AWS Certified Solutions Architect Professional SAP-C03 Practice Questions with Explanatio…

154 questions · Cloud Computing · by Study Foxy

Study these questions free

Questions

  1. An order pipeline must process each order exactly once, in order per customer, while different customers are processed in parallel. Which design fits?

    • SQS FIFO with customer ID as the message group ID
    • SQS standard queue with a long visibility timeout
    • SNS standard topic with one subscriber per customer
    • Kinesis with a random partition key per record

  2. Consumers of an SQS standard queue occasionally receive duplicates. How should the consumer be designed?

    • Idempotently, with a dedup key
    • Assume exactly-once delivery from the queue
    • Increase the queue's retention period
    • Switch consumers to short polling

  3. A web tier keeps user sessions in instance memory, which breaks scaling. What is the best fix?

    • Externalize session state to ElastiCache or DynamoDB
    • Enable sticky sessions and stop scaling in
    • Store sessions on each instance's EBS volume and snapshot them nightly
    • Use larger instances so fewer are needed

  4. A multi-step order process with human approval must run reliably for up to 30 days and survive failures. Which service fits?

    • Step Functions Standard Workflows
    • Step Functions Express Workflows
    • A single Lambda function with retries
    • An SQS delay queue

  5. Events from 20 workload accounts must reach a central security account's event bus for processing. Which design fits?

    • Rules targeting a central account's bus
    • CloudTrail in each account emailing the team
    • An SQS queue polled from each account
    • Copying events to S3 and running daily Athena queries

  6. Microservices in many VPCs and accounts need service-to-service connectivity with auth policies and no VPC peering. Which service fits?

    • Amazon VPC Lattice
    • A Transit Gateway with full-mesh routes
    • Public ALBs with IP allowlists
    • Site-to-Site VPN between every VPC

  7. ECS services need built-in service discovery, traffic metrics, and retries between them with minimal setup. Which feature fits?

    • ECS Service Connect
    • AWS Cloud Map with manual health checks only
    • Route 53 public hosted zones
    • A Classic Load Balancer per service

  8. Container images must be scanned for vulnerabilities on push, and untagged images older than 14 days removed. What should be configured in ECR?

    • Enhanced scanning and a lifecycle policy
    • Tag immutability and a repository policy
    • Cross-Region replication and pull-through cache
    • Image signing only, with no scanning

  9. Pods on EKS need to scale with load, and nodes must be added when pods can't be scheduled. Which combination fits?

    • HPA plus Karpenter or Cluster Autoscaler
    • Vertical Pod Autoscaler only with fixed node groups
    • Lambda reserved concurrency for each pod
    • EC2 Auto Scaling scheduled actions only

  10. An EKS cluster needs ALBs created automatically from Kubernetes Ingress resources. What should be installed?

    • The AWS Load Balancer Controller
    • The Amazon VPC CNI plugin with custom networking
    • CoreDNS with custom forwarding
    • The EBS CSI driver

  11. Simple header rewrites and URL redirects must run at the edge for every request with sub-millisecond latency and lowest cost. Which fits?

    • CloudFront Functions
    • Lambda@Edge
    • An ALB listener rule
    • API Gateway mapping templates

  12. A chat app needs servers to push messages to connected clients in real time without polling. Which option fits?

    • API Gateway WebSocket APIs
    • API Gateway REST APIs with caching
    • S3 static website hosting
    • An SQS queue per user

  13. A SaaS app shares one database across tenants and must prevent tenants from seeing each other's rows. Which isolation approach fits a pooled model?

    • Row-level security keyed on tenant context
    • One AWS account per tenant
    • One VPC per tenant with peering
    • Disabling encryption to simplify cross-tenant queries

  14. A regulated tenant demands its data be encrypted with a key no other tenant uses. Which approach fits?

    • Tenant-specific KMS keys
    • One shared AWS managed key
    • SSE-S3 for all tenants
    • Client certificates only

  15. Clickstream data must be ingested, transformed, and queried with no servers to manage. Which pipeline fits?

    • Kinesis, Lambda or Glue, S3, Athena
    • EC2 cron jobs writing to an RDS instance
    • EMR on EC2 with a long-running cluster
    • On-premises Hadoop over a VPN

  16. Which are valid ways to scale serverless and container workloads? (Select TWO.)

    • ECS service auto scaling with target tracking
    • Lambda provisioned concurrency with Application Auto Scaling
    • Manually resizing a single EC2 instance weekly
    • Disabling health checks during peaks

  17. Several business units in separate accounts need governed access to Bedrock models with central guardrails and usage tracking. Which design fits?

    • A central Bedrock platform account with shared guardrails
    • Each unit calling public model APIs with personal keys
    • Self-hosting every model on EC2 in each account
    • One IAM user shared by all units

  18. An agent must call internal APIs as tools, keep session memory, and run with isolated sessions. Which service fits?

    • Amazon Bedrock AgentCore
    • Amazon SQS FIFO
    • AWS Batch array jobs with retries
    • Amazon Lightsail

  19. Answers must come from a company's policy documents, with citations, without retraining a model. Which architecture fits?

    • RAG with Bedrock Knowledge Bases
    • Pre-training a custom FM monthly
    • Fine-tuning weekly on all documents
    • Raising model temperature

  20. A custom model needs low-latency, always-on inference with autoscaling. Which option fits?

    • A SageMaker AI real-time endpoint
    • SageMaker batch transform with a nightly schedule
    • Athena with a UDF
    • Glue streaming ETL

  21. Retrieval in a RAG app returns relevant chunks but in poor order. What improves answer quality?

    • Add a reranking step
    • Use one huge chunk per document
    • Remove chunk metadata
    • Lower the embedding dimension

  22. A company needs highly resilient hybrid connectivity for critical workloads. Which design meets AWS's maximum resiliency recommendation?

    • Two Direct Connect locations, each with two connections
    • One Direct Connect connection with a Site-to-Site VPN as the only backup path
    • Two VPN tunnels on one customer gateway
    • One Direct Connect connection at one location

  23. On-premises file servers must keep using NFS while data lands in S3 with local caching. Which service fits?

    • Amazon S3 File Gateway
    • AWS DataSync scheduled tasks
    • AWS Transfer Family SFTP
    • Amazon EFS with a VPN

  24. A legacy app uses JMS with ActiveMQ and must integrate with new AWS services without rewriting messaging. Which fits?

    • Amazon MQ
    • Amazon SNS
    • Amazon Kinesis
    • AWS AppSync

  25. On-premises DNS must resolve Route 53 private hosted zone names, and VPCs must resolve on-premises names. What is needed?

    • Route 53 Resolver inbound and outbound endpoints
    • Public hosted zones for every internal domain name
    • DNS servers on EC2 in each VPC
    • A CloudFront distribution

  26. The same domain must return internal IPs inside the VPC and public IPs on the internet. What is this called?

    • Split-horizon DNS
    • DNS failover routing
    • Weighted DNS routing
    • DNSSEC signing

  27. A company wants to run ECS tasks on its own on-premises servers, managed from the ECS control plane. Which option fits?

    • Amazon ECS Anywhere
    • AWS Wavelength
    • Amazon Lightsail
    • AWS App Runner with a VPC connector

  28. A provider must expose one service to hundreds of consumer VPCs with overlapping CIDRs. Which option fits?

    • AWS PrivateLink
    • VPC peering
    • Transit Gateway with static routes
    • A public NLB with allowlists

  29. A company wants central IP planning across Regions and accounts to prevent overlapping CIDRs. Which service fits?

    • Amazon VPC IPAM
    • AWS RAM alone
    • Route 53 Resolver
    • VPC Flow Logs

  30. All traffic between VPCs and to the internet must pass through centralized third-party firewall appliances that scale. Which design fits?

    • An inspection VPC using GWLB
    • Security groups on every instance only
    • A NAT gateway in each VPC
    • VPC peering between all VPCs

  31. IPv6-only workloads must reach IPv4-only services on the internet. What enables this?

    • NAT64 with DNS64
    • An egress-only internet gateway alone
    • An IPv4 NAT gateway with no DNS changes
    • VPC peering to an IPv4 VPC

  32. A global app needs static anycast IPs and fast failover between Regions for TCP traffic. Which service fits?

    • AWS Global Accelerator
    • Route 53 simple routing
    • CloudFront with a single origin
    • A Regional NLB only

  33. A company needs a global network that connects branches, data centers, and VPCs across Regions with one central policy. Which service fits?

    • AWS Cloud WAN
    • VPC peering in each Region
    • AWS Client VPN
    • Amazon CloudFront

  34. A data lake needs ACID tables, time travel, and fine-grained permissions queryable by Athena and Redshift. Which design fits?

    • Iceberg tables with Lake Formation
    • CSV files with bucket policies only
    • DynamoDB tables with streams
    • EBS volumes shared across instances

  35. A global app needs a relational database with low-latency reads in multiple Regions and fast Regional failover. Which fits?

    • Aurora Global Database
    • RDS Multi-AZ in one Region
    • DynamoDB with DAX
    • Redshift with concurrency scaling

  36. Two companies want to analyze overlapping customers without sharing raw data with each other. Which service fits?

    • AWS Clean Rooms
    • Redshift data sharing
    • S3 Cross-Region Replication
    • AWS DataSync

  37. A key-value workload needs microsecond reads and must be durable across AZs. Which store fits?

    • Amazon MemoryDB
    • ElastiCache with no replicas
    • Amazon Redshift
    • S3 Glacier

  38. Windows apps need SMB shares with Active Directory integration and Multi-AZ availability. Which storage fits?

    • Amazon FSx for Windows File Server
    • Amazon EFS with the Infrequent Access class
    • Amazon FSx for Lustre
    • EC2 instance store

  39. Streaming events from Kafka must be processed in real time while batch jobs run nightly on the same data in S3. Which services fit?

    • Amazon MSK plus EMR or Glue on S3
    • Amazon MQ plus DynamoDB TTL
    • Amazon SNS plus S3 Glacier Deep Archive restores
    • SES plus Athena

  40. Users and groups from a corporate identity provider must be provisioned into IAM Identity Center automatically as they change. Which protocol handles provisioning?

    • SCIM
    • SAML 2.0
    • LDAP over TLS
    • Kerberos

  41. Pods in EKS need fine-grained AWS permissions per service account without node-level credentials. Which feature fits?

    • EKS Pod Identity
    • An instance profile on every node
    • IAM users with keys in Kubernetes secrets
    • A security group per pod

  42. On-premises servers need temporary AWS credentials without long-term access keys. Which service fits?

    • IAM Roles Anywhere
    • IAM Identity Center user portal
    • Amazon Cognito user pools
    • AWS Directory Service only

  43. A third-party vendor assumes a role in many customer accounts. Which control prevents the confused deputy problem?

    • An external ID condition in the role's trust policy
    • A permissions boundary attached to the vendor's own account roles
    • A larger session duration
    • An SCP that allows sts:AssumeRole

  44. Developers may create roles, but those roles must never exceed a defined set of permissions. Which feature fits?

    • Permissions boundaries
    • Session tags only
    • Resource-based policies
    • Service-linked roles

  45. The organization must ensure its S3 data can only be accessed by its own identities and from its own networks. What is this pattern called?

    • A data perimeter
    • A landing zone with account baselines
    • A pilot light
    • A service mesh

  46. Employees need access to internal web apps based on identity and device posture, without a VPN. Which service fits?

    • AWS Verified Access
    • AWS Client VPN
    • AWS Site-to-Site VPN
    • Amazon CloudFront signed URLs

  47. A SaaS app needs fine-grained, policy-based authorization decisions inside the application using Cedar policies. Which service fits?

    • Amazon Verified Permissions
    • AWS IAM Access Analyzer
    • AWS Organizations service control policies
    • Amazon GuardDuty

  48. Security needs to find all resources shared with principals outside the organization. Which tool fits?

    • IAM Access Analyzer
    • AWS Trusted Advisor cost checks
    • CloudWatch Logs Insights
    • AWS Config conformance packs only

  49. VPC traffic to S3 must only reach buckets owned by the organization. Which control fits?

    • An endpoint policy on aws:ResourceOrgID
    • A security group on the endpoint
    • A NAT gateway with an allowlist
    • An S3 lifecycle rule

  50. A company wants KMS keys rotated automatically and must choose the rotation period. Which key type fits?

    • Customer managed keys
    • AWS owned keys
    • AWS managed keys with custom rotation
    • Imported keys with automatic rotation

Showing 50 of 154. Open the quiz to study them all.