At ValidExamDumps, we consistently monitor updates to the Amazon SAA-C03 exam questions by Amazon. Whenever our team identifies changes in the exam questions, objectives, focus areas or requirements, We immediately update our exam questions for both PDF and online practice exams. This commitment ensures our customers always have access to the most current and accurate questions. By preparing with these up to date and 100% exam domain coverage questions, our customers can successfully pass the Amazon AWS Certified Solutions Architect - Associate exam on their first attempt without needing additional materials or study guides.
Other certification materials providers often include outdated or removed questions by Amazon in their SAA-C03 exam. These outdated questions lead to customers failing their Amazon AWS Certified Solutions Architect - Associate exam. In contrast, we ensure our questions bank includes only precise and up-to-date questions. Our main priority is your success in the Amazon SAA-C03 exam, not profiting from selling obsolete exam questions in PDF or Online Practice Test.
A company wants to migrate applications from its on-premises servers to AWS. As a first step, the company is modifying and migrating a non-critical application to a single Amazon EC2 instance. The application will store information in an Amazon S3 bucket. The company needs to follow security best practices when deploying the application on AWS.
Which approach should the company take to allow the application to interact with Amazon S3?
AWS recommends using anIAM role attached to the EC2 instanceso the application can obtaintemporary credentialsautomatically instead of storing long-term access keys in code or configuration. That directly follows AWS security guidance for workloads running on EC2. The role should grant only the specific S3 permissions the application needs, which satisfies the principle of least privilege. Administrative access is too broad, and IAM users with access keys are less secure because they require credential distribution and rotation. The best-practice design is therefore to attach an IAM role with only the required S3 actions to the instance profile and let the SDK retrieve temporary credentials from the instance metadata service.
A company runs an application that stores and shares photos. Users upload photos to an Amazon S3 bucket. Approximately 150 photos are uploaded daily. The company wants to create a thumbnail for each new photo and store it in a second S3 bucket.
Which solution will meet these requirements MOST cost-effectively?
The workload described is event-driven, low volume, and sporadic, making serverless architecture the most cost-effective choice. AWS Lambda, when triggered by S3 event notifications, runs only when new photos are uploaded and incurs cost only for execution time.
Option C uses S3 event notifications to invoke a Lambda function whenever a new object is created. The Lambda function generates a thumbnail and uploads it to a second S3 bucket. This solution requires no servers, no scheduling, and no idle compute costs, making it extremely cost-efficient for 150 uploads per day.
Options A and B involve running long-lived compute resources that would remain idle most of the time, resulting in unnecessary cost. Option D is invalid because S3 Storage Lens is designed for storage analytics and reporting, not event-driven processing.
Therefore, C is the most cost-effective and operationally efficient solution.
A company is developing a photo-hosting application in the us-east-1 Region. The application gives users across multiple countries the ability to upload and view photos. Some photos are heavily viewed for months, while other photos are viewed for less than a week. The application allows users to upload photos that are up to 20 MB in size. The application uses photo metadata to determine which photos to display to each user.
The company needs a cost-effective storage solution to support the application.
Amazon S3 Intelligent-Tiering automatically moves objects between frequent and infrequent access tiers based on access patterns, which minimizes cost without performance impact. Storing photo metadata in Amazon DynamoDB provides fast and scalable lookup by user or tag.
From AWS Documentation:
''The S3 Intelligent-Tiering storage class automatically optimizes storage costs by moving data between frequent and infrequent access tiers when access patterns change.''
(Source: Amazon S3 User Guide -- Intelligent-Tiering)
Why B is correct:
S3 Intelligent-Tiering optimizes storage automatically for cost without lifecycle management overhead.
DynamoDB stores small metadata items and S3 URLs, enabling efficient queries and photo lookups.
This architecture scales globally, integrates seamlessly with applications, and minimizes operational cost.
Why other options are incorrect:
A & D: DynamoDB is not intended for storing binary objects like images.
C: Lifecycle rules are static and don't adapt dynamically to unpredictable access patterns.
References:
Amazon S3 User Guide -- ''Storage Classes and Intelligent-Tiering''
AWS Well-Architected Framework -- Cost Optimization Pillar
AWS Developer Guide -- ''Building Serverless Image Hosting with S3 and DynamoDB''
A company has a large fleet of vehicles that are equipped with internet connectivity to send telemetry to the company. The company receives over 1 million data points every 5 minutes from the vehicles. The company uses the data in machine learning (ML) applications to predict vehicle maintenance needs and to preorder parts. The company produces visual reports based on the captured dat
a. The company wants to migrate the telemetry ingestion, processing, and visualization workloads to AWS. Which solution will meet these requirements?
Amazon Timestream: Purpose-built time series database optimized for telemetry and IoT data ingestion and analytics.
Amazon SageMaker: Provides ML capabilities for predictive maintenance workflows.
Amazon QuickSight: Efficiently generates interactive, real-time visual reports from Timestream data.
Optimized for Scale: Timestream efficiently handles large-scale telemetry data with time-series indexing and queries.
Amazon Timestream Documentation
A company is building an Amazon Elastic Kubernetes Service (Amazon EKS) cluster for its workloads. All secrets that are stored in Amazon EKS must be encrypted in the Kubernetes etcd key-value store.
Which solution will meet these requirements?
In Amazon EKS, Kubernetes stores objects such as Secrets in the cluster's etcd key-value store. By default, Kubernetes Secrets are base64-encoded and are not automatically encrypted at the application object level unless encryption is configured. Amazon EKS provides a managed capability to encrypt Kubernetes Secrets at rest in etcd using AWS Key Management Service (KMS). The requirement explicitly states that ''all secrets that are stored in Amazon EKS must be encrypted in the Kubernetes etcd key-value store,'' which maps directly to enabling EKS secrets encryption with a customer-managed KMS key.
Option B is exactly this: create a KMS key and enable EKS KMS secrets encryption on the cluster. With this enabled, EKS uses envelope encryption so that Secrets are encrypted when stored in etcd, and decrypt operations are controlled through KMS permissions. This is the standard, AWS-native method that fulfills the requirement without requiring application changes or external secret stores for the encryption-at-rest requirement in etcd.
Option A (Secrets Manager) is a strong service for secret lifecycle management and rotation, but it does not by itself guarantee that Kubernetes Secrets stored in etcd are encrypted unless EKS secrets encryption is also enabled or the cluster avoids storing secrets in etcd entirely. The question specifically targets etcd encryption. Option C is unrelated: the EBS CSI driver concerns persistent volumes, not etcd secret encryption. Option D concerns EBS volume encryption and a specific AWS-managed key alias used for EBS; it also does not address etcd encryption for Kubernetes Secrets.
Therefore, B is the correct solution because it directly enables encryption of Kubernetes Secrets within etcd using KMS.
