A company needs to integrate with a third-party data feed. The data feed sends a webhook to notify an external service when new data is ready for consumption. A developer wrote an AWS Lambda function to retrieve data when the company receives a webhook callback. The developer must make the Lambda function available for the third party to call.Which solution will meet these requirements with the MOST operational efficiency?
Answer(s): A
A) The Lambda function URL enables direct public HTTPS invocation of the Lambda, providing the most operationally efficient and serverless way for the third party to call the function via webhook without managing additional infrastructure. B) ALB in front of Lambda adds extra management and cost; not as serverless or straightforward as Function URL. C) SNS topic is not intended for direct webhook calls; it publishes to subscribers, not a single Lambda invocation via a public endpoint. D) SQS queue requires polling by Lambda and does not expose a direct callable endpoint; webhook would not be a simple, immediate invocable URL.
A company has a workload in an AWS Region. Customers connect to and access the workload by using an Amazon API Gateway REST API. The company uses Amazon Route 53 as its DNS provider. The company wants to provide individual and secure URLs for all customers.Which combination of steps will meet these requirements with the MOST operational efficiency? (Choose three.)
Answer(s): A,D,F
The correct combination uses a unified, scalable custom domain with ACM certificates and API Gateway’s custom domain feature. F) Creating a custom domain name in API Gateway and associating an ACM certificate enables per-customer secure URLs under a single domain. D) ACM wildcard certificate in the same region ensures coverage for all subdomains without cross-region latency or management. A) Registering the domain and using a wildcard Route 53 record to point to the API Gateway endpoint provides centralized DNS routing and operational efficiency.B) Wildcard certificate in a different region adds cross-region complexity and is unnecessary with a same-region wildcard. C) Creating per-customer Route 53 hosted zones is not scalable. E) Multiple API endpoints for each customer complicates management versus a single custom domain.
A company stores data in Amazon S3. According to regulations, the data must not contain personally identifiable information (PII). The company recently discovered that S3 buckets have some objects that contain PII. The company needs to automatically detect PII in S3 buckets and to notify the company’s security team.Which solution will meet these requirements?
Amazon Macie is designed to discover and classify PII in S3 and can generate findings that can be streamed to EventBridge for alerting. Using EventBridge to filter Macie’s SensitiveData events and sending an SNS notification ensures immediate, actionable alerts to the security team when PII is detected in S3 objects.B) GuardDuty detects anomalous and malicious activity, not PII in S3, and is not the right service for data classification.C) Although Macie can produce SensitiveData:S3Object/Personal events, the requirement is a timely alert to the security team; SNS is preferred over SQS for real-time notifications.D) GuardDuty + SQS would not target PII in S3, and GuardDuty is not appropriate for this data classification use case.
A company wants to build a logging solution for its multiple AWS accounts. The company currently stores the logs from all accounts in a centralized account. The company has created an Amazon S3 bucket in the centralized account to store the VPC flow logs and AWS CloudTrail logs. All logs must be highly available for 30 days for frequent analysis, retained for an additional 60 days for backup purposes, and deleted 90 days after creation.Which solution will meet these requirements MOST cost-effectively?
Answer(s): C
S) C) is correct because VPC flow logs and CloudTrail must be highly available for 30 days and retained for an additional 60 days, with deletion at 90 days. S3 Glacier Flexible Retrieval provides long-term archival with retrieval support and cost of storage lower than S3 Standard for objects not accessed during the 30–90 day window, meeting cost-efficiency while retaining accessibility if needed. A) uses S3 Standard until 30 days then deletes at 90 days—too expensive for 60-day archive. B) transitions to S3 Standard-IA and Glacier—adds unnecessary IA cost and extra retrieval complexity. D) One Zone-IA risks data durability and availability since it stores data in a single AZ.
A company is building an Amazon Elastic Kubernetes Service (Amazon EKS) cluster for its workloads. All secrets that are stored in Amazon EKS must be encrypted in the Kubernetes etcd key-value store.Which solution will meet these requirements?
Answer(s): B
E) Enable EKS KMS secrets encryption on the cluster with a dedicated KMS key. Enabling EKS KMS integration encrypts Kubernetes secrets at rest in etcd using the specified KMS key, meeting the requirement.A) Secrets Manager is not required for etcd encryption; it stores secrets but does not encrypt etcd directly, and adds extra management overhead.C) EBS CSI driver and default cluster options do not address etcd encryption at rest for Kubernetes secrets.D) alias/aws/ebs is for EBS, not for etcd secret encryption; does not configure etcd encryption for Kubernetes secrets.
Post your Comments and Discuss Amazon SAA-C03 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SAA-C03 content, but please register or login to continue.