AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 10
Question 90
A workload role has an IAM policy allowing kms:Decrypt, but requests to use a customer-managed KMS key still fail. The key is in the same account and security has not authorized the role through its key policy model. What should the team examine?
- Increase EBS volume throughput because KMS Decrypt depends on provisioned IOPS.
- Check that the KMS key policy enables the intended permissions or appropriate IAM delegation, and verify all applicable IAM/grant/condition constraints.
- Add an S3 object version to bypass KMS key authorization for decryption.
- Allow public internet DNS lookups to the key alias and treat that as cryptographic permission.
Explanation
Correct Answer
B:KMS authorization depends on the key's resource policy, applicable IAM policies and grants where used. An IAM Allow alone does not necessarily authorize key use without the required key-policy arrangements.
Incorrect Answers
A:Storage throughput is unrelated to whether a principal is authorized to call KMS Decrypt on a specific key.
C:An S3 object version changes object history, not the KMS key permission evaluation required to decrypt SSE-KMS ciphertext.
D:A key alias is a resource reference and DNS visibility is not an authorization grant or substitution for KMS policy.
Question 91
A SaaS application emits account-created and invoice-paid events. Different downstream services must react only to matching event types, and the producer should not know each consumer endpoint. Which integration pattern best fits?
- Send every event synchronously to a single hardcoded worker and let it call each consumer endpoint.
- Use an EventBridge event bus with rules matching event detail and route matching events to supported targets.
- Configure an EC2 Network ACL to inspect JSON payload fields and invoke microservices.
- Publish the events as CloudFront cache invalidations so subscribers can process durable business messages.
Explanation
Correct Answer
B:EventBridge matches events using structured patterns and routes them to selected integrations, reducing direct producer-to-consumer coupling. Target retry and dead-letter behavior should be configured as required.
Incorrect Answers
A:A synchronous central dispatcher couples the producer path to consumer failures and forces producers or central code to track all endpoints.
C:Network ACLs filter IP/protocol/port fields, not event JSON types or business payload attributes.
D:CloudFront invalidations manage cached content, not durable custom event routing between independent services.
Question 92
A serverless checkout API makes a burst of thousands of Lambda invocations. Each opens a new database connection, quickly exhausting the Aurora writer's connection capacity even though individual queries are short. What architecture most directly reduces this connection churn?
- Increase S3 object metadata limits to provide more SQL connections.
- Add an ALB in front of Aurora and use HTTP path rules to multiplex SQL sessions.
- Disable IAM database authentication so the database permits infinite connections.
- Place Amazon RDS Proxy between the Lambda clients and the relational database and tune connection pooling and authentication.
Explanation
Correct Answer
D:RDS Proxy can reuse database connections across many client sessions, reducing per-invocation connection pressure. Limits, failover behavior and transactions that pin sessions should still be tested.
Incorrect Answers
A:S3 object metadata has no influence on Aurora session limits and cannot pool database client connections.
B:An ALB is for HTTP/HTTPS application requests, not a supported SQL connection-pooling proxy for Aurora drivers.
C:Authentication does not remove finite database connection capacity, and disabling it introduces serious security risks.
Question 93
A production account hosts a customer database. Security is worried that a compromised production administrator could delete both the database and same-account recovery material. A separate restricted backup account is available. Which design better protects a recoverable copy?
- Store all backup copies in the compromised production account's default vault and give its admins delete rights.
- Add a CloudWatch dashboard widget named Backup to prevent deletion by IAM administrators.
- Use eligible AWS Backup cross-account copy into a protected vault with separate access controls, monitoring and restore tests.
- Use S3 public object ACLs to publish the database recovery artifacts for external redundancy.
Explanation
Correct Answer
C:Cross-account backup copies can improve recovery isolation when destination vault policies, encryption and administrative separation are configured correctly. Restore rights and immutability requirements must also be validated.
Incorrect Answers
A:Copies sharing the same compromised account and unrestricted administrator controls do not establish the desired isolation boundary.
B:A dashboard displays telemetry but cannot prevent an administrator from deleting a backup vault or recovery point.
D:Public ACLs expose confidential recovery material and do not create an appropriate controlled recovery account or backup lifecycle.
Question 94
An operations plan states RPO = 15 minutes and RTO = 2 hours for a payment reporting database. The team must choose how frequently to replicate or protect data. How should it interpret the RPO?
- RPO means the system must become operational again within 15 minutes, regardless of data loss.
- RPO is the maximum acceptable age of recoverable data after a disruption, so data loss should stay within roughly 15 minutes of the failure.
- RPO specifies the maximum time that a DNS resolver may cache a failover record.
- RPO means backups can be taken only once per two hours because RTO is two hours.
Explanation
Correct Answer
B:Recovery Point Objective is the acceptable data-loss window measured in time. Backup or replication frequency and consistency behavior should support no more than the stated data gap under modeled failures.
Incorrect Answers
A:The restoration-duration target is RTO, not RPO. Meeting a 15-minute recovery time is not what the 15-minute RPO states.
C:DNS TTL influences cached routing changes but is not the definition of acceptable recoverable data age.
D:A two-hour RTO says how quickly service should return, not that two-hour-spaced backups meet a 15-minute data-loss goal.
Question 95
A video-processing platform sends 30-GB video assets to Amazon S3 from remote studios. Single-upload retries waste bandwidth after transient link failures. Which S3 upload technique can transfer parts independently and resume incomplete large transfers?
- Use S3 multipart upload with appropriately sized parts, parallelism and abort/cleanup handling for incomplete uploads.
- Put each 30-GB file into a single SQS message and let message retries preserve file parts.
- Use Amazon Route 53 failover records to reassemble object byte ranges in S3.
- Configure S3 Object Lock compliance retention to split network requests automatically.
Explanation
Correct Answer
A:Multipart upload divides large objects into separately uploaded parts, permitting parallel transfer and retries of failed parts rather than the whole object. The client must complete or abort unfinished uploads appropriately.
Incorrect Answers
B:SQS messages have size limits far below 30 GB and are not object part-transfer containers.
C:DNS failover changes endpoint resolution; it does not provide part-level S3 upload state or byte-range recovery.
D:Object Lock controls version retention and does not implement multipart network upload retries.
Question 96
A Windows application in AWS needs a shared SMB filesystem with Windows ACL semantics and Active Directory integration. The team does not want to administer Windows file server EC2 instances. Which storage choice best matches?
- Use Amazon EFS as a generic Linux NFS mount and assume it automatically implements native Windows SMB/NTFS ACL behavior.
- Use S3 Glacier Deep Archive as a live SMB share for transaction documents.
- Use Amazon FSx for Windows File Server integrated with the chosen supported directory and permission design.
- Use SQS FIFO message groups as Windows filesystem security identifiers.
Explanation
Correct Answer
C:FSx for Windows File Server supplies managed SMB storage with Windows permission and directory integration features, making it the natural fit for this application.
Incorrect Answers
A:EFS provides NFS-compatible file access for supported workloads; it is not the managed native SMB Windows file server with NTFS ACL and AD integration described.
B:Deep Archive is an archival object store that requires restore workflows and cannot serve live SMB filesystem operations.
D:Message group IDs only influence FIFO queue ordering. They do not represent Windows SIDs, SMB sessions or filesystem access-control lists.
Question 97
A genomics lab submits thousands of independent compute jobs of differing CPU and memory sizes each night. Jobs can queue, run when capacity is available and retry on failure, and the team wants AWS-managed placement rather than hand-scheduling EC2 hosts. Which service fits?
- Run every job as a permanent always-on ALB target to guarantee all servers remain idle during the day.
- Store each executable in a Route 53 TXT record and depend on DNS to schedule compute.
- Use Amazon CloudFront signed URLs to implement CPU capacity allocation for jobs.
- Use AWS Batch job queues and compute environments with appropriate job definitions, retry and capacity policies.
Explanation
Correct Answer
D:AWS Batch manages job submission, scheduling, dependencies and compute resource allocation over supported environments, matching variable job demand without a bespoke scheduler.
Incorrect Answers
A:An ALB routes network traffic to applications and does not schedule independent nightly batch jobs by CPU/memory resource requests.
B:DNS records can store text but do not allocate hosts, place jobs or retry container executions.
C:CloudFront signed URLs govern access to web assets and do not implement compute job scheduling.
Question 98
A machine-learning inference system uses CUDA-based GPU kernels and its latency tests show a CPU-only instance cannot meet throughput goals. The model and software stack are compatible with a supported AWS GPU family. Which compute approach is most appropriate?
- Deploy a supported EC2 accelerated-computing GPU instance family sized for the workload, validating driver, memory and network needs.
- Use only larger EBS gp3 storage volumes because disk IOPS substitutes for GPU matrix operations.
- Move the model to S3 Glacier Instant Retrieval and issue inference operations as object GET requests.
- Choose an EC2 burstable CPU instance solely because all EC2 families expose identical GPUs.
Explanation
Correct Answer
A:GPU-based EC2 instance families accelerate supported inference kernels when the software stack is compatible. Instance selection should account for GPU memory, throughput, cost and drivers.
Incorrect Answers
B:Block storage performance helps data loading but does not execute CUDA GPU kernels or replace missing accelerator hardware.
C:Glacier Instant Retrieval is an object storage class and does not provide model-serving compute or GPU execution.
D:Burstable CPU families do not universally include GPUs. Selecting one does not satisfy a demonstrated GPU processing requirement.
Question 99
An RDS PostgreSQL application becomes slow after a software release. CPU is moderate, but transactions queue behind a long-running update. Management proposes doubling the instance size immediately. Which diagnostic action should come first?
- Add S3 Transfer Acceleration to the DB instance's public endpoint.
- Review available database performance telemetry, query plans and lock-wait information to identify the blocking SQL before resizing.
- Buy a larger NAT gateway because database lock waits are caused by private IPv4 translation.
- Create DynamoDB TTL attributes on the RDS tables so PostgreSQL rows expire faster.
Explanation
Correct Answer
B:Database execution and wait metrics can show whether lock contention or query changes, not compute saturation, explain latency. Correcting SQL or transaction behavior is more targeted than blindly increasing instance size.
Incorrect Answers
A:S3 Transfer Acceleration optimizes eligible object uploads and is unrelated to PostgreSQL lock contention.
C:A NAT gateway does not control PostgreSQL transaction locks or database query plans, so more NAT capacity would not resolve the observed waiting transactions.
D:DynamoDB TTL applies to DynamoDB items and does not implement automatic expiry of PostgreSQL rows or relieve table locks.
Question 100
A standard Aurora PostgreSQL cluster has a stable writer and existing readers. Its customer analytics queries fluctuate from low traffic at night to high read-only demand during the day. The team wants the number of read replicas to change automatically from a measured target metric, without resizing the writer for every spike. Which AWS capability fits?
- Increase the writer instance class and turn off reader endpoints, since Aurora reader scaling policies can only change writer CPU capacity.
- Use RDS Proxy to add physical read replicas automatically when pooled client connections reach the chosen target utilization.
- Configure Aurora Auto Scaling for reader instances with suitable minimum/maximum capacities and a target-tracking metric, routing eligible reads through the reader endpoint.
- Increase Aurora cluster storage capacity on a schedule and expect the storage layer to create and remove reader compute instances based on usage.
Explanation
Correct Answer
C:Aurora Auto Scaling adjusts the number of eligible Aurora Replicas using scaling policies and CloudWatch metrics. It does not automatically scale writer compute; new reader instances can receive connections through the reader endpoint.
Incorrect Answers
A:Writer scaling can be appropriate for writer saturation but does not match the request to adjust reader count automatically based on daytime analytics load.
B:RDS Proxy manages and reuses database connections; it does not provision new Aurora reader instances or implement target-tracking reader-fleet scaling.
D:Aurora storage grows independently of compute in its cluster architecture. Increasing storage does not create or remove read replica DB instances to handle query demand.
