A company has applications that run on Amazon EC2 instances in a VPC. One of the applications needs to call the Amazon S3 API to store and read objects. According to the company's security regulations, no traffic from the applications is allowed to travel across the internet.Which solution will meet these requirements?
Answer(s): A
S3 gateway endpoint provides private, region-local routing to S3 over the AWS network without traversing the internet, meeting the no-internet requirement.A) S3 gateway endpoint is correct: uses VPC endpoint to S3 via AWS backbone, ensuring traffic never leaves AWS.B) A private subnet alone does not prevent internet egress; unless paired with a VPC endpoint or security controls, requests can still reach the internet.C) Bucket region alignment doesn’t affect data path; traffic could still go via the internet unless a VPC endpoint is used.D) NAT gateway enables internet access for private subnets, which violates the no-internet requirement.
A company is storing sensitive user information in an Amazon S3 bucket. The company wants to provide secure access to this bucket from the application tier running on Amazon EC2 instances inside a VPC.Which combination of steps should a solutions architect take to accomplish this? (Choose two.)
Answer(s): A,C
A) A VPC gateway endpoint for Amazon S3 within the VPC allows private, regionally-routeable access to S3 without traversing the public internet, ensuring secure access from EC2 in the VPC.C) A bucket policy that limits access to only the application tier running in the VPC (e.g., IAM role or VPC principal) enforces least privilege and ensures only trusted sources within the VPC can access the bucket.B) Makes objects public—breaches confidentiality.D) Embedding IAM credentials on EC2 is insecure and not recommended; use instance roles.E) NAT is unnecessary for S3 access within a VPC and adds cost and complexity.
A company runs an on-premises application that is powered by a MySQL database. The company is migrating the application to AWS to increase the application's elasticity and availability.The current architecture shows heavy read activity on the database during times of normal operation. Every 4 hours, the company's development team pulls a full export of the production database to populate a database in the staging environment. During this period, users experience unacceptable application latency. The development team is unable to use the staging environment until the procedure completes.A solutions architect must recommend replacement architecture that alleviates the application latency issue. The replacement architecture also must give the development team the ability to continue using the staging environment without delay.Which solution meets these requirements?
Answer(s): B
Aurora MySQL with on-demand cloning provides low-latency reads and can create a fast, isolated staging copy without impacting production, meeting elasticity and zero-wait staging access.A) Uses backup/restore with mysqldump, which is slow and volume-intensive, causing latency during production export and delaying staging access. C) RDS MySQL with Multi-AZ and read replicas adds complexity and still relies on backup/restore for staging; standby cannot be used for a live staging clone. D) Similar to C, relies on mysqldump for staging data, introducing heavy I/O and latency during export, delaying staging access.
A company is designing an application where users upload small files into Amazon S3. After a user uploads a file, the file requires one-time simple processing to transform the data and save the data in JSON format for later analysis.Each file must be processed as quickly as possible after it is uploaded. Demand will vary. On some days, users will upload a high number of files. On other days, users will upload a few files or no files.Which solution meets these requirements with the LEAST operational overhead?
Answer(s): C
S3 event-driven processing with Lambda provides near-real-time handling, serverless scaling for variable demand, and minimal operational overhead. Using SQS with Lambda (option C) ensures asynchronous, decoupled processing of each uploaded file and Lambda scales automatically to the event rate; storing JSON in DynamoDB suits small, fast lookups and is fully managed.A) EMR is heavy, requires cluster management, and is unsuitable for simple one-time processing with variable load. B) EC2-based processing adds maintenance, scaling, and higher overhead than serverless. D) EventBridge to Kinesis adds unnecessary components and complexity; Aurora introduces relational storage with more management.
An application allows users at a company's headquarters to access product data. The product data is stored in an Amazon RDS MySQL DB instance. The operations team has isolated an application performance slowdown and wants to separate read traffic from write traffic. A solutions architect needs to optimize the application's performance quickly.What should the solutions architect recommend?
Answer(s): D
A) D) incorrect to start; A and B discuss Multi-AZ but read/write separation via AZ placement is not how reads are scaled in RDS; Multi-AZ provides high availability, not read offload.C) Incorrect: read replicas typically have same or scaled resources; halving resources can cause underprovisioning and latency; not a recommended quick optimization.D) Correct: creating read replicas provides true read offload from the primary, enabling separation of read traffic without impacting write performance; maintaining same compute/storage ensures consistent performance and reduces configuration risk.
Post your Comments and Discuss Amazon SAA-C03 exam prep with other Community members: