AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 100
Question 990
A small HTTP app uses an NLB in front of an ALB for historical reasons. It has no static IP, PrivateLink, special protocol or other requirement demanding both layers. Finance wants to simplify. What should be considered?
- Keep both balancers because adding layers always lowers costs while preserving identical functionality.
- Remove the unnecessary layer after validating HTTP routing, client connectivity and availability requirements, retaining a single suitable ALB where possible.
- Replace the ALB with an NLB and expect URL path rules to continue unchanged.
- Replace both with an unprotected single EC2 endpoint without reviewing resilience obligations.
Explanation
Correct Answer
B:Stacking NLB and ALB incurs additional load balancer resources without benefit when the app needs only ALB HTTP features.
Incorrect Answers
A:Extra layers can increase hours, capacity charges and complexity.
C:NLB does not perform application-layer HTTP path routing.
D:Removing required balancing can create an unacceptable single point of failure.
Question 991
A multitenant SaaS platform creates thousands of Route 53 health checks and per-tenant public DNS routing rules, then sees its monthly DNS bill rise sharply. What usage dimensions should be reviewed?
- Assume every DNS query and all health checks are unlimited free resources.
- Add more redundant health checks for every tenant without establishing a monitoring benefit.
- Inspect hosted-zone/query and health-check pricing, consolidate unnecessary per-tenant rules and measure request patterns.
- Enable Route 53 Resolver query logging and use request counts alone as a replacement for reviewing public hosted-zone and health-check pricing.
Explanation
Correct Answer
C:Route 53 has several billable components; excessive record/health-check design can create unnecessary recurring expenses.
Incorrect Answers
A:Route 53 has documented pricing dimensions for queries and checks.
B:Unused checks add recurring cost and possible alert complexity.
D:Resolver query logs provide useful DNS-query diagnostics in their supported VPC scope, but they do not replace accounting for public hosted zones, public authoritative queries and individually billed health checks.
Question 992
A failover-sensitive service chooses a Route 53 TTL of 24 hours to minimize DNS query volume. During a regional outage, clients keep using the old cached answer. What is the right balancing consideration?
- Use the longest TTL possible because failover health checks always invalidate every recursive resolver cache instantly.
- Set TTL to zero for all records and assume unlimited resolver traffic cannot add cost or operational load.
- Use S3 access logs as the only mechanism to update recursive DNS caches after an incident.
- Set a TTL that balances DNS cache efficiency with acceptable failover reaction time and realistic resolver behavior.
Explanation
Correct Answer
D:Long TTLs reduce lookup frequency but can extend stale endpoint usage after a routing change.
Incorrect Answers
A:Authoritative DNS changes do not universally flush already cached answers.
B:Very low TTLs may increase queries while caching behavior remains resolver-dependent.
C:S3 access logs record S3 requests and do not invalidate recursive DNS caches or reduce DNS TTL propagation delays. DNS mitigation needs appropriately managed record changes, health checks and cache-expiration expectations.
Question 993
A company duplicates nearly identical public Route 53 hosted zones in 50 team accounts for one product domain, with complicated conflicting ownership. There is no isolation mandate. What should it consider?
- Consolidate DNS authority and sharing/delegation appropriately while retaining required team permissions and isolation boundaries.
- Create another zone for each developer because additional copies automatically synchronize all DNS changes.
- Require every team to maintain its own root domain delegation regardless of operational need.
- Delete every health check and zone without checking whether production endpoints rely on them.
Explanation
Correct Answer
A:Unnecessary hosted zones add cost and change-management risk when a shared governance model is sufficient.
Incorrect Answers
B:Separate Route 53 hosted zones do not synchronize resource records automatically merely because they share an account or similar names. Maintaining duplicate zones without controlled replication can introduce inconsistent DNS answers.
C:Redundant delegations can increase complexity and ownership ambiguity.
D:Deleting zones or health checks without checking live dependencies can remove working production DNS records and failover controls. Cost cleanup requires dependency inventory and deliberate removal of unused resources only.
Question 994
An application in private VPC subnets has IPv6 addresses and calls third-party API endpoints that are confirmed reachable over native IPv6. It must initiate outbound connections but must not accept unsolicited inbound IPv6 connections. The team wants to avoid NAT gateway processing charges for this traffic. Which configuration matches the connectivity and cost requirements?
- Route native IPv6 calls through an IPv4 NAT gateway using NAT64 translation even when each target already has a reachable AAAA record.
- Create an egress-only internet gateway and route the private subnets’ intended IPv6 destinations, such as ::/0, through it while retaining appropriate security filtering.
- Attach a normal internet gateway with a public IPv4 address to each instance, because public IPv4 addressing inherently prevents unsolicited inbound IPv6 connections.
- Deploy a Direct Connect virtual interface to every third-party public API host, since an AWS private circuit is mandatory for internet-bound IPv6.
Explanation
Correct Answer
B:An egress-only internet gateway allows stateful outbound IPv6 connectivity while blocking unsolicited inbound connections. AWS does not charge for the gateway itself, although ordinary internet data-transfer charges can still apply; IPv4 requires a separate solution.
Incorrect Answers
A:NAT64 is relevant when IPv6 clients must reach IPv4-only destinations; translating already IPv6-reachable services through an unnecessary NAT path does not meet the stated cost-avoidance goal.
C:An internet gateway can allow publicly routed IPv6 traffic in both directions subject to security policies, and assigning public IPv4 addresses is not a control for inbound IPv6. It also introduces address charges.
D:Direct Connect is for dedicated connectivity to supported networks, not a prerequisite or general cost-saving route to unrelated third-party public API endpoints.
Question 995
A company with eligible AWS support needs to move a very large historical dataset from local media into AWS once. It could take devices to an AWS Data Transfer Terminal or buy a temporary higher-bandwidth circuit. What is a responsible economic comparison?
- Assume physically transporting media is always free and instantaneous once devices are prepared.
- Assume upgrading WAN capacity is always sufficient without calculating data volume divided by sustained throughput.
- Compare eligibility, device preparation/travel/appointment time and terminal costs against effective online bandwidth, DataSync charges and the cutover deadline.
- Budget a new Snowball Edge order for every first-time customer without verifying current availability.
Explanation
Correct Answer
C:Physical ingest and WAN upgrades have different setup, time and transfer economics; no method is universally cheaper.
Incorrect Answers
A:Travel, handling and ingest schedules can be substantial.
B:Large datasets can still exceed deadlines on upgraded links.
D:AWS no longer accepts new Snowball Edge device orders from new customers, so the plan may be infeasible.
Question 996
A regulated research migration must copy 20 million immutable 1-KiB event objects from an S3 bucket in one Region into an approved destination Region. The destination software can ingest batched archives and reconstruct the records with original identifiers. The business has confirmed that the regional copy is mandatory, but per-object request costs are significant. What should the architect evaluate?
- Use S3 Transfer Acceleration for each object because a faster network path guarantees a reduction in the number of GET and PUT requests.
- Enable versioning on each source and destination object to reduce the number of billable COPY, PUT, and GET API calls.
- Use S3 Batch Operations to issue one independent copy for every tiny object and assume a batch job eliminates the underlying per-object request charges.
- Package compatible small records into appropriately sized larger objects before the mandatory transfer, preserving a verified manifest and reconstructing them at the destination.
Explanation
Correct Answer
D:With compatible downstream semantics, packaging small records into fewer larger S3 objects can reduce per-object request overhead while preserving required regional copies. Integrity checks, manifest metadata, unpacking costs and total transfer charges must be modeled.
Incorrect Answers
A:Transfer Acceleration may improve suitable long-distance transfers but does not merge millions of distinct object operations into fewer API requests. It also has its own pricing dimensions.
B:Versioning preserves object history and can add stored versions. It does not consolidate individual GET, PUT, or COPY requests for an unchanged number of tiny objects.
C:Batch Operations can automate many object actions, but it can add job and object-related charges and does not turn millions of independent destination objects into one request. It is not a request-count elimination mechanism.
Question 997
A company wants a quick interactive view of which accounts and AWS Regions incurred NAT gateway data-processing charges in the last month. Its analysts can use AWS Cost Explorer and do not require exported line-item billing files for this first investigation. What is the most appropriate initial analysis?
- In Cost Explorer, filter for the NAT Gateway Data Processed usage type/group and then group or filter by linked account and Region to locate the charge drivers.
- Count how many VPCs exist and multiply by a single flat rate, ignoring processed bytes and their billing usage type.
- Use the number of EC2 security-group ingress rules as the basis for the NAT gateway’s per-GB processing bill.
- Inspect only CloudTrail management-event login records and assume they display NAT gateway processed-byte pricing by Region.
Explanation
Correct Answer
A:Cost Explorer supports filtering by usage type and usage type group, service, linked account, Region and other dimensions. The EC2 NAT Gateway Data Processed category directly isolates processed-byte charges without requiring a raw Cost and Usage Report export for an initial analysis.
Incorrect Answers
B:VPC counts do not measure NAT gateway uptime or bytes processed; billing contains usage-specific dimensions.
C:Security-group rule counts are authorization configurations, not metered bytes through a managed NAT service.
D:CloudTrail login events are not a billing dimension or a replacement for the usage-type charges shown in Cost Explorer.
Question 998
A nonproduction VPC has one private EC2 test machine that needs outbound IPv4 access for a few hours per week. The environment is disposable, can tolerate one-instance NAT downtime, and the team will maintain an instance. Gateway hourly charges dominate the tiny throughput. What change is worth modeling rather than assuming the managed service always costs less?
- Keep a regional managed NAT gateway active in each AZ 24/7 without checking hourly or per-GB charges against the near-idle pattern.
- Compare a correctly configured small NAT instance with the gateway, including EC2/EBS/IP charges, patching, routing, scale and single-instance failure risk.
- Create interface endpoints for AWS APIs but leave the private instance dependent on arbitrary external public IPv4 package repositories.
- Move the test instance into a private subnet with no NAT path and assume an S3 gateway endpoint provides OS updates from any vendor.
Explanation
Correct Answer
B:For a tiny disposable development workload, a NAT instance can be a cost candidate if its administration and lower availability are acceptable; it is not an unconditional replacement.
Incorrect Answers
A:Managed gateways reduce operations but bill for active hours and processed data; near-idle usage warrants an explicit cost comparison.
C:Private AWS service endpoints remove some AWS API traffic from internet egress, but cannot reach unrelated public IPv4 update hosts. They do not satisfy the stated general outbound access requirement or replace NAT for that traffic.
D:An S3 gateway endpoint serves supported S3 requests only. General external IPv4 package repositories still require an outbound connectivity design, so the instance would lose the stated update capability.
Question 999
Developers suspect a chatty inter-AZ service is responsible for high network cost. They can enable VPC Flow Logs and service telemetry but the logging system itself has charges. What is the appropriate diagnostic plan?
- Enable a VPC-wide, indefinite flow-log retention policy first; comparing sources and destinations can wait until the maximum-volume dataset has accumulated.
- Use only aggregate EC2 NetworkIn and NetworkOut CloudWatch metrics and attribute all bytes to a single suspected inter-AZ service.
- Scope VPC Flow Logs to the relevant ENIs or subnets, analyze flow-byte metadata with application metrics and billing categories, and set a bounded retention period.
- Enable traffic mirroring for every production ENI to capture full packet payloads indefinitely as the lowest-overhead billing attribution mechanism.
Explanation
Correct Answer
C:VPC Flow Logs capture aggregated flow metadata such as source, destination and bytes, not application messages. Scoped telemetry plus Cost Explorer or usage reports can distinguish costly routes while bounding observation cost.
Incorrect Answers
A:Indiscriminate logging and unlimited retention create their own collection and storage charges. The scope and observation window should match the suspected traffic path.
B:Instance metrics measure total interface traffic but lack the flow-level source, destination and directional metadata needed to isolate which application pairs cross AZ boundaries and generate billed transfer.
D:Traffic Mirroring is a packet-level technique for supported ENIs and can be valuable for detailed analysis, but collecting all payload traffic continuously is costly and disproportionate to a first-pass cost investigation.
Question 1000
A cost proposal moves a streaming app to a new VPC layout based on one week's traffic. Product plans will quadruple payload volume next quarter, and regional egress could dominate savings. How should the final economic decision be validated?
- Approve the redesign from current hourly endpoint fees alone while ignoring the expected fourfold bytes.
- Project the new payload total but omit data-processing, cross-AZ transfer and internet egress prices from the estimate.
- Discard performance and availability SLOs whenever a network path appears cheaper per hour.
- Model expected future traffic volumes, pricing dimensions, and resilience/latency requirements and benchmark plausible scenarios before committing.
Explanation
Correct Answer
D:A valid comparison models next-quarter byte volume and each applicable topology-specific charge, then tests realistic latency, resilience and traffic scenarios. This avoids claiming savings based on a single current-week snapshot.
Incorrect Answers
A:Endpoint and gateway hourly costs alone omit data-processing and byte-transfer charges. Quadrupling the streaming payload can overwhelm an apparently cheaper fixed-hourly topology, so approving the design from today’s hourly fees is not defensible.
B:Forecasting the fourfold volume is useful, but leaving out per-GB gateway processing, possible inter-AZ charges and regional or internet egress excludes the costs the proposed route changes may introduce.
C:Reducing network expenditure does not justify violating required latency and availability SLOs. The architect must retain feasible fault tolerance and performance while comparing the full operating costs.
