A company has a serverless website with millions of objects in an Amazon S3 bucket. The company uses the S3 bucket as the origin for an Amazon CloudFront distribution. The company did not set encryption on the S3 bucket before the objects were loaded. A solutions architect needs to enable encryption for all existing objects and for all objects that are added to the S3 bucket in the future.Which solution will meet these requirements with the LEAST amount of effort?
Answer(s): B
Turning on S3 default encryption and using S3 Batch Operations with a copy job efficiently encrypts all existing and future objects with minimal manual effort.A) Incorrect: recreating in a new bucket requires massive data transfer and downtime; not least effort.C) Incorrect: SSE-KMS and enabling versioning doesn’t automatically encrypt existing objects; requires a separate process and driver complexity.D) Incorrect: manually encrypting each object is impractical at millions of objects and not scalable.B) Correct: enables default encryption, uses S3 Inventory to identify unencrypted objects, and S3 Batch Operations to efficiently re-encrypt in place with a single workflow.
A company runs a global web application on Amazon EC2 instances behind an Application Load Balancer. The application stores data in Amazon Aurora. The company needs to create a disaster recovery solution and can tolerate up to 30 minutes of downtime and potential data loss. The solution does not need to handle the load when the primary infrastructure is healthy.What should a solutions architect do to meet these requirements?
Answer(s): A
A) Correct. Active-passive failover with Route 53 ensures a standby in a second region, meeting 30 minutes downtime/possible data loss (RPO/RTO acceptable). An Aurora Replica in the second region provides read/write failover capability with minimal data loss when the primary region is unavailable.B) Incorrect. Active-active would require handling traffic in both regions and complex conflict resolution; not needed since downtime tolerance exists. Also a scaled-down app may not support full DR testing.C) Incorrect. Creating a restored Aurora from latest snapshot in the second region adds data loss risk beyond 30 minutes and complicates failover timing; better to have a replica.D) Incorrect. AWS Backup alone does not provision and scale the entire DR infrastructure or ensure immediate failover readiness; an Aurora replica in DR region is more suitable.
A company has a web server running on an Amazon EC2 instance in a public subnet with an Elastic IP address. The default security group is assigned to the EC2 instance. The default network ACL has been modified to block all traffic. A solutions architect needs to make the web server accessible from everywhere on port 443.Which combination of steps will accomplish this task? (Choose two.)
Answer(s): A,E
A) Correct because attaching a security group that explicitly allows inbound TCP 443 from 0.0.0.0/0 enables public access to the web server, leveraging security groups for stateless, instance-level traffic filtering.E) Correct because network ACLs are stateless and require explicit rules for both inbound and outbound traffic; allowing inbound TCP 443 from 0.0.0.0/0 and outbound ephemeral ports (32768-65535) to 0.0.0.0/0 ensures return traffic is permitted.B) Incorrect because security groups specify inbound or outbound rules on the source/destination as appropriate; “to destination 0.0.0.0/0” is not how SG rules are defined.C) Incorrect since modifying the NACL to allow 443 is not sufficient without proper ephemeral-port outbound rules.D) Incorrect because you cannot author a single rule for both directions in a single NACL entry; explicit inbound and outbound rules are needed.
A company’s application is having performance issues. The application is stateful and needs to complete in-memory tasks on Amazon EC2 instances. The company used AWS CloudFormation to deploy infrastructure and used the M5 EC2 instance family. As traffic increased, the application performance degraded. Users are reporting delays when the users attempt to access the application.Which solution will resolve these issues in the MOST operationally efficient way?
Answer(s): D
D) replaces EC2 with R5, and deploys CloudWatch agent to generate custom application latency metrics for future capacity planning. This provides detailed, application-level latency data and scalable memory/CPU with R5, enabling informed capacity planning and proactive scaling in CloudWatch, improving operational efficiency.A) Using T3 instances and manual Console changes is less scalable and may not address stateful in-memory tasks or provide latency metrics needed for capacity planning. B) Manually adjusting ASG desired/max in CloudFormation is error-prone and not as automated or scalable as a deployed metric-driven approach. C) R5 with CloudWatch memory metrics does not capture application latency metrics, limiting capacity planning for performance issues. D) addresses latency visibility and scalable, memory-optimized instances with automation potential.
A solutions architect is designing a new API using Amazon API Gateway that will receive requests from users. The volume of requests is highly variable; several hours can pass without receiving a single request. The data processing will take place asynchronously, but should be completed within a few seconds after a request is made.Which compute service should the solutions architect have the API invoke to deliver the requirements at the lowest cost?
A) AWS Glue jobReason: AWS Glue is optimized for ETL data cataloging and batch data processing, not for low-latency, event-driven API backends. It incurs startup and job scheduling latency.B) AWS Lambda functionReason: Lambda provides event-driven, serverless compute with instant scale and very low idle costs, suiting variable traffic and asynchronous processing that must complete within seconds.C) EKS containerized serviceReason: EKS introduces managing Kubernetes clusters, with higher operational overhead and ongoing costs for idle capacity, not cost-optimal for sporadic traffic.D) ECS with EC2Reason: EC2-backed containers require provisioning and maintaining instances, leading to higher costs during idle periods compared to serverless Lambda.
Post your Comments and Discuss Amazon SAA-C03 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SAA-C03 content, but please register or login to continue.