ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Solutions Architect - Associate SAA-C03 All Questions

View all questions & answers for the AWS Certified Solutions Architect - Associate SAA-C03 exam
Go to Exam

Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 716 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Associate SAA-C03
Question #: 716
Topic #: 1
[All AWS Certified Solutions Architect - Associate SAA-C03 Questions]

A company runs a real-time data ingestion solution on AWS. The solution consists of the most recent version of Amazon Managed Streaming for Apache Kafka (Amazon MSK). The solution is deployed in a VPC in private subnets across three Availability Zones.

A solutions architect needs to redesign the data ingestion solution to be publicly available over the internet. The data in transit must also be encrypted.

Which solution will meet these requirements with the MOST operational efficiency?

  • A. Configure public subnets in the existing VPC. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication.
  • B. Create a new VPC that has public subnets. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication.
  • C. Deploy an Application Load Balancer (ALB) that uses private subnets. Configure an ALB security group inbound rule to allow inbound traffic from the VPC CIDR block for HTTPS protocol.
  • D. Deploy a Network Load Balancer (NLB) that uses private subnets. Configure an NLB listener for HTTPS communication over the internet.
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
by Andy_09 at Feb. 5, 2024, 6:12 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
haci
Highly Voted 1 year, 1 month ago
Selected Answer: A
Since we are talking about real-time data (UDP packets) ALB is not a viable solution. You don't need to listen HTTPS, so D is eliminated. If you create a new VPC, you must create link between the old one and this is not mentioned in B. So It is A for me.
upvoted 11 times
...
Dantecito
Most Recent 1 month, 1 week ago
Selected Answer: D
D. NLB forward traffic from the internet to private subnet where the cluster is. MSK use layer 4. A. B. use public subnets exposing the cluster C. Similar to D but MSK requires a Layer 4.
upvoted 1 times
...
FlyingHawk
1 month, 4 weeks ago
Selected Answer: A
For MSK to get public access, you must associate it with a public subnet, so rule out C and D, B is to create a new VPC, which is more complicated and more operations, so A is correct.
upvoted 1 times
FlyingHawk
1 month, 4 weeks ago
To turn on public access to an MSK Provisioned cluster, first ensure that the cluster meets all of the following conditions: The subnets that are associated with the cluster must be public. Each public subnet has a public IPv4 address associated with it and public IPv4 addresses are priced as shown in Amazon VPC pricing page. This means that the subnets must have an associated route table with an internet gateway attached. For information about how to create and attach an internet gateway, see Enable VPC internet access using internet gateways in the Amazon VPC User Guide.
upvoted 1 times
FlyingHawk
1 month, 4 weeks ago
Unauthenticated access control must be off and at least one of the following access-control methods must be on: SASL/IAM, SASL/SCRAM, mTLS. For information about how to update the access-control method of a cluster, see Update security settings of a Amazon MSK cluster.
upvoted 1 times
...
...
...
MatAlves
6 months, 2 weeks ago
Selected Answer: A
"You can turn on public access to an MSK cluster at no additional cost... To turn on public access to a cluster, first ensure that the cluster meets all of the following conditions: - The subnets that are associated with the cluster must be public. - Unauthenticated access control must be off and at least one of the following access-control methods must be on: SASL/IAM, SASL/SCRAM, mTLS. - ..." https://docs.aws.amazon.com/msk/latest/developerguide/public-access.html
upvoted 4 times
MatAlves
6 months, 2 weeks ago
There is no reference to a NEW VPC being required in the documentation. We can simply configure subnets in the existing VPC.
upvoted 2 times
...
...
Scheldon
9 months ago
Selected Answer: A
AnswerA I need to agree that answer will probably be Option A.
upvoted 1 times
...
Indrasis
1 year, 1 month ago
Selected Answer: A
A is correct
upvoted 2 times
...
Marunio
1 year, 1 month ago
Selected Answer: A
A, since Kafka is loadbalancing itself. - https://dattell.com/data-architecture-blog/load-balancing-with-kafka/#:~:text=Load%20balancing%20with%20Kafka%20is,partitions%20while%20preserving%20message%20ordering. B - why create new VPC? C / D - Kafka is loadbalacing itself, also NLB can't handle HTTPS.
upvoted 3 times
...
Andy_09
1 year, 1 month ago
Option A
upvoted 4 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago