Instant Access Amazon.SAA-C03.v2025-10-20.q999 Actual Practice Test Engine for Free (Page 5)

Question 16

[Design High-Performing Architectures]
A company wants to create a payment processing application. The application must run when a payment record arrives in an existing Amazon S3 bucket. The application must process each payment record exactly once. The company wants to use an AWS Lambda function to process the payments.
Which solution will meet these requirements?

A.Configure the existing S3 bucket to send object creation events directly to the Lambda function. Configure the Lambda function to handle object creation events and to process the payments.
B.Configure the existing S3 bucket to send object creation events to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function to run when a new event arrives in the SQS queue.
C.Configure the existing S3 bucket to send object creation events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure the Lambda function to run when a new event arrives in the SNS topic.
D.Configure the existing S3 bucket to send object creation events to Amazon EventBridge. Configure EventBridge to route events to an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Configure the Lambda function to run when a new event arrives in the SQS queue.

Question 17

[Design Resilient Architectures]
A company has a web application hosted over 10 Amazon EC2 instances with traffic directed by Amazon Route 53. The company occasionally experiences a timeout error when attempting to browse the application. The networking team finds that some DNS queries return IP addresses of unhealthy instances, resulting in the timeout error.
What should a solutions architect implement to overcome these timeout errors?

A.Create a Route 53 simple routing policy record for each EC2 instance. Associate a health check with each record.
B.Create a Route 53 failover routing policy record for each EC2 instance. Associate a health check with each record.
C.Create an Amazon CloudFront distribution with EC2 instances as its origin. Associate a health check with the EC2 instances.
D.Create an Application Load Balancer (ALB) with a health check in front of the EC2 instances. Route to the ALB from Route 53.

Question 18

[Design Secure Architectures]
A company runs an environment where data is stored in an Amazon S3 bucket. The objects are accessed frequently throughout the day. The company has strict data encryption requirements fordata that is stored in the S3 bucket. The company currently uses AWS Key Management Service (AWS KMS) for encryption.
The company wants to optimize costs associated with encrypting S3 objects without making additional calls to AWS KMS.
Which solution will meet these requirements?

A.Use server-side encryption with Amazon S3 managed keys (SSE-S3).
B.Use an S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the new objects.
C.Use client-side encryption with AWS KMS customer managed keys.
D.Use server-side encryption with customer-provided keys (SSE-C) stored in AWS KMS.

Question 19

A company hosts an application in a private subnet. The company has already integrated the application with Amazon Cognito. The company uses an Amazon Cognito user pool to authenticate users.
The company needs to modify the application so the application can securely store user documents in an Amazon S3 bucket.
Which combination of steps will securely integrate Amazon S3 with the application? (Select TWO.)

A.Create an Ama2on Cognito identity pool to generate secure Amazon S3 access tokens for users when they successfully log in.
B.Use the existing Amazon Cognito user pool to generate Amazon S3 access tokens for users when they successfully log in.
C.Create an Amazon S3 VPC endpoint in the same VPC where the company hosts the application.
D.Create a NAT gateway in the VPC where the company hosts the application. Assign a policy to the S3 bucket to deny any request that is not initiated from Amazon Cognito.
E.Attach a policy to the S3 bucket that allows access only from the users' IP addresses.

Correct Answer: A,C

To securely integrate Amazon S3 with an application that uses Amazon Cognito for user authentication, the following two steps are essential:
Detailed Explanation:
Step 1: Create an Amazon Cognito Identity Pool (Option A)
Amazon Cognito Identity Pools allow users to obtain temporary AWS credentials to access AWS resources, such as Amazon S3, after successfully authenticating with the Cognito user pool. The identity pool bridges the gap between user authentication and AWS service access by generating temporary credentials using AWS Identity and Access Management (IAM).
Once a user logs in using the Cognito User Pool, the identity pool provides IAM roles with specific permissions that the application can use to access S3 securely. This ensures that each user has appropriate access controls while accessing the S3 bucket.
This is a secure way to ensure that users only have temporary and least-privilege access to the S3 bucket for their documents.
Step 2: Create an Amazon S3 VPC Endpoint (Option C)
By creating an Amazon S3 VPC endpoint, the company ensures that communication between the application (which is hosted in a private subnet) and the S3 bucket occurs over the AWS private network, without the need to traverse the internet. This enhances security and prevents exposure of data to public networks.
The VPC endpoint allows the application to access the S3 bucket privately and securely within the VPC. It also ensures that traffic stays within the AWS network, reducing attack surface and improving overall security.
Why the Other Options Are Incorrect:
Option B: This is incorrect because Amazon Cognito User Pools are used for user authentication, not for generating S3 access tokens. To provide S3 access, you need to use Amazon Cognito Identity Pools, which offer AWS credentials.
Option D: A NAT gateway is unnecessary in this scenario. Using a VPC endpoint for S3 access provides a more secure and cost-effective solution by keeping traffic within AWS.
Option E: Attaching a policy to restrict access based on IP addresses is not scalable or efficient. It would require managing users' dynamic IP addresses, which is not an effective security measure for this use case.
AWS Reference:
Amazon Cognito Identity Pools
Amazon VPC Endpoints for S3

Question 20

A company wants to measure the effectiveness of its recent marketing campaigns. The company performs batch processing on csv files of sales data and stores the results an Amazon S3 bucket once every hour. The S3 bi petabytes of objects. The company runs one-time queries in Amazon Athena to determine which products are most popular on a particular date for a particular region Queries sometimes fail or take longer than expected to finish.
Which actions should a solutions architect take to improve the query performance and reliability? (Select TWO.)

A.Partition the data by date and region n Amazon S3
B.Store the files as large, single objects in Amazon S3.
C.Use an AWS duo extract, transform, and load (ETL) process to convert the csv files into Apache Parquet format.
D.Use Amazon Kinosis Data Analytics to run the Queries as pan of the batch processing operation
E.Reduce the S3 object sizes to less than 126 MB

Question 16

Question 17

Question 18

Question 19

Question 20

Download PDF File