A company hosts a multi-tier web application that uses an Amazon Aurora MySQL DB cluster for storage. The application tier is hosted on Amazon EC2 instances. The company’s IT security guidelines mandate that the database credentials be encrypted and rotated every 14 days.What should a solutions architect do to meet this requirement with the LEAST operational effort?
Answer(s): A
The correct answer is A. Using Secrets Manager with a KMS key provides encrypted storage, automatic and configurable rotation for the DB credentials, and direct integration with Aurora, minimizing operational overhead. Secrets Manager handles credential rotation in a managed, automated fashion and can be set to a 14-day schedule with correct rotation Lambda hooks if needed.B is incorrect because rotating passwords via Lambda with Parameter Store requires custom orchestration and lacks built-in rotation for the secrets used by Aurora, increasing operational burden.C is incorrect due to unnecessary EFS provisioning, file-based credentials, and manual key rotation logic, adding complexity and potential access issues.D is incorrect because loading credentials from an S3 file and regular downloads introduces latency, risk, and maintenance without native rotation support for database credentials.
A company has deployed a web application on AWS. The company hosts the backend database on Amazon RDS for MySQL with a primary DB instance and five read replicas to support scaling needs. The read replicas must lag no more than 1 second behind the primary DB instance. The database routinely runs scheduled stored procedures.As traffic on the website increases, the replicas experience additional lag during periods of peak load. A solutions architect must reduce the replication lag as much as possible. The solutions architect must minimize changes to the application code and must minimize ongoing operational overhead.Which solution will meet these requirements?
Aurora MySQL with Aurora Replicas provides built-in replication across replicas with minimal lag, automatic failover, and auto-scaling features. Aurora reduces replication overhead, and Aurora Auto Scaling adjusts read capacity to meet demand while keeping low latency; Aurora also supports MySQL-compatible storage and features, aligning with the stored procedures expressed in the same ecosystem (no need to rewrite to native functions). B) Redis caching helps read latency but adds caching complexity and potential data staleness; it does not reduce DB replication lag and requires app changes. C) EC2-based MySQL introduces more maintenance and higher operational overhead; lag may persist. D) DynamoDB is a different data model with no stored procedures; migrating and rewriting logic is costly and increases complexity.
A solutions architect must create a disaster recovery (DR) plan for a high-volume software as a service (SaaS) platform. All data for the platform is stored in an Amazon Aurora MySQL DB cluster.The DR plan must replicate data to a secondary AWS Region.Which solution will meet these requirements MOST cost-effectively?
Answer(s): B
Aurora Global Database provides low-latency cross-region replication for read/write scalability and automatic replication, meeting DR with minimal ongoing cost by keeping a secondary region synchronized and optional, not a full DR instance unless needed. It is the most cost-effective for continuous DR readiness without ongoing DMS or multiple instances.A) Binary log replication requires managing replication topology and maintaining a separate DB instance; higher operational cost and complexity.C) DMS continuous replication adds ongoing replication tasks and compute, increasing cost.D) Global Database requires at least one secondary instance; option B’s approach implies the same setup with operational efficiency, but DMS/explicit instance removal are unnecessary.
A company has a custom application with embedded credentials that retrieves information from an Amazon RDS MySQL DB instance. Management says the application must be made more secure with the least amount of programming effort.What should a solutions architect do to meet these requirements?
Answer(s): C
The correct answer is C because Secrets Manager provides automated credential rotation for database users, enabling least-effort rotation without code changes, and applications can retrieve credentials securely from Secrets Manager. A) KMS alone does not store or rotate credentials and loading from KMS is not appropriate for dynamic DB credentials. B) Although Secrets Manager is suitable, rotating credentials inside the application via Lambda adds unnecessary complexity; built-in rotation is preferred. D) Parameter Store can store secrets but supports less robust rotation capabilities for databases than Secrets Manager, making it less ideal for automated DB credential rotation.
A media company hosts its website on AWS. The website application’s architecture includes a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB) and a database that is hosted on Amazon Aurora. The company’s cybersecurity team reports that the application is vulnerable to SQL injection.How should the company resolve this issue?
A) Use AWS WAF in front of the ALB. Associate the appropriate web ACLs with AWS WAF.To mitigate SQL injection, deploy AWS WAF with rules that detect and block common SQLi patterns at the edge before reaching EC2/ALB and Aurora. B is incorrect because ALB rules cannot reliably detect/mitigate SQLi; a fixed response does not adapt to varied payloads. C is incorrect because Shield Advanced protects against DDoS, not SQL injection. D is incorrect because Amazon Inspector is an assessment tool for vulnerabilities on EC2, not real-time web traffic protection. AWS WAF provides targeted, managed protection for SQL injection.
Post your Comments and Discuss Amazon SAA-C03 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SAA-C03 content, but please register or login to continue.