View Full Amazon AWS Certified Solutions Architect – Associate SAA-C03 Exam Dumps and Practice Test Dumps

 

Question 361

Which AWS service can provide a dedicated private network connection between an on-premises data center and AWS?

1. Amazon CloudFront
2. AWS Direct Connect
3. Amazon SQS
4. AWS WAF

Correct Answer: 2

Explanation

AWS Direct Connect provides a dedicated network connection between an on-premises environment and AWS. It can offer more consistent network performance and avoid sending traffic across the public internet for supported connectivity patterns. Direct Connect is commonly used for hybrid architectures, large data transfers, and applications requiring predictable private connectivity. CloudFront provides content delivery, SQS provides message queuing, and WAF protects web applications. Direct Connect is therefore the appropriate choice when an organization requires dedicated private connectivity between its data center and AWS.

Question 362

A company wants to protect an S3 bucket so that objects cannot be permanently deleted or overwritten before a defined retention period expires. Which feature should be enabled?

1. S3 Transfer Acceleration
2. S3 Lifecycle
3. S3 Object Lock
4. S3 Intelligent-Tiering

Correct Answer: 3

Explanation

S3 Object Lock allows organizations to prevent objects from being deleted or overwritten for a specified retention period. It is useful for compliance requirements, financial records, backups, and other data that must remain immutable. Object Lock supports governance and compliance retention modes depending on the required protection level. Transfer Acceleration improves transfer performance, Lifecycle automates object transitions or expiration, and Intelligent-Tiering optimizes storage costs based on access patterns. S3 Object Lock is therefore the appropriate feature when objects must remain protected from modification or deletion.

Question 363

Which AWS service allows applications to store and retrieve secrets without embedding sensitive credentials directly in source code?

1. AWS Secrets Manager
2. Amazon CloudWatch
3. Amazon GuardDuty
4. Amazon Route 53

Correct Answer: 1

Explanation

AWS Secrets Manager securely stores sensitive information such as database passwords, API credentials, and application secrets. Applications can retrieve secrets programmatically at runtime rather than storing credentials directly in source code or configuration files. Secrets Manager also supports automatic rotation for supported secrets, helping reduce the risk associated with long-lived credentials. CloudWatch provides monitoring, GuardDuty detects threats, and Route 53 provides DNS services. Secrets Manager is therefore the appropriate AWS service for securely managing application credentials and other sensitive secrets.

Question 364

A company runs a stateless web application and wants to automatically increase the number of servers when traffic increases. Which combination is most appropriate?

1. Amazon S3 and Glacier
2. Amazon RDS and EBS
3. Amazon Route 53 and CloudTrail
4. Elastic Load Balancing and EC2 Auto Scaling

Correct Answer: 4

Explanation

Elastic Load Balancing and EC2 Auto Scaling provide a strong architecture for scalable stateless web applications. The load balancer distributes requests among healthy instances, while Auto Scaling automatically adds or removes instances according to configured policies and demand. Because the application is stateless, requests can be handled by any healthy instance without depending on local session state. S3 and Glacier provide storage, RDS and EBS provide data services, and Route 53 and CloudTrail address DNS and auditing. ELB with Auto Scaling is therefore the appropriate solution.

Question 365

Which AWS service is designed to provide centralized identity management for users across multiple AWS accounts?

1. Amazon Cognito
2. AWS IAM Identity Center
3. Amazon GuardDuty
4. AWS Config

Correct Answer: 2

Explanation

AWS IAM Identity Center provides centralized access management for users who need access to multiple AWS accounts and applications. Administrators can create or connect identities, assign users to groups, and provide appropriate permissions across accounts. This simplifies workforce access management compared with creating separate IAM users in every AWS account. Amazon Cognito is primarily designed for application end-user authentication, GuardDuty provides threat detection, and Config evaluates resource configurations. IAM Identity Center is therefore the appropriate solution for centralized workforce access across multiple AWS accounts.

Question 366

A company wants to route users to the AWS Region that provides the lowest network latency from their locations. Which Route 53 routing policy should be used?

1. Weighted routing
2. Geolocation routing
3. Latency-based routing
4. Failover routing

Correct Answer: 3

Explanation

Route 53 latency-based routing directs DNS queries toward the AWS Region that provides the lowest measured network latency for the user. This is useful for globally distributed applications that operate in multiple Regions and need to improve user response times. Weighted routing distributes traffic according to assigned percentages, geolocation routing uses geographic location rules, and failover routing directs traffic between primary and secondary resources based on health checks. Latency-based routing is therefore the appropriate choice when minimizing network latency is the primary objective.

Question 367

A company wants to use an AWS-managed service to identify software vulnerabilities and unintended network exposure in EC2 workloads. Which service should be considered?

1. Amazon Inspector
2. Amazon Macie
3. Amazon SNS
4. AWS CloudFormation

Correct Answer: 1

Explanation

Amazon Inspector is a vulnerability management service that can assess supported AWS workloads for software vulnerabilities and unintended network exposure. It can help organizations identify security weaknesses in EC2 instances and other supported resources and prioritize findings for remediation. Macie focuses on discovering sensitive data in S3, SNS provides notifications, and CloudFormation manages infrastructure as code. Inspector is therefore the appropriate service when the goal is to identify vulnerabilities and security exposures in supported compute workloads.

Question 368

A company needs to distribute requests globally to applications running in multiple AWS Regions while using static anycast IP addresses. Which service should be used?

1. Amazon Route 53 Resolver
2. Amazon CloudFront
3. AWS Global Accelerator
4. Amazon SQS

Correct Answer: 3

Explanation

AWS Global Accelerator provides static anycast IP addresses that route users through the AWS global network to healthy application endpoints in supported Regions. It can improve availability and performance for applications with globally distributed endpoints and can automatically route traffic away from unhealthy endpoints. CloudFront is primarily a content delivery network, Route 53 Resolver provides DNS resolution capabilities, and SQS provides message queuing. Global Accelerator is therefore the appropriate service when an application requires global traffic acceleration with static IP addresses.

Question 369

A company wants to allow an application to authenticate its end users using managed sign-up and sign-in functionality without building an identity system from scratch. Which service is most appropriate?

1. Amazon Cognito User Pools
2. AWS Organizations
3. Amazon Redshift
4. AWS Direct Connect

Correct Answer: 1

Explanation

Amazon Cognito User Pools provide managed user directories and authentication capabilities for application users. They can support user registration, sign-in, password management, and other authentication features without requiring the organization to build an entire identity system. Cognito can also integrate with identity providers and application authentication workflows. AWS Organizations manages multiple accounts, Redshift provides data warehousing, and Direct Connect provides private network connectivity. Cognito User Pools are therefore appropriate when an application needs managed authentication and user management.

Question 370

A company wants to make a web application available globally while reducing latency for users requesting static images, JavaScript, and CSS files. Which solution should be used?

1. Amazon RDS Multi-AZ
2. Amazon CloudFront
3. Amazon SQS
4. AWS Secrets Manager

Correct Answer: 2

Explanation

Amazon CloudFront is a content delivery network that caches and serves content from edge locations distributed around the world. Static files such as images, JavaScript, CSS, and other frequently accessed objects can be delivered from locations closer to users, reducing latency and improving application performance. RDS Multi-AZ improves database availability, SQS provides asynchronous messaging, and Secrets Manager protects sensitive credentials. CloudFront is therefore the appropriate solution for globally distributing static web content with lower user latency.

Question 371

A company wants to ensure that an application can process messages even when the consumer temporarily becomes unavailable. Which architecture is most appropriate?

1. SQS queue between the producer and consumer
2. Direct communication only between applications
3. Route 53 without a queue
4. CloudTrail event recording

Correct Answer: 1

Explanation

An Amazon SQS queue can decouple message producers from consumers and retain messages until consumers are available to process them. If a consumer temporarily becomes unavailable, messages can remain in the queue rather than being immediately lost. This improves resilience and allows components to operate independently at different speeds. Direct synchronous communication creates tighter coupling and may fail when the consumer is unavailable. Route 53 provides DNS functionality, while CloudTrail records API activity. An SQS queue is therefore the appropriate architecture for resilient asynchronous processing.

Question 372

Which storage option provides temporary block storage that is physically attached to the host computer running an EC2 instance?

1. Amazon EFS
2. Amazon S3
3. Amazon EBS
4. EC2 Instance Store

Correct Answer: 4

Explanation

EC2 Instance Store provides temporary block-level storage that is physically attached to the host computer on which an EC2 instance runs. It can offer very high I/O performance, but the data is ephemeral and can be lost when the instance is stopped, terminated, or the underlying host fails, depending on the event. EBS provides persistent block storage, EFS provides shared file storage, and S3 provides object storage. Instance Store is therefore appropriate for temporary data such as caches, buffers, or scratch files that can be recreated.

Question 373

A company wants to automatically move S3 objects that have not been accessed for a defined period into a lower-cost storage tier. Which feature should be used?

1. S3 Lifecycle rules
2. S3 Access Points
3. S3 Object Lock
4. S3 Versioning

Correct Answer: 1

Explanation

S3 Lifecycle rules allow organizations to automatically transition objects between storage classes or expire objects based on configured conditions. This helps reduce storage costs when data becomes less frequently accessed over time. For example, objects can transition from S3 Standard to an infrequent-access or archival class according to their age. Access Points provide specialized access control, Object Lock protects objects from deletion or modification, and Versioning maintains multiple object versions. S3 Lifecycle rules are therefore the appropriate feature for automating storage-class transitions.

Question 374

A company needs a highly durable storage service for backups that may be accessed occasionally but should remain readily available when needed. Which option is appropriate?

1. S3 Standard
2. S3 Standard-IA
3. EC2 Instance Store
4. Instance Store with RAID

Correct Answer: 2

Explanation

S3 Standard-IA is designed for data that is accessed less frequently but still requires rapid access when needed. It provides high durability while offering lower storage costs than the S3 Standard class, making it suitable for backups, long-term data sets, and other infrequently accessed information. EC2 Instance Store is temporary storage and is not appropriate for durable backups. S3 Standard is designed for frequent access, while local Instance Store configurations do not provide the required durability. Standard-IA is therefore appropriate for readily available infrequently accessed backups.

Question 375

A company wants to automatically replace an EC2 instance when it becomes unhealthy. Which service combination should be configured?

1. Amazon S3 and CloudFront
2. AWS CloudTrail and IAM
3. EC2 Auto Scaling with health checks
4. Amazon Route 53 and SQS

Correct Answer: 3

Explanation

EC2 Auto Scaling can monitor the health of instances in an Auto Scaling group and replace instances that are determined to be unhealthy. This helps maintain the desired capacity of an application and improves resilience against individual instance failures. Health checks can be based on EC2 status or, when configured with a load balancer, additional application-level health information. S3 and CloudFront address content delivery, CloudTrail and IAM address auditing and access management, and Route 53 and SQS serve different purposes. Auto Scaling with health checks is therefore appropriate.

Question 376

A company needs to perform analytical queries against a large data warehouse while separating analytical workloads from its transactional database. Which service should be used?

1. Amazon Redshift
2. Amazon EFS
3. Amazon SQS
4. Amazon Route 53

Correct Answer: 1

Explanation

Amazon Redshift is a managed data warehouse designed for analytical workloads over large datasets. Separating analytics from a transactional database prevents complex analytical queries from consuming resources needed by operational applications. Redshift supports SQL and is optimized for reporting, business intelligence, and large-scale data analysis. EFS provides file storage, SQS provides message queuing, and Route 53 provides DNS services. Redshift is therefore an appropriate choice when analytical processing needs to be separated from an application’s transactional database workload.

Question 377

A company wants to reduce the number of requests reaching its origin server by caching dynamic application responses at the edge. Which AWS service can provide this capability?

1. Amazon CloudFront
2. Amazon EBS
3. AWS CloudTrail
4. Amazon DynamoDB

Correct Answer: 1

Explanation

Amazon CloudFront can cache eligible application responses at edge locations, reducing repeated requests to the origin and improving response times for users. Cache behavior can be configured according to URL paths, headers, query strings, and other request characteristics. This can reduce origin load and improve scalability for applications with cacheable content. EBS provides block storage, CloudTrail records API activity, and DynamoDB provides NoSQL database capabilities. CloudFront is therefore the appropriate service when edge caching is required to reduce origin requests.

Question 378

A company wants to use a database architecture that can continue operating in another AWS Region if the primary Region becomes unavailable, while maintaining low-latency replicated data access. Which option is most appropriate for supported Aurora workloads?

1. Aurora Global Database
2. RDS Single-AZ deployment
3. Amazon EBS snapshots only
4. Amazon ElastiCache

Correct Answer: 1

Explanation

Amazon Aurora Global Database is designed for globally distributed applications and disaster recovery across AWS Regions. It replicates data from a primary Aurora cluster to secondary Regions with low replication latency, allowing applications to serve read traffic from secondary Regions and support faster regional recovery. A single-AZ RDS deployment does not provide regional resilience, EBS snapshots require restoration processes, and ElastiCache is an in-memory caching service. Aurora Global Database is therefore an appropriate choice for supported workloads requiring cross-Region database resilience and low-latency replicated access.

Question 379

Which AWS service allows an organization to create isolated virtual networks with configurable subnets, routing, and network security controls?

1. Amazon VPC
2. Amazon S3
3. Amazon DynamoDB
4. Amazon SNS

Correct Answer: 1

Explanation

Amazon Virtual Private Cloud (VPC) allows organizations to create logically isolated virtual networks within AWS. A VPC can contain public and private subnets, route tables, security groups, network ACLs, and connectivity components such as Internet Gateways and NAT Gateways. This provides control over how resources communicate with one another and with external networks. S3 provides object storage, DynamoDB provides NoSQL database services, and SNS provides messaging. Amazon VPC is therefore the appropriate service for creating and controlling an isolated AWS network environment.

Question 380

A company wants to monitor API activity across all AWS accounts in an organization using a centrally managed CloudTrail configuration. Which approach should be used?

1. Create an organization trail
2. Enable CloudFront logging only
3. Configure an S3 lifecycle rule
4. Create an SQS queue

Correct Answer: 1

Explanation

An AWS CloudTrail organization trail allows an organization to create a centrally managed trail that records activity across accounts in AWS Organizations. This simplifies auditing and provides centralized visibility into API activity throughout the organization. Logs can be delivered to a designated S3 bucket for retention and analysis. CloudFront logging focuses on content delivery requests, S3 Lifecycle manages object transitions, and SQS provides message queuing. An organization trail is therefore the appropriate approach for centralized CloudTrail auditing across multiple AWS accounts.