View Full Amazon AWS Certified Solutions Architect – Associate SAA-C03 Exam Dumps and Practice Test Dumps

 

Question 381

A company needs to store application configuration values that are not highly sensitive and wants a managed service that can provide centralized parameter storage. Which AWS service is most appropriate?

1. Amazon SQS
2. AWS Systems Manager Parameter Store
3. Amazon CloudFront
4. AWS CloudTrail

Correct Answer: 2

Explanation

AWS Systems Manager Parameter Store provides secure, centralized storage for configuration values, parameters, and application settings. Applications can retrieve parameters at runtime instead of hardcoding configuration values into source code. Parameter Store supports different parameter types and integrates with IAM for access control. For highly sensitive secrets requiring advanced secret-management capabilities and automated rotation, AWS Secrets Manager may be more appropriate. SQS provides messaging, CloudFront provides content delivery, and CloudTrail provides auditing. Parameter Store is therefore suitable for centralized application configuration management.

Question 382

A company needs to protect its web application from distributed denial-of-service attacks. Which AWS service provides dedicated DDoS protection capabilities?

1. AWS Shield
2. Amazon Macie
3. Amazon Inspector
4. AWS Config

Correct Answer: 1

Explanation

AWS Shield provides managed protection against distributed denial-of-service attacks targeting AWS applications and resources. AWS Shield Standard is automatically available and provides baseline protection against common network and transport layer DDoS attacks. AWS Shield Advanced provides additional capabilities for organizations requiring more comprehensive protection and visibility. Macie focuses on sensitive data discovery, Inspector identifies vulnerabilities, and Config evaluates resource configurations. AWS Shield is therefore the appropriate service when DDoS protection is the primary security requirement.

Question 383

A company wants to give an external application temporary access to a private S3 object without making the object publicly accessible. Which solution should be used?

1. Public bucket policy
2. S3 presigned URL
3. S3 static website hosting
4. S3 lifecycle rule

Correct Answer: 2

Explanation

An S3 presigned URL provides temporary access to a specific S3 object without requiring the object itself to become publicly accessible. The URL is generated using credentials with appropriate permissions and can include an expiration time. This is useful when applications need to provide temporary downloads or uploads to users or external systems. A public bucket policy would expose data more broadly, static website hosting serves website content, and lifecycle rules automate object management. A presigned URL is therefore the appropriate solution for temporary private object access.

Question 384

Which AWS service provides managed Kubernetes control planes and integrates with standard Kubernetes tooling?

1. Amazon ECS
2. AWS Fargate
3. Amazon EKS
4. AWS Lambda

Correct Answer: 3

Explanation

Amazon Elastic Kubernetes Service (EKS) is a managed Kubernetes service that provides AWS-managed Kubernetes control plane infrastructure. Organizations can use standard Kubernetes APIs, tools, and configurations while integrating Kubernetes workloads with AWS services. ECS is AWS’s native container orchestration service, while Fargate provides serverless compute for containers and can be used with ECS or EKS. Lambda provides serverless function execution rather than Kubernetes management. EKS is therefore the appropriate service when an organization requires managed Kubernetes capabilities.

Question 385

A company needs to automatically discover changes made to AWS resource configurations and maintain a history of those configurations. Which service should be used?

1. AWS Config
2. Amazon CloudFront
3. Amazon SNS
4. Amazon EFS

Correct Answer: 1

Explanation

AWS Config records the configuration state of supported AWS resources and tracks configuration changes over time. This historical information can help organizations determine how resources changed, investigate configuration issues, and evaluate compliance against defined rules. Config is particularly useful for governance and auditing resource configurations. CloudFront provides content delivery, SNS provides messaging, and EFS provides shared file storage. AWS Config is therefore the appropriate service when an organization needs configuration history and visibility into resource changes.

Question 386

A company wants to provide applications with temporary credentials to access AWS resources after users authenticate through a managed application identity service. Which Amazon Cognito feature is appropriate?

1. Cognito Identity Pools
2. Cognito User Pools only
3. Amazon Route 53
4. AWS Organizations

Correct Answer: 1

Explanation

Amazon Cognito Identity Pools can provide temporary AWS credentials to authenticated or appropriately configured users and applications. These credentials allow applications to access selected AWS resources without requiring users to possess permanent AWS access keys. Cognito User Pools primarily provide user authentication and user-directory capabilities, while Identity Pools are designed to federate identities and grant temporary AWS credentials. Route 53 provides DNS services and Organizations manages multiple AWS accounts. Cognito Identity Pools are therefore appropriate for temporary AWS access.

Question 387

A company wants to connect several VPCs using a centralized networking architecture and also connect those VPCs to an on-premises network. Which service is most appropriate?

1. Amazon CloudFront
2. AWS Transit Gateway
3. Amazon S3
4. Amazon SNS

Correct Answer: 2

Explanation

AWS Transit Gateway provides a centralized network hub that can connect multiple VPCs and on-premises networks through supported attachments. This hub-and-spoke architecture simplifies routing and avoids the complexity of maintaining numerous individual VPC peering connections. It is particularly useful as an organization’s network grows across accounts and Regions. CloudFront provides content delivery, S3 provides object storage, and SNS provides messaging. Transit Gateway is therefore the appropriate solution for centralized connectivity among multiple VPCs and hybrid network environments.

Question 388

A company wants to protect private application servers from inbound internet traffic while allowing them to initiate outbound internet connections for updates. Which architecture is appropriate?

1. Public subnet with direct inbound access
2. Private subnet with NAT Gateway for outbound traffic
3. Private subnet with no route to any destination
4. Public subnet without security controls

Correct Answer: 2

Explanation

Placing application servers in private subnets prevents direct inbound internet access while allowing controlled outbound connectivity through a NAT Gateway. The private subnet route table can direct internet-bound traffic to the NAT Gateway, which resides in a public subnet and uses an Internet Gateway for external connectivity. Security groups and network ACLs can provide additional traffic controls. A private subnet without outbound connectivity would prevent legitimate updates, while public placement increases exposure. Therefore, a private subnet with NAT-based outbound access is appropriate.

Question 389

A company wants to automatically send an alert when a monitored AWS metric crosses a predefined threshold. Which CloudWatch feature should be configured?

1. CloudWatch Alarm
2. CloudTrail Trail
3. Config Rule
4. VPC Flow Log

Correct Answer: 1

Explanation

Amazon CloudWatch alarms monitor metrics and can trigger actions when those metrics meet configured conditions. For example, an alarm can detect sustained high CPU utilization and notify administrators or initiate an automated response. CloudTrail trails record API activity, Config rules evaluate resource configurations, and VPC Flow Logs capture network traffic metadata. CloudWatch alarms are therefore the appropriate feature when an organization needs automated notifications or actions based on metric thresholds.

Question 390

A company needs a storage service that can provide a shared file system for applications running on multiple Linux servers simultaneously. Which service should be used?

1. Amazon EBS
2. Amazon EFS
3. Amazon S3 Glacier
4. EC2 Instance Store

Correct Answer: 2

Explanation

Amazon Elastic File System (EFS) provides a managed shared file system that multiple Linux-based compute resources can access concurrently. It is useful for workloads where several EC2 instances need access to the same directory structure and files. EFS automatically manages storage capacity as data changes, reducing administrative overhead. EBS generally provides block storage for individual instances, Glacier is an archival object-storage class, and Instance Store provides temporary local storage. EFS is therefore the appropriate solution for shared Linux file storage.

Question 391

A company wants to reduce the cost of storing old S3 data while keeping it available for retrieval when needed. Which approach is most appropriate?

1. Store all data permanently in S3 Standard
2. Configure S3 Lifecycle transitions
3. Store the data on EC2 Instance Store
4. Disable S3 versioning only

Correct Answer: 2

Explanation

S3 Lifecycle transitions allow organizations to automatically move objects into lower-cost storage classes as they age. This is useful for data that becomes less frequently accessed over time. For example, older objects can move from S3 Standard to an infrequent-access or archival storage class based on defined lifecycle rules. EC2 Instance Store is temporary and unsuitable for long-term data retention, while disabling versioning does not automatically optimize storage-class costs. Lifecycle transitions therefore provide an efficient way to reduce long-term S3 storage expenses.

Question 392

A company needs to execute a function automatically whenever an event is published to a custom event bus. Which solution should be used?

1. Amazon EBS
2. Amazon EventBridge with AWS Lambda
3. Amazon EFS
4. AWS Direct Connect

Correct Answer: 2

Explanation

Amazon EventBridge can receive events through event buses and use rules to match event patterns. A matching event can then invoke an AWS Lambda function for serverless processing. This creates a loosely coupled event-driven architecture in which producers do not need direct knowledge of the processing component. EBS and EFS provide storage services, while Direct Connect provides private network connectivity. EventBridge combined with Lambda is therefore the appropriate solution when application logic needs to execute automatically in response to events.

Question 393

A company needs to prevent a single application component from becoming a bottleneck when demand increases. Which architectural approach should be used?

1. Horizontal scaling
2. Single large server only
3. Manual configuration of one instance
4. Disabling load balancing

Correct Answer: 1

Explanation

Horizontal scaling increases capacity by adding additional instances or application resources rather than relying on a single increasingly powerful server. It can improve availability, fault tolerance, and scalability when combined with load balancing and automated capacity management. A single large server represents vertical scaling and can remain a single point of failure. Manual configuration does not provide automatic elasticity, and disabling load balancing can concentrate traffic on fewer resources. Horizontal scaling is therefore a strong architectural approach for handling increasing application demand.

Question 394

A company wants to route traffic to different application versions during a controlled deployment using DNS percentages. Which Route 53 policy should be used?

1. Geolocation
2. Failover
3. Weighted
4. Simple

Correct Answer: 3

Explanation

Route 53 weighted routing allows DNS responses to distribute traffic among multiple resources according to configured weights. This can support controlled deployments where a small percentage of users are directed to a new application version while most users continue using the existing version. Traffic percentages can be adjusted as confidence in the new version increases. Geolocation routing uses user location, failover routing uses primary and secondary resources, and simple routing provides basic DNS responses. Weighted routing is therefore appropriate for percentage-based traffic distribution.

Question 395

A company needs to automatically retry failed steps in a multi-stage serverless workflow and handle failures without writing custom orchestration code. Which service should be used?

1. Amazon S3
2. AWS Step Functions
3. Amazon CloudFront
4. Amazon Route 53

Correct Answer: 2

Explanation

AWS Step Functions provides managed workflow orchestration for applications composed of multiple steps. State machines can define sequential and parallel tasks, conditional branches, retries, waits, and error-handling behavior. This reduces the need to implement complex workflow control logic inside individual Lambda functions or applications. S3 provides object storage, CloudFront provides content delivery, and Route 53 provides DNS services. Step Functions is therefore the appropriate service when a serverless workflow requires coordinated execution, retries, and structured error handling.

Question 396

A company wants to monitor whether AWS resources comply with organizational policies and automatically identify noncompliant configurations. Which service should be used?

1. AWS Config
2. Amazon SQS
3. Amazon CloudFront
4. Amazon ElastiCache

Correct Answer: 1

Explanation

AWS Config can evaluate AWS resource configurations against predefined or custom rules to determine whether resources comply with organizational policies. When a resource becomes noncompliant, Config can record the finding and, when integrated with supported automation, initiate remediation actions. This makes Config useful for governance, compliance, and security configuration monitoring. SQS provides message queuing, CloudFront provides content delivery, and ElastiCache provides in-memory caching. AWS Config is therefore the appropriate service for continuously assessing resource compliance.

Question 397

A company wants to run a web application on EC2 while ensuring that users do not connect directly to the application instances. Which architecture is most appropriate?

1. Users connect directly to public EC2 instances
2. Internet-facing Application Load Balancer forwards traffic to private EC2 instances
3. Users connect directly to private EC2 instances
4. EC2 instances are placed behind Amazon S3

Correct Answer: 2

Explanation

An internet-facing Application Load Balancer can accept user traffic and forward requests to EC2 instances located in private subnets. Security groups can be configured so that the instances accept application traffic only from the load balancer’s security group. This reduces direct exposure of the application servers and provides health checks and traffic distribution. Allowing users to connect directly to EC2 instances increases exposure and makes scaling more difficult. Therefore, an internet-facing ALB with private application instances provides a stronger and more scalable architecture.

Question 398

A company wants to reduce database load by storing frequently requested database results in memory and retrieving them without repeatedly querying the database. Which pattern should be used?

1. Cache-aside
2. Backup-and-restore
3. Multi-site active-active
4. DNS failover

Correct Answer: 1

Explanation

The cache-aside pattern allows an application to check a cache before querying the primary database. If the requested data exists in the cache, the application returns it directly. If it is not present, the application retrieves the data from the database and stores an appropriate copy in the cache for future requests. This can reduce database load and improve application response times. Backup-and-restore and active-active architectures address availability and disaster recovery, while DNS failover controls traffic routing. Cache-aside is therefore appropriate for reducing repeated database queries.

Question 399

A company needs to automatically send messages to different subscribers based on message attributes. Which Amazon SNS capability can support this requirement?

1. SNS message filtering
2. S3 Versioning
3. RDS Multi-AZ
4. EBS snapshots

Correct Answer: 1

Explanation

Amazon SNS message filtering allows subscribers to receive only messages that match defined filter policies. Publishers can include message attributes, and each subscription can define conditions determining which messages should be delivered. This is useful when different consumers need different subsets of events without requiring separate topics for every message type. S3 Versioning protects object versions, RDS Multi-AZ improves database availability, and EBS snapshots provide point-in-time backups. SNS message filtering is therefore the appropriate feature for selective subscriber message delivery.

Question 400

A company wants to design an AWS workload according to the principle of granting users and applications only the permissions they require. Which AWS security best practice does this represent?

1. Use the root account for daily operations
2. Grant administrator permissions to every user
3. Follow the principle of least privilege
4. Share one IAM user among all employees

Correct Answer: 3

Explanation

The principle of least privilege means granting users, applications, and services only the permissions necessary to perform their required tasks. This reduces the potential impact of compromised credentials, accidental actions, and unauthorized access. AWS IAM policies and roles can be carefully scoped to specific resources and actions to implement this principle. Using the root account for daily activities, granting broad administrator access, or sharing IAM credentials increases security risks. Least privilege is therefore a fundamental AWS security best practice for controlling access.