A solutions architect is designing a VPC with public and private subnets. The VPC and subnets use IPv4 CIDR blocks. There is one public subnet and one private subnet in each of three Availability Zones (AZs) for high availability. An internet gateway is used to provide internet access for the public subnets. The private subnets require access to the internet to allow Amazon EC2 instances to download software updates.What should the solutions architect do to enable Internet access for the private subnets?
Answer(s): A
Public subnets use an Internet Gateway; private subnets require outbound internet access via NAT. A correctly implements NAT in each AZ to preserve HA: three NAT gateways in public subnets, with private subnets’ route tables directing non-VPC traffic to the NAT gateway in the same AZ. This provides scalable, managed NAT with high availability.A) Correct: per-AZ NAT gateways ensure private subnets can reach the internet for updates while remaining non-routable from the internet.B) NAT instances are self-managed and require maintenance; using three adds operational overhead and single AZ failure risk.C) A second internet gateway is not supported; private subnets cannot route to an Internet Gateway directly.D) Egress-only gateways are for IPv6; private IPv4 traffic cannot rely on this for general internet egress.
A company wants to migrate an on-premises data center to AWS. The data center hosts an SFTP server that stores its data on an NFS-based file system. The server holds 200 GB of data that needs to be transferred. The server must be hosted on an Amazon EC2 instance that uses an Amazon Elastic File System (Amazon EFS) file system.Which combination of steps should a solutions architect take to automate this task? (Choose two.)
Answer(s): B,E
DataSync provides a scalable, automated method to transfer on-premises data to an EFS-backed EC2 environment, and setting up the on-premises DataSync agent enables this integration and migration.A) Wrong: EC2 and EFS do not require being in the same AZ for DataSync; EFS is accessible across AZs within the same region, and this is not a distinct migration requirement.B) Correct: Installing a DataSync agent in the on-premises data center enables discovery and transfer to the target EFS through DataSync.C) Wrong: Using a secondary EBS volume on the EC2 instance adds management overhead and is unnecessary when targeting EFS via DataSync.D) Wrong: Manual OS copy is non-automated and error-prone, not suitable for automated migration at scale.E) Correct: DataSync can configure a location for the on-premises SFTP data source, enabling automated transfer to EFS-backed storage.
A company has an AWS Glue extract, transform, and load (ETL) job that runs every day at the same time. The job processes XML data that is in an Amazon S3 bucket. New data is added to the S3 bucket every day. A solutions architect notices that AWS Glue is processing all the data during each run.What should the solutions architect do to prevent AWS Glue from reprocessing old data?
The correct answer is A. AWS Glue job bookmarks track processed data and only process new or changed records in subsequent runs, preventing reprocessing of old XML data when the job runs on a fixed schedule.B is incorrect because deleting processed data is destructive and not a recommended ETL pattern; it would remove data rather than control reprocessing.C is incorrect because NumberOfWorkers only affects throughput and parallelism, not whether previously processed data is re-read.D is incorrect because FindMatches ML transform is for deduplication or relationship finding, not for preventing reprocessing of previously processed data.
A solutions architect must design a highly available infrastructure for a website. The website is powered by Windows web servers that run on Amazon EC2 instances. The solutions architect must implement a solution that can mitigate a large-scale DDoS attack that originates from thousands of IP addresses. Downtime is not acceptable for the website.Which actions should the solutions architect take to protect the website from such an attack? (Choose two.)
Answer(s): A,C
Amazon CloudFront and Shield Advanced provide scalable, at-edge DDoS protection and caching that mitigate large-scale attacks with minimal downtime. A) Shield Advanced offers DDoS detection and mitigation for AWS resources, suitable for high-traffic, volumetric attacks. C) CloudFront distributes traffic, accelerates content, and absorbs/mitigates DDoS at edge, protecting origin. B) GuardDuty is a threat detection service, not an automatic blocker for inbound traffic. D) Dynamically updating VPC NACLs via Lambda is risky, brittle, and not scalable for large, rapid DDoS. E) Spot Instances don’t address DDoS mitigation and can undermine availability.
A company is preparing to deploy a new serverless workload. A solutions architect must use the principle of least privilege to configure permissions that will be used to run an AWS Lambda function. An Amazon EventBridge (Amazon CloudWatch Events) rule will invoke the function.Which solution meets these requirements?
Answer(s): D
EventBridge should be allowed to invoke the Lambda function via a resource-based policy granting lambda:InvokeFunction to the events.amazonaws.com principal.A) Incorrect: granting a Lambda execution role with lambda:InvokeFunction to * principal is not valid for a function invocation by EventBridge and risks broad, unintended access; use a resource-based policy for cross-service invocation.B) Incorrect: associating the function’s execution role does not grant EventBridge permission to invoke; invocation must be allowed by a resource-based policy.C) Incorrect: resource-based policy with lambda:* on events.amazonaws.com is overly broad and violates least privilege; restrict to InvokeFunction.D) Correct: resource-based policy limiting to lambda:InvokeFunction for events.amazonaws.com grants only required permission for EventBridge to invoke the function.
Post your Comments and Discuss Amazon SAA-C03 exam prep with other Community members: