Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 Practice Test Question - Page 4

Question 10 (Topic 1)

A company is preparing to store confidential data in Amazon S3. For compliance reasons, the data must be encrypted at rest. Encryption key usage must be logged for auditing purposes. Keys must be rotated every year. Which solution meets these requirements and is the MOST operationally efficient?

Select an option, then click Submit answer.

○ Server-side encryption with customer-provided keys (SSE-C)
○ Server-side encryption with Amazon S3 managed keys (SSE-S3)
○ Server-side encryption with AWS KMS keys (SSE-KMS) with manual rotation
○ Server-side encryption with AWS KMS keys (SSE-KMS) with automatic rotation

Reference / correct answer:

Server-side encryption with AWS KMS keys (SSE-KMS) with automatic rotation

Most accepted answer: D. Server-side encryption with AWS KMS keys (SSE-KMS) with automatic rotation

Community votes: B=2, D=11

Selected Answer: D The MOST operationally efficient one is D. Automating the key rotation is the most efficient. Just to confirm, the A and B options don't allow automate the rotation as explained here: https://aws.amazon.com/kms/faqs/#:~:text=You%20can%20choose%20to%20have%20AWS%20KMS%20automatically%20rotate%20KMS,KMS%20custom%20key%20store%20feature upvoted 22 times vadiminski_a 3 years, 7 months ago In addition you cannot log key usage in B, for A I am not certain upvoted 2 times ... ocbn3wby 3 years, 8 months ago Thank you for the explanation. upvoted 1 times ...

In addition you cannot log key usage in B, for A I am not certain upvoted 2 times

Thank you for the explanation. upvoted 1 times

Selected Answer: D SSE-KMS provides a secure and efficient way to encrypt data at rest in S3. SSE-KMS uses KMS to manage the encryption keys securely. With SSE-KMS, encryption keys can be automatically rotated using KMS key rotation feature, which simplifies the key management process and ensures compliance with the requirement to rotate keys every year. Additionally, SSE-KMS provides built-in audit logging for encryption key usage through CloudTrail, which captures API calls related to the management and usage of KMS keys. This meets the requirement for logging key usage for auditing purposes. Option A (SSE-C) requires customers to provide their own encryption keys, but it does not provide key rotation or built-in logging of key usage. Option B (SSE-S3) uses Amazon S3 managed keys for encryption, which simplifies key management but does not provide key rotation or detailed key usage logging. Option C (SSE-KMS with manual rotation) uses AWS KMS keys but requires manual rotation, which is less operationally efficient than the automatic key rotation available with option D. upvoted 10 times

Selected Answer: D Automating the key rotation is the most important here and hence D is the most suitable option here. upvoted 1 times

Question 11 (Topic 1)

A company has an automobile sales website that stores its listings in a database on Amazon RDS. When an automobile is sold, the listing needs to be removed from the website and the data must be sent to multiple target systems. Which design should a solutions architect recommend?

Select an option, then click Submit answer.

○ Create an AWS Lambda function triggered when the database on Amazon RDS is updated to send the information to an Amazon Simple Queue Service (Amazon SQS) queue for the targets to consume.
○ Create an AWS Lambda function triggered when the database on Amazon RDS is updated to send the information to an Amazon Simple Queue Service (Amazon SQS) FIFO queue for the targets to consume.
○ Subscribe to an RDS event notification and send an Amazon Simple Queue Service (Amazon SQS) queue fanned out to multiple Amazon Simple Notification Service (Amazon SNS) topics. Use AWS Lambda functions to update the targets.
○ Subscribe to an RDS event notification and send an Amazon Simple Notification Service (Amazon SNS) topic fanned out to multiple Amazon Simple Queue Service (Amazon SQS) queues. Use AWS Lambda functions to update the targets.

Reference / correct answer:

Subscribe to an RDS event notification and send an Amazon Simple Notification Service (Amazon SNS) topic fanned out to multiple Amazon Simple Queue Service (Amazon SQS) queues. Use AWS Lambda functions to update the targets.

Most accepted answer: D. Subscribe to an RDS event notification and send an Amazon Simple Notification Service (Amazon SNS) topic fanned out to multiple Amazon Simple Queue Service (Amazon SQS) queues. Use AWS Lambda functions to update the targets.

Community votes: A=3, D=14

Selected Answer: A Interesting point that Amazon RDS event notification doesn't support any notification when data inside DB is updated. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.overview.html So subscription to RDS events doesn't give any value for Fanout = SNS => SQS B is out because FIFO is not required here. A is left as correct answer upvoted 91 times Jiang_aws1 3 years, 7 months ago D is connect RDS event notification by RDS stream or advance audit DML so it is possible upvoted 2 times Jiang_aws1 3 years, 7 months ago The key is "Fanned out" due to "Multiple target systems" need to update upvoted 4 times ... JayBee65 3 years, 7 months ago Please provide reference for this claim: " event notification by RDS stream or advance audit DML" upvoted 4 times ... ... ruqui 3 years, 2 months ago I don't think A is a valid solution ... how do you send the data to multiple targets using a single SQS? upvoted 22 times ... Vic_d_gr8 3 years, 8 months ago Amazon RDS uses the SNS to provide notification when an Amazon event occurs https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html upvoted 4 times ... studynoplay 3 years, 2 months ago Wow, great find romko. Didn't realize that Event notification doesn't notify when the data is changed, it notifies when major changes at DB level occur like settings etc upvoted 2 times ... Load full discussion...

D is connect RDS event notification by RDS stream or advance audit DML so it is possible upvoted 2 times Jiang_aws1 3 years, 7 months ago The key is "Fanned out" due to "Multiple target systems" need to update upvoted 4 times ... JayBee65 3 years, 7 months ago Please provide reference for this claim: " event notification by RDS stream or advance audit DML" upvoted 4 times ...

The key is "Fanned out" due to "Multiple target systems" need to update upvoted 4 times

Please provide reference for this claim: " event notification by RDS stream or advance audit DML" upvoted 4 times

I don't think A is a valid solution ... how do you send the data to multiple targets using a single SQS? upvoted 22 times

Question 12 (Topic 1)

A solutions architect needs to implement a solution to reduce a company's storage costs. All the company's data is in the Amazon S3 Standard storage class. The company must keep all data for at least 25 years. Data from the most recent 2 years must be highly available and immediately retrievable. Which solution will meet these requirements?

Select an option, then click Submit answer.

○ Set up an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive immediately.
○ Set up an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 2 years.
○ Use S3 Intelligent-Tiering. Activate the archiving option to ensure that data is archived in S3 Glacier Deep Archive.
○ Set up an S3 Lifecycle policy to transition objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) immediately and to S3 Glacier Deep Archive after 2 years.

Reference / correct answer:

Set up an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 2 years.

Most accepted answer: B. Set up an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 2 years.

Community votes: B=12

Selected Answer: B Why Not C? Because Intelligent Tier the objects are automatically moved to different tiers. The question says "the data from most recent 2 yrs should be highly available and immediately retrievable", which means in intelligent tier , if you activate archiving option(as Option C specifies) , the objects will be moved to Archive tiers(instant to access to deep archive access tiers) in 90 to 730 days. Remember these archive tiers performance will be similar to S3 glacier flexible and s3 deep archive which means files cannot be retrieved immediately within 2 yrs . We have a hard requirement in question which says it should be retreivable immediately for the 2 yrs. which cannot be acheived in Intelligent tier. So B is the correct option imho. Because of the above reason Its possible only in S3 standard and then configure lifecycle configuration to move to S3 Glacier Deep Archive after 2 yrs. upvoted 18 times Abdou1604 2 years, 11 months ago but your S3 intelligent-tiering will move the object to S3 infrequent access tier which a is a single AZ tier , and then the HA requirement will not be respected upvoted 2 times sandordini 2 years, 3 months ago S3 Standard IA is NOT single AZ. (One-Zone IA is single Az.) upvoted 2 times sandordini 2 years, 3 months ago The issue is with the missing "flag" for 2 years, and not S3 Intelligent Tiering. It needs to be B. upvoted 2 times ... ... ... MutiverseAgent 3 years ago Mmm.. You can enable Intelligent-Tiering and take advantage of of the infrequent Access tier and thus reducing costs. To avoid moving objects to the deep archive tier before the two years it would be enough to enable ONLY the check "Deep Archive Access tier" and set days to 720 (two years, which is curiously the maximum value), and keep disabled the check "Archive Access tier" to avoid the Intelligent-Tiering move objects to the non-instant retrieval tier. That will work, offcourse this specific configuration is not mention in the question which leaves some doubts about which option is the correct. upvoted 2 times MutiverseAgent 3 years ago Just to clarify, my previous comment is about how answer B) might be correct and the MOST cheapest option under the correct configuration. upvoted 2 times MutiverseAgent 3 years ago Sorry, I meant answer C) might be correct upvoted 1 times ... ... ...

but your S3 intelligent-tiering will move the object to S3 infrequent access tier which a is a single AZ tier , and then the HA requirement will not be respected upvoted 2 times sandordini 2 years, 3 months ago S3 Standard IA is NOT single AZ. (One-Zone IA is single Az.) upvoted 2 times sandordini 2 years, 3 months ago The issue is with the missing "flag" for 2 years, and not S3 Intelligent Tiering. It needs to be B. upvoted 2 times ... ...

S3 Standard IA is NOT single AZ. (One-Zone IA is single Az.) upvoted 2 times sandordini 2 years, 3 months ago The issue is with the missing "flag" for 2 years, and not S3 Intelligent Tiering. It needs to be B. upvoted 2 times ...

The issue is with the missing "flag" for 2 years, and not S3 Intelligent Tiering. It needs to be B. upvoted 2 times

Mmm.. You can enable Intelligent-Tiering and take advantage of of the infrequent Access tier and thus reducing costs. To avoid moving objects to the deep archive tier before the two years it would be enough to enable ONLY the check "Deep Archive Access tier" and set days to 720 (two years, which is curiously the maximum value), and keep disabled the check "Archive Access tier" to avoid the Intelligent-Tiering move objects to the non-instant retrieval tier. That will work, offcourse this specific configuration is not mention in the question which leaves some doubts about which option is the correct. upvoted 2 times MutiverseAgent 3 years ago Just to clarify, my previous comment is about how answer B) might be correct and the MOST cheapest option under the correct configuration. upvoted 2 times MutiverseAgent 3 years ago Sorry, I meant answer C) might be correct upvoted 1 times ... ...

Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 – Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 Practice Test Question