Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience

and Simulate Real Practice Exam

iOs – Android – Windows - Web

#AWS #SAAC03 #AWSSAA #SAA #AWSCertification #AWSTraining #LearnAWS

#CloudArchitect #SolutionsArchitect #Djamgatech

1|Page
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 2022 AWS Certified Solutions
Architect Associate Exam Prep
250+ Quizzes, Practice Exams, Cheat Sheets, Flashcards, FAQs,
Illustrations, AWS Security Best practices,
Passed SAA Testimonials, SAA,

Copyright @ Djamgatech 2022

What will you learn in this book? .............................................................................................19

What are the requirements or prerequisites for reading this book? .................................................19
Who is this book for? ..............................................................................................................19
Book Description:...................................................................................................................19

2|Page
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 What is taught in this book? .....................................................................................................19
Key tools, technologies, and concepts covered ...........................................................................20
Some New AWS services covered.............................................................................................20
Design Secure Architectures – Description ....................................................................................24
Design Secure Architectures - Cheat Sheets...................................................................................24
Design Secure Architectures - Flashcards ......................................................................................27
Design Secure Architectures – Illustrations ....................................................................................34
Design Secure Architectures – Quiz ..............................................................................................37
Design Secure Architectures - Question 1: ..........................................................................37
Design Secure Architectures - Answer 1:.............................................................................37
Design Secure Architectures - Question 2: ..........................................................................38
Design Secure Architectures - Answer 2:.............................................................................38
Design Secure Architectures - Question 3: ..........................................................................38
Design Secure Architectures - Answer 3:.............................................................................39
Design Secure Architectures - Question 4: ..........................................................................39
Design Secure Architectures - Answer 4:.............................................................................39
Design Secure Architectures - Question 5: ..........................................................................40
Design Secure Architectures - Answer 5:.............................................................................40
Design Secure Architectures - Question 6: ..........................................................................40
Design Secure Architectures - Answer 6:.............................................................................41
Design Secure Architectures - Question 7: ..........................................................................41
Design Secure Architectures - Answer 7:.............................................................................41
Design Secure Architectures - Question 8: ..........................................................................41
Design Secure Architectures - Answer 8:.............................................................................42
Design Secure Architectures - Question 9: ..........................................................................42
Design Secure Architectures - Answer 9:.............................................................................43
Design Secure Architectures - Question 10:.........................................................................43
Design Secure Architectures - Answer 10:...........................................................................43
Design Secure Architectures - Question 11:.........................................................................44
Design Secure Architectures - Answer 11:...........................................................................44
Design Secure Architectures - Question 12:.........................................................................44

3|Page
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Design Secure Architectures - Answer 12:...........................................................................45
Design Secure Architectures - Question 13:.........................................................................45
Design Secure Architectures - Answer 13:...........................................................................46
Design Secure Architectures - Question 14:.........................................................................46
Design Secure Architectures - Answer 14:...........................................................................46
Design Secure Architectures - Question 15:.........................................................................46
Design Secure Architectures - Answer 15:...........................................................................48
Design Secure Architectures - Question 16:.........................................................................48
Design Secure Architectures - Answer 16:...........................................................................48
Design Secure Architectures - Question 17:.........................................................................49
Design Secure Architectures - Answer 17:...........................................................................49
Design Secure Architectures - Question 18:.........................................................................50
Design Secure Architectures - Answer 18:...........................................................................50
Design Secure Architectures - Question 19:.........................................................................51
Design Secure Architectures - Answer 19:...........................................................................51
Design Secure Architectures - Question 20:.........................................................................52
Design Secure Architectures - Answer 20:...........................................................................52
Design Secure Architectures - Question 21:.........................................................................53
Design Secure Architectures - Answer 21:...........................................................................54
Design Secure Architectures - Question 22:.........................................................................54
Design Secure Architectures - Answer 22:...........................................................................54
Design Secure Architectures - Question 23:.........................................................................55
Design Secure Architectures - Answer 23:...........................................................................56
Design Secure Architectures - Question 24:.........................................................................56
Design Secure Architectures - Answer 24:...........................................................................57
Design Secure Architectures - Question 25:.........................................................................57
Design Secure Architectures - Answer 25:...........................................................................57
Design Secure Architectures - Question 26:.........................................................................58
Design Secure Architectures - Answer 26:...........................................................................58
Design Secure Architectures - Question 27:.........................................................................59
Design Secure Architectures - Answer 27:...........................................................................59

4|Page
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Design Secure Architectures - Question 28:.........................................................................60
Design Secure Architectures - Answer 28:...........................................................................60
Design Secure Architectures - Question 29:.........................................................................61
Design Secure Architectures - Answer 29:...........................................................................61
Design Secure Architectures - Question 30:.........................................................................62
Design Secure Architectures - Answer 30:...........................................................................62
Design Secure Architectures - Question 31:.........................................................................63
Design Secure Architectures - Answer 31:...........................................................................63
Design Secure Architectures - Question 32:.........................................................................64
Design Secure Architectures - Answer 32:...........................................................................64
Design Secure Architectures - Question 33:.........................................................................65
Design Secure Architectures - Answer 33:...........................................................................66
Design Secure Architectures - Question 34:.........................................................................66
Design Secure Architectures - Answer 34:...........................................................................66
Design Secure Architectures - Question 35:.........................................................................67
Design Secure Architectures - Answer 35:...........................................................................67
Design Secure Architectures - Question 36:.........................................................................68
Design Secure Architectures - Question 37:.........................................................................68
Design Secure Architectures - Answer 37:...........................................................................69
Design Secure Architectures - Question 38:.........................................................................69
Design Secure Architectures - Answer 38:...........................................................................70
Design Secure Architectures - Question 39:.........................................................................70
Design Secure Architectures - Answer 39:...........................................................................71
Design Secure Architectures - Question 40:.........................................................................71
Design Secure Architectures - Answer 40:...........................................................................72
Design Resilient Architectures - Question 1: ........................................................................90
Design Resilient Architectures - Answer 1: ..........................................................................91
Design Resilient Architectures - Question 2: ........................................................................91
Design Resilient Architectures - Answer 2: ..........................................................................91
Design Resilient Architectures - Question 3: ........................................................................92
Design Resilient Architectures - Answer 3: ..........................................................................92

5|Page
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Design Secure Applications and Architectures - Question 4: ................................................93
Design Secure Applications and Architectures - Answer 4:...................................................93
Design Resilient Architectures - Question 5: ........................................................................94
Design Resilient Architectures - Answer 5: ..........................................................................94
Design Resilient Architectures - Question 6: ........................................................................95
Design Resilient Architectures - Answer 6: ..........................................................................95
Design Resilient Architectures - Question 7: ........................................................................96
Design Resilient Architectures - Answer 7: ..........................................................................96
Design Resilient Architectures - Question 8: ........................................................................97
Design Resilient Architectures - Answer 8: ..........................................................................97
Design Resilient Architectures - Question 9: ........................................................................98
Design Resilient Architectures - Answer 9: ..........................................................................98
Design Resilient Architectures - Question 10: ......................................................................98
Design Resilient Architectures - Answer 10:.........................................................................99
Design Resilient Architectures - Question 11: ......................................................................99
Design Resilient Architectures - Answer 11:....................................................................... 100
Design Resilient Architectures - Question 12: .................................................................... 100
Design Resilient Architectures - Answer 12:....................................................................... 101
Design Resilient Architectures - Question 13: .................................................................... 102
Design Resilient Architectures - Answer 13:....................................................................... 102
Design Resilient Architectures - Question 14: .................................................................... 102
Design Resilient Architectures - Answer 14:....................................................................... 103
Design Resilient Architectures - Question 15: .................................................................... 103
Design Resilient Architectures - Answer 15:....................................................................... 104
Design Resilient Architectures - Question 16: .................................................................... 104
Design Resilient Architectures - Answer 16:....................................................................... 104
Design Resilient Architectures - Question 17: .................................................................... 105
Design Resilient Architectures - Answer 17:....................................................................... 105
Design Resilient Architectures - Question 18: .................................................................... 105
Design Resilient Architectures - Answer 18:....................................................................... 106
Design Resilient Architectures - Question 19: .................................................................... 106

6|Page
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Design Resilient Architectures - Answer 19:....................................................................... 107
Design Resilient Architectures - Question 20: .................................................................... 107
Design Resilient Architectures - Answer 20:....................................................................... 107
Design Resilient Architectures - Question 21: .................................................................... 108
Design Resilient Architectures - Answer 21:....................................................................... 108
Design Resilient Architectures - Question 22: .................................................................... 108
Design Resilient Architectures - Answer 22:....................................................................... 109
Design Resilient Architectures - Question 23: .................................................................... 109
Design Resilient Architectures - Answer 23:....................................................................... 109
Design Resilient Architectures - Question 24: .................................................................... 110
Design Resilient Architectures - Answer 24:....................................................................... 110
Design Resilient Architectures - Question 25: .................................................................... 110
Design Resilient Architectures - Answer 25:....................................................................... 111
Design Resilient Architectures - Question 26: .................................................................... 111
Design Resilient Architectures - Answer 26:....................................................................... 112
Design Resilient Architectures - Question 27: .................................................................... 112
Design Resilient Architectures - Answer 27:....................................................................... 113
Design Resilient Architectures - Question 28: .................................................................... 113
Design Resilient Architectures - Answer 28:....................................................................... 113
Design Resilient Architectures - Question 29: .................................................................... 114
Design Resilient Architectures - Answer 29:....................................................................... 114
Design Resilient Architectures - Question 30: .................................................................... 114
Design Resilient Architectures - Answer 30:....................................................................... 115
Design Resilient Architectures - Question 31: .................................................................... 115
Design Resilient Architectures - Answer 31:....................................................................... 116
Design Resilient Architectures - Question 32: .................................................................... 116
Design Resilient Architectures - Answer 32:....................................................................... 116
Design Resilient Architectures - Question 33: .................................................................... 117
Design Resilient Architectures - Answer 33:....................................................................... 117
Design Resilient Architectures - Question 34: .................................................................... 118
Design Resilient Architectures - Answer 34:....................................................................... 118

7|Page
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Resilient Architectures - Question 35: .................................................................... 119
Design Resilient Architectures - Answer 35:....................................................................... 119
Design Resilient Architectures - Question 36: .................................................................... 119
Design Resilient Architectures - Answer 36:....................................................................... 120
Design Resilient Architectures - Question 37: .................................................................... 120
Design Resilient Architectures - Answer 37:....................................................................... 121
Design Resilient Architectures - Question 38: .................................................................... 121
Design Resilient Architectures - Answer 38:....................................................................... 121
Design Resilient Architectures - Question 39: .................................................................... 122
Design Resilient Architectures - Answer 39:....................................................................... 122
Define Resilient Architectures - Question 40:..................................................................... 122
Define Resilient Architectures - Answer 40: ....................................................................... 123
Design High-Performing Architectures – Description..................................................................... 123
Design High-Performing Architectures - Cheat Sheets ................................................................... 123
Design High-Performing Architectures- Illustrations ...................................................................... 127
Design High-Performing Architectures - Quiz ............................................................................... 129
Design High-Performing Architectures - Question 1: .......................................................... 130
Design High-Performing Architectures - Answer 1:............................................................. 130
Design High-Performing Architectures - Question 2: .......................................................... 130
Design High-Performing Architectures - Answer 2:............................................................. 131
Design High-Performing Architectures - Question 3: .......................................................... 131
Design High-Performing Architectures - Answer 3:............................................................. 131
Design High-Performing Architectures - Question 4: .......................................................... 132
Design High-Performing Architectures - Answer 4:............................................................. 132
Design High-Performing Architectures - Question 5: .......................................................... 132
Design High-Performing Architectures - Answer 5:............................................................. 133
Design High-Performing Architectures - Question 6: .......................................................... 133
Design High-Performing Architectures - Answer 6:............................................................. 134
Design High-Performing Architectures - Question 7: .......................................................... 134
Design High-Performing Architectures - Answer 7:............................................................. 135
Design High-Performing Architectures - Question 8: .......................................................... 135

8|Page
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Design High-Performing Architectures - Answer 8:............................................................. 135
Design High-Performing Architectures - Question 9: .......................................................... 136
Design High-Performing Architectures - Answer 9:............................................................. 136
Design High-Performing Architectures - Question 10: ........................................................ 137
Design High-Performing Architectures - Answer 10:........................................................... 137
Design High-Performing Architectures - Question 11: ........................................................ 138
Design High-Performing Architectures - Answer 11:........................................................... 138
Design High-Performing Architectures - Question 12: ........................................................ 139
Design High-Performing Architectures - Answer 12:........................................................... 139
Design High-Performing Architectures - Question 13: ........................................................ 140
Design High-Performing Architectures - Answer 13:........................................................... 141
Design High-Performing Architectures - Question 14: ........................................................ 141
Design High-Performing Architectures - Answer 14:........................................................... 141
Design High-Performing Architectures - Question 15: ........................................................ 142
Design High-Performing Architectures - Answer 15:........................................................... 143
Design High-Performing Architectures - Question 16: ........................................................ 143
Design High-Performing Architectures - Answer 16:........................................................... 143
Design High-Performing Architectures - Question 17: ........................................................ 144
Design High-Performing Architectures - Answer 17:........................................................... 144
Design High-Performing Architectures - Question 18: ........................................................ 145
Design High-Performing Architectures - Answer 18:........................................................... 145
Design High-Performing Architectures - Question 19: ........................................................ 146
Design High-Performing Architectures - Answer 19:........................................................... 147
Design High-Performing Architectures - Question 20: ........................................................ 147
Design High-Performing Architectures - Answer 20:........................................................... 147
Design High-Performing Architectures - Question 21: ........................................................ 148
Design High-Performing Architectures - Answer 21:........................................................... 148
Design High-Performing Architectures - Question 22: ........................................................ 149
Design High-Performing Architectures - Answer 22:........................................................... 150
Design High-Performing Architecture - Question 23: .......................................................... 150
Design High-Performing Architecture - Answer 23: ............................................................ 150

9|Page
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Design High-Performing Architecture - Question 24: .......................................................... 151
Design High-Performing Architecture - Answer 24: ............................................................ 151
Design High-Performing Architectures - Question 25: ........................................................ 152
Design High-Performing Architectures - Answer 25:........................................................... 152
Design High-Performing Architectures - Question 26: ........................................................ 153
Design High-Performing Architectures - Answer 26:........................................................... 153
Design High-Performing Architectures - Question 27: ........................................................ 154
Design High-Performing Architectures - Answer 27:........................................................... 154
Design High-Performing Architectures - Question 28: ........................................................ 155
Design High-Performing Architectures - Answer 28:........................................................... 155
Design High-Performing Architectures - Question 29: ........................................................ 156
Design High-Performing Architectures - Answer 29:........................................................... 156
Design High-Performing Architectures - Question 30: ........................................................ 157
Design High-Performing Architectures - Answer 30:........................................................... 157
Design High-Performing Architectures - Question 31: ........................................................ 158
Design High-Performing Architectures - Answer 31:........................................................... 159
Design High-Performing Architectures - Question 32: ........................................................ 159
Design High-Performing Architectures - Answer 32:........................................................... 159
Design High-Performing Architectures - Question 33: ........................................................ 160
Design High-Performing Architectures - Answer 33:........................................................... 161
Design High-Performing Architectures - Question 34: ........................................................ 161
Design High-Performing Architectures - Answer 34:........................................................... 161
Design High-Performing Architectures - Question 35: ........................................................ 162
Design High-Performing Architectures - Answer 35:........................................................... 162
Design High-Performing Architectures - Question 36: ........................................................ 162
Design High-Performing Architectures - Answer 36:........................................................... 163
Design High-Performing Architectures - Question 37: ........................................................ 163
Design High-Performing Architectures - Answer 37:........................................................... 164
Design High-Performing Architectures - Question 38: ........................................................ 164
Design High-Performing Architectures - Answer 38:........................................................... 165
Design High-Performing Architectures - Question 39: ........................................................ 165

10 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design High-Performing Architectures - Answer 39:........................................................... 165
Design High-Performing Architectures - Question 40: ........................................................ 166
Design High-Performing Architectures - Answer 40:........................................................... 166
Design Cost-Optimized Architectures - Cheat Sheets..................................................................... 167
Design Cost-Optimized Architectures: Illustrations ....................................................................... 171
Design Cost-Optimized Architectures – Quiz ................................................................................ 175
Design Cost-Optimized Architectures - Question 1:............................................................ 175
Design Cost-Optimized Architectures - Answer 1:.............................................................. 175
Design Cost-Optimized Architectures - Question 2:............................................................ 176
Design Cost-Optimized Architectures - Answer 2:.............................................................. 176
Design Cost-Optimized Architectures - Question 3:............................................................ 176
Design Cost-Optimized Architectures - Answer 3:.............................................................. 177
Design Cost-Optimized Architectures - Question 4:............................................................ 177
Design Cost-Optimized Architectures - Answer 4:.............................................................. 177
Design Cost-Optimized Architectures - Question 5:............................................................ 177
Design Cost-Optimized Architectures - Answer 5:.............................................................. 178
Design Cost-Optimized Architectures - Question 6:............................................................ 178
Design Cost-Optimized Architectures - Answer 6:.............................................................. 178
Design Cost-Optimized Architectures - Question 7:............................................................ 179
Design Cost-Optimized Architectures - Question 8:............................................................ 179
Design Cost-Optimized Architectures - Answer 8:.............................................................. 179
Design Cost-Optimized Architectures - Question 9:............................................................ 180
Design Cost-Optimized Architectures - Answer 9:.............................................................. 180
Design Cost-Optimized Architectures - Question 10:.......................................................... 180
Design Cost-Optimized Architectures - Answer 10: ............................................................ 181
Design Cost-Optimized Architectures - Question 11:.......................................................... 181
Design Cost-Optimized Architectures - Answer 11: ............................................................ 181
Design Cost-Optimized Architectures - Question 12:.......................................................... 181
Design Cost-Optimized Architectures - Answer 12: ............................................................ 182
Design Cost-Optimized Architectures - Question 13:.......................................................... 182
Design Cost-Optimized Architectures - Answer 13: ............................................................ 183

11 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Design Cost-Optimized Architectures - Question 14:.......................................................... 183
Design Cost-Optimized Architectures - Answer 14: ............................................................ 183
Design Cost-Optimized Architectures - Question 15:.......................................................... 184
Design Cost-Optimized Architectures - Answer 15: ............................................................ 184
Design Cost-Optimized Architectures - Question 16:.......................................................... 185
Design Cost-Optimized Architectures - Answer 16: ............................................................ 186
Design Cost-Optimized Architectures - Question 17:.......................................................... 186
Design Cost-Optimized Architectures - Answer 17: ............................................................ 187
Design Cost-Optimized Architectures - Question 18:.......................................................... 187
Design Cost-Optimized Architectures - Answer 18: ............................................................ 187
Design Cost-Optimized Architectures - Question 19:.......................................................... 188
Design Cost-Optimized Architectures - Answer 19: ............................................................ 188
Design Cost-Optimized Architectures - Question 20:.......................................................... 189
Design Cost-Optimized Architectures - Answer 20: ............................................................ 190
Design Cost-Optimized Architectures - Question 21:.......................................................... 190
Design Cost-Optimized Architectures - Answer 21: ............................................................ 190
Design Cost-Optimized Architectures - Question 22:.......................................................... 191
Design Cost-Optimized Architectures - Answer 22: ............................................................ 191
Design Cost-Optimized Architectures - Question 23:.......................................................... 192
Design Cost-Optimized Architectures - Answer 23: ............................................................ 192
Design Cost-Optimized Architectures - Question 24:.......................................................... 193
Design Cost-Optimized Architectures - Answer 24: ............................................................ 193
Design Cost-Optimized Architectures - Question 25:.......................................................... 194
Design Cost-Optimized Architectures - Answer 25: ............................................................ 195
Design Cost-Optimized Architectures - Question 26:.......................................................... 195
Design Cost-Optimized Architectures - Answer 26: ............................................................ 196
Design Cost-Optimized Architectures - Question 27:.......................................................... 196
Design Cost-Optimized Architectures - Answer 27: ............................................................ 196
Design Cost-Optimized Architectures - Question 28:.......................................................... 197
Design Cost-Optimized Architectures - Answer 28: ............................................................ 197
Design Cost-Optimized Architectures - Question 29:.......................................................... 198

12 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Cost-Optimized Architectures - Answer 29: ............................................................ 198
Design Cost-Optimized Architectures - Question 30:.......................................................... 199
Design Cost-Optimized Architectures - Answer 30: ............................................................ 199
Design Cost-Optimized Architectures - Question 31:.......................................................... 200
Design Cost-Optimized Architectures - Answer 31: ............................................................ 200
Design Cost-Optimized Architectures - Question 32:.......................................................... 201
Design Cost-Optimized Architectures - Answer 32: ............................................................ 201
Design Cost-Optimized Architectures - Question 33:.......................................................... 201
Design Cost-Optimized Architectures - Answer 33: ............................................................ 202
Design Cost-Optimized Architectures - Question 34:.......................................................... 202
Design Cost-Optimized Architectures - Answer 34: ............................................................ 203
Design Cost-Optimized Architectures - Question 35:.......................................................... 203
Design Cost-Optimized Architectures - Answer 35: ............................................................ 204
Design Cost-Optimized Architectures - Question 36:.......................................................... 204
Design Cost-Optimized Architectures - Answer 36: ............................................................ 205
Design Cost-Optimized Architectures - Question 37:.......................................................... 205
Design Cost-Optimized Architectures - Answer 37: ............................................................ 205
Design Cost-Optimized Architectures - Question 38:.......................................................... 206
Design Cost-Optimized Architectures - Answer 38: ............................................................ 206
Design Cost-Optimized Architectures - Question 39:.......................................................... 207
Design Cost-Optimized Architectures - Answer 39: ............................................................ 208
Design Cost-Optimized Architectures - Question 40:.......................................................... 209
Design Cost-Optimized Architectures - Answer 40: ............................................................ 210
Top 50 AWS Recommended Security Best Practices ............................................................ 210
AWS SAA FAQs ....................................................................................................................... 215
AWS S3 FAQs.................................................................................................................. 215
AWS EC2 FAQs ............................................................................................................... 218
DYNAMODB FAQs ........................................................................................................... 220
RDS FAQs........................................................................................................................ 222
AWS LAMBDA FAQs........................................................................................................ 224
AWS SERVERLESS FAQs ............................................................................................... 237

13 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 API Gateway FAQs........................................................................................................... 244
Practice Exam – 69 Questions & Answers .................................................................................... 247
Practice Exam - Question 1: ........................................................................................... 247
Practice Exam - Answer 1............................................................................................... 248
Practice Exam - Question 2: ........................................................................................... 248
Practice Exam - Answer 2............................................................................................... 248
Practice Exam - Question 3: ........................................................................................... 249
Practice Exam - Answer 3............................................................................................... 249
Practice Exam - Question 4: ........................................................................................... 250
Practice Exam - Answer 4............................................................................................... 250
Practice Exam - Question 5: ........................................................................................... 251
Practice Exam - Answer 5............................................................................................... 251
Practice Exam - Question 6: ........................................................................................... 252
Practice Exam - Answer 6............................................................................................... 252
Practice Exam - Question 7: ........................................................................................... 253
Practice Exam - Answer 7............................................................................................... 254
Practice Exam - Question 8: ........................................................................................... 254
Practice Exam - Answer 8............................................................................................... 255
Practice Exam - Question 9: ........................................................................................... 255
Practice Exam - Answer 9............................................................................................... 255
Practice Exam - Question 10: ......................................................................................... 256
Practice Exam - Answer 10............................................................................................. 256
Practice Exam - Question 11: ......................................................................................... 257
Practice Exam - Answer 11............................................................................................. 258
Practice Exam - Question 12: ......................................................................................... 258
Practice Exam - Answer 12............................................................................................. 259
Practice Exam - Question 13: ......................................................................................... 260
Practice Exam - Answer 13............................................................................................. 260
Practice Exam - Question 14: ......................................................................................... 261
Practice Exam - Answer 14............................................................................................. 261
Practice Exam - Question 15: ......................................................................................... 262

14 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Practice Exam - Answer 15............................................................................................. 262
Practice Exam - Question 16: ......................................................................................... 263
Practice Exam - Answer 16............................................................................................. 263
Practice Exam - Question 17: ......................................................................................... 264
Practice Exam - Answer 17............................................................................................. 264
Practice Exam - Question 18: ......................................................................................... 265
Practice Exam - Answer 18............................................................................................. 265
Practice Exam - Question 19: ......................................................................................... 266
Practice Exam - Answer 19............................................................................................. 266
Practice Exam - Question 20: ......................................................................................... 267
Practice Exam - Answer 20............................................................................................. 267
Practice Exam - Question 21: ......................................................................................... 268
Practice Exam - Answer 21............................................................................................. 268
Practice Exam - Question 22: ......................................................................................... 269
Practice Exam - Answer 22............................................................................................. 269
Practice Exam - Question 23: ......................................................................................... 269
Practice Exam - Answer 23............................................................................................. 270
Practice Exam - Question 24: ......................................................................................... 270
Practice Exam - Answer 24............................................................................................. 271
Practice Exam - Question 25: ......................................................................................... 271
Practice Exam - Answer 25............................................................................................. 272
Practice Exam - Question 26: ......................................................................................... 272
Practice Exam - Answer 26............................................................................................. 273
Practice Exam - Question 27: ......................................................................................... 273
Practice Exam - Answer 27............................................................................................. 274
Practice Exam - Question 28: ......................................................................................... 274
Practice Exam - Answer 28............................................................................................. 275
Practice Exam - Question 29: ......................................................................................... 275
Practice Exam - Answer 29............................................................................................. 276
Practice Exam - Question 30: ......................................................................................... 276
Practice Exam - Answer 30............................................................................................. 277

15 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Practice Exam - Question 31: ......................................................................................... 277
Practice Exam - Answer 31............................................................................................. 278
Practice Exam - Question 32: ......................................................................................... 278
Practice Exam - Answer 32............................................................................................. 279
Practice Exam - Question 33: ......................................................................................... 279
Practice Exam - Answer 33............................................................................................. 280
Practice Exam - Question 34: ......................................................................................... 280
Practice Exam - Answer 34............................................................................................. 281
Practice Exam - Question 35: ......................................................................................... 281
Practice Exam - Answer 35............................................................................................. 282
Practice Exam - Question 36: ......................................................................................... 282
Practice Exam - Answer 36............................................................................................. 282
Practice Exam - Question 37: ......................................................................................... 283
Practice Exam - Answer 37............................................................................................. 283
Practice Exam - Question 38: ......................................................................................... 284
Practice Exam - Answer 38............................................................................................. 284
Practice Exam - Question 39: ......................................................................................... 285
Practice Exam - Answer 39............................................................................................. 285
Practice Exam - Question 40: ......................................................................................... 286
Practice Exam - Answer 40............................................................................................. 286
Practice Exam - Question 41: ......................................................................................... 287
Practice Exam - Answer 41............................................................................................. 287
Practice Exam - Question 42: ......................................................................................... 287
Practice Exam - Answer 42............................................................................................. 288
Practice Exam - Question 43: ......................................................................................... 288
Practice Exam - Answer 43............................................................................................. 289
Practice Exam - Question 44: ......................................................................................... 289
Practice Exam - Answer 44............................................................................................. 290
Practice Exam - Question 45: ......................................................................................... 290
Practice Exam - Answer 45............................................................................................. 291
Practice Exam - Question 46: ......................................................................................... 291

16 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Practice Exam - Answer 46............................................................................................. 292
Practice Exam - Question 47: ......................................................................................... 293
Practice Exam - Answer 47............................................................................................. 293
Practice Exam - Question 48: ......................................................................................... 294
Practice Exam - Answer 48............................................................................................. 294
Practice Exam - Question 49: ......................................................................................... 295
Practice Exam - Answer 49............................................................................................. 295
Practice Exam - Question 50: ......................................................................................... 296
Practice Exam - Answer 50............................................................................................. 296
Practice Exam - Question 51: ......................................................................................... 297
Practice Exam - Answer 51............................................................................................. 297
Practice Exam - Question 52: ......................................................................................... 298
Practice Exam - Answer 52............................................................................................. 299
Practice Exam - Question 53: ......................................................................................... 299
Practice Exam - Answer 53............................................................................................. 300
Practice Exam - Question 54: ......................................................................................... 300
Practice Exam - Answer 54............................................................................................. 301
Practice Exam - Question 55: ......................................................................................... 302
Practice Exam - Answer 55............................................................................................. 302
Practice Exam - Question 56: ......................................................................................... 303
Practice Exam - Answer 56............................................................................................. 303
Practice Exam - Question 57: ......................................................................................... 304
Practice Exam - Answer 57............................................................................................. 305
Practice Exam - Question 58: ......................................................................................... 305
Practice Exam - Answer 58............................................................................................. 306
Practice Exam - Question 59: ......................................................................................... 306
Practice Exam - Answer 59............................................................................................. 307
Practice Exam - Question 60: ......................................................................................... 308
Practice Exam - Answer 60............................................................................................. 308
Practice Exam - Question 61: ......................................................................................... 309
Practice Exam - Answer 61............................................................................................. 309

17 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Question 62: ......................................................................................... 310
Practice Exam - Answer 62............................................................................................. 311
Practice Exam - Question 63: ......................................................................................... 311
Practice Exam - Answer 63............................................................................................. 312
Practice Exam - Question 64: ......................................................................................... 312
Practice Exam - Answer 64............................................................................................. 313
Practice Exam - Question 65: ......................................................................................... 313
Practice Exam - Answer 65............................................................................................. 314
Practice Exam - Question 66: ......................................................................................... 314
Practice Exam - Answer 66............................................................................................. 315
Practice Exam - Question 67: ......................................................................................... 315
Practice Exam - Answer 67............................................................................................. 316
Practice Exam - Question 68: ......................................................................................... 317
Practice Exam - Answer 68............................................................................................. 317
Practice Exam - Question 69: ......................................................................................... 318
Practice Exam - Answer 69............................................................................................. 319
Passed AWS SAA Testimonials............................................................................................ 319

18 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
What will you learn in this book?
- Design Secure Architectures
- Design Resilient Architectures
- Design High-Performing Architectures
- Design Cost-Optimized Architectures

What are the requirements or prerequisites for reading this

book?
The target candidate should have at least 1 year of hands-on experience designing
cloud solutions that use AWS services

Who is this book for?

IT Professionals, Cloud enthusiasts, Students, AWS Cloud Developer, Technology Manager and
Executives, IT Project Managers

Book Description:
The AWS Certified Solutions Architect - Associate (SAA) exam is intended for
individuals who perform in a solutions architect role.
The exam validates a candidate's ability to use AWS technologies to design solutions
based on the AWS Well-Architected Framework.
The exam also validates a candidate’s ability to complete the following tasks:
• Design solutions that incorporate AWS services to meet current business
requirements and future projected needs
• Design architectures that are secure, resilient, high-performing, and cost-
optimized
• Review existing solutions and determine improvements

What is taught in this book?

- AWS Certification Preparation for Solutions Architecture – Associate Level

19 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Key tools, technologies, and concepts covered
• Compute
• Cost management
• Database
• Disaster recovery
• High performance
• Management and governance
• Microservices and component decoupling
• Migration and data transfer
• Networking, connectivity, and content delivery
• Resiliency
• Security
• Serverless and event-driven design principles
• Storage

Some New AWS services covered

Analytics:
• Amazon Athena
• AWS Data Exchange
• AWS Data Pipeline
• Amazon EMR
• AWS Glue
• Amazon Kinesis
• AWS Lake Formation
• Amazon Managed Streaming for Apache Kafka (Amazon MSK)
• Amazon OpenSearch Service (Amazon Elasticsearch Service)
• Amazon QuickSight
• Amazon Redshift

Application Integration:
• Amazon AppFlow
• AWS AppSync
• Amazon EventBridge (Amazon CloudWatch Events)
• Amazon MQ
• Amazon Simple Notification Service (Amazon SNS)

20 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
• Amazon Simple Queue Service (Amazon SQS)
• AWS Step Functions

AWS Cost Management:

• AWS Budgets
• AWS Cost and Usage Report
• AWS Cost Explorer
• Savings Plans

Compute:
• AWS Batch
• Amazon EC2
• Amazon EC2 Auto Scaling
• AWS Elastic Beanstalk
• AWS Outposts
• AWS Serverless Application Repository
• VMware Cloud on AWS
• AWS Wavelength
Containers:
• Amazon Elastic Container Registry (Amazon ECR)
• Amazon Elastic Container Service (Amazon ECS)
• Amazon ECS Anywhere
• Amazon Elastic Kubernetes Service (Amazon EKS)
• Amazon EKS Anywhere
• Amazon EKS Distro

Database:
• Amazon Aurora
• Amazon Aurora Serverless
• Amazon DocumentDB (with MongoDB compatibility)
• Amazon DynamoDB
• Amazon ElastiCache
• Amazon Keyspaces (for Apache Cassandra)
• Amazon Neptune
• Amazon Quantum Ledger Database (Amazon QLDB)
• Amazon RDS
• Amazon Redshift
• Amazon Timestream

Developer Tools:
• AWS X-Ray

21 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Front-End Web and Mobile:
• AWS Amplify
• Amazon API Gateway
• AWS Device Farm
• Amazon Pinpoint
Machine Learning:
• Amazon Comprehend
• Amazon Forecast
• Amazon Fraud Detector
• Amazon Kendra
• Amazon Lex
• Amazon Polly
• Amazon Rekognition
• Amazon SageMaker
• Amazon Textract
• Amazon Transcribe
• Amazon Translate

Management and Governance:

• AWS Auto Scaling
• AWS CloudFormation
• AWS CloudTrail
• Amazon CloudWatch
• AWS Command Line Interface (AWS CLI)
• AWS Compute Optimizer
• AWS Config
• AWS Control Tower
• AWS License Manager
• Amazon Managed Grafana
• Amazon Managed Service for Prometheus
• AWS Management Console
• AWS Organizations
• AWS Personal Health Dashboard
• AWS Proton
• AWS Service Catalog
• AWS Systems Manager
• AWS Trusted Advisor
• AWS Well-Architected Tool

Media Services:

22 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
• Amazon Elastic Transcoder
• Amazon Kinesis Video Streams
Migration and Transfer:
• AWS Application Discovery Service
• AWS Application Migration Service (CloudEndure Migration)
• AWS Database Migration Service (AWS DMS)
• AWS DataSync
• AWS Migration Hub
• AWS Server Migration Service (AWS SMS)
• AWS Snow Family
• AWS Transfer Family

Networking and Content Delivery:

• Amazon CloudFront
• AWS Direct Connect
• Elastic Load Balancing (ELB)
• AWS Global Accelerator
• AWS PrivateLink
• Amazon Route 53
• AWS Transit Gateway
• Amazon VPC
• AWS VPN

Security, Identity, and Compliance:

• AWS Artifact
• AWS Audit Manager
• AWS Certificate Manager (ACM)
• AWS CloudHSM
• Amazon Cognito
• Amazon Detective
• AWS Directory Service
• AWS Firewall Manager
• Amazon GuardDuty
• AWS Identity and Access Management (IAM)
• Amazon Inspector
• AWS Key Management Service (AWS KMS)
• Amazon Macie
• AWS Network Firewall
• AWS Resource Access Manager (AWS RAM)
• AWS Secrets Manager
• AWS Security Hub

23 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
• AWS Shield
• AWS Single Sign-On
• AWS WAF
Serverless:
• AWS AppSync
• AWS Fargate
• AWS Lambda

Storage:
• AWS Backup
• Amazon Elastic Block Store (Amazon EBS)
• Amazon Elastic File System (Amazon EFS)
• Amazon FSx (for all types)
• Amazon S3
• Amazon S3 Glacier
• AWS Storage Gateway

Design Secure Architectures – Description

This exam domain is focused on securing your architectures on AWS and comprises
30% of the exam. Task statements include:
Task Statement 1: Design secure access to AWS resources.
Task Statement 2: Design secure workloads and applications.
Task Statement 3: Determine appropriate data security controls.

Design Secure Architectures - Cheat Sheets

Server-Side Encryption vs Client-Side Encryption

- Server-Side Encryption with Customer-Provided Keys (SSE-C) enables Amazon

S3 to encrypt objects server side using an encryption key provided in the PUT request.
The same key must be provided in GET requests for Amazon S3 to decrypt the object.
- Customers also have the option to encrypt data client side before uploading it to
Amazon S3 and decrypting it after downloading it. AWS SDKs provide an S3 encryption
client that streamlines the process.

Best practice areas for security in the cloud

24 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
There are six best practice areas for security in the cloud: Security, Identity and Access
Management, Detection, Infrastructure Protection, Data Protection, Incident Response.

Policy in AWS

A policy is an object in AWS that, when associated with an identity or resource, defines
their permissions. AWS evaluates these policies when an IAM principal (user or role)
makes a request. Permissions in the policies determine whether the request is allowed
or denied. Most policies are stored in AWS as JSON documents.
AWS supports six types of policies:
- identity-based policies,
- resource-based policies,
- permissions boundaries,
- Organizations SCPs,
- ACLs, and session policies.
IAM policies define permissions for an action regardless of the method that you
use to perform the operation. For example, if a policy allows the GetUser action, then
a user with that policy can get user information from the AWS Management Console,
the AWS CLI, or the AWS API. When you create an IAM user, you can choose to allow
console or programmatic access. If console access is allowed, the IAM user can sign in
to the console using a user name and password. Or if programmatic access is allowed,
the user can use access keys to work with the CLI or API.

Security: Amazon S3 notification

The Amazon S3 notification feature enables you to receive notifications when certain
events happen in your bucket. To enable notifications, you must first add a notification
configuration that identifies the events you want Amazon S3 to publish and the
destinations where you want Amazon S3 to send the notifications. An S3 notification
can be set up to notify you when objects are restored from Glacier to S3.

Network ACL

Your VPC automatically comes with a modifiable default network ACL. By default, it
allows all inbound and outbound IPv4 traffic and, if applicable, IPv6 traffic. You can
create a custom network ACL and associate it with a subnet. By default, each custom
network ACL denies all inbound and outbound traffic until you add rules.

KMS API

You can configure your application to use the KMS API to encrypt all data before saving
it to disk.
25 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Network ACLs are stateless, and security groups are stateful.

Network ACLs are stateless, which means that responses to allowed inbound traffic are
subject to the rules for outbound traffic (and vice versa).

AWS Security Token Service (AWS STS)

AWS Security Token Service (AWS STS) is the service that you can use to create and
provide trusted users with temporary security credentials that can control access to your
AWS resources. Temporary security credentials work almost identically to the long-term
access key credentials that your IAM users can use. You can use the AWS Security
Token Service (AWS STS) to create and provide trusted users with temporary security
credentials that can control access to your AWS resources. Temporary security
credentials work almost identically to the long-term access key credentials that your IAM
users can use, with the following differences: Temporary security credentials are short-
term, as the name implies. They can be configured to last for anywhere from a few
minutes to several hours. After the credentials expire, AWS no longer recognizes them
or allows any kind of access from API requests made with them. Temporary security
credentials are not stored with the user but are generated dynamically and provided to
the user when requested. When (or even before) the temporary security credentials
expire, the user can request new credentials, as long as the user requesting them still
has permissions to do so.

How are NACL Rules evaluated and applied?

Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches
traffic, it's applied immediately regardless of any higher-numbered rule that may
contradict it.

The following are the basic things that you need to know about network ACLs:
Your VPC automatically comes with a modifiable default network ACL. By default, it
allows all inbound and outbound IPv4 traffic and, if applicable, IPv6 traffic. You can
create a custom network ACL and associate it with a subnet. By default, each custom
network ACL denies all inbound and outbound traffic until you add rules. Each subnet in
your VPC must be associated with a network ACL. If you don't explicitly associate a
subnet with a network ACL, the subnet is automatically associated with the default
network ACL. You can associate a network ACL with multiple subnets. However, a
subnet can be associated with only one network ACL at a time. When you associate a
network ACL with a subnet, the previous association is removed. A network ACL
contains a numbered list of rules. We evaluate the rules in order, starting with the
lowest-numbered rule, to determine whether traffic is allowed in or out of any subnet
associated with the network ACL.

26 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
What is the purpose of key pair with Amazon AWS EC2?

Amazon AWS uses key pair to encrypt and decrypt login information.

A sender uses a public key to encrypt data, which its receiver then decrypts using
another private key. These two keys, public and private, are known as a key pair.
You need a key pair to be able to connect to your instances. The way this works on
Linux and Windows instances is different.
First, when you launch a new instance, you assign a key pair to it. Then, when you log
in to it, you use the private key.
The difference between Linux and Windows instances is that Linux instances do not
have a password already set and you must use the key pair to log in to Linux instances.
On the other hand, on Windows instances, you need the key pair to decrypt the
administrator password. Using the decrypted password, you can use RDP and then
connect to your Windows instance.
Amazon EC2 stores only the public key, and you can either generate it inside Amazon
EC2 or you can import it. Since the private key is not stored by Amazon, it’s advisable to
store it in a secure place as anyone who has this private key can log in on your behalf.

What is VPC PrivateLink?

AWS PrivateLink provides private connectivity between VPCs and services hosted on
AWS or on-premises, securely on the Amazon network. By providing a private endpoint
to access your services, AWS PrivateLink ensures your traffic is not exposed to the
public internet.

From a security perspective, what is a principal?

- An anonymous user falls under the definition of a principal. A principal can be an

anonymous user acting on a system.
- An authenticated user falls under the definition of a principal. A principal can be an
authenticated user acting on a system.

Design Secure Architectures - Flashcards

What is it?: AWS Identity and Access Management (IAM) is a web service that
helps you securely control access to AWS resources.

27 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Remember:
- You use IAM to control who is authenticated (signed in) and authorized (has
permissions) to use resources.
- Permissions are governed by Policies (JSON)
- IAM has predefined "managed policies"
- Always give users the minimal amount of permissions they need to perform their job
(least privilege principles)
- Big enterprises usually integrate their own repository of users with IAM, so employees
can login into AWS using their company credentials
- Identity Federation uses the SAML standard (Active Directory)
- MFA (Multi Factor Authentication) can be setup
- IAM credentials should never be shared
- Never use ROOT IAM Credentials
- Never use the ROOT account except for initial setup.

28 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 29 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 30 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 31 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 32 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 33 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Design Secure Architectures – Illustrations

34 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 35 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 36 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Design Secure Architectures – Quiz

Design Secure Architectures - Question 1:

You are reviewing Change Control requests, and you note that there is a change
designed to reduce wasted CPU cycles by increasing the value of your Amazon
SQS "VisibilityTimeout" attribute. What does this mean?
A
While processing a message, a consumer instance can amend the message visibility counter by a fixed amo unt.
B
When a consumer instance retrieves a message, that message will be hidden from other consumer instances for a fixed period.
C
When the consumer instance polls for new work the SQS service will allow it to wait a certain time for a message to be avai lable before
closing the connection.
D
While processing a message, a consumer instance can reset the message visibility by restarting the preset timeout counter.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 1:

B.

Poor timing of SQS processes can significantly impact the cost effectiveness of
the solution. To prevent other consumers from processing the message again,
Amazon SQS sets a visibility timeout, a period of time during which Amazon SQS
prevents other consumers from receiving and processing the message. The
default visibility timeout for a message is 30 seconds. The minimum is 0 seconds.
The maximum is 12 hours.
Reference: SQS

37 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Secure Architectures - Question 2:
You are a security architect working for a large antivirus Djamgatech’s company.
The production environment has recently been moved to AWS and is in a public
subnet. You are able to view the production environment over HTTP. However,
when your customers try to update their virus definition files over a custom port,
that port is blocked. You log in to the console and you allow traffic in over the
custom port. How long will this take to take effect?
A
After a few minutes.
B
Immediately.
C
Straight away, but to the new instances only.
D
Straight away to the new instances, but old instances must be stopped and restarted before the new rules apply.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 2:

B.

Immediately
Reference: IAM

Design Secure Architectures - Question 3:

Your Security Manager has hired a security contractor to audit your network and
firewall configurations. The consultant doesn't have access to an AWS account.
You need to provide the required access for the auditing tasks, and answer a
question about login details for the official AWS firewall appliance. Which of the
following might you do? Choose 2
A
Create an IAM User with a policy that can Read Security Group and NACL settings.
B
Explain that AWS implements network security differently and that there is no such thing as an official AWS firewall appliance. Security
Groups and NACLs are used instead.
C
Create an IAM Role with a policy that can Read Security Group and NACL settings.
D
Explain that AWS is a cloud service and that AWS manages the Network appliances.

38 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 3:

A. B.

Create an IAM user for the auditor and explain that the firewall functionality is
implemented as stateful Security Groups, and stateless subnet NACLs. AWS has
removed the Firewall appliance from the hub of the network and implemented the
firewall functionality as stateful Security Groups, and stateless subnet NACLs.
This is not a new concept in networking, but rarely implemented at this scale.
Reference: IAM

Design Secure Architectures - Question 4:

Select all the true statements on S3 URL styles: Choose 2
A
Virtual hosted-style URLs will be eventually depreciated in favor of Path-Style URLs for S3 bucket access.
B
Virtual-host-style URLs (such as: https://bucket-name.s3.Region.amazonaws.com/key name) are supported by AWS.
C
Path-Style URLs (such as https://s3.Region.amazonaws.com/bucket-name/key name) are supported by AWS.
D
DNS compliant names are NOT recommended f or the URLs to access S3.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 4:

B. C.

Virtual-host-style URLs and Path-Style URLs (soon to be retired) are supported by

AWS. DNS compliant names are recommended for the URLs to access S3.
Reference: S3

39 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Secure Architectures - Question 5:
Which native AWS service will act as a file system mounted on an S3 bucket?
A
Amazon Elastic Block Store
B
File Gateway
C
Amazon S3
D
Amazon Elastic File System

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 5:

B.

A file gateway supports a file interface into Amazon Simple Storage Service
(Amazon S3) and combines a service and a virtual software appliance. By using
this combination, you can store and retrieve objects in Amazon S3 using
industry-standard file protocols such as Network File System (NFS) and Server
Message Block (SMB). The software appliance, or gateway, is deployed into your
on-premises environment as a virtual machine (VM) running on VMware ESXi,
Microsoft Hyper-V, or Linux Kernel-based Virtual Machine (KVM) hypervisor. The
gateway provides access to objects in S3 as files or file share mount points. You
can manage your S3 data using lifecycle policies, cross-region replication, and
versioning. You can think of a file gateway as a file system mount on S3.
Reference: Storage Gateway

Design Secure Architectures - Question 6:

You work for a busy Djamgatech’s real estate company, and you need to protect
your data stored on S3 from accidental deletion. Which of the following actions
might you take to achieve this? Choose 2
A
Create a bucket policy that prohibits anyone from deleting things from the bucket.
B
Enable S3 - Infrequent Access Storage (S3 - IA).
C
Enable versioning on the bucket. If a file is accidentally deleted, delete the delete marker.
D
Configure MFA-protected API access.

40 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 6:

C. D.

Enable versioning on the bucket. If a file is accidentally deleted, delete the delete
marker. Configure MFA-protected API access.
Reference: S3

Design Secure Architectures - Question 7:

What does the "EAR" in a policy document stand for?
A
Effects, APIs, Roles
B
Effect, Action, Resource
C
Ewoks, Always, Romanticize
D
Every, Action, Reasonable

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 7:

B.

The elements included in a policy document that make up the "EAR" are effect,
action, and resource.
Reference: IAM

Design Secure Architectures - Question 8:

41 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 The company Djamgatech plans to run a monitoring application on an Amazon
EC2 instance in a VPC. Connections are made to the EC2 instance using the
instance’s private IPv4 address. A solutions architect needs to design a solution
that will allow traffic to be quickly directed to a standby EC2 instance if the
application fails and becomes unreachable. Which approach will meet these
requirements?
A
Deploy an Application Load Balancer configured with a listener for the private IP address and register the primary EC2 instan ce with the load
balancer. Upon failure, de-register the instance and register the standby EC2 instance.
B
Configure a custom DHCP option set. Configure DHCP to assign the same private IP address to the standby EC2 instance when the primary
EC2 instance fails.
C
Attach a secondary elastic network interface to the EC2 instanc e configured with the private IP address. Move the network interface to the
standby EC2 instance if the primary EC2 instance becomes unreachable.
D
Associate an Elastic IP address with the network interface of the primary EC2 instance. Disassociate the Elastic IP from the primary instance
upon failure and associate it with a standby EC2 instance.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 8:

C.

A secondary elastic network interface can be added to an EC2 instance. While

primary network interfaces cannot be detached from an instance, secondary
network interfaces can be detached and attached to a different EC2 instance.
Reference: A secondary elastic network interface

Design Secure Architectures - Question 9:

An analytics company is planning to offer a web analytics service to its users.
The service will require that the users’ webpages include a JavaScript script that
makes authenticated GET requests to the company’s Amazon S3 bucket. What
must a solutions architect do to ensure that the script will successfully execute?
A
Enable cross-origin resource sharing (CORS) on the S3 bucket.
B
Enable S3 Versioning on the S3 bucket.
C
Provide the users with a signed URL for the script.
D
Configure an S3 bucket policy to allow public execute privileges.

42 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 9:

A.

Web browsers will block running a script that originates from a server with a
domain name that is different from the webpage. Amazon S3 can be configured
with CORS to send HTTP headers that allow the script to run
Reference: Amazon S3 can be configured with CORS

Design Secure Architectures - Question 10:

The company Djamgatech’s security team requires that all data stored in the
cloud be encrypted at rest at all times using encryption keys stored on premises.
Which encryption options meet these requirements? (Select TWO.)
A
Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3).
B
Use server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
C
Use server-side encryption with customer-provided encryption keys (SSE-C).
D
Use client-side encryption to provide at-rest encryption.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 10:

C. D.

43 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Server-side encryption with customer-provided keys (SSE-C) enables Amazon S3
to encrypt objects on the server side using an encryption key provided in the PUT
request. The same key must be provided in the GET requests for Amazon S3 to
decrypt the object. Customers also have the option to encrypt data on the client
side before uploading it to Amazon S3, and then they can decrypt the data after
downloading it. AWS software development kits (SDKs) provide an S3 encryption
client that streamlines the process.
Reference: Server-side encryption with customer-provided keys (SSE-C)

Design Secure Architectures - Question 11:

The Djamgatech company has a two-tier application architecture that runs in
public and private subnets. Amazon EC2 instances running the web application
are in the public subnet and an EC2 instance for the database runs on the private
subnet. The web application instances and the database are running in a single
Availability Zone (AZ). Which combination of steps should a solutions architect
take to provide high availability for this architecture? (Select TWO.)
A
Create new public and private subnets in the same AZ.
B
Create an Amazon EC2 Auto Scaling group and Application Load Balancer spanning multiple AZs for the web application instances.
C
Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer.
D
Create new public and private subnets in the same VPC, each in a new AZ. Create an Amazon RDS Multi-AZ DB instance in the private
subnets. Migrate the old database contents to the new DB instance.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 11:

B. D.

Create new subnets in a new Availability Zone (AZ) to provide a redundant

network. Create an Auto Scaling group with instances in two AZs behind the load
balancer to ensure high availability of the web application and redistribution of
web traffic between the two public AZs. Create an RDS DB instance in the two
private subnets to make the database tier highly available too.
Reference: Auto Scaling group with instances in two AZs behind the load balancer

Design Secure Architectures - Question 12:

44 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Under which security model does AWS provide secure infrastructure and services, while
the customer is responsible for secure operating systems, platforms, and data?
A
Multiple Accountability Model
B
AAA Model
C
Shared Responsibility Model
D
Accountability and Answerability Model

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 12:

D.

The Shared Responsibility Model is the security model under which AWS
provides secure infrastructure and services, while the customer is responsible
for secure operating systems, platforms, and data
Reference: AWS Shared Responsibility Model

Design Secure Architectures - Question 13:

An analytics company is planning to offer a web analytics service to its users.
The service will require that the users’ webpages include a JavaScript script that
makes authenticated GET requests to the company’s Amazon S3 bucket. What
must a solutions architect do to ensure that the script will successfully execute?
A
Enable cross-origin resource sharing (CORS) on the S3 bucket.
B
Enable S3 Versioning on the S3 bucket.
C
Provide the users with a signed URL for the script.
D
Configure an S3 bucket policy to allow public execute privileges.

Your Answer: _______________

Your Notes: _____________________________________________________

45 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Secure Architectures - Answer 13:
A.

Web browsers will block running a script that originates from a server with a
domain name that is different from the webpage. Amazon S3 can be configured
with CORS to send HTTP headers that allow the script to run
Reference: Amazon S3 can be configured with CORS

Design Secure Architectures - Question 14:

The company Djamgatech's security team requires that all data stored in the
cloud be encrypted at rest at all times using encryption keys stored on premises.
Which encryption options meet these requirements? (Select TWO.)
A
Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3).
B
Use server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
C
Use server-side encryption with customer-provided encryption keys (SSE-C).
D
Use client-side encryption to provide at-rest encryption.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 14:

C. D.

Server-side encryption with customer-provided keys (SSE-C) enables Amazon S3

to encrypt objects on the server side using an encryption key provided in the PUT
request. The same key must be provided in the GET requests for Amazon S3 to
decrypt the object. Customers also have the option to encrypt data on the client
side before uploading it to Amazon S3, and then they can decrypt the data after
downloading it. AWS software development kits (SDKs) provide an S3 encryption
client that streamlines the process.
Reference: Server-side encryption with customer-provided keys (SSE-C)

Design Secure Architectures - Question 15:

46 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
An organization stores and manages financial records of various companies in its
on-premises data center, which is almost out of space. The management decided
to move all of their existing records to a cloud storage service. All future financial
records will also be stored in the cloud. For additional security, all records must
be prevented from being deleted or overwritten. Which of the following should
you do to meet the above requirement?
A
Use AWS Storage Gateway to establish hybrid cloud storage. Store all of your data in Amazon S3 and enable object lock.
B
Use AWS DataSync to move the data. Store all of your data in Amazon EFS and enable object lock.
C
Use AWS Storage Gateway to establish hybrid cloud storage. Store all of your data in Amazon EBS and enable object lock.
D
Use AWS DataSync to move the data. Store all of your data in Amazon S3 and enable object lock.

Your Answer: _______________

Your Notes: _____________________________________________________

47 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Secure Architectures - Answer 15:
D.

AWS DataSync allows you to copy large datasets with millions of files, without
having to build custom solutions with open source tools, or license and manage
expensive commercial network acceleration software. You can use DataSync to
migrate active data to AWS, transfer data to the cloud for analysis and
processing, archive data to free up on-premises storage capacity, or replicate
data to AWS for business continuity. AWS DataSync enables you to migrate your
on-premises data to Amazon S3, Amazon EFS, and Amazon FSx for Windows File
Server. You can configure DataSync to make an initial copy of your entire dataset,
and schedule subsequent incremental transfers of changing data towards
Amazon S3. Enabling S3 Object Lock prevents your existing and future records
from being deleted or overwritten. AWS DataSync is primarily used to migrate
existing data to Amazon S3. On the other hand, AWS Storage Gateway is more
suitable if you still want to retain access to the migrated data and for ongoing
updates from your on-premises file-based applications.
Reference: AWS DataSync

Design Secure Architectures - Question 16:

The company Djamagtech has 3 DevOps engineers that are handling its software
development and infrastructure management processes. One of the engineers
accidentally deleted a file hosted in Amazon S3 which has caused disruption of
service. What can the DevOps engineers do to prevent this from happening
again?
A
Set up a signed URL for all users.
B
Use S3 Infrequently Accessed storage to store the data.
C
Enable S3 Versioning and Multi-Factor Authentication Delete on the bucket.
D
Create an IAM bucket policy that disables delete operation.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 16:

C.

48 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
To avoid accidental deletion in Amazon S3 bucket, you can: – Enable Versioning,
– Enable MFA (Multi-Factor Authentication) Delete. Versioning is a means of
keeping multiple variants of an object in the same bucket. You can use versioning
to preserve, retrieve, and restore every version of every object stored in your
Amazon S3 bucket. With versioning, you can easily recover from both unintended
user actions and application failures. If the MFA (Multi-Factor Authentication)
Delete is enabled, it requires additional authentication for either of the following
operations: – Change the versioning state of your bucket, – Permanently delete
an object version
Reference: Versioning

Design Secure Architectures - Question 17:

The company Djamgatech has a web application hosted on a fleet of EC2
instances located in two Availability Zones that are all placed behind an
Application Load Balancer. As a Solutions Architect, you have to add a health
check configuration to ensure your application is highly-available. Which health
checks will you implement?
A
TCP health check
B
HTTP or HTTPS health check
C
ICMP health check
D
FTP health check

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 17:

B.

49 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
A load balancer takes requests from clients and distributes them across the EC2
instances that are registered with the load balancer. You can create a load
balancer that listens to both the HTTP (80) and HTTPS (443) ports. If you specify
that the HTTPS listener sends requests to the instances on port 80, the load
balancer terminates the requests, and communication from the load balancer to
the instances is not encrypted. If the HTTPS listener sends requests to the
instances on port 443, communication from the load balancer to the instances is
encrypted. If your load balancer uses an encrypted connection to communicate
with the instances, you can optionally enable authentication of the instances.
This ensures that the load balancer communicates with an instance only if its
public key matches the key that you specified to the load balancer for this
purpose. The type of ELB that is mentioned in this scenario is an Application
Elastic Load Balancer. This is used if you want a flexible feature set for your web
applications with HTTP and HTTPS traffic. Conversely, it only allows 2 types of
health check: HTTP and HTTPS.
Reference: HTTP or HTTPS health check

Design Secure Architectures - Question 18:

The company Djamgatech launched an online platform that allows people to
easily buy, sell, spend, and manage their cryptocurrency. To meet the strict IT
audit requirements, each of the API calls on all of the AWS resources should be
properly captured and recorded. You used CloudTrail in the VPC to help you in
the compliance, operational auditing, and risk auditing of your AWS account. In
this scenario, where does CloudTrail store all of the logs that it creates?
A
Amazon S3
B
DynamoDB
C
A RDS instance
D
Amazon Redshift

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 18:

A.

50 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 CloudTrail is enabled on your AWS account when you create it. When activity
occurs in your AWS account, that activity is recorded in a CloudTrail event. You
can easily view events in the CloudTrail console by going to Event history. Event
history allows you to view, search, and download the past 90 days of supported
activity in your AWS account. In addition, you can create a CloudTrail trail to
further archive, analyze, and respond to changes in your AWS resources. A trail
is a configuration that enables delivery of events to an Amazon S3 bucket that
you specify. You can also deliver and analyze events in a trail with Amazon
CloudWatch Logs and Amazon CloudWatch Events. You can create a trail with
the CloudTrail console, the AWS CLI, or the CloudTrail API.
Reference: CloudTrail Logs storage

Design Secure Architectures - Question 19:

A large financial firm needs to set up a Linux bastion host to allow access to the
Amazon EC2 instances running in their VPC. For security purposes, only the
clients connecting from the corporate external public IP address 175.45.116.100
should have SSH access to the host. Which is the best option that can meet the
customer’s requirement?
A
Security Group Inbound Rule: Protocol – TCP. Port Range – 22, Source 175.45.116.100/32
B
Security Group Inbound Rule: Protocol – UDP, Port Range – 22, Source 175.45.116.100/32
C
Network ACL Inbound Rule: Protocol – TCP, Port Range-22, Source 175.45.116.100/0
D
Network ACL Inbound Rule: Protocol – UDP, Port Range – 22, Source 175.45.116.100/32

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 19:

A.

51 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
A bastion host is a special purpose computer on a network specifically designed
and configured to withstand attacks. The computer generally hosts a single
application, for example a proxy server, and all other services are removed or
limited to reduce the threat to the computer. When setting up a bastion host in
AWS, you should only allow the individual IP of the client and not the entire
network. Therefore, in the Source, the proper CIDR notation should be used. The
/32 denotes one IP address and the /0 refers to the entire network.
Reference: Ec2 Instance metadata

Design Secure Architectures - Question 20:

For data privacy, a healthcare company has been asked to comply with the Health
Insurance Portability and Accountability Act (HIPAA). The company stores all its
backups on an Amazon S3 bucket. It is required that data stored on the S3 bucket
must be encrypted. What is the best option to do this? (Select TWO.)
A
Store the data in encrypted EBS snapshots.
B
Before sending the data to Amazon S3 over HTTPS, encrypt the data locally first using your own encryption keys.
C
Enable Server-Side Encryption on an S3 bucket to make use of AES-128 encryption.
D
Enable Server-Side Encryption on an S3 bucket to make use of AES-256 encryption.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 20:

B. D.

52 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Server-side encryption is about data encryption at rest—that is, Amazon S3
encrypts your data at the object level as it writes it to disks in its data centers and
decrypts it for you when you access it. As long as you authenticate your request
and you have access permissions, there is no difference in the way you access
encrypted or unencrypted objects. For example, if you share your objects using a
pre-signed URL, that URL works the same way for both encrypted and
unencrypted objects. The options that say: Before sending the data to Amazon S3
over HTTPS, encrypt the data locally first using your own encryption keys and
Enable Server-Side Encryption on an S3 bucket to make use of AES-256
encryption are correct because these options are using client-side encryption
and Amazon S3-Managed Keys (SSE-S3) respectively. Client-side encryption is
the act of encrypting data before sending it to Amazon S3 while SSE-S3 uses
AES-256 encryption.
Reference: Encryption

Design Secure Architectures - Question 21:

A startup is building an AI-based face recognition application in AWS, where they store
millions of images in an S3 bucket. As the Solutions Architect, you have to ensure that
each and every image uploaded to their system is stored without any issues. What is the
correct indication that an object was successfully stored when you put objects in
Amazon S3?
A
You will receive an email from Amazon SNS informing you that the object is
successfully stored.
B
Amazon S3 has 99.999999999% durability hence, there is no need to confirm that data
was inserted.
C
HTTP 200 result code and MD5 checksum.
D
You will receive an SMS from Amazon SNS informing you that the object is successfully
stored.

Your Answer: _______________

Your Notes: _____________________________________________________

53 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Secure Architectures - Answer 21:
C.

If you triggered an S3 API call and got HTTP 200 result code and MD5 checksum,
then it is considered as a successful upload. The S3 API will return an error code
in case the upload is unsuccessful.
Reference: REST Object Post

Design Secure Architectures - Question 22:

The company Djamgatech has clients all across the globe that access product
files stored in several S3 buckets, which are behind each of their own CloudFront
web distributions. They currently want to deliver their content to a specific client,
and they need to make sure that only that client can access the data. Currently,
all of their clients can access their S3 buckets directly using an S3 URL or
through their CloudFront distribution. The Solutions Architect must serve the
private content via CloudFront only, to secure the distribution of files. Which
combination of actions should the Architect implement to meet the above
requirements? (Select TWO.)
A
Require the users to access the private content by using special CloudFront signed URLs or signed cookies.
B
Use AWS App Mesh to ensure that only their client can access the files.
C
Use S3 pre-signed URLs to ensure that only their client can access the files. Remove permission to use Amazon S3 URLs to read the files
for anyone else.
D
Restrict access to files in the origin by creating an origin access identity (OAI) and give it permission to read the files in the bucket.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 22:

A. D.

54 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Many companies that distribute content over the Internet want to restrict access
to documents, business data, media streams, or content that is intended for
selected users, for example, users who have paid a fee. To securely serve this
private content by using CloudFront, you can do the following: Require that your
users access your private content by using special CloudFront signed URLs or
signed cookies. Require that your users access your Amazon S3 content by
using CloudFront URLs, not Amazon S3 URLs. Requiring CloudFront URLs isn’t
necessary, but it is recommended to prevent users from bypassing the
restrictions that you specify in signed URLs or signed cookies. You can do this
by setting up an origin access identity (OAI) for your Amazon S3 bucket. You can
also configure the custom headers for a private HTTP server or an Amazon S3
bucket configured as a website endpoint. All objects and buckets by default are
private. The pre-signed URLs are useful if you want your user/customer to be able
to upload a specific object to your bucket, but you don’t require them to have
AWS security credentials or permissions. You can generate a pre-signed URL
programmatically using the AWS SDK for Java or the AWS SDK for .NET. If you
are using Microsoft Visual Studio, you can also use AWS Explorer to generate a
pre-signed object URL without writing any code. Anyone who receives a valid
pre-signed URL can then programmatically upload an object.
Reference: Presigned Objects

Design Secure Architectures - Question 23:

A web application is using CloudFront to distribute their images, videos, and other static
contents stored in their S3 bucket to its users around the world. The company has
recently introduced a new member-only access to some of its high quality media files.
There is a requirement to provide access to multiple private media files only to their
paying subscribers without having to change their current URLs. Which of the following
is the most suitable solution that you should implement to satisfy this require ment?
A
Configure your CloudFront distribution to use Field-Level Encryption to protect your private data and only allow access to members.
B
Create a Signed URL with a custom policy which only allows the members to see the private files.
C
Use Signed Cookies to control who can access the private files in your CloudFront distribution by modifying your application to determine
whether a user should have access to your content. For members, send the required Set -Cookie headers to the viewer which will unlock the
content only to them.
D
Configure your CloudFront distribution to use Match Viewer as its Origin Protocol Policy which will automatically match the u ser request. This
will allow access to the private content if the request is a paying member and deny it if it is not a member.

Your Answer: _______________

55 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes: _____________________________________________________

Design Secure Architectures - Answer 23:

C.

CloudFront signed URLs and signed cookies provide the same basic
functionality: they allow you to control who can access your content. If you want
to serve private content through CloudFront and you’re trying to decide whether
to use signed URLs or signed cookies, consider the following: Use signed URLs
for the following cases: 1- You want to use an RTMP distribution. Signed cookies
aren’t supported for RTMP distributions., 2-You want to restrict access to
individual files, for example, an installation download for your application., 3-
Your users are using a client (for example, a custom HTTP client) that doesn’t
support cookies. Use signed cookies for the following cases: You want to provide
access to multiple restricted files, for example, all of the files for a video in HLS
format or all of the files in the subscribers’ area of a website. 2- You don’t want to
change your current URLs.
Reference: Signed Cookies

Design Secure Architectures - Question 24:

A top IT Consultancy has a VPC with two On-Demand EC2 instances with Elastic IP
addresses. You were notified that the EC2 instances are currently under SSH brute force
attacks over the Internet. The IT Security team has identified the IP addresses where
these attacks originated. You have to immediately implement a t emporary fix to stop
these attacks while the team is setting up AWS WAF, GuardDuty, and AWS Shield
Advanced to permanently fix the security vulnerability. Which of the following provides
the quickest way to stop the attacks to the instances?
A
Place the EC2 instances into private subnets
B
Block the IP addresses in the Network Access Control List
C
Assign a static Anycast IP address to each EC2 instance
D
Remove the Internet Gateway from the VPC

Your Answer: _______________

Your Notes: _____________________________________________________

56 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Secure Architectures - Answer 24:
B.

A network access control list (ACL) is an optional layer of security for your VPC
that acts as a firewall for controlling traffic in and out of one or more subnets.
You might set up network ACLs with rules similar to your security groups in
order to add an additional layer of security to your VPC. The scenario clearly
states that it requires the quickest way to fix the security vulnerability. In this
situation, you can manually block the offending IP addresses using Network
ACLs since the IT Security team already identified the list of offending IP
addresses. Alternatively, you can set up a bastion host, however, this option
entails additional time to properly set up as you have to configure the security
configurations of your bastion host. Hence, blocking the IP addresses in the
Network Access Control List is the best answer since it can quickly resolve the
issue by blocking the IP addresses using Network ACL.
Reference: VPC ACLs

Design Secure Architectures - Question 25:

The company Djamgatech developed a meal planning application that provides meal
recommendations for the week as well as the food consumption of the users. The
application resides on an EC2 instance which requires access to various AWS services
for its day-to-day operations. Which of the following is the best way to allow the EC2
instance to access the S3 bucket and other AWS services?
A
Add the API Credentials in the Security Group and assign it to the EC2 instance.
B
Store the API credentials in the EC2 instance.
C
Store the API credentials in a bastion host.
D
Create a role in IAM and assign it to the EC2 instance.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 25:

D.

57 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 The best practice in handling API Credentials is to create a new role in the
Identity Access Management (IAM) service and then assign it to a specific EC2
instance. In this way, you have a secure and centralized way of storing and
managing your credentials. Storing the API credentials in the EC2 instance,
adding the API Credentials in the Security Group and assigning it to the EC2
instance, and storing the API credentials in a bastion host are incorrect because
it is not secure to store nor use the API credentials from an EC2 instance. You
should use IAM service instead.
Reference: IAM Role

Design Secure Architectures - Question 26:

A local bank has an in-house application that handles sensitive financial data in a private
subnet. After the data is processed by the EC2 worker instances, they will be delivered to
S3 for ingestion by other services. How should you design this solution so that the data
does not pass through the public Internet?
A
Create an Internet gateway in the public subnet with a corresponding route entry that directs the data to S3.
B
Configure a VPC Endpoint along with a corresponding route entry that directs the data to S3.
C
Configure a Transit gateway along with a corresponding route entry that directs the data to S3.
D
Provision a NAT gateway in the private subnet with a corresponding route entry that directs the data to S3.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 26:

B.

58 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 The important concept that you have to understand in this scenario is that your
VPC and your S3 bucket are located within the larger AWS network. However, the
traffic coming from your VPC to your S3 bucket is traversing the public Internet
by default. To better protect your data in transit, you can set up a VPC endpoint
so the incoming traffic from your VPC will not pass through the public Internet,
but instead through the private AWS network. A VPC endpoint enables you to
privately connect your VPC to supported AWS services and VPC endpoint
services powered by PrivateLink without requiring an Internet gateway, NAT
device, VPN connection, or AWS Direct Connect connection. Instances in your
VPC do not require public IP addresses to communicate with resources in the
service. Traffic between your VPC and the other services does not leave the
Amazon network. Endpoints are virtual devices. They are horizontally scaled,
redundant, and highly available VPC components that allow communication
between instances in your VPC and services without imposing availability risks
or bandwidth constraints on your network traffic.
Reference: VPC Endpoints

Design Secure Architectures - Question 27:

In the Djamgatech company that you are working for, there is a requirement to allow one
IAM user to modify the configuration of one of your Elastic Load Balancers (ELB) which
is used in a specific project. Each developer in your Djamgatech company has an
individual IAM user and they usually move from one project to another. Which of the
following would be the best way to allow this access?
A
Create a new IAM Role which will be assumed by the IAM user. Attach a policy allowing access to modify the ELB and once it is done,
remove the IAM role from the user.
B
Open up the port that ELB uses in a security group and then give the user access to that security group via a policy.
C
Create a new IAM user that has access to modify the ELB. Delete that user when the work is completed.
D
Provide the user temporary access to the root account for 8 hours only. Afterwards, change the password once the activity is completed.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 27:

A.

59 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 In this scenario, the best option is to use IAM Role to provide access. You can
create a new IAM Role then associate it to the IAM user. Attach a policy allowing
access to modify the ELB and once it is done, remove the IAM role to the user. An
IAM role is similar to a user in that it is an AWS identity with permission policies
that determine what the identity can and cannot do in AWS. However, instead of
being uniquely associated with one person, a role is intended to be assumable by
anyone who needs it. Also, a role does not have standard long-term credentials
(password or access keys) associated with it. Instead, if a user assumes a role,
temporary security credentials are created dynamically and provided to the user.
You can use roles to delegate access to users, applications, or services that don’t
normally have access to your AWS resources. For example, you might want to
grant users in your AWS account access to resources they don’t usually have, or
grant users in one AWS account access to resources in another account. Or you
might want to allow a mobile app to use AWS resources, but not want to embed
AWS keys within the app (where they can be difficult to rotate and where users
can potentially extract them). Sometimes you want to give AWS access to users
who already have identities defined outside of AWS, such as in your corporate
directory. Or, you might want to grant access to your account to third parties so
that they can perform an audit on your resources.
Reference: Create IAM Roles for Users

Design Secure Architectures - Question 28:

A Solutions Architect is unable to connect to the newly deployed EC2 instance via SSH
using a home computer. However, the Architect was able to successfully access other
existing instances in the VPC without any issues. Which of the following should the
Architect check and possibly correct to restore connectivity?
A
Configure the Security Group of the EC2 instanc e to permit ingress traffic over port 3389 from your IP.
B
Configure the Network Access Control List of your VPC to permit ingress traffic over port 22 from your IP.
C
Use Amazon Data Lifecycle Manager.
D
Configure the Security Group of the EC2 instance to permit ingress traffic over port 22 from your IP.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 28:

60 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 D.

When connecting to your EC2 instance via SSH, you need to ensure that port 22
is allowed on the security group of your EC2 instance. A security group acts as a
virtual firewall that controls the traffic for one or more instances. When you
launch an instance, you associate one or more security groups with the instance.
You add rules to each security group that allow traffic to or from its associated
instances. You can modify the rules for a security group at any time; the new
rules are automatically applied to all instances that are associated with the
security group.
Reference: using Network Security

Design Secure Architectures - Question 29:

An application is hosted in an Auto Scaling group of EC2 instances and a Microsoft SQL
Server on Amazon RDS. There is a requirement that all in -flight data between your web
servers and RDS should be secured. Which of the following options is the MOST suitable
solution that you should implement? (Select TWO.)
A
Force all connections to your DB instance to use SSL by setting the rds.force_ssl parameter to true. Once done, reboot your DB instance.
B
Download the Amazon RDS Root CA certificate. Import the certificate to your servers and configure your application to use SSL to encrypt
the connection to RDS.
C
Specify the TDE option in an RDS option group that is associated with that DB instance to enable transparent data encryption (TDE).
D
Configure the security groups of your EC2 instances and RDS to only allow traffic to and from port 443.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 29:

A. B.

61 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 You can use Secure Sockets Layer (SSL) to encrypt connections between your
client applications and your Amazon RDS DB instances running Microsoft SQL
Server. SSL support is available in all AWS regions for all supported SQL Server
editions. When you create an SQL Server DB instance, Amazon RDS creates an
SSL certificate for it. The SSL certificate includes the DB instance endpoint as the
Common Name (CN) for the SSL certificate to guard against spoofing attacks.
You can force all connections to your DB instance to use SSL, or you can encrypt
connections from specific client computers only. To use SSL from a specific
client, you must obtain certificates for the client computer, import certificates on
the client computer, and then encrypt the connections from the client computer. If
you want to force SSL, use the rds.force_ssl parameter. By default, the
rds.force_ssl parameter is set to false. Set the rds.force_ssl parameter to true to
force connections to use SSL. The rds.force_ssl parameter is static, so after you
change the value, you must reboot your DB instance for the change to take effect.
Reference: SQL Server Concepts SSL

Design Secure Architectures - Question 30:

An online events registration system is hosted in AWS and uses ECS to host its front -
end tier and an RDS configured with Multi-AZ for its database tier. What are the events
that will make Amazon RDS automatically perform a failover to the standby repli ca?
(Select TWO.)
A
Loss of availability in primary Availability Zone
B
In the event of Read Replica failure
C
Compute unit failure on secondary DB instance
D
Storage failure on primary

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 30:

A. D.

62 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon RDS provides high availability and failover support for DB instances
using Multi-AZ deployments. Amazon RDS uses several different technologies to
provide failover support. Multi-AZ deployments for Oracle, PostgreSQL, MySQL,
and MariaDB DB instances use Amazon’s failover technology. SQL Server DB
instances use SQL Server Database Mirroring (DBM). In a Multi-AZ deployment,
Amazon RDS automatically provisions and maintains a synchronous standby
replica in a different Availability Zone. The primary DB instance is synchronously
replicated across Availability Zones to a standby replica to provide data
redundancy, eliminate I/O freezes, and minimize latency spikes during system
backups. Running a DB instance with high availability can enhance availability
during planned system maintenance, and help protect your databases against DB
instance failure and Availability Zone disruption. Amazon RDS detects and
automatically recovers from the most common failure scenarios for Multi-AZ
deployments so that you can resume database operations as quickly as possible
without administrative intervention. The high-availability feature is not a scaling
solution for read-only scenarios; you cannot use a standby replica to serve read
traffic. To service read-only traffic, you should use a Read Replica. Amazon RDS
automatically performs a failover in the event of any of the following: 1- Loss of
availability in primary Availability Zone. 2-Loss of network connectivity to
primary. 3-Compute unit failure on primary. 4-Storage failure on primary.
Reference: RDS Multi-AZ

Design Secure Architectures - Question 31:

An organization needs to control the access for several S3 buckets. They plan to use a
gateway endpoint to allow access to trusted buckets. Which of the following could help
you achieve this requirement?
A
Generate an endpoint policy for trusted VPCs.
B
Generate an endpoint policy for trusted S3 buckets.
C
Generate a bucket policy for trusted S3 buckets.
D
Generate a bucket policy for trusted VPCs.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 31:

63 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 B.

A VPC endpoint enables you to privately connect your VPC to supported AWS
services and VPC endpoint services powered by AWS PrivateLink without
requiring an internet gateway, NAT device, VPN connection, or AWS Direct
Connect connection. Instances in your VPC do not require public IP addresses to
communicate with resources in the service. Traffic between your VPC and the
other service does not leave the Amazon network. When you create a VPC
endpoint, you can attach an endpoint policy that controls access to the service to
which you are connecting. You can modify the endpoint policy attached to your
endpoint and add or remove the route tables used by the endpoint. An endpoint
policy does not override or replace IAM user policies or service-specific policies
(such as S3 bucket policies). It is a separate policy for controlling access from
the endpoint to the specified service. We can use a bucket policy or an endpoint
policy to allow the traffic to trusted S3 buckets. The options that have ‘trusted S3
buckets’ key phrases will be the possible answer in this scenario. It would take
you a lot of time to configure a bucket policy for each S3 bucket instead of using
a single endpoint policy. Therefore, you should use an endpoint policy to control
the traffic to the trusted Amazon S3 buckets.
Reference: VPC Endpoints S3

Design Secure Architectures - Question 32:

Djamgatech’s media company needs to configure an Amazon S3 bucket to serve static
assets for the public-facing web application. Which methods ensure that all of the
objects uploaded to the S3 bucket can be read publicly all over the Internet? (Select
TWO.)
A
Create an IAM role to set the objects inside the S3 bucket to public read.
B
Grant public read access to the object when uploading it us ing the S3 Console.
C
Configure the cross-origin resource sharing (CORS) of the S3 bucket to allow objects to be publicly accessible from all domains.
D
Configure the S3 bucket policy to set all objects to public read.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 32:

B. D.

64 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 By default, all Amazon S3 resources such as buckets, objects, and related sub-
resources are private which means that only the AWS account holder (resource
owner) that created it has access to the resource. The resource owner can
optionally grant access permissions to others by writing an access policy. In S3,
you also set the permissions of the object during upload to make it public.
Amazon S3 offers access policy options broadly categorized as resource-based
policies and user policies. Access policies you attach to your resources (buckets
and objects) are referred to as resource-based policies. For example, bucket
policies and access control lists (ACLs) are resource-based policies. You can
also attach access policies to users in your account. These are called user
policies. You may choose to use resource-based policies, user policies, or some
combination of these to manage permissions to your Amazon S3 resources. You
can also manage the public permissions of your objects during upload. Under
Manage public permissions, you can grant read access to your objects to the
general public (everyone in the world), for all of the files that you’re uploading.
Granting public read access is applicable to a small subset of use cases such as
when buckets are used for websites.
Reference: S3 Access Control

Design Secure Architectures - Question 33:

A Djamgatech company that you are working for has undertaken a Total Cost Of
Ownership (TCO) analysis evaluating the use of Amazon S3 versus acquiring more
storage hardware. The result was that all 1200 employees would be granted access to
use Amazon S3 for the storage of their personal documents. Which of the following will
you need to consider so you can set up a solution that incorporates a single sign-on
feature from your corporate AD or LDAP directory and also restricts acces s for each
individual user to a designated user folder in an S3 bucket? (Select TWO.)
A
Configure an IAM role and an IAM Policy to access the bucket.
B
Set up a Federation proxy or an Identity provider, and use AWS Security Token Service to generate temporary tokens.
C
Set up a matching IAM user for each of the 1200 users in your corporate directory that needs access to a folder in the S3 bucket.
D
Map each individual user to a designated user folder in S3 using Amazon WorkDocs to access their personal docu ments.

Your Answer: _______________

Your Notes: _____________________________________________________

65 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Secure Architectures - Answer 33:
A. B.

The question refers to one of the common scenarios for temporary credentials in
AWS. Temporary credentials are useful in scenarios that involve identity
federation, delegation, cross-account access, and IAM roles. In this example, it is
called enterprise identity federation considering that you also need to set up a
single sign-on (SSO) capability. In an enterprise identity federation, you can
authenticate users in your organization’s network, and then provide those users
access to AWS without creating new AWS identities for them and requiring them
to sign in with a separate user name and password. This is known as the single
sign-on (SSO) approach to temporary access. AWS STS supports open standards
like Security Assertion Markup Language (SAML) 2.0, with which you can use
Microsoft AD FS to leverage your Microsoft Active Directory. You can also use
SAML 2.0 to manage your own solution for federating user identities.
Reference: ID Roles Providers SAML

Design Secure Architectures - Question 34:

A mobile application stores pictures in Amazon Simple Storage Service (S3) and allows
application sign-in using an OpenID Connect-compatible identity provider. Which AWS
Security Token Service approach to temporary access should you use for this scenario?
A
Cross-Account Access
B
AWS Identity and Access Management roles
C
SAML-based Identity Federation
D
Web Identity Federation

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 34:

D.

66 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 With web identity federation, you don’t need to create custom sign-in code or
manage your own user identities. Instead, users of your app can sign in using a
well-known identity provider (IdP) —such as Login with Amazon, Facebook,
Google, or any other OpenID Connect (OIDC)-compatible IdP, receive an
authentication token, and then exchange that token for temporary security
credentials in AWS that map to an IAM role with permissions to use the resources
in your AWS account. Using an IdP helps you keep your AWS account secure
because you don’t have to embed and distribute long-term security credentials
with your application.
Reference: OIDC

Design Secure Architectures - Question 35:

A Solutions Architect created a brand new IAM User with a default setting using AWS
CLI. This is intended to be used to send API requests to Amazon S3, DynamoDB,
Lambda, and other AWS resources of the Djamgatech company’s cloud infrastructure.
Which of the following must be done to allow the user to make API calls to the AWS
resources?
A
Do nothing as the IAM User is already capable of sending API calls to your AWS resources.
B
Assign an IAM Policy to the user to allow it to send API calls.
C
Create a set of Access Keys for the user and attach the necessary permissions.
D
Enable Multi-Factor Authentication for the user.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 35:

C.

67 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 You can choose the credentials that are right for your IAM user. When you use
the AWS Management Console to create a user, you must choose to at least
include a console password or access keys. By default, a brand new IAM user
created using the AWS CLI or AWS API has no credentials of any kind. You must
create the type of credentials for an IAM user based on the needs of your user.
Access keys are long-term credentials for an IAM user or the AWS account root
user. You can use access keys to sign programmatic requests to the AWS CLI or
AWS API (directly or using the AWS SDK). Users need their own access keys to
make programmatic calls to AWS from the AWS Command Line Interface (AWS
CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using
the APIs for individual AWS services. To fill this need, you can create, modify,
view, or rotate access keys (access key IDs and secret access keys) for IAM
users. When you create an access key, IAM returns the access key ID and secret
access key. You should save these in a secure location and give them to the user.
Reference: Credentials Access keys

Design Secure Architectures - Question 36:

An application is hosted on an EC2 instance with multiple EBS Volumes attached and
uses Amazon Neptune as its database. To improve data security, you encrypted all of the
EBS volumes attached to the instance to protect the confidential data stored in the
volumes. Which of the following statements are true about encrypted Amazon Elastic
Block Store volumes? (Select TWO.)
A
All data moving between the volume and the instance are encrypted.
B
Snapshots are automatically encrypted.
C
The volumes created from the encrypted snapshot are not encrypted.
D
Snapshots are not automatically encrypted.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Question 37:

68 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A tech startup has recently received a Series A round of funding to continue building
their mobile forex trading application. You are hired to set up their cloud architecture in
AWS and to implement a highly available, fault tolerant system. For their data base, they
are using DynamoDB and for authentication, they have chosen to use Cognito. Since the
mobile application contains confidential financial transactions, there is a requirement to
add a second authentication method that doesn’t rely solely on user name and
password. How can you implement this in AWS?
A
Integrate Cognito with Amazon SNS Mobile Push to allow additional authentication via SMS.
B
Add multi-factor authentication (MFA) to a user pool in Cognito to protect the identity of your users.
C
Develop a custom application that integrates with Cognito that implements a second layer of authentication.
D
Add a new IAM policy to a user pool in Cognito.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 37:

B.
You can add multi-factor authentication (MFA) to a user pool to protect the
identity of your users. MFA adds a second authentication method that doesn’t
rely solely on user name and password. You can choose to use SMS text
messages, or time-based one-time (TOTP) passwords as second factors in
signing in your users. You can also use adaptive authentication with its risk-
based model to predict when you might need another authentication factor. It’s
part of the user pool advanced security features, which also include protections
against compromised credentials.
Reference: Managing Security

Design Secure Architectures - Question 38:

The company Djamgatech has an existing VPC which is quite unutilized for the past few
months. The Business Manager instructed the Solutions Architect to integrate the
company’s on-premises data center and its VPC. The architect explained the list of tasks
that he’ll be doing and discussed the Virtual Private Network (VPN) connection. The
Business Manager is not tech-savvy but he is interested to know what a VPN is and its
benefits. What is one of the major advantages of having a VPN in AWS?
A

69 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 It enables you to establish a private and dedicated network connection between your network and your VPC
B
It provides a networking connection between two VPCs which enables you to route traffic between them using private IPv4 addre sses or
IPv6 addresses.
C
It provides a cost-effective, hybrid connection from your VPC to your on-premises data centers which bypasses the public Internet.
D
It allows you to connect your AWS cloud resources to your on-premises data center using secure and private sessions with IP Security
(IPSec) or Transport Layer Security (TLS) tunnels.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 38:

D.

Amazon VPC offers you the flexibility to fully manage both sides of your Amazon
VPC connectivity by creating a VPN connection between your remote network
and a software VPN appliance running in your Amazon VPC network. This option
is recommended if you must manage both ends of the VPN connection either for
compliance purposes or for leveraging gateway devices that are not currently
supported by Amazon VPC’s VPN solution. With a VPN connection, you can
connect to an Amazon VPC in the cloud the same way you connect to your
branches while establishing secure and private sessions with IP Security (IPSec)
or Transport Layer Security (TLS) tunnels.
Reference: VPn Connections

Design Secure Architectures - Question 39:

The company Djamgatech decided to change its third-party data analytics tool to a
cheaper solution. They sent a full data export on a CSV file which contains all of their
analytics information. You then save the CSV file to an S3 bucket for storage. Your
manager asked you to do some validation on the provided data export. In this scenario,
what is the most cost-effective and easiest way to analyze export data using standard
SQL?
A
Use a migration tool to load the CSV export file from S3 to a database that is designed f or online analytic processing (OLAP) such as AWS
RedShift. Run some queries once the data has been loaded to complete your validation.
B
Use mysqldump client utility to load the CSV export file from S3 to a MySQL RDS instance. Run some SQL queries once the data has been
loaded to complete your validation.
C
Create a migration tool to load the CSV export file from S3 to a DynamoDB instance. Once the data has been loaded, run querie s using
DynamoDB.
D
To be able to run SQL queries, use Amazon Athena to analyze the export data file in S3.

70 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 39:

D.

Amazon Athena is an interactive query service that makes it easy to analyze data
directly in Amazon Simple Storage Service (Amazon S3) using standard SQL.
With a few actions in the AWS Management Console, you can point Athena at
your data stored in Amazon S3 and begin using standard SQL to run ad-hoc
queries and get results in seconds. Athena is serverless, so there is no
infrastructure to set up or manage, and you pay only for the queries you run.
Athena scales automatically—executing queries in parallel—so results are fast,
even with large datasets and complex queries. Athena helps you analyze
unstructured, semi-structured, and structured data stored in Amazon S3.
Examples include CSV, JSON, or columnar data formats such as Apache Parquet
and Apache ORC. You can use Athena to run ad-hoc queries using ANSI SQL,
without the need to aggregate or load the data into Athena.
Reference: Athena

Design Secure Architectures - Question 40:

A Solutions Architect is working for a fast-growing startup that just started operations
during the past 3 months. They currently have an on-premises Active Directory and 10
computers. To save costs in procuring physical workstations, they decided to deploy
virtual desktops for their new employees in a virtual private cloud in AWS. The new cloud
infrastructure should leverage the existing security controls in AWS but can still
communicate with their on-premises network. Which set of AWS services will the
Architect use to meet these requirements?
A
AWS Directory Services, VPN connection, and AWS Identity and Access Management
B
AWS Directory Services, VPN connection, and Amazon S3
C
AWS Directory Services, VPN connection, and Amazon Workspaces
D
AWS Directory Services, VPN connection, and ClassicLink

71 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Architectures - Answer 40:

C.

or this scenario, the best answer is: AWS Directory Services, VPN connection,
and Amazon Workspaces. First, you need a VPN connection to connect the VPC
and your on-premises network. Second, you need AWS Directory Services to
integrate with your on-premises Active Directory and lastly, you need to use
Amazon Workspace to create the needed virtual desktops in your VPC.
Reference: Directoty Service

Design Resilient Architectures – Description

This exam domain is focused on designing resilient architectures on AWS and comprises 26% of
the exam. Task statements include:

Task Statement 1: Design scalable and loosely coupled architectures.

Task Statement 2: Design highly available and/or fault-tolerant architectures.
Understand the various block, file and object storage technologies such as
Amazon EBS, Instance Store, Amazon EFS and Amazon S3, and know their use
cases.
Be able to design multi-tier application architectures and know-how to decouple
application components using technologies such as Amazon SQS and Amazon
SWF.

Design Resilient Architectures - Cheat Sheets

In designing an environment, what four main points should a Solutions Architect
keep in mind?

- Cost-efficient,
- secure,

72 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
- Application session state,
- Undifferentiated heavy lifting:
What means undifferentiated heavy lifting?
The reality, of course, today is that if you come up with a great idea you don't get to go
quickly to a successful product. There's a lot of undifferentiated heavy lifting that stands
between your idea and that success. The kinds of things that I'm talking about when I
say undifferentiated heavy lifting are things like these: figuring out which servers to buy,
how many of them to buy, what time line to buy them.

Pillar of AWS Well-Architected Framework

- Operational Excellence: The ability to support development and run workloads

effectively, gain insight into their operations, and to continuously improve supporting
processes and procedures to deliver business value.
- Security: The security pillar encompasses the ability to protect data, systems, and
assets to take advantage of cloud technologies to improve your security.
- Reliability: The reliability pillar encompasses the ability of a workload to perform its
intended function correctly and consistently when it’s expected to. This includes the
ability to operate and test the workload through its total lifecycle.
- Performance Efficiency: The ability to use computing resources efficiently to meet
system requirements, and to maintain that efficiency as demand changes and
technologies evolve.
- Cost Optimization: The ability to run systems to deliver business value at the lowest
price point.

Placement Groups

Placement groups have the placement strategies of Cluster, Partition and Spread. With
the Partition placement strategy, instances in one partition do not share the underlying
hardware with other partitions. This strategy is suitable for distributed and replicated
workloads such as Cassandra.

Elastic Network Adapter (ENA)

Enhanced networking has two mechanisms: Elastic Network Adapter (ENA) and Intel
82599Virtual Function (VF) interface. For ENA, users can enable it with --ena-support.

ENI Hot Attach, Cold Attach, warm Attach

Best practices for configuring network interfaces: You can attach a network interface to
an instance when it's running (hot attach), when it's stopped (warm attach), or when the
instance is being launched (cold attach). You can detach secondary network interfaces
when the instance is running or stopped. However, you can't detach the primary
network interface. You can move a network interface from one instance to another, if
73 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
the instances are in the same Availability Zone and VPC but in different subnets. When
launching an instance using the CLI, API, or an SDK, you can specify the primary
network interface and additional network interfaces. Launching an Amazon Linux or
Windows Server instance with multiple network interfaces automatically configures
interfaces, private IPv4 addresses, and route tables on the operating system of the
instance. A warm or hot attach of an additional network interface may require you to
manually bring up the second interface, configure the private IPv4 address, and modify
the route table accordingly. Instances running Amazon Linux or Windows Server
automatically recognize the warm or hot attach and configure themselves. Attaching
another network interface to an instance (for example, a NIC teaming configuration)
cannot be used as a method to increase or double the network bandwidth to or from the
dual-homed instance. If you attach two or more network interfaces from the same
subnet to an instance, you may encounter networking issues such as asymmetric
routing. If possible, use a secondary private IPv4 address on the primary network
interface instead.

Route 53 Geolocation routing

Geolocation routing lets you choose the resources that serve your traffic based on the
geographic location of your users, meaning the location that DNS queries originate
from. For example, you might want all queries from Europe to be routed to an ELB in
the Frankfurt region. When you use geolocation routing, you can localize your content
and present some or all of your website in the language of your users. You can also use
geolocation routing to restrict distribution of content to only the locations in which you
have distribution rights. Another possible use is for balancing load across endpoints in a
predictable, easy-to-manage way, so that each user location is consistently routed to
the same endpoint.

EC2 Instances user data

When you launch an instance in Amazon EC2, you have the option of passing user data
to the instance that can be used to perform common automated configuration tasks and
even run scripts after the instance starts. You can pass two types of user data to
Amazon EC2: shell scripts and cloud-init directives.

What happens during Multi-AZ failover and how long does it take?

Failover is automatically handled by Amazon RDS so that you can resume database
operations as quickly as possible without administrative intervention. When failing over,
Amazon RDS simply flips the canonical name record (CNAME) f or your DB instance to
point at the standby, which is in turn promoted to become the new primary. We
encourage you to follow best practices and implement database connection retry at the
application layer. Failovers, as defined by the interval between the detection of the
failure on the primary and the resumption of transactions on the standby, typically
74 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
complete within one to two minutes. Failover time can also be affected by whether large
uncommitted transactions must be recovered; the use of adequately large instance
types is recommended with Multi-AZ for best results. AWS also recommends the use of
Provisioned IOPS with Multi-AZ instances for fast, predictable, and consistent
throughput performance.

AWS Personal Health Dashboard

AWS Personal Health Dashboard provides alerts and remediation guidance when AWS
is experiencing events that may impact you. While the Service Health Dashboard
displays the general status of AWS services, Personal Health Dashboard gives you a
personalized view of the performance and availability of the AWS services underlying
your AWS resources. The dashboard displays relevant and timely information to help
you manage events in progress, and provides proactive notification to help you plan for
scheduled activities. With Personal Health Dashboard, alerts are triggered by changes
in the health of AWS resources, giving you event visibility and guidance to help quickly
diagnose and resolve issues.

Memory utilization in CloudWatch

Memory utilization is not available as an out of the box metric in CloudWatch. You can,
however, collect memory metrics when you configure a custom metric for CloudWatch.

Amazon RDS Multi-AZ deployments

Amazon RDS Multi-AZ deployments provide enhanced availability and durability for
RDS database (DB) instances, making them a natural fit for production database
workloads. When you provision a Multi-AZ DB Instance, Amazon RDS automatically
creates a primary DB Instance and synchronously replicates the data to a standby
instance in a different Availability Zone (AZ). Each AZ runs on its own physically distinct,
independent infrastructure, and is engineered to be highly reliable. In case of an
infrastructure failure, Amazon RDS performs an automatic failover to the standby (or to
a read replica in the case of Amazon Aurora), so that you can resume database
operations as soon as the failover is complete. Since the endpoint for your DB Instance
remains the same after a failover, your application can resume database operation
without the need for manual administrative intervention.

What is NLB in AWS?

An NLB is a Network Load Balancer.

A Network Load Balancer functions at the fourth layer of the Open Systems
Interconnection (OSI) model. It can handle millions of requests per second. After the
load balancer receives a connection request, it selects a target from the target group for
the default rule. It attempts to open a TCP connection to the selected target on the port
75 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
specified in the listener configuration. When you enable an Availability Zone for the load
balancer, Elastic Load Balancing creates a load balancer node in the Availability Zone.
By default, each load balancer node distributes traffic across the registered targets in its
Availability Zone only. If you enable cross-zone load balancing, each load balancer
node distributes traffic across the registered targets in all enabled Availability Zones. It
is designed to handle tens of millions of requests per second while maintaining high
throughput at ultra low latency, with no effort on your part. The Network Load Balancer
is API-compatible with the Application Load Balancer, including full programmatic
control of Target Groups and Targets

How many types of VPC endpoints are available?

There are two types of VPC endpoints: (1) interface endpoints and (2) gateway
endpoints. Interface endpoints enable connectivity to services over AWS PrivateLink.

What is an example of encryption at rest?

When a file(s) is encrypted and the stored data is not in transit it's known as encryption
at rest.

When would vertical scaling be necessary?

When an application is built entirely into one source code, otherwise known as a
monolithic application.

RPO vs RTO
RTO: Fault-Tolerance allows for continuous operation throughout a failure, which can
lead to a low Recovery Time Objective.
RTO: High-Availability means automating tasks so that an instance will quickly
recover, which can lead to a low Recovery Time Objective.
RPO: Frequent backups reduce the time between the last backup and recovery point,
otherwise known as the Recovery Point Objective.
- High-Availability means the system will quickly recover from a failure event
- Fault-Tolerance means the system will maintain operations during a failure.

What are the characteristics of a tiered application?

In a tiered application, the presentation layer is separate from the logic layer; the logic
layer is separate from the data layer. Since parts of the application are isolated, they
can scale horizontally.

Design Resilient Architectures- Flashcards

AWS VPC
76 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Private network in AWS that you can use to deploy your resources.

Remember:
- Subnets allow you to partition your network inside your VPC (Availability Zone
resource)
- A public subnet is accessible from the internet
- A private subnet is not accessible from the internet
- Internet Gateways helps our VPC instances connect with the internet
- NAT Gateways (AWS-managed) & NAT Instances (self-managed) allow your
instances in your Private Subnets to access the internet while remaining private.
- NACL (Network ACL) is a firewall which controls traffic from and to subnet
- Security Groups are firewall that controls traffic to and from an ENI / an EC2 Instance
- VPC Flow Logs capture information about IP traffic going into your interfaces (VPC,
Subnet, ENI)
- VPC Peering Connect two VPC, privately using AWS' network
- VPC Endpoints allow you to connect to AWS Services using a private network instead
of the public www network resulting in enhanced security and lower latency to access
AWS services.
- Site to Site VPN connect an on-premises VPN to AWS
- Direct Connect (DX) establish a physical connection between on- premises and AWS
- With VPC traffic mirroring, you can detect network and security anomalies, gain
operational insights, implement compliance and security controls, and troubleshoot
issues.

AWS EC2
Elastic Compute Cloud allows users to rent virtual computers on which to run
their own computer applications.

77 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Remember:
- Amazon EC2 provides a truly elastic computing environment.
- Amazon EC2 enables you to increase or decrease capacity within minutes, not hours
or days.
- EC2 provides the capability to store data on virtual drives (EBS)
- Security Groups are the fundamental of network security in AWS
- Security Groups control how traffic is allowed into or out of our EC2 Machines.
- Security groups act as a "firewall" on EC2 instances
-EC2 On Demand:Pay for what you use (billing per second, after the first minute)
-EC2 Reserved Instances:Discount up to 75% compared to On-demand. Pay upfront
for what you use with long term commitment
-EC2 Spot Instances:Discount of up to 90% compared to On-demand. You can “lose”
your instance at any point of time if your max price is less than the current spot price
- EC2 Dedicated Hosts:Physical dedicated EC2 server for your use. Full control of EC2
Instance placement.

AWS S3
Object storage service that offers scalability, data availability, security, and
performance.

Remember:
- S3 is a universal namespace, meaning each S3 bucket you create must have a unique
name that is not being used by anyone else in the world.
78 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
- S3 is object based for files: i.e allows you to upload files.
- S3 has unlimited storage.
- Files are stored in Buckets.
- Not suitable to install OS on.
- S3 Encryption: Encryption In-Transit (SSL/TLS), Encryption At Rest
- S3 CORS (Cross Origin Resource Sharing)
- CORS defines a way for client web applications that are loaded in one domain to
interact with resources in a different domain.
- The best way to handle large objects uploads to the S3 service is to use the Multipart
upload API.
- You can enable versioning on a bucket, even if that bucket already has objects in it.
- Bucket names cannot start with a . or - characters. S3 bucket names can contain both
the . and - characters. There can only be one . or one - between labels. E.G mybucket-
com mybucket.com are valid names but mybucket--com and mybucket..com are not
valid bucket names.
- S3 Security: User based using IAM policies, Resource Based using Bucket policies
and ACL
- S3 Bucket Policies: JSON based policies( Resources, Actions, Effect, Principal)
- Use S3 bucket for policy to Grant public access to the bucket, Force objects to be
encrypted at upload, Grant access to another account
- S3 can host static websites and have them accessible on the www

79 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
AWS RDS

80 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Relational Database Service

Remember:
- RDS is a managed DB service for DB use SQL as a query language.
- It allows you to create databases in the cloud that are managed by AWS
- RDS DB Engines are: Amazon Aurora, Postgres, MySQL, MariaDB, Oracle, SQL
Server
- RDS is a managed service: Automated provisioning, OS patching,
- Continuous backups and restore
- Monitoring dashboards
- Read replicas for improved read performance
- Multi AZ setup for DR (Disaster Recovery)
- Maintenance windows for upgrades
- Scaling capability (vertical and horizontal)
- Storage backed by EBS (gp2 or io1)
- Backups are automatically enabled in RDS
- RDS Security - Encryption: at rest encryption, • In-flight encryption
- Aurora is a proprietary technology from AWS (not open sourced)
- Postgres and MySQL are both supported as Aurora DB
- Aurora is “AWS cloud optimized”
- Aurora storage automatically grows in increments of 10GB, up to 64 TB

AWS Lambda
Serverless compute service that runs your code in response to events and
automatically manages the underlying compute resources for you.

81 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Remember:
- Lambda: Virtual functions – no servers to manage!
- Lambda: Limited by time - short executions
- Run on-demand
- Scaling is automated!
- Lambda natively supports Java, Go, PowerShell, Node.js, C#, Python, and Ruby
- Lambda provides a Runtime API which allows you to use any additional programming
languages to author your functions.
- A Lambda deployment package contains Function code and libraries not included
within the runtime environment
- Long-running memory-intensive workloads is LEAST suited to AWS Lambda
- Logs for Lambda functions are Stored in AWS CloudWatch

82 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 83 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 84 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 85 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 86 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Design Resilient Architectures – Illustrations

Disaster recovery compliance in the cloud

AWS Regions, AZs, and data centers

87 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Achieving Operational Resilience in the Financial Sector and Beyond

Maximum Resiliency for Critical Workloads

88 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Two data center model for on-premises resilience strategies

89 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Risk classification matrix for infrastructure res ilience

Design Resilient Architectures – Quiz

Design Resilient Architectures - Question 1:
_____ allows you to transform data using SQL as it's being passed through Kinesis.
A
RDS
B
Kinesis Data Analytics
C
Redshift
D
DynamoDB

Your Answer: _______________

90 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 1:

B.

Kinesis Data Analytics allows you to transform data using SQL.

Reference: Amazon Kinesis Data Analytics -

Design Resilient Architectures - Question 2:

The company Djamgatech has an auto scaling group of EC2 instances hosting their retail
sales application. Any significant downtime for this application can result in large losses
of profit. Therefore the architecture also includes an Application Load Balancer and an
RDS database in a Multi-AZ deployment. The Djamgatech company has a very aggressive
Recovery Time Objective (RTO) in case of disaster. How long will a failover typically
complete?
A
Under 10 minutes
B
Within an hour
C
Almost instantly
D
one to two minutes

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 2:

D.

91 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 What happens during Multi-AZ failover and how long does it take? Failover is
automatically handled by Amazon RDS so that you can resume database
operations as quickly as possible without administrative intervention. When
failing over, Amazon RDS simply flips the canonical name record (CNAME) for
your DB instance to point at the standby, which is in turn promoted to become
the new primary. We encourage you to follow best practices and implement
database connection retry at the application layer. Failovers, as defined by the
interval between the detection of the failure on the primary and the resumption of
transactions on the standby, typically complete within one to two minutes.
Failover time can also be affected by whether large uncommitted transactions
must be recovered; the use of adequately large instance types is recommended
with Multi-AZ for best results. AWS also recommends the use of Provisioned
IOPS with Multi-AZ instances for fast, predictable, and consistent throughput
performance.
Reference: RDS FAQ

Design Resilient Architectures - Question 3:

The company Djamgatech runs an online voting system for a weekly live television
program. During broadcasts, users submit hundreds of tho usands of votes within
minutes to a front-end fleet of Amazon EC2 instances that run in an Auto Scaling group.
The EC2 instances write the votes to an Amazon RDS database. However, the database is
unable to keep up with the requests that come from the EC2 instances. A solutions
architect must design a solution that processes the votes in the most efficient manner
and without downtime. Which solution meets these requirements?
A
Migrate the front-end application to AWS Lambda. Use Amazon API Gateway to route user requests to the Lambda functions.
B
Scale the database horizontally by converting it to a Multi-AZ deployment. Configure the front-end application to write to both the primary and
secondary DB instances.
C
Configure the front-end application to send votes to an Amazon Simple Queue Service (Amazon SQS) queue. Provision worker instances to
read the SQS queue and write the vote information to the database.
D
Use Amazon EventBridge (Amazon CloudWatch Events) to create a scheduled event to re-provision the database with larger, memory
optimized instances during voting periods. When voting ends, re-provision the database to use smaller instances.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 3:

92 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 C.

Decouple the ingestion of votes from the database to allow the voting system to
continue processing votes without waiting for the database writes. Add dedicated
workers to read from the SQS queue to allow votes to be entered into the
database at a controllable rate. The votes will be added to the database as fast as
the database can process them, but no votes will be lost.
Reference: Decouple

Design Secure Applications and Architectures -

Question 4:
The company Djamgatech has a two-tier application architecture that runs in public and
private subnets. Amazon EC2 instances running the web application are in the public
subnet and an EC2 instance for the database runs on the private subnet. The web
application instances and the database are running in a single Availability Zone (AZ).
Which combination of steps should a solutions architect take to provide high availability
for this architecture? (Select TWO.)
A
Create new public and private subnets in the same AZ.
B
Create an Amazon EC2 Auto Scaling group and Application Load Balancer spanning multiple AZs for the web application instances.
C
Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer.
D
Create new public and private subnets in the same VPC, each in a new AZ. Create an Amazon RDS Multi-AZ DB instance in the private
subnets. Migrate the old database contents to the new DB instance.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Secure Applications and Architectures -

Answer 4:
B. D.

93 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Create new subnets in a new Availability Zone (AZ) to provide a redundant
network. Create an Auto Scaling group with instances in two AZs behind the load
balancer to ensure high availability of the web application and redistribution of
web traffic between the two public AZs. Create an RDS DB instance in the two
private subnets to make the database tier highly available too.
Reference: Auto Scaling group with instances in two AZs behind the load balancer
Tags: #AWS #SAA #SAAC02 #SAAC03

Design Resilient Architectures - Question 5:

A website runs a custom web application that receives a burst of traffic each day at
noon. The users upload new pictures and content daily, but have been complaining of
timeouts. The architecture uses Amazon EC2 Auto Scaling groups, and the application
consistently takes 1 minute to initiate upon boot up before responding to user requests.
How should a solutions architect redesign the architecture to better respond to changing
traffic?
A
Configure a Network Load Balancer with a slow start configuration.
B
Configure Amazon ElastiCache for Redis to offload direct requests from the EC2 instances.
C
Configure an Auto Scaling step scaling policy with an EC2 instance warmup condition.
D
Configure Amazon CloudFront to use an Application Load Balancer as the origin.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 5:

C.

94 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 The current configuration puts new EC2 instances into service before they are
able to respond to transactions. This could also cause the instances to overscale.
With a step scaling policy, you can specify the number of seconds that it takes
for a newly launched instance to warm up. Until its specified warm-up time has
expired, an EC2 instance is not counted toward the aggregated metrics of the
Auto Scaling group. While scaling out, the Auto Scaling logic does not consider
EC2 instances that are warming up as part of the current capacity of the Auto
Scaling group. Therefore, multiple alarm breaches that fall in the range of the
same step adjustment result in a single scaling activity. This ensures that you do
not add more instances than you need.
Reference: Step scaling policy

Design Resilient Architectures - Question 6:

The company Djamgatech plans to migrate its on-premises workload to AWS. The
current architecture is composed of a Microsoft SharePoint server that uses a Windows
shared file storage. The Solutions Architect needs to use a cloud storage solution that is
highly available and can be integrated with Active Directory for access control and
authentication. Which of the following options can satisfy the given requirement?
A
Create a file system using Amazon EFS and join it to an Active Directory domain.
B
Create a file system using Amazon FSx for Windows File Server and join it to an Active Directory domain in AWS.
C
Create a Network File System (NFS) file share using AWS Storage Gateway.
D
Launch an Amazon EC2 Windows Server to mount a new S3 bucket as a file volume.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 6:

B.

95 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Amazon FSx for Windows File Server provides fully managed, highly reliable, and
scalable file storage that is accessible over the industry-standard Service
Message Block (SMB) protocol. It is built on Windows Server, delivering a wide
range of administrative features such as user quotas, end-user file restore, and
Microsoft Active Directory (AD) integration. Amazon FSx is accessible from
Windows, Linux, and MacOS compute instances and devices. Thousands of
compute instances and devices can access a file system concurrently.
Reference: FSx

Design Resilient Architectures - Question 7:

A Forex trading platform, which frequently processes and stores global financial data
every minute, is hosted in your on-premises data center and uses an Oracle database.
Due to a recent cooling problem in their data center, the Djamgatech company urgently
needs to migrate their infrastructure to AWS to improve the performance of their
applications. As the Solutions Architect, you are responsible in ensuring that the
database is properly migrated and should remain available in case of database server
failure in the future. Which of the following is the most suitable solution to meet the
requirement?
A
Create an Oracle database in RDS with Multi-AZ deployments.
B
Launch an Oracle database instance in RDS with Recovery Manager (RMAN) enabled.
C
Launch an Oracle Real Application Clusters (RAC) in RDS.
D
Convert the database schema using the AWS Schema Conversion Tool and AWS Database Migration Service. Migrate the Oracle database
to a non-cluster Amazon Aurora with a single instance.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 7:

A.

96 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon RDS Multi-AZ deployments provide enhanced availability and durability
for Database (DB) Instances, making them a natural fit for production database
workloads. When you provision a Multi-AZ DB Instance, Amazon RDS
automatically creates a primary DB Instance and synchronously replicates the
data to a standby instance in a different Availability Zone (AZ). Each AZ runs on
its own physically distinct, independent infrastructure, and is engineered to be
highly reliable.
Reference: RDS Multi AZ

Design Resilient Architectures - Question 8:

A Djamgatech data analytics company, which uses machine learning to collect and
analyze consumer data, is using Redshift cluster as their data warehouse. You are
instructed to implement a disaster recovery plan for their systems to ensure business
continuity even in the event of an AWS region outage. Which of the following is the best
approach to meet this requirement?
A
Do nothing because Amazon Redshift is a highly available, fully -managed data warehouse which can withstand an outage of an entire AWS
region.
B
Enable Cross-Region Snapshots Copy in your Amazon Redshift Cluster.
C
Create a scheduled job that will automatically take the snapshot of your Redshift Cluster and store it to an S3 bucket. Restore the snapshot
in case of an AWS region outage.
D
Use Automated snapshots of your Redshift Cluster.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 8:

B.

You can configure Amazon Redshift to copy snapshots for a cluster to another
region. To configure cross-region snapshot copy, you need to enable this copy
feature for each cluster and configure where to copy snapshots and how long to
keep copied automated snapshots in the destination region. When cross-region
copy is enabled for a cluster, all new manual and automatic snapshots are copied
to the specified region.
Reference: Redshift Snapshots

97 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Resilient Architectures - Question 9:
A Djamgatech start-up company has an EC2 instance that is hosting a web application.
The volume of users is expected to grow in the coming months and hence, you need to
add more elasticity and scalability in your AWS architecture to cope with the demand.
Which of the following options can satisfy the above requirement for the given scenario?
(Select TWO.)
A
Set up two EC2 instances and then put them behind an Elastic Load balancer (ELB).
B
Set up two EC2 instances deployed using Launch Templates and integrated with AWS Glue.
C
Set up an S3 Cache in front of the EC2 instance.
D
Set up two EC2 instances and use Route 53 to route traffic based on a Weighted Routing Policy.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 9:

A. D.

Using an Elastic Load Balancer is an ideal solution for adding elasticity to your
application. Alternatively, you can also create a policy in Route 53, such as a
Weighted routing policy, to evenly distribute the traffic to 2 or more EC2
instances. Hence, setting up two EC2 instances and then put them behind an
Elastic Load balancer (ELB) and setting up two EC2 instances and using Route 53
to route traffic based on a Weighted Routing Policy are the correct answers.
Reference: Elastic Load Balancing

Design Resilient Architectures - Question 10:

The company Djamgatech plans to deploy a Docker-based batch application in AWS. The
application will be used to process both mission-critical data as well as non-essential
batch jobs. Which of the following is the most cost-effective option to use in
implementing this architecture?
A
Use ECS as the container management service then set up Reserved EC2 Instances for processing both mission -critical and non-essential
batch jobs.
B
Use ECS as the container management service then set up a combination of Reserved and Spot EC2 Instan ces for processing mission-
critical and non-essential batch jobs respectively.
C

98 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Use ECS as the container management service then set up On-Demand EC2 Instances for processing both mission-critical and non-
essential batch jobs.
D
Use ECS as the container management service then set up Spot EC2 Instances for processing both mission-critical and non-essential batch
jobs.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 10:

B.

Amazon ECS lets you run batch workloads with managed or custom schedulers
on Amazon EC2 On-Demand Instances, Reserved Instances, or Spot Instances.
You can launch a combination of EC2 instances to set up a cost-effective
architecture depending on your workload. You can launch Reserved EC2
instances to process the mission-critical data and Spot EC2 instances for
processing non-essential batch jobs. There are two different charge models for
Amazon Elastic Container Service (ECS): Fargate Launch Type Model and EC2
Launch Type Model. With Fargate, you pay for the amount of vCPU and memory
resources that your containerized application requests while for EC2 launch type
model, there is no additional charge. You pay for AWS resources (e.g. EC2
instances or EBS volumes) you create to store and run your application. You only
pay for what you use, as you use it; there are no minimum fees and no upfront
commitments. In this scenario, the most cost-effective solution is to use ECS as
the container management service then set up a combination of Reserved and
Spot EC2 Instances for processing mission-critical and non-essential batch jobs
respectively. You can use Scheduled Reserved Instances (Scheduled Instances)
which enables you to purchase capacity reservations that recur on a daily,
weekly, or monthly basis, with a specified start time and duration, for a one-year
term. This will ensure that you have an uninterrupted compute capacity to
process your mission-critical batch jobs.
Reference: Emazon ECS

Design Resilient Architectures - Question 11:

99 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 The company Djamgatech has recently adopted a hybrid cloud architecture and is
planning to migrate a database hosted on-premises to AWS. The database currently has
over 50 TB of consumer data, handles highly transactional (OLTP) workloads, and is
expected to grow. The Solutions Architect should ensure that the database is ACID-
compliant and can handle complex queries of the application. Which type of database
service should the Architect use?
A
Amazon DynamoDB
B
Amazon RDS
C
Amazon Redshift
D
Amazon Aurora

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 11:

D.

Amazon Aurora (Aurora) is a fully managed relational database engine that’s

compatible with MySQL and PostgreSQL. You already know how MySQL and
PostgreSQL combine the speed and reliability of high-end commercial databases
with the simplicity and cost-effectiveness of open-source databases. The code,
tools, and applications you use today with your existing MySQL and PostgreSQL
databases can be used with Aurora. With some workloads, Aurora can deliver up
to five times the throughput of MySQL and up to three times the throughput of
PostgreSQL without requiring changes to most of your existing applications.
Aurora includes a high-performance storage subsystem. Its MySQL- and
PostgreSQL-compatible database engines are customized to take advantage of
that fast distributed storage. The underlying storage grows automatically as
needed, up to 64 tebibytes (TiB). Aurora also automates and standardizes
database clustering and replication, which are typically among the most
challenging aspects of database configuration and administration.
Reference: Aurora

Design Resilient Architectures - Question 12:

100 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 An online stocks trading application that stores financial data in an S3 bucket has a
lifecycle policy that moves older data to Glacier every month. There is a strict
compliance requirement where a surprise audit can happen at anytime and you should
be able to retrieve the required data in under 15 minutes under all circumstances. Your
manager instructed you to ensure that retrieval capacity is available when you need it
and should handle up to 150 MB/s of retrieval throughput. Which of the following should
you do to meet the above requirement? (Select TWO.)
A
Retrieve the data using Amazon Glacier Select.
B
Use Bulk Retrieval to access the financial data.
C
Purchase provisioned retrieval capacity.
D
Use Expedited Retrieval to access the financial data.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 12:

C. D.

Expedited retrievals allow you to quickly access your data when occasional
urgent requests for a subset of archives are required. For all but the largest
archives (250 MB+), data accessed using Expedited retrievals are typically made
available within 1–5 minutes. Provisioned Capacity ensures that retrieval capacity
for Expedited retrievals is available when you need it. To make an Expedited,
Standard, or Bulk retrieval, set the Tier parameter in the Initiate Job (POST jobs)
REST API request to the option you want, or the equivalent in the AWS CLI or
AWS SDKs. If you have purchased provisioned capacity, then all expedited
retrievals are automatically served through your provisioned capacity.
Provisioned capacity ensures that your retrieval capacity for expedited retrievals
is available when you need it. Each unit of capacity provides that at least three
expedited retrievals can be performed every five minutes and provides up to 150
MB/s of retrieval throughput. You should purchase provisioned retrieval capacity
if your workload requires highly reliable and predictable access to a subset of
your data in minutes. Without provisioned capacity Expedited retrievals are
accepted, except for rare situations of unusually high demand. However, if you
require access to Expedited retrievals under all circumstances, you must
purchase provisioned retrieval capacity.
Reference: Amazon Glacier

101 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Resilient Architectures - Question 13:
A multi-tiered application hosted in your on-premises data center is scheduled to be
migrated to AWS. The application has a message broker service which uses industry
standard messaging APIs and protocols that must be migrated as well, without rewriting
the messaging code in your application. Which of the following is the most suitable
service that you should use to move your messaging service to AWS?
A
Amazon MQ
B
Amazon SQS
C
Amazon SNS
D
Amazon SWF

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 13:

A.

Amazon MQ, Amazon SQS, and Amazon SNS are messaging services that are
suitable for anyone from startups to enterprises. If you’re using messaging with
existing applications and want to move your messaging service to the cloud
quickly and easily, it is recommended that you consider Amazon MQ. It supports
industry-standard APIs and protocols so you can switch from any standards-
based message broker to Amazon MQ without rewriting the messaging code in
your applications.
Reference: Amazon MQ

Design Resilient Architectures - Question 14:

An application is using a Lambda function to process complex financial data that run for
15 minutes on average. Most invocations were successfully processed. However, you
noticed that there are a few terminated invocations throughout the day, which caused
data discrepancy in the application. Which of the following is the most likely cause of
this issue?
A
The failed Lambda functions have been running for over 15 minutes and reached the maximum execution time.
B
The concurrent execution limit has been reached.
C

102 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 The Lambda function contains a recursive code and has been running for over 15 minutes.
D
The failed Lambda Invocations contain a ServiceException error which means that the AWS Lambda service encountered an internal error.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 14:

A.

A Lambda function consists of code and any associated dependencies. In

addition, a Lambda function also has configuration information associated with it.
Initially, you specify the configuration information when you create a Lambda
function. Lambda provides an API for you to update some of the configuration
data. You pay for the AWS resources that are used to run your Lambda function.
To prevent your Lambda function from running indefinitely, you specify a
timeout. When the specified timeout is reached, AWS Lambda terminates
execution of your Lambda function. It is recommended that you set this value
based on your expected execution time. The default timeout is 3 seconds and the
maximum execution duration per request in AWS Lambda is 900 seconds, which
is equivalent to 15 minutes.
Reference: Lambda

Design Resilient Architectures - Question 15:

The company Djamgatech has a top priority requirement to monitor a few database
metrics and then afterward, send email notifications to the Operations team in case there
is an issue. Which AWS services can accomplish this requirement? (Select TWO.)
A
Amazon Simple Queue Service (SQS)
B
Amazon CloudWatch
C
Amazon EC2 Instance with a running Berkeley Internet Name Domain (BIND) Server.
D
Amazon Simple Notification Service (SNS)

Your Answer: _______________

Your Notes: _____________________________________________________

103 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Resilient Architectures - Answer 15:
A. D.

Amazon CloudWatch and Amazon Simple Notification Service (SNS) are correct.
In this requirement, you can use Amazon CloudWatch to monitor the database
and then Amazon SNS to send the emails to the Operations team. Take note that
you should use SNS instead of SES (Simple Email Service) when you want to
monitor your EC2 instances.
Reference: CloudWatch

Design Resilient Architectures - Question 16:

The company Djamgatech is in the process of migrating their applications to AWS. One
of their systems requires a database that can scale globally and handle frequent schema
changes. The application should not have any downtime or performance issues
whenever there is a schema change in the database. It should also provide a low latency
response to high-traffic queries. Which is the most suitable database solution to use to
achieve this requirement?
A
Amazon DynamoDB
B
An Amazon RDS instance in Multi-AZ Deployments configuration
C
Redshift
D
An Amazon Aurora database with Read Replicas

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 16:

A.

Amazon DynamoDB helps solve the problems that limit the relational system
scalability by avoiding them. In DynamoDB, you design your schema specifically
to make the most common and important queries as fast and as inexpensive as
possible. Your data structures are tailored to the specific requirements of your
business use cases.
Reference: DynamoDB

104 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Resilient Architectures - Question 17:
A Djamgatech data analytics company, which uses machine learning to collect and
analyze consumer data, is using Redshift cluster as their data warehouse. You are
instructed to implement a disaster recovery plan for their systems to ensure business
continuity even in the event of an AWS region outage. Which of the following is the best
approach to meet this requirement?
A
Enable Cross-Region Snapshots Copy in your Amazon Redshift Cluster.
B
Use Automated snapshots of your Redshift Cluster.
C
Do nothing because Amazon Redshift is a highly available, fully -managed data warehouse which can withstand an outage of an entire AWS
region.
D
Create a scheduled job that will automatically take the snapshot of your Redshift Cluster and store it to an S3 bucket. Restore the snapshot
in case of an AWS region outage.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 17:

A.

You can configure Amazon Redshift to copy snapshots for a cluster to another
region. To configure cross-region snapshot copy, you need to enable this copy
feature for each cluster and configure where to copy snapshots and how long to
keep copied automated snapshots in the destination region. When cross-region
copy is enabled for a cluster, all new manual and automatic snapshots are copied
to the specified region.
Reference: Redshift Cross Region Snapshots copy

Design Resilient Architectures - Question 18:

The company Djamgatech has a set of Linux servers running on multiple On-Demand
EC2 Instances. The Audit team wants to collect and process the application log files
generated from these servers for their report. Which of the following services is best to
use in this case?
A
A single On-Demand Amazon EC2 instance for both storing and processing the log files
B
Amazon S3 Glacier for storing the application log files and Spot EC2 Instances for processing them.
C
Amazon S3 Glacier Deep Archive for storing the application log files and AWS ParallelCluster for processing the log files.

105 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 D
Amazon S3 for storing the application log files and Amazon Elastic MapReduce for processing the log files.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 18:

D.

Amazon EMR is a managed cluster platform that simplifies running big data
frameworks, such as Apache Hadoop and Apache Spark, on AWS to process and
analyze vast amounts of data. By using these frameworks and related open-
source projects such as Apache Hive and Apache Pig, you can process data for
analytics purposes and business intelligence workloads. Additionally, you can
use Amazon EMR to transform and move large amounts of data into and out of
other AWS data stores and databases such as Amazon Simple Storage Service
(Amazon S3) and Amazon DynamoDB.
Reference: Apache EMR

Design Resilient Architectures - Question 19:

The company Djamgatech plans to implement a network monitoring system in AWS. The
Solutions Architect launched an EC2 instance to host the monitoring system and used
CloudWatch to monitor, store, and access the log files of the instance. Which of the
following provides an automated way to send log data to CloudWatch Logs from the
Amazon EC2 instance?
A
CloudTrail with log file validation
B
CloudWatch Logs agent
C
AWS Transfer for SFTP
D
CloudTrail Processing Library

Your Answer: _______________

Your Notes: _____________________________________________________

106 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Resilient Architectures - Answer 19:
B.

CloudWatch Logs enables you to centralize the logs from all of your systems,
applications, and AWS services that you use, in a single, highly scalable service.
You can then easily view them, search them for specific error codes or patterns,
filter them based on specific fields, or archive them securely for future analysis.
CloudWatch Logs enables you to see all of your logs, regardless of their source,
as a single and consistent flow of events ordered by time, and you can query
them and sort them based on other dimensions, group them by specific fields,
create custom computations with a powerful query language, and visualize log
data in dashboards.
Reference: CloudWatch Logs

Design Resilient Architectures - Question 20:

An IT consultant is working for a large financial Djamgatech’s company. The role of the
consultant is to help the development team build a highly available web application using
stateless web servers. In this scenario, which AWS services are suitable for s toring
session state data? (Select TWO.)
A
DynamoDB
B
Redshift Spectrum
C
RDS
D
ElastiCache

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 20:

A. D.

DynamoDB and ElastiCache are the correct answers. You can store session state
data on both DynamoDB and ElastiCache. These AWS services provide high-
performance storage of key-value pairs which can be used to build a highly
available web application.
Reference: DynamoDB - ElastiCache

107 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Resilient Architectures - Question 21:
A Djamgatech’s company is currently using Auto Scaling for their web application. A new
AMI now needs to be used for launching a fleet of EC2 instances. Which of the following
changes needs to be done?
A
Create a new target group.
B
Create a new target group and launch configuration.
C
Create a new launch configuration.
D
Do nothing. You can start directly launching EC2 instances in the Auto Scaling group with the same launch configuration.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 21:

C.

A launch configuration is a template that an Auto Scaling group uses to launch

EC2 instances. When you create a launch configuration, you specify information
for the instances such as the ID of the Amazon Machine Image (AMI), the instance
type, a key pair, one or more security groups, and a block device mapping. If
you’ve launched an EC2 instance before, you specified the same information in
order to launch the instance.
Reference: launch configuration

Design Resilient Architectures - Question 22:

The company Djamgatech is planning to launch an application which requires a data
warehouse that will be used for their infrequently accessed data. You need to use an EBS
Volume that can handle large, sequential I/O operations. Which of the following is the
most cost-effective storage type that you should use to meet the requirement?
A
Cold HDD (sc1)
B
Provisioned IOPS SSD (io1)
C
EBS General Purpose SSD (gp2)
D
Throughput Optimized HDD (st1)

108 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 22:

A.

Cold HDD volumes provide low-cost magnetic storage that defines performance
in terms of throughput rather than IOPS. With a lower throughput limit than
Throughput Optimized HDD, this is a good fit ideal for large, sequential cold-data
workloads. If you require infrequent access to your data and are looking to save
costs, Cold HDD provides inexpensive block storage. Take note that bootable
Cold HDD volumes are not supported.
Reference: Cold HDD

Design Resilient Architectures - Question 23:

A Djamgatech company currently has an on-premises infrastructure. They are currently
running low on storage and want to have the ability to extend their storage using the
AWS cloud. Which AWS service can help them achieve this requirement?
A
Amazon EC2
B
Amazon Storage Gateway
C
Amazon Elastic Block Storage
D
Amazon SQS

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 23:

B.

109 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
AWS Storage Gateway connects an on-premises software appliance with cloud-
based storage to provide seamless integration with data security features
between your on-premises IT environment and the AWS storage infrastructure.
You can use the service to store data in the AWS Cloud for scalable and cost-
effective storage that helps maintain data security.
Reference: Amazon Storage Gateway

Design Resilient Architectures - Question 24:

A Solutions Architect needs to set up a bastion host in the cheapest, most secure way.
The Architect should be the only person that can access it via SSH. Which of the
following steps would satisfy this requirement?
A
Set up a small EC2 instance and a security group t hat only allows access on port 22
B
Set up a large EC2 instance and a security group that only allows access on port 22
C
Set up a large EC2 instance and a security group that only allows access on port 22 via your IP address
D
Set up a small EC2 instance and a security group that only allows access on port 22 via your IP address

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 24:

D.

A bastion host is a server whose purpose is to provide access to a private

network from an external network, such as the Internet. Because of its exposure
to potential attack, a bastion host must minimize the chances of penetration.
Reference: Bastion Host

Design Resilient Architectures - Question 25:

110 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A Forex trading platform, which frequently processes and stores global financial data
every minute, is hosted in your on-premises data center and uses an Oracle database.
Due to a recent cooling problem in their data center, the Djamgatech company urgently
needs to migrate their infrastructure to AWS to improve the performance of their
applications. As the Solutions Architect, you are responsible in ensuring that the
database is properly migrated and should remain available in case of database server
failure in the future. Which of the following is the most suitable solution to meet the
requirement?
A
Create an Oracle database in RDS with Multi-AZ deployments.
B
Launch an Oracle Real Application Clusters (RAC) in RDS.
C
Convert the database schema using the AWS Schema Conversion Tool and AWS Database Migration Service. Migrate the Oracle database
to a non-cluster Amazon Aurora with a single instance.
D
Launch an Oracle database instance in RDS with Recovery Manager (RMAN) enabled.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 25:

A.

Amazon RDS Multi-AZ deployments provide enhanced availability and durability

for Database (DB) Instances, making them a natural fit for production database
workloads. When you provision a Multi-AZ DB Instance, Amazon RDS
automatically creates a primary DB Instance and synchronously replicates the
data to a standby instance in a different Availability Zone (AZ). Each AZ runs on
its own physically distinct, independent infrastructure, and is engineered to be
highly reliable.
Reference: Multi-AZ

Design Resilient Architectures - Question 26:

111 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
The company Djamgatech installed sensors to track the number of people who visit the
park. The data is sent every day to an Amazon Kinesis stream with default settings for
processing, in which a consumer is configured to process the data every other day. You
noticed that the S3 bucket is not receiving all of the data that is being sent to the Kinesis
stream. You checked the sensors if they are properly sending the data to Amazon
Kinesis and verified that the data is indeed sent every day. What could be the reason for
this?
A
By default, the data records are only accessible for 24 hours from the time they are added to a Kinesis stream.
B
There is a problem in the sensors. They probably had some intermittent connection hence, the data is not sent to the stream.
C
By default, Amazon S3 stores the data for 1 day and moves it to Amazon Glacier.
D
Your AWS account was hacked and someone has deleted some data in your Kinesis stream.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 26:

A.

Kinesis Data Streams supports changes to the data record retention period of
your stream. A Kinesis data stream is an ordered sequence of data records meant
to be written to and read from in real-time. Data records are therefore stored in
shards in your stream temporarily.
Reference: Kinesis Data Stream

Design Resilient Architectures - Question 27:

The company Djamgatech has a running m5ad.large EC2 instance with a default attached
75 GB SSD instance-store backed volume. You shut it down and then start the instance.
You noticed that the data which you have saved earlier on the attached volume is no
longer available. What might be the cause of this?
A
The EC2 instance was using instance store volumes, which are ephemeral and only live for the life of the instance.
B
The instance was hit by a virus that wipes out all data.
C
The EC2 instance was using EBS backed root volumes, which are ephemeral and only live for the life of the instance.
D
The volume of the instance was not big enough to handle all of the processing data.

112 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 27:

A.

An instance store provides temporary block-level storage for your instance. This
storage is located on disks that are physically attached to the host computer.
Instance store is ideal for temporary storage of information that changes
frequently, such as buffers, caches, scratch data, and other temporary content, or
for data that is replicated across a fleet of instances, such as a load-balanced
pool of web servers.
Reference: Instance Storage

Design Resilient Architectures - Question 28:

The company Djamgatech plans to migrate its on-premises workload to AWS. The
current architecture is composed of a Microsoft SharePoint server that uses a Windows
shared file storage. The Solutions Architect needs to use a cloud storage solution that is
highly available and can be integrated with Active Directory for access control and
authentication. Which of the following options can satisfy the given requirement?
A
Create a file system using Amazon EFS and join it to an Active Directory domain.
B
Launch an Amazon EC2 Windows Server to mount a new S3 bucket as a file volume.
C
Create a Network File System (NFS) file share using AWS Storage Gateway.
D
Create a file system using Amazon FSx for Windows File Server and join it to an Active Directory domain in AWS.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 28:

D.

113 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Amazon FSx for Windows File Server provides fully managed, highly reliable, and
scalable file storage that is accessible over the industry-standard Service
Message Block (SMB) protocol. It is built on Windows Server, delivering a wide
range of administrative features such as user quotas, end-user file restore, and
Microsoft Active Directory (AD) integration. Amazon FSx is accessible from
Windows, Linux, and MacOS compute instances and devices. Thousands of
compute instances and devices can access a file system concurrently.
Reference: Amazon FSx

Design Resilient Architectures - Question 29:

An accounting application uses an RDS database configured with Multi -AZ deployments
to improve availability. What would happen to RDS if the primary database instance
fails?
A
The primary database instance will reboot.
B
A new database instance is created in the standby Availability Zone.
C
The canonical name record (CNAME) is switched from the primary to standby instance.
D
The IP address of the primary DB instance is switched to the standby DB instance.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 29:

C.

In Amazon RDS, failover is automatically handled so that you can resume

database operations as quickly as possible without administrative intervention in
the event that your primary database instance went down. When failing over,
Amazon RDS simply flips the canonical name record (CNAME) for your DB
instance to point at the standby, which is in turn promoted to become the new
primary.
Reference: Multi-AZ

Design Resilient Architectures - Question 30:

114 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A real-time data analytics application is using AWS Lambda to process data and store
results in JSON format to an S3 bucket. To speed up the existing workflow, you have to
use a service where you can run sophisticated Big Data analytics on your data without
moving them into a separate analytics system. Which of the following group of services
can you use to meet this requirement?
A
Amazon Glue, Glacier Select, Amazon Redshift
B
S3 Select, Amazon Athena, Amazon Redshift Spectrum
C
Amazon X-Ray, Amazon Neptune, DynamoDB
D
S3 Select, Amazon Neptune, DynamoDB DAX

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 30:

B.

Amazon S3 allows you to run sophisticated Big Data analytics on your data
without moving the data into a separate analytics system. In AWS, there is a suite
of tools that make analyzing and processing large amounts of data in the cloud
faster, including ways to optimize and integrate existing workflows with Amazon
S3:
Reference: S3

Design Resilient Architectures - Question 31:

A Network Architect developed a food ordering application. The Architect needs to
retrieve the instance ID, public keys, and public IP address of the EC2 server made for
tagging and grouping the attributes into the internal application running on-premises.
Which of the following options fulfills this requirement?
A
Instance metadata
B
Resource tags
C
Amazon Machine Image
D
Instance user data

Your Answer: _______________

115 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 31:

A.

Instance metadata is the data about your instance that you can use to configure
or manage the running instance. You can get the instance ID, public keys, public
IP address and many other information from the instance metadata by firing a
URL command in your instance to this URL http://169.254.169.254/latest/meta-
data/
Reference: EC2 Instance Meta Data

Design Resilient Architectures - Question 32:

A financial analytics application that collects, processes and analyzes stock data in real -
time is using Kinesis Data Streams. The producers continually push data to Kinesis Data
Streams while the consumers process the data in real time. In Amazon Kinesis, where
can the consumers store their results? (Select TWO.)
A
Amazon S3
B
Glacier Select
C
Amazon Redshift
D
AWS Glue

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 32:

A. C.

116 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
In Amazon Kinesis, the producers continually push data to Kinesis Data Streams
and the consumers process the data in real time. Consumers (such as a custom
application running on Amazon EC2, or an Amazon Kinesis Data Firehose
delivery stream) can store their results using an AWS service such as Amazon
DynamoDB, Amazon Redshift, or Amazon S3.
Reference: Amazon Kinesis

Design Resilient Architectures - Question 33:

The company Djamgatech plans to deploy an application in an Amazon EC2 instance.
The application will perform the following tasks: 1- Read large datasets from an Amazon
S3 bucket., 2- Execute multi-stage analysis on the datasets., 3- Save the results to
Amazon RDS. During multi-stage analysis, the application will store a large number of
temporary files in the instance storage. As the Solutions Architect, you need to
recommend the fastest storage option with high I/O performance for the temporary files.
Which of the following options fulfills this requirement?
A
Configure RAID 0 in multiple instance store volumes.
B
Configure RAID 1 in multiple instance store volumes.
C
Attach multiple Provisioned IOPS SSD volumes in the instance.
D
Enable Transfer Acceleration in Amazon S3.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 33:

A.

117 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
RAID 0 configuration enables you to improve your storage volumes’ performance
by distributing the I/O across the volumes in a stripe. Therefore, if you add a
storage volume, you get the straight addition of throughput and IOPS. This
configuration can be implemented on both EBS or instance store volumes. Since
the main requirement in the scenario is storage performance, you need to use an
instance store volume. It uses NVMe or SATA-based SSD to deliver high random
I/O performance. This type of storage is a good option when you need storage
with very low latency, and you don’t need the data to persist when the instance
terminates.
Reference: Instance Storage

Design Resilient Architectures - Question 34:

The company Djamgatech has a VPC for its human resource department, and another
VPC located in a different region for their finance department. The Solutions Architect
must redesign the architecture to allow the finance department to access all resources
that are in the human resource department, and vice versa. Which type of networking
connection in AWS should the Solutions Architect set up to satisfy the above
requirement?
A
VPN Connection
B
AWS Cloud Map
C
VPC Endpoint
D
Inter-Region VPC Peering

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 34:

D.

A VPC peering connection is a networking connection between two VPCs that

enables you to route traffic between them privately. Instances in either VPC can
communicate with each other as if they are within the same network. You can
create a VPC peering connection between your own VPCs, with a VPC in another
AWS account, or with a VPC in a different AWS Region.
Reference: VPC Peering

118 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Resilient Architectures - Question 35:
A Solutions Architect for a global news Djamgatech company is configuring a fleet of
EC2 instances in a subnet that currently is in a VPC with an Internet gateway atta ched.
All of these EC2 instances can be accessed from the Internet. The architect launches
another subnet and deploys an EC2 instance in it, however, the architect is not able to
access the EC2 instance from the Internet. What could be the possible reasons for this
issue? (Select TWO.)
A
The Amazon EC2 instance does not have a public IP address associated with it.
B
The Amazon EC2 instance is not a member of the same Auto Scaling group.
C
The Amazon EC2 instance does not have an attached Elastic Fabric Adapter (EFA).
D
The route table is not configured properly to send traffic from the EC2 instance to the Internet through the Intern et gateway.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 35:

A. D.

Amazon EC2 instance does not have a public IP address associated with it. The
route table is not configured properly to send traffic from the EC2 instance to the
Internet through the Internet gateway.
Reference: VPC
Tags: #AWS #SAA #SAAC02 #SAAC03

Design Resilient Architectures - Question 36:

The company Djamgatech has a web application that is relying entirely on slower disk-
based databases, causing it to perform slowly. To improve its performance, the Solutions
Architect integrated an in-memory data store to the web application using ElastiCache.
How does Amazon ElastiCache improve database performance?
A
It securely delivers data to customers globally with low latency and high transfer speeds.
B
It reduces the load on your database by routing read queries from your applications to the Read Replica.
C
It provides an in-memory cache that delivers up to 10x performance improvement f rom milliseconds to microseconds or even at millions of
requests per second.

119 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 D
By caching database query results.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 36:

D.

ElastiCache improves the performance of your database through caching query

results. The primary purpose of an in-memory key-value store is to provide ultra-
fast (submillisecond latency) and inexpensive access to copies of data. Most data
stores have areas of data that are frequently accessed but seldom updated.
Additionally, querying a database is always slower and more expensive than
locating a key in a key-value pair cache. Some database queries are especially
expensive to perform, for example, queries that involve joins across multiple
tables or queries with intensive calculations. By caching such query results, you
pay the price of the query once and then are able to quickly retrieve the data
multiple times without having to re-execute the query.
Reference: Elasticache

Design Resilient Architectures - Question 37:

An application running on AWS uses an Amazon Aurora Multi-AZ DB cluster deployment
for its database. When evaluating performance metrics, a solutions architect discovered
that the database reads are causing high I/O and adding latency to the write requests
against the database. What should the solutions architect do to separate the read
requests from the write requests?
A
Enable read-through caching on the Aurora database.
B
Update the application to read from the Multi-AZ standby instance.
C
Create an Aurora replica and modify the application to use the appropriate endpoints.
D
Create a second Aurora database and link it to the primary database as a read replica.

Your Answer: _______________

Your Notes: _____________________________________________________

120 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Resilient Architectures - Answer 37:
C.

Aurora Replicas provide a way to offload read traffic. Aurora Replicas share the
same underlying storage as the main database, so lag time is generally very low.
Aurora Replicas have their own endpoints, so the application will need to be
configured to direct read traffic to the new endpoints.
Reference: Aurora Replicas

Design Resilient Architectures - Question 38:

The usage of the company Djamgatech's image-processing application is increasing
suddenly with no set pattern. The application's processing time grows linearly with the
size of the image. The processing can take up to 20 minutes for large image files. The
architecture consists of a web tier, an Amazon Simple Queue Service (Amazon SQS)
standard queue, and message consumers that process the images on Amazon EC2
instances. When a high volume of requests occurs, the message backlog in Amazon SQS
increases. Users are reporting the delays in processing. A solutions architect must
improve the performance of the application in compliance with cloud best practices.
Which solution will meet these requirements?
A
Purchase enough Dedicated Instances to meet the peak demand. Deploy the instances for the consumers.
B
Convert the existing SQS standard queue to an SQS FIFO queue. Increase the visibility timeout.
C
Configure a scalable AWS Lambda function as the consumer of the SQS messages.
D
Create a message consumer that is an Auto Scaling group of instances. Configure the Auto Scaling group to scale based upon the
ApproximateNumberOfMessages Amazon CloudWatch metric.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 38:

D.

FIFO queues will solve problems that occur when messages are processed out of
order. FIFO queues will not improve performance during sudden volume
increases. Additionally, you cannot convert SQS queues after you create them.
Reference: FIFO Queues

121 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Resilient Architectures - Question 39:
A reporting application runs on Amazon EC2 instances behind an Application Load
Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple
Availability Zones. For complex reports, the application can take up to 15 minutes to
respond to a request. A solutions architect is concerned that users will receive HTTP 5xx
errors if a report request is in process during a scale-in event. What should the solutions
architect do to ensure that user requests will be completed before instances are
terminated?
A
Enable sticky sessions (session affinity) for the target group of the instances.
B
Increase the instance size in the Application Load Balancer target group.
C
Increase the cooldown period for the Auto Scaling group to a greater amount of time than the time required for the longest runni ng
responses.
D
Increase the deregistration delay timeout for the target group of the instances to greater than 900 seconds.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Resilient Architectures - Answer 39:

D.

By default, Elastic Load Balancing waits 300 seconds before the completion of
the deregistration process, which can help in-flight requests to the target become
complete. To change the amount of time that Elastic Load Balancing waits,
update the deregistration delay value.
Reference: Deregistration Delay.

Define Resilient Architectures - Question 40:

A Solution Architect is designing an online shopping application running in a VPC on
EC2 instances behind an ELB Application Load Balancer. The instances run in an Auto
Scaling group across multiple Availability Zones. The application tier must read and write
data to a customer managed database cluster. There should be no access to the
database from the Internet, but the cluster must be able to obtain software patches from
the Internet. Which VPC design meets these requirements?
A
Public subnets for both the application tier and the database cluster
B
Public subnets for the application tier, and private subnets for the database cluster

122 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 C
Public subnets for the application tier and NAT Gateway, and private subnets for the database cluster
D
Public subnets for the application tier, and private subnets for the database cluster and NAT Gateway

Your Answer: _______________

Your Notes: __________________________________________________ ___

Define Resilient Architectures - Answer 40:

C.

The online application must be in public subnets to allow access from clients'
browsers. The database cluster must be in private subnets to meet the
requirement that there be no access from the Internet.A NAT Gateway is required
to give the database cluster the ability to download patches from the Internet.
NAT Gateways must be deployed in public subnets.
Reference: Public and Private Subnets

Design High-Performing Architectures – Description

This exam domain is focused on designing high-performing architectures on
AWS and comprises 24% of the exam. Task statements include:

Task Statement 1: Determine high-performing and/or scalable storage solutions.

Task Statement 2: Design high-performing and elastic compute solutions.
Task Statement 3: Determine high-performing database solutions.
Task Statement 4: Determine high-performing and/or scalable network architectures.
Task Statement 5: Determine high-performing data ingestion and transformation
solutions.

Design High-Performing Architectures - Cheat Sheets

CloudFront vs Global Accelerator

Both CloudFront and Global Accelerator can speed up the distribution of contents over
the AWS global network. AWS Global Accelerator works at the network layer and is
123 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
able to direct traffic to optimal endpoints. CloudFront delivers content through edge
locations and users are routed to the edge location that has the lowest time delay.

Multipart Upload in SDK

Because with byte-range fetches, users can establish concurrent connections to

Amazon S3 to fetch different parts from within the same object. Through the "Range"
header in the HTTP GET request, a specified portion of the objects can be downloaded
instead of the whole objects.

S3 Lifecycle configuration

Lifecycle configuration allows lifecycle management of objects in a bucket. The

configuration is a set of one or more rules, where each rule defines an action for
Amazon S3 to apply to a group of objects. Bucket policies and IAM define access to
objects in an S3 bucket. CORS enables clients in one domain to interact with resources
in a different domain.

Target Tracking Scaling Policy

A target tracking scaling policy can be applied to check the ASGAverageCPUUtilization

metric. In ASG, you can add a target tracking scaling policy based on a target

AWS Direct Connect

AWS Direct Connect can reduce network costs, increase bandwidth throughput, and
provide a more consistent network experience than internet-based connections. It uses
industry-standard 802.1q VLANs to connect to Amazon VPC using private IP
addresses. You can choose from an ecosystem of WAN service providers for
integrating your AWS Direct Connect endpoint in an AWS Direct Connect location with
your remote networks. AWS Direct Connect lets you establish 1 Gbps or 10 Gbps
dedicated network connections (or multiple connections) between AWS networks and
one of the AWS Direct Connect locations. You can also work with your provider to
create sub-1G connection or use link aggregation group (LAG) to aggregate multiple 1
gigabit or 10 gigabit connections at a single AWS Direct Connect endpoint, allowing you
to treat them as a single, managed connection. A Direct Connect gateway is a globally
available resource to enable connections to multiple Amazon VPCs across different
regions or AWS accounts.

Placement Groups

Amazon Web Services' (AWS) solution to reducing latency between instances involves
the use of placement groups. As the name implies, a placement group is just that -- a
group. AWS instances that exist within a common availability zone can be grouped into
124 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
a placement group. Group members are able to communicate with one another in a way
that provides low latency and high throughput. A cluster placement group is a logical
grouping of instances within a single Availability Zone. A cluster placement group can
span peered VPCs in the same Region. Instances in the same cluster placement group
enjoy a higher per-flow throughput limit of up to 10 Gbps for TCP/IP traffic and are
placed in the same high-bisection bandwidth segment of the network.
Placement groups are a clustering of EC2 instances in one Availability Zone with
fast (up to 25Gbps) connections between them. This feature is used for applications
that need extremely low-latency connections between instances.

Application Load Balancer vs Classic Load Balancer

Only the Application Load Balancer can support path-based and host-based routing.
Using an Application Load Balancer instead of a Classic Load Balancer has the
following benefits:
- Support for path-based routing. You can configure rules for your listener that
forward requests based on the URL in the request. This enables you to structure your
application as smaller services, and route requests to the correct service based on the
content of the URL.
- Support for host-based routing. You can configure rules for your listener that
forward requests based on the host field in the HTTP header. This enables you to route
requests to multiple domains using a single load balancer.
- Support for routing based on fields in the request, such as standard and custom
HTTP headers and methods, query parameters, and source IP addresses.
Using an Application Load Balancer instead of a Classic Load Balancer has the
following benefits: Support for path-based routing. You can configure rules for your
listener that forward requests based on the URL in the request. This enables you to
structure your application as smaller services, and route requests to the correct service
based on the content of the URL.

Disaster Recovery: Read Replicas

Amazon RDS Read Replicas for MySQL and MariaDB now support Multi-AZ
deployments. Combining Read Replicas with Multi-AZ enables you to build a resilient
disaster recovery strategy and simplify your database engine upgrade process. Amazon
RDS Read Replicas enable you to create one or more read-only copies of your
database instance within the same AWS Region or in a different AWS Region. Updates
made to the source database are then asynchronously copied to your Read Replicas. In
addition to providing scalability for read-heavy workloads, Read Replicas can be
promoted to become a standalone database instance when needed.

Gaming: Kinesis Data Streams

Kinesis Data Streams can be used to continuously collect data about player-game
125 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
interactions and feed the data into your gaming platform. With Kinesis Data Streams,
you can design a game that provides engaging and dynamic experiences based on
players’ actions and behaviors.

Predictive Scaling Policy

Use a predictive scaling policy on the Auto Scaling Group to meet opening and closing
spikes: Using data collected from your actual EC2 usage and further informed by
billions of data points drawn from our own observations, we use well-trained Machine
Learning models to predict your expected traffic (and EC2 usage) including daily and
weekly patterns. The model needs at least one day’s of historical data to start making
predictions; it is re-evaluated every 24 hours to create a forecast for the next 48 hours.
What we can gather from the question is that the spikes at the beginning and end of day
can potentially affect performance. Sure, we can use dynamic scaling, but remember,
scaling up takes a little bit of time. We have the information to be proactive, use
predictive scaling, and be ready for these spikes at opening and closing.

Amazon DynamoDB auto scaling

Amazon DynamoDB auto scaling uses the AWS Application Auto Scaling service to
dynamically adjust provisioned throughput capacity on your behalf, in response to actual
traffic patterns. This enables a table or a global secondary index to increase its
provisioned read and write capacity to handle sudden increases in traffic, without
throttling. When the workload decreases, Application Auto Scaling decreases the
throughput so that you don't pay for unused provisioned capacity. Note that if you use
the AWS Management Console to create a table or a global secondary index,
DynamoDB auto scaling is enabled by default. You can modify your auto scaling
settings at any time.

How can you improve the performance of EFS?

Amazon EFS now allows you to instantly provision the throughput required for your
applications independent of the amount of data stored in your file system. This allows
you to optimize throughput for your application’s performance needs.

Stateful vs Stateless web Services

- A stateful web service will keep track of the "state" of a client's connection and data
over several requests. So for example, the client might login, select a users account
data, update their address, attach a photo, and change the status flag, then disconnect.
In a stateless web service, the server doesn't keep any information from one request to
the next. The client needs to do it's work in a series of simple transactions, and the
client has to keep track of what happens between requests. So in the above example,
the client needs to do each operation separately: connect and update the address,
126 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
disconnect. Connect and attach the photo, disconnect. Connect and change the status
flag, disconnect.
A stateless web service is much simpler to implement, and can handle greater volume
of clients.

An Edge Location is a specialization AWS data centre that works with which
services?
Lambda@Edge lets you run Lambda functions to customize the content that CloudFront
delivers, executing the functions in AWS locations closer to the viewer. Amazon
CloudFront is a web service that speeds up distribution of your static and dynamic web
content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your
content through a worldwide network of data centers called edge locations. When a
user requests content that you're serving with CloudFront, the user is routed to the edge
location that provides the lowest latency (time delay), so that content is delivered with
the best possible performance.
CloudFront speeds up the distribution of your content by routing each user request
through the AWS backbone network to the edge location that can best serve your
content. Typically, this is a CloudFront edge server that provides the fastest delivery to
the viewer. Using the AWS network dramatically reduces the number of networks that
your users' requests must pass through, which improves performance. Users get lower
latency—the time it takes to load the first byte of the file—and higher data transfer rates.
You also get increased reliability and availability because copies of your files (also
known as objects) are now held (or cached) in multiple edge locations around the world.

Design High-Performing Architectures- Illustrations

127 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Monolithic architecture vs. modular architecture

128 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Architecting for Reliable Scalability

Running a high-performance SAS Grid Manager cluster on AWS

Design High-Performing Architectures - Quiz

129 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design High-Performing Architectures - Question 1:
You have been engaged by the company Djamgatech to design and lead a migration to
an AWS environment. The team is concerned about the capabilities of the new
environment, especially when it comes to high availability and cost-effectiveness. The
design calls for about 20 instances (c3.2xlarge) pulling jobs/messages from SQS.
Network traffic per instance is estimated to be around 500 Mbps at the beginning and end
of each job. Which configuration should you plan on deploying?
A
Use a 2nd Network Interface to separate the SQS traffic for the storage traffic .
B
Choose a different instance type that better matched the traffic demand.
C
Spread the Instances over multiple AZs to minimize the traffic concentration and maximize fault-tolerance.
D
Deploy as a Cluster Placement Group as the aggregated burst traffic could be around 10 Gbps.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 1:

C.

With a multi-AZ configuration, an additional reliability point is scored as the entire

Availability Zone itself is ruled out as a single point of failure. This ensures high
availability. Wherever possible, use simple solutions such as spreading the load
out rather than expensive high tech solutions.
Reference: AZ

Design High-Performing Architectures - Question 2:

You are a solutions architect working for a Djamgatech’s cosmetics company. Your
company Djamgatech has a busy Magento online store that consists of a two-tier
architecture. The web servers are on EC2 instances deployed across multiple AZs, and
the database is on a Multi-AZ RDS MySQL database instance. Your store is having a
Black Friday sale in five days, and having reviewed the performance for the last sale you
expect the site to start running very slowly during the peak load. You investigate and you
determine that the database was struggling to keep up with the number of reads that the
store was generating. Which solution would you implement to improve the application
read performance the most?
A
Deploy an Amazon ElastiCache cluster with nodes running in each AZ.

130 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 B
Upgrade your RDS MySQL instance to use provisioned IOPS.
C
Add an RDS Read Replica in each AZ.
D
Upgrade the RDS MySQL instance to a larger type.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 2:

C.

RDS Replicas can substantially increase the Read performance of your database.
Multiple read replicas can be made to increase performance further. It will also
require the least modifications to any code, and is generally possible to be
implemented in the timeframe specified
Reference: RDS

Design High-Performing Architectures - Question 3:

A solutions architect wants to design a solution to save costs for Amazon EC2 instances
that do not need to run during a 2-week company shutdown. The applications running on
the EC2 instances store data in instance memory that must be present when the
instances resume operation. Which approach should the solutions architect recommend
to shut down and resume the EC2 instances?
A
Modify the application to store the data on instance store volumes. Reattach the volumes while restarting them.
B
Snapshot the EC2 instances before stopping them. Restore the snapshot after restarting the instances.
C
Run the applications on EC2 instances enabled for hibernation. Hibernate the instances before the 2- week company shutdown.
D
Note the Availability Zone for each EC2 instance before stopping it. Restart the instances in the same Availability Zones after the 2-week
company shutdown.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 3:

131 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 C.

Hibernating EC2 instances save the contents of instance memory to an Amazon

Elastic Block Store (Amazon EBS) root volume. When the instances restart, the
instance memory contents are reloaded.
Reference: Hibernation

Design High-Performing Architectures - Question 4:

The company Djamgatech uses Amazon EC2 Reserved Instances to run its data
processing workload. The nightly job typically takes 7 hours to run and must finish
within a 10-hour time window. The company anticipates temporary increases in demand
at the end of each month that will cause the job to run over the time limit with the
capacity of the current resources. Once started, the processing job cannot be interrupted
before completion. The company wants to implement a solution that would provide
increased resource capacity as cost-effectively as possible. What should a solutions
architect do to accomplish this?
A
Deploy On-Demand Instances during periods of high demand.
B
Create a second EC2 reservation for additional instances.
C
Deploy Spot Instances during periods of high demand.
D
Increase the EC2 instance size in the EC2 reservation to support the increased workload.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 4:

A.

While Spot Instances would be the least costly option, they are not suitable for
jobs that cannot be interrupted or must complete within a certain time period. On-
Demand Instances would be billed for the number of seconds they are running.
Reference: Spot Instances

Design High-Performing Architectures - Question 5:

132 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
An application running on AWS uses an Amazon Aurora Multi-AZ DB cluster deployment
for its database. When evaluating performance metrics, a solutions architect discovered
that the database reads are causing high I/O and adding latency to the write requests
against the database. What should the solutions architect do to separate the read
requests from the write requests?
A
Enable read-through caching on the Aurora database.
B
Update the application to read from the Multi-AZ standby instance.
C
Create an Aurora replica and modify the application to use the appropriate endpoints.
D
Create a second Aurora database and link it to the primary database as a read replica.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 5:

C.

Aurora Replicas provide a way to offload read traffic. Aurora Replicas share the
same underlying storage as the main database, so lag time is generally very low.
Aurora Replicas have their own endpoints, so the application will need to be
configured to direct read traffic to the new endpoints.
Reference: Aurora Replicas

Design High-Performing Architectures - Question 6:

A new online banking platform has been re-designed to have a microservices
architecture in which complex applications are decomposed into smaller, independent
services. The new platform is using Docker considering that application containers are
optimal for running small, decoupled services. The new solution should remove the need
to provision and manage servers, let you specify and pay for resources per application,
and improve security through application isolation by design. Which o f the following is
the MOST suitable service to use to migrate this new platform to AWS?
A
Amazon EKS
B
Amazon EFS
C
Amazon EBS
D
AWS Fargate

133 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 6:

D.

AWS Fargate is a serverless compute engine for containers that works with both
Amazon Elastic Container Service (ECS) and Amazon Elastic Kubernetes Service
(EKS). Fargate makes it easy for you to focus on building your applications.
Fargate removes the need to provision and manage servers, lets you specify and
pay for resources per application, and improves security through application
isolation by design. Fargate allocates the right amount of compute, eliminating
the need to choose instances and scale cluster capacity. You only pay for the
resources required to run your containers, so there is no over-provisioning and
paying for additional servers. Fargate runs each task or pod in its own kernel
providing the tasks and pods their own isolated compute environment. This
enables your application to have workload isolation and improved security by
design. This is why customers such as Vanguard, Accenture, Foursquare, and
Ancestry have chosen to run their mission critical applications on Fargate.
Reference: AWS Fargate

Design High-Performing Architectures - Question 7:

An auto scaling group of Linux EC2 instances is created with basic monitoring enabled
in CloudWatch. You noticed that your application is slow so you asked one of your
engineers to check all of your EC2 instances. After checking your instances, you noticed
that the auto scaling group is not launching more instances as it should be, even though
the servers already have high memory usage. Which of the following options should the
Architect implement to solve this issue?
A
Modify the scaling policy to increase the threshold to scale out the number of instances.
B
Enable detailed monitoring on the instances.
C
Install the CloudWatch agent to the EC2 instances which will trigger your Auto Scaling group to scale out.
D
Install AWS SDK in the EC2 instances. Create a script that will trigger the Auto Scaling event if there is hig h memory usage.

Your Answer: _______________

134 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 7:

C.

The premise of the scenario is that the EC2 servers have high memory usage, but
since this specific metric is not tracked by the Auto Scaling group by default, the
scaling out activity is not being triggered. Remember that by default, CloudWatch
doesn’t monitor memory usage but only the CPU utilization, Network utilization,
Disk performance, and Disk Reads/Writes. This is the reason why you have to
install a CloudWatch agent in your EC2 instances to collect and monitor the
custom metric (memory usage), which will be used by your Auto Scaling Group
as a trigger for scaling activities.
Reference: Install the CloudWatch agent to the EC2 instances which will trigger
your Auto Scaling group to scale out
Tags: #AWS #SAAC03 #SAA

Design High-Performing Architectures - Question 8:

A startup plans to develop a multiplayer game that uses UDP as the protocol for
communication between clients and game servers. The data of the use rs will be stored in
a key-value store. As the Solutions Architect, you need to implement a solution that will
distribute the traffic across a number of servers. Which of the following could help you
achieve this requirement?
A
Distribute the traffic using Network Load Balancer and store the data in Amazon Aurora.
B
Distribute the traffic using Network Load Balancer and store the data in Amazon DynamoDB.
C
Distribute the traffic using Application Load Balancer and store the data in Amazon Dynam oDB.
D
Distribute the traffic using Application Load Balancer and store the data in Amazon RDS.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 8:

B.

135 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A Network Load Balancer functions at the fourth layer of the Open Systems
Interconnection (OSI) model. It can handle millions of requests per second. After
the load balancer receives a connection request, it selects a target from the target
group for the default rule. For UDP traffic, the load balancer selects a target using
a flow hash algorithm based on the protocol, source IP address, source port,
destination IP address, and destination port. A UDP flow has the same source
and destination, so it is consistently routed to a single target throughout its
lifetime. Different UDP flows have different source IP addresses and ports, so
they can be routed to different targets. In this scenario, a startup plans to create a
multiplayer game that uses UDP as the protocol for communications. Since UDP
is a Layer 4 traffic, we can limit the option that uses Network Load Balancer. The
data of the users will be stored in a key-value store. This means that we should
select Amazon DynamoDB since it supports both document and key-value store
models.
Reference: Distribute the traffic using Network Load Balancer and store the data
in Amazon DynamoDB

Design High-Performing Architectures - Question 9:

A large financial firm in the country has an AWS environment that contains several
Reserved EC2 instances hosting a web application that has been decommissioned last
week. To save costs, you need to stop incurring charges for the Reserved instances as
soon as possible. What cost-effective steps will you take in this circumstance? (Select
TWO.)
A
Terminate the Reserved instances as soon as possible to avoid getting billed at the on-demand price when it expires.
B
Go to the AWS Reserved Instance Marketplace and sell the Reserved instances.
C
Contact AWS to cancel your AWS subscription.
D
Stop the Reserved instances as soon as possible.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 9:

A. B.

136 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 The Reserved Instance Marketplace is a platform that supports the sale of third-
party and AWS customers’ unused Standard Reserved Instances, which vary in
terms of lengths and pricing options. For example, you may want to sell Reserved
Instances after moving instances to a new AWS region, changing to a new
instance type, ending projects before the term expiration, when your business
needs change, or if you have unneeded capacity.
Reference: Reserved Instances

Design High-Performing Architectures - Question 10:

The company Djamgatech plans to use Route 53 instead of an ELB to load balance the
incoming request to the web application. The system is deployed to two EC2 instances to
which the traffic needs to be distributed. You want to set a specific percentage of traffic
to go to each instance. Which routing policy would you use?
A
Geolocation
B
Weighted
C
Failover
D
Latency

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 10:

B.

137 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Weighted routing lets you associate multiple resources with a single domain
name (abc.com) or subdomain name (portal.abc.com) and choose how much
traffic is routed to each resource. This can be useful for a variety of purposes
including load balancing and testing new versions of software. You can set a
specific percentage of how much traffic will be allocated to the resource by
specifying the weights. For example, if you want to send a tiny portion of your
traffic to one resource and the rest to another resource, you might specify
weights of 1 and 255. The resource with a weight of 1 gets 1/256th of the traffic
(1/1+255), and the other resource gets 255/256ths (255/1+255). You can gradually
change the balance by changing the weights. If you want to stop sending traffic
to a resource, you can change the weight for that record to 0.
Reference: Weighted routing

Design High-Performing Architectures - Question 11:

The company Djamgatech is receiving semi-structured and structured data from different
sources every day. The Solutions Architect plans to use big data processing frameworks
to analyze vast amounts of data and access it using various business intelligence tools
and standard SQL queries. Which of the following provides the MOST high-performing
solution that fulfills this requirement?
A
Create an Amazon EC2 instance and store the processed data in Amazon EBS.
B
Use Amazon Kinesis Data Analytics and store the processed data in Amazon DynamoDB.
C
Create an Amazon EMR cluster and store the processed data in Amazon Redshift.
D
Use AWS Glue and store the processed data in Amazon S3.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 11:

C.

138 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon EMR is a managed cluster platform that simplifies running big data
frameworks, such as Apache Hadoop and Apache Spark, on AWS to process and
analyze vast amounts of data. By using these frameworks and related open-
source projects, such as Apache Hive and Apache Pig, you can process data for
analytics purposes and business intelligence workloads. Additionally, you can
use Amazon EMR to transform and move large amounts of data into and out of
other AWS data stores and databases. Amazon Redshift is the most widely used
cloud data warehouse. It makes it fast, simple and cost-effective to analyze all
your data using standard SQL and your existing Business Intelligence (BI) tools.
It allows you to run complex analytic queries against terabytes to petabytes of
structured and semi-structured data, using sophisticated query optimization,
columnar storage on high-performance storage, and massively parallel query
execution.
Reference: EMR & Redshift

Design High-Performing Architectures - Question 12:

The company Djamgatech plans to build a data analytics application in AWS which will
be deployed in an Auto Scaling group of On-Demand EC2 instances and a MongoDB
database. It is expected that the database will have high-throughput workloads
performing small, random I/O operations. As the Solutions Architect, you are required to
properly set up and launch the required resources in AWS. Which of the following is the
most suitable EBS type to use for your database?
A
General Purpose SSD (gp2)
B
Provisioned IOPS SSD (io1)
C
Throughput Optimized HDD (st1)
D
Cold HDD (sc1)

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 12:

B.

139 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 On a given volume configuration, certain I/O characteristics drive the
performance behavior for your EBS volumes. SSD-backed volumes, such as
General Purpose SSD (gp2) and Provisioned IOPS SSD (io1), deliver consistent
performance whether an I/O operation is random or sequential. HDD-backed
volumes like Throughput Optimized HDD (st1) and Cold HDD (sc1) deliver optimal
performance only when I/O operations are large and sequential. In the exam,
always consider the difference between SSD and HDD as shown on the table
below. This will allow you to easily eliminate specific EBS-types in the options
which are not SSD or not HDD, depending on whether the question asks for a
storage type which has small, random I/O operations or large, sequential I/O
operations. Provisioned IOPS SSD (io1) volumes are designed to meet the needs
of I/O-intensive workloads, particularly database workloads, that are sensitive to
storage performance and consistency. Unlike gp2, which uses a bucket and
credit model to calculate performance, an io1 volume allows you to specify a
consistent IOPS rate when you create the volume, and Amazon EBS delivers
within 10 percent of the provisioned IOPS performance 99.9 percent of the time
over a given year.
Reference: Provisioned IOPS SSD (io1)

Design High-Performing Architectures - Question 13:

A leading e-commerce company for Djamgatech is in need of a storage solution that can
be simultaneously accessed by 1000 Linux servers in multiple availability zones. The
servers are hosted in EC2 instances that use a hierarchical directory structure via the
NFSv4 protocol. The service should be able to handle the rapidly changing data at scale
while still maintaining high performance. It should also be highly durable and highly
available whenever the servers will pull data from it, with little need for management. As
the Solutions Architect, which of the following services is the most cost-effective choice
that you should use to meet the above requirement?
A
Storage Gateway
B
EBS
C
EFS
D
S3

Your Answer: _______________

Your Notes: _____________________________________________________

140 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design High-Performing Architectures - Answer 13:
C.

Amazon Web Services (AWS) offers cloud storage services to support a wide
range of storage workloads such as EFS, S3 and EBS. You have to understand
when you should use Amazon EFS, Amazon S3 and Amazon Elastic Block Store
(EBS) based on the specific workloads. In this scenario, the keywords are rapidly
changing data and 1000 Linux servers. Amazon EFS is a file storage service for
use with Amazon EC2. Amazon EFS provides a file system interface, file system
access semantics (such as strong consistency and file locking), and
concurrently-accessible storage for up to thousands of Amazon EC2 instances.
EFS provides the same level of high availability and high scalability like S3
however, this service is more suitable for scenarios where it is required to have a
POSIX-compatible file system or if you are storing rapidly changing data.
Reference: EFS

Design High-Performing Architectures - Question 14:

An application is hosted in an Auto Scaling group of EC2 instances. To improve the
monitoring process, you have to configure the current capacity to inc rease or decrease
based on a set of scaling adjustments. This should be done by specifying the scaling
metrics and threshold values for the CloudWatch alarms that trigger the scaling process.
Which of the following is the most suitable type of scaling policy that you should use?
A
Step scaling
B
Target tracking scaling
C
Scheduled Scaling
D
Simple scaling

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 14:

A.

141 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 With step scaling, you choose scaling metrics and threshold values for the
CloudWatch alarms that trigger the scaling process as well as define how your
scalable target should be scaled when a threshold is in breach for a specified
number of evaluation periods. Step scaling policies increase or decrease the
current capacity of a scalable target based on a set of scaling adjustments,
known as step adjustments. The adjustments vary based on the size of the alarm
breach. After a scaling activity is started, the policy continues to respond to
additional alarms, even while a scaling activity is in progress. Therefore, all
alarms that are breached are evaluated by Application Auto Scaling as it receives
the alarm messages. When you configure dynamic scaling, you must define how
to scale in response to changing demand. For example, you have a web
application that currently runs on two instances and you want the CPU utilization
of the Auto Scaling group to stay at around 50 percent when the load on the
application changes. This gives you extra capacity to handle traffic spikes
without maintaining an excessive amount of idle resources. You can configure
your Auto Scaling group to scale automatically to meet this need. The policy type
determines how the scaling action is performed.
Reference: Step Scaling

Design High-Performing Architectures - Question 15:

A Djamgatech’s technology company is building a new cryptocurrency tradin g platform
that allows the buying and selling of Bitcoin, Ethereum, Ripple, Tether, and many others.
You were hired as a Cloud Engineer to build the required infrastructure needed for this
new trading platform. On your first week at work, you started to create CloudFormation
YAML scripts that define all of the needed AWS resources for the application. Your
manager was shocked that you haven’t created the EC2 instances, S3 buckets, and other
AWS resources straight away. He does not understand the text -based scripts that you
have done and has asked for your clarification. In this scenario, what are the benefits of
using the Amazon CloudFormation service that you should tell your manager to clarify
his concerns? (Select TWO.)
A
Allows you to model your entire infrastructure in a text file
B
Enables modeling, provisioning, and version-controlling of your entire AWS infrastructure
C
A storage location for the code of your application
D
Using CloudFormation itself is free, including the AWS resources that have been created.

Your Answer: _______________

142 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 15:

A. B.

AWS CloudFormation provides a common language for you to describe and

provision all the infrastructure resources in your cloud environment.
CloudFormation allows you to use a simple text file to model and provision, in an
automated and secure manner, all the resources needed for your applications
across all regions and accounts. This file serves as the single source of truth for
your cloud environment. AWS CloudFormation is available at no additional
charge, and you pay only for the AWS resources needed to run your applications.
Reference: AWS CloudFormation

Design High-Performing Architectures - Question 16:

The company Djamgatech plans to launch an application that tracks the GPS coordinates
of delivery trucks in the country. The coordinates are transmitted from each delivery
truck every five seconds. You need to design an architecture that will enable real -time
processing of these coordinates from multiple consumers. The aggregated data will be
analyzed in a separate reporting application. Which AWS service should you use for this
scenario?
A
Amazon AppStream
B
Amazon Simple Queue Service
C
AWS Data Pipeline
D
Amazon Kinesis

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 16:

D.

143 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon Kinesis makes it easy to collect, process, and analyze real-time,
streaming data so you can get timely insights and react quickly to new
information. It offers key capabilities to cost-effectively process streaming data at
any scale, along with the flexibility to choose the tools that best suit the
requirements of your application. With Amazon Kinesis, you can ingest real-time
data such as video, audio, application logs, website clickstreams, and IoT
telemetry data for machine learning, analytics, and other applications. Amazon
Kinesis enables you to process and analyze data as it arrives and responds
instantly instead of having to wait until all your data are collected before the
processing can begin.
Reference: Amazon Kinesis

Design High-Performing Architectures - Question 17:

The company Djamgatech has a cryptocurrency exchange portal that is hosted in an
Auto Scaling group of EC2 instances behind an Application Load Balancer and is
deployed across multiple AWS regions. The users can be found all around the globe, but
the majority are from Japan and Sweden. Because of the compliance requirements in
these two locations, you want the Japanese users to connect to the servers in the ap -
northeast-1 Asia Pacific (Tokyo) region, while the Swedish users should be connected to
the servers in the eu-west-1 EU (Ireland) region. Which of the following services would
allow you to easily fulfill this requirement?
A
Use Route 53 Geolocation Routing policy.
B
Use Route 53 Weighted Routing policy.
C
Set up a new CloudFront web distribution with the geo-restriction feature enabled.
D
Set up an Application Load Balancers that will automatically route the traffic to the proper AWS region.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 17:

A.

144 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Geolocation routing lets you choose the resources that serve your traffic based
on the geographic location of your users, meaning the location that DNS queries
originate from. For example, you might want all queries from Europe to be routed
to an ELB load balancer in the Frankfurt region. When you use geolocation
routing, you can localize your content and present some or all of your website in
the language of your users. You can also use geolocation routing to restrict
distribution of content to only the locations in which you have distribution rights.
Another possible use is for balancing load across endpoints in a predictable,
easy-to-manage way, so that each user location is consistently routed to the
same endpoint.
Reference: Geolocation Routing policy

Design High-Performing Architectures - Question 18:

A data analytics company is setting up an innovative checkout -free grocery store. Their
Solutions Architect developed a real-time monitoring application that uses smart sensors
to collect the items that the customers are getting from the grocery’s refrigerators and
shelves then automatically deduct it from their accounts. The company wants to analyze
the items that are frequently being bought and store the results in S3 for durable storage
to determine the purchase behavior of its customers. What service must be used to
easily capture, transform, and load streaming data into Amazon S3, Amazon
Elasticsearch Service, and Splunk?
A
Amazon Kinesis Data Firehose
B
Amazon SQS
C
Amazon Kinesis
D
Amazon Redshift

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 18:

A.

145 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Amazon Kinesis Data Firehose is the easiest way to load streaming data into data
stores and analytics tools. It can capture, transform, and load streaming data into
Amazon S3, Amazon Redshift, Amazon Elasticsearch Service, and Splunk,
enabling near real-time analytics with existing business intelligence tools and
dashboards you are already using today. It is a fully managed service that
automatically scales to match the throughput of your data and requires no
ongoing administration. It can also batch, compress, and encrypt the data before
loading it, minimizing the amount of storage used at the destination and
increasing security. In the diagram below, you gather the data from your smart
refrigerators and use Kinesis Data firehouse to prepare and load the data. S3 will
be used as a method of durably storing the data for analytics and the eventual
ingestion of data for output using analytical tools. You can use Amazon Kinesis
Data Firehose in conjunction with Amazon Kinesis Data Streams if you need to
implement real-time processing of streaming big data. Kinesis Data Streams
provides an ordering of records, as well as the ability to read and/or replay
records in the same order to multiple Amazon Kinesis Applications. The Amazon
Kinesis Client Library (KCL) delivers all records for a given partition key to the
same record processor, making it easier to build multiple applications reading
from the same Amazon Kinesis data stream (for example, to perform counting,
aggregation, and filtering).
Reference: Amazon Kinesis Data Firehose

Design High-Performing Architectures - Question 19:

The company Djamgatech has developed public APIs hosted in Amazon EC2 instances
behind an Elastic Load Balancer. The APIs will be used by various clients from their
respective on-premises data centers. A Solutions Architect received a report that the web
service clients can only access trusted IP addresses whitelisted on their firewalls. What
should you do to accomplish the above requirement?
A
Create an Alias Record in Route 53 which maps to the DNS name of the load balancer.
B
Associate an Elastic IP address to an Application Load Balancer.
C
Create a CloudFront distribution whose origin points to the private IP addresses of your web servers.
D
Associate an Elastic IP address to a Network Load Balancer.

Your Answer: _______________

Your Notes: _____________________________________________________

146 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design High-Performing Architectures - Answer 19:
D.

A Network Load Balancer functions at the fourth layer of the Open Systems
Interconnection (OSI) model. It can handle millions of requests per second. After
the load balancer receives a connection request, it selects a target from the
default rule’s target group. It attempts to open a TCP connection to the selected
target on the port specified in the listener configuration. Based on the given
scenario, web service clients can only access trusted IP addresses. To resolve
this requirement, you can use the Bring Your Own IP (BYOIP) feature to use the
trusted IPs as Elastic IP addresses (EIP) to a Network Load Balancer (NLB). This
way, there’s no need to re-establish the whitelists with new IP addresses.
Reference: Elastic IP

Design High-Performing Architectures - Question 20:

An AI-powered Forex trading application consumes thousands of data sets to train its
machine learning model. The application’s workload requires a high-performance,
parallel hot storage to process the training datasets concurrently. It also needs cost-
effective cold storage to archive those datasets that yield low profit. Which of the
following Amazon storage services should the developer use?
A
Use Amazon FSx For Lustre and Amazon EBS Provisioned IOPS SSD (io1) volum es for hot and cold storage respectively.
B
Use Amazon FSx For Windows File Server and Amazon S3 for hot and cold storage respectively.
C
Use Amazon FSx For Lustre and Amazon S3 for hot and cold storage respectively.
D
Use Amazon Elastic File System and Amazon S3 for hot and cold storage respectively.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 20:

C.

147 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Hot storage refers to the storage that keeps frequently accessed data (hot data).
Warm storage refers to the storage that keeps less frequently accessed data
(warm data). Cold storage refers to the storage that keeps rarely accessed data
(cold data). In terms of pricing, the colder the data, the cheaper it is to store, and
the costlier it is to access when needed. Amazon FSx For Lustre is a high-
performance file system for fast processing of workloads. Lustre is a popular
open-source parallel file system which stores data across multiple network file
servers to maximize performance and reduce bottlenecks.
Reference: FSx

Design High-Performing Architectures - Question 21:

The company Djamgatech requires corporate IT governance and cost oversight of all of
its AWS resources across its divisions around the world. Their corporate divisions want
to maintain administrative control of the discrete AWS resources they consume and
ensure that those resources are separate from other divisions. Which of the following
options will support the autonomy of each corporate division while enabling the
corporate IT to maintain governance and cost oversight? (Select TWO.)
A
Use AWS Consolidated Billing by creating AWS Organizations to link the divisions’ accounts to a parent corporate account.
B
Create separate VPCs for each division within the corporate IT AWS account. Launch an AWS Transit Gateway with equal -cost multipath
routing (ECMP) and VPN tunnels for intra-VPC communication.
C
Enable IAM cross-account access for all corporate IT administrators in each child account.
D
Create separate Availability Zones for each division within the corporate IT AWS account. Improve communication between the t wo AZs
using the AWS Global Accelerator.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 21:

A. C.

148 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
You can use an IAM role to delegate access to resources that are in different AWS
accounts that you own. You share resources in one account with users in a
different account. By setting up cross-account access in this way, you don’t need
to create individual IAM users in each account. In addition, users don’t have to
sign out of one account and sign into another in order to access resources that
are in different AWS accounts. You can use the consolidated billing feature in
AWS Organizations to consolidate payment for multiple AWS accounts or
multiple AISPL accounts. With consolidated billing, you can see a combined view
of AWS charges incurred by all of your accounts. You can also get a cost report
for each member account that is associated with your master account.
Consolidated billing is offered at no additional charge. AWS and AISPL accounts
can’t be consolidated together. The combined use of IAM and Consolidated
Billing will support the autonomy of each corporate division while enabling
corporate IT to maintain governance and cost oversight.
Reference: Consolidated billing
Tags: #AWS #SAAC03 #SAA

Design High-Performing Architectures - Question 22:

A fast food company for Djamgatech is using AWS to host their online ordering system
which uses an Auto Scaling group of EC2 instances deployed across multiple Availability
Zones with an Application Load Balancer in front. To better handle the incoming traffic
from various digital devices, you are planning to implement a new routing system where
requests which have a URL of /api/android are forwarded to one specific target group
named 'Android-Target-Group'. Conversely, requests which have a URL of /api/ios are
forwarded to another separate target group named 'iOS-Target-Group'. How can you
implement this change in AWS?
A
Use host conditions to define rules that forward requests to different target groups based on the hostname in the host header . This enables
you to support multiple domains using a single load balancer.
B
Replace your ALB with a Gateway Load Balancer then use path conditions to define rules that forward requests to different target groups
based on the URL in the request.
C
Use path conditions to define rules that forward requests to different target groups based on the URL in the request.
D
Replace your ALB with a Network Load Balancer then use host conditions to define rules that forward requests to different target groups
based on the URL in the request.

Your Answer: _______________

Your Notes: _____________________________________________________

149 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design High-Performing Architectures - Answer 22:
C.

If your application is composed of several individual services, an Application

Load Balancer can route a request to a service based on the content of the
request such as Host field, Path URL, HTTP header, HTTP method, Query string,
or Source IP address. Path-based routing allows you to route a client request
based on the URL path of the HTTP header. Each path condition has one path
pattern. If the URL in a request matches the path pattern in a listener rule exactly,
the request is routed using that rule. A path pattern is case-sensitive, can be up
to 128 characters in length.
Reference: ALB Benefits

Design High-Performing Architecture - Question 23:

A game development company for Djamgatech operates several virtual reality (VR) and
augmented reality (AR) games which use various RESTful web APIs hosted on their on -
premises data center. Due to the unprecedented growth o f their company, they decided
to migrate their system to AWS Cloud to scale out their resources as well to minimize
costs. Which of the following should you recommend as the most cost-effective and
scalable solution to meet the above requirement?
A
Use a Spot Fleet of Amazon EC2 instances, each with an Elastic Fabric Adapter (EFA) for more consistent latency and higher network
throughput. Set up an Application Load Balancer to distribute traffic to the instances.
B
Use AWS Lambda and Amazon API Gateway.
C
Host the APIs in a static S3 web hosting bucket behind a CloudFront web dist ribution.
D
Set up a micro-service architecture with ECS, ECR, and Fargate.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architecture - Answer 23:

B.

150 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
With AWS Lambda, you pay only for what you use. You are charged based on the
number of requests for your functions and the duration, the time it takes for your
code to execute. Lambda counts a request each time it starts executing in
response to an event notification or invoke call, including test invokes from the
console. You are charged for the total number of requests across all your
functions. Duration is calculated from the time your code begins executing until it
returns or otherwise terminates, rounded up to the nearest 1ms. The price
depends on the amount of memory you allocate to your function. The Lambda
free tier includes 1M free requests per month and over 400,000 GB-seconds of
compute time per month. The best possible answer here is to use a combination
of AWS Lambda and Amazon API Gateway because this solution is both scalable
and cost-effective. You will only be charged when you use your Lambda function,
unlike having an EC2 instance that always runs even though you don’t use it.
Reference: AWS Lambda and Amazon API Gateway.

Design High-Performing Architecture - Question 24:

An application hosted in EC2 consumes messages from an SQS queue and is integrated
with SNS to send out an email to you once the process is complete. The Operations team
received 5 orders but after a few hours, they saw 20 email notifications in their inbox.
Which of the following could be the possible culprit for this issue?
A
The web application is not deleting the messages in the SQS queue after it has processed them.
B
The web application is set to short polling so some messages are not being picked up.
C
The web application does not have permission to consume messages in the SQS queue.
D
The web application is set for long polling so the messages are being sent twice.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architecture - Answer 24:

A.

151 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Always remember that the messages in the SQS queue will continue to exist even
after the EC2 instance has processed it, until you delete that message. You have
to ensure that you delete the message after processing to prevent the message
from being received and processed again once the visibility timeout expires.
There are three main parts in a distributed messaging system: 1- The
components of your distributed system (EC2 instances) , 2- Your queue
(distributed on Amazon SQS servers) , 3- Messages in the queue. You can set up
a system which has several components that send messages to the queue and
receive messages from the queue. The queue redundantly stores the messages
across multiple Amazon SQS servers.
Reference: SQS Message Lifecycle

Design High-Performing Architectures - Question 25:

A startup needs to use a shared file system for its .NET web application running on an
Amazon EC2 Windows instance. The file system must provide a high level of throughput
and IOPS that can also be integrated with Microsoft Active Directory. Which is the MOST
suitable service that you should use to achieve this requirement?
A
AWS Storage Gateway – File Gateway
B
Amazon EBS Provisioned IOPS SSD volumes
C
Amazon FSx for Windows File Server
D
Amazon Elastic File System

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 25:

C.

152 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Amazon FSx for Windows File Server provides fully managed, highly reliable, and
scalable file storage accessible over the industry-standard Service Message
Block (SMB) protocol. It is built on Windows Server, delivering a wide range of
administrative features such as user quotas, end-user file restore, and Microsoft
Active Directory (AD) integration. Amazon FSx supports the use of Microsoft’s
Distributed File System (DFS) Namespaces to scale-out performance across
multiple file systems in the same namespace up to tens of Gbps and millions of
IOPS. The key phrases in this scenario are “file system” and “Active Directory
integration.” You need to implement a solution that will meet these requirements.
Among the options given, the possible answers are FSx Windows File Server and
File Gateway. But you need to consider that the question also states that you
need to provide a high level of throughput and IOPS. Amazon FSx Windows File
Server can scale-out storage to hundreds of petabytes of data with tens of GB/s
of throughput performance and millions of IOPS.
Reference: FSx

Design High-Performing Architectures - Question 26:

The company Djamgatech is running a multi-tier web application farm in a virtual private
cloud (VPC) that is not connected to their corporate network. They are connecting to the
VPC over the Internet to manage the fleet of Amazon EC2 instances running in both the
public and private subnets. The Solutions Architect has added a bastion host with
Microsoft Remote Desktop Protocol (RDP) access to the application instance security
groups, but the company wants to further limit administrative access to all of the
instances in the VPC. Which of the following bastion host deployment options will meet
this requirement?
A
Deploy a Windows Bastion host with an Elastic IP address in the public subnet and allow RDP access to bastion only from the c orporate IP
addresses.
B
Deploy a Windows Bastion host with an Elastic IP address in the public subnet and allow SSH access to the bastion from anywhere.
C
Deploy a Windows Bastion host with an Elastic IP address in the private subnet, and restrict RDP access to the bastion from o nly the
corporate public IP addresses.
D
Deploy a Windows Bastion host on the corporate network that has RDP access to all EC2 instances in the VPC.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 26:

153 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A.

The correct answer is to deploy a Windows Bastion host with an Elastic IP

address in the public subnet and allow RDP access to bastion only from the
corporate IP addresses. A bastion host is a special purpose computer on a
network specifically designed and configured to withstand attacks. If you have a
bastion host in AWS, it is basically just an EC2 instance. It should be in a public
subnet with either a public or Elastic IP address with sufficient RDP or SSH
access defined in the security group. Users log on to the bastion host via SSH or
RDP and then use that session to manage other hosts in the private subnets.
Reference: Linux Bastion Host

Design High-Performing Architectures - Question 27:

A popular social media website uses a CloudFront web distribution to serve their static
contents to their millions of users around the globe. They are receiving a number of
complaints recently that their users take a lot of time to log into their website. There are
also occasions when their users are getting HTTP 504 errors. You are instructed by your
manager to significantly reduce the user’s login time to further optimize the system.
Which of the following options should you use together to set up a cost-effective
solution that can improve your application’s performance? (Select TWO.)
A
Use multiple and geographically disperse VPCs to various AWS regions then create a transit VPC to connect all of your r esources. In order
to handle the requests faster, set up Lambda functions in each region using the AWS Serverless Application Model (SAM) servic e.
B
Set up an origin failover by creating an origin group with two origins. Specify one as the primary origin and the other as the second origin
which CloudFront automatically switches to when the primary origin returns specific HTTP status code failure res ponses.
C
Deploy your application to multiple AWS regions to accommodate your users around the world. Set up a Route 53 record with latency routing
policy to route incoming traffic to the region that provides the best latency to the user.
D
Customize the content that the CloudFront web distribution delivers to your users using Lambda@Edge, which allows your Lambda functions
to execute the authentication process in AWS locations closer to the users.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 27:

B. D.

154 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Lambda@Edge lets you run Lambda functions to customize the content that
CloudFront delivers, executing the functions in AWS locations closer to the
viewer. The functions run in response to CloudFront events, without provisioning
or managing servers. In the given scenario, you can use Lambda@Edge to allow
your Lambda functions to customize the content that CloudFront delivers and to
execute the authentication process in AWS locations closer to the users. In
addition, you can set up an origin failover by creating an origin group with two
origins with one as the primary origin and the other as the second origin which
CloudFront automatically switches to when the primary origin fails. This will
alleviate the occasional HTTP 504 errors that users are experiencing.
Reference: High Availability Origin Failover

Design High-Performing Architectures - Question 28:

A leading IT consulting company for Djamgatech has an application which processes a
large stream of financial data by an Amazon ECS Cluster then stores the result to a
DynamoDB table. You have to design a solution to detect new entries in the DynamoDB
table then automatically trigger a Lambda function to run some tests to verify the
processed data. What solution can be easily implemented to alert the Lambda function of
new entries while requiring minimal configuration change to your architecture?
A
Invoke the Lambda functions using SNS each time that the ECS Cluster successfully processed financial data.
B
Use Systems Manager Automation to detect new entries in the DynamoDB table then automatically invoke the Lambda function for
processing.
C
Enable DynamoDB Streams to capture table activity and automatically trigger the Lambda function.
D
Use CloudWatch Alarms to trigger the Lambda function whenever a new entry is created in the DynamoDB table.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 28:

C.

155 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon DynamoDB is integrated with AWS Lambda so that you can create
triggers—pieces of code that automatically respond to events in DynamoDB
Streams. With triggers, you can build applications that react to data modifications
in DynamoDB tables. If you enable DynamoDB Streams on a table, you can
associate the stream ARN with a Lambda function that you write. Immediately
after an item in the table is modified, a new record appears in the table’s stream.
AWS Lambda polls the stream and invokes your Lambda function synchronously
when it detects new stream records. You can create a Lambda function which can
perform a specific action that you specify, such as sending a notification or
initiating a workflow. For instance, you can set up a Lambda function to simply
copy each stream record to persistent storage, such as EFS or S3, to create a
permanent audit trail of write activity in your table.
Reference: enabling DynamoDB Streams to capture table activity and
automatically trigger the Lambda function

Design High-Performing Architectures - Question 29:

A Solutions Architect needs to deploy a mobile application that can collect votes for a
popular singing competition. Millions of users from around the world will submit votes
using their mobile phones. These votes must be collected and stored in a highly sca lable
and highly available data store which will be queried for real-time ranking. Which of the
following combination of services should the architect use to meet this requirement?
A
Amazon Redshift and AWS Mobile Hub
B
Amazon DynamoDB and AWS AppSync
C
Amazon Relational Database Service (RDS) and Amazon MQ
D
Amazon Aurora and Amazon Cognito

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 29:

B.

156 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 When the word durability pops out, the first service that should come to your
mind is Amazon S3. Since this service is not available in the answer options, we
can look at the other data store available which is Amazon DynamoDB.
DynamoDB is durable, scalable, and highly available data store which can be
used for real-time tabulation. You can also use AppSync with DynamoDB to make
it easy for you to build collaborative apps that keep shared data updated in real
time. You just specify the data for your app with simple code statements and
AWS AppSync manages everything needed to keep the app data updated in real
time. This will allow your app to access data in Amazon DynamoDB, trigger AWS
Lambda functions, or run Amazon Elasticsearch queries and combine data from
these services to provide the exact data you need for your app.
Reference: DynamoDB

Design High-Performing Architectures - Question 30:

The company Djamgatech plans to build a web architecture using On-Demand EC2
instances and a database in AWS. However, due to budget constraints , the company
instructed the Solutions Architect to choose a database service in which they no longer
need to worry about database management tasks such as hardware or software
provisioning, setup, configuration, scaling, and backups. Which of the followin g services
should the Solutions Architect recommend?
A
Amazon Redshift
B
Amazon ElastiCache
C
Amazon DynamoDB
D
Amazon RDS

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 30:

C.

157 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Basically, a database service in which you no longer need to worry about
database management tasks such as hardware or software provisioning, setup,
and configuration is called a fully managed database. This means that AWS fully
manages all of the database management tasks and the underlying host server.
The main differentiator here is the keyword 'scaling' in the question. In RDS, you
still have to manually scale up your resources and create Read Replicas to
improve scalability while in DynamoDB, this is automatically done. Amazon
DynamoDB is the best option to use in this scenario. It is a fully managed non-
relational database service – you simply create a database table, set your target
utilization for Auto Scaling, and let the service handle the rest. You no longer
need to worry about database management tasks such as hardware or software
provisioning, setup, and configuration, software patching, operating a reliable,
distributed database cluster, or partitioning data over multiple instances as you
scale. DynamoDB also lets you backup and restore all your tables for data
archival, helping you meet your corporate and governmental regulatory
requirements.
Reference: DynamoDB

Design High-Performing Architectures - Question 31:

The company Djamgatech launched a website that accepts high-quality photos and turns
them into a downloadable video montage. The website offers a free and a premium
account that guarantees faster processing. All requests by both free and premium
members go through a single SQS queue and then processed by a group of EC2
instances that generate the videos. The company needs to ensure that the premium
users who paid for the service have higher priority than the free members. How should
the company re-design its architecture to address this requirement?
A
For the requests made by premium members, set a higher priority in the SQS queue so it will be processed first compared to th e requests
made by free members.
B
Use Amazon S3 to store and process the photos and then generate the video montage afterward.
C
Create an SQS queue for free members and another one for premium members. Configure your EC2 instances to consume messages fr om
the premium queue first and if it is empty, poll from the free members' SQS queue.
D
Use Amazon Kinesis to process the photos and generate the video montage in real-time.

Your Answer: _______________

Your Notes: _____________________________________________________

158 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design High-Performing Architectures - Answer 31:
C.

Amazon Simple Queue Service (SQS) is a fully managed message queuing

service that enables you to decouple and scale microservices, distributed
systems, and serverless applications. SQS eliminates the complexity and
overhead associated with managing and operating message oriented middleware,
and empowers developers to focus on differentiating work. Using SQS, you can
send, store, and receive messages between software components at any volume,
without losing messages or requiring other services to be available. In this
scenario, it is best to create 2 separate SQS queues for each type of members.
The SQS queues for the premium members can be polled first by the EC2
Instances and once completed, the messages from the free members can be
processed next.
Reference: SQS

Design High-Performing Architectures - Question 32:

A Solutions Architect is migrating several Windows-based applications to AWS that
require a scalable file system storage for high-performance computing (HPC). The
storage service must have full support for the SMB protocol and Windows NTFS, Active
Directory (AD) integration, and Distributed File System (DFS). Which of the following is
the MOST suitable storage service that the Architect should use to fulfill this scenario?
A
Amazon FSx for Lustre
B
AWS DataSync
C
Amazon S3 Glacier Deep Archive
D
Amazon FSx for Windows File Server

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 32:

D.

159 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon FSx provides fully managed third-party file systems. Amazon FSx
provides you with the native compatibility of third-party file systems with feature
sets for workloads such as Windows-based storage, high-performance
computing (HPC), machine learning, and electronic design automation (EDA). You
don’t have to worry about managing file servers and storage, as Amazon FSx
automates the time-consuming administration tasks such as hardware
provisioning, software configuration, patching, and backups. Amazon FSx
integrates the file systems with cloud-native AWS services, making them even
more useful for a broader set of workloads. Amazon FSx provides you with two
file systems to choose from: Amazon FSx for Windows File Server for Windows-
based applications and Amazon FSx for Lustre for compute-intensive workloads.
For Windows-based applications, Amazon FSx provides fully managed Windows
file servers with features and performance optimized for “lift-and-shift” business-
critical application workloads including home directories (user shares), media
workflows, and ERP applications. It is accessible from Windows and Linux
instances via the SMB protocol. If you have Linux-based applications, Amazon
EFS is a cloud-native fully managed file system that provides simple, scalable,
elastic file storage accessible from Linux instances via the NFS protocol. For
compute-intensive and fast processing workloads, like high-performance
computing (HPC), machine learning, EDA, and media processing, Amazon FSx for
Lustre, provides a file system that’s optimized for performance, with input and
output stored on Amazon S3.
Reference: FSx

Design High-Performing Architectures - Question 33:

A Solutions Architect needs to set up the required compute resources for the application
which have workloads that require high, sequential read and write access to very large
data sets on local storage. Which of the following instance type is the most suitable one
to use in this scenario?
A
Storage Optimized Instances
B
Memory Optimized Instances
C
Compute Optimized Instances
D
General Purpose Instances

Your Answer: _______________

160 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 33:

A.

Storage optimized instances are designed for workloads that require high,
sequential read and write access to very large data sets on local storage. They
are optimized to deliver tens of thousands of low-latency, random I/O operations
per second (IOPS) to applications.
Reference: Storage Optimized Instances

Design High-Performing Architectures - Question 34:

The company Djamgatech uses Amazon EC2 Reserved Instances to run its data
processing workload. The nightly job typically takes 7 hours to run and must finish
within a 10-hour time window. The company anticipates temporary increases in demand
at the end of each month that will cause the job to run over the time limit with the
capacity of the current resources. Once started, the processing job cannot be interrupted
before completion. The company wants to implement a solution that would provide
increased resource capacity as cost-effectively as possible. What should a solutions
architect do to accomplish this?
A
Deploy On-Demand Instances during periods of high demand.
B
Create a second EC2 reservation for additional instances.
C
Deploy Spot Instances during periods of high demand.
D
Increase the EC2 instance size in the EC2 reservation to support the increased workload.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 34:

A.

161 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 While Spot Instances would be the least costly option, they are not suitable for
jobs that cannot be interrupted or must complete within a certain time period. On-
Demand Instances would be billed for the number of seconds they are running.
Reference: Spot Instances - On-Demand instances

Design High-Performing Architectures - Question 35:

The company Djamgatech runs an online voting system for a weekly live television
program. During broadcasts, users submit hundreds of thousands of votes within
minutes to a front-end fleet of Amazon EC2 instances that run in an Auto Scaling group.
The EC2 instances write the votes to an Amazon RDS database. However, the database is
unable to keep up with the requests that come from the EC2 instances. A solutions
architect must design a solution that processes the votes in the most efficient manner
and without downtime. Which solution meets these requirements?
A
Migrate the front-end application to AWS Lambda. Use Amazon API Gateway to route user requests to the Lambda functions.
B
Scale the database horizontally by converting it to a Multi-AZ deployment. Configure the front-end application to write to both the primary and
secondary DB instances.
C
Configure the front-end application to send votes to an Amazon Simple Queue Service (Amazon SQS) queue. Provision worker instances to
read the SQS queue and write the vote information to the database.
D
Use Amazon EventBridge (Amazon CloudWatch Events) to create a scheduled event to re-provision the database with larger, memory
optimized instances during voting periods. When voting ends, re-provision the database to use smaller instances.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 35:

C.

Decouple the ingestion of votes from the database to allow the voting system to
continue processing votes without waiting for the database writes. Add dedicated
workers to read from the SQS queue to allow votes to be entered into the
database at a controllable rate. The votes will be added to the database as fast as
the database can process them, but no votes will be lost.
Reference: Decouple

Design High-Performing Architectures - Question 36:

162 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
The company Djamgatech has a two-tier application architecture that runs in public and
private subnets. Amazon EC2 instances running the web application are in the public
subnet and an EC2 instance for the database runs on the private subnet. The web
application instances and the database are running in a single Availability Zone (AZ).
Which combination of steps should a solutions architect take to provide high availability
for this architecture? (Select TWO.)
A
Create new public and private subnets in the same AZ.
B
Create an Amazon EC2 Auto Scaling group and Application Load Balancer spanning multiple AZs for the web application instances.
C
Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer.
D
Create new public and private subnets in a new AZ. Create a database using an EC2 instance in the public subnet in the new AZ. Migrate
the old database contents to the new database.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 36:

B. E.

Create new subnets in a new Availability Zone (AZ) to provide a redundant

network. Create an Auto Scaling group with instances in two AZs behind the load
balancer to ensure high availability of the web application and redistribution of
web traffic between the two public AZs. Create an RDS DB instance in the two
private subnets to make the database tier highly available too.
Reference: Auto Scaling group with instances in two AZs behind the load balancer

Design High-Performing Architectures - Question 37:

A website runs a custom web application that receives a burst of traffic each day at
noon. The users upload new pictures and content daily, but have been complaining of
timeouts. The architecture uses Amazon EC2 Auto Scaling groups, and the application
consistently takes 1 minute to initiate upon boot up before responding to user requests.
How should a solutions architect redesign the architecture to better respond to changing
traffic?
A
Configure a Network Load Balancer with a slow start configuration.
B
Configure Amazon ElastiCache for Redis to offload direct requests from the EC2 instances.
C
Configure an Auto Scaling step scaling policy with an EC2 instance warmup condition.
D
Configure Amazon CloudFront to use an Application Load Balancer as the origin.

163 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 37:

C.

The current configuration puts new EC2 instances into service before they are
able to respond to transactions. This could also cause the instances to overscale.
With a step scaling policy, you can specify the number of seconds that it takes
for a newly launched instance to warm up. Until its specified warm-up time has
expired, an EC2 instance is not counted toward the aggregated metrics of the
Auto Scaling group. While scaling out, the Auto Scaling logic does not consider
EC2 instances that are warming up as part of the current capacity of the Auto
Scaling group. Therefore, multiple alarm breaches that fall in the range of the
same step adjustment result in a single scaling activity. This ensures that you do
not add more instances than you need.
Reference: Step scaling policy

Design High-Performing Architectures - Question 38:

Djamgatech’s media company is designing a new solution for graphic rendering. The
application requires up to 400 GB of storage for temporary data that is discarded after
the frames are rendered. The application requires approximately 40,000 random IOPS to
perform the rendering. What is the MOST cost-effective storage option for this rendering
application?
A
A storage optimized Amazon EC2 instance with instance store storage
B
A storage optimized Amazon EC2 instance with a Provisioned IOPS SSD (io1 or io2) Amazon Elas tic Block Store (Amazon EBS) volume
C
A burstable Amazon EC2 instance with a Throughput Optimized HDD (st1) Amazon Elastic Block Store (Amazon EBS) volume
D
A burstable Amazon EC2 instance with Amazon S3 storage over a VPC endpoint

Your Answer: _______________

Your Notes: _____________________________________________________

164 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design High-Performing Architectures - Answer 38:
A.

SSD-Backed Storage Optimized (i2) instances provide more than 365,000 random
IOPS. The instance store has no additional cost, compared with the regular
hourly cost of the instance.
Reference: Amazon EC2 pricing.

Design High-Performing Architectures - Question 39:

You are looking at ways to improve some existing infrastructure as it seems a lot of
engineering resources are being taken up with basic management and monitoring tasks
and the costs seem to be excessive. You are thinking of deploying Amazon ElasticCache
to help. Which of the following statements is true in regards to ElasticCache?
A
You can improve load and response times to user actions and queries however the cost associated with scaling web applications will be
more.
B
You can't improve load and response times to user actions and queries but you can reduce the cost associated with scaling web
applications.
C
You can improve load and response times to user actions and queries however the cost associated with scaling web applications will remain
the same.
D
You can improve load and response times to user actions and queries and also reduce the cost associated with scaling web applications.

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 39:

D.

165 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon ElastiCache is a web service that makes it easy to deploy and run
Memcached or Redis protocol-compliant server nodes in the cloud. Amazon
ElastiCache improves the performance of web applications by allowing you to
retrieve information from a fast, managed, in-memory caching system, instead of
relying entirely on slower disk-based databases. The service simplifies and
offloads the management, monitoring and operation of in-memory cache
environments, enabling your engineering resources to focus on developing
applications. Using Amazon ElastiCache, you can not only improve load and
response times to user actions and queries, but also reduce the cost associated
with scaling web applications
Reference: Amazon Elasticache

Design High-Performing Architectures - Question 40:

You have been assigned to create an architecture which uses load balancers to direct
traffic to an Auto Scaling Group of EC2 instances across multiple Availab ility Zones. The
application to be deployed on these instances is a life insurance application which
requires path-based and host-based routing. Which type of load balancer will you need
to use?
A
Any type of load balancer will meet these requirements.
B
Classic Load Balancer
C
Network Load Balancer
D
Application Load Balancer

Your Answer: _______________

Your Notes: _____________________________________________________

Design High-Performing Architectures - Answer 40:

D.

166 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Only the Application Load Balancer can support path-based and host-based
routing. Using an Application Load Balancer instead of a Classic Load Balancer
has the following benefits: - Support for path-based routing. You can configure
rules for your listener that forward requests based on the URL in the request.
This enables you to structure your application as smaller services, and route
requests to the correct service based on the content of the URL. - Support for
host-based routing. You can configure rules for your listener that forward
requests based on the host field in the HTTP header. This enables you to route
requests to multiple domains using a single load balancer. - Support for routing
based on fields in the request, such as standard and custom HTTP headers and
methods, query parameters, and source IP addresses.
Reference: Application Load Balancer - ELB FAQS

Design Cost-Optimized Architectures – Description

This exam domain is focused optimizing solutions for cost-effectiveness on AWS and comprises
20% of the exam. Task statements include:

Task Statement 1: Design cost-optimized storage solutions.

Task Statement 2: Design cost-optimized compute solutions.
Task Statement 3: Design cost-optimized database solutions.
Task Statement 4: Design cost-optimized network architectures.
You need to understand the various cost models of compute and storage
services, what you pay for and what the best choices would be given a specific
scenario.
You also need to know which services are free and be able to compare the cost of
different services that may suit a specific scenario. You’ll definitely need to
understand serverless technologies such as AWS Lambda, Amazon Aurora
Serverless, and Amazon ECS Fargate.

Design Cost-Optimized Architectures - Cheat Sheets

Cost Saving: How to stop instances when they are idle for long periods?

Adding Stop Actions to Amazon CloudWatch Alarms: You can create an alarm that
stops an Amazon EC2 instance when a certain threshold has been met. For example,
you may run development or test instances and occasionally forget to shut them off.
You can create an alarm that is triggered when the average CPU utilization percentage
167 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
has been lower than 10 percent for 24 hours, signaling that it is idle and no longer in
use. You can adjust the threshold, duration, and period to suit your needs, plus you can
add an SNS notification, so that you will receive an email when the alarm is triggered.
Amazon EC2 instances that use an Amazon Elastic Block Store volume as the root
device can be stopped or terminated, whereas instances that use the instance store as
the root device can only be terminated.

VPC/VPN Connection

A VPC/VPN Connection utilizes IPSec to establish encrypted network connectivity

between your intranet and Amazon VPC over the Internet. VPN Connections can be
configured in minutes and are a good solution if you have an immediate need, have low-
to-modest bandwidth requirements, and can tolerate the inherent variability in Internet-
based connectivity. AWS Client VPN is a managed client-based VPN service that
enables you to securely access your AWS resources or your on-premises network. With
AWS Client VPN, you configure an endpoint to which your users can connect to
establish a secure TLS VPN session. This enables clients to access resources in AWS
or on-premises from any location using an OpenVPN-based VPN client. You can create
an IPsec VPN connection between your VPC and your remote network. On the AWS
side of the Site-to-Site VPN connection, a virtual private gateway or transit gateway
provides two VPN endpoints (tunnels) for automatic failover. You configure your
customer gateway device on the remote side of the Site-to-Site VPN connection.

AWS Budgets

AWS Budgets gives you the ability to set custom budgets that alert you when your costs
or usage exceed (or are forecasted to exceed) your budgeted amount. You can also
use AWS Budgets to set reservation utilization or coverage targets and receive alerts
when your utilization drops below the threshold you define. And remember the keyword,
proactively. With AWS Budgets, we can be proactive about attending to cost overruns
before they become a major budget issue at the end of the month or quarter. Budgets
can be tracked at the monthly, quarterly, or yearly level, and you can customize the start
and end dates. You can further refine your budget to track costs associated with
multiple dimensions, such as AWS service, linked account, tag, and others. Budget
alerts can be sent via email and/or Amazon Simple Notification Service (SNS) topic.
You can also use AWS Budgets to set a custom reservation utilization target and
receive alerts when your utilization drops below the threshold you define. RI utilization
alerts support Amazon EC2, Amazon RDS, Amazon Redshift, and Amazon ElastiCache
reservations. Budgets can be created and tracked from the AWS Budgets dashboard, or
via the Budgets API.

AWS Snowball Edge

168 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
The AWS Snowball Edge is a type of Snowball device with on-board storage and
compute power for select AWS capabilities. Snowball Edge can undertake local
processing and edge-computing workloads in addition to transferring data between your
local environment and the AWS Cloud.

EC2 instance OS Patching

Security and compliance is a shared responsibility between AWS and the customer.
This shared model can help relieve the customer’s operational burden as AWS
operates, manages, and controls the components from the host operating system and
virtualization layer down to the physical security of the facilities in which the service
operates. The customer assumes responsibility for, and management of, the guest
operating system (including updates and security patches), other associated application
software, and the configuration of the AWS provided security group firewall.

EC2 instances purchasing options for Cost Optimization

Amazon EC2 provides the following purchasing options to enable you to optimize your
costs based on your needs:
*On-Demand Instances – Pay, by the second, for the instances that you launch.
Savings Plans– Reduce your Amazon EC2 costs by making a commitment to a
consistent amount of usage, in USD per hour, for a term of 1 or 3 years.
* Reserved Instances – Reduce your Amazon EC2 costs by making a commitment to a
consistent instance configuration, including instance type and Region, for a term of 1 or
3 years.
* Scheduled Instances – Purchase instances that are always available on the specified
recurring schedule, for a one-year term.
* Spot Instances – Request unused EC2 instances, which can reduce your Amazon
EC2 costs significantly.
* Dedicated Hosts – Pay for a physical host that is fully dedicated to running your
instances, and bring your existing per-socket, per-core, or per-VM software licenses to
reduce costs.
* Dedicated Instances – Pay, by the hour, for instances that run on single-tenant
hardware.
* Capacity Reservations – Reserve capacity for your EC2 instances in a specific
Availability Zone for any duration.

Point-in-time Snapshots

You can back up the data on your Amazon EBS volumes to Amazon S3 by taking point-
in-time snapshots. Snapshots are incremental backups, which means that only the
blocks on the device that have changed after your most recent snapshot are saved.
This minimizes the time required to create the snapshot and saves on storage costs by
not duplicating data. When you delete a snapshot, only the data unique to that snapshot
169 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
is removed. Each snapshot contains all of the information that is needed to restore your
data (from the moment when the snapshot was taken) to a new EBS volume.

Reserved Instances

Reserved Instances provide you with a significant discount (up to 75%) compared to
On-Demand instance pricing. In addition, when Reserved Instances are assigned to a
specific Availability Zone, they provide a capacity reservation, giving you additional
confidence in your ability to launch instances when you need them. For applications that
have steady state or predictable usage, Reserved Instances can provide significant
savings compared to using On-Demand instances.

Origin Access Identity (OAI)

An OAI is a virtual identity that can be associated with a CloudFront distribution and
then used in a bucket policy.

In designing an environment, what four main points should a Solutions Architect

keep in mind?

These four main points should be the framework when designing an environment: Cost-
efficient, secure, application session state, undifferentiated heavy lifting.
10
AWS Auto Scaling
AWS Auto Scaling continually monitors your applications to make sure that they are
operating at your desired performance levels. When demand spikes, AWS Auto Scaling
automatically increases the capacity of constrained resources so you maintain a high
quality of service.

EC2 Instances Hybernating

A Solutions Architect wants to design a solution to save costs for Amazon EC2
instances that do not need to run during a 2-week company shutdown. The applications
running on the instances store data in instance memory (RAM) that must be present
when the instances resume operation. Which approach should the Solutions Architect
recommend to shut down and resume the instances?
Hibernating an instance saves the contents of RAM to the Amazon EBS root
volume. When the instance restarts, the RAM contents are reloaded.

Cheapest S3 Storage Class

Data can be stored directly in Amazon S3 Glacier Deep Archive. This is the cheapest
S3 storage class.

170 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Cost Saving App Authentication Solution: Cognito

Amazon Cognito lets you add user sign-up, sign-in, and access control to your web and
mobile apps quickly and easily. Amazon Cognito scales to millions of users and
supports sign-in with social identity providers, such as Facebook, Google, and Amazon,
and enterprise identity providers via SAML 2.0.

What services will help identify Amazon EC2 instances with underutilized CPU
Capacity?

CloudTrail, CLoudWatch: AWS CloudTrail allows you track and automatically respond
to account activity threatening the security of your AWS resources. With Amazon
CloudWatch Events integration, you can define workflows that execute when events
that can result in security vulnerabilities are detected.

Cost Savings with Elastic IPs

You manage a fleet of 30 EC2 instances for a client, split across 10 AWS regions. To
aid in managing these machines, you have been asked to allocate the instances' static
public IP IPv4 addressing. Before this work is completed, you have been asked to
provide a cost estimation for the change in addressing. What should you tell your client?
Use Elastic IP addresses — there is no charge, assuming the IP is attached to a
network interface.
Elastic IPs are static, and, as long as you use them, there is no charge

Design Cost-Optimized Architectures: Illustrations

171 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Optimizing the cost of serverless web applications

Cost optimization for Kubernetes on AWS

172 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 AWS Set up a cost budget

Querying your AWS Cost & Usage Report using Athena

173 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Estimate Amazon EC2 Spot Instance cost savings

174 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 AWS Well-Architected Framework for Machine Learnin g: Cost Optimization Pillar

Design Cost-Optimized Architectures – Quiz

Design Cost-Optimized Architectures - Question 1:
Amazon Web Services offers 4 different levels of support. Which of the following are
valid support levels? Choose 3
A
Enterprise
B
Developer
C
Corporate
D
Business

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 1:

175 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A. B. D.

The correct answers are Enterprise, Business, Developer.

Reference: AWS Support

Design Cost-Optimized Architectures - Question 2:

Amazon SQS keeps track of all tasks and events in an application.
A
True
B
False
C
N/A
D
N/A

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 2:

B.

Amazon SWF (not Amazon SQS) keeps track of all tasks and events in an
application. Amazon SQS requires you to implement your own application-level
tracking, especially if your application uses multiple queues. Amazon SWF FAQs.
Reference: SQS

Design Cost-Optimized Architectures - Question 3:

How many internet gateways can I attach to my custom VPC?
A
5
B
3
C
2
D
1

Your Answer: _______________

176 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 3:

D.

VPC
Reference: VPC

Design Cost-Optimized Architectures - Question 4:

How long can a message be retained in an SQS Queue?
A
14 days
B
1 day
C
7 days
D
30 days

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 4:

A.

Messages can be retained in queues for up to 14 days.

Reference: SQS

Design Cost-Optimized Architectures - Question 5:

Although your application customarily runs at 30% usage, you have identified a recurring
usage spike (>90%) between 8pm and midnight daily. What is the most cost-effective way
to scale your application to meet this increased need?
A
Manually deploy Reactive Event-based Scaling each night at 7:45.
B
Deploy additional EC2 instances to meet the demand.
C
Use scheduled scaling to boost your capacity at a fixed interval.
D
Increase the size of the Resource Group to meet demand.

177 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 5:

C.

Scheduled scaling allows you to set your own scaling schedule. For example,
let's say that every week the traffic to your web application starts to increase on
Wednesday, remains high on Thursday, and starts to decrease on Friday. You
can plan your scaling actions based on the predictable traffic patterns of your
web application. Scaling actions are performed automatically as a function of
time and date.
Reference: Scheduled scaling for Amazon EC2 Auto Scaling.

Design Cost-Optimized Architectures - Question 6:

To save money, you quickly stored some data in one of the attached volumes of an EC2
instance and stopped it for the weekend. When you returned on Monday and restarted
your instance, you discovered that your data was gone. Why might that be?
A
The EBS volume was not large enough to store your data.
B
The instance failed to connect to the root volume on Monday.
C
The elastic block-level storage service failed over the weekend.
D
The volume was ephemeral, block-level storage. Data on an instance store volume is lost if an instance is stopped.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 6:

D.

178 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 the EC2 instance had an instance store volume attached to it. Instance store
volumes are ephemeral, meaning that data in attached instance store volumes is
lost if the instance stops.
Reference: AWS EC2

Design Cost-Optimized Architectures - Question 7:

AWS intends to shut down your spot instance; which of these scenarios is possible?
Choose 3
A
AWS sends a notification of termination and you receive it 120 seconds before the int ended forced shutdown.
B
AWS sends a notification of termination and you receive it 120 seconds before the forced shutdown, and you delay it by sending a 'Delay300'
instruction before the forced shutdown takes effect.
C
AWS sends a notification of termination and you receive it 120 seconds before the forced shutdown, but the defined duration period (also
known as Spot blocks) hasn't ended yet.
D
AWS sends a notification of termination, but you do not receive it within the 120 seconds and the instance is shu tdown.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Question 8:

_____ provides real-time streaming of data.
A
Kinesis Data Analytics
B
Kinesis Data Firehose
C
Kinesis Data Streams
D
SQS

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 8:

C.

179 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Kinesis Data Streams offers real-time data streaming
Reference: Data Streams

Design Cost-Optimized Architectures - Question 9:

You can use _ to build a schema for your data, and _ to query the data that's stored in S3.
A
Glue, Athena
B
EC2, SQS
C
EC2, Glue
D
Athena, Lambda

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 9:

A.

Kinesis Data Streams offers real-time data streaming

Reference: Kinesis

Design Cost-Optimized Architectures - Question 10:

What type of work does EMR perform?
A
Data processing information (DPI) jobs.
B
Big data (BD) jobs.
C
Extract, transform, and load (ETL) jobs.
D
Huge amounts of data (HAD) jobs

Your Answer: _______________

Your Notes: _____________________________________________________

180 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Cost-Optimized Architectures - Answer 10:
C.

EMR excels at extract, transform, and load (ETL) jobs.

Reference: EMR

Design Cost-Optimized Architectures - Question 11:

A solutions architect wants to design a solution to save costs for Amazon EC2 instances
that do not need to run during a 2-week company shutdown. The applications running on
the EC2 instances store data in instance memory that must be present when the
instances resume operation. Which approach should the solutions architect recomme nd
to shut down and resume the EC2 instances?
A
Modify the application to store the data on instance store volumes. Reattach the volumes while restarting them.
B
Snapshot the EC2 instances before stopping them. Restore the snapshot after restarting the ins tances.
C
Run the applications on EC2 instances enabled for hibernation. Hibernate the instances before the 2-week company shutdown.
D
Note the Availability Zone for each EC2 instance before stopping it. Restart the instances in the same Availability Zones after the 2-week
company shutdown.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 11:

C.

Hibernating EC2 instances save the contents of instance memory to an Amazon

Elastic Block Store (Amazon EBS) root volume. When the instances restart, the
instance memory contents are reloaded.
Reference: Hibernating

Design Cost-Optimized Architectures - Question 12:

181 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A solutions architect is designing a solution to run a containerized web application by
using Amazon Elastic Container Service (Amazon ECS). The solutions architect wants to
minimize cost by running multiple copies of a task on each container instance. The
number of task copies must scale as the load increases and decreases. Which routing
solution distributes the load to the multiple tasks?
A
Configure an Application Load Balancer to distribute the requests by using pat h-based routing.
B
Configure an Application Load Balancer to distribute the requests by using dynamic host port mapping.
C
Configure an Amazon Route 53 alias record set to distribute the requests with a failover routing policy.
D
Configure an Amazon Route 53 alias record set to distribute the requests with a weighted routing policy.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 12:

B.

With dynamic host port mapping, multiple tasks from the same service are
allowed for each container instance. You can use weighted routing policies to
route traffic to instances at proportions that you specify. You cannot use
weighted routing policies to manage multiple tasks on a single container.
Reference: Choosing a routing policy

Design Cost-Optimized Architectures - Question 13:

A Solutions Architect needs to ensure that all of the AWS resources in Amazon VPC
don’t go beyond their respective service limits. The Architect should prepare a system
that provides real-time guidance in provisioning resources that adheres to the AWS best
practices. Which of the following is the MOST appropriate service to use to satisfy this
task?
A
AWS Cost Explorer
B
Amazon Inspector
C
AWS Budgets
D
AWS Trusted Advisor

Your Answer: _______________

182 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 13:

D.

AWS Trusted Advisor is an online tool that provides you real-time guidance to
help you provision your resources following AWS best practices. It inspects your
AWS environment and makes recommendations for saving money, improving
system performance and reliability, or closing security gaps. Whether
establishing new workflows, developing applications, or as part of ongoing
improvement, take advantage of the recommendations provided by Trusted
Advisor on a regular basis to help keep your solutions provisioned optimally.
Trusted Advisor includes an ever-expanding list of checks in the following five
categories: Cost Optimization, Security, Fault Tolerance, Performance, Service
Limits
Reference: Trusted Advisor

Design Cost-Optimized Architectures - Question 14:

A Solutions Architect is working for a Djamgatech’s financial company. The manager
wants to have the ability to automatically transfer obsolete data from their S3 bucket to a
low-cost storage system in AWS. What is the best solution that the Architect can provide
to them?
A
Use an EC2 instance and a scheduled job to transfer the obsolete data from their S3 location to Amazon S3 Glacier.
B
Use Lifecycle Policies in S3 to move obsolete data to Glacier.
C
Use Amazon SQS.
D
Use CloudEndure Migration.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 14:

B.

183 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 In this scenario, you can use lifecycle policies in S3 to automatically move
obsolete data to Glacier. Lifecycle configuration in Amazon S3 enables you to
specify the lifecycle management of objects in a bucket. The configuration is a
set of one or more rules, where each rule defines an action for Amazon S3 to
apply to a group of objects.
Reference: Lifecycle Policies

Design Cost-Optimized Architectures - Question 15:

A Djamgatech’s multinational corporate and investment bank is regularly processing
steady workloads of accruals, loan interests, and other critical financial calculations
every night from 10 PM to 3 AM on their on-premises data center for their corporate
clients. Once the process is done, the results are then uploaded to the Oracle General
Ledger which means that the processing should not be delayed or interrupted. The CTO
has decided to move its IT infrastructure to AWS to save costs. The company needs to
reserve compute capacity in a specific Availability Zone to properly run their work loads.
As the Senior Solutions Architect, how can you implement a cost -effective architecture in
AWS for their financial system?
A
Use On-Demand EC2 instances which allows you to pay for the instances that you launch and use by the second. Reserve compute capacity
in a specific Availability Zone to avoid any interruption.
B
Use Regional Reserved Instances to reserve capacity on a specific Availability Zone and lower down the op erating cost through its billing
discounts.
C
Use On-Demand Capacity Reservations, which provide compute capacity that is always available on the specified recurring schedule.
D
Use Dedicated Hosts which provide a physical host that is fully dedicated to running your instances, and bring your existing per-socket, per-
core, or per-VM software licenses to reduce costs.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 15:

C.

184 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 On-Demand Capacity Reservations enable you to reserve compute capacity for
your Amazon EC2 instances in a specific Availability Zone for any duration. This
gives you the ability to create and manage Capacity Reservations independently
from the billing discounts offered by Savings Plans or Regional Reserved
Instances. By creating Capacity Reservations, you ensure that you always have
access to EC2 capacity when you need it, for as long as you need it. You can
create Capacity Reservations at any time, without entering into a one-year or
three-year term commitment, and the capacity is available immediately. Billing
starts as soon as the capacity is provisioned and the Capacity Reservation enters
the active state. When you no longer need it, cancel the Capacity Reservation to
stop incurring charges. Capacity Reservations can only be used by instances that
match their attributes. By default, they are automatically used by running
instances that match the attributes. If you don’t have any running instances that
match the attributes of the Capacity Reservation, it remains unused until you
launch an instance with matching attributes. In addition, you can use Savings
Plans and Regional Reserved Instances with your Capacity Reservations to
benefit from billing discounts. AWS automatically applies your discount when the
attributes of a Capacity Reservation match the attributes of a Savings Plan or
Regional Reserved Instance.
Reference: On-Demand Capacity Reservations

Design Cost-Optimized Architectures - Question 16:

A Djamgatech’s media company hosts large volumes of archive data that are about 250
TB in size on their internal servers. They have decided to move these d ata to S3 because
of its durability and redundancy. The company currently has a 100 Mbps dedicated line
connecting their head office to the Internet. Which of the following is the FASTEST and
the MOST cost-effective way to import all these data to Amazon S3?
A
Upload it directly to S3
B
Establish an AWS Direct Connect connection then transfer the data over to S3.
C
Use AWS Snowmobile to transfer the data over to S3.
D
Order multiple AWS Snowball devices to upload the files to Amazon S3.

Your Answer: _______________

Your Notes: _____________________________________________________

185 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Cost-Optimized Architectures - Answer 16:
D.

AWS Snowball is a petabyte-scale data transport solution that uses secure

appliances to transfer large amounts of data into and out of the AWS cloud. Using
Snowball addresses common challenges with large-scale data transfers including
high network costs, long transfer times, and security concerns. Transferring data
with Snowball is simple, fast, secure, and can be as little as one-fifth the cost of
high-speed Internet. Snowball is a strong choice for data transfer if you need to
more securely and quickly transfer terabytes to many petabytes of data to AWS.
Snowball can also be the right choice if you don’t want to make expensive
upgrades to your network infrastructure, if you frequently experience large
backlogs of data, if you’re located in a physically isolated environment, or if
you’re in an area where high-speed Internet connections are not available or cost-
prohibitive. As a rule of thumb, if it takes more than one week to upload your data
to AWS using the spare capacity of your existing Internet connection, then you
should consider using Snowball. For example, if you have a 100 Mb connection
that you can solely dedicate to transferring your data and need to transfer 100 TB
of data, it takes more than 100 days to complete data transfer over that
connection. You can make the same transfer by using multiple Snowballs in
about a week.
Reference: Snowball

Design Cost-Optimized Architectures - Question 17:

A Djamgatech company has 10 TB of infrequently accessed financial data files that
would need to be stored in AWS. These data would be accessed infrequently during
specific weeks when they are retrieved for auditing purposes. The retrieval time is not
strict as long as it does not exceed 24 hours. Which of the following would be a secure,
durable, and cost-effective solution for this scenario?
A
Upload the data to S3 then use a lifecycle policy to transfer data to S3-IA.
B
Upload the data to S3 and set a lifecycle policy to transition data to Glacier after 0 days.
C
Upload the data to S3 then use a lifecycle policy to transfer data to S3 One Zone-IA.
D
Upload the data to Amazon FSx for Windows File Server using the Server Message Block (SMB) protocol.

Your Answer: _______________

186 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 17:

B.

Glacier is a cost-effective archival solution for large amounts of data. Bulk

retrievals are S3 Glacier’s lowest-cost retrieval option, enabling you to retrieve
large amounts, even petabytes, of data inexpensively in a day. Bulk retrievals
typically complete within 5 – 12 hours. You can specify an absolute or relative
time period (including 0 days) after which the specified Amazon S3 objects
should be transitioned to Amazon Glacier.
Reference: Glacier

Design Cost-Optimized Architectures - Question 18:

A web application requires a minimum of six Amazon Elastic Compute Cloud (EC2)
instances running at all times. You are tasked to deploy the application to t hree
availability zones in the EU Ireland region (eu-west-1a, eu-west-1b, and eu-west-1c). It is
required that the system is fault-tolerant up to the loss of one Availability Zone. Which of
the following setup is the most cost-effective solution which also maintains the fault-
tolerance of your system?
A
3 instances in eu-west-1a, 3 instances in eu-west-1b, and 3 instances in eu-west-1c
B
6 instances in eu-west-1a, 6 instances in eu-west-1b, and 6 instances in eu-west-1c
C
6 instances in eu-west-1a, 6 instances in eu-west-1b, and no instances in eu-west-1c
D
2 instances in eu-west-1a, 2 instances in eu-west-1b, and 2 instances in eu-west-1c

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 18:

A.

187 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Basically, fault-tolerance is the ability of a system to remain in operation even in
the event that some of its components fail, without any service degradation. In
AWS, it can also refer to the minimum number of running EC2 instances or
resources which should be running at all times in order for the system to properly
operate and serve its consumers. Take note that this is quite different from the
concept of High Availability, which is just concerned with having at least one
running instance or resource in case of failure. In this scenario, 3 instances in eu-
west-1a, 3 instances in eu-west-1b, and 3 instances in eu-west-1c is the correct
answer because even if there was an outage in one of the Availability Zones, the
system still satisfies the requirement of having a minimum of 6 running
instances. It is also the most cost-effective solution among other options.
Reference: EC2 increase availability

Design Cost-Optimized Architectures - Question 19:

A Djamgatech start-up company that offers an intuitive financial data analytics service
has consulted you about their AWS architecture. They have a fleet of Amazon EC2
worker instances that process financial data and then outputs reports which are used by
their clients. You must store the generated report files in a durable storage. The number
of files to be stored can grow over time as the start-up company is expanding rapidly
overseas and hence, they also need a way to distribute the reports faster to clients
located across the globe. Which of the following is a cost-efficient and scalable storage
option that you should use for this scenario?
A
Use multiple EC2 instance stores for data storage and ElastiCache as the CDN.
B
Use Amazon S3 as the data storage and CloudFront as the CDN.
C
Use Amazon S3 Glacier as the data storage and ElastiCache as the CDN.
D
Use Amazon Redshift as the data storage and CloudFront as the CDN.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 19:

B.

188 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A Content Delivery Network (CDN) is a critical component of nearly any modern
web application. It used to be that CDN merely improved the delivery of content
by replicating commonly requested files (static content) across a globally
distributed set of caching servers. However, CDNs have become much more
useful over time. For caching, a CDN will reduce the load on an application origin
and improve the experience of the requestor by delivering a local copy of the
content from a nearby cache edge, or Point of Presence (PoP). The application
origin is off the hook for opening the connection and delivering the content
directly as the CDN takes care of the heavy lifting. The end result is that the
application origins don’t need to scale to meet demands for static content.
Amazon CloudFront is a fast content delivery network (CDN) service that securely
delivers data, videos, applications, and APIs to customers globally with low
latency, high transfer speeds, all within a developer-friendly environment.
CloudFront is integrated with AWS – both physical locations that are directly
connected to the AWS global infrastructure, as well as other AWS services.
Amazon S3 offers a highly durable, scalable, and secure destination for backing
up and archiving your critical data. This is the correct option as the start-up
company is looking for a durable storage to store the audio and text files. In
addition, ElastiCache is only used for caching and not specifically as a Global
Content Delivery Network (CDN).
Reference: S3

Design Cost-Optimized Architectures - Question 20:

A Djamgatech company needs to use Amazon S3 to store irreproducible financial
documents. For their quarterly reporting, the files are required to be retrieved after a
period of 3 months. There will be some occasions when a surprise audit wil l be held,
which requires access to the archived data that they need to present immediately. What
will you do to satisfy this requirement in a cost-effective way?
A
Use Amazon Glacier Deep Archive
B
Use Amazon S3 -Intelligent Tiering
C
Use Amazon S3 Standard – Infrequent Access
D
Use Amazon S3 Standard

Your Answer: _______________

Your Notes: _____________________________________________________

189 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Cost-Optimized Architectures - Answer 20:
C.

In this scenario, the requirement is to have a storage option that is cost-effective

and has the ability to access or retrieve the archived data immediately. The cost-
effective options are Amazon Glacier Deep Archive and Amazon S3 Standard-
Infrequent Access (Standard – IA). However, the former option is not designed for
rapid retrieval of data which is required for the surprise audit. Hence, using
Amazon Glacier Deep Archive is incorrect and the best answer is to use Amazon
S3 Standard – Infrequent Access.
Reference: Storage Classes

Design Cost-Optimized Architectures - Question 21:

A Djamgatech company has a distributed application in AWS that periodically processes
large volumes of data across multiple instances. The Solutions Architect designed the
application to recover gracefully from any instance failures. He is then required to launch
the application in the most cost-effective way. Which type of EC2 instance will meet this
requirement?
A
Reserved instances
B
Spot Instances
C
On-Demand instances
D
Dedicated instances

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 21:

B.

190 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
You require an EC2 instance that is the most cost-effective among other types. In
addition, the application it will host is designed to gracefully recover in case of
instance failures. In terms of cost-effectiveness, Spot and Reserved instances are
the top options. And since the application can gracefully recover from instance
failures, the Spot instance is the best option for this case as it is the cheapest
type of EC2 instance. Remember that when you use Spot Instances, there will be
interruptions. Amazon EC2 can interrupt your Spot Instance when the Spot price
exceeds your maximum price, when the demand for Spot Instances rise, or when
the supply of Spot Instances decreases.
Reference: Spot Instances

Design Cost-Optimized Architectures - Question 22:

A Djamgatech company is hosting EC2 instances that are on non-production
environment and processing non-priority batch loads, which can be interrupted at any
time. What is the best instance purchasing option which can be applied to your EC2
instances in this case?
A
Spot Instances
B
On-Demand Instances
C
Reserved Instances
D
On-Demand Capacity Reservations

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 22:

A.

191 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon EC2 Spot instances are spare compute capacity in the AWS cloud
available to you at steep discounts compared to On-Demand prices. It can be
interrupted by AWS EC2 with two minutes of notification when the EC2 needs the
capacity back. To use Spot Instances, you create a Spot Instance request that
includes the number of instances, the instance type, the Availability Zone, and
the maximum price that you are willing to pay per instance hour. If your maximum
price exceeds the current Spot price, Amazon EC2 fulfills your request
immediately if capacity is available. Otherwise, Amazon EC2 waits until your
request can be fulfilled or until you cancel the request.
Reference: Spot Instances

Design Cost-Optimized Architectures - Question 23:

The company Djamgatech plans to set up a cloud infrastructure in AWS. In the planning,
it was discussed that you need to deploy two EC2 instances that should continuously
run for three years. The CPU utilization of the EC2 instances is also expected to be stable
and predictable. Which is the most cost-efficient Amazon EC2 Pricing type that is most
appropriate for this scenario?
A
Dedicated Hosts
B
Reserved Instances
C
On-Demand instances
D
Spot instances

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 23:

B.

192 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Reserved Instances provide you with a significant discount (up to 75%) compared
to On-Demand instance pricing. In addition, when Reserved Instances are
assigned to a specific Availability Zone, they provide a capacity reservation,
giving you additional confidence in your ability to launch instances when you
need them. For applications that have steady state or predictable usage,
Reserved Instances can provide significant savings compared to using On-
Demand instances. Reserved Instances are recommended for: Applications with
steady state usage, Applications that may require reserved capacity, Customers
that can commit to using EC2 over a 1 or 3 year term to reduce their total
computing costs
Reference: Reserved Instances

Design Cost-Optimized Architectures - Question 24:

The company Djamgatech has several EC2 Reserved Instances in their account that need
to be decommissioned and shut down since they are no longer used by the development
team. However, the data is still required by the audit team for compliance purposes.
Which of the following steps can be taken in this scenario? (Select TWO.)
A
Convert the EC2 instance to On-Demand instances
B
You can opt to sell these EC2 instances on the AWS Reserved Instance Marketplace
C
Take snapshots of the EBS volumes and terminate the EC2 instances.
D
Stop all the running EC2 instances.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 24:

B. C.

193 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides
secure, resizable compute capacity in the cloud. It is designed to make web-scale
cloud computing easier for developers. Amazon EC2’s simple web service
interface allows you to obtain and configure capacity with minimal friction. It
provides you with complete control of your computing resources and lets you run
on Amazon’s proven computing environment. The first requirement as per the
scenario is to decommission and shut down several EC2 Reserved Instances.
However, it is also mentioned that the audit team still requires the data for
compliance purposes. To fulfill the given requirements, you can first create a
snapshot of the instance to save its data and then sell the instance to the
Reserved Instance Marketplace. The Reserved Instance Marketplace is a platform
that supports the sale of third-party and AWS customers’ unused Standard
Reserved Instances, which vary in terms of length and pricing options. For
example, you may want to sell Reserved Instances after moving instances to a
new AWS region, changing to a new instance type, ending projects before the
term expiration, when your business needs change, or if you have unneeded
capacity.
Reference: EBS Create Snapshots

Design Cost-Optimized Architectures - Question 25:

The Djamgatech’s media company that you are working for has a video transcoding
application running on Amazon EC2. Each EC2 instance polls a queue to find out which
video should be transcoded, and then runs a transcoding process. If this process is
interrupted, the video will be transcoded by another instance based on the queuing
system. This application has a large backlog of videos which need to be transcoded.
Your manager would like to reduce this backlog by adding more EC2 instances, however,
these instances are only needed until the backlog is reduced. In this scenario, which type
of Amazon EC2 instance is the most cost-effective type to use?
A
Reserved instances
B
Spot instances
C
On-demand instances
D
Dedicated instances

Your Answer: _______________

Your Notes: _____________________________________________________

194 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Cost-Optimized Architectures - Answer 25:
B.

You require an instance that will be used not as a primary server but as a spare
compute resource to augment the transcoding process of your application. These
instances should also be terminated once the backlog has been significantly
reduced. In addition, the scenario mentions that if the current process is
interrupted, the video can be transcoded by another instance based on the
queuing system. This means that the application can gracefully handle an
unexpected termination of an EC2 instance, like in the event of a Spot instance
termination when the Spot price is greater than your set maximum price. Hence,
an Amazon EC2 Spot instance is the best and cost-effective option for this
scenario. Amazon EC2 Spot instances are spare compute capacity in the AWS
cloud available to you at steep discounts compared to On-Demand prices. EC2
Spot enables you to optimize your costs on the AWS cloud and scale your
application’s throughput up to 10X for the same budget. By simply selecting Spot
when launching EC2 instances, you can save up-to 90% on On-Demand prices.
The only difference between On-Demand instances and Spot Instances is that
Spot instances can be interrupted by EC2 with two minutes of notification when
the EC2 needs the capacity back. You can specify whether Amazon EC2 should
hibernate, stop, or terminate Spot Instances when they are interrupted. You can
choose the interruption behavior that meets your needs.
Reference: Spot Instances

Design Cost-Optimized Architectures - Question 26:

To save costs, your manager instructed you to analyze and review the setup of your AWS
cloud infrastructure. You should also provide an estimate of how much your company
Djamgatech will pay for all of the AWS resources that they are using. In this scenario,
which of the following will incur costs? (Select TWO.)
A
Using an Amazon VPC
B
Public Data Set
C
A running EC2 Instance
D
EBS Volumes attached to stopped EC2 Instances

Your Answer: _______________

195 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 26:

C. D.

Billing commences when Amazon EC2 initiates the boot sequence of an AMI
instance. Billing ends when the instance terminates, which could occur through a
web services command, by running “shutdown -h”, or through instance failure.
When you stop an instance, AWS shuts it down but doesn’t charge hourly usage
for a stopped instance or data transfer fees. However, AWS does charge for the
storage of any Amazon EBS volumes. Hence, a running EC2 Instance and EBS
Volumes attached to stopped EC2 Instances are the right answers.
Reference: Using Public Data sets

Design Cost-Optimized Architectures - Question 27:

A web application is hosted in an Auto Scaling group of EC2 instances deployed across
multiple Availability Zones behind an Application Load Balancer. You need to i mplement
an SSL solution for your system to improve its security which is why you requested an
SSL/TLS certificate from a third-party certificate authority (CA). Where can you safely
import the SSL/TLS certificate of your application? (Select TWO.)
A
AWS Certificate Manager
B
IAM certificate store
C
CloudFront
D
An S3 bucket configured with server-side encryption with customer-provided encryption keys (SSE-C)

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 27:

A. B.

196 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
If you got your certificate from a third-party CA, import the certificate into ACM or
upload it to the IAM certificate store. Hence, AWS Certificate Manager and IAM
certificate store are the correct answers. ACM lets you import third-party
certificates from the ACM console, as well as programmatically. If ACM is not
available in your region, use AWS CLI to upload your third-party certificate to the
IAM certificate store.
Reference: ACM

Design Cost-Optimized Architectures - Question 28:

There are a few, easily reproducible but confidential files that your client wants to store
in AWS without worrying about storage capacity. For the first month, all of these files will
be accessed frequently but after that, they will rarely be accessed at all. The old files will
only be accessed by developers so there is no set retrieval time requirement. However,
the files under a specific blahblah-finance prefix in the S3 bucket will be used for post-
processing that requires millisecond retrieval time. Given these conditions, which of the
following options would be the most cost-effective solution for your client’s storage
needs?
A
Store the files in S3 then after a month, change the storage class of the bucket to S3-IA using lifecycle policy.
B
Store the files in S3 then after a month, change the storage class of the blahblah-finance prefix to S3-IA while the remaining go to Glacier
using lifecycle policy.
C
Store the files in S3 then after a month, change the storage class of the bucket to Intelligent-Tiering using lifecycle policy.
D
Store the files in S3 then after a month, change the storage class of the blahblah-finance prefix to One Zone-IA while the remaining go to
Glacier using lifecycle policy.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 28:

D.

197 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Initially, the files will be accessed frequently, and S3 is a durable and highly
available storage solution for that. After a month has passed, the files won’t be
accessed frequently anymore, so it is a good idea to use lifecycle policies to
move them to a storage class that would have a lower cost for storing them.
Since the files are easily reproducible and some of them are needed to be
retrieved quickly based on a specific prefix filter (blahblah-finance), S3-One Zone
IA would be a good choice for storing them. The other files that do not contain
such prefix would then be moved to Glacier for low-cost archival. This setup
would also be the most cost-effective for the client.
Reference: Object LifeCycle Management

Design Cost-Optimized Architectures - Question 29:

A media company for Djamgatech is using Amazon EC2, ELB, and S3 for its video-
sharing portal for filmmakers. They are using a standard S3 storage class to store all
high-quality videos that are frequently accessed only during the first three months of
posting. As a Solutions Architect, what should you do if the company needs to
automatically transfer or archive media data from an S3 bucket to Glacier?
A
Use a custom shell script that transfers data from the S3 bucket to Glacier
B
Use Amazon SWF
C
Use Lifecycle Policies
D
Use Amazon SQS

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 29:

C.

You can create a lifecycle policy in S3 to automatically transfer your data to

Glacier. Lifecycle configuration enables you to specify the lifecycle management
of objects in a bucket. The configuration is a set of one or more rules, where each
rule defines an action for Amazon S3 to apply to a group of objects.
Reference: Object LifeCycle Management

198 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Cost-Optimized Architectures - Question 30:
The company Djamgatech has established a dedicated network connection from its on-
premises data center to AWS Cloud using AWS Direct Connect (DX). The core network
services, such as the Domain Name System (DNS) service and Active Directory services,
are all hosted on-premises. The company has new AWS accounts that will also require
consistent and dedicated access to these network services. Which of the following can
satisfy this requirement with the LEAST amount of operational overhead and in a cost -
effective manner?
A
Set up another Direct Connect connection for each and every new AWS account that will be added.
B
Set up a new Direct Connect gateway and integrate it with the existing Direct Connect connection. Configure a VPC peering con nection
between AWS accounts and associate it with Direct Connect gateway.
C
Create a new AWS VPN CloudHub. Set up a Virtual Private Network (VPN) connection for additional AWS accounts.
D
Create a new Direct Connect gateway and integrate it with the existing Direct Connect connection. Set up a Transit Gateway between AWS
accounts and associate it with the Direct Connect gateway.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 30:

D.

199 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
AWS Transit Gateway provides a hub and spoke design for connecting VPCs and
on-premises networks. You can attach all your hybrid connectivity (VPN and
Direct Connect connections) to a single Transit Gateway consolidating and
controlling your organization’s entire AWS routing configuration in one place. It
also controls how traffic is routed among all the connected spoke networks using
route tables. This hub and spoke model simplifies management and reduces
operational costs because VPCs only connect to the Transit Gateway to gain
access to the connected networks. By attaching a transit gateway to a Direct
Connect gateway using a transit virtual interface, you can manage a single
connection for multiple VPCs or VPNs that are in the same AWS Region. You can
also advertise prefixes from on-premises to AWS and from AWS to on-premises.
The AWS Transit Gateway and AWS Direct Connect solution simplify the
management of connections between an Amazon VPC and your networks over a
private connection. It can also minimize network costs, improve bandwidth
throughput, and provide a more reliable network experience than Internet-based
connections.
Reference: Direct Connect Gateway Transit

Design Cost-Optimized Architectures - Question 31:

A Djamgatech’s software development company needs to connect its on-premises
infrastructure to the AWS cloud. Which of the following AWS services can you use to
accomplish this? (Select TWO.)
A
IPsec VPN connection
B
NAT Gateway
C
VPC Peering
D
AWS Direct Connect

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 31:

A. D.

200 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
You can connect your VPC to remote networks by using a VPN connection which
can be IPsec VPN connection, AWS VPN CloudHub, or a third party software VPN
appliance. A VPC VPN Connection utilizes IPSec to establish encrypted network
connectivity between your intranet and Amazon VPC over the Internet. AWS
Direct Connect is a network service that provides an alternative to using the
Internet to connect customer’s on-premises sites to AWS. AWS Direct Connect
does not involve the Internet; instead, it uses dedicated, private network
connections between your intranet and Amazon VPC.
Reference: VPN Connections

Design Cost-Optimized Architectures - Question 32:

In Amazon EC2, you can manage your instances from the moment you launch them up to
their termination. You can flexibly control your computing costs by changing the EC2
instance state. Which of the following statements is true regarding EC2 billing? (Select
TWO.)
A
You will be billed when your Reserved instance is in terminated state.
B
You will be billed when your On-Demand instance is preparing to hibernate with a stopping state.
C
You will be billed when your Spot instance is preparing to stop with a stopping state.
D
You will not be billed for any instance usage while an instance is not in the running state.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 32:

A. B.

By working with Amazon EC2 to manage your instances from the moment you
launch them through their termination, you ensure that your customers have the
best possible experience with the applications or sites that you host on your
instances. The following illustration represents the transitions between instance
states.
Reference: EC2 instance lifecycle

Design Cost-Optimized Architectures - Question 33:

201 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
The company Djamgatech has stored 200 TB of backup files in Amazon S3. The files are
in a vendor-proprietary format. The Solutions Architect needs to use the vendor’s
proprietary file conversion software to retrieve the files from their Amazon S3 bucket,
transform the files to an industry-standard format, and re-upload the files back to
Amazon S3. The solution must minimize the data transfer costs. Which of the following
options can satisfy the given requirement?
A
Deploy the EC2 instance in the same Region as Amazon S3. Install the file conversion software on the ins tance. Perform data transformation
and re-upload it to Amazon S3.
B
Deploy the EC2 instance in a different Region. Install the conversion software on the instance. Perform data transformation a nd re-upload it
to Amazon S3.
C
Export the data using AWS Snowball Edge device. Install the file conversion software on the device. Transform the data and re-upload it to
Amazon S3.
D
Install the file conversion software in Amazon S3. Use S3 Batch Operations to perform data transformation.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 33:

A.

Amazon S3 is object storage built to store and retrieve any amount of data from
anywhere on the Internet. It’s a simple storage service that offers industry-leading
durability, availability, performance, security, and virtually unlimited scalability at
very low costs. Amazon S3 is also designed to be highly flexible. Store any type
and amount of data that you want; read the same piece of data a million times or
only for emergency disaster recovery; build a simple FTP application or a
sophisticated web application.
Reference: S3

Design Cost-Optimized Architectures - Question 34:

The company Djamgatech is building a transcription service in which a fleet of EC2
worker instances processes an uploaded audio file and generates a text file as an output.
They must store both of these frequently accessed files in the same durable storage until
the text file is retrieved by the uploader. Due to an expected surge in demand, they have
to ensure that the storage is scalable and can be retrieved within minutes. Which storage
option in AWS can they use in this situation, which is both cost-efficient and scalable?
A
Multiple instance stores
B

202 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Multiple Amazon EBS volume with snapshots
C
Amazon S3 Glacier Deep Archive
D
A single Amazon S3 bucket

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 34:

D.

Amazon Simple Storage Service (Amazon S3) is an object storage service that
offers industry-leading scalability, data availability, security, and performance. It
provides easy-to-use management features so you can organize your data and
configure finely-tuned access controls to meet your specific business,
organizational, and compliance requirements. Amazon S3 is designed for
99.999999999% (11 9’s) of durability, and stores data for millions of applications
for companies all around the world. In this scenario, the requirement is to have
cost-efficient and scalable storage. Among the given options, the best option is
to use Amazon S3. It’s a simple storage service that offers a highly-scalable,
reliable, and low-latency data storage infrastructure at very low costs.
Reference: Amazon S3 bucket.

Design Cost-Optimized Architectures - Question 35:

The company Djamgatech is building an internal application that serves as a repository
for images uploaded by a couple of users. Whenever a user uploads an image, it would
be sent to Kinesis Data Streams for processing before it is stored in an S3 bucket. If the
upload was successful, the application will return a prompt informing the user that the
operation was successful. The entire processing typically takes about 5 minutes to
finish. Which of the following options will allow you to asynchronously process the
request to the application from upload request to Kinesis, S3, and ret urn a reply in the
most cost-effective manner?
A
Use a combination of SNS to buffer the requests and then asynchronously process them using On-Demand EC2 Instances.
B
Use a combination of SQS to queue the requests and then asynchronously process them using On-Demand EC2 Instances.
C
Use a combination of Lambda and Step Functions to orchestrate service components and asynchronously process the requests.
D
Replace the Kinesis Data Streams with an Amazon SQS queue. Create a Lambda function that will asynchronously process the requests.

203 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 35:

D.

AWS Lambda supports the synchronous and asynchronous invocation of a

Lambda function. You can control the invocation type only when you invoke a
Lambda function. When you use an AWS service as a trigger, the invocation type
is predetermined for each service. You have no control over the invocation type
that these event sources use when they invoke your Lambda function. Since
processing only takes 5 minutes, Lambda is also a cost-effective choice. You can
use an AWS Lambda function to process messages in an Amazon Simple Queue
Service (Amazon SQS) queue. Lambda event source mappings support standard
queues and first-in, first-out (FIFO) queues. With Amazon SQS, you can offload
tasks from one component of your application by sending them to a queue and
processing them asynchronously. Kinesis Data Streams is a real-time data
streaming service that requires the provisioning of shards. Amazon SQS is a
cheaper option because you only pay for what you use. Since there is no
requirement for real-time processing in the scenario given, replacing Kinesis Data
Streams with Amazon SQS would save more costs. Hence, the correct answer is:
Replace the Kinesis stream with an Amazon SQS queue. Create a Lambda
function that will asynchronously process the requests.
Reference: AWS Lambda Asynchronous invocation

Design Cost-Optimized Architectures - Question 36:

The company Djamgatech used Amazon EC2 Spot Instances for a demonstration that is
now complete. A solutions architect must remove the Spot Instances to stop them from
incurring cost. What should the solutions architect do to meet this requirement?
A
Cancel the Spot request only.
B
Terminate the Spot Instances only.
C
Cancel the Spot request. Terminate the Spot Instances.
D
Terminate the Spot Instances. Cancel the Spot request.

204 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 36:

C.

To remove the Spot Instances, the appropriate steps are to cancel the Spot
request and then to terminate the Spot Instances.
Reference: Spot Instances

Design Cost-Optimized Architectures - Question 37:

The company Djamgatech is deploying a new application that will consist of an
application layer and an online transaction processing (OLTP) relational database. The
application must be available at all times. However, the application will have periods of
inactivity. The company wants to pay the minimum for compute costs during these idle
periods. Which solution meets these requirements MOST cost-effectively?
A
Run the application in containers with Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. Use Amazon Aurora Serverless
for the database.
B
Run the application on Amazon EC2 instances by using a burstable instance type. Use Amazon Redshift for the database.
C
Deploy the application and a MySQL database to Amazon EC2 instances by using AWS CloudFormation. Delete the stack at the beginning
of the idle periods.
D
Deploy the application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Use Amazon RDS f or
MySQL for the database.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 37:

A.

When Amazon ECS uses Fargate for compute, it incurs no costs when the
application is idle. Aurora Serverless also incurs no compute costs when it is
idle.

205 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Design Cost-Optimized Architectures - Question 38:
The company Djamgatech is looking to store their confidential financial files in AWS
which are accessed every week. The Architect was instructed to set up the storage
system which uses envelope encryption and automates key rotation. It should also
provide an audit trail that shows who used the encryption key and by whom for security
purposes. Which combination of actions should the Architect implement to satisfy the
requirement in the most cost-effective way? (Select TWO.)
A
Configure Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS).
B
Configure Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3).
C
Use Amazon S3 to store the data.
D
Configure Server-Side Encryption with Customer-Provided Keys (SSE-C).

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 38:

A. C.

206 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Server-side encryption is the encryption of data at its destination by the
application or service that receives it. AWS Key Management Service (AWS KMS)
is a service that combines secure, highly available hardware and software to
provide a key management system scaled for the cloud. Amazon S3 uses AWS
KMS customer master keys (CMKs) to encrypt your Amazon S3 objects. SSE-KMS
encrypts only the object data. Any object metadata is not encrypted. If you use
customer-managed CMKs, you use AWS KMS via the AWS Management Console
or AWS KMS APIs to centrally create encryption keys, define the policies that
control how keys can be used, and audit key usage to prove that they are being
used correctly. You can use these keys to protect your data in Amazon S3
buckets. A customer master key (CMK) is a logical representation of a master
key. The CMK includes metadata, such as the key ID, creation date, description,
and key state. The CMK also contains the key material used to encrypt and
decrypt data. You can use a CMK to encrypt and decrypt up to 4 KB (4096 bytes)
of data. Typically, you use CMKs to generate, encrypt, and decrypt the data keys
that you use outside of AWS KMS to encrypt your data. This strategy is known as
envelope encryption. You have three mutually exclusive options depending on
how you choose to manage the encryption keys: Use Server-Side Encryption with
Amazon S3-Managed Keys (SSE-S3) – Each object is encrypted with a unique
key. As an additional safeguard, it encrypts the key itself with a master key that it
regularly rotates. Amazon S3 server-side encryption uses one of the strongest
block ciphers available, 256-bit Advanced Encryption Standard (AES-256), to
encrypt your data. Use Server-Side Encryption with Customer Master Keys
(CMKs) Stored in AWS Key Management Service (SSE-KMS) – Similar to SSE-S3,
but with some additional benefits and charges for using this service. There are
separate permissions for the use of a CMK that provides added protection
against unauthorized access of your objects in Amazon S3. SSE-KMS also
provides you with an audit trail that shows when your CMK was used and by
whom. Additionally, you can create and manage customer-managed CMKs or use
AWS managed CMKs that are unique to you, your service, and your Region. Use
Server-Side Encryption with Customer-Provided Keys (SSE-C) – You manage the
encryption keys and Amazon S3 manages the encryption, as it writes to disks,
and decryption when you access your objects.
Reference: Server Side Encryption

Design Cost-Optimized Architectures - Question 39:

207 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 The company Djamgatech hosted a web application in an Auto Scaling group of EC2
instances. The IT manager is concerned about the over-provisioning of the resources
that can cause higher operating costs. A Solutions Architect has been instructed to
create a cost-effective solution without affecting the performance of the application.
Which dynamic scaling policy should be used to satisfy this requirement?
A
Use target tracking scaling.
B
Use suspend and resume scaling.
C
Use scheduled scaling.
D
Use simple scaling.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 39:

A.

208 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 An Auto Scaling group contains a collection of Amazon EC2 instances that are
treated as a logical grouping for the purposes of automatic scaling and
management. An Auto Scaling group also enables you to use Amazon EC2 Auto
Scaling features such as health check replacements and scaling policies. Both
maintaining the number of instances in an Auto Scaling group and automatic
scaling are the core functionality of the Amazon EC2 Auto Scaling service. The
size of an Auto Scaling group depends on the number of instances that you set
as the desired capacity. You can adjust its size to meet demand, either manually
or by using automatic scaling. Step scaling policies and simple scaling policies
are two of the dynamic scaling options available for you to use. Both require you
to create CloudWatch alarms for the scaling policies. Both require you to specify
the high and low thresholds for the alarms. Both require you to define whether to
add or remove instances, and how many, or set the group to an exact size. The
main difference between the policy types is the step adjustments that you get
with step scaling policies. When step adjustments are applied, and they increase
or decrease the current capacity of your Auto Scaling group, the adjustments
vary based on the size of the alarm breach. The primary issue with simple scaling
is that after a scaling activity is started, the policy must wait for the scaling
activity or health check replacement to complete and the cooldown period to
expire before responding to additional alarms. Cooldown periods help to prevent
the initiation of additional scaling activities before the effects of previous
activities are visible. With a target tracking scaling policy, you can increase or
decrease the current capacity of the group based on a target value for a specific
metric. This policy will help resolve the over-provisioning of your resources. The
scaling policy adds or removes capacity as required to keep the metric at, or
close to, the specified target value. In addition to keeping the metric close to the
target value, a target tracking scaling policy also adjusts to changes in the metric
due to a changing load pattern.
Reference: target tracking scaling

Design Cost-Optimized Architectures - Question 40:

The company Djamgatech has an e-commerce application that saves the transaction logs
to an S3 bucket. You are instructed by the CTO to configure the application to keep the
transaction logs for one month for troubleshooting purposes, and then afterward, purge
the logs.
A
Enable CORS on the Amazon S3 bucket which will enable the automatic monthly deletion of data
B
Create a new IAM policy for the Amazon S3 bucket that automatically deletes the logs after a month
C
Configure the lifecycle configuration rules on the Amazon S3 bucket to purge the transaction logs after a month
D

209 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Add a new bucket policy on the Amazon S3 bucket.

Your Answer: _______________

Your Notes: _____________________________________________________

Design Cost-Optimized Architectures - Answer 40:

C.

In this scenario, the best way to accomplish the requirement is to simply

configure the lifecycle configuration rules on the Amazon S3 bucket to purge the
transaction logs after a month. Lifecycle configuration enables you to specify the
lifecycle management of objects in a bucket. The configuration is a set of one or
more rules, where each rule defines an action for Amazon S3 to apply to a group
of objects.
Reference: Object LifeCycle management

Top 50 AWS Recommended Security Best Practices

1- MFA

Turn on multifactor authentication for the “root” account

2- Log file validation

Turn on CloudTrail Log file validation log file validation.

3- Multi-region logging

Enable CloudTrail multi-region logging.

4- CloudWatch

Integrate CloudTrail with CloudWatch.

5- S3 Buckets

210 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Enable access logging for CloudTrail S3 buckets.

6- Elastic Load Balancer (ELB)

Enable access logging for Elastic Load Balancer (ELB).

7- Redshift audit logging

Enable Redshift audit logging.

8- VPC flow logging

Enable Virtual Private Cloud (VPC) flow logging.

9- CloudTrail buckets

Require multifactor authentication (MFA) to delete CloudTrail buckets

10-CloudTrail

Enable CloudTrail logging across all AWS.

11-IAM users

Turn on multi-factor authentication for IAM users.

12-Multi-mode access

Enable IAM users for multi-mode access.

13-IAM policies

Attach IAM policies to groups or roles

14-IAM access keys

Rotate IAM access keys regularly, and standardize on the selected number of days

15- strict password policy

Set up a strict password policy.

16-Password expiration period

211 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Set the password expiration period to 90 days and prevent reuseCustomer Visualforce
pages with standard headers

17- SSL/TLS

Don’t use expired SSL/TLS certificates

18-CloudFront distributions

User HTTPS for CloudFront distributions

19- CloudTrail bucket

Restrict access to CloudTrail bucket.

20-CloudTrail log files

Encrypt CloudTrail log files at rest

21-Elastic Block Store (EBS)

Encrypt Elastic Block Store (EBS) database.

22-IAM roles

Provision access to resources using IAM roles.

23-EC2 security groups

Ensure EC2 security groups don’t have large ranges of ports open

24- Restrict inbound access to EC2

Configure EC2 security groups to restrict inbound access to EC2.

25-root user accounts

Avoid using root user accounts.

26-Secure SSL ciphers

Use secure SSL ciphers when connecting between the client and ELB.

212 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 27-Secure SSL versions

Use secure SSL versions when connecting between client and ELB.

28- Standard naming (tagging)

Use a standard naming (tagging) convention for EC2.

29- RDS

Encrypt RDS.

30- Root accounts

Ensure access keys are not being used with root accounts.

31-secure CloudFront SSL versions

Use secure CloudFront SSL versions.

32-Redshift clusters

Enable the require_ssl parameter in all Redshift clusters.

33- SSH keys

Rotate SSH keys periodically.

34-Discrete security groups

Minimize the number of discrete security groups.

35-IAM groups

Reduce number of IAM groups.

36- Unused access keys

Terminate unused access keys

37-Inactive or unused IAM users

Disable access for inactive or unused IAM users

213 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 38- Unused IAM access keys

Remove unused IAM access keys

39-Unused SSH Public Keys

Delete unused SSH Public Keys

40- Access to AMIs

Restrict access to AMIs.

41-Access to EC2 security groups

Restrict access to EC2 security groups.

42-Access to RDS instances

Restrict access to RDS instances.

43-Access to Redshift clusters

Restrict access to Redshift clusters.

44- Outbound access

Restrict outbound access.

45-Ingress access on uncommon ports

Disallow unrestricted ingress access on uncommon ports.

46-Access to well-known ports

Restrict access to well-known ports such as CIFS, FTP, ICMP, SMTP, SSH, Remote
desktop

47-Existing custom apps

Inventory & categorize all existing custom apps by the types of data stored, compliance
requirements & possible threats they face.

48-Development process

Involve IT security throughout the development process.

214 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 49-Application users

Grant the fewest privileges as possible for application users

50-Custom applications and all other cloud services

Enforce a single set of data loss prevention policies across custom applications and all
other cloud services.
51- Protected health information (PHI) or personally identifiable information
(PII)

Encrypt highly sensitive data such as protected health information (PHI) or personally
identifiable information (PII).

Source: AWS CCP Blog

AWS SAA FAQs

AWS S3 FAQs

What is Amazon S3?

Amazon S3 or Amazon Simple Storage Service is a "simple storage service" offered by Amazon Web Services that provides object storage
through a web service interface. Amazon S3 uses the same scalable storage infrastructure that Amazon.com uses to run its glob al e-
commerce network.
Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry -leading scalability, data availability, security,
and performance.

215 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 216 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 What can developers do with Amazon S3 that they could not do with an on -premises solution?

Amazon S3 enables any developer to leverage Amazon’s own benefits of massiv e scale with no up-front investment or performance
compromises. Developers are now free to innovate knowing that no matter how successful their businesses become, it will be in expensive
and simple to ensure their data is quickly accessible, always available, and secure.

What can I do with Amazon S3?

Amazon S3 provides a simple web service interface that you can use to store and retrieve any amount of data, at any time, fro m anywhere
on the web. Using this web service, you can easily build applications that make use of Internet storage. Since Amazon S3 is highly scalable
and you only pay for what you use, you can start small and grow your application as you wish, with no compromise on performance or
reliability.
Amazon S3 is also designed to be highly flexible. Store any type and amount of data that you want; read the same piece of data a million
times or only for emergency disaster recovery; build a simple FTP application, or a sophisticated web application such as the Amazon.com
retail web site. Amazon S3 frees developers to focus on innovation instead of figuring out how to store their data.

What kind of data can I store in Amazon S3?

You can store virtually any kind of data in any format.

How much data can I store in Amazon S3?

217 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
The total volume of data and number of objects you can store are unlimited. Individual Amazon S3 objects can range in size from a minimum
of 0 bytes to a maximum of 5 terabytes. The largest object that can be uploaded in a single PUT is 5 gigabytes. For objects larger than 100
megabytes, customers should consider using the Multipart Upload capability.

What are S3 Storage Classes and What storage classes does Amazon S3 offer?

Amazon S3 offers a range of storage classes designed for different use cases. These include S3 Standard for general-purpose storage of
frequently accessed data; S3 Intelligent-Tiering for data with unknown or changing access patterns; S3 Standard-Infrequent Access (S3
Standard-IA) and S3 One Zone-Infrequent Access (S3 One Zone-IA) for long-lived, but less frequently accessed data; and Amazon S3
Glacier (S3 Glacier) and Amazon S3 Glacier Deep Archive (S3 Glacier Deep Archive) for long-term archive and digital preservation; and S3
Outposts for on-premises object storage to meet data residency needs. If you have data residency requirements that can’t be met by an
existing AWS Region, you can use the S3 Outposts storage class to store your S3 data on-premises. Amazon S3 also offers capabilities to
manage your data throughout its lifecycle.
Once an S3 Lifecycle policy is set, your data will automatically transfer to a different storage class without any changes to your application.
Learn more at: Amazon S3 FAQs

What does Amazon do with my data in Amazon S3?

Amazon will store your data and track its associated usage for billing purposes. Amazon will not otherwise access your data f or any purpose
outside of the Amazon S3 offering, except when required to do so by law.

Does Amazon store its own data in Amazon S3?

Yes. Developers within Amazon use Amazon S3 for a wide variety of projects. Many of these projects use Amazon S3 as their aut horitative
data store and rely on it for business-critical operations.

How is Amazon S3 data organized?

Amazon S3 is a simple key-based object store. When you store data, you assign a unique object key that can later be used to retrieve the
data. Keys can be any string, and they can be cons tructed to mimic hierarchical attributes. Alternatively, you can use S3 Object Tagging to
organize your data across all of your S3 buckets and/or prefixes.

How do I interface with Amazon S3?

Amazon S3 provides a simple, standards-based REST web services interface that is designed to work with any Internet -development toolkit.
The operations are intentionally made simple to make it easy to add new distribution protocols and functional layers.

Can I have a bucket that has different objects in different storage classes?
Yes, you can have a bucket that has different objects stored in S3 Standard, S3 Intelligent-Tiering, S3 Standard-IA, and S3 One Zone-IA.
Source: AWS S3 FAQs

AWS EC2 FAQs

What is Amazon Elastic Compute Cloud (Amazon EC2)?

Amazon Elastic Compute Cloud (Amazon EC2) is a web service t hat provides secure, resizable compute capacity in the cloud. It is designed
to make web-scale cloud computing easier for developers.
Amazon Elastic Compute Cloud (EC2) forms a central part of Amazon.com's cloud-computing platform, Amazon Web Services (AWS), by
allowing users to rent virtual computers on which to run their own computer applications.

Can users SSH to EC2 instances using their AWS user name and password?

No. User security credentials created with IAM are not supported for direct authenticat ion to customer EC2 instances. Managing EC2 SSH
credentials is the customer’s responsibility within the EC2 console.

What can I do with Amazon EC2?

Just as Amazon Simple Storage Service (Amazon S3) enables storage in the cloud, Amazon EC2 enables “comput e” in the cloud.
Amazon EC2’s simple web service interface allows you to obtain and configure capacity with minimal friction.
It provides you with complete control of your computing resources and lets you run on Amazon’s proven computing environment.
Amazon EC2 reduces the time required to obtain and boot new server instances to minutes, allowing you to quickly scale capacity, b oth up
and down, as your computing requirements change. Amazon EC2 changes the economics of computing by allowing you to pay only f or
capacity that you actually use.

What can developers now do that they could not before EC2?

218 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Until now, small developers did not have the capital to acquire massive compute resources and ensure they had the capacity they needed to
handle unexpected spikes in load. Amazon EC2 enables any developer to leverage Amazon’s own benefits of massive scale with no up -front
investment or performance compromises. Developers are now free to innovate knowing that no matter how successful their businesses
become, it will be inexpensive and simple to ensure they have the compute capacity they need to meet their business requirements.
The “Elastic” nature of the service allows developers to instantly scale to meet spikes in traffic or demand. When computing requirements
unexpectedly change (up or down), Amazon EC2 can instantly respond, meaning that developers have the ability to control how ma ny
resources are in use at any given point in time. In contrast, traditional hosting services generally provide a fixed number of r esources for a
fixed amount of time, meaning that users have a limited ability to easily respond when their usage is rapidly changing, unpredictable, or is
known to experience large peaks at various intervals.

What is the difference between using the local instance store and Amazon Elastic Block Store (Amazon EBS) for the root device?

When you launch your Amazon EC2 instances you have the ability to store your root device data on Amazon EBS or the local instance store.
By using Amazon EBS, data on the root device will persist independently from the lifetime of the instance. This enables you to stop and
restart the instance at a subsequent time, which is similar to shutting down your laptop and restarting it when you need it again.
Alternatively, the local instance store only persists during the life of the instance. This is an inexpensive way to launch instances where data
is not stored to the root device. For example, some customers use this option to run large web sites where each instance is a clone to h andle
web traffic.

Is Amazon EC2 used in conjunction with Amazon S3?

Yes, Amazon EC2 is used jointly with Amazon S3 for instances with root devices backed by local instance storage. By using Ama zon S3,
developers have access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own
global network of web sites. In order to execute systems in the Amazon EC2 environment, developers use the tools provided to load their
AMIs into Amazon S3 and to move them between Amazon S3 and Amazon EC2.
Amazon EC2 provides cheap, scalable compute in the cloud while Amazon S3 allows users to store their data reliably.

How many instances can I run in Amazon EC2?

You are limited to running On-Demand Instances per your vCPU-based On-Demand Instance limit, purchasing 20 Reserved Instances, and
requesting Spot Instances per your dynamic Spot limit per region. New AWS accounts may start with limits that are lower than the limits
described here.

How quickly can I scale my EC2 capacity both up and down?

Amazon EC2 provides a truly elastic computing environment. Amazon EC2 enables you to increase or decrease capacity within min utes, not
hours or days. You can commission one, hundreds or even thousands of server instances sim ultaneously. When you need more instances,
you simply call RunInstances, and Amazon EC2 will typically set up your new instances in a matter of minutes. Of course, beca use this is all
controlled with web service APIs, your application can automatically scale itself up and down depending on its needs.

What operating system environments are supported on EC2?

Amazon EC2 currently supports a variety of operating systems including: Amazon Linux, Ubuntu, Windows Server, Red Hat Enterpr ise
Linux, SUSE Linux Enterprise Server, openSUSE Leap, Fedora, Fedora CoreOS, Debian, CentOS, Gentoo Linux, Oracle Linux, and
FreeBSD. AWS is always looking for ways to expand it to other platforms.

Does Amazon EC2 use ECC memory?

ECC memory is necessary for server infrastructure, and all the hardware underlying Amazon EC2 uses ECC memory.

How is EC2 service different than a plain hosting service?

Traditional hosting services generally provide a pre-configured resource for a fixed amount of time and at a predetermined cost. Amazon
EC2 differs fundamentally in the flexibility, control and significant cost savings it offers developers, allowing them to treat Amazon EC2 as
their own personal data center with the benefit of Amazon.com’s robust infrastructure.
When computing requirements unexpectedly change (up or down), Amazon EC2 can instantly respond, meaning that developers have the
ability to control how many resources are in use at any given point in time. In contrast, traditional hosting services genera lly provide a fixed
number of resources for a fixed amount of time, meaning that users have a limited ability to easily respond when their usage is rapidly
changing, unpredictable, or is known to experience large peaks at various intervals.
Secondly, many hosting services don’t provide full control over the compute resources being provided. Using Amazon EC2, developers can
choose not only to initiate or shut down instances at any time, they can completely customize the configuration of their inst ances to suit their
needs – and change it at any time. Most hosting services cater more towards groups of users with similar system requirements, and so offer
limited ability to change these.
Finally, with Amazon EC2 developers enjoy the benefit of paying only for their actual resource consumption – and at very low rates. Most
hosting services require users to pay a fixed, up-front fee irrespective of their actual computing power used, and so users risk overbuying
resources to compensate for the inability to quickly scale up resources within a short time frame.

Can I get a history of all EC2 API calls made on my account for security analysis and operational troubleshooting purposes?

219 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Yes. To receive a history of all EC2 API calls (including VPC and EBS) made on your account, you simply turn o n CloudTrail in the AWS
Management Console. For more information, visit the CloudTrail home page.
Source: AWS EC2 FAQs

DYNAMODB FAQs

What is Amazon DynamoDB?

DynamoDB is a fast and flexible nonrelational database service for any scale. DynamoDB enables customers to offload the administrative
burdens of operating and scaling distributed databases to AWS so that they don’t have to worry about hardware provisi oning, setup and
configuration, throughput capacity planning, replication, software patching, or cluster scaling.
Amazon DynamoDB is a fully managed proprietary NoSQL database service that supports key -value and document data structures and is
offered by Amazon.com as part of the Amazon Web Services portfolio. DynamoDB exposes a similar data model to and derives its name
from Dynamo, but has a different underlying implementation. Dynamo had a multi-master design requiring the client to resolve version
conflicts and DynamoDB uses synchronous replication across multiple datacenters for high durability and availability.

Amazon DynamoDB main charateristics:

- Fully Managed
- Fast, consistent Performance
- Fine-grained access control
- Flexible

220 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon DynamoDB is a low-latency NoSQL database.
DynamoDB consists of Tables, Items, and Attributes
DynamoDb supports both document and key-value data models
DynamoDB Supported documents formats are JSON, HTML, XML
DynamoDB has 2 types of Primary Keys: Partition Key and combination of Partition Key + Sort Key (Composite Key)
DynamoDB has 2 consistency models: Strongly Consistent / Eventually Consistent
DynamoDB Access is controlled using IAM policies.
DynamoDB has fine grained access control using IAM Condition parameter dynamodb:LeadingKeys to allow users to access only the
items where the partition key vakue matches their user ID.
DynamoDB Indexes enable fast queries on specific data columns
DynamoDB indexes give you a different view of your data based on alternative Partition / Sort Keys.
DynamoDB Local Secondary indexes must be created when you create your table, they have same partition Key as your table, and
they have a different Sort Key.
DynamoDB Global Secondary Index an be created at any time: at table creation or after. They have a different partition Key as your
table and a different sort key as your table.
A DynamoDB query operation finds items in a table using only the primary Key attribute: You provide the Primary Key name and a
distinct value to search for.
A DynamoDB Scan operation examines every item in the table. By default, it return data attributes.
DynamoDB Query operation is generally more efficient than a Scan.
With DynamoDB, you can reduce the impact of a query or scan by setting a smaller page size which uses fewer read operations.
To optimize DynamoDB performance, isolate scan operations to specific tables and segregate them from your mission -critical traffic.
To optimize DynamoDB performance, try Parallel scans rather than the default sequential scan.
To optimize DynamoDB performance: Avoid using scan operations if you can: design tables in a way that you can use Query, Get, or
BatchGetItems APIs.
When you scan your table in Amazon DynamoDB, you should follow the DynamoDB best practices for avoiding sudden bursts of read
activity.

What does DynamoDB manage on my behalf?

DynamoDB takes away one of the main stumbling blocks of scaling databases: the management of database software and the provis ioning
of the hardware needed to run it. You can deploy a nonrelational database in a matter of minutes. DynamoDB automatically scales
throughput capacity to meet workload demands, and partitions and repartitions your data as your table size grows. Also, Dynam oDB
synchronously replicates data across three facilities in an AWS Region, giving you high availability and data durability.

What is the consistency model of DynamoDB?

When reading data from DynamoDB, users can specify whether they want the read to be eventually consistent or strongly consist ent:

- Eventually consistent reads (the default) – The eventual consistency option maximizes your read throughput. However, an eventually
consistent read might not reflect the results of a recently completed write. All copies of data usually reach consiste ncy within a second.
Repeating a read after a short time should return the updated data.
- Strongly consistent reads — In addition to eventual consistency, DynamoDB also gives you the flexibility and control to request a strongly
consistent read if your application, or an element of your application, requires it. A strongly consistent read returns a result that reflects all
writes that received a successful response before the read.
- ACID transactions – DynamoDB transactions provide developers atomicity, c onsistency, isolation, and durability (ACID) across one or more
tables within a single AWS account and region. You can use transactions when building applications that require coordinated i nserts,
deletes, or updates to multiple items as part of a single logical business operation.

What kind of query functionality does DynamoDB support?

DynamoDB supports GET/PUT operations by using a user-defined primary key. The primary key is the only required attribute for items in a
table. You specify the primary key when you create a table, and it uniquely identifies each item. DynamoDB also provides flexible querying
by letting you query on nonprimary key attributes using global secondary indexes and local secondary indexes.
A primary key can be either a single-attribute partition key or a composite partition-sort key. A single-attribute partition key could be, for
example, UserID. Such a single attribute partition key would allow you to quickly read and write data for an item associated with a given user
ID.
DynamoDB indexes a composite partition-sort key as a partition key element and a sort key element. This multipart key maintains a
hierarchy between the first and second element values. For example, a composite partition-sort key could be a combination of UserID

221 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 (partition) and Timestamp (sort). Holding the partition key element constant, you can search across the sort key element to retrieve item s.
Such searching would allow you to use the Query API to, for example, retrieve all items for a single UserID across a r ange of time stamps.

How to update and query data items with DynamoDB?

After you have created a table using the DynamoDB console or CreateTable API, you can use the PutItem or BatchWriteItem APIs to insert
items. Then, you can use the GetItem, BatchGetIt em, or, if composite primary keys are enabled and in use in your table, the Query API to
retrieve the items you added to the table.

Can DynamoDB be used by applications running on any operating system?

Yes. DynamoDB is a fully managed cloud service that you access via API. Applications running on any operating system (such as Linux,
Windows, iOS, Android, Solaris, AIX, and HP-UX) can use DynamoDB. We recommend using the AWS SDKs to get started with DynamoDB.

What is the maximum throughput I can provision for a single DynamoDB table?

Maximum throughput per DynamoDB table is practically unlimited. For information about the limits in place, see Limits in Dyna moDB.
DynamoDB is designed to scale without limits. However, if you want to exceed throughput rates of 10,000 write capacity units or 10,000 read
capacity units for an individual table, you must Contact AWS to increase it.
If you want to provision more than 20,000 write capacity units or 20,000 read capacity units from a single subscriber account , you must first
contact AWS to request a limit increase.

What is the minimum throughput I can provision for a single DynamoDB table?

The smallest provisioned throughput you can request is 1 write capacity unit and 1 read capacity unit for both auto scaling a nd manual
throughput provisioning. Such provisioning falls within the free tier which allows for 25 units of write capacity and 25 units of read capacity.
The free tier applies at the account level, not the table level. In other words, if you add up the provi sioned capacity of all your tables, and if
the total capacity is no more than 25 units of write capacity and 25 units of read capacity, your provisioned capacity would fall into the free
tier.

How to increase DynamoDB performance using DAX?

DAX is a DynamoDB-compatible caching service that enables you to benefit from fast in-memory performance for demanding applications.
- As an in-memory cache, DAX reduces the response times of eventually-consistent read workloads by an order of magnitude, from
single-digit milliseconds to microseconds
- DAX improves response times for Eventually Consistent reads only.
- With DAX, you point your API calls to the DAX cluster instead of your table.
- If the item you are querying is on the cache, DAX will return it; otherwise, it will perform and Eventually Consistent GetItem operation
to your DynamoDB table.
- DAX reduces operational and application complexity by providing a managed service that is API compatible with Amazon DynamoDB,
and thus requires only minimal functional changes to use with an existing application.
- DAX is not suitable for write-intensive applications or applications that require Strongly Consistent reads.
- For read-heavy or bursty workloads, DAX provides increased throughput and potential operational cost savings by reducing the need to
over-provision read capacity units. This is especially beneficial for applications that require repeated reads for individual keys.

How to increase DynamoDB performance using ElastiCache?

- ElastiCache is an In-memory cache that sits between your application and database
- 2 different caching strategies: Lazy loading and Write Through: Lazy loading only caches the data when it is requested
- Elasticache Node failures are not fatal, just lots of cache misses
- Avoid stale data by implementing a TTL.
- Write-Through strategy writes data into cache whenever there is a change to the database. Data is never stale
- Write-Through penalty: Each write involves a write to the cache. Elasticache node failure means that data is missing until added or updated
in the database.
- Elasticache is wasted resources if most of the data is never used.
Source: AWS DYNAMODB FAQs

RDS FAQs

What is Amazon RDS?

Amazon Relational Database Service (Amazon RDS) is a managed service that makes it easy to set up, operate, and scale a relational
database in the cloud. It provides cost-efficient and resizable capacity, while managing time-consuming database administration tasks,
freeing you up to focus on your applications and business.
Amazon RDS gives you access to the capabilities of a familiar MySQL, MariaDB, Oracle, SQL Server, or PostgreSQL database. Thi s means

222 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 that the code, applications, and tools you already use today with your existing databases should work seamlessly with Amazon RDS.
Amazon RDS can automatically back up your database and keep your database software up to date with the latest version. You be nefit from
the flexibility of being able to easily scale the c ompute resources or storage capacity associated with your relational database instance. In
addition, Amazon RDS makes it easy to use replication to enhance database availability, improve data durability, or scale bey ond the
capacity constraints of a single database instance for read-heavy database workloads. As with all Amazon Web Services, there are no up-
front investments required, and you pay only for the resources you use.

Which relational database engines does Amazon RDS support?

Amazon RDS supports Amazon Aurora, MySQL, MariaDB, Oracle, SQL Server, and PostgreSQL database engines.

What does Amazon RDS manage on your behalf?

Amazon RDS manages the work involved in setting up a relational database: from provisioning the infrastructure capacity you r equest to
installing the database software. Once your database is up and running, Amazon RDS automates common administrative tasks such as
performing backups and patching the software that powers your database. With optional Multi-AZ deployments, Amazon RDS also manages
synchronous data replication across Availability Zones with automatic failover.
Since Amazon RDS provides native database access, you interact with the relational database software as you normally would. This means
you're still responsible for managing the database settings that are specific to your application. You'll need to build the relational schema that
best fits your use case and are responsible for any performance tuning to optimize your database for your application’s workf low.

When to use Amazon RDS vs. Amazon EC2 Relational Database AMIs?

Amazon Web Services provides a number of database alternatives for developers. Amazon RDS enables you to run a fully featured
relational database while offloading database administration. Using one of our many relational database AMIs on Amazon EC2 allows you to
manage your own relational database in the cloud. There are important differences between these alternatives that may make on e more
appropriate for your use case. See Cloud Databases with AWS for guidance on which solution is best for you.

What is a database instance (DB instance)?

You can think of a DB instance as a database environment in the cloud with the compute and storage resources you specify. You can create
and delete DB instances, define/refine infrastructure attributes of your DB instance(s), and control access and security via the AWS
Management Console, Amazon RDS APIs, and AWS Command Line Interface. You can run one or more DB instances, and each DB
instance can support one or more databases or database schemas, depending on engine type.

How many DB instances can I run with Amazon RDS?

By default, customers are allowed to have up to a total of 40 Amazon RDS DB instances. Of those 40, up to 10 can be Oracle or SQL Server
DB instances under the "License Included" model. All 40 can be used for Amazon Aurora, MySQL, MariaDB, PostgreSQL and Oracle under
the "BYOL" model. Note that RDS for SQL Server has a limit of up to 100 databases on a single DB instance to learn more see the Amazon
RDS SQL Server User Guide.

How many databases or schemas can I run within a DB instance in Amazon RDS?

RDS for Amazon Aurora: No limit imposed by software

RDS for MySQL: No limit imposed by software
RDS for MariaDB: No limit imposed by software
RDS for Oracle: 1 database per instance; no limit on number of schemas per database imposed by software
RDS for SQL Server: Up to 100 databases per instance see here: Amazon RDS SQL Server User Guide
RDS for PostgreSQL: No limit imposed by software

How to import data into an Amazon RDS DB instance in Amazon RDS?

There are a number of simple ways to import data into Amazon RDS, such as with the mys qldump or mysqlimport utilities for MySQL; Data
Pump, import/export or SQL Loader for Oracle; Import/Export wizard, full backup files (. bak files) or Bulk Copy Program (BCP) for SQL
Server; or pg_dump for PostgreSQL.

How to access my running DB instance in Amazon RDS?

Once your DB instance is available, you can retrieve its endpoint via the DB instance description in the AWS Management C onsole,
DescribeDBInstances API or describe-db-instances command. Using this endpoint you can construct the connection s tring required to
connect directly with your DB instance using your favorite database tool or programming language. In order to allow ne twork requests to your
running DB instance, you will need to authorize access.

What to do if my queries seem to be runn ing slowly in Amazon RDS?

- For production databases enable Enhanced Monitoring, which provides access to over 50 CPU, memory, file sy stem, and disk I/O
metrics. You can enable these features on a per-instance basis and you can choose the granularity (all the way down to 1 second). High
levels of CPU utilization can reduce query performance and in this case you may want to consider scaling your DB instance class.

223 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 - If you are using RDS for MySQL or MariaDB, you can access the slow query logs for your database to determine if there are slow-
running SQL queries and, if so, the performance characteristics of each. You could set the "slow_query_log" DB Parameter and query the
mysql.slow_log table to review the slow-running SQL queries.
- If you are using RDS for Oracle, you can use the Oracle trace file data to identify slow queries.
- If you're using RDS for SQL Server, you can use the client side SQL Server traces to identify slow queries.
Source: AWS RDS FAQs

AWS LAMBDA FAQs

What is AWS Lambda?

AWS Lambda lets you run code without provisioning or managing servers. You pay only for the comput e time you consume - there is no
charge when your code is not running. With Lambda, you can run code for virtually any type of application or backend service - all with zero
administration. Just upload your code and Lambda takes care of everything required to run and scale your code with high availability. You
can set up your code to automatically trigger from other AWS services or call it directly from any web or mobile app.

What events can trigger an AWS Lambda function?

AWS Lambda integrates with other AWS services to invoke functions. You can configure triggers to invoke a function in response to resource
lifecycle events, respond to incoming HTTP requests, consume events from a queue, or run on a schedule.
Each service that integrates with Lambda sends data to your function in JSON as an event. The structure of the event document is different
for each event type, and contains data about the resource or request that triggered the function. Lambda runtimes convert the event into an
object and pass it to your function.

Lambda main characteristics in images

224 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 225 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 226 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 227 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 228 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 229 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 230 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 231 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 232 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 233 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 234 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 235 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 236 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Source: AWS LAMBDA FAQs

AWS SERVERLESS FAQs

What is Amazon Elastic Container Service?

Amazon Elastic Container Service (ECS) is a highly scalable, high performance container management service that supports Dock er
containers and allows you to easily run applications on a managed cluster of Amazon EC2 instances. Amazon ECS eliminates the need for
you to install, operate, and scale your own cluster management infrastructure. With simple API calls, you can launch and stop container-
enabled applications, query the complete state of your cluster, and access many familiar features like security groups, Elastic Load
Balancing, EBS volumes and IAM roles. You can use Amazon ECS to schedule the placement of containers across your cluster base d on
your resource needs and availability requirements. You can also integrate your own scheduler or third-party schedulers to meet business or
application specific requirements.

Why should I use Amazon ECS?

Amazon ECS makes it easy to use containers as a building block for your applications by eliminating the need for you to inst all, operate, and
scale your own cluster management infrastructure. Amazon ECS lets you schedule long-running applications, services, and batch processes

237 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 using Docker containers. Amazon ECS maintains application availability and allows you to scale your containers up or down to meet your
application's capacity requirements. Amazon ECS is integrated with familiar features like Elastic Load Balancing, EBS volumes , VPC, and
IAM. Simple APIs let you integrate and use your own schedulers or connect Amazon ECS into your existing software delivery process.

What is the pricing for Amazon ECS?

There is no additional charge for Amazon ECS. You pay for AWS resources (e.g. EC2 instances or EBS volumes) you create to sto re and
run your application. You only pay for what you use, as you use it; there are no minimum fees and no upfront commitments.

How is Amazon ECS different from AWS Elastic Beanstalk?

AWS Elastic Beanstalk is an application management platform that helps customers easily deploy and scale web applicatio ns and services.
It keeps the provisioning of building blocks (e.g., EC2, RDS, Elastic Load Balancing, Auto Scaling, CloudWatch), deployment of application s,
and health monitoring abstracted from the user so they can just focus on writing code. You simply specify which container images are to be
deployed, the CPU and memory requirements, the port mappings, and the container links.
Elastic Beanstalk will automatically handle all the details such as provisioning an Amazon ECS cluster, balancing load, auto -scaling,
monitoring, and placing your containers across your cluster. Elastic Beanstalk is ideal if you want to leverage the benefits of containers but
just want the simplicity of deploying applications from development to production by uploading a container image. You can work with Amazon
ECS directly if you want more fine-grained control for custom application architectures.

How is Amazon ECS different from AWS Lambda?

Amazon ECS is a highly scalable Docker container management service that allows you to run and manage distributed applications that run
in Docker containers. AWS Lambda is an event-driven task compute service that runs your code in response to “events” such as changes in
data, website clicks, or messages from other AWS services without you having to manage any compute infrastructure.

Does Amazon ECS support any other container types?

No. Docker is the only container platform supported by Amazon ECS at this time.

Source: AWS ECS FAQs

What is AWS Identity and Access Management (IAM)?

You can use AWS IAM to securely control individual and group access to your AWS resources. You can create and manage user ide ntities
("IAM users") and grant permissions for those IAM users to access your resources. You can also grant permissions for users outside of AWS
( federated users).

What problems does IAM solve?

IAM makes it easy to provide multiple users secure access to your AWS resources. IAM enables you to:
- Manage IAM users and their access: You can cr eate users in AWS's identity management system, assign users individual
security credentials (such as access keys, passwords, multi -factor authentication devices), or request temporary security
credentials to provide users access to AWS services and resour ces. You can specify permissions to control which operations a
user can perform.
- Manage access for federated users: You can request security credentials with configurable expirations for users who you
manage in your corporate directory, allowing you to p rovide your employees and applications secure access to resources in your
AWS account without creating an IAM user account for them. You specify the permissions for these security credentials to cont rol
which operations a user can perform.

Who can use IAM?

Any AWS customer can use IAM. The service is offered at no additional charge. You will be charged only for the use of other AWS services
by your users.

What is a user?

A user is a unique identity recognized by AWS services and applications. Similar to a login user in an operating system like Windows or
UNIX, a user has a unique name and can identify itself using familiar security credentials such as a password or access key. A user can be
an individual, system, or application requiring access to AWS services. IAM supports users (referred to as "IAM users") managed in AWS's
identity management system, and it also enables you to grant access to AWS resources for users managed outside of AWS in your
corporate directory (referred to as "federated users").

What can a user do?

A user can place requests to web services such as Amazon S3 and Amazon EC2. A user's ability to access web service APIs is un der the
control and responsibility of the AWS account under which it is defined. You can permit a user to access any or all of the AWS services that
have been integrated with IAM and to which the AWS account has subscribed. If permitted, a user has access to all of the reso urces under
the AWS account. In addition, if the AWS account has access to resources from a different AWS account, its users may be able to access
data under those AWS accounts. Any AWS resources created by a user are under control of and paid for by its AWS account. A us er cannot
independently subscribe to AWS services or control resources.

238 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 How do users call AWS services?

Users can make requests to AWS services using security credentials. Explicit permissions govern a user's ability to call AWS services. By
default, users have no ability to call service APIs on behalf of the account.

Source: AWS IAM FAQs

What makes a service or application serverless?

The concept of serverless were founded on the following tenets: no server management, pay -for-value services, continuous scaling, and
built-in fault tolerance. When adopting a serverless service or building a serverless architecture, these ideals are fundamental to server less
strategy.

What is a serverless-first strategy?

A serverless-first strategy is the organizational dedication to prioritizing the tenets of serverless in your applications, operations, and
development cycles. A serverless developer or serverless -first company works to build using these tenets first and foremost, but knows that it
doesn’t work for every workload. Non-serverless technologies are incorporated as supporting architecture when needed.

As a developer, why should I use serverless?

A serverless approach will allow you to minimize undifferentiated work around managing servers, infrastructure, and the parts of the
application that add less value to your customers. Serverless can make it easier to deliver new features in applications, launch expe riments,
and improve your team delivery velocity, while also providing a pay -for-value cost model.

What is Function as a Service (FaaS)?

FaaS is the compute layer of a serverless architecture, which is AWS Lambda. In serverless applications, Lambda is typically used to
connect services, transform data, and implement business logic. Most serverless application consist of more than Lambda, so FaaS is
typically only one part of a serverless workload.

How does serverless lower costs?

If you use on-premise servers or EC2 instances, you are likely not using 100% of the compute capacity at all times. Many customers only
use 10-20% of the available capacity in their EC2 fleet at any point in time. This average is also affected by high availability and Disaster
Recovery requirements, which typically result in idle servers waiting for traffic from failovers. In the on -demand AWS Lambda compute
model, you pay per request and by duration of time. Additionally, serverless architectures can lower the overall Total Cost o f Ownership
since many of the networking, security, and DevOps management tasks are included in the cost of the serv ice.

How do I maintain the security posture I need?

AWS has a shared security model where AWS is responsible for security of the cloud and customers are responsible for security in the
cloud. With serverless, AWS manages many additional layers of infrast ructure, including operating systems and networking. If you follow the
principles of least privilege and the best practices of securing a serverless application, you can secure each resource with granular
permissions using familiar tools like AWS IAM, whic h can help give you a robust security posture for your serverless applications.

What is an event-driven architecture?

An event-driven architecture uses messages, or events, to trigger and communicate between decoupled services and is common in modern
applications built with microservices. Events contain information about a change in a system’s state, such as a new order or a completed
payment. Focusing on events helps avoid tight -coupling and can promote greater flexibility and extensibility for applications, which in turn
helps improve feature velocity and agility for your developer teams.

What is application integration?

Application integration on AWS is a suite of services that enable communication between decoupled components within microserv ices,
distributed systems, and serverless applications.

What is messaging in the context of serverless applications?

Event-driven architectures communicate across services using messages. Messages are lightweight JSON objects that typically contain
event details. AWS provides Amazon SQS, Amazon SNS, and Amazon EventBridge as serverless messaging services to help with routing
messages at scale. These services provide queues, message fan-out capabilities, event buses, content filtering, and other powerful features.

What is AWS SAM?

The AWS Serverless Application Model (AWS SAM) is a model to define serverless applications. AWS SAM is natively supported by AWS
CloudFormation and provides a simplified way of defining the Amazon API Gateway APIs, AWS Lambda functions, and Amazon DynamoDB.

Serverless characteristics?

239 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 240 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 241 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 242 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 How to automate building, testing, and deploying serverless applications.

You can use AWS CodePipeline with the AWS Serverless Application Model to automate building, testing, and deploying serverless
applications. AWS CodeBuild integrates with CodePipeline to provide automated builds. You can use AWS CodeDeploy to gradually roll out
and test new Lambda function versions.

How to monitor and troubleshoot the performance of your serverless applications?

You can monitor and troubleshoot the performance of your serverless applications and AWS Lambda functions with AWS services a nd third-
party tools. Amazon CloudWatch helps you see real-time reporting metrics and logs for your serverless applic ations. You can use AWS X-
Ray to debug and trace your serverless applications and AWS Lambda.

What is AWS Serverless Application Repository

The AWS Serverless Application Repository is a managed repository for serverless applications. It enables teams, organizations, and
individual developers to store and share reusable applications, and easily assemble and deploy serverless architectures in po werful new
ways. Using the Serverless Application Repository, you don't need to clone, build, package, or publish source code to AWS before deploying
it. Instead, you can use pre-built applications from the Serverless Application Repository in your serverless architectures, helping you and
your teams reduce duplicated work, ensure organizational best practices, and get to market faster.

Who can publish a serverless application to the Serverless Application Repository?

Anyone with an AWS account can publish a serverless application to the Serverless Application Repository. Applications can be privately
shared with specific AWS accounts. Applications that are shared publicly include a link to the application's source code so others can view
what the application does and how it works.

What kinds of applications are available in the AWS Serverless Application Repository?

The AWS Serverless Application Repository includes applications for Alexa Skills, chatbots, data processing, IoT, real time s tream
processing, web and mobile back-ends, social media trend analysis, image resizing, and more from publishers on AWS.

AWS Serverless Application Repository and Github?

243 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 The AWS Serverless Application Repository enables developers to publish serverless applications developed in a GitHub reposi tory. Using
AWS CodePipeline to link a GitHub source with the AWS Serverless Application Repository can make the publishing process even easier,
and the process can be set up in minutes.
What two arguments does a Python Lambda handler function require?

Event, Context

*
Source: AWS SERVERLESS FAQs

API Gateway FAQs

What is Amazon API Gateway?

Amazon API Gateway is a fully managed service that makes it easy for developers to publish, maintain, monitor, and secure API s at any
scale. With a few clicks in the AWS Management Console, you c an create an API that acts as a “front door” for applications to access data,
business logic, or functionality from your back-end services, such as applications running on Amazon Elastic Compute Cloud (Amazon EC2),
Amazon Elastic Container Service (Amazon ECS) or AWS Elastic Beanstalk, code running on AWS Lambda, or any web application.
Amazon API Gateway handles all of the tasks involved in accepting and processing up to hundreds of thousands of concurrent AP I calls,
including traffic management, authorization and access control, monitoring, and API version management. Amazon API Gateway has no
minimum fees or startup costs. For HTTP APIs and REST APIs, you pay only for the API calls you receive and the amount of data
transferred out. For WebSocket APIs, you pay only for messages sent and received and for the time a user/device is connected to the
WebSocket API.

Why use Amazon API Gateway?

Amazon API Gateway provides developers with a simple, flexible, fully managed, pay -as-you-go service that handles all aspects of creating
and operating robust APIs for application back ends. With API Gateway, you can launch new services faster and with reduced investment so
you can focus on building your core business services. API Gateway was built to help you with several aspects of creating and managing
APIs:
1- Metering: API Gateway helps you define plans that meter and restrict third-party developer access to your APIs. You can define a set of
plans, configure throttling, and quota limits on a per API key basis. API Gateway automatically meters traffic to your APIs and lets you extract
utilization data for each API key.
2- Security: API Gateway provides you with multiple tools to authorize access to your APIs and control service operation access. API
Gateway allows you to leverage AWS administration and security tools, such as AWS Identity and Access Management (IAM) and Amazon
Cognito, to authorize access to your APIs. API Gateway can verify signed API calls on your behalf using the same methodology AWS uses
for its own APIs. Using custom authorizers written as AWS Lambda functions, API Gateway can also help you verify incoming bearer tokens,
removing authorization concerns from your backend code.
3- Resiliency: API Gateway helps you manage traffic with throttling so that backend operations can withstand traffic spikes. API Gatew ay
also helps you improve the performance of your APIs and the latency your end users experience by caching the output of API ca lls to avoid
calling your backend every time.
4- Operations Monitoring: After an API is published and in use, API Gateway provides you with a metrics dashboard to monitor calls to
your services. The API Gateway dashboard, through integration with Amazon CloudWatch, provides you with backend performance m etrics
covering API calls, latency data and error rates. You can enable detailed metrics for each method in your APIs and also receive error, access
or debug logs in CloudWatch Logs.
5- Lifecycle Management: After an API has been published, you often need to build and test new versions that enhance or add new
functionality. API Gateway lets you operate multiple API versions and multiple stages for each version simultaneously so that existing
applications can continue to call previous versions after new API versions are published.
6- Desigend for developers: API Gateway allows you to quickly create APIs and assign static content for their responses to reduce cross -
team development effort and time-to-market for your applications. Teams who depend on your APIs can begin developm ent while you build
your backend processes.
7- Real-Time Two-Way Communication: Build real-time two-way communication applications such as chat apps, streaming dashboards,
and notifications without having to run or manage any servers. API Gateway maintains a persistent connection between connected users and
enables message transfer between them.

What API types are supported by Amazon API Gateway?

Amazon API Gateway offers two options to create RESTful APIs, HTTP APIs and REST APIs, as well as an option to create WebSocket
APIs.
- HTTP API: HTTP APIs are optimized for building APIs that proxy to AWS Lambda functions or HTTP backends, making them ideal for
serverless workloads. They do not currently offer API management functionality.
- REST API: REST APIs offer API proxy functionality and API management features in a single solution. REST APIs offer API management
features such as usage plans, API keys, publishing, and monetizing APIs.
- WebSocket API: WebSocket APIs maintain a persistent connection between connected clients to enable real-time message

244 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
communication. With WebSocket APIs in API Gateway, you can define backend integrations with AWS Lambda functions, Amazon Kine sis,
or any HTTP endpoint to be invoked when messages are received from the connected clients.

When creating RESTful APIs, when should I use HTTP APIs and when should I use REST APIs?

You can build RESTful APIs using both HTTP APIs and REST APIs in Amazon API Gateway.
HTTP APIs are optimized for building APIs that proxy to AWS Lambda functions or HTTP backends, making them ideal for serverless
workloads. HTTP APIs are a cheaper and faster alternative to REST APIs, but they do not currently support API management func tionality.
REST APIs are intended for APIs that require API proxy functionality and API management features in a single solution.
HTTP APIs are ideal for:
1- Building proxy APIs for AWS Lambda or any HTTP endpoint
2- Building modern APIs that are equipped with OIDC and OAuth 2 authorization
3- Workloads that are likely to grow very large
4- APIs for latency sensitive workloads
REST APIs are ideal for:
1- Customers looking to pay a single price point for an all -inclusive set of features needed to build, manage, and publish their APIs.
Can I create HTTPS endpoints ith API Gateway?

Yes, all of the APIs created with Amazon API Gateway expose HTTPS endpoints only. Amazon API Gateway does not support unencrypted
(HTTP) endpoints. By default, Amazon API Gateway assigns an internal domain to the API that automatically uses the Amazon AP I Gateway
certificate. When configuring your APIs to run under a custom domain name, you can provide your own certificate for the domain.

What data types can I use with Amazon API Gateway ?

APIs built on Amazon API Gateway can accept any payloads sent ov er HTTPS for HTTP APIs, REST APIs, and WebSock et APIs. Typical
data formats include JSON, XML, query string parameters, and request headers. You can declare any content type for your APIs responses,
and then use the transform templates to change the back -end response into your desired format.

With what backends can Amazon API Gateway communicate?

Amazon API Gateway can execute AWS Lambda functions in your account, start AWS Step Functions state machines, or call HTTP
endpoints hosted on AWS Elastic Beanstalk, Amazon EC2, and also non-AWS hosted HTTP based operations that are accessible via the
public Internet.API Gateway also allows you to specify a mapping template to generate static content to be returned, helping you mock your
APIs before the backend is ready. You can also integrate API Gateway with other AWS services directly – for example, you could expose an
API method in API Gateway that sends data directly to Amazon Kinesis.

For which client platforms can Amazon API Gateway generate SDKs?

API Gateway generates custom SDKs for mobile app development with Android and iOS (Swift and Objective-C), and for web app
development with JavaScript. API Gateway also supports generating SDKs for Ruby and Java. Once an API and its models are defi ned in
API Gateway, you can use the AWS console or the API Gateway APIs to generate and download a client SDK. Client SDKs are only
generated for REST APIs in Amazon API Gateway.

What can I manage through the Amazon API Gateway console?

Through the Amazon API Gateway console, you can define the REST API and its associated resources and methods, manage the API
lifecycle, generate client SDKs and view API metrics. You can also use the API Gateway console to define your APIs’ usage pla ns, manage
developers’ API keys, and configure throttling and quota limits. All of the same actions are available through the API Gateway APIs.

What is the Amazon API Gateway API lifecycle?

With Amazon API Gateway, each REST API can have multiple stages. Stages are meant to help with the deve lopment lifecycle of an API --
for example, after you’ve built your APIs and you deploy them to a development stage, or when you are ready for production, y ou can deploy
them to a production stage.

What is a resource?

A resource is a typed object that is part of your API’s domain. Each resource may have associated a data model, relationships to other
resources, and can respond to different methods. You can also define resources as variables to intercept requests to multiple child
resources.

What is a method?

Each resource within a REST API can support one or more of the standard HTTP methods. You define which verbs should be supported for
each resource (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS) and their implementation. For example, a GET to the cars resource
should return a list of cars. To connect all methods within a resource to a single backend endpoint, API Gateway also supports a special
“ANY” method.

What is a usage plan?

Usage plans help you declare plans for third-party developers that restrict access only to certain APIs, define throttling and request quota

245 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 limits, and associate them with API keys. You can also extract utilization data on an per-API key basis to analyze API usage and generate
billing documents. For example, you can create a basic, professional, and enterprise plans – you can configure the basic usage plan to only
allow 1,000 requests per day and a maximum of 5 requests per second (RPS).

What is a stage?

In Amazon API Gateway, stages are similar to tags. They define the path through which the deployment is accessible. For example, you can
define a development stage and deploy your cars API to it. The resource will be accessible at https://www.myapi.com/dev/cars. You can also
set up custom domain names to point directly to a stage, so that you don’t have to use the additional path parameter. For example, if you
pointed myapi.com directly to the development stage, you could access your cars resource at https://www.myapi.com/cars. Stage s can be
configured using variables that can be accessed from your API configuration or mapping templates.

What are stage variables?

Stage variables let you define key/value pairs of configuration values associated with a stage. These values, similarly to en vironment
variables, can be used in your API configuration. For example, you could define the HTTP endpoint for your method integration as a stage
variable, and use the variable in your API configuration instead of hardcoding the endpoint – this allows you to use a different endpoint for
each stage (e.g. dev, beta, prod) with the same API configuration. Stage variables are also accessible in the mapping templates and can be
used to pass configuration parameters to your Lambda or HTTP backend.

What is a Resource Policy?

A Resource Policy is a JSON policy document that you attach to an API to control whether a specified principal (typically an IAM user or role)
can invoke the API. You can use a Resource Policy to enable users from a different AWS account to securely acce ss your API or to allow the
API to be invoked only from specified source IP address ranges or CIDR blocks. Resource Policies can be used with REST APIs i n Amazon
API Gateway.

Can I use my Swagger API definitions?

Yes. You can use our open source Swagger importer tool to import your Swagger API definitions into Amazon API Gateway. With the
Swagger importer tool you can create and deploy new APIs as well as update existing ones.

Can I restrict access to private APIs to a specific Amazon VPC or VPC endpoint?

Yes, you can apply a Resource Policy to an API to restrict access to a specific Amazon VPC or VPC endpoint. You can also give an Amazon
VPC or VPC endpoint from a different account access to the Private API using a Resource Policy.

How do I authorize access to my APIs?

With Amazon API Gateway, you can optionally set your API methods to require authorization. When setting up a method to require
authorization you can leverage AWS Signature Version 4 or Lambda authorizers to support your own bearer token auth strategy.

What is a Lambda authorizer?

Lambda authorizers are AWS Lambda functions. With custom request authorizers, you will be able to authorize access to APIs us ing a
bearer token auth strategy such as OAuth. When an API is called, API Gateway checks if a Lambda authorizer is configured, API Gateway
then calls the Lambda function with the incoming authorization token. You can use Lambda to implement various authorization s trategies
(e.g. JWT verification, OAuth provider callout) that return IAM policies which are used to authorize the request. If the policy returned by the
authorizer is valid, API Gateway will cache the policy associated with the incoming token for up to 1 hour.

Can Amazon API Gateway generate API keys for distribution to third-party developers?

Yes. API Gateway can generate API keys and associate them with an usage plan. Calls received from each API key are monitored and
included in the Amazon CloudWatch Logs you can enable for each stage. However, we do not recommend you use API keys for
authorization. You should use API keys to monitor usage by third-party developers and leverage a stronger mechanism for authorization,
such as signed API calls or OAuth.

How can I address or prevent API threats or abuse?

API Gateway supports throttling settings for each method or route in your APIs. You can set a standard rate limit and a burst rate limit per
second for each method in your REST APIs and each route in WebSocket APIs. Further, API Gateway automatically protects your b ackend
systems from distributed denial-of-service (DDoS) attacks, whether attacked with counterfeit requests (Layer 7) or SYN floods (Layer 3).

Can I verify that it is API Gateway calling my backend?

Yes. Amazon API Gateway can generate a client -side SSL certificate and make the public key of that certificate available to you. Calls to
your backend can be made with the generated certificate, and you can verify calls originating from Amazon API Gateway using the public k ey
of the certificate.

Can I use AWS CloudTrail with Amazon API Gateway?

246 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Yes. Amazon API Gateway is integrated with AWS CloudTrail to give you a full auditable history of the changes to your REST APIs. All API
calls made to the Amazon API Gateway APIs to create, modify, delete, or deploy REST APIs are logged to CloudTrail in yo ur AWS account.

How does Amazon API Gateway work with an Amazon Virtual Private Cloud (Amazon VPC)?

In Amazon API Gateway, you can proxy requests to backend HTTP/HTTPS resources running in your Amazon VPC by setting up Privat e
Integrations using VPC Links. Client-side SSL certificates in Amazon API Gateway can be used to verify that requests to your backend
systems were sent by API Gateway using the public key of the certificate. You can also create Private APIs in Amazon API Gate way which
can only be accessible by resources within your Amazon VPC through Amazon VPC Endpoints.

Can I restrict access to private APIs to a specific Amazon VPC or VPC endpoint?

Yes, you can apply a Resource Policy to an API to restrict access to a specific Amazon VPC or VPC en dpoint. You can also give an Amazon
VPC or VPC endpoint from a different account access to the Private API using a Resource Policy

Can I configure my REST APIs in API Gateway to use TLS 1.1 or higher ?

If you’re using REST APIs, you can set up a CloudFront distribution with custom SSL certificate in your account and use it with Regional
APIs in API Gateway. You can then configure the Security Policy for the CloudFront distribution with TLS 1.1 or higher based on your
security and compliance requirements.

*
Source: AWS API GATEWAY FAQs

Practice Exam – 69 Questions & Answers

Practice Exam - Question 1:

_____ allows you to transform data using SQL as it's being passed through
Kinesis.

A
RDS
B
Kinesis Data Analytics
C
Redshift
D
DynamoDB

Your Answer: _______________

Your Notes:
_____________________________________________________
247 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 1
B.

Kinesis Data Analytics allows you to transform data using SQL.

Reference: Amazon Kinesis Data Analytics -

Practice Exam - Question 2:

You are a security architect working for a large antivirus Djamgatech’s company. The
production environment has recently been moved to AWS and is in a public subnet. You
are able to view the production environment over HTTP. However, when your customers
try to update their virus definition files over a custom port, that port i s blocked. You log
in to the console and you allow traffic in over the custom port. How long will this take to
take effect?
A
After a few minutes.
B
Immediately.
C
Straight away, but to the new instances only.
D
Straight away to the new instances, but old instances must be stopped and restarted
before the new rules apply.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 2

248 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 B.

Immediately
Reference: IAM

Practice Exam - Question 3:

The company Djamgatech runs an online voting system for a weekly live
television program. During broadcasts, users submit hundreds of thousands of
votes within minutes to a front-end fleet of Amazon EC2 instances that run in an
Auto Scaling group. The EC2 instances write the votes to an Amazon RDS
database. However, the database is unable to keep up with the requests that
come from the EC2 instances. A solutions architect must design a solution that
processes the votes in the most efficient manner and without downtime. Which
solution meets these requirements?

A
Migrate the front-end application to AWS Lambda. Use Amazon API Gateway to route user requests to the Lambda functions.
B
Scale the database horizontally by converting it to a Multi-AZ deployment. Configure the front-end application to write to both the primary and
secondary DB instances.
C
Configure the front-end application to send votes to an Amazon Simple Queue Service (Amazon SQS) queue. Provision worker instances to
read the SQS queue and write the vote information to the database.
D
Use Amazon EventBridge (Amazon CloudWatch Events) to create a scheduled event to re-provision the database with larger, memory
optimized instances during voting periods. When voting ends, re-provision the database to use smaller instances.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 3

C.

' Decouple the ingestion of votes from the database to allow the voting system
to continue processing votes without waiting for the database writes. Add
dedicated workers to read from the SQS queue to allow votes to be entered

249 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 into the database at a controllable rate. The votes will be added to the
database as fast as the database can process them, but no votes will be lost.

Reference: Decouple

Practice Exam - Question 4:

The company Djamgatech has a two-tier application architecture that runs in
public and private subnets. Amazon EC2 instances running the web application
are in the public subnet and an EC2 instance for the database runs on the private
subnet. The web application instances and the database are running in a single
Availability Zone (AZ). Which combination of steps should a solutions architect
take to provide high availability for this architecture? (Select TWO.)
A
Create new public and private subnets in the same AZ.
B
Create an Amazon EC2 Auto Scaling group and Application Load Balancer spanning multiple AZs for the web application instances.
C
Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer.
D
Create new public and private subnets in the same VPC, each in a new AZ. Create an Amazon RDS Multi-AZ DB instance in the private
subnets. Migrate the old database contents to the new DB instance.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 4

B. D.

Create new subnets in a new Availability Zone (AZ) to provide a redundant

network. Create an Auto Scaling group with instances in two AZs behind the
load balancer to ensure high availability of the web application and
redistribution of web traffic between the two public AZs. Create an RDS DB

250 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
instance in the two private subnets to make the database tier highly available
too.

Reference: Auto Scaling group with instances in two AZs behind the load
balancer

Practice Exam - Question 5:

A website runs a custom web application that receives a burst of traffic each day
at noon. The users upload new pictures and content daily, but have been
complaining of timeouts. The architecture uses Amazon EC2 Auto Scaling
groups, and the application consistently takes 1 minute to initiate upon boot up
before responding to user requests. How should a solutions architect redesign
the architecture to better respond to changing traffic?

A
Configure a Network Load Balancer with a slow start configuration.
B
Configure Amazon ElastiCache for Redis to offload direct requests from the EC2 instances.
C
Configure an Auto Scaling step scaling policy with an EC2 instance warmup condition.
D
Configure Amazon CloudFront to use an Application Load Balancer as the origin.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 5

C.

The current configuration puts new EC2 instances into service before they are
able to respond to transactions. This could also cause the instances to
overscale. With a step scaling policy, you can specify the number of seconds
that it takes for a newly launched instance to warm up. Until its specified
251 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 warm-up time has expired, an EC2 instance is not counted toward the
aggregated metrics of the Auto Scaling group. While scaling out, the Auto
Scaling logic does not consider EC2 instances that are warming up as part of
the current capacity of the Auto Scaling group. Therefore, multiple alarm
breaches that fall in the range of the same step adjustment result in a single
scaling activity. This ensures that you do not add more instances than you
need.

Reference: Step scaling policy

Practice Exam - Question 6:

The company Djamgatech plans to migrate its on-premises workload to AWS. The
current architecture is composed of a Microsoft SharePoint server that uses a
Windows shared file storage. The Solutions Architect needs to use a cloud
storage solution that is highly available and can be integrated with Active
Directory for access control and authentication. Which of the following options
can satisfy the given requirement?
A
Create a file system using Amazon EFS and join it to an Active Directory domain.
B
Create a file system using Amazon FSx for Windows File Server and join it to an Active Directory domain in AWS.
C
Create a Network File System (NFS) file share using AWS Storage Gateway.
D
Launch an Amazon EC2 Windows Server to mount a new S3 bucket as a file volume.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 6

B.

252 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Amazon FSx for Windows File Server provides fully managed, highly reliable,
and scalable file storage that is accessible over the industry -standard Service
Message Block (SMB) protocol. It is built on Windows Server, delivering a
wide range of administrative features such as user quotas, end-user file
restore, and Microsoft Active Directory (AD) integration. Amazon FSx is
accessible from Windows, Linux, and MacOS compute instances and devices.
Thousands of compute instances and devices can access a file system
concurrently.

Reference: FSx

Practice Exam - Question 7:

A Djamgatech’s Forex trading platform, which frequently processes and stores
global financial data every minute, is hosted in your on-premises data center and
uses an Oracle database. Due to a recent cooling problem in their data center, the
Djamgatech’s company urgently needs to migrate their infrastructure to AWS to
improve the performance of their applications. As the Solutions Architect, you are
responsible in ensuring that the database is properly migrated and should remain
available in case of database server failure in the future. Which of the following is
the most suitable solution to meet the requirement?
A
Create an Oracle database in RDS with Multi-AZ deployments.
B
Launch an Oracle database instance in RDS with Recovery Manager (RMAN) enabled.
C
Launch an Oracle Real Application Clusters (RAC) in RDS.
D
Convert the database schema using the AWS Schema Conversion Tool and AWS Database Migration Service. Migrate the Oracle database
to a non-cluster Amazon Aurora with a single instance.

Your Answer: _______________

Your Notes:
_____________________________________________________

253 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 7
A.

Amazon RDS Multi-AZ deployments provide enhanced availability and

durability for Database (DB) Instances, making them a natural fit for
production database workloads. When you provision a Multi-AZ DB Instance,
Amazon RDS automatically creates a primary DB Instance and synchronously
replicates the data to a standby instance in a different Availability Zone (AZ).
Each AZ runs on its own physically distinct, independent infrastructure, and is
engineered to be highly reliable.

Reference: RDS Multi AZ

Practice Exam - Question 8:

A Djamgatech’s data analytics company, which uses machine learning to collect
and analyze consumer data, is using Redshift cluster as their data warehouse.
You are instructed to implement a disaster recovery plan for their systems to
ensure business continuity even in the event of an AWS region outage. Which of
the following is the best approach to meet this requirement?

A
Do nothing because Amazon Redshift is a highly available, fully-managed data warehouse which can withstand an outage of an entire AWS
region.
B
Enable Cross-Region Snapshots Copy in your Amazon Redshift Cluster.
C
Create a scheduled job that will automatically take the snapshot of your Redshift Cluster and store it to an S3 bucket. Restore the snapshot
in case of an AWS region outage.
D
Use Automated snapshots of your Redshift Cluster.

Your Answer: _______________

Your Notes:
_____________________________________________________

254 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 8
B.

You can configure Amazon Redshift to copy snapshots for a cluster to another
region. To configure cross-region snapshot copy, you need to enable this
copy feature for each cluster and configure where to copy snapshots and how
long to keep copied automated snapshots in the destination region. When
cross-region copy is enabled for a cluster, all new manual and automatic
snapshots are copied to the specified region.

Reference: Redshift Snapshots

Practice Exam - Question 9:

A Djamgatech start-up company has an EC2 instance that is hosting a web
application. The volume of users is expected to grow in the coming months and
hence, you need to add more elasticity and scalability in your AWS architecture
to cope with the demand. Which of the following options can satisfy the above
requirement for the given scenario? (Select TWO.)
A
Set up two EC2 instances and then put them behind an Elastic Load balancer (ELB).
B
Set up two EC2 instances deployed using Launch Templates and integrated with AWS Glue.
C
Set up an S3 Cache in front of the EC2 instance.
D
Set up two EC2 instances and use Route 53 to route traffic based on a Weighted Routing Policy.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 9

255 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A. D.

Using an Elastic Load Balancer is an ideal solution for adding elasticity to your
application. Alternatively, you can also create a policy in Route 53, such as a
Weighted routing policy, to evenly distribute the traffic to 2 or more EC2
instances. Hence, setting up two EC2 instances and then put them behind an
Elastic Load balancer (ELB) and setting up two EC2 instances and using
Route 53 to route traffic based on a Weighted Routing Policy are the c orrect
answers.

Reference: Elastic Load Balancing

Practice Exam - Question 10:

The company Djamgatech plans to deploy a Docker-based batch application in
AWS. The application will be used to process both mission-critical data as well as
non-essential batch jobs. Which of the following is the most cost-effective option
to use in implementing this architecture?

A
Use ECS as the container management service then set up Reserved EC2 Instances for processing both mission-critical and non-essential
batch jobs.
B
Use ECS as the container management service then set up a combination of Reserved and Spot EC 2 Instances for processing mission-
critical and non-essential batch jobs respectively.
C
Use ECS as the container management service then set up On-Demand EC2 Instances for processing both mission-critical and non-
essential batch jobs.
D
Use ECS as the container management service then set up Spot EC2 Instances for processing both mission-critical and non-essential batch
jobs.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 10

256 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 B.

Amazon ECS lets you run batch workloads with managed or custom
schedulers on Amazon EC2 On-Demand Instances, Reserved Instances, or
Spot Instances. You can launch a combination of EC2 instances to set up a
cost-effective architecture depending on your workload. You can launch
Reserved EC2 instances to process the mission-critical data and Spot EC2
instances for processing non-essential batch jobs. There are two different
charge models for Amazon Elastic Container Service (ECS): Fargate Launch
Type Model and EC2 Launch Type Model. With Fargate, you pay for the
amount of vCPU and memory resources that your containerized application
requests while for EC2 launch type model, there is no additional charge. You
pay for AWS resources (e.g. EC2 instances or EBS volumes) you create to
store and run your application. You only pay for what you use, as you use it;
there are no minimum fees and no upfront commitments. In this scenario, the
most cost-effective solution is to use ECS as the container management
service then set up a combination of Reserved and Spot EC2 Instances for
processing mission-critical and non-essential batch jobs respectively. You can
use Scheduled Reserved Instances (Scheduled Instances) which enables you
to purchase capacity reservations that recur on a daily, weekly, or monthly
basis, with a specified start time and duration, for a one-year term. This will
ensure that you have an uninterrupted compute capacity to process your
mission-critical batch jobs.

Reference: Emazon ECS

Tags: #AWS #SAA #SAAC02 #SAAC03

Practice Exam - Question 11:

The company Djamgatech has recently adopted a hybrid cloud architecture and is
planning to migrate a database hosted on-premises to AWS. The database
currently has over 50 TB of consumer data, handles highly transactional (OLTP)
workloads, and is expected to grow. The Solutions Architect should ensure that
the database is ACID-compliant and can handle complex queries of the
application. Which type of database service should the Architect use?

A
Amazon DynamoDB
B

257 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon RDS
C
Amazon Redshift
D
Amazon Aurora

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 11

D.

Amazon Aurora (Aurora) is a fully managed relational database engine that’s

compatible with MySQL and PostgreSQL. You already know how MySQL and
PostgreSQL combine the speed and reliability of high-end commercial
databases with the simplicity and cost-effectiveness of open-source
databases. The code, tools, and applications you use today with your existing
MySQL and PostgreSQL databases can be used with Aurora. With some
workloads, Aurora can deliver up to five times the throughput of MySQL and
up to three times the throughput of PostgreSQL without requiring changes to
most of your existing applications. Aurora includes a high-performance
storage subsystem. Its MySQL- and PostgreSQL-compatible database
engines are customized to take advantage of that fast distributed storage. The
underlying storage grows automatically as needed, up to 64 tebibytes (TiB).
Aurora also automates and standardizes database clustering and replicati on,
which are typically among the most challenging aspects of database
configuration and administration.

Reference: Aurora

Practice Exam - Question 12:

258 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
An online stocks trading application that stores financial data in an S3 bucket has
a lifecycle policy that moves older data to Glacier every month. There is a strict
compliance requirement where a surprise audit can happen at anytime and you
should be able to retrieve the required data in under 15 minutes under all
circumstances. Your manager instructed you to ensure that retrieval capacity is
available when you need it and should handle up to 150 MB/s of retrieval
throughput. Which of the following should you do to meet the above
requirement? (Select TWO.)
A
Retrieve the data using Amazon Glacier Select.
B
Use Bulk Retrieval to access the financial data.
C
Purchase provisioned retrieval capacity.
D
Use Expedited Retrieval to access the financial data.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 12

C. D.

Expedited retrievals allow you to quickly access your data when occasional
urgent requests for a subset of archives are required. For all but the largest
archives (250 MB+), data accessed using Expedited retrievals are typically
made available within 1'5 minutes. Provisioned Capacity ensures that retrieval
capacity for Expedited retrievals is available when you need it. To make an
Expedited, Standard, or Bulk retrieval, set the Tier parameter in the Initiate
Job (POST jobs) REST API request to the option you want, or the equivalent
in the AWS CLI or AWS SDKs. If you have purchased provisioned capacity,
then all expedited retrievals are automatically served through your provisioned
capacity. Provisioned capacity ensures that your retrieval capacity for
expedited retrievals is available when you need it. Each unit of capacity
provides that at least three expedited retrievals can be performed every five
259 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 minutes and provides up to 150 MB/s of retrieval throughput. You should
purchase provisioned retrieval capacity if your workload requires highly
reliable and predictable access to a subset of your data in minutes. Without
provisioned capacity Expedited retrievals are accepted, except for rare
situations of unusually high demand. However, if you require access to
Expedited retrievals under all circumstances, you must purchase provisioned
retrieval capacity.

Reference: Amazon Glacier

Practice Exam - Question 13:

A multi-tiered application hosted in your on-premises data center is scheduled to
be migrated to AWS. The application has a message broker service which uses
industry standard messaging APIs and protocols that must be migrated as well,
without rewriting the messaging code in your application. Which of the following
is the most suitable service that you should use to move your messaging service
to AWS?
A
Amazon MQ
B
Amazon SQS
C
Amazon SNS
D
Amazon SWF

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 13

A.

260 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon MQ, Amazon SQS, and Amazon SNS are messaging services that
are suitable for anyone from startups to enterprises. If you’re using messaging
with existing applications and want to move your messaging service to the
cloud quickly and easily, it is recommended that you consider Amazon MQ. It
supports industry-standard APIs and protocols so you can switch from any
standards-based message broker to Amazon MQ without rewriting the
messaging code in your applications.

Reference: Amazon MQ

Practice Exam - Question 14:

An application is using a Lambda function to process complex financial data that
run for 15 minutes on average. Most invocations were successfully processed.
However, you noticed that there are a few terminated invocations throughout the
day, which caused data discrepancy in the application. Which of the following is
the most likely cause of this issue?

A
The failed Lambda functions have been running for over 15 minutes and reached the maximum execution time.
B
The concurrent execution limit has been reached.
C
The Lambda function contains a recursive code and has been running for over 15 minutes.
D
The failed Lambda Invocations contain a ServiceException error which means that the AWS Lambda service encountered an interna l error.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 14

A.

261 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A Lambda function consists of code and any associated dependencies. In
addition, a Lambda function also has configuration information associated with
it. Initially, you specify the configuration information when you create a
Lambda function. Lambda provides an API for you to update some of the
configuration data. You pay for the AWS resources that are used to run your
Lambda function. To prevent your Lambda function from running indefinitely,
you specify a timeout. When the specified timeout is reached, AWS Lambda
terminates execution of your Lambda function. It is recommended that you set
this value based on your expected execution time. The default timeout is 3
seconds and the maximum execution duration per request in AWS Lambda is
900 seconds, which is equivalent to 15 minutes.

Reference: Lambda

Practice Exam - Question 15:

The company Djamgatech has a top priority requirement to monitor a few
database metrics and then afterward, send email notifications to the Operations
team in case there is an issue. Which AWS services can accomplish this
requirement? (Select TWO.)
A
Amazon Simple Queue Service (SQS)
B
Amazon CloudWatch
C
Amazon EC2 Instance with a running Berkeley Internet Name Domain (BI ND) Server.
D
Amazon Simple Notification Service (SNS)

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 15

262 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A. D.

Amazon CloudWatch and Amazon Simple Notification Service (SNS) are

correct. In this requirement, you can use Amazon CloudWatch to monitor the
database and then Amazon SNS to send the emails to the Operations team.
Take note that you should use SNS instead of SES (Simple Email Service)
when you want to monitor your EC2 instances.

Reference: CloudWatch

Practice Exam - Question 16:

The company Djamgatech is in the process of migrating their applications to
AWS. One of their systems requires a database that can scale globally and handle
frequent schema changes. The application should not have any downtime or
performance issues whenever there is a schema change in the database. It
should also provide a low latency response to high-traffic queries. Which is the
most suitable database solution to use to achieve this requirement?

A
Amazon DynamoDB
B
An Amazon RDS instance in Multi-AZ Deployments configuration
C
Redshift
D
An Amazon Aurora database with Read Replicas

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 16

A.

263 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Amazon DynamoDB helps solve the problems that limit the relational system
scalability by avoiding them. In DynamoDB, you design your schema
specifically to make the most common and important queries as fast and as
inexpensive as possible. Your data structures are tailored to the specific
requirements of your business use cases.

Reference: DynamoDB

Practice Exam - Question 17:

A Djamgatech’s data analytics company, which uses machine learning to collect
and analyze consumer data, is using Redshift cluster as their data warehouse.
You are instructed to implement a disaster recovery plan for their systems to
ensure business continuity even in the event of an AWS region outage. Which of
the following is the best approach to meet this requirement?
A
Enable Cross-Region Snapshots Copy in your Amazon Redshift Cluster.
B
Use Automated snapshots of your Redshift Cluster.
C
Do nothing because Amazon Redshift is a highly available, fully -managed data warehouse which can withstand an outage of an entire AWS
region.
D
Create a scheduled job that will automatically take the snapshot of your Redshift Cluster and store it to an S3 bucket. Resto re the snapshot
in case of an AWS region outage.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 17

A.

You can configure Amazon Redshift to copy snapshots for a cluster to another
region. To configure cross-region snapshot copy, you need to enable this
264 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
copy feature for each cluster and configure where to copy snapshots and how
long to keep copied automated snapshots in the destination region. When
cross-region copy is enabled for a cluster, all new manual and automatic
snapshots are copied to the specified region.

Reference: Redshift Cross Region Snapshots copy

Practice Exam - Question 18:

The company Djamgatech has a set of Linux servers running on multiple On-
Demand EC2 Instances. The Audit team wants to collect and process the
application log files generated from these servers for their report. Which of the
following services is best to use in this case?
A
A single On-Demand Amazon EC2 instance for both storing and processing the log files
B
Amazon S3 Glacier for storing the application log files and Spot EC2 Instances for processing them.
C
Amazon S3 Glacier Deep Archive for storing the application log files and AWS ParallelCluster for processing the log files.
D
Amazon S3 for storing the application log files and Amazon Elastic MapReduce for processing the log files.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 18

D.

Amazon EMR is a managed cluster platform that simplifies running big data
frameworks, such as Apache Hadoop and Apache Spark, on AWS to process
and analyze vast amounts of data. By using these frameworks and related
open-source projects such as Apache Hive and Apache Pig, you can process
data for analytics purposes and business intelligence workloads. Additionally,
265 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
you can use Amazon EMR to transform and move large amounts of data into
and out of other AWS data stores and databases such as Amazon Simple
Storage Service (Amazon S3) and Amazon DynamoDB.

Reference: Apache EMR

Practice Exam - Question 19:

The company Djamgatech plans to implement a network monitoring system in
AWS. The Solutions Architect launched an EC2 instance to host the monitoring
system and used CloudWatch to monitor, store, and access the log files of the
instance. Which of the following provides an automated way to send log data to
CloudWatch Logs from the Amazon EC2 instance?
A
CloudTrail with log file validation
B
CloudWatch Logs agent
C
AWS Transfer for SFTP
D
CloudTrail Processing Library

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 19

B.

CloudWatch Logs enables you to centralize the logs from all of your systems,
applications, and AWS services that you use, in a single, highly scalable
service. You can then easily view them, search them for specific error codes
or patterns, filter them based on specific fields, or archive them securely for
future analysis. CloudWatch Logs enables you to see all of your logs,
266 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 regardless of their source, as a single and consistent flow of events ordered
by time, and you can query them and sort them based on other dimensions,
group them by specific fields, create custom computations with a powerful
query language, and visualize log data in dashboards.

Reference: CloudWatch Logs

Practice Exam - Question 20:

An IT consultant is working for a Djamgatech’s large financial company. The role
of the consultant is to help the development team build a highly available web
application using stateless web servers. In this scenario, which AWS services are
suitable for storing session state data? (Select TWO.)
A
DynamoDB
B
Redshift Spectrum
C
RDS
D
ElastiCache

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 20

A. D.

DynamoDB and ElastiCache are the correct answers. You can store session
state data on both DynamoDB and ElastiCache. These AWS services provide
high-performance storage of key-value pairs which can be used to build a
highly available web application.

267 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Reference: DynamoDB - ElastiCache

Practice Exam - Question 21:

A Djamgatech company is currently using Auto Scaling for their web application.
A new AMI now needs to be used for launching a fleet of EC2 instances. Which of
the following changes needs to be done?
A
Create a new target group.
B
Create a new target group and launch configuration.
C
Create a new launch configuration.
D
Do nothing. You can start directly launching EC2 instances in the Auto Scaling group with the same launch configuration.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 21

C.

A launch configuration is a template that an Auto Scaling group uses to launch

EC2 instances. When you create a launch configuration, you specify
information for the instances such as the ID of the Amazon Machine Image
(AMI), the instance type, a key pair, one or more security groups, and a block
device mapping. If you’ve launched an EC2 instance before, you specified the
same information in order to launch the instance.

Reference: launch configuration

268 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Question 22:
The company Djamgatech is planning to launch an application which requires a
data warehouse that will be used for their infrequently accessed data. You need
to use an EBS Volume that can handle large, sequential I/O operations. Which of
the following is the most cost-effective storage type that you should use to meet
the requirement?

A
Cold HDD (sc1)
B
Provisioned IOPS SSD (io1)
C
EBS General Purpose SSD (gp2)
D
Throughput Optimized HDD (st1)

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 22

A.

Cold HDD volumes provide low-cost magnetic storage that defines

performance in terms of throughput rather than IOPS. With a lower throughput
limit than Throughput Optimized HDD, this is a good fit ideal for large,
sequential cold-data workloads. If you require infrequent access to your data
and are looking to save costs, Cold HDD provides inexpensive block storage.
Take note that bootable Cold HDD volumes are not supported.

Reference: Cold HDD

Practice Exam - Question 23:

269 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A Djamgatech company currently has an on-premises infrastructure. They are
currently running low on storage and want to have the ability to extend their
storage using the AWS cloud. Which AWS service can help them achieve this
requirement?
A
Amazon EC2
B
Amazon Storage Gateway
C
Amazon Elastic Block Storage
D
Amazon SQS

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 23

B.

AWS Storage Gateway connects an on-premises software appliance with

cloud-based storage to provide seamless integration with data security
features between your on-premises IT environment and the AWS storage
infrastructure. You can use the service to store data in the AWS Cloud for
scalable and cost-effective storage that helps maintain data security.

Reference: Amazon Storage Gateway

Practice Exam - Question 24:

A Solutions Architect needs to set up a bastion host in the cheapest, most secure
way. The Architect should be the only person that can access it via SSH. Which of
the following steps would satisfy this requirement?
A

270 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Set up a small EC2 instance and a security group that only allows access on port 22
B
Set up a large EC2 instance and a security group that only allows access on port 22
C
Set up a large EC2 instance and a security group that only allows access on port 22 via your IP address
D
Set up a small EC2 instance and a security group that only allows access on port 22 via your IP address

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 24

D.

A bastion host is a server whose purpose is to provide access to a private

network from an external network, such as the Internet. Because of its
exposure to potential attack, a bastion host must minimize the chances of
penetration.

Reference: Bastion Host

Tags: #AWS #SAA #SAAC02 #SAAC03

Practice Exam - Question 25:

A Djamgatech’s Forex trading platform, which frequently processes and stores
global financial data every minute, is hosted in your on-premises data center and
uses an Oracle database. Due to a recent cooling problem in their data center, the
company urgently needs to migrate their infrastructure to AWS to improve the
performance of their applications. As the Solutions Architect, you are responsible
in ensuring that the database is properly migrated and should remain available in
case of database server failure in the future. Which of the following is the most
suitable solution to meet the requirement?

271 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A
Create an Oracle database in RDS with Multi-AZ deployments.
B
Launch an Oracle Real Application Clusters (RAC) in RDS.
C
Convert the database schema using the AWS Schema Conversion Tool and AWS Database Migration Service. Migrat e the Oracle database
to a non-cluster Amazon Aurora with a single instance.
D
Launch an Oracle database instance in RDS with Recovery Manager (RMAN) enabled.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 25

A.

Amazon RDS Multi-AZ deployments provide enhanced availability and

durability for Database (DB) Instances, making them a natural fit for
production database workloads. When you provision a Multi-AZ DB Instance,
Amazon RDS automatically creates a primary DB Instance and synchronously
replicates the data to a standby instance in a different Availability Zone (AZ).
Each AZ runs on its own physically distinct, independent infrastructure, and is
engineered to be highly reliable.

Reference: Multi-AZ

Practice Exam - Question 26:

The company Djamgatech installed sensors to track the number of people who
visit the park. The data is sent every day to an Amazon Kinesis stream with
default settings for processing, in which a consumer is configured to process the
data every other day. You noticed that the S3 bucket is not receiving all of the
data that is being sent to the Kinesis stream. You checked the sensors if they are

272 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
properly sending the data to Amazon Kinesis and verified that the data is indeed
sent every day. What could be the reason for this?

A
By default, the data records are only accessible for 24 hours from the time they are added to a Kinesis stream.
B
There is a problem in the sensors. They probably had some intermittent connection hence, the data is not sent to the stream.
C
By default, Amazon S3 stores the data for 1 day and moves it to Amazon Glacier.
D
Your AWS account was hacked and someone has deleted some data in your Kinesis stream.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 26

A.

Kinesis Data Streams supports changes to the data record retention period of
your stream. A Kinesis data stream is an ordered sequence of data records
meant to be written to and read from in real-time. Data records are therefore
stored in shards in your stream temporarily.

Reference: Kinesis Data Stream

Practice Exam - Question 27:

The company Djamgatech has a running m5ad.large EC2 instance with a default
attached 75 GB SSD instance-store backed volume. You shut it down and then
start the instance. You noticed that the data which you have saved earlier on the
attached volume is no longer available. What might be the cause of this?

A
The EC2 instance was using instance store volumes, which are ephemeral and only live for the life of the instance.
B
The instance was hit by a virus that wipes out all data.

273 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 C
The EC2 instance was using EBS backed root volumes, which are ephemeral and only live for the life of the instance.
D
The volume of the instance was not big enough to handle all of the processing data.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 27

A.

An instance store provides temporary block-level storage for your instance.

This storage is located on disks that are physically attached to the host
computer. Instance store is ideal for temporary storage of information that
changes frequently, such as buffers, caches, scratch data, and other
temporary content, or for data that is replicated across a fleet of instances,
such as a load-balanced pool of web servers.

Reference: Instance Storage

Practice Exam - Question 28:

The company Djamgatech plans to migrate its on-premises workload to AWS. The
current architecture is composed of a Microsoft SharePoint server that uses a
Windows shared file storage. The Solutions Architect needs to use a cloud
storage solution that is highly available and can be integrated with Active
Directory for access control and authentication. Which of the following options
can satisfy the given requirement?

A
Create a file system using Amazon EFS and join it to an Active Directory domain.
B
Launch an Amazon EC2 Windows Server to mount a new S3 bucket as a file volume.
C
Create a Network File System (NFS) file share using AWS Storage Gateway.

274 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 D
Create a file system using Amazon FSx for Windows File Server and join it to an Active Directory domain in AWS.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 28

D.

Amazon FSx for Windows File Server provides fully managed, highly reliable,
and scalable file storage that is accessible over the industry -standard Service
Message Block (SMB) protocol. It is built on Windows Server, delivering a
wide range of administrative features such as user quotas, end-user file
restore, and Microsoft Active Directory (AD) integration. Amazon FSx is
accessible from Windows, Linux, and MacOS compute instances and devices.
Thousands of compute instances and devices can access a file system
concurrently.

Reference: Amazon FSx

Practice Exam - Question 29:

An accounting application uses an RDS database configured with Multi-AZ
deployments to improve availability. What would happen to RDS if the primary
database instance fails?
A
The primary database instance will reboot.
B
A new database instance is created in the standby Availability Zone.
C
The canonical name record (CNAME) is switched from the primary to standby instance.
D
The IP address of the primary DB instance is switched to the standby DB instance.

275 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 29

C.

In Amazon RDS, failover is automatically handled so that you can resume

database operations as quickly as possible without administrative intervention
in the event that your primary database instance went down. When failing
over, Amazon RDS simply flips the canonical name record (CNAME) for your
DB instance to point at the standby, which is in turn promoted to become the
new primary.

Reference: Multi-AZ

Practice Exam - Question 30:

A real-time data analytics application is using AWS Lambda to process data and
store results in JSON format to an S3 bucket. To speed up the existing workflow,
you have to use a service where you can run sophisticated Big Data analytics on
your data without moving them into a separate analytics system. Which of the
following group of services can you use to meet this requirement?

A
Amazon Glue, Glacier Select, Amazon Redshift
B
S3 Select, Amazon Athena, Amazon Redshift Spectrum
C
Amazon X-Ray, Amazon Neptune, DynamoDB
D
S3 Select, Amazon Neptune, DynamoDB DAX

276 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 30

B.

Amazon S3 allows you to run sophisticated Big Data analytics on your data
without moving the data into a separate analytics system. In AWS, there is a
suite of tools that make analyzing and processing large amounts of data in the
cloud faster, including ways to optimize and integrate existing workflows with
Amazon S3:

Reference: S3

Practice Exam - Question 31:

A Network Architect developed a food ordering application. The Architect needs
to retrieve the instance ID, public keys, and public IP address of the EC2 server
made for tagging and grouping the attributes into the internal application running
on-premises. Which of the following options fulfills this requirement?

A
Instance metadata
B
Resource tags
C
Amazon Machine Image
D
Instance user data

Your Answer: _______________

277 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes:
_____________________________________________________

Practice Exam - Answer 31

A.

Instance metadata is the data about your instance that you can use to
configure or manage the running instance. You can get the instance ID, public
keys, public IP address and many other information from the instance
metadata by firing a URL command in your instance to this URL
http://169.254.169.254/latest/meta-data/

Reference: EC2 Instance Meta Data

Practice Exam - Question 32:

A financial analytics application that collects, processes and analyzes stock data
in real-time is using Kinesis Data Streams. The producers continually push data
to Kinesis Data Streams while the consumers process the data in real time. In
Amazon Kinesis, where can the consumers store their results? (Select TWO.)

A
Amazon S3
B
Glacier Select
C
Amazon Redshift
D
AWS Glue

Your Answer: _______________

Your Notes:
_____________________________________________________

278 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 32
A. C.

In Amazon Kinesis, the producers continually push data to Kinesis Data

Streams and the consumers process the data in real time. Consumers (such
as a custom application running on Amazon EC2, or an Amazon Kinesis Data
Firehose delivery stream) can store their results using an AWS service such
as Amazon DynamoDB, Amazon Redshift, or Amazon S3.

Reference: Amazon Kinesis

Practice Exam - Question 33:

The company Djamgatech plans to deploy an application in an Amazon EC2
instance. The application will perform the following tasks: 1- Read large datasets
from an Amazon S3 bucket., 2- Execute multi-stage analysis on the datasets., 3-
Save the results to Amazon RDS. During multi-stage analysis, the application will
store a large number of temporary files in the instance storage. As the Solutions
Architect, you need to recommend the fastest storage option with high I/O
performance for the temporary files. Which of the following options fulfills this
requirement?
A
Configure RAID 0 in multiple instance store volumes.
B
Configure RAID 1 in multiple instance store volumes.
C
Attach multiple Provisioned IOPS SSD volumes in the instance.
D
Enable Transfer Acceleration in Amazon S3.

Your Answer: _______________

Your Notes:
_____________________________________________________

279 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 33
A.

RAID 0 configuration enables you to improve your storage volumes’

performance by distributing the I/O across the volumes in a stripe. Therefore,
if you add a storage volume, you get the straight addition of throughput and
IOPS. This configuration can be implemented on both EBS or instance store
volumes. Since the main requirement in the scenario is storage performance,
you need to use an instance store volume. It uses NVMe or SATA-based SSD
to deliver high random I/O performance. This type of storage is a g ood option
when you need storage with very low latency, and you don’t need the data to
persist when the instance terminates.

Reference: Instance Storage

Practice Exam - Question 34:

The company Djamgatech has a VPC for its human resource department, and
another VPC located in a different region for their finance department. The
Solutions Architect must redesign the architecture to allow the finance
department to access all resources that are in the human resource department,
and vice versa. Which type of networking connection in AWS should the
Solutions Architect set up to satisfy the above requirement?

A
VPN Connection
B
AWS Cloud Map
C
VPC Endpoint
D
Inter-Region VPC Peering

Your Answer: _______________

Your Notes:
_____________________________________________________

280 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 34
D.

A VPC peering connection is a networking connection between two VPCs that

enables you to route traffic between them privately. Instances in either VPC
can communicate with each other as if they are within the same network. You
can create a VPC peering connection between your own VPCs, with a VPC in
another AWS account, or with a VPC in a different AWS Region.

Reference: VPC Peering

Practice Exam - Question 35:

You just created a VPC. For security purposes, you are using NACLs and security groups. You
launched an EC2 instance into a subnet, where you have set an inbound rule for SSH (22) in
the security group and both inbound and outbound rules for port 22 on the subnet NACL.
However, you are not able to access the instance via SSH. What is the most likely issue?

A
The NACL needs an outbound rule for the high ephemeral port range (1024-65535).
B
You need to add an outbound rule allowing SSH for the security group.
C
You have not enabled IPv6 for the VPC.
D
Your IAM user does not have SSH permissions.

Your Answer: _______________

Your Notes:
_____________________________________________________

281 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 35
A.
SSH uses port 22 for the inbound request, but a dynamic port for the response.
So there has to be an allow for the ephemeral port range outbound.
Reference: NACL

Practice Exam - Question 36:

A Solutions Architect for a Djamgatech’s global news company is configuring a
fleet of EC2 instances in a subnet that currently is in a VPC with an Internet
gateway attached. All of these EC2 instances can be accessed from the Internet.
The architect launches another subnet and deploys an EC2 instance in it,
however, the architect is not able to access the EC2 instance from the Internet.
What could be the possible reasons for this issue? (Select TWO.)

A
The Amazon EC2 instance does not have a public IP address associated with it.
B
The Amazon EC2 instance is not a member of the same Auto Scaling group.
C
The Amazon EC2 instance does not have an attached Elastic Fabric Adapter (EFA).
D
The route table is not configured properly to send traffic from the EC2 instance to the Internet through the Intern et gateway.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 36

A. D.

Amazon EC2 instance does not have a public IP address associated with it.
The route table is not configured properly to send traffic from the EC2
instance to the Internet through the Internet gateway.

282 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Reference: VPC

Practice Exam - Question 37:

The company Djamgatech has a web application that is relying entirely on slower
disk-based databases, causing it to perform slowly. To improve its performance,
the Solutions Architect integrated an in-memory data store to the web application
using ElastiCache. How does Amazon ElastiCache improve database
performance?

A
It securely delivers data to customers globally with low latency and high transfer speeds.
B
It reduces the load on your database by routing read queries from your applications to the Read Replica.
C
It provides an in-memory cache that delivers up to 10x performance improvement from milliseconds to microseconds or even at millions of
requests per second.
D
By caching database query results.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 37

D.

ElastiCache improves the performance of your database through caching

query results. The primary purpose of an in-memory key-value store is to
provide ultra-fast (submillisecond latency) and inexpensive access to copies
of data. Most data stores have areas of data that are frequently accessed but
seldom updated. Additionally, querying a database is always slower and more
expensive than locating a key in a key-value pair cache. Some database
queries are especially expensive to perform, for example, queries that involve
joins across multiple tables or queries with intensive calculations. By caching
283 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 such query results, you pay the price of the query once and then are able to
quickly retrieve the data multiple times without having to re-execute the query.

Reference: Elasticache

Practice Exam - Question 38:

An application running on AWS uses an Amazon Aurora Multi-AZ DB cluster
deployment for its database. When evaluating performance metrics, a solutions
architect discovered that the database reads are causing high I/O and adding
latency to the write requests against the database. What should the solutions
architect do to separate the read requests from the write requests?

A
Enable read-through caching on the Aurora database.
B
Update the application to read from the Multi-AZ standby instance.
C
Create an Aurora replica and modify the application to use the appropriate endpoints.
D
Create a second Aurora database and link it to the primary database as a read replica.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 38

C.

Aurora Replicas provide a way to offload read traffic. Aurora Replicas share
the same underlying storage as the main database, so lag time is generally
very low. Aurora Replicas have their own endpoints, so the application will
need to be configured to direct read traffic to the new endpoints.

Reference: Aurora Replicas

284 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Question 39:
The usage of the company Djamgatech's image-processing application is
increasing suddenly with no set pattern. The application's processing time grows
linearly with the size of the image. The processing can take up to 20 minutes for
large image files. The architecture consists of a web tier, an Amazon Simple
Queue Service (Amazon SQS) standard queue, and message consumers that
process the images on Amazon EC2 instances. When a high volume of requests
occurs, the message backlog in Amazon SQS increases. Users are reporting the
delays in processing. A solutions architect must improve the performance of the
application in compliance with cloud best practices. Which solution will meet
these requirements?

A
Purchase enough Dedicated Instances to meet the peak demand. Deploy the instances for the consumers.
B
Convert the existing SQS standard queue to an SQS FIFO queue. Increase the visibility timeout.
C
Configure a scalable AWS Lambda function as the consumer of the SQS messages.
D
Create a message consumer that is an Auto Scaling group of instances. Configure the Auto Scaling group to scale based upon th e
ApproximateNumberOfMessages Amazon CloudWatch metric.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 39

D.

FIFO queues will solve problems that occur when messages are processed
out of order. FIFO queues will not improve performance during sudden
volume increases. Additionally, you cannot convert SQS queues after you
create them.

Reference: FIFO Queues

285 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Question 40:
A reporting application runs on Amazon EC2 instances behind an Application
Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across
multiple Availability Zones. For complex reports, the application can take up to 15
minutes to respond to a request. A solutions architect is concerned that users
will receive HTTP 5xx errors if a report request is in process during a scale-in
event. What should the solutions architect do to ensure that user requests will be
completed before instances are terminated?
A
Enable sticky sessions (session affinity) for the target group of the instances.
B
Increase the instance size in the Application Load Balancer target group.
C
Increase the cooldown period for the Auto Scaling group to a greater amount of time than the time required for the longest running
responses.
D
Increase the deregistration delay timeout for the target group of the instances to greater than 900 seconds.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 40

D.

By default, Elastic Load Balancing waits 300 seconds before the completion of
the deregistration process, which can help in-flight requests to the target
become complete. To change the amount of time that Elastic Load Balancing
waits, update the deregistration delay value.

Reference: Deregistration Delay.

286 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Question 41:
You have been engaged by the company Djamgatech to design and lead a
migration to an AWS environment. The team is concerned about the capabilities
of the new environment, especially when it comes to high availability and cost-
effectiveness. The design calls for about 20 instances (c3.2xlarge) pulling
jobs/messages from SQS. Network traffic per instance is estimated to be around
500 Mbps at the beginning and end of each job. Which configuration should you
plan on deploying?
A
Use a 2nd Network Interface to separate the SQS traffic for the storage traffic.
B
Choose a different instance type that better matched the traffic demand.
C
Spread the Instances over multiple AZs to minimize the traffic concentration and maximize fault -tolerance.
D
Deploy as a Cluster Placement Group as the aggregated burst traffic could be around 10 Gbps.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 41

C.

With a multi-AZ configuration, an additional reliability point is scored as the

entire Availability Zone itself is ruled out as a single point of failure. This
ensures high availability. Wherever possible, use simple solutions such as
spreading the load out rather than expensive high tech solutions.

Reference: AZ

Practice Exam - Question 42:

287 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
You are a solutions architect working for a Djamgatech cosmetics company. Your
company Djamgatech has a busy Magento online store that consists of a two-tier
architecture. The web servers are on EC2 instances deployed across multiple
AZs, and the database is on a Multi-AZ RDS MySQL database instance. Your store
is having a Black Friday sale in five days, and having reviewed the performance
for the last sale you expect the site to start running very slowly during the peak
load. You investigate and you determine that the database was struggling to keep
up with the number of reads that the store was generating. Which solution would
you implement to improve the application read performance the most?

A
Deploy an Amazon ElastiCache cluster with nodes running in each AZ.
B
Upgrade your RDS MySQL instance to use provisioned IOPS.
C
Add an RDS Read Replica in each AZ.
D
Upgrade the RDS MySQL instance to a larger type.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 42

C.

RDS Replicas can substantially increase the Read performance of your

database. Multiple read replicas can be made to increase performance
further. It will also require the least modifications to any code, and is generally
possible to be implemented in the timeframe specified

Reference: RDS

Practice Exam - Question 43:

288 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 A solutions architect wants to design a solution to save costs for Amazon EC2
instances that do not need to run during a 2-week Djamgatech’s company
shutdown. The applications running on the EC2 instances store data in instance
memory that must be present when the instances resume operation. Which
approach should the solutions architect recommend to shut down and resume
the EC2 instances?

A
Modify the application to store the data on instance store volumes. Reat tach the volumes while restarting them.
B
Snapshot the EC2 instances before stopping them. Restore the snapshot after restarting the instances.
C
Run the applications on EC2 instances enabled for hibernation. Hibernate the instances before the 2- week company shutdown.
D
Note the Availability Zone for each EC2 instance before stopping it. Restart the instances in the same Availability Zones after the 2 -week
company shutdown.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 43

C.

Hibernating EC2 instances save the contents of instance memory to an

Amazon Elastic Block Store (Amazon EBS) root volume. When the instances
restart, the instance memory contents are reloaded.

Reference: Hibernation

Tags: #AWS #SAA #SAAC02 #SAAC03

Practice Exam - Question 44:

The company Djamgatech uses Amazon EC2 Reserved Instances to run its data
processing workload. The nightly job typically takes 7 hours to run and must
289 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 finish within a 10-hour time window. The company anticipates temporary
increases in demand at the end of each month that will cause the job to run over
the time limit with the capacity of the current resources. Once started, the
processing job cannot be interrupted before completion. The company wants to
implement a solution that would provide increased resource capacity as cost-
effectively as possible. What should a solutions architect do to accomplish this?

A
Deploy On-Demand Instances during periods of high demand.
B
Create a second EC2 reservation for additional instances.
C
Deploy Spot Instances during periods of high demand.
D
Increase the EC2 instance size in the EC2 reservation to support the increased workload.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 44

A.

While Spot Instances would be the least costly option, they are not suitable for
jobs that cannot be interrupted or must complete within a certain time period.
On-Demand Instances would be billed for the number of seconds they are
running.

Reference: Spot Instances

Practice Exam - Question 45:

An application running on AWS uses an Amazon Aurora Multi-AZ DB cluster
deployment for its database. When evaluating performance metrics, a solutions
architect discovered that the database reads are causing high I/O and adding

290 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 latency to the write requests against the database. What should the solutions
architect do to separate the read requests from the write requests?

A
Enable read-through caching on the Aurora database.
B
Update the application to read from the Multi-AZ standby instance.
C
Create an Aurora replica and modify the application to use the appropriate endpoints.
D
Create a second Aurora database and link it to the primary database as a read replica.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 45

C.

Aurora Replicas provide a way to offload read traffic. Aurora Replicas share
the same underlying storage as the main database, so lag time is generally
very low. Aurora Replicas have their own endpoints, so the application will
need to be configured to direct read traffic to the new endpoints.

Reference: Aurora Replicas

Practice Exam - Question 46:

A new online banking platform has been re-designed to have a microservices
architecture in which complex applications are decomposed into smaller,
independent services. The new platform is using Docker considering that
application containers are optimal for running small, decoupled services. The
new solution should remove the need to provision and manage servers, let you
specify and pay for resources per application, and improve security through

291 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 application isolation by design. Which of the following is the MOST suitable
service to use to migrate this new platform to AWS?

A
Amazon EKS
B
Amazon EFS
C
Amazon EBS
D
AWS Fargate

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 46

D.

AWS Fargate is a serverless compute engine for containers that works with
both Amazon Elastic Container Service (ECS) and Amazon Elastic
Kubernetes Service (EKS). Fargate makes it easy for you to focus on building
your applications. Fargate removes the need to provision and manage
servers, lets you specify and pay for resources per application, and improves
security through application isolation by design. Fargate allocates the right
amount of compute, eliminating the need to choose instances and scale
cluster capacity. You only pay for the resources required to run your
containers, so there is no over-provisioning and paying for additional servers.
Fargate runs each task or pod in its own kernel providing the tasks and pods
their own isolated compute environment. This enables your application to
have workload isolation and improved security by design. This is why
customers such as Vanguard, Accenture, Foursquare, and Ancestry have
chosen to run their mission critical applications on Fargate.

Reference: AWS Fargate

292 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Question 47:
An auto scaling group of Linux EC2 instances is created with basic monitoring
enabled in CloudWatch. You noticed that your application is slow so you asked
one of your engineers to check all of your EC2 instances. After checking your
instances, you noticed that the auto scaling group is not launching more
instances as it should be, even though the servers already have high memory
usage. Which of the following options should the Architect implement to solve
this issue?
A
Modify the scaling policy to increase the threshold to scale out the number of instances.
B
Enable detailed monitoring on the instances.
C
Install the CloudWatch agent to the EC2 instances which will trigger your Auto Scaling group to scale out.
D
Install AWS SDK in the EC2 instances. Create a script that will trigger the Auto Scaling event if there is high memory usage.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 47

C.

The premise of the scenario is that the EC2 servers have high memory usage,
but since this specific metric is not tracked by the Auto Scaling group by
default, the scaling out activity is not being triggered. Remember that by
default, CloudWatch doesn’t monitor memory usage but only the CPU
utilization, Network utilization, Disk performance, and Disk Reads/Writes. This
is the reason why you have to install a CloudWatch agent in your EC2
instances to collect and monitor the custom metric (memory usage), whic h will
be used by your Auto Scaling Group as a trigger for scaling activities.

Reference: Install the CloudWatch agent to the EC2 instances which will
trigger your Auto Scaling group to scale out
293 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Question 48:
A startup plans to develop a multiplayer game that uses UDP as the protocol for
communication between clients and game servers. The data of the users will be
stored in a key-value store. As the Solutions Architect, you need to implement a
solution that will distribute the traffic across a number of servers. Which of the
following could help you achieve this requirement?

A
Distribute the traffic using Network Load Balancer and store the data in Amazon Aurora.
B
Distribute the traffic using Network Load Balancer and store the data in Amazon DynamoDB.
C
Distribute the traffic using Application Load Balancer and store the data in Amazon DynamoDB.
D
Distribute the traffic using Application Load Balancer and store the data in Amazon RDS.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 48

B.

A Network Load Balancer functions at the fourth layer of the Open Systems
Interconnection (OSI) model. It can handle millions of requests per second.
After the load balancer receives a connection request, it selects a target from
the target group for the default rule. For UDP traffic, the load balancer selects
a target using a flow hash algorithm based on the protocol, source IP address,
source port, destination IP address, and destination port. A UDP flow has the
same source and destination, so it is consistently routed to a single target
throughout its lifetime. Different UDP flows have different source IP addresses
and ports, so they can be routed to different targets. In this scenario, a startup
plans to create a multiplayer game that uses UDP as the protocol for
communications. Since UDP is a Layer 4 traffic, we can limit the option that
294 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 uses Network Load Balancer. The data of the users will be stored in a key -
value store. This means that we should select Amazon DynamoDB since it
supports both document and key-value store models.

Reference: Distribute the traffic using Network Load Balancer and store the
data in Amazon DynamoDB

Practice Exam - Question 49:

A large financial firm in the country has an AWS environment that contains
several Reserved EC2 instances hosting a web application that has been
decommissioned last week. To save costs, you need to stop incurring charges for
the Reserved instances as soon as possible. What cost-effective steps will you
take in this circumstance? (Select TWO.)

A
Terminate the Reserved instances as soon as possible to avoid getting billed at the on-demand price when it expires.
B
Go to the AWS Reserved Instance Marketplace and sell the Reserved instances.
C
Contact AWS to cancel your AWS subscription.
D
Stop the Reserved instances as soon as possible.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 49

A. B.

The Reserved Instance Marketplace is a platform that supports the sale of

third-party and AWS customers’ unused Standard Reserved Instances, which
vary in terms of lengths and pricing options. For example, you may want to
sell Reserved Instances after moving instances to a new AWS region,
295 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
changing to a new instance type, ending projects before the term expiration,
when your business needs change, or if you have unneeded capacity.

Reference: Reserved Instances

Practice Exam - Question 50:

The company Djamgatech plans to use Route 53 instead of an ELB to load
balance the incoming request to the web application. The system is deployed to
two EC2 instances to which the traffic needs to be distributed. You want to set a
specific percentage of traffic to go to each instance. Which routing policy would
you use?

A
Geolocation
B
Weighted
C
Failover
D
Latency

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 50

B.

Weighted routing lets you associate multiple resources with a single domain
name (abc.com) or subdomain name (portal.abc.com) and choose how much
traffic is routed to each resource. This can be useful for a variety of purposes
including load balancing and testing new versions of software. You can set a
specific percentage of how much traffic will be allocated to the resource by
specifying the weights. For example, if you want to send a tiny portion of your
296 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 traffic to one resource and the rest to another resource, you might specify
weights of 1 and 255. The resource with a weight of 1 gets 1/256th of the
traffic (1/1+255), and the other resource gets 255/256ths (255/1+255). You
can gradually change the balance by changing the weights. If you want to stop
sending traffic to a resource, you can change the weight for that record to 0.

Reference: Weighted routing

Practice Exam - Question 51:

The company Djamgatech is receiving semi-structured and structured data from
different sources every day. The Solutions Architect plans to use big data
processing frameworks to analyze vast amounts of data and access it using
various business intelligence tools and standard SQL queries. Which of the
following provides the MOST high-performing solution that fulfills this
requirement?
A
Create an Amazon EC2 instance and store the processed data in Amazon EBS.
B
Use Amazon Kinesis Data Analytics and store the processed data in Amazon DynamoDB.
C
Create an Amazon EMR cluster and store the processed data in Amazon Redshift.
D
Use AWS Glue and store the processed data in Amazon S3.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 51

C.

Amazon EMR is a managed cluster platform that simplifies running big data
frameworks, such as Apache Hadoop and Apache Spark, on AWS to process
297 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 and analyze vast amounts of data. By using these frameworks and related
open-source projects, such as Apache Hive and Apache Pig, you can process
data for analytics purposes and business intelligence workloads. Additionally,
you can use Amazon EMR to transform and move large amounts of data into
and out of other AWS data stores and databases. Amazon Redshift is the
most widely used cloud data warehouse. It makes it fast, simple and cost-
effective to analyze all your data using standard SQL and your existing
Business Intelligence (BI) tools. It allows you to run complex analytic queries
against terabytes to petabytes of structured and semi-structured data, using
sophisticated query optimization, columnar storage on high-performance
storage, and massively parallel query execution.

Reference: EMR & Redshift

Practice Exam - Question 52:

The company Djamgatech plans to build a data analytics application in AWS
which will be deployed in an Auto Scaling group of On-Demand EC2 instances
and a MongoDB database. It is expected that the database will have high-
throughput workloads performing small, random I/O operations. As the Solutions
Architect, you are required to properly set up and launch the required resources
in AWS. Which of the following is the most suitable EBS type to use for your
database?

A
General Purpose SSD (gp2)
B
Provisioned IOPS SSD (io1)
C
Throughput Optimized HDD (st1)
D
Cold HDD (sc1)

Your Answer: _______________

Your Notes:
_____________________________________________________

298 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 52
B.

On a given volume configuration, certain I/O characteristics drive the

performance behavior for your EBS volumes. SSD-backed volumes, such as
General Purpose SSD (gp2) and Provisioned IOPS SSD (io1), deliver
consistent performance whether an I/O operation is random or sequential.
HDD-backed volumes like Throughput Optimized HDD (st1) and Cold HDD
(sc1) deliver optimal performance only when I/O operations are large and
sequential. In the exam, always consider the difference between SSD and
HDD as shown on the table below. This will allow you to easily eliminate
specific EBS-types in the options which are not SSD or not HDD, depending
on whether the question asks for a storage type which has small, random I/O
operations or large, sequential I/O operations. Provisioned IOPS SSD (io1)
volumes are designed to meet the needs of I/O-intensive workloads,
particularly database workloads, that are sensitive to storage performance
and consistency. Unlike gp2, which uses a bucket and credit model to
calculate performance, an io1 volume allows you to specify a consistent IOPS
rate when you create the volume, and Amazon EBS delivers within 10 percent
of the provisioned IOPS performance 99.9 percent of the time over a given
year.

Reference: Provisioned IOPS SSD (io1)

Practice Exam - Question 53:

A leading e-commerce Djamgatech’s company is in need of a storage solution
that can be simultaneously accessed by 1000 Linux servers in multiple
availability zones. The servers are hosted in EC2 instances that use a hierarchical
directory structure via the NFSv4 protocol. The service should be able to handle
the rapidly changing data at scale while still maintaining high performance. It
should also be highly durable and highly available whenever the servers will pull
data from it, with little need for management. As the Solutions Architect, which of
the following services is the most cost-effective choice that you should use to
meet the above requirement?

A
Storage Gateway
B

299 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 EBS
C
EFS
D
S3

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 53

C.

Amazon Web Services (AWS) offers cloud storage services to support a wide
range of storage workloads such as EFS, S3 and EBS. You have to
understand when you should use Amazon EFS, Amazon S3 and Amazon
Elastic Block Store (EBS) based on the specific workloads. In this scenario,
the keywords are rapidly changing data and 1000 Linux servers. Amazon EFS
is a file storage service for use with Amazon EC2. Amazon EFS provides a file
system interface, file system access semantics (such as strong consistency
and file locking), and concurrently-accessible storage for up to thousands of
Amazon EC2 instances. EFS provides the same level of high availability and
high scalability like S3 however, this service is more suitable for scenarios
where it is required to have a POSIX-compatible file system or if you are
storing rapidly changing data.

Reference: EFS

Practice Exam - Question 54:

An application is hosted in an Auto Scaling group of EC2 instances. To improve
the monitoring process, you have to configure the current capacity to increase or
decrease based on a set of scaling adjustments. This should be done by

300 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 specifying the scaling metrics and threshold values for the CloudWatch alarms
that trigger the scaling process. Which of the following is the most suitable type
of scaling policy that you should use?

A
Step scaling
B
Target tracking scaling
C
Scheduled Scaling
D
Simple scaling

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 54

A.

With step scaling, you choose scaling metrics and threshold values for the
CloudWatch alarms that trigger the scaling process as well as define how your
scalable target should be scaled when a threshold is in breach for a specified
number of evaluation periods. Step scaling policies increase or decrease the
current capacity of a scalable target based on a set of scaling adjustments,
known as step adjustments. The adjustments vary based on the size of the
alarm breach. After a scaling activity is started, the policy continues to
respond to additional alarms, even while a scaling activity is in progress.
Therefore, all alarms that are breached are evaluated by Application Auto
Scaling as it receives the alarm messages. When you configure dynamic
scaling, you must define how to scale in response to changing demand. For
example, you have a web application that currently runs on two instances and
you want the CPU utilization of the Auto Scaling group to stay at around 50
percent when the load on the application changes. This gives you extra
capacity to handle traffic spikes without maintaining an excessive amount of
idle resources. You can configure your Auto Scaling group to scale

301 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
automatically to meet this need. The policy type determines how the scaling
action is performed.

Reference: Step Scaling

Practice Exam - Question 55:

A Djamgatech technology company is building a new cryptocurrency trading
platform that allows the buying and selling of Bitcoin, Ethereum, Ripple, Tether,
and many others. You were hired as a Cloud Engineer to build the required
infrastructure needed for this new trading platform. On your first week at work,
you started to create CloudFormation YAML scripts that define all of the needed
AWS resources for the application. Your manager was shocked that you haven’t
created the EC2 instances, S3 buckets, and other AWS resources straight away.
He does not understand the text-based scripts that you have done and has asked
for your clarification. In this scenario, what are the benefits of using the Amazon
CloudFormation service that you should tell your manager to clarify his
concerns? (Select TWO.)
A
Allows you to model your entire infrastructure in a text file
B
Enables modeling, provisioning, and version-controlling of your entire AWS infrastructure
C
A storage location for the code of your application
D
Using CloudFormation itself is free, including the AWS resources that have been created.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 55

A. B.

302 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
AWS CloudFormation provides a common language for you to describe and
provision all the infrastructure resources in your cloud environment.
CloudFormation allows you to use a simple text file to model and provision, in
an automated and secure manner, all the resources needed for your
applications across all regions and accounts. This file serves as the single
source of truth for your cloud environment. AWS CloudFormation is available
at no additional charge, and you pay only for the AWS resources needed to
run your applications.

Reference: AWS CloudFormation

Practice Exam - Question 56:

The company Djamgatech plans to launch an application that tracks the GPS
coordinates of delivery trucks in the country. The coordinates are transmitted
from each delivery truck every five seconds. You need to design an architecture
that will enable real-time processing of these coordinates from multiple
consumers. The aggregated data will be analyzed in a separate reporting
application. Which AWS service should you use for this scenario?

A
Amazon AppStream
B
Amazon Simple Queue Service
C
AWS Data Pipeline
D
Amazon Kinesis

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 56

D.

303 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Amazon Kinesis makes it easy to collect, process, and analyze real-time,
streaming data so you can get timely insights and react quickly to new
information. It offers key capabilities to cost-effectively process streaming data
at any scale, along with the flexibility to choose the tools that best suit the
requirements of your application. With Amazon Kinesis, you can ingest real-
time data such as video, audio, application logs, website clickstreams, and IoT
telemetry data for machine learning, analytics, and other applications.
Amazon Kinesis enables you to process and analyze data as it arrives and
responds instantly instead of having to wait until all your data are collected
before the processing can begin.

Reference: Amazon Kinesis

Practice Exam - Question 57:

The company Djamgatech has a cryptocurrency exchange portal that is hosted in
an Auto Scaling group of EC2 instances behind an Application Load Balancer and
is deployed across multiple AWS regions. The users can be found all around the
globe, but the majority are from Japan and Sweden. Because of the compliance
requirements in these two locations, you want the Japanese users to connect to
the servers in the ap-northeast-1 Asia Pacific (Tokyo) region, while the Swedish
users should be connected to the servers in the eu-west-1 EU (Ireland) region.
Which of the following services would allow you to easily fulfill this requirement?

A
Use Route 53 Geolocation Routing policy.
B
Use Route 53 Weighted Routing policy.
C
Set up a new CloudFront web distribution with the geo-restriction feature enabled.
D
Set up an Application Load Balancers that will automatically route the traffic to the proper AWS region.

Your Answer: _______________

Your Notes:
_____________________________________________________

304 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 57
A.

Geolocation routing lets you choose the resources that serve your traffic
based on the geographic location of your users, meaning the loc ation that
DNS queries originate from. For example, you might want all queries from
Europe to be routed to an ELB load balancer in the Frankfurt region. When
you use geolocation routing, you can localize your content and present some
or all of your website in the language of your users. You can also use
geolocation routing to restrict distribution of content to only the locations in
which you have distribution rights. Another possible use is for balancing load
across endpoints in a predictable, easy-to-manage way, so that each user
location is consistently routed to the same endpoint.

Reference: Geolocation Routing policy

Tags: #AWS #SAA #SAAC02 #SAAC03

Practice Exam - Question 58:

A Djamgatech’s data analytics company is setting up an innovative checkout-free
grocery store. Their Solutions Architect developed a real-time monitoring
application that uses smart sensors to collect the items that the customers are
getting from the grocery’s refrigerators and shelves then automatically deduct it
from their accounts. The company wants to analyze the items that are frequently
being bought and store the results in S3 for durable storage to determine the
purchase behavior of its customers. What service must be used to easily capture,
transform, and load streaming data into Amazon S3, Amazon Elasticsearch
Service, and Splunk?

A
Amazon Kinesis Data Firehose
B
Amazon SQS
C
Amazon Kinesis
D
Amazon Redshift

Your Answer: _______________

305 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes:
_____________________________________________________

Practice Exam - Answer 58

A.

Amazon Kinesis Data Firehose is the easiest way to load streaming data into
data stores and analytics tools. It can capture, transform, and load streaming
data into Amazon S3, Amazon Redshift, Amazon Elasticsearch Service, and
Splunk, enabling near real-time analytics with existing business intelligence
tools and dashboards you are already using today. It is a fully managed
service that automatically scales to match the throughput of your data and
requires no ongoing administration. It can also batch, compress, and encrypt
the data before loading it, minimizing the amount of storage used at the
destination and increasing security. In the diagram below, you gather the data
from your smart refrigerators and use Kinesis Data firehouse to prepare and
load the data. S3 will be used as a method of durably storing the data for
analytics and the eventual ingestion of data for output using analytical tools.
You can use Amazon Kinesis Data Firehose in conjunction with Amazon
Kinesis Data Streams if you need to implement real-time processing of
streaming big data. Kinesis Data Streams provides an ordering of records, as
well as the ability to read and/or replay records in the same order to multiple
Amazon Kinesis Applications. The Amazon Kinesis Client Library (KCL)
delivers all records for a given partition key to the same record processor,
making it easier to build multiple applications reading from the same Amazon
Kinesis data stream (for example, to perform counting, aggregation, and
filtering).

Reference: Amazon Kinesis Data Firehose

Practice Exam - Question 59:

306 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 The company Djamgatech has developed public APIs hosted in Amazon EC2
instances behind an Elastic Load Balancer. The APIs will be used by various
clients from their respective on-premises data centers. A Solutions Architect
received a report that the web service clients can only access trusted IP
addresses whitelisted on their firewalls. What should you do to accomplish the
above requirement?

A
Create an Alias Record in Route 53 which maps to the DNS name of the load balancer.
B
Associate an Elastic IP address to an Application Load Balancer.
C
Create a CloudFront distribution whose origin points to the private IP addresses of your web servers.
D
Associate an Elastic IP address to a Network Load Balancer.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 59

D.

A Network Load Balancer functions at the fourth layer of the Open Systems
Interconnection (OSI) model. It can handle millions of requests per second.
After the load balancer receives a connection request, it selects a target from
the default rule’s target group. It attempts to open a TCP connection to the
selected target on the port specified in the listener configuration. Based on the
given scenario, web service clients can only access trusted IP addresses. To
resolve this requirement, you can use the Bring Your Own IP (BYOIP) feature
to use the trusted IPs as Elastic IP addresses (EIP) to a Network Load
Balancer (NLB). This way, there’s no need to re-establish the whitelists with
new IP addresses.

Reference: Elastic IP

307 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Question 60:
An AI-powered Forex trading application consumes thousands of data sets to
train its machine learning model. The application’s workload requires a high-
performance, parallel hot storage to process the training datasets concurrently. It
also needs cost-effective cold storage to archive those datasets that yield low
profit. Which of the following Amazon storage services should the developer
use?
A
Use Amazon FSx For Lustre and Amazon EBS Provisioned IOPS SSD (io1) volumes for hot and cold storage respectively.
B
Use Amazon FSx For Windows File Server and Amazon S3 for hot and cold s torage respectively.
C
Use Amazon FSx For Lustre and Amazon S3 for hot and cold storage respectively.
D
Use Amazon Elastic File System and Amazon S3 for hot and cold storage respectively.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 60

C.

Hot storage refers to the storage that keeps frequently accessed data (hot
data). Warm storage refers to the storage that keeps less frequently accessed
data (warm data). Cold storage refers to the storage that keeps rarely
accessed data (cold data). In terms of pricing, the colder the data, the cheaper
it is to store, and the costlier it is to access when needed. Amazon FSx For
Lustre is a high-performance file system for fast processing of workloads.
Lustre is a popular open-source parallel file system which stores data across
multiple network file servers to maximize performance and reduce
bottlenecks.

Reference: FSx

308 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Question 61:
The company Djamgatech requires corporate IT governance and cost oversight of
all of its AWS resources across its divisions around the world. Their corporate
divisions want to maintain administrative control of the discrete AWS resources
they consume and ensure that those resources are separate from other divisions.
Which of the following options will support the autonomy of each corporate
division while enabling the corporate IT to maintain governance and cost
oversight? (Select TWO.)
A
Use AWS Consolidated Billing by creating AWS Organizations to link the divisions’ accounts to a parent corporate account.
B
Create separate VPCs for each division within the corporate IT AWS account. Launch an AWS Transit Gateway with equal -cost multipath
routing (ECMP) and VPN tunnels for intra-VPC communication.
C
Enable IAM cross-account access for all corporate IT administrators in each child account.
D
Create separate Availability Zones for each division within the corporate IT AWS account. Improve comm unication between the two AZs
using the AWS Global Accelerator.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 61

A. C.

You can use an IAM role to delegate access to resources that are in different
AWS accounts that you own. You share resources in one account with users
in a different account. By setting up cross-account access in this way, you
don’t need to create individual IAM users in each account. In addition, users
don’t have to sign out of one account and sign into another in order to access
resources that are in different AWS accounts. You can use the consolidated
billing feature in AWS Organizations to consolidate payment for multiple AWS
accounts or multiple AISPL accounts. With consolidated billing, you can see a
309 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
combined view of AWS charges incurred by all of your accounts. You can also
get a cost report for each member account that is associated with your master
account. Consolidated billing is offered at no additional charge. AWS and
AISPL accounts can’t be consolidated together. The combined use of IAM and
Consolidated Billing will support the autonomy of each corporate division while
enabling corporate IT to maintain governance and cost oversight.

Reference: Consolidated billing

Practice Exam - Question 62:

A Djamgatech’s fast food company is using AWS to host their online ordering
system which uses an Auto Scaling group of EC2 instances deployed across
multiple Availability Zones with an Application Load Balancer in front. To better
handle the incoming traffic from various digital devices, you are planning to
implement a new routing system where requests which have a URL
of /api/android are forwarded to one specific target group named 'Android-Target-
Group'. Conversely, requests which have a URL of /api/ios are forwarded to
another separate target group named 'iOS-Target-Group'. How can you implement
this change in AWS?
A
Use host conditions to define rules that forward requests to different target groups based on the hostname in the host header. This enables
you to support multiple domains using a single load balancer.
B
Replace your ALB with a Gateway Load Balancer then use path conditions to define rules that forward requests to different target groups
based on the URL in the request.
C
Use path conditions to define rules that forward requests to different target groups based on the URL in the request.
D
Replace your ALB with a Network Load Balancer then use host conditions to define rules that forward requests to different target groups
based on the URL in the request.

Your Answer: _______________

Your Notes:
_____________________________________________________

310 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 62
C.

If your application is composed of several individual services, an Application

Load Balancer can route a request to a service based on the content of the
request such as Host field, Path URL, HTTP header, HTTP method, Query
string, or Source IP address. Path-based routing allows you to route a client
request based on the URL path of the HTTP header. Each path condition has
one path pattern. If the URL in a request matches the path pattern in a listener
rule exactly, the request is routed using that rule. A path pattern is case-
sensitive, can be up to 128 characters in length.

Reference: ALB Benefits

Practice Exam - Question 63:

A Djamgatech’s game development company operates several virtual reality (VR)
and augmented reality (AR) games which use various RESTful web APIs hosted
on their on-premises data center. Due to the unprecedented growth of their
company, they decided to migrate their system to AWS Cloud to scale out their
resources as well to minimize costs. Which of the following should you
recommend as the most cost-effective and scalable solution to meet the above
requirement?
A
Use a Spot Fleet of Amazon EC2 instances, each with an Elastic Fabric Adapter (EFA) for more consistent latency and higher network
throughput. Set up an Application Load Balancer to distribute traffic to the instances.
B
Use AWS Lambda and Amazon API Gateway.
C
Host the APIs in a static S3 web hosting bucket behind a CloudFront web distribution.
D
Set up a micro-service architecture with ECS, ECR, and Fargate.

Your Answer: _______________

Your Notes:
_____________________________________________________

311 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 63
B.

With AWS Lambda, you pay only for what you use. You are charged based on
the number of requests for your functions and the duration, the time it takes
for your code to execute. Lambda counts a request each time it starts
executing in response to an event notification or invoke call, including test
invokes from the console. You are charged for the total number of requests
across all your functions. Duration is calculated from the time your code
begins executing until it returns or otherwise terminates, rounded up to the
nearest 1ms. The price depends on the amount of memory you allocate to
your function. The Lambda free tier includes 1M free requests per month and
over 400,000 GB-seconds of compute time per month. The best possible
answer here is to use a combination of AWS Lambda and Amazon API
Gateway because this solution is both scalable and cost-effective. You will
only be charged when you use your Lambda function, unlike having an EC2
instance that always runs even though you don’t use it.

Reference: AWS Lambda and Amazon API Gateway.

Practice Exam - Question 64:

An application hosted in EC2 consumes messages from an SQS queue and is
integrated with SNS to send out an email to you once the process is complete.
The Operations team received 5 orders but after a few hours, they saw 20 email
notifications in their inbox. Which of the following could be the possible culprit
for this issue?
A
The web application is not deleting the messages in the SQS queue after it has processed them.
B
The web application is set to short polling so some messages are not being picked up.
C
The web application does not have permission to consume messages in the SQS queue.
D
The web application is set for long polling so the messages are being sent twice.

Your Answer: _______________

312 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Notes:
_____________________________________________________

Practice Exam - Answer 64

A.

Always remember that the messages in the SQS queue will continue to exist
even after the EC2 instance has processed it, until you delete that message.
You have to ensure that you delete the message after processing to prevent
the message from being received and processed again once the visibility
timeout expires. There are three main parts in a distributed messaging
system: 1- The components of your distributed system (EC2 instances) , 2-
Your queue (distributed on Amazon SQS servers) , 3- Messages in the queue.
You can set up a system which has several components that send messages
to the queue and receive messages from the queue. The queue redundantly
stores the messages across multiple Amazon SQS servers.

Reference: SQS Message Lifecycle

Practice Exam - Question 65:

A startup needs to use a shared file system for its .NET web application running
on an Amazon EC2 Windows instance. The file system must provide a high level
of throughput and IOPS that can also be integrated with Microsoft Active
Directory. Which is the MOST suitable service that you should use to achieve this
requirement?
A
AWS Storage Gateway ' File Gateway
B
Amazon EBS Provisioned IOPS SSD volumes
C
Amazon FSx for Windows File Server
D
Amazon Elastic File System

313 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 65

C.

Amazon FSx for Windows File Server provides fully managed, highly reliable,
and scalable file storage accessible over the industry-standard Service
Message Block (SMB) protocol. It is built on Windows Server, delivering a
wide range of administrative features such as user quotas, end-user file
restore, and Microsoft Active Directory (AD) integration. Amazon FSx supports
the use of Microsoft’s Distributed File System (DFS) Namespaces to scale-out
performance across multiple file systems in the same namespace up to tens
of Gbps and millions of IOPS. The key phrases in this scenario are “file
system” and “Active Directory integration.” You need to implement a solution
that will meet these requirements. Among the options given, the possible
answers are FSx Windows File Server and File Gateway. But you need to
consider that the question also states that you need to provide a high level of
throughput and IOPS. Amazon FSx Windows File Server can scale-out
storage to hundreds of petabytes of data with tens of GB/s of throughput
performance and millions of IOPS.

Reference: FSx

Practice Exam - Question 66:

The company Djamgatech is running a multi-tier web application farm in a virtual
private cloud (VPC) that is not connected to their corporate network. They are
connecting to the VPC over the Internet to manage the fleet of Amazon EC2
instances running in both the public and private subnets. The Solutions Architect
has added a bastion host with Microsoft Remote Desktop Protocol (RDP) access

314 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 to the application instance security groups, but the company wants to further
limit administrative access to all of the instances in the VPC. Which of the
following bastion host deployment options will meet this requirement?

A
Deploy a Windows Bastion host with an Elastic IP address in the public subnet and allow RDP access to bastion o nly from the corporate IP
addresses.
B
Deploy a Windows Bastion host with an Elastic IP address in the public subnet and allow SSH access to the bastion from anywhere.
C
Deploy a Windows Bastion host with an Elastic IP address in the private subnet, and restrict RDP access to the bastion from only the
corporate public IP addresses.
D
Deploy a Windows Bastion host on the corporate network that has RDP access to all EC2 inst ances in the VPC.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 66

A.

The correct answer is to deploy a Windows Bastion host with an Elastic IP

address in the public subnet and allow RDP access to bastion only from the
corporate IP addresses. A bastion host is a special purpose computer on a
network specifically designed and configured to withstand attacks. If you have
a bastion host in AWS, it is basically just an EC2 instance. It should be in a
public subnet with either a public or Elastic IP address with sufficient RDP or
SSH access defined in the security group. Users log on to the bastion host via
SSH or RDP and then use that session to manage other hosts in the private
subnets.

Reference: Linux Bastion Host

Practice Exam - Question 67:

315 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
A popular social media website uses a CloudFront web distribution to serve their
static contents to their millions of users around the globe. They are receiving a
number of complaints recently that their users take a lot of time to log into their
website. There are also occasions when their users are getting HTTP 504 errors.
You are instructed by your manager to significantly reduce the user’s login time
to further optimize the system. Which of the following options should you use
together to set up a cost-effective solution that can improve your application’s
performance? (Select TWO.)
A
Use multiple and geographically disperse VPCs to various AWS regions then create a transit VPC to connect all of your resources. In order
to handle the requests faster, set up Lambda functions in each region using the AWS Serverless Application Model (SAM) service.
B
Set up an origin failover by creating an origin group with two origins. Specify one as the primary origin and the other as the second origin
which CloudFront automatically switches to when the primary origin returns specific HTTP status code failure responses.
C
Deploy your application to multiple AWS regions to accommodate your users around the world. Set up a Route 53 record with latency routing
policy to route incoming traffic to the region that provides the best latency to the user.
D
Customize the content that the CloudFront web distribution delivers to your users using Lambda@Edge, which a llows your Lambda functions
to execute the authentication process in AWS locations closer to the users.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 67

B. D.

Lambda@Edge lets you run Lambda functions to customize the content that
CloudFront delivers, executing the functions in AWS locations closer to the
viewer. The functions run in response to CloudFront events, without
provisioning or managing servers. In the given scenario, you can use
Lambda@Edge to allow your Lambda functions to customize the content that
CloudFront delivers and to execute the authentication process in AWS
locations closer to the users. In addition, you can set up an origin failover by
creating an origin group with two origins with one as the primary origin and the
other as the second origin which CloudFront automatically switches to when

316 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
the primary origin fails. This will alleviate the occasional HTTP 504 errors that
users are experiencing.

Reference: High Availability Origin Failover

Practice Exam - Question 68:

A Djamgatech’s leading IT consulting company has an application which
processes a large stream of financial data by an Amazon ECS Cluster then stores
the result to a DynamoDB table. You have to design a solution to detect new
entries in the DynamoDB table then automatically trigger a Lambda function to
run some tests to verify the processed data. What solution can be easily
implemented to alert the Lambda function of new entries while requiring minimal
configuration change to your architecture?
A
Invoke the Lambda functions using SNS each time that the ECS Cluster successfully processed financial data.
B
Use Systems Manager Automation to detect new entries in the DynamoDB table then automatically invoke the Lambda function for
processing.
C
Enable DynamoDB Streams to capture table activity and automatically trigger the Lambda function.
D
Use CloudWatch Alarms to trigger the Lambda function whenever a new entry is created in the DynamoDB table.

Your Answer: _______________

Your Notes:
_____________________________________________________

Practice Exam - Answer 68

C.

Amazon DynamoDB is integrated with AWS Lambda so that you can create
triggers—pieces of code that automatically respond to events in DynamoDB
Streams. With triggers, you can build applications that react to data
modifications in DynamoDB tables. If you enable DynamoDB Streams on a
317 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 table, you can associate the stream ARN with a Lambda function that you
write. Immediately after an item in the table is modified, a new record appears
in the table’s stream. AWS Lambda polls the stream and invokes your
Lambda function synchronously when it detects new stream records. You can
create a Lambda function which can perform a specific action that you specify,
such as sending a notification or initiating a workflow. For instance, you can
set up a Lambda function to simply copy each stream record to persistent
storage, such as EFS or S3, to create a permanent audit trail of write activity
in your table.

Reference: enabling DynamoDB Streams to capture table activity and

automatically trigger the Lambda function

Practice Exam - Question 69:

A Solutions Architect needs to deploy a mobile application that can collect votes
for a popular singing competition. Millions of users from around the world will
submit votes using their mobile phones. These votes must be collected and
stored in a highly scalable and highly available data store which will be queried
for real-time ranking. Which of the following combination of services should the
architect use to meet this requirement?
A
Amazon Redshift and AWS Mobile Hub
B
Amazon DynamoDB and AWS AppSync
C
Amazon Relational Database Service (RDS) and Amazon MQ
D
Amazon Aurora and Amazon Cognito

Your Answer: _______________

Your Notes:
_____________________________________________________

318 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 Practice Exam - Answer 69
B.

When the word durability pops out, the first service that should come to your
mind is Amazon S3. Since this service is not available in the answer options,
we can look at the other data store available which is Amazon DynamoDB.
DynamoDB is durable, scalable, and highly available data store which can be
used for real-time tabulation. You can also use AppSync with DynamoDB to
make it easy for you to build collaborative apps that keep shared data updated
in real time. You just specify the data for your app with simple code
statements and AWS AppSync manages everything needed to keep the app
data updated in real time. This will allow your app to access data in Amazon
DynamoDB, trigger AWS Lambda functions, or run Amazon Elasticsearch
queries and combine data from these services to provide the exact data you
need for your app.

Reference: DynamoDB

Passed AWS SAA Testimonials

I scored 858. Was practicing with Stephan's udemy lectures and Bonso exam
tests. My test results were as follows Test 1. 63%, 93% Test 2. 67%, 87% Test 3. 81
% Test 4. 72% Test 5. 75 % Test 6. 81% Stephan's test. 80%

- I was reading all question explanations (even the ones I got correct)

- The actual exam was pretty much similar to these. The topics I got were:

- A lot of S3 (make sure you know all of it from head to toes)

- VPC peering

- DataSync and Database Migration Service in same questions. Make sure you know
the difference

- One EKS question

319 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
- 2-3 KMS questions

- Security group question

- A lot of RDS Multi-AZ

- SQS + SNS fan out pattern

- ECS microservice architecture question

- Route 53

- NAT gateway

- took extra 30 minutes, because English is not my native language and I had plenty of
time to think and then review flagged questions.

- Source1:AWS Solutions Architect Dumps Blog at enoumen.com

- Source2: r/AWSCertifications

Passed SAA-C02: It took me 68 days straight of hard work to pass this exam with
confidence. No rest days, more than 120 pages of hand-written notes and
hundreds and hundreds of flash cards.

- In the beginning, I hopped on Stephane Maarek's course for the CCP exam just to see
if it was for me. I did the course in about a week and then after doing some research on
here, got the CCP Practice exams from tutorialsdojo.com Two weeks after starting the
Udemy course, I passed the exam. By that point, I'd already done lots of research on
the different career paths and the best way to study, etc.

- Cantrill(10/10) - That same day, I hopped onto Cantrill's course for the SAA and got to
work. Somebody had mentioned that by doing his courses you'd be over-prepared for
the exam. While I think a combination of material is really important for passing the
certification with confidence, I can say without a doubt Cantrill's courses got me 85-90%
of the way there. His forum is also amazing, and has directly contributed to me talking
with somebody who works at AWS to land me a job, which makes the money I spent on
all of his courses A STEAL. As I continue my journey (up next is SA Pro), I will be using
all of his courses.

- Neal Davis(8/10) - After completing Cantrill's course, I found myself needing a

resource to reinforce all the material I'd just learned. AWS is an expansive platf orm and
the many intricacies of the different services can be tricky. For this portion, I relied on
320 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
Neal Davis's Training Notes series. These training notes are a very condensed version
of the information you'll need to pass the exam, and with the proper context are very
useful to find the things you may have missed in your initial learnings. I will be using his
other Training Notes for my other exams as well.

- TutorialsDojo(10/10) - These tests filled in the gaps and allowed me to spot my

weaknesses and shore them up. I actually think my real exam was harder than these,
but because I'd spent so much time on the material I got wrong, I was able to pass the
exam with a safe score.

- As I said, I was surprised at how difficult the exam was. A lot of my questions were
related to DBs, and a lot of them gave no context as to whether the data being loaded
into them was SQL or NoSQL which made the choice selection a little frustrating. A lot
of the questions have 2 VERY SIMILAR answers, and often time the wording of the
answers could be easy to misinterpret (such as when you are creating a Read Replica,
do you attach it to the primary application DB that is slowing down because of read
issues or attach it to the service that is causing the primary DB to slow down). For
context, I was scoring 95-100% on the TD exams prior to taking the test and managed a
823 on the exam so I don't know if I got unlucky with a hard test or if I'm not as prepared
as I thought I was (i.e. over-thinking questions).

- Source1:AWS Solutions Architect Dumps Blog at enoumen.com

- Source2: r/AWSCertifications

Passed SAA: How did I prepare for AWS Certified Solutions Architect - Associate
Level certification?

- For me, Practical knowledge is 30% important and rest is Jayendra blog,
enoumen.com blog and Dumps.

- Buying udemy courses doesn't make you pass, I can tell surely without going to dumps
and without going to jayendra’s blog not easy to clear the certification.

- Read FAQs of S3, IAM, EC2, VPC, SQS, Autoscaling, Elastic Load Balancer, EBS,
RDS, Lambda, API Gateway, ECS.

- Read the Security Whitepaper and Shared Responsibility model.

- The most important thing is basic questions from the last introduced topics to
the exam is very important like Amazon Kinesis, etc

- ACloudGuru course with practice test's

321 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
- Created my own cheat sheet in excel

- Some questions were your understanding about which service to pick for the use case.

- many questions on VPC

- a couple of unexpected question on AWS CloudHSM, AWS systems manager, aws

athena

- encryption at rest and in transit services

- migration from on-premise to AWS

- backup data in az vs regional

- Whitepapers are the important information about each services that are published by
Amazon in their website. If you are preparing for the AWS certifications, it is very
important to use the some of the most recommended whitepapers to read before writing
the exam.

- Data Security questions could be the more challenging and it’s worth noting that you
need to have a good understanding of security processes described in the whitepaper
titled “Overview of Security Processes”.

- Source1:AWS Solutions Architect Dumps Blog at enoumen.com

- Source2: r/AWSCertifications

Testimonial: I passed SAA-C02... But don't do what I did to pass it

- The exam materials that I used were the following:

- AWS Certified Solutions Architect Associate All-in-One Exam Guide (Banerjee)

- Stephen Maarek's Udemy course, and his 6 exam practices

- Adrian Cantrill's online course (about `60% done)

- TutorialDojo's exams

- Five days before the exam, I finished Stephen's course, and then did his final exam on
the course. I failed miserably (around 50%). So I did one of Stephen's practice exam
and did worse (42%). I thought maybe it might be his exams that are slightly difficult, so
I went and bought Jon Bonso's exam and got 60% on his first one. And then I realized
322 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
based on all the questions on the exams, I was definitely lacking some fundamentals. I
went back to Adrian's course and things were definitely sticking more - I think it has to
do with his explanations + more practical stuff. Unfortunately, I could not finish his
course before the exam (because I was cramming), and on the day of the exam, I could
only do Bonso's four of six exams, with barely passing one of them.

- Please, don't do what I did. I was desperate to get this thing over with it. I wanted to
move on and work on other things for job search, but if you're not in this situation,
please don't do this. I can't for love of god tell you about OAI and Cloudfront and why
that's different than S3 URL. The only thing that I can remember is all the practical stuff
that I did with Adrian's course. I'll never forget how to create VPC, because he make
you manually go through it. I'm not against Stephen's course - they are different on its
own way (see the tips below).

- So here's what I recommend doing before writing for aws exam:

- Don't schedule your exam beforehand. Go through the materials that you are doing,
and make sure you get at least 80% on all of the Jon Bonso's exam (I'd recommend
maybe 90% or higher)

- If you like to learn things practically, I do recommend Adrian's course. If you like to
learn things conceptually, go with Stephen Maarek's course. I find Stephen's course
more detailed when going through different architectures, but I can't really say that
because I didn't really finish Adrian's course

- Jon Bonso's exam was about the same difficulty as the actual exam. But they're
slightly more tricky. For example, many of the questions will give you two different
situation and you really have to figure out what they are asking for because they might
contradict to each other, but the actual question is asking one specific thing. However,
there were few questions that were definitely obvious if you knew the service.

- I'm upset that even though I passed the exam, I'm still lacking some practical stuff, so
I'm just going to go through Adrian's Developer exam but without cramming this time. If
you actually learn the materials and practice them, they are definitely useful in the real
world. I hope this will help you passing and actually learning the stuff.

- Source1:AWS Solutions Architect Dumps Blog at enoumen.com

- Source2: r/AWSCertifications

Testimonial: Passed SAA-C02 with a score of 833/1000

- Just a quick note - recently passed SAA-C02 with a score of 833/1000, the exam was
pretty tough and only had ~10 mins left at the end after checking a few flagged
323 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
questions.

- Had a few questions that were not covered in -any- of the material I studied. One of
which was on the Rekognition and Textract services - so might be worth reading those
before you take the exam!

- The whole process took me ~6 weeks, I booked the test after I was halfway through
the video content. I'm the sort of person that isn't motivated unless I have a deadline. :)

- Background: I'm a Data Engineer with a background in software engineering. Been

using AWS for ~1.5 years but really had absolutely no clue on a AWS networking (VPC,
CIDR Ranges, Security Groups, NACLs etc...) and other more "web developer"
(Route53, CloudFront etc) based services. The databases and other data related
questions were pretty easy!

- Study route:
Stephane Maarek Udemy videos, watched the whole course on 1.5 speed, went over
some of the difficult sections a few times. I'd write notes on the whole course in a
notepad as I went through the course, I found this made things stick a little better.
Overall I found the course really good and would highly recommend it, it took me around
3 weeks to complete - trying to do an hour or so a day. Got ~60% on the practice test at
the end, found this really tough and I'll be honest I felt the pressure a bit with such a low
score. link
- Tutorials Dojo practice tests, again scored around 60% on the first practice test. Used
the "review mode" and did every single question on there and learned the concepts I
was struggling with. This involved writing a set of notes in notion for each service I didn't
know well. There are 6 tests, and by the end I was scoring 80 - 85% on these. Went
through and redid the tests I had lowest on and got 90+% on these. These questions
are -very- similar to those that you'll find in the real exam.

- I also bought the practice tests from Stephane Maarek, I found these much harder
than the real exam - if you're consistently doing well on these (80+%) you'll pass the
exam no problem. I completed all of his 6 tests, again writing notes on things I got
wrong, and was scoring 80-90% by the time I had finished these.

- bought a set of practice tests from Whizz Labs 2 days before my exam and was
scoring 80-90% on each of these - I wouldn't recommend buying these as the
explanations were pretty poor and questions weren't like the real exam. The day before
the exam I read through all the comparisons of the services on tutorials dojo, this was -
super- helpful and I'd recommend this to get things to finally stick.

- I also stumbled across some official practice questions on the AWS skill builder site, I
scored 19/20 on these, so felt pretty confident going into the exam.

324 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
- So I'd say I probably spent 50% of the time on video content and 50% on doing exam
papers and writing up notes on questions I got wrong. I tried to do an hour or so each
evening, I found it much better to be consistent and do an hour each evening than
skipping days and trying to cram. It was taking me approx 1 hour to do a practice test by
the end (and score relatively well), but the real exam took longer!

- The Exam:
The test centre experience was good, I'd much rather take the test in a centre and not
have to worry about being recorded, stress of internet cutting out etc. One thing that did
catch me off guard is all the text for the questions are tightly packed together on the
screen, which makes it a bit difficult to read. I didn't get my results for ~24 hours - so
hang tight

- The exam questions seemed to be quite long (make use of those extra 30 mins).
Although I felt for questions where I was confused , with options given it is not quite
hard to pick the right answers (use elimination method). I got a lot of questions on S3 ,
Aurora, Dynamo DB, VPN.

- Source1:AWS Solutions Architect Dumps Blog at enoumen.com

- Source2: r/AWSCertifications

I passed SAA with (799), had about an hour left on the clock.

- Many FSx / EFS / Lustre questions

- S3 Use cases, storage tiers, cloudfront were pretty prominent too

- Only got one "figure out what's wrong with this IAM policy" question

- A handful of dynamodb questions and a handful for picking use cases between
different database types or caching layers.

- Other typical tips: When you're unclear on what answer you should pick, or if they
seem very similar - work on eliminating answers first. "It can't be X because oy Y" and
that can help a lot.

- Source1:AWS Solutions Architect Dumps Blog at enoumen.com

- Source2: r/AWSCertifications

325 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web
 326 | P a g e
Download our AWS SAA-C03 Practice Exam Apps below For an Interactive Experience
and Simulate Real Practice Exam
iOs – Android – Windows - Web