AWS Certified Solutions Architect - Associate (SAA-C03) Practice Test
15 Questions
4 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the best way to meet the requirements of encrypting the application at the edge with a certificate issued by an external CA and rotating it annually?

  • Use AWS Certificate Manager (ACM) to issue an SSL/TLS certificate. Import the key material from the certificate. Apply the certificate to the ALB. Use the managed renewal feature to automatically rotate the certificate.
  • Use AWS Certificate Manager (ACM) Private Certificate Authority to issue an SSL/TLS certificate from the root CA. Apply the certificate to the ALB.
  • Apply a self-signed SSL/TLS certificate to the ALB. Manually rotate the certificate each year.
  • Use AWS Certificate Manager (ACM) to issue an SSL/TLS certificate. Apply the certificate to the ALB. Use the managed renewal feature to automatically rotate the certificate. (correct)

What is the incorrect way to ensure encryption at the edge with a certificate issued by an external CA and annual rotation?

  • Use AWS Certificate Manager (ACM) Public Certificate Authority to issue an SSL/TLS certificate from the root CA. Apply the certificate to the ALB. (correct)
  • Use AWS Certificate Manager (ACM) to issue an SSL/TLS certificate. Apply the certificate to the ALB. Use the managed renewal feature to automatically rotate the certificate.
  • Apply a self-signed SSL/TLS certificate to the backend servers behind ALB. Manually rotate the certificate each year.
  • Use AWS Certificate Manager (ACM) to issue an SSL/TLS certificate. Import the key material from the certificate. Apply the certificate to the ALB. Use the managed renewal feature to automatically rotate the certificate.

Which action would NOT meet the requirement of rotating the SSL/TLS certificate annually?

  • Use AWS Certificate Manager (ACM) to issue an SSL/TLS certificate. Apply the certificate to the ALB. Use the managed renewal feature to automatically rotate the certificate.
  • Use AWS Certificate Manager (ACM) Private Certificate Authority to issue an SSL/TLS certificate from the root CA. Apply the certificate to the ALB.
  • Import a third-party SSL/TLS certificate directly into ALB without involving ACM. (correct)
  • Use AWS CloudFront to manage SSL/TLS certificates for ALB and enable automatic rotation.

Which approach does NOT align with best practices for managing SSL/TLS certificates in AWS?

<p>Using Let's Encrypt to obtain SSL/TLS certificates and manually applying them to ALB. (B)</p> Signup and view all the answers

What would be a suboptimal approach for managing SSL/TLS certificates for an ALB in AWS?

<p>Manually renewing self-signed SSL/TLS certificates on ALB every year. (C)</p> Signup and view all the answers

Which option would NOT be suitable for ensuring encryption with a valid SSL/TLS certificate on an ALB in AWS?

<p>Obtaining a third-party SSL/TLS certificate and importing it directly into ALB without involving ACM. (A)</p> Signup and view all the answers

What is the most cost-effective way for the company to avoid Regional data transfer charges?

<p>Deploy a gateway VPC endpoint for Amazon S3 (D)</p> Signup and view all the answers

How can the company automatically rotate the SSL/TLS certificate for the ALB?

<p>Use managed renewal feature to automatically rotate the certificate (A)</p> Signup and view all the answers

What is the correct combination of steps for the solutions architect to connect from the on-premises network to the bastion host and the application servers?

<p>Replace the current security group of the bastion host with one that only allows inbound access from the internal IP range for the company (B)</p> Signup and view all the answers

What should be done to allow access from on-premises network through the company's internet connection to the bastion host and application servers?

<p>Replace the current security group of the bastion host with one that only allows inbound access from the external IP range for the company (B)</p> Signup and view all the answers

What action should be taken to connect from on-premises network through the company's internet connection to the bastion host and application servers?

<p>Implement VPN connection between on-premises network and AWS VPC (A)</p> Signup and view all the answers

Which method should be used to notify when the SSL/TLS certificate is nearing expiration?

<p>Configure Amazon EventBridge rule to send a notification when certificate is nearing expiration (C)</p> Signup and view all the answers

What would be a suitable solution for connecting securely to Linux-based application instances on Amazon EC2 in a private subnet?

<p>Use public key authentication for SSH access to EC2 instances (D)</p> Signup and view all the answers

How can data transfer charges be minimized when EC2 instances download and upload images to Amazon S3?

<p><strong>Utilize gateway VPC endpoints</strong> for Amazon S3 instead of relying on NAT gateway (B)</p> Signup and view all the answers

What's a secure way for systems administrators to connect from on-premises network through company's internet connection to bastion host and application servers?

<p><strong>Utilize VPN tunnels</strong> between on-premises network and AWS VPC for secure connections (B)</p> Signup and view all the answers

More Like This

Use Quizgecko on...
Browser
Open
Browser
Browser