A solutions architect is designing a two-tiered architecture that includes a public subnet and a database subnet. The web servers in the public subnet must be open to the internet on port 443. The Amazon RDS for MySQL DB instance in the database subnet must be accessible only to the web servers on port 3306.Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
Answer(s): C,D
C) Correct: Creates a security group for web servers allowing inbound 443 from the internet, satisfying public access on 443, and associates it with web tier.D) Correct: Creates a security group for the DB instance allowing inbound 3306 only from the web servers’ security group, ensuring DB access is restricted to web servers.A) Incorrect: NACLs are stateless; blocking outbound 3306 on public subnet would not reliably restrict DB access and is unnecessary when SG-based controls suffice.B) Incorrect: Allowing 3306 from the entire public subnet CIDR to the DB instance risks exposure from other hosts in the subnet; not as granular as SG-based source from web layer.E) Incorrect: Deny rules are implicit by default; explicit deny of all traffic except from web SG is redundant and less flexible than a positive allow from the web SG.
A company is implementing a shared storage solution for a gaming application that is hosted in the AWS Cloud. The company needs the ability to use Lustre clients to access data. The solution must be fully managed.Which solution meets these requirements?
Answer(s): D
Amazon FSx for Lustre provides a fully managed Lustre file system that natively supports Lustre clients with low latency and high performance, directly meeting the requirement for Lustre access in a fully managed service.A) DataSync task with a mountable file system is not Lustre-native and does not provide a fully managed Lustre service. B) Storage Gateway file gateway supports SMB/NFS, not Lustre clients, so it does not meet Lustre access. C) EFS can be configured for performance modes but does not offer Lustre as a client-facing protocol; it is not Lustre-native. D) FSx for Lustre is the correct fully managed Lustre solution that supports Lustre clients directly.
A company runs an application that receives data from thousands of geographically dispersed remote devices that use UDP. The application processes the data immediately and sends a message back to the device if necessary. No data is stored.The company needs a solution that minimizes latency for the data transmission from the devices. The solution also must provide rapid failover to another AWS Region.Which solution will meet these requirements?
Answer(s): B
Global Accelerator minimizes latency globally and provides rapid failover between Regions, making B correct. It uses regional NLB endpoints and local anycast, reducing path length for UDP traffic and enabling fast regional failover without DNS propagation delays. A is incorrect because Route 53 failover routing adds DNS-based failover, not the lowest latency path for UDP, and using Lambda introduces invocation latency and lacks Global Accelerator’s fast failover. C is incorrect because ALB targets are limited to HTTP/HTTPS and WebSocket; UDP is not supported, so cannot handle raw UDP devices. D is incorrect for similar ALB/Route 53 DNS failover, and ALB does not support UDP, plus slower failover compared to Global Accelerator.
A solutions architect must migrate a Windows Internet Information Services (IIS) web application to AWS. The application currently relies on a file share hosted in the user's on-premises network-attached storage (NAS). The solutions architect has proposed migrating the IIS web servers to Amazon EC2 instances in multiple Availability Zones that are connected to the storage solution, and configuring an Elastic Load Balancer attached to the instances.Which replacement to the on-premises file share is MOST resilient and durable?
Answer(s): C
The correct answer is C.A) Migrate the file share to Amazon FSx for Windows File Server provides a native Windows file share (SMB) with full Windows ACLs, supports EC2-integrated deployments across AZs, and high durability with built-in backups, making it the most seamless replacement for an on-premises Windows file share in this IIS scenario. B) AWS Storage Gateway is a hybrid option, not a native cloud file system, and adds complexity rather than optimal resilience for multi-AZ EC2 workloads. D) Amazon EFS offers a scalable NFS file system, but lacks native Windows SMB support and seamless Windows permissions required by IIS-based Windows applications. A) Amazon RDS is a database service, not a file share.
A company is deploying a new application on Amazon EC2 instances. The application writes data to Amazon Elastic Block Store (Amazon EBS) volumes. The company needs to ensure that all data that is written to the EBS volumes is encrypted at rest.Which solution will meet this requirement?
E) Creating and attaching EBS volumes that are encrypted by default ensures all data at rest is encrypted without relying on callers or instance configuration.A) IAM role cannot enforce EBS encryption; roles grant permissions, not encryption at rest. B) Correct: EBS volumes can be created as encrypted, using KMS keys, ensuring data at rest is encrypted on every write. C) Tag-based enforcement does not enforce encryption at rest or mechanism for encryption; tags are metadata only. D) A key policy alone does not enable encryption on volumes; encryption is a property of the EBS volume or snapshot, not a policy requirement.
Post your Comments and Discuss Amazon SAA-C03 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SAA-C03 content, but please register or login to continue.