A financial services company plans to launch a new application on AWS to handle sensitive financial transactions. The company will deploy the application on Amazon EC2 instances. The company will use Amazon RDS for MySQL as the database. The company's security policies mandate that data must be encrypted at rest and in transit. Which solution will meet these requirements with the LEAST operational overhead?
Correct Answer: A
This solution provides encryption at rest and in transit with the least operational overhead while adhering to the company's security policies. Encryption at Rest: Amazon RDS for MySQL can be configured to encrypt data at rest by using AWS Key Management Service (KMS) managed keys. This encryption is applied automatically to all data stored on disk, including backups, read replicas, and snapshots. This solution requires minimal operational overhead because AWS manages the encryption and key management process. Encryption in Transit: AWS Certificate Manager (ACM) allows you to provision, manage, and deploy SSL /TLS certificates seamlessly. These certificates can be used to encrypt data in transit by configuring the MySQL instance to use SSL/TLS for connections. This setup ensures that data is encrypted between the application and the database, protecting it from interception during transmission. * Why Not Other Options?: * Option B (IPsec tunnels): While IPsec tunnels encrypt data in transit, they are more complex to manage and require additional configuration and maintenance, leading to higher operational overhead. * Option C (Third-party application-level encryption): Implementing application-level encryption adds complexity, requires code changes, and increases operational overhead. * Option D (VPN for encryption): A VPN solution for encrypting data in transit is unnecessary and adds additional complexity without providing any benefit over SSL/TLS, which is simpler to implement and manage. AWS References: Amazon RDS Encryption - Information on how to configure and use encryption for Amazon RDS. AWS Certificate Manager (ACM) - Details on using ACM to manage SSL/TLS certificates for securing data in transit.
SAA-C03 Exam Question 92
A company is developing a latency-sensitive application. Part of the application includes several AWS Lambda functions that need to initialize as quickly as possible. The Lambda functions are written in Java and contain initialization code outside the handlers to load libraries, initialize classes, and generate unique IDs. Which solution will meet the startup performance requirement MOST cost-effectively?
Correct Answer: D
AWS Lambda SnapStart is designed to improve the cold start performance of Java Lambda functions by initializing the function, taking a snapshot of the execution environment, and then reusing that snapshot for subsequent invocations. However, some code (such as code that generates unique IDs or session-specific data) should run during each invocation, not during the snapshot process. By using a pre-snapshot hook and moving the unique ID generation into the handler, you ensure that non-deterministic or per-invocation code is executed correctly, while the rest of the initialization benefits from SnapStart. This delivers the lowest latency and cost, as you do not need to pay for provisioned concurrency. AWS Documentation Extract: "Lambda SnapStart is ideal for Java functions with long cold starts due to heavy initialization. Move non- deterministic code such as unique ID generation to the handler, and use pre-snapshot hooks to customize what gets snapshotted. SnapStart works only for published versions, not $LATEST." (Source: AWS Lambda documentation, Using SnapStart for Java Functions) Other options: A: SnapStart is not supported for the $LATEST version; must be a published version. B & C: Provisioned concurrency removes cold starts but is more expensive than SnapStart for most workloads. C: You must use SnapStart on published versions, but provisioned concurrency is not required for SnapStart and adds cost. Reference: AWS Certified Solutions Architect - Official Study Guide, Lambda Performance Section.
SAA-C03 Exam Question 93
A company has an API that receives real-time data from a fleet of monitoring devices. The API stores this data in an Amazon RDS DB instance for later analysis. The amount of data that the monitoring devices send to the API fluctuates. During periods of heavy traffic, the API often returns timeout errors. After an inspection of the logs, the company determines that the database is not capable of processing the volume of write traffic that comes from the API. A solutions architect must minimize the number of connections to the database and must ensure that data is not lost during periods of heavy traffic.
Correct Answer: C
Using Amazon SQS decouples the API from the database, allowing the system to handle write bursts without data loss. The queue buffers incoming requests, and AWS Lambda processes them asynchronously, writing to the RDS instance at a sustainable rate. From AWS Documentation: "Amazon SQS acts as a buffer between components that produce and consume data, allowing each to operate independently. You can use AWS Lambda to process messages from SQS and write them to other services such as Amazon RDS." (Source: Amazon SQS Developer Guide) Why C is correct: SQS absorbs write surges and ensures durable message retention. Lambda scales automatically with message volume and reduces DB connections. Prevents timeout errors by smoothing traffic spikes. Why others are incorrect: A: Scaling RDS vertically doesn't address connection spikes. B: Multi-AZ is for availability, not write throughput. D: SNS is for fan-out message delivery, not queue-based buffering. References: Amazon SQS Developer Guide - "Decoupling Applications with Message Queues" AWS Lambda Developer Guide - "Using Lambda with SQS" AWS Well-Architected Framework - Performance Efficiency and Reliability Pillars
SAA-C03 Exam Question 94
An ecommerce company hosts a three-tier web application in a VPC. The web tier runs on Amazon EC2 instances in two Availability Zones. The company stores a product catalog and customer sales information in Amazon DynamoDB. The company's finance team uses a reporting application to generate reports of daily product sales. When the finance team runs the daily reports, a sudden performance decrease affects website customers. The company wants to improve the performance of the system. Which solution will meet these requirements with MINIMAL changes to the current architecture?
Correct Answer: C
DynamoDB Accelerator (DAX) is a fully managed, in-memory cache for DynamoDB that delivers up to a 10x performance improvement-even at millions of requests per second. DAX requires minimal changes to existing applications and offloads the read workload from DynamoDB during report generation. Reference Extract: "DAX provides in-memory acceleration for DynamoDB tables, reducing response times from milliseconds to microseconds with minimal application changes." Source: AWS Certified Solutions Architect - Official Study Guide, DynamoDB and Performance section.
SAA-C03 Exam Question 95
A company is implementing a shared storage solution for a media application that the company hosts on AWS. The company needs the ability to use SMB clients to access stored data. Which solution will meet these requirements with the LEAST administrative overhead?
Correct Answer: D
The key requirements are shared storage, SMB protocol support, and least administrative overhead. Amazon FSx for Windows File Server is a fully managed AWS service designed specifically to provide native SMB file shares compatible with Windows-based workloads and SMB clients. Option D is the optimal solution because FSx for Windows File Server eliminates the need to manage operating systems, patching, backups, file server clustering, and availability. AWS handles infrastructure management, scaling, and availability, while providing high-performance file storage that integrates seamlessly with Active Directory and supports standard Windows file permissions and SMB semantics. This makes it ideal for media applications that rely on shared file access. Option A (Storage Gateway Volume Gateway) is designed primarily for hybrid environments that extend on- premises storage into AWS, not for cloud-native shared file systems. Option B (Tape Gateway) is intended for backup and archival workflows, not active file access. Option C requires significant operational overhead, including OS maintenance, security patching, scaling, and high availability design. Therefore, D meets all requirements with the least administrative effort while providing a scalable, secure, and highly available SMB-compatible storage solution.
