共 10 题 · 来源：AWS 官方 Sample Questions（SAA-C03）· 官方答案与解析 · 点选项后按「确认作答」即刻判对错
A company runs a public-facing three-tier web application in a VPC across multiple Availability Zones. Amazon EC2 instances for the application tier running in private subnets need to download software patches from the internet. However, the EC2 instances cannot be directly accessible from the internet. Which actions should be taken to allow the EC2 instances to download the needed patches? (Select TWO.)
一家公司在跨多个可用区的 VPC 中运行面向公众的三层 Web 应用程序。在私有子网中运行的应用层的 Amazon EC2 实例需要从互联网下载软件补丁。但是，无法从 Internet 直接访问 EC2 实例。应采取哪些操作来允许 EC2 实例下载所需的补丁？ （选择两项。）
Configure a NAT gateway in a public subnet.
在公有子网中配置 NAT 网关。
Define a custom route table with a route to the NAT gateway for internet traffic and associate it with the private subnets for the application tier.
定义一个自定义路由表，其中包含到 Internet 流量的 NAT 网关的路由，并将其与应用程序层的私有子网关联。
Assign Elastic IP addresses to the EC2 instances.
为 EC2 实例分配弹性 IP 地址。
Define a custom route table with a route to the internet gateway for internet traffic and associate it with the private subnets for the application tier.
定义一个自定义路由表，其中包含到 Internet 流量的 Internet 网关的路由，并将其与应用程序层的私有子网关联。
Configure a NAT instance in a private subnet.
在私有子网中配置 NAT 实例。
正确答案 A, B
A NAT gateway forwards traffic from the EC2 instances in the private subnet to the internet or other AWS services, and then sends the response back to the instances. After a NAT gateway is created, the route tables for private subnets must be updated to point internet traffic to the NAT gateway.
NAT 网关将流量从私有子网中的 EC2 实例转发到互联网或其他 AWS 服务，然后将响应发送回实例。创建 NAT 网关后，必须更新私有子网的路由表，以将 Internet 流量指向 NAT 网关。
A solutions architect wants to design a solution to save costs for Amazon EC2 instances that do not need to run during a 2-week company shutdown. The applications running on the EC2 instances store data in instance memory that must be present when the instances resume operation. Which approach should the solutions architect recommend to shut down and resume the EC2 instances?
解决方案架构师想要设计一个解决方案，以节省在公司停工 2 周期间不需要运行的 Amazon EC2 实例的成本。 EC2 实例上运行的应用程序将数据存储在实例内存中，当实例恢复运行时这些数据必须存在。解决方案架构师应建议采用哪种方法来关闭和恢复 EC2 实例？
Modify the application to store the data on instance store volumes. Reattach the volumes while restarting them.
修改应用程序以将数据存储在实例存储卷上。重新启动卷时重新附加它们。
Snapshot the EC2 instances before stopping them. Restore the snapshot after restarting the instances.
在停止 EC2 实例之前对其进行快照。重启实例后恢复快照。
Run the applications on EC2 instances enabled for hibernation. Hibernate the instances before the 2- week company shutdown.
在启用休眠功能的 EC2 实例上运行应用程序。在公司关闭两周之前使实例休眠。
Note the Availability Zone for each EC2 instance before stopping it. Restart the instances in the same Availability Zones after the 2-week company shutdown.
在停止之前记下每个 EC2 实例的可用区。公司关闭两周后，重新启动同一可用区中的实例。
正确答案 C
Hibernating EC2 instances save the contents of instance memory to an Amazon Elastic Block Store (Amazon EBS) root volume. When the instances restart, the instance memory contents are reloaded.
休眠 EC2 实例将实例内存的内容保存到 Amazon Elastic Block Store (Amazon EBS) 根卷。当实例重新启动时，实例内存内容将重新加载。
A company plans to run a monitoring application on an Amazon EC2 instance in a VPC. Connections are made to the EC2 instance using the instance’s private IPv4 address. A solutions architect needs to design a solution that will allow traffic to be quickly directed to a standby EC2 instance if the application fails and becomes unreachable. Which approach will meet these requirements?
某公司计划在 VPC 中的 Amazon EC2 实例上运行监控应用程序。使用实例的私有 IPv4 地址与 EC2 实例建立连接。解决方案架构师需要设计一种解决方案，以便在应用程序发生故障且无法访问时能够将流量快速定向到备用 EC2 实例。哪种方法可以满足这些要求？
Deploy an Application Load Balancer configured with a listener for the private IP address and register the primary EC2 instance with the load balancer. Upon failure, de-register the instance and register the standby EC2 instance.
部署配置了私有 IP 地址侦听器的 Application Load Balancer，并向负载均衡器注册主 EC2 实例。失败时，取消注册实例并注册备用 EC2 实例。
Configure a custom DHCP option set. Configure DHCP to assign the same private IP address to the standby EC2 instance when the primary EC2 instance fails.
配置自定义 DHCP 选项集。配置 DHCP，以便在主 EC2 实例出现故障时为备用 EC2 实例分配相同的私有 IP 地址。
Attach a secondary elastic network interface to the EC2 instance configured with the private IP address. Move the network interface to the standby EC2 instance if the primary EC2 instance becomes unreachable.
将辅助弹性网络接口连接到配置有私有 IP 地址的 EC2 实例。如果主 EC2 实例变得无法访问，请将网络接口移至备用 EC2 实例。
Associate an Elastic IP address with the network interface of the primary EC2 instance. Disassociate the Elastic IP from the primary instance upon failure and associate it with a standby EC2 instance. AWS Certified Solutions Architect - Associate (SAA-C03) Sample Exam Questions © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved | aws.amazon.com 2 | P a g e
将弹性 IP 地址与主 EC2 实例的网络接口关联。发生故障时，将弹性 IP 与主实例解除关联，并将其与备用 EC2 实例关联。 AWS 认证解决方案架构师 - 助理 (SAA-C03) 考试题示例 © 2022，Amazon Web Services, Inc. 或其附属公司。版权所有| aws.amazon.com 2 |页
正确答案 C
A secondary elastic network interface can be added to an EC2 instance. While primary network interfaces cannot be detached from an instance, secondary network interfaces can be detached and attached to a different EC2 instance.
An analytics company is planning to offer a web analytics service to its users. The service will require that the users’ webpages include a JavaScript script that makes authenticated GET requests to the company’s Amazon S3 bucket. What must a solutions architect do to ensure that the script will successfully execute?
一家分析公司正计划为其用户提供网络分析服务。该服务将要求用户的网页包含一个 JavaScript 脚本，该脚本向公司的 Amazon S3 存储桶发出经过身份验证的 GET 请求。解决方案架构师必须做什么才能确保脚本成功执行？
Enable cross-origin resource sharing (CORS) on the S3 bucket.
在 S3 存储桶上启用跨源资源共享 (CORS)。
Enable S3 Versioning on the S3 bucket.
在 S3 存储桶上启用 S3 版本控制。
Provide the users with a signed URL for the script.
向用户提供脚本的签名 URL。
Configure an S3 bucket policy to allow public execute privileges.
配置 S3 存储桶策略以允许公共执行权限。
正确答案 A
Web browsers will block running a script that originates from a server with a domain name that is different from the webpage. Amazon S3 can be configured with CORS to send HTTP headers that allow the script to run.
Web 浏览器将阻止运行源自域名与网页不同的服务器的脚本。 Amazon S3 可以配置 CORS 以发送允许脚本运行的 HTTP 标头。
A company’s security team requires that all data stored in the cloud be encrypted at rest at all times using encryption keys stored on premises. Which encryption options meet these requirements? (Select TWO.)
公司的安全团队要求使用本地存储的加密密钥始终对存储在云中的所有数据进行静态加密。哪些加密选项满足这些要求？ （选择两项。）
Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3).
使用带有 Amazon S3 托管加密密钥 (SSE-S3) 的服务器端加密。
Use server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
使用带有 AWS KMS 托管加密密钥 (SSE-KMS) 的服务器端加密。
Use server-side encryption with customer-provided encryption keys (SSE-C).
使用带有客户提供的加密密钥的服务器端加密 (SSE-C)。
Use client-side encryption to provide at-rest encryption.
使用客户端加密来提供静态加密。
Use an AWS Lambda function invoked by Amazon S3 events to encrypt the data using the customer’s keys.
使用 Amazon S3 事件调用的 AWS Lambda 函数来使用客户密钥加密数据。
正确答案 C, D
Server-side encryption with customer-provided keys (SSE-C) enables Amazon S3 to encrypt objects on the server side using an encryption key provided in the PUT request. The same key must be provided in the GET requests for Amazon S3 to decrypt the object. Customers also have the option to encrypt data on the client side before uploading it to Amazon S3, and then they can decrypt the data after downloading it. AWS software development kits (SDKs) provide an S3 encryption client that streamlines the process.
使用客户提供的密钥进行服务器端加密 (SSE-C) 使 Amazon S3 能够使用 PUT 请求中提供的加密密钥来加密服务器端的对象。必须在 Amazon S3 的 GET 请求中提供相同的密钥才能解密对象。客户还可以选择在将数据上传到 Amazon S3 之前在客户端加密数据，然后在下载数据后解密数据。 AWS 软件开发工具包 (SDK) 提供了可简化流程的 S3 加密客户端。
A company uses Amazon EC2 Reserved Instances to run its data processing workload. The nightly job typically takes 7 hours to run and must finish within a 10-hour time window. The company anticipates temporary increases in demand at the end of each month that will cause the job to run over the time limit with the capacity of the current resources. Once started, the processing job cannot be interrupted before completion. The company wants to implement a solution that would provide increased resource capacity as cost-effectively as possible. What should a solutions architect do to accomplish this?
一家公司使用 Amazon EC2 预留实例来运行其数据处理工作负载。每晚作业通常需要 7 小时才能运行，并且必须在 10 小时的时间窗口内完成。该公司预计每个月底需求会暂时增加，这将导致该工作超出当前资源容量的时间限制。一旦开始，处理作业在完成之前就不能中断。该公司希望实施一种解决方案，以尽可能经济高效的方式提供更高的资源容量。解决方案架构师应该做什么来实现这一目标？
Deploy On-Demand Instances during periods of high demand.
在高需求期间部署按需实例。
Create a second EC2 reservation for additional instances.
为其他实例创建第二个 EC2 预留。
Deploy Spot Instances during periods of high demand.
在高需求期间部署 Spot 实例。
Increase the EC2 instance size in the EC2 reservation to support the increased workload. AWS Certified Solutions Architect - Associate (SAA-C03) Sample Exam Questions © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved | aws.amazon.com 3 | P a g e
增加 EC2 预留中的 EC2 实例大小以支持增加的工作负载。 AWS 认证解决方案架构师 - 助理 (SAA-C03) 考试题示例 © 2022，Amazon Web Services, Inc. 或其附属公司。版权所有| aws.amazon.com 3 |页
正确答案 A
While Spot Instances would be the least costly option, they are not suitable for jobs that cannot be interrupted or must complete within a certain time period. On-Demand Instances would be billed for the number of seconds they are running.
虽然 Spot 实例是成本最低的选项，但它们不适合无法中断或必须在特定时间段内完成的作业。按需实例将根据其运行的秒数进行计费。
A company runs an online voting system for a weekly live television program. During broadcasts, users submit hundreds of thousands of votes within minutes to a front-end fleet of Amazon EC2 instances that run in an Auto Scaling group. The EC2 instances write the votes to an Amazon RDS database. However, the database is unable to keep up with the requests that come from the EC2 instances. A solutions architect must design a solution that processes the votes in the most efficient manner and without downtime. Which solution meets these requirements?
一家公司为每周的直播电视节目运行在线投票系统。在广播期间，用户在几分钟内向 Auto Scaling 组中运行的 Amazon EC2 实例前端队列提交数十万张选票。 EC2 实例将投票写入 Amazon RDS 数据库。但是，数据库无法跟上来自 EC2 实例的请求。解决方案架构师必须设计一个能够以最有效的方式处理投票且无需停机的解决方案。哪种解决方案满足这些要求？
Migrate the front-end application to AWS Lambda. Use Amazon API Gateway to route user requests to the Lambda functions.
将前端应用程序迁移到 AWS Lambda。使用 Amazon API Gateway 将用户请求路由到 Lambda 函数。
Scale the database horizontally by converting it to a Multi-AZ deployment. Configure the front-end application to write to both the primary and secondary DB instances.
通过将数据库转换为多可用区部署来水平扩展数据库。配置前端应用程序以写入主数据库实例和辅助数据库实例。
Configure the front-end application to send votes to an Amazon Simple Queue Service (Amazon SQS) queue. Provision worker instances to read the SQS queue and write the vote information to the database.
配置前端应用程序以将投票发送到 Amazon Simple Queue Service (Amazon SQS) 队列。配置工作实例以读取 SQS 队列并将投票信息写入数据库。
Use Amazon EventBridge (Amazon CloudWatch Events) to create a scheduled event to re-provision the database with larger, memory optimized instances during voting periods. When voting ends, re-provision the database to use smaller instances.
使用 Amazon EventBridge（Amazon CloudWatch 事件）创建计划事件，以便在投票期间为数据库重新配置更大的内存优化实例。投票结束后，重新配置数据库以使用较小的实例。
正确答案 C
Decouple the ingestion of votes from the database to allow the voting system to continue processing votes without waiting for the database writes. Add dedicated workers to read from the SQS queue to allow votes to be entered into the database at a controllable rate. The votes will be added to the database as fast as the database can process them, but no votes will be lost.
将投票的摄取与数据库解耦，以允许投票系统继续处理投票，而无需等待数据库写入。添加专门的工作人员从 SQS 队列中读取数据，以允许以可控的速率将选票输入数据库。选票将按照数据库处理它们的速度添加到数据库中，但不会丢失任何选票。
A company has a two-tier application architecture that runs in public and private subnets. Amazon EC2 instances running the web application are in the public subnet and an EC2 instance for the database runs on the private subnet. The web application instances and the database are running in a single Availability Zone (AZ). Which combination of steps should a solutions architect take to provide high availability for this architecture? (Select TWO.)
一家公司拥有在公共子网和私有子网中运行的两层应用程序体系结构。运行 Web 应用程序的 Amazon EC2 实例位于公有子网中，数据库的 EC2 实例在私有子网中运行。 Web 应用程序实例和数据库在单个可用区 (AZ) 中运行。解决方案架构师应采取哪些步骤组合来为此架构提供高可用性？ （选择两项。）
Create new public and private subnets in the same AZ.
在同一可用区中创建新的公有子网和私有子网。
Create an Amazon EC2 Auto Scaling group and Application Load Balancer spanning multiple AZs for the web application instances.
为 Web 应用程序实例创建跨多个可用区的 Amazon EC2 Auto Scaling 组和 Application Load Balancer。
Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer.
将现有 Web 应用程序实例添加到 Application Load Balancer 后面的 Auto Scaling 组。
Create new public and private subnets in a new AZ. Create a database using an EC2 instance in the public subnet in the new AZ. Migrate the old database contents to the new database.
在新的可用区中创建新的公有子网和私有子网。使用新可用区的公有子网中的 EC2 实例创建数据库。将旧数据库内容迁移到新数据库。
Create new public and private subnets in the same VPC, each in a new AZ. Create an Amazon RDS Multi-AZ DB instance in the private subnets. Migrate the old database contents to the new DB instance. AWS Certified Solutions Architect - Associate (SAA-C03) Sample Exam Questions © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved | aws.amazon.com 4 | P a g e
在同一 VPC 中创建新的公有子网和私有子网，每个子网位于一个新的可用区中。在私有子网中创建 Amazon RDS 多可用区数据库实例。将旧数据库内容迁移到新数据库实例。 AWS 认证解决方案架构师 - 助理 (SAA-C03) 考试题示例 © 2022，Amazon Web Services, Inc. 或其附属公司。版权所有| aws.amazon.com 4 |页
正确答案 B, E
Create new subnets in a new Availability Zone (AZ) to provide a redundant network. Create an Auto Scaling group with instances in two AZs behind the load balancer to ensure high availability of the web application and redistribution of web traffic between the two public AZs. Create an RDS DB instance in the two private subnets to make the database tier highly available too.
在新的可用区 (AZ) 中创建新子网以提供冗余网络。创建一个 Auto Scaling 组，其中实例位于负载均衡器后面的两个可用区中，以确保 Web 应用程序的高可用性以及两个公共可用区之间 Web 流量的重新分配。在两个私有子网中创建一个 RDS 数据库实例，以使数据库层也具有高可用性。
A website runs a custom web application that receives a burst of traffic each day at noon. The users upload new pictures and content daily, but have been complaining of timeouts. The architecture uses Amazon EC2 Auto Scaling groups, and the application consistently takes 1 minute to initiate upon boot up before responding to user requests. How should a solutions architect redesign the architecture to better respond to changing traffic?
某个网站运行一个自定义 Web 应用程序，该应用程序每天中午都会收到大量流量。用户每天都会上传新的图片和内容，但一直抱怨超时。该架构使用 Amazon EC2 Auto Scaling 组，并且应用程序在启动时始终需要 1 分钟才能响应用户请求。解决方案架构师应该如何重新设计架构以更好地响应不断变化的流量？
Configure a Network Load Balancer with a slow start configuration.
使用慢启动配置配置 Network Load Balancer。
Configure Amazon ElastiCache for Redis to offload direct requests from the EC2 instances.
为 Redis 配置 Amazon ElastiCache 以卸载来自 EC2 实例的直接请求。
Configure an Auto Scaling step scaling policy with an EC2 instance warmup condition.
配置具有 EC2 实例预热条件的 Auto Scaling 步骤扩展策略。
Configure Amazon CloudFront to use an Application Load Balancer as the origin.
配置 Amazon CloudFront 以使用 Application Load Balancer 作为源。
正确答案 C
The current configuration puts new EC2 instances into service before they are able to respond to transactions. This could also cause the instances to overscale. With a step scaling policy, you can specify the number of seconds that it takes for a newly launched instance to warm up. Until its specified warm-up time has expired, an EC2 instance is not counted toward the aggregated metrics of the Auto Scaling group. While scaling out, the Auto Scaling logic does not consider EC2 instances that are warming up as part of the current capacity of the Auto Scaling group. Therefore, multiple alarm breaches that fall in the range of the same step adjustment result in a single scaling activity. This ensures that you do not add more instances than you need.
当前配置将新的 EC2 实例投入使用，然后才能响应事务。这也可能导致实例规模过大。通过逐步扩展策略，您可以指定新启动的实例预热所需的秒数。在指定的预热时间到期之前，EC2 实例不会计入 Auto Scaling 组的聚合指标中。横向扩展时，Auto Scaling 逻辑不会将正在预热的 EC2 实例视为 Auto Scaling 组当前容量的一部分。因此，同一步长调整范围内的多个警报违规会导致一次伸缩活动。这可确保您添加的实例不会超出您的需要。
An application running on AWS uses an Amazon Aurora Multi-AZ DB cluster deployment for its database. When evaluating performance metrics, a solutions architect discovered that the database reads are causing high I/O and adding latency to the write requests against the database. What should the solutions architect do to separate the read requests from the write requests?
在 AWS 上运行的应用程序为其数据库使用 Amazon Aurora 多可用区数据库集群部署。在评估性能指标时，解决方案架构师发现数据库读取导致高 I/O 并增加针对数据库的写入请求的延迟。解决方案架构师应该如何将读取请求与写入请求分开？
Enable read-through caching on the Aurora database.
在 Aurora 数据库上启用读取缓存。
Update the application to read from the Multi-AZ standby instance.
更新应用程序以从多可用区备用实例读取。
Create an Aurora replica and modify the application to use the appropriate endpoints.
创建 Aurora 副本并修改应用程序以使用适当的终端节点。
Create a second Aurora database and link it to the primary database as a read replica. AWS Certified Solutions Architect - Associate (SAA-C03) Sample Exam Questions © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved | aws.amazon.com 5 | P a g e
创建第二个 Aurora 数据库并将其作为只读副本链接到主数据库。 AWS 认证解决方案架构师 - 助理 (SAA-C03) 考试题示例 © 2022，Amazon Web Services, Inc. 或其附属公司。版权所有| 5 | aws.amazon.com 页
正确答案 C
Aurora Replicas provide a way to offload read traffic. Aurora Replicas share the same underlying storage as the main database, so lag time is generally very low. Aurora Replicas have their own endpoints, so the application will need to be configured to direct read traffic to the new endpoints.
Aurora 副本提供了一种卸载读取流量的方法。 Aurora 副本与主数据库共享相同的底层存储，因此延迟时间通常非常短。 Aurora 副本有自己的端点，因此需要配置应用程序以将读取流量定向到新端点。
| 已作答 | 0 |
| 答对 | 0 |
| 答错 | 0 |
| 未作答 | 0 |
| 用时 | — |