Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 Practice Test Question - Page 19

Question 55 (Topic 1)

A solutions architect is using an AWS CloudFormation template to deploy a three-tier web application. The web application consists of a web tier and an application tier that stores and retrieves user data in Amazon DynamoDB tables. The web and application tiers are hosted on Amazon EC2 instances, and the database tier is not publicly accessible. The application EC2 instances need to access the DynamoDB tables without exposing API credentials in the template. What should the solutions architect do to meet these requirements?

Select an option, then click Submit answer.

○ Create an IAM role to read the DynamoDB tables. Associate the role with the application instances by referencing an instance profile.
○ Create an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile, and associate the instance profile with the application instances.
○ Use the parameter section in the AWS CloudFormation template to have the user input access and secret keys from an already-created IAM user that has the required permissions to read and write from the DynamoDB tables.
○ Create an IAM user in the AWS CloudFormation template that has the required permissions to read and write from the DynamoDB tables. Use the GetAtt function to retrieve the access and secret keys, and pass them to the application instances through the user data.

Reference / correct answer:

Create an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile, and associate the instance profile with the application instances.

Most accepted answer: B. Create an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile, and associate the instance profile with the application instances.

Community votes: A=2, B=7

Selected Answer: B best practice is using IAM role for database access. From app to DB => need both read & write, only B meets these 2 upvoted 3 times

Selected Answer: B Application "stores and retrieves" data in DynamoDB while A grants only access "to read". upvoted 3 times

Selected Answer: B B is correct, A total wrong because "read the DynamoDB tables", so what about write in database. upvoted 4 times

question says: ...application tier stores and retrieves user data in Amazon DynamoDB tables... so it needs read and write access A) is only read access B) seems to be the right answer upvoted 2 times

Selected Answer: B Option B is the correct approach to meet the requirements: Create an IAM role with permissions to access DynamoDB Add the IAM role to an EC2 Instance Profile Associate the Instance Profile with the application EC2 instances This allows the instances to assume the IAM role to obtain temporary credentials to access DynamoDB. upvoted 3 times

Question 56 (Topic 1)

A company's solutions architect is designing an AWS multi-account solution that uses AWS Organizations. The solutions architect has organized the company's accounts into organizational units (OUs). The solutions architect needs a solution that will identify any changes to the OU hierarchy. The solution also needs to notify the company's operations team of any changes. Which solution will meet these requirements with the LEAST operational overhead?

Select an option, then click Submit answer.

○ Provision the AWS accounts by using AWS Control Tower. Use account drift notifications to identify the changes to the OU hierarchy.
○ Provision the AWS accounts by using AWS Control Tower. Use AWS Config aggregated rules to identify the changes to the OU hierarchy.
○ Use AWS Service Catalog to create accounts in Organizations. Use an AWS CloudTrail organization trail to identify the changes to the OU hierarchy.
○ Use AWS CloudFormation templates to create accounts in Organizations. Use the drift detection operation on a stack to identify the changes to the OU hierarchy.

Reference / correct answer:

Use AWS Service Catalog to create accounts in Organizations. Use an AWS CloudTrail organization trail to identify the changes to the OU hierarchy.

Most accepted answer: C. Use AWS Service Catalog to create accounts in Organizations. Use an AWS CloudTrail organization trail to identify the changes to the OU hierarchy.

Community votes: A=2, B=2, C=3

Selected Answer: A The key advantages you highlight of Control Tower are convincing: Fully managed service simplifies multi-account setup. Built-in account drift notifications detect OU changes automatically. More scalable and less complex than Config rules or CloudTrail. Better security and compliance guardrails than custom options. Lower operational overhead compared to other solution upvoted 12 times

A is correct. https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html https://docs.aws.amazon.com/controltower/latest/userguide/prevention-and-notification.html upvoted 8 times

Selected Answer: C A. Control Tower drift detection is about accounts or resources drifting from guardrails/baselines, not OU hierarchy changes. B. Control Tower + AWS Config aggregated rules AWS Config can track certain resources, but AWS Config does not natively record OU hierarchy changes in AWS Organizations. upvoted 1 times

Selected Answer: C Chat --- C. Service Catalog + CloudTrail organization trail CloudTrail does log AWS Organizations events such as CreateOrganizationalUnit, MoveAccount, UpdateOrganizationalUnit, DeleteOrganizationalUnit. Setting up an organization trail ensures these events are captured across all accounts automatically. Then you can use EventBridge rules to trigger notifications (e.g., to SNS → Ops team). This directly meets the requirement with the least overhead. upvoted 1 times DevendraAWS6025 1 month, 3 weeks ago Please Mark the Key word Least Operation Overhead. Then A should be Correct Answer only upvoted 1 times ...

Please Mark the Key word Least Operation Overhead. Then A should be Correct Answer only upvoted 1 times

Question 57 (Topic 1)

A solutions architect needs to ensure that API calls to Amazon DynamoDB from Amazon EC2 instances in a VPC do not travel across the internet. Which combination of steps should the solutions architect take to meet this requirement? (Choose two.)

Select an option, then click Submit answer.

○ Create a route table entry for the endpoint.
○ Create a gateway endpoint for DynamoDB.
○ Create an interface endpoint for Amazon EC2.
○ Create an elastic network interface for the endpoint in each of the subnets of the VPC.
○ Create a security group entry in the endpoint's security group to provide access.

Reference / correct answer:

Create a gateway endpoint for DynamoDB.

Most accepted answer: B. Create a gateway endpoint for DynamoDB.

Community votes: A=10, B=13, E=3

Selected Answer: AB https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html upvoted 13 times

Selected Answer: BE The reasons are: A gateway endpoint for DynamoDB enables private connectivity between DynamoDB and the VPC. This allows EC2 instances to access DynamoDB APIs without traversing the internet. A security group entry is needed to allow the EC2 instances access to the DynamoDB endpoint over the VPC. An interface endpoint is used for services like S3 and Systems Manager, not DynamoDB. Route table entries route traffic within a VPC but do not affect external connectivity. Elastic network interfaces are not needed for gateway endpoints. upvoted 10 times allanm 11 months, 3 weeks ago Gateway VPC endpoints provide reliable connectivity to Amazon S3 and DynamoDB without requiring an internet gateway or a NAT device for your VPC. Gateway endpoints do not use AWS PrivateLink, unlike other types of VPC endpoints. https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html B is correct upvoted 2 times ... unbendable 2 years, 9 months ago "The outbound rules for the security group for instances that access DynamoDB through the gateway endpoint must allow traffic to DynamoDB", https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html The option however is talking about the security group of the endpoint upvoted 3 times ...

Gateway VPC endpoints provide reliable connectivity to Amazon S3 and DynamoDB without requiring an internet gateway or a NAT device for your VPC. Gateway endpoints do not use AWS PrivateLink, unlike other types of VPC endpoints. https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html B is correct upvoted 2 times

"The outbound rules for the security group for instances that access DynamoDB through the gateway endpoint must allow traffic to DynamoDB", https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html The option however is talking about the security group of the endpoint upvoted 3 times

Selected Answer: AB A & B are correct https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/vpc-endpoints-dynamodb.html E is incorrect. There's no need for security group. From the URL above: "Once the VPC subnet’s gateway endpoint has been granted access to DynamoDB, any AWS account with access to that subnet can use DynamoDB." upvoted 2 times

Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 – Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 Practice Test Question