Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 – Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 Practice Test Question

Loading demo links...

Showing 94–96 of 102 questions

Question 94 (Topic 1)

A company is designing its production application's disaster recovery (DR) strategy. The application is backed by a MySQL database on an Amazon Aurora cluster in the us-east-1 Region. The company has chosen the us-west-1 Region as its DR Region. The company's target recovery point objective (RPO) is 5 minutes and the target recovery time objective (RTO) is 20 minutes. The company wants to minimize configuration changes. Which solution will meet these requirements with the MOST operational efficiency?

Select an option, then click Submit answer.

○ Create an Aurora read replica in us-west-1 similar in size to the production application's Aurora MySQL cluster writer instance.
○ Convert the Aurora cluster to an Aurora global database. Configure managed failover.
○ Create a new Aurora cluster in us-west-1 that has Cross-Region Replication.
○ Create a new Aurora cluster in us-west-1. Use AWS Database Migration Service (AWS DMS) to sync both clusters.

Reference / correct answer:

Convert the Aurora cluster to an Aurora global database. Configure managed failover.

Most accepted answer: B. Convert the Aurora cluster to an Aurora global database. Configure managed failover.

Community votes: B=5

Selected Answer: B A - Read replicas can't automatically provide failover in the event of a disaster. B - Aurora Global Databases are designed for cross-region replication and are synchronous, which means they can meet a low RPO (within seconds). Then failover is automated, meaning that if the primary region fails, traffic can be redirected to the secondary region automatically. C - Aurora does not automatically fail over with cross-region replication. You need to promote the replica manually, which could take longer than 20 minutes. The 5-minute RPO might not be met either. D - Well, just too much work to do manually. Let's simply rule it out. upvoted 3 times

Selected Answer: B B. Convert the Aurora cluster to an Aurora global database. Configure managed failover. upvoted 1 times

Selected Answer: B I go for B. However, C is also a good option except manual failover intervention upvoted 2 times

Selected Answer: B Answer:B https://aws.amazon.com/rds/aurora/global-database/ Cross-Region disaster recovery If your primary Region suffers a performance degradation or outage, you can promote one of the secondary Regions to take read/write responsibilities. An Aurora cluster can recover in less than 1 minute, even in the event of a complete Regional outage. This provides your application with an effective recovery point objective (RPO) of 1 second and a recovery time objective (RTO) of less than 1 minute, providing a strong foundation for a global business continuity plan. upvoted 3 times

Selected Answer: B Aurora Global Database: allowing a single Amazon Aurora database to span multiple AWS Regions. It replicates your data with no impact on database performance, enables fast local reads with low latency in each Region, and provides disaster recovery from Region-wide outages. upvoted 3 times

Question 95 (Topic 1)

A company is building an application in the AWS Cloud. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 for the DNS. The company needs a managed solution with proactive engagement to detect against DDoS attacks. Which solution will meet these requirements?

Select an option, then click Submit answer.

○ Enable AWS Config. Configure an AWS Config managed rule that detects DDoS attacks.
○ Enable AWS WAF on the ALCreate an AWS WAF web ACL with rules to detect and prevent DDoS attacks. Associate the web ACL with the ALB.
○ Store the ALB access logs in an Amazon S3 bucket. Configure Amazon GuardDuty to detect and take automated preventative actions for DDoS attacks.
○ Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.

Reference / correct answer:

Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.

Most accepted answer: D. Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.

Community votes: D=4

Selected Answer: D Tip: DDoS = Shield, SQL injection = WAF upvoted 6 times

Selected Answer: D For your references: 1. AWS WAF (Web Application Firewall) - SQL injections, cross-site scripting (XSS), and other common web exploits. 2. Shield Standard - common DDoS attacks; Shield Advanced - Provides advanced DDoS protection with 24/7 support, cost protection for scaling due to attacks, and more detailed attack analytics. 3. AWS Network Firewall - Blocks unauthorized access and inspect traffic for VPCs. 4. Amazon GuardDuty - Detects threats by analyzing AWS logs like CloudTrail, DNS, and VPC Flow Logs. Identifies potential malicious activities like brute force attacks and data exfiltration. 5. AWS Macie - Helps identify and protect sensitive data like PII stored in S3 buckets. upvoted 3 times LeonSauveterre 1 year, 7 months ago 6. AWS Detective - Analyzes and visualizes security-related data to identify root causes of potential security issues. 7. AWS Config - Monitors and evaluates configurations of AWS resources to ensure compliance with security best practices. 8. AWS Inspector - Automatically scans EC2 instances and container-based workloads for known vulnerabilities. 9. AWS CloudTrail - Tracks API calls and user activity for auditing and compliance. upvoted 2 times ...

6. AWS Detective - Analyzes and visualizes security-related data to identify root causes of potential security issues. 7. AWS Config - Monitors and evaluates configurations of AWS resources to ensure compliance with security best practices. 8. AWS Inspector - Automatically scans EC2 instances and container-based workloads for known vulnerabilities. 9. AWS CloudTrail - Tracks API calls and user activity for auditing and compliance. upvoted 2 times

Selected Answer: D Shield Advanced signals a DDoS detection and starts analyzing the traffic for an attack signature. If a signature is found, it is first tested on past traffic to reduce the risk of false positive, then if it's safe to use it, a corresponding WAF rule is placed in the previously created rule group. After a certain time, when the attack is stopped, the rule is automatically removed from the rule group. When successful, this process takes several minutes. upvoted 2 times

Selected Answer: D Answer is D upvoted 2 times

Question 96 (Topic 1)

A media company has a multi-account AWS environment in the us-east-1 Region. The company has an Amazon Simple Notification Service (Amazon SNS) topic in a production account that publishes performance metrics. The company has an AWS Lambda function in an administrator account to process and analyze log data. The Lambda function that is in the administrator account must be invoked by messages from the SNS topic that is in the production account when significant metrics are reported. Which combination of steps will meet these requirements? (Choose two.)

Select an option, then click Submit answer.

○ Create an IAM resource policy for the Lambda function that allows Amazon SNS to invoke the function.
○ Implement an Amazon Simple Queue Service (Amazon SQS) queue in the administrator account to buffer messages from the SNS topic that is in the production account. Configure the SQS queue to invoke the Lambda function.
○ Create an IAM policy for the SNS topic that allows the Lambda function to subscribe to the topic.
○ Use an Amazon EventBridge rule in the production account to capture the SNS topic notifications. Configure the EventBridge rule to forward notifications to the Lambda function that is in the administrator account.
○ Store performance metrics in an Amazon S3 bucket in the production account. Use Amazon Athena to analyze the metrics from the administrator account.

Reference / correct answer:

Create an IAM resource policy for the Lambda function that allows Amazon SNS to invoke the function.

Most accepted answer: A. Create an IAM resource policy for the Lambda function that allows Amazon SNS to invoke the function.

Community votes: A=9, B=3, C=6, D=1, E=1

Selected Answer: AB The correct answers are A,B. Explanation: Option A: Correct. Creating an IAM resource policy for the Lambda function that allows Amazon SNS to invoke the function is necessary for SNS to have permission to trigger Lambda. This policy ensures that the Lambda function can be invoked by a service principal from the SNS service. Option B: Correct. Using an Amazon Simple Queue Service (Amazon SQS) queue as an intermediary buffer allows for decoupling the SNS topic from the Lambda function, providing more reliability and handling burst traffic effectively. In this setup, the SNS topic can publish to the SQS queue, and the queue can then trigger the Lambda function to process the messages. upvoted 5 times Anyio 1 year, 7 months ago Sorry this is the wrong answer (or second best answer) :). The Correct answer is A,C. Using the Amazon SNS console, add a cross-account AWS Lambda subscription to an Amazon SNS topic. the Lambda function resource policy allows SNS to invoke the function. the SNS topic access policy allows Lambda to subscribe to the topic. Note: The SNS topic resides in account A and the Lambda function resides in account B. upvoted 4 times ...

Sorry this is the wrong answer (or second best answer) :). The Correct answer is A,C. Using the Amazon SNS console, add a cross-account AWS Lambda subscription to an Amazon SNS topic. the Lambda function resource policy allows SNS to invoke the function. the SNS topic access policy allows Lambda to subscribe to the topic. Note: The SNS topic resides in account A and the Lambda function resides in account B. upvoted 4 times

Selected Answer: AB VOTE A,B upvoted 5 times

Selected Answer: AC The Correct answer is A,C. Using the Amazon SNS console, add a cross-account AWS Lambda subscription to an Amazon SNS topic. the Lambda function resource policy allows SNS to invoke the function. the SNS topic access policy allows Lambda to subscribe to the topic. Note: The SNS topic resides in account A and the Lambda function resides in account B. upvoted 2 times

Selected Answer: AC A: resource-policy for Lambda: should grant SNS to access lambda permission C: resource-policy for SNS: should specify who can subscribe SNS topic upvoted 3 times

← Prev 25 26 27 28 29 30 31 32 33 34 Next →

Page 32 of 34

Sale Ends In

2h 0m 0s