A company’s web application consists of an Amazon API Gateway API in front of an AWS Lambda function and an Amazon DynamoDB database. The Lambda function handles the business logic, and the DynamoDB table hosts the data. The application uses Amazon Cognito user pools to identify the individual users of the application. A solutions architect needs to update the application so that only users who have a subscription can access premium content.Which solution will meet this requirement with the LEAST operational overhead?
Answer(s): D
Implement API usage plans and API keys to control access based on subscription status with minimal operational overhead.A) Incorrect. API caching/throttling do not enforce subscription-based access; they optimize performance rather than authorize users.B) Incorrect. WAF rules require custom integrations and ongoing maintenance for per-user subscription checks; not a scalable or low-overhead solution for individual user authorization.C) Incorrect. Fine-grained IAM permissions apply to principals within AWS, not to end users authenticated via Cognito in a web app; DynamoDB-level restrictions won’t map cleanly to per-user app access without additional auth logic.D) Correct. API Gateway usage plans and API keys provide per-user access control aligned with subscription status, without modifying Lambda or DynamoDB logic, offering low operational overhead.
A company is using Amazon Route 53 latency-based routing to route requests to its UDP-based application for users around the world. The application is hosted on redundant servers in the company's on-premises data centers in the United States, Asia, and Europe. The company’s compliance requirements state that the application must be hosted on premises. The company wants to improve the performance and availability of the application.What should a solutions architect do to meet these requirements?
Answer(s): A
AWS Global Accelerator provides a single, global anycast entry point with health checks and fast failover to regional endpoints, optimizing latency for UDP traffic and enabling on-premises endpoints behind AWS resources. Using three NLBs in AWS Regions as endpoints leverages NLBs’ UDP support and preserves on-premises hosting while Global Accelerator handles global routing and health. A CNAME to the accelerator DNS exposes a single, resilient address.A) Correct: uses NLBs in regions with Global Accelerator for UDP traffic to on-prem endpoints.B) ALBs are layer 7 and primarily support HTTP/S, not suitable for UDP.C) CloudFront is CDN for HTTP/HTTPS; not ideal for UDP and adds extra latency.D) ALBs with CloudFront still inappropriate for UDP and latency-based routing across regions.
A solutions architect wants all new users to have specific complexity requirements and mandatory rotation periods for IAM user passwords.What should the solutions architect do to accomplish this?
A) A password policy can be configured at the AWS account level to enforce complexity and rotation requirements for all IAM user passwords, ensuring consistency for every new user.B) IAM does not support per-user password policies; policies apply at the account level, not per user.C) Third-party software is unnecessary; AWS provides built-in account-level password policies.D) CloudWatch events cannot enforce password policies or rotation requirements for new users; they cannot modify IAM passwords in this way.Therefore, an account-level password policy is the correct, supported mechanism.
A company has migrated an application to Amazon EC2 Linux instances. One of these EC2 instances runs several 1-hour tasks on a schedule. These tasks were written by different teams and have no common programming language. The company is concerned about performance and scalability while these tasks run on a single instance. A solutions architect needs to implement a solution to resolve these concerns.Which solution will meet these requirements with the LEAST operational overhead?
Using AWS Batch with EventBridge minimizes operational overhead by orchestrating heterogeneous, one-off tasks as jobs on managed compute resources, scaling behind the scenes without manual provisioning. It handles job queues, retries, and scheduling across a fleet of compute environments suitable for short-lived tasks, regardless of language.A) Correct: AWS Batch provides a serverless-like workflow for disparate tasks with minimal management; EventBridge schedules jobs.B) App Runner is for web services, not batch jobs; launching containers on demand adds complexity for scheduling heterogeneous tasks.C) Lambda is unsuitable for long-running or multi-language batch tasks and has 15-minute limits; also requires code changes.D) Creating AMIs and ASGs increases maintenance and does not optimize for on-demand batch execution.
A company runs a public three-tier web application in a VPC. The application runs on Amazon EC2 instances across multiple Availability Zones. The EC2 instances that run in private subnets need to communicate with a license server over the internet. The company needs a managed solution that minimizes operational maintenance.Which solution meets these requirements?
Answer(s): C
A NAT Gateway placed in a public subnet provides a managed, highly available egress to the internet for private subnets, with automatic scaling and no maintenance, matching the requirement for a managed solution. Private subnets route 0.0.0.0/0 to the NAT gateway to access the license server on the internet.A) NAT instance in a public subnet requires manual maintenance and scaling; not managed.B) NAT instance in a private subnet is inappropriate and insecure; still requires maintenance.D) NAT gateway must be in a public subnet to provide internet egress; placing it in a private subnet defeats routing and HA.
Post your Comments and Discuss Amazon SAA-C03 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SAA-C03 content, but please register or login to continue.