SAA-C03 Practice Test 39 — 15 Questions

Question 1

A team wants a web application to keep serving traffic if one Availability Zone fails. Match each architecture element to the resilience behavior it provides.

Question 2

A team wants a web application to keep serving traffic if one Availability Zone fails. Match each architecture element to the resilience behavior it provides.

Question 3

Match the disaster recovery strategy to the recovery posture it best fits for a Regional outage.

Question 4

Match each data-retention scenario to the most cost-effective Amazon S3 storage class. Assume the retrieval pattern and access-latency requirement are the most important constraints.

Question 5

Match each operational condition to the load balancing or Auto Scaling behavior that should occur.

Question 6

Match each workload to the most cost-effective compute model or service choice. Focus on how often the workload runs, whether it is interruption-tolerant, and how much administration the team wants to avoid.

Question 7

Match the disaster recovery strategy to the recovery posture it best fits for a Regional outage.

Question 8

Match each private-networking or content-delivery scenario to the AWS feature that most directly reduces cost while meeting the connectivity requirement.

Question 9

A media platform serves global users through Amazon CloudFront and an S3 origin. Match each requirement on the left to the CloudFront configuration or behavior on the right.

Question 10

Match each database availability event to the AWS failover behavior that best describes it.

Question 11

A company runs a stateless application tier behind an Application Load Balancer. Match each observed scaling pattern on the left to the best Auto Scaling strategy or metric on the right.

Question 12

A company is designing a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), an Amazon EC2 Auto Scaling group for the web tier, and an Amazon RDS for MySQL database. The security team requires that the web tier instances have no public IP addresses and that all outbound traffic to the internet is blocked, except for specific software updates from a trusted vendor. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Place the web tier instances in a private subnet and use a NAT gateway in a public subnet for outbound traffic to the trusted vendor.. Placing the web tier instances in a private subnet ensures they have no public IP addresses, meeting the security requirement. Using a security group on the web tier instances to deny all outbound traffic except to the trusted vendor's IP range provides a stateful, instance-level control that blocks all other outbound internet traffic. Additionally, a network ACL on the private subnet must allow outbound traffic to the trusted vendor's IP range and to the NAT gateway, because the NAT gateway itself needs to send traffic to the vendor, and the network ACL acts as a stateless subnet-level filter that must explicitly permit this return traffic.

Answer

Configure a VPC endpoint for the trusted vendor's software update service.

Answer

Deploy the web tier instances in a public subnet and use a network ACL to block all inbound traffic from the internet.

Answer

Configure the ALB to be internet-facing and place the web tier instances in a public subnet.

Question 13

A financial services company is migrating sensitive customer data to Amazon S3. The data must be encrypted at rest using a customer-managed key stored in AWS KMS, with automatic rotation every 90 days. The company also needs to prevent any access to the data from outside the corporate network, except for approved AWS services. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Enable default encryption on the S3 bucket with SSE-KMS using the customer-managed key.. Enable default encryption on the S3 bucket with SSE-KMS using the customer-managed key ensures data is encrypted at rest with a key the customer controls and can rotate automatically every 90 days. Configure an S3 bucket policy that denies access unless the request is made from the corporate IP range restricts access to the corporate network. Attach an S3 VPC endpoint policy that only allows access from the corporate VPC ensures that traffic to S3 stays within the AWS network and is subject to VPC controls, preventing exposure to the public internet.

Answer

Use an S3 bucket policy to require that all requests use HTTPS.

Answer

Enable S3 Block Public Access at the account level.

Answer

Use an S3 bucket policy that grants access only to the root user of the account.

Question 14

A company is hosting a web application on Amazon ECS Fargate behind an Application Load Balancer. The application needs to authenticate users using Amazon Cognito and store session data in Amazon ElastiCache for Redis. The security team mandates that all traffic between the ALB and ECS tasks must not traverse the public internet, and that session data in ElastiCache is encrypted at rest. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Deploy the ECS tasks in private subnets and configure the ALB as an internal load balancer.. Deploying ECS tasks in private subnets with an internal ALB ensures traffic between the ALB and tasks does not traverse the public internet, as internal load balancers have only private IP addresses. Enabling encryption at rest on ElastiCache for Redis with a customer-managed KMS key meets the security mandate for encrypted session data. Using a security group on ECS tasks that allows inbound traffic only from the ALB's security group provides a precise, stateful firewall rule that enforces the traffic flow restriction.

Answer

Configure the ALB to be internal-facing and place the ECS tasks in public subnets.

Answer

Place the ECS tasks in a public subnet and use network ACLs to block inbound traffic from the internet.

Answer

Configure the ElastiCache cluster to use in-transit encryption only.

Question 15

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must meet strict security and compliance requirements. The company needs to ensure that all data stored in DynamoDB is encrypted at rest using a customer-managed key, that the Lambda function can only access the specific DynamoDB table it needs, and that API requests are authenticated and authorized. Which of the following actions should the company take? (Choose four.)

Accepted Answer

Create an AWS KMS customer managed key and configure DynamoDB to use it for encryption at rest.. Creating an AWS KMS customer managed key and configuring DynamoDB to use it for encryption at rest ensures that the data is encrypted using a key that the company controls, meeting strict compliance requirements. Attaching an IAM role to the Lambda function with a policy that grants only the necessary DynamoDB actions on the specific table ARN follows the principle of least privilege. Configuring API Gateway to use an IAM authorizer ensures that only authenticated AWS users or roles can invoke the API, providing authentication and authorization. Using AWS KMS grants in the Lambda function's IAM policy allows the function to use the customer managed key for encryption operations, which is necessary for encrypting and decrypting data in DynamoDB when using client-side encryption or when the key is used for other cryptographic operations.

Answer

Store the customer managed key directly in the Lambda function's environment variables for easy access.

Answer

Enable DynamoDB Streams and configure the Lambda function to process stream records without any additional security configuration.