AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 2
Question 10
A telemetry platform needs multiple independent applications to consume each event stream within seconds, replay retained records after downstream failures, and preserve ordering for a given device identifier. The developers will implement their own stream processors. Which ingestion service should they select?
- Amazon Data Firehose solely as a buffered delivery pipeline, without any separate retained multi-consumer event stream.
- Amazon SQS Standard as a broadcast stream guaranteeing order across all consumers.
- Amazon Kinesis Data Streams with partition keys based on device IDs and suitable retention and consumer capacity.
- Amazon Athena to continuously accept producer writes and store ordered retained event records in memory.
Explanation
Correct Answer
C:Kinesis Data Streams stores ordered records within a shard and supports multiple consumer applications with configurable retention. Device-based partition keys preserve ordering for each device within the stream's shard mapping.
Incorrect Answers
A:Firehose is optimized for managed delivery to destinations and optional transforms. Its batching and destination pipeline do not replace a purpose-built retained stream with independent custom consumers and per-key ordering.
B:Standard SQS queues distribute messages among competing consumers and do not promise strict ordering. Multiple independent replaying consumers need a retained stream or explicit fan-out architecture.
D:Athena is a SQL query engine over sources such as S3, not a low-latency append-only producer endpoint supporting per-key stream ordering and consumer replay semantics.
Question 11
A company plans to transition millions of very small log objects to S3 Standard-IA after only a few days, then delete most within two weeks. The architect must minimize total cost including request and storage-class billing behavior. Which recommendation is most defensible?
- Immediately transition every object to Standard-IA because its per-GB price is always lower regardless of object size or lifetime.
- Model Standard-IA minimum storage duration, billable object size and retrieval/request fees; leave short-lived tiny objects in a suitable class if transition is uneconomical.
- Turn off S3 versioning across the organization to eliminate all object retention and compliance considerations.
- Use RDS Provisioned IOPS volumes to store every log object as an alternative to S3 storage-class decisions.
Explanation
Correct Answer
B:Standard-IA has minimum storage duration and minimum billable size rules. Evaluating those alongside request, transition and retrieval charges is necessary before applying an aggressive lifecycle policy to short-lived small objects.
Incorrect Answers
A:Lower per-GB storage pricing does not imply lower total cost for tiny or short-lived objects. Minimum duration and minimum billable object sizes can dominate any expected Standard-IA savings.
C:Disabling versioning is not a storage-class cost analysis and can conflict with retention and recovery requirements. It does not remove minimum-duration charges in the class being proposed.
D:Using relational-database-oriented block storage for millions of log objects introduces a different access and management model and does not solve the specified S3 storage-class pricing analysis.
Question 12
A compute-heavy overnight analytics job can checkpoint and tolerate instance interruption. Running solely on one heavily discounted EC2 Spot instance type repeatedly stalls when that capacity pool is reclaimed. Which change best improves capacity continuity without abandoning discounted compute?
- Replace checkpoints with instance-store files, guaranteeing job data survives every Spot interruption.
- Purchase one-year EC2 Reserved Instances for every potential peak worker regardless of annual utilization.
- Keep using only the same scarce Spot pool but raise the instance's security group connection limit.
- Configure a diversified Spot fleet or Auto Scaling capacity strategy with several suitable instance types and pools, retaining durable checkpoints.
Explanation
Correct Answer
D:Diversifying among acceptable instance types and capacity pools reduces dependence on one scarce Spot supply source. Durable checkpoints allow work to resume when interruption still occurs, preserving a cost-oriented design.
Incorrect Answers
A:Instance store is ephemeral and can be lost when an instance terminates; it is not a safe checkpoint target for Spot interruption recovery.
B:Reserved Instances can offer commitment discounts for stable demand, but committing every intermittent peak worker sacrifices the flexibility and cost rationale of this interruptible overnight job.
C:Security group rules do not create scarce EC2 Spot capacity or change AWS's ability to reclaim instances. A single capacity pool remains a correlated interruption risk.
Question 13
A new DynamoDB-backed consumer application has highly irregular request volumes, including unpredictable launches and periods of near-idle activity. There is no reliable historical traffic baseline, and the team wants to avoid capacity-planning operations. Which capacity mode is the sound starting choice?
- Use DynamoDB on-demand capacity and assess its request-based costs against actual usage after traffic stabilizes.
- Use a fixed, low provisioned throughput setting with all auto scaling turned off, accepting arbitrary throttling during launches.
- Deploy Aurora Global Database to increase DynamoDB write capacity for the existing table without changing its clients.
- Buy RDS Reserved Instances because they reserve DynamoDB read and write capacity units.
Explanation
Correct Answer
A:DynamoDB on-demand capacity adapts to variable request traffic without manually specifying fixed RCUs/WCUs. For unpredictable use, its request-based economics and simpler operations make it a sensible initial choice.
Incorrect Answers
B:A low, static provisioned setting is likely to throttle abrupt launches and demands continuous capacity tuning when historical request patterns are unknown.
C:Aurora Global Database is a relational Aurora architecture, not an extension that attaches to a DynamoDB table to provide its API write capacity.
D:RDS Reserved Instances are billing commitments for supported relational database instances, not a mechanism for procuring DynamoDB request-capacity units.
Question 14
A company repeatedly transfers small batches of files from a branch office to AWS. A proposed DataSync deployment adds managed transfer fees, while an existing authenticated transfer script is simple and reliable. The team wants the lowest total cost without sacrificing its actual verification and support needs. What should it evaluate?
- Use AWS DataSync for all transfers without considering its per-GB charges or the cost of existing tooling.
- Compare the managed DataSync transfer and verification costs with the total maintenance, networking and reliability costs of the existing transfer method.
- Deploy an S3 gateway endpoint inside the branch office and assume it removes all WAN transfer charges.
- Buy additional EC2 reserved compute capacity because that automatically offsets charges for DataSync file movement.
Explanation
Correct Answer
B:A total-cost comparison includes DataSync metered transfer and managed capabilities as well as staffing, retries, validation and networking of the custom method. The scenario explicitly requires choosing on measured cost and operational needs.
Incorrect Answers
A:DataSync can simplify complex or recurring transfers, but it is not universally cheaper for modest predictable traffic. Ignoring its charges could make this solution worse economically.
C:An S3 gateway endpoint is associated with VPC routing; it does not magically exist as a local office endpoint or waive all WAN transfer and service fees.
D:Compute Reserved Instances affect eligible EC2 pricing, not a general discount applied to managed DataSync transfer charges.
Question 15
A SaaS monitoring vendor manages several thousand customer AWS accounts. Each customer creates an IAM role that the vendor's AWS account can assume. A customer wants to prevent a malicious third party from tricking the vendor into operating on another customer's account through the same vendor principal. Which additional trust condition is most relevant?
- Add an internet gateway to every account so STS requests can be traced to a public IP.
- Require an agreed customer-specific sts:ExternalId value in the role trust policy in addition to the authorized vendor principal.
- Store the vendor's root access key in an S3 bucket encrypted with an AWS-managed KMS key.
- Use one shared IAM user and password for all of the vendor's customers instead of role assumption.
Explanation
Correct Answer
B:The ExternalId condition helps ensure the multi-customer third party supplies the intended customer's identifier when assuming that customer's role. It supplements, rather than replaces, permission to assume the trusted principal.
Incorrect Answers
A:An internet gateway changes VPC connectivity, not the trust relationship or confused-deputy problem of an authorized vendor being induced to assume the wrong customer's role.
C:Root access keys would expand credential risk and are unrelated to scoping a multi-tenant vendor's role assumption. Encryption at rest does not prevent an authorized service from assuming the wrong role.
D:Shared permanent credentials weaken attribution and rotation and do not establish a per-customer STS trust boundary. The threat specifically arises when one legitimate vendor principal serves many customers.
Question 16
A company serves product images to the public through a CloudFront distribution. The S3 origin must remain inaccessible by direct anonymous S3 requests, while CloudFront should be authorized to fetch only the intended objects. Which approach achieves that separation?
- Enable S3 static website hosting and configure the entire bucket for public GetObject access.
- Attach a NAT gateway to CloudFront so all origin requests are translated into private VPC IP addresses.
- Grant a wildcard IAM identity policy to anonymous internet users while denying CloudFront service access.
- Configure CloudFront Origin Access Control, keep S3 public access blocked, and scope the bucket policy to the authorized distribution.
Explanation
Correct Answer
D:Origin Access Control signs CloudFront-to-S3 origin requests. With a bucket policy limited to the distribution and S3 public access restrictions, viewers can use CloudFront without gaining direct anonymous S3 access.
Incorrect Answers
A:A public S3 website endpoint permits direct public access, violating the restriction that only the distribution should obtain origin objects.
B:A NAT gateway provides outbound translation for resources inside a VPC; CloudFront access to an S3 origin is not made private by attaching a NAT gateway to the CDN.
C:Wildcard anonymous authorization exposes the origin outside the distribution. Denying the distribution additionally prevents legitimate image retrieval through the intended public delivery path.
Question 17
A company already encrypts S3 objects at rest using the default server-side encryption mechanism. A new regulatory control requires customer-managed encryption keys, independent KMS usage permissions, and KMS audit records for decrypt operations. Which storage encryption change fits?
- Use S3 SSE-KMS with an appropriate customer-managed KMS key and grant both S3 and KMS permissions to authorized callers.
- Disable server-side encryption and rely solely on an S3 bucket policy to stop unauthorized decryption of plaintext objects.
- Apply an S3 lifecycle expiration rule; key-use permissions automatically follow every object retention schedule.
- Move the bucket to a public static website endpoint because TLS alone supplies the requested at-rest key governance.
Explanation
Correct Answer
A:SSE-KMS with a customer-managed key permits KMS policy and IAM control over key use, and KMS records relevant API activity in CloudTrail. S3 object authorization and KMS decrypt authorization are separate requirements.
Incorrect Answers
B:A bucket policy governs S3 requests but does not encrypt stored plaintext, allocate a customer-managed key, or provide KMS decrypt event auditing.
C:Lifecycle rules handle object transition and expiration, not cryptographic key delegation or KMS API audit trails. They do not substitute for key management.
D:TLS protects data in transit and a public origin worsens access exposure. Neither satisfies encryption-at-rest control over a customer-managed KMS key.
Question 18
A payment processor receives adjustments for each account. Adjustments for a given account must be processed in the order submitted, while updates for different accounts should run concurrently. It also needs queue-backed processing through temporary worker outages. Which queue pattern best meets this requirement?
- Use an SQS Standard queue and rely on worker CPU scaling to guarantee strict per-account ordering.
- Use one SNS email subscription for all adjustments and retry when an operator reads the message.
- Use an SQS FIFO queue with the account ID as MessageGroupId, suitable deduplication, and idempotent consumers.
- Use a CloudFront distribution with separate cache behaviors for each account to retain ordered payment messages.
Explanation
Correct Answer
C:FIFO message groups serialize message processing for one account while allowing different groups to proceed concurrently. Deduplication and idempotency protect against retries and downstream side-effect duplication.
Incorrect Answers
A:Standard queues provide at-least-once delivery with best-effort ordering. Adding workers does not guarantee that all adjustments for one account arrive or complete in the required sequence.
B:SNS email is a notification transport, not a durable automated per-account ordered work queue with concurrent independent message groups.
D:CloudFront caches and delivers web content; cache behaviors do not provide durable FIFO message ordering or payment-processor work coordination.
Question 19
A firm requires its critical storefront to recover in a secondary AWS Region within minutes. It cannot afford fully active capacity in two Regions, but periodically restoring all application servers and databases from snapshots is too slow. Which disaster recovery strategy is the closest fit?
- Rely on local EBS snapshots stored only in the failed primary Region and rebuild after service recovery.
- Run an active-active design with both Regions serving 100% of global traffic despite the explicit affordability constraint.
- Keep no running resources in the second Region and describe the restoration plan as a minutes-level warm standby.
- Maintain a scaled-down but operational warm standby environment and replicated data in the secondary Region, with tested scaling and traffic-failover procedures.
Explanation
Correct Answer
D:Warm standby keeps a functional, reduced-capacity copy available in another Region and scales it up during failover. The chosen design must also replicate data and validate DNS/routing and application recovery through exercises.
Incorrect Answers
A:Region-local artifacts cannot satisfy a secondary-Region recovery plan after the primary region is unavailable, and complete infrastructure rebuilding also conflicts with the minutes-level RTO.
B:Active-active can provide strong availability but requires paying for continually active regional capacity; it exceeds the budget constraint when a smaller operational recovery footprint is acceptable.
C:An unprovisioned recovery region is a backup-and-restore or pilot-light-like starting point depending on retained core resources, not an already-running warm standby suitable for the specified fast recovery.
Question 20
A media-processing fleet has Linux EC2 instances in three Availability Zones. Every worker must concurrently read and write a shared POSIX-style directory tree, and capacity should expand without manually provisioning separate disks for each worker. What storage choice best fits?
- Give each worker an instance-store directory and copy files manually whenever the Auto Scaling group changes.
- Mount a multi-AZ Amazon EFS file system from the workers with suitable network and file-system permissions.
- Attach a single-AZ EBS volume to every worker as the same concurrently writable cross-AZ disk.
- Use an S3 bucket as the shared file store and let unmodified POSIX applications open bucket keys as if they were local NFS files.
Explanation
Correct Answer
B:Amazon EFS supports NFS/POSIX-oriented shared file access from many Linux instances and can be mounted from multiple AZs. Its elastic capacity removes per-worker volume provisioning for the shared tree.
Incorrect Answers
A:Instance store is tied to individual compute hosts and cannot provide a shared durable directory across instances and AZs; copying files manually is not shared concurrent access.
C:Ordinary EBS volumes are scoped to one Availability Zone and are not a cross-AZ shared file system. EBS Multi-Attach is a constrained same-AZ block capability and does not create a managed POSIX filesystem.
D:S3 supports concurrent object access but exposes object APIs rather than a transparent multi-AZ POSIX/NFS mount. The existing Linux programs require shared directory, open, rename and file-locking semantics, which an ordinary bucket does not directly supply.
