An image hosting company uploads its large assets to Amazon S3 Standard buckets. The company uses multipart upload in parallel by using S3 APIs and overwrites if the same object is uploaded again. For the first 30 days after upload, the objects will be accessed frequently. The objects will be used less frequently after 30 days, but the access patterns for each object will be inconsistent. The company must optimize its S3 storage costs while maintaining high availability and resiliency of stored assets.Which combination of actions should a solutions architect recommend to meet these requirements? (Choose two.)
Answer(s): A,B
S) A and B are correct because: A) S3 Intelligent-Tiering automatically moves objects between frequent and infrequent access based on usage, preserving high availability and resiliency while optimizing cost for workloads with unpredictable access patterns. B) Lifecycle policy to clean up incomplete multipart uploads reduces wasted storage from abandoned uploads, lowering costs and improving durability by ensuring only complete objects remain. C is incorrect because delete markers relate to versioned buckets and are not about cost optimization for infrequent access. D and E are incorrect because Standard-IA and One Zone-IA require explicit cost considerations and reduced durability options; Intelligent-Tiering better fits mixed and unpredictable access with automated tiering.
A solutions architect must secure a VPC network that hosts Amazon EC2 instances. The EC2 instances contain highly sensitive data and run in a private subnet. According to company policy, the EC2 instances that run in the VPC can access only approved third-party software repositories on the internet for software product updates that use the third party’s URL. Other internet traffic must be blocked.Which solution meets these requirements?
Answer(s): A
A) Correct: AWS Network Firewall with domain list rule groups allows you to permit outbound connections only to approved third-party software repositories by blocking all other traffic from private subnets, meeting the “approved URLs only” requirement.B) Incorrect: AWS WAF protects web traffic at edge or API endpoints; it cannot control arbitrary outbound internet egress from private subnets to specific URLs.C) Incorrect: Security groups are stateful and cannot filter by URL or enforce outbound rules to specific domains; they rely on IP-based rules, not URL whitelisting.D) Incorrect: ALB is for inbound traffic distribution; it cannot enforce outbound URL-based egress filtering or control outbound internet access.
A company is hosting a three-tier ecommerce application in the AWS Cloud. The company hosts the website on Amazon S3 and integrates the website with an API that handles sales requests. The company hosts the API on three Amazon EC2 instances behind an Application Load Balancer (ALB). The API consists of static and dynamic front-end content along with backend workers that process sales requests asynchronously.The company is expecting a significant and sudden increase in the number of sales requests during events for the launch of new products.What should a solutions architect recommend to ensure that all the requests are processed successfully?
Answer(s): D
A) CloudFront for dynamic content and more EC2s: Incorrect because scaling EC2s alone may not smooth spikes in asynchronous processing; dynamic content caching may be less effective, and it ignores decoupling of requests from processing.B) CloudFront for static content and Auto Scaling: Partial improvement for static assets, but does not address asynchronous processing backlog; lacks decoupling via queuing.C) CloudFront for dynamic content and ElastiCache in front of ALB: Caching dynamic API responses is complex and may lead to stale data; ElastiCache does not guarantee decoupled, reliable processing backlog.D) CloudFront for static content and SQS queue: Correct because SQS decouples request ingestion from processing, allowing resilient, scalable handling of asynchronous sales requests; static content delivery via CloudFront reduces origin load.
A security audit reveals that Amazon EC2 instances are not being patched regularly. A solutions architect needs to provide a solution that will run regular security scans across a large fleet of EC2 instances. The solution should also patch the EC2 instances on a regular schedule and provide a report of each instance’s patch status.Which solution will meet these requirements?
A short, accurate explanation: D is correct because Amazon Inspector provides automated security assessments of EC2 instances for vulnerabilities and exposures, and AWS Systems Manager Patch Manager automates patching on a defined schedule, with reporting via Inspector findings. A is incorrect because Macie focuses on data discovery, not host vulnerability scanning or patching. B is incorrect because GuardDuty is threat detection, not vulnerability scanning, and Session Manager is a remote command tool, not a patching solution. C is incorrect because Detective analyzes security incidents and relationships, not vulnerability scanning or patch scheduling; EventBridge can trigger actions but lacks integrated patching, so it does not provide a complete patching solution.
A company is planning to store data on Amazon RDS DB instances. The company must encrypt the data at rest.What should a solutions architect do to meet this requirement?
A) Encrypting RDS at rest is achieved by using an AWS KMS key; enabling encryption at creation time or for an existing snapshot/encrypted option ensures data-at-rest protection. AWS KMS manages keys and integrates with RDS.B) Secrets Manager is for managing credentials and secrets, not for at-rest encryption keys used by RDS. RDS encryption relies on KMS, not stored secrets.C) ACM certificates enable TLS in transit, not at-rest encryption for RDS data. This is for client-server encryption in transit.D) IAM certificates are not used for RDS at-rest encryption; SSL/TLS in transit is not configured via IAM certificates.
Post your Comments and Discuss Amazon SAA-C03 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SAA-C03 content, but please register or login to continue.