate millions of views from users around the world. The files are stored in an Amazon S3 bucket. A solutions architect has been asked to design an efficient and effective solution. Which action should the solutions architect take to accomplish this?

• Generate presigned URLs for the files.

• Use cross-Region replication to all Regions.

• Use the geoproximity feature of Amazon Route 53.

• Use Amazon CloudFront with the S3 bucket as its origin.

A company runs a production application on a fleet of Amazon EC2 instances. The application reads the data from an Amazon SQS queue and processes the messages in parallel. The message volume is unpredictable and often has intermittent traffic. This application should continually process messages without any downtime. Which solution meets these requirements MOST cost-effectively?

• Use Spot Instances exclusively to handle the maximum capacity required.

• Use Reserved Instances exclusively to handle the maximum capacity required.

• Use Reserved Instances for the baseline capacity and use Spot Instances to handle additional capacity.

• Use Reserved Instances for the baseline capacity and use On-Demand Instances to handle additional capacity.

A security team wants to limit access to specific services or actions in all of the team’s AWS accounts. All accounts belong to a large organization in AWS Organizations. The solution must be scalable and there must be a single point where permissions can be maintained. What should a solutions architect do to accomplish this?

• Create an ACL to provide access to the services or actions.

• Create a security group to allow accounts and attach it to user groups.

• Create cross-account roles in each account to deny access to the services or actions.

• Create a service control policy in the root organizational unit to deny access to the services or actions.

A company is concerned about the security of its public web application due to recent web attacks. The application uses an Application Load Balancer (ALB). A solutions architect must reduce the risk of DDoS attacks against the application. What should the solutions architect do to meet this requirement?

• Add an Amazon Inspector agent to the ALB.

• Configure Amazon Macie to prevent attacks.

• Enable AWS Shield Advanced to prevent attacks.

• Configure Amazon GuardDuty to monitor the ALB.

A company’s web application is running on Amazon EC2 instances behind an Application Load Balancer. The company recently changed its policy, which now requires the application to be accessed from one specific country only. Which configuration will meet this requirement?

• Configure the security group for the EC2 instances.

• Configure the security group on the Application Load Balancer.

• Configure AWS WAF on the Application Load Balancer in a VPC.

• Configure the network ACL for the subnet that contains the EC2 instances.

A company provides an API to its users that automates inquiries for tax computations based on item prices. The company experiences a larger number of inquiries during the holiday season only that cause slower response times. A solutions architect needs to design a solution that is scalable and elastic. What should the solutions architect do to accomplish this?

• Provide an API hosted on an Amazon EC2 instance. The EC2 instance performs the required computations when the API request is made.

• Design a REST API using Amazon API Gateway that accepts the item names. API Gateway passes item names to AWS Lambda for tax computations.

• Create an Application Load Balancer that has two Amazon EC2 instances behind it. The EC2 instances will compute the tax on the received item names.

• Design a REST API using Amazon API Gateway that connects with an API hosted on an Amazon EC2 instance. API Gateway accepts and passes the item names to the EC2 instance for tax computations.

A solutions architect is creating a new Amazon CloudFront distribution for an application. Some of the information submitted by users is sensitive. The application uses HTTPS but needs another layer of security. The sensitive information should be protected throughout the entire application stack, and access to the information should be restricted to certain applications. Which action should the solutions architect take?

• Configure a CloudFront signed URL.

• Configure a CloudFront signed cookie.

• Configure a CloudFront field-level encryption profile.

• Configure CloudFront and set the Origin Protocol Policy setting to HTTPS Only for the Viewer Protocol Policy.

A gaming company hosts a browser-based application on AWS. The users of the application consume a large number of videos and images that are stored in Amazon S3. This content is the same for all users. The application has increased in popularity, and millions of users worldwide accessing these media files. The company wants to provide the files to the users while reducing the load on the origin. Which solution meets these requirements MOST cost-effectively?

• Deploy an AWS Global Accelerator accelerator in front of the web servers.

• Deploy an Amazon CloudFront web distribution in front of the S3 bucket.

• Deploy an Amazon ElastiCache for Redis instance in front of the web servers.

• Deploy an Amazon ElastiCache for Memcached instance in front of the web servers.