SAA 考试每日练习 - 2024/11/24

来源：Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam
7 题 (No.51 ~ No.57)，仅供自己复习使用。
如果侵权请联系删除。

🌟 单词：

1. retrieval_{n. 取回，索回，数据检索}
2. statistics_{n. 统计数据}
3. extract_{v. （费力）取出，拔出；提取，提炼；榨取；摘录；设法得到；开方，求根 | n. 提取物；萃取物；精，汁；摘录；选段；引文}
4. low-confidence_低信心
5. prediction_{n. 预言；预测；预报，预告}

一、Send formatted data by email

A company is developing an application that provides order shipping statistics_统计数据 for retrieval by a REST API. The company wants to extract_提炼 the shipping statistics, organize the data into an easy-to-read HTML format, and send the report to several email addresses at the same time every morning.
Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)

1. Configure the application to send the data to Amazon Kinesis Data Firehose.
2. ✅ Use Amazon Simple Email Service (Amazon SES) to format the data and to send the report by email.
3. Create an Amazon EventBridge (Amazon CloudWatch Events) scheduled event that invokes an AWS Glue job to query the application’s API for the data.
4. ✅ Create an Amazon EventBridge (Amazon CloudWatch Events) scheduled event that invokes an AWS Lambda function to query the application’s API for the data.
5. Store the application data in Amazon S3. Create an Amazon Simple Notification Service (Amazon SNS) topicas an S3 event destination to send the report by email.

✨ 关键词：the same time every morning、organize the data into HTML format、send email

2️⃣ 4️⃣ ✅

💡 解析：应用程序能通过 REST API 获取船运统计数据，公司希望提炼数据并将其组织成 HTML 格式，然后每天早上发送给多个邮箱。
答案中能够实现定时任务的只有 Amazon CloudWatch Events，然后调用 Lambda 结构化数据，之后通过 SES 发出。

什么是亚马逊 EventBridge？

EventBridge 是一项无服务器服务，它使用事件将应用程序组件连接在一起，使您可以更轻松地构建可扩展的事件驱动应用程序。
事件驱动型架构 (event-driven applications) 是一种构建松耦合软件系统的风格，这些系统通过发出和响应事件来协同工作。事件驱动型架构可以帮助您提高敏捷性，并构建可靠、可扩展的应用程序。

创建在 Amazon 中按计划运行的规则 EventBridge

规则可以响应事件运行，也可以按特定的时间间隔运行。例如，要定期运行 AWS Lambda 函数，可以创建按计划运行的规则

👨‍👨‍👦‍👦 社区讨论：B&D are the only 2 correct options. If you are choosing option E then you missed the daily morning schedule requirement mentioned in the question which cant be achieved with S3 events forSNS.Event Bridge can used to configure scheduled events (every morning in this case). Option B fulfills the email in HTML format requirement (bySES) and D fulfillsevery morning schedule event requirement (by EventBridge)

EventBridge can be used to schedule regular invocations of a Lambda function that retrieves the required data from the application’s API.This step sets up the process to collect the data at the specified time every morning.

二、Standard file system structure

A company wants to migrate its on-premises application to AWS. The application produces output files that vary in size from tens of gigabytes to hundreds of terabytes. The application data must be stored in a standard file system structure. The company wants a solution that scales automatically. is highly available, and requires minimum operational overhead.
Which solution will meet these requirements?

1. Migrate the application to run as containers on Amazon Elastic Container Service (Amazon ECS). Use Amazon S3 for storage.
2. Migrate the application to run as containers on Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon Elastic Block Store (Amazon EBS) for storage.
3. ✅ Migrate the application to Amazon EC2 instances in a Multi-AZ Auto Scaling group. Use Amazon ElasticFile System (Amazon EFS) for storage.
4. Migrate the application to Amazon EC2 instances in a Multi-AZ Auto Scaling group. Use Amazon Elastic Block Store (Amazon EBS) for storage.

✨ 关键词：10 GB 到 100 TB 的文件、standard file system structure、scales automatically、ha、minimum operational overhead

3️⃣ ✅

💡 解析：私有云迁移到 AWS，应用程序会产生 10 GB 到 100 TB 的文件，需要部署在独立文件系统架构上，并且易于扩展、高可用、操作低延迟。
S3 的最大文件大小限制为 5 TB，因此需要选择 EFS。

不过社区讨论中指出了 EFS 最大也仅支持 47.9 TB 的文件，可能题目的重点在 a standard file system structure，S3 是对象存储，EBS 是块存储，都不是文件存储系统。

👨‍👨‍👦‍👦 社区讨论：

• S3, 5TiB is per object but you can have more than one object in a bucket, meaning infinity
  https://aws.amazon.com/fr/blogs/aws/amazon-s3-object-size-limit/
• EBS 64 Tib is per block of storage
  https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/volume_constraints.html
• EFS 47.9 TiB per file and in the questions its says Files the ‘s’
  https://docs.aws.amazon.com/efs/latest/ug/limits.html

三、S3 Object Lock

A company needs to store its accounting records in Amazon S3. The records must be immediately accessible for 1 year and then must be archived for an additional 9 years. No one at the company, including administrative users and root users, can be able to delete the records during the entire 10-year period. The records must be stored with maximum resiliency_{弹性（恢复能力）}.
Which solution will meet these requirements?

1. Store the records in S3 Glacier for the entire 10-year period. Use an access control policy to deny deletion of the records for a period of 10 years.
2. Store the records by using S3 Intelligent-Tiering. Use an IAM policy to deny deletion of the records. After 10 years, change the IAM policy to allow deletion.
3. ✅ Use an S3 Lifecycle policy to transition the records from S3 Standard to S3 Glacier Deep Archive after 1 year. Use S3 Object Lock in compliance mode for a period of 10 years.
4. Use an S3 Lifecycle policy to transition the records from S3 Standard to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 1 year. Use S3 Object Lock in governance mode for a period of 10 years.

✨ 关键词：be immediately accessible for 1 year、archived for an additional 9 years、no one can delete

3️⃣ ✅

💡 解析：账号记录存储在 S3 中，第 1 年需要立即可用，之后再归档 9 年，不允许删除。
需要使用 S3 生命周期策略来完成标准和归档间的迁移，并使用锁来禁止删除。

使用对象锁定以锁定对象

​S3 对象锁定可以协助在固定的时间长度内或无限期地阻止删除或覆盖 Amazon S3 对象。对象锁定使用一次写入多次读取（WORM）模式存储对象。您可以使用对象锁定来协助满足需要 WORM 存储的法规要求，或用于添加额外的保护层来防止对象被更改和删除。

👨‍👨‍👦‍👦 社区讨论：Only CD provides Object Lock options which is required for stopping admin/root users from deleting.
D is governance mode which is like government, payenough moneyand you can do anything.This is not what we want so compliance is the option.
C is right choice.

For future, remember

• S3 Lock Governance = corrupt government official（腐败的政府官员）

  在管理模式下，除非用户拥有特殊权限，否则无法覆盖或删除对象版本或更改其锁定设置。使用管理模式，可以防止大多数用户删除对象，但仍可授予某些用户更改保留设置或在必要时删除对象的权限。在创建合规模式保留期之前，还可以使用管理模式测试保留期设置。

• S3 Lock Compliance = honest solution architect!（诚实的解决方案架构师！）

  在合规模式下，受保护对象版本不能被任何用户覆盖或删除，包括 AWS 账户中的根用户。在合规模式下锁定对象时，不能更改保留模式，也不能缩短保留期。合规模式有助于确保对象版本在保留期内无法被覆盖或删除。 S3 Object Lock 已通过 Cohasset Associates 的评估，符合 SEC 规则 17a-4(f)、FINRA 规则 4511 和 CFTC 条例 1.31。

四、Windows File Server

A company runs multiple Windows workloads on AWS. The company’s employees use Windows file shares that are hosted on two Amazon EC2 instances. The file shares synchronize data between themselves and maintain duplicate copies. The company wants a highly available and durable storage solution that preserves how users currently access the files.
What should a solutions architect do to meet these requirements?

1. Migrate all the data to Amazon S3. Set up IAM authentication for users to access files.
2. Set up an Amazon S3 File Gateway. Mount the S3 File Gateway on the existing EC2 instances.
3. ✅ Extend the file share environment to Amazon FSx for Windows File Server with a Multi-AZ configuration. Migrate all the data to FSx for Windows File Server.
4. Extend the file share environment to Amazon ElasticFile System (Amazon EFS) with a Multi-AZ configuration. Migrate all the data to Amazon EFS.

✨ 关键词：Windows workloads、HA、durable

3️⃣ ✅

💡 解析：有工作负载运行在两台 Windows 实例上，之前使用 Windows 文件共享来同步文件并保留两份备份，希望迁移到高可用持久的存储上。
因为使用了 Windows 因此 EFS 不适用，需要选择 Amazon FSx for Windows File Server。

👨‍👨‍👦‍👦 社区讨论：EFS is not supported on Windows instances
https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/AmazonEFS.html
Amazon FSx for Windows File Server provides fully managed Microsoft Windows file servers, backed bya fully native Windows file system.
https://docs.aws.amazon.com/fsx/latest/WindowsGuide/what-is.html

五、Security Group

A solutions architect is developing a VPC architecture that includes multiple subnets. The architecture will host applications that use Amazon EC2 instances and Amazon RDS DB instances. The architecture consists of six subnets in two Availability Zones. Each Availability Zone includes a public subnet, a private subnet, and a dedicated subnet for databases. Only EC2 instances that run in the private subnets can have access to the RDS databases.
Which solution will meet these requirements?

1. Create a new route table that excludes the route to the public subnets’ CIDR blocks. Associate the route table with the database subnets.
2. Create a security group that denies inbound traffic from the security group that is assigned to instances in the public subnets. Attach the security group to the DB instances.
3. ✅ Create a security group that allows inbound traffic from the security group that is assigned to instances in the private subnets. Attach the security group to the DB instances.
4. Create a new peering connection between the public subnets and the private subnets. Create a different peering connection between the private subnets and the database subnets.

✨ 关键词：six subnets in two Availability Zones、Each Availability Zone includes a public subnet and a private subnet and a dedicated subnet for databases

3️⃣ ✅

💡 解析：EC2 和 RDS 分布于总计 2 个可用区 6 个子网，每个可用区有 1 个公有子网、1 个私有子网和 1 个运行数据库的专有子网，只有在私有子网中的 EC2 实例才能访问数据库。问怎样解决这个需求。

首先明确 VPC 是区域级别的，可以跨可用区，而 子网 则无法跨可用区。
1️⃣ 创建一个包含前往公有子网 CIDR 块记录的路由表，将这个路由表附加在数据库子网。
2️⃣ 创建一个安全组，阻止来自公有子网实例的入站流量，将这个安全组附加在 DB 实例上。
3️⃣ 创建一个安全组，允许来自私有子网实例的入站流量，将这个安全组附加在 DB 实例上。
4️⃣ 创建一个连接公有子网和私有子网的对等连接，再创建一个对等连接连接私有子网和数据库子网。

1️⃣ 没有意义，数据库子网不需要访问公有子网实例；2️⃣ 错在安全组没有拒绝规则；3️⃣ 更贴合题意，允许来自私有子网实例的连接；4️⃣ 对等连接是 VPC 级别的。

👨‍👨‍👦‍👦 社区讨论：A: doesn’t fully configure the traffic flow
B: security groups don’t have deny rules
D: peering is mostly between VPCs, doesn’t really help here

六、API Gateway with doamin and SSL

A company has registered its domain name with Amazon Route 53. The company uses Amazon API Gateway in the ca-central-1 Region as a public interface for its backend microservice APIs. Third-party services consume the APIs securely. The company wants to design its API Gateway URL with the company’s domain name and corresponding certificate so that the third-party services can use HTTPS.
Which solution will meet these requirements?

1. Create stage variables in API Gateway with Name=“Endpoint-URL” and Value=“Company Domain Name” to overwrite the default URL. Import the public certificate associated with the company’s domain name into AWS Certificate Manager (ACM).
2. ❌ Create Route 53 DNS records with the company’s domain name. Point the alias record to the Regional API Gateway stage endpoint. Import the public certificate associated with the company’s domain name into AWS Certificate Manager (ACM) in the us-east-1 Region.
3. ✅ Create a Regional API Gateway endpoint. Associate the API Gateway endpoint with the company’s domain name. Import the public certificate associated with the company’s domain name into AWS Certificate Manager (ACM) in the same Region. Attach the certificate to the API Gateway endpoint. Configure Route 53 to route traffic to the API Gateway endpoint.
4. Create a Regional API Gateway endpoint. Associate the API Gateway endpoint with the company’s domain name. Import the public certificate associated with the company’s domain name into AWS Certificate Manager (ACM) in the us-east-1 Region. Attach the certificate to the API Gateway APIs. Create Route 53 DNS records with the company’s domain name. Point an A record to the company’s domain name.

✨ 关键词：domain on Amazon Route 53、design its API Gateway URL with the company’s domain name、corresponding certificate

2️⃣ ❌ -> 3️⃣ ✅

💡 解析：让 API Gateway 上的接口使用 Route 53 上的域名，并配置证书开启 HTTPS。
这里需要注意 ACM 中的证书是区域级的资源，因此需要首先将 API Gateway 限制在一个区域（或者就是每个区域都配置 SSL 证书）。

什么是 AWS Certificate Manager？

ACM 中的证书属于区域性资源。若要为多个AWS区域中相同的完全限定域名 (FQDN) 或 FQDN 组将证书用于 Elastic Load Balancing，您必须为每个区域请求或导入一个证书。对于 ACM 提供的证书，这意味着您必须重新验证每个区域的证书中的每个域名。您不能在各区域之间复制证书。

在 API Gateway 中设置区域自定义域名

使用区域自定义域名创建用户友好的 API 基本 URL。利用区域自定义域名，您可以将 HTTP 和 REST API 阶段映射到相同的自定义域名并使用双向 TLS 身份验证。

注意事项

• 您必须提供特定于区域的 ACM 证书。该证书必须与您的 API 位于同一区域。有关创建或上传自定义域名证书的更多信息，请参阅在 AWS Certificate Manager 中准备好证书。
• 在您创建（或迁移）包含 ACM 证书的区域自定义域名时，API Gateway 会在您的账户中创建一个服务相关角色。需要使用服务相关角色，才能将 ACM 证书附加到您的区域端点。该角色名为 AWSServiceRoleForAPIGateway，将对其附加 APIGatewayServiceRolePolicy 托管策略。有关使用服务相关角色的更多信息，请参阅使用服务相关角色。
• 创建区域自定义域名后，您必须创建将该自定义域名指向区域域名的“A”型 DNS 记录。这使绑定到自定义域名的流量可以路由到 API 的区域主机名。

👨‍👨‍👦‍👦 社区讨论：The correct solution to meet these requirements is option C.
To design the API Gateway URL with the company’s domain name and corresponding certificate, the company needs to do the following:

1. Create a Regional API Gatewayendpoint:This will allow the company to create an endpoint that is specific to a region.
2. Associate the API Gatewayendpoint with the company’s domain name:This will allow the company to use its own domain name for the API Gateway URL.
3. Import the public certificate associated with the company’s domain name into AWS Certificate Manager (ACM) in the same Region:This will allow the company to use HTTPS for secure communication with its APIs.
4. Attach the certificate to the API Gatewayendpoint:This will allow the company to use the certificate for securing the API Gateway URL.
5. Configure Route 53 to route traffic to the API Gatewayendpoint:This will allow the company to use Route 53 to route traffic to the API Gateway URL using the company’s domain name.

七、Amazon Rekognition & Ground Truth

A company is running a popular social media website. The website gives users the ability to upload images to share with other users. The company wants to make sure that the images do not contain inappropriate content. The company needs a solution that minimizes development effort.
What should a solutions architect do to meet these requirements?

1. Use Amazon Comprehend to detect inappropriate content. Use human review for low-confidence_低信心 predictions_预测.
2. ✅ Use Amazon Rekognition to detect inappropriate content. Use human review for low-confidence predictions.
3. Use Amazon SageMaker to detect inappropriate content. Use ground truth to label low-confidence predictions.
4. ❌ Use AWS Fargate to deploy a custom machine learning model to detect inappropriate content. Use ground truth to label low-confidence predictions.

✨ 关键词：do not contain inappropriate content、AI

4️⃣ ❌ -> 2️⃣ ✅

💡 解析：社交媒体应用需要确保用户上传的图片不包含隐私信息。
使用 AI 进行筛选，之后结合人工进行核实。
考点就是各 AWS AI 产品的特性和使用场景。

使用 Amazon G SageMaker round Truth 使用人类训练数据标签

要训练机器学习模型，您需要一个大型、高质量的标注数据集。Ground Truth 有助于您为机器学习模型构建高质量的训练数据集。借助 Ground Truth，您可以将来自 Amazon Mechanical Turk、您选择的供应商公司或内部私有人力资源的工作人员与机器学习相结合，以便创建已标注的数据集。您可以使用从 Ground Truth 输出的已标注数据集来训练自己的模型。您也可以将输出用作 Amazon SageMaker 模型的训练数据集。

Amazon Comprehend（理解）自然语言处理（NLP）服务

Amazon Comprehend使用自然语言处理 (NLP) 来提取有关文档内容的见解。它可以通过识别文档中的实体、关键短语、语言、情绪和其他常见元素生成见解。

Amazon Rekognition 图像识别

Amazon Rekognition 是一项基于云的图像和视频分析服务，可以轻松地向应用程序添加高级计算机视觉功能。

Amazon SageMaker 机器学习面向每位开发人员和数据科学家

Amazon SageMaker 是一项完全托管的服务，可以帮助开发人员和数据科学家快速构建、训练和部署机器学习 (ML) 模型。SageMaker 完全消除了机器学习过程中每个步骤的繁重工作，让开发高质量模型变得更加轻松。

AWS Fargate 适用于容器的无服务器计算

AWS Fargate 是一种无服务器、随用随付的计算引擎，可让您专注于构建应用程序，而无需管理服务器。

👨‍👨‍👦‍👦 社区讨论：The best solution to meet these requirements would be option B: Use Amazon Rekognition to detect inappropriate content, and use human review for low-confidence predictions.
Amazon Rekognition isa cloud-based image and video analysis service that can detect inappropriate content in images using its pre-trained label detection model. It can identifya wide range of inappropriate content, including explicit or suggestive adult content, violent content,and offensive language.The service provides high accuracyand low latency, making it a good choice for this use case.