AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 3
Question 20
A media-processing fleet has Linux EC2 instances in three Availability Zones. Every worker must concurrently read and write a shared POSIX-style directory tree, and capacity should expand without manually provisioning separate disks for each worker. What storage choice best fits?
- Give each worker an instance-store directory and copy files manually whenever the Auto Scaling group changes.
- Mount a multi-AZ Amazon EFS file system from the workers with suitable network and file-system permissions.
- Attach a single-AZ EBS volume to every worker as the same concurrently writable cross-AZ disk.
- Use an S3 bucket as the shared file store and let unmodified POSIX applications open bucket keys as if they were local NFS files.
Explanation
Correct Answer
B:Amazon EFS supports NFS/POSIX-oriented shared file access from many Linux instances and can be mounted from multiple AZs. Its elastic capacity removes per-worker volume provisioning for the shared tree.
Incorrect Answers
A:Instance store is tied to individual compute hosts and cannot provide a shared durable directory across instances and AZs; copying files manually is not shared concurrent access.
C:Ordinary EBS volumes are scoped to one Availability Zone and are not a cross-AZ shared file system. EBS Multi-Attach is a constrained same-AZ block capability and does not create a managed POSIX filesystem.
D:S3 supports concurrent object access but exposes object APIs rather than a transparent multi-AZ POSIX/NFS mount. The existing Linux programs require shared directory, open, rename and file-locking semantics, which an ordinary bucket does not directly supply.
Question 21
A latency-sensitive API uses AWS Lambda, and most requests are quick. During infrequent traffic bursts, newly initialized execution environments cause intermittent first-request delays, even though downstream services are healthy. Which Lambda feature most directly mitigates this initialization latency?
- Configure provisioned concurrency for the relevant function version or alias and size it to anticipated peak warm demand.
- Set the function's reserved concurrency to zero so no new execution environment can start.
- Increase the SQS message retention period for the API even though the synchronous route does not use SQS.
- Disable CloudWatch Logs, because initialization time is driven by the size of retained logs.
Explanation
Correct Answer
A:Provisioned concurrency keeps a configured number of initialized Lambda execution environments available, reducing the cold-start component of latency for invocations covered by that provisioned pool.
Incorrect Answers
B:Reserved concurrency limits the number of concurrent executions. Setting it to zero intentionally throttles the function rather than keeping instances initialized and ready.
C:SQS retention only affects queue message availability. It does not keep Lambda execution environments warm for a synchronous request path with no queue.
D:Reducing logs can change observability and some execution overhead but does not address the lifecycle of provisioning new execution environments that creates cold starts.
Question 22
A DynamoDB table is keyed by customer ID and order ID. An application now needs frequent low-latency queries for orders by status and date across customers. It cannot efficiently query those items using the table's existing key schema. Which schema addition is most appropriate?
- Replace every Query call with an unfiltered Scan, expecting table size not to affect cost or latency.
- Add RDS read replicas behind the DynamoDB endpoint so DynamoDB automatically translates SQL indexes.
- Use a DynamoDB global table in another Region because replication creates new query keys automatically.
- Add a properly designed DynamoDB global secondary index with keys supporting the status/date access pattern, accounting for index capacity and eventual consistency.
Explanation
Correct Answer
D:A GSI provides a separate partition/sort-key access path for supported queries. It adds indexing/storage and write costs, and its reads are eventually consistent, so access and freshness requirements must be considered.
Incorrect Answers
A:A Scan examines many items and scales poorly for frequent selective queries; it consumes read capacity without providing an efficient indexed access path.
B:RDS replicas apply to relational database engines and cannot be attached to a DynamoDB API table to supply alternate DynamoDB partition keys.
C:Global tables provide multi-Region replication and local access, not an alternate key schema for queries by attributes missing from the original primary key.
Question 23
A SaaS provider exposes a TCP application through an AWS PrivateLink endpoint service backed by a Network Load Balancer. Its application targets see the load balancer nodes as the source rather than the original consumer and must identify the specific consumer VPC endpoint for audit attribution. The backend can parse PROXY protocol version 2 headers. What should the provider configure?
- Enable only NLB source-IP preservation and expect PrivateLink traffic to retain each consumer client address as the packet source.
- Add a CloudFront viewer-request function to stamp consumer endpoint IDs onto the raw PrivateLink TCP packets.
- Enable Proxy Protocol v2 on the NLB target group and parse the AWS-specific TLV containing the consumer VPC endpoint ID.
- Enable NLB sticky sessions and assume a backend connection hash is the authenticated identifier of the consumer endpoint.
Explanation
Correct Answer
C:For endpoint-service traffic, NLB Proxy Protocol v2 can carry an AWS-specific TLV with the VPC endpoint ID. An application that supports the binary header can extract it for per-consumer attribution.
Incorrect Answers
A:For PrivateLink traffic, the target sees the NLB node private source address even if ordinary NLB client-IP preservation is supported for other flows. Preservation alone does not expose the endpoint ID.
B:CloudFront functions operate on supported HTTP viewer requests. They do not sit in this PrivateLink TCP path and cannot manufacture the VPC endpoint identity in a packet.
D:Connection stickiness affects target selection, not authoritative VPC endpoint identity. A hash of a connection is not a substitute for the endpoint ID provided in Proxy Protocol v2.
Question 24
A SaaS provider emits operational events continuously. Its goal is to land batched records in S3 for later analytics with minimal custom consumer code, and a delivery delay of one or two minutes is acceptable. Which ingestion component should it use?
- Build a Kubernetes Kafka cluster only to copy every record into S3, even though the team explicitly wants minimal operations.
- Use Amazon Data Firehose with its supported S3 destination, delivery buffering and optional transforms.
- Use Amazon Athena as a write API for every incoming event, without any upstream event storage.
- Publish SQS messages to an RDS read-replica endpoint and assume the replica writes events into S3.
Explanation
Correct Answer
B:Amazon Data Firehose handles streaming delivery, buffering and optional transformation to supported destinations including S3. A delay measured in seconds or minutes fits its buffering approach.
Incorrect Answers
A:Self-managed Kafka could be used in a broader architecture, but provisioning and maintaining a cluster plus a delivery sink adds complexity the scenario explicitly seeks to avoid.
C:Athena queries data sources such as S3; it is not a managed continuous ingestion endpoint that durably buffers arbitrary producer writes before landing them in a bucket.
D:SQS is a queue and an RDS read-replica endpoint is not a writable S3 delivery destination. Combining them this way does not constitute a functional streaming sink pipeline.
Question 25
An organization has regulatory backups that are seldom accessed but must be retrievable within hours if auditors request them. It plans to keep them for years and wants the lowest appropriate storage spend without promising instant retrieval. Which S3 storage class choice fits the retrieval constraint?
- Select S3 Glacier Flexible Retrieval and explicitly account for its restore time, retention and request-cost characteristics.
- Use S3 Standard for every archive and conclude all archival classes provide instant restores without fees.
- Use S3 One Zone-IA as the only protected copy, regardless of the archive's durability and fault-domain requirements.
- Move the backups into DynamoDB DAX and depend on the cache to preserve them through long idle periods.
Explanation
Correct Answer
A:Glacier Flexible Retrieval is intended for archival data with restore options on the order of minutes to hours, not instantaneous normal GET access. Its cost benefits depend on respecting restoration and minimum-duration characteristics.
Incorrect Answers
B:S3 Standard has immediate retrieval but higher storage cost for cold long-lived data; it also does not change the restore constraints of the archival alternatives under evaluation.
C:One Zone-IA stores within a single Availability Zone and has retrieval and minimum-duration costs. As a sole critical regulatory backup copy it can violate the required failure-domain resilience.
D:DAX is a DynamoDB-compatible in-memory read cache, not a durable compliance archive with multi-year retention guarantees for backup objects.
Question 26
A platform team already owns compute Savings Plans. A new procurement proposal would purchase additional commitments because last month's EC2 on-demand bill was high. The fleet is being redesigned and its baseline utilization is uncertain. What should the architect evaluate before committing more spending?
- Purchase the largest available new commitment immediately because any on-demand charge means existing plans are insufficient.
- Switch all production databases to Spot instances because application availability is unrelated to EC2 purchase options.
- Analyze existing Savings Plans utilization and coverage plus reliable future baseline demand before choosing additional commitment scope and amount.
- Delete all CloudWatch metrics to stop billing and use the reduced observability spend as proof of compute savings.
Explanation
Correct Answer
C:Commitment utilization shows whether existing discounts are actually consumed, while coverage reveals eligible spending still billed on demand. Forecasts matter because a coming architecture change can invalidate today's stable baseline.
Incorrect Answers
A:On-demand charges alone do not prove that a specific new plan will be fully used across its term. Overcommitting can cost more than appropriate flexible on-demand usage.
B:Spot is interruptible EC2 capacity and not a universal drop-in purchase model for relational databases or critical noninterruptible services; it cannot replace commitment analysis.
D:CloudWatch removal compromises cost and performance evidence. Observability charges are not a substitute for determining whether a one- or three-year compute commitment fits future resource usage.
Question 27
A mature Aurora PostgreSQL-compatible order database runs steadily on correctly sized instances. Its last three months of billing show that storage read/write I/O charges contribute 31% of total Aurora database spending. The application performs very large numbers of small random I/O operations but needs no change to its relational API or scaling policy. The engine and Region support both Aurora storage configurations. Which cost-focused change should the architect evaluate first?
- Replace Aurora with DynamoDB Standard-IA solely because its storage per GiB is inexpensive, without assessing relational transaction compatibility.
- Keep Aurora Standard because its I/O request charges are included in the DB instance-hour price regardless of access volume.
- Reduce the cluster’s provisioned database storage by 31%, because Aurora Standard charges all I/O as a fixed percentage of the allocated GiB.
- Compare the total cost of Aurora I/O-Optimized against Aurora Standard; I/O-Optimized charges for cluster compute and storage without separate read/write I/O operation charges.
Explanation
Correct Answer
D:Aurora I/O-Optimized removes separately charged read/write I/O operation fees and is often economical when I/O spending is at least roughly a quarter of total Aurora cost. Verify supported versions and compare the higher storage/compute charges against avoided I/O charges for the measured workload.
Incorrect Answers
A:DynamoDB Standard-IA has a different data model and request/storage pricing. Changing database engines solely to avoid Aurora I/O billing would require transactional and application compatibility analysis rather than the requested same-engine cost optimization.
B:Aurora Standard includes metered read/write I/O operation charges in addition to the cluster compute and storage charges. With I/O around 31% of total Aurora spend, omitting this dimension prevents a valid comparison.
C:Aurora storage is elastic rather than a fixed preallocated volume charged by the cited percentage. Reducing storage does not remove separately billed high-volume Aurora Standard I/O operations.
Question 28
A small VPC accesses one supported AWS API a few times each month. It already has a NAT gateway for other outbound traffic. A proposal adds one interface endpoint per service in every Availability Zone to save money, regardless of request volume. How should the architect assess the proposal?
- Deploy every available interface endpoint because each one is free and automatically eliminates all network charges.
- Compare per-AZ interface endpoint hourly and per-GB charges against the current NAT marginal cost and security requirements; add endpoints where they provide value.
- Create more NAT gateways to make every interface endpoint charge disappear through private DNS.
- Use an S3 gateway endpoint as a universal private endpoint for arbitrary services such as Secrets Manager and CloudWatch.
Explanation
Correct Answer
B:The proper design compares incremental endpoint cost with existing NAT traffic charges and the value of private routing and security. Sparse API calls may not justify every per-AZ interface endpoint.
Incorrect Answers
A:Interface endpoints generally incur hourly and data-processing charges. Creating many unused endpoints can raise cost even when they offer useful network privacy benefits for particular APIs.
C:Additional NAT gateways add fixed hourly spend and do not offset independent endpoint billing. Private DNS determines resolution to endpoint addresses, not cross-service billing credits.
D:S3 gateway endpoints serve supported gateway endpoint services, not all AWS APIs. Most other supported APIs need their specific interface endpoint services with private ENIs and security groups.
Question 29
An IAM role has an identity policy allowing s3:GetObject on a reporting bucket. A second applicable policy explicitly denies s3:GetObject for the same objects. Users can assume the role but receive AccessDenied when downloading files. Which explanation is correct?
- The explicit Deny wins over an applicable Allow, so the denying statement must be revised if access is intended.
- The role's managed Allow policy takes priority because managed policies are evaluated last.
- An S3 access point automatically bypasses all identity policy denials.
- Adding a second Allow statement in another policy will override the Deny without changing its scope.
Explanation
Correct Answer
A:AWS permission evaluation treats an applicable explicit Deny as authoritative even when another identity or resource policy allows the operation. The architect must identify and address the denying policy within governance requirements.
Incorrect Answers
B:IAM policy evaluation is not a last-writer-wins sequence. Managed versus inline identity policy placement does not turn an Allow into an override of an explicit Deny.
C:An S3 access point can provide an additional controlled path to objects, but it does not cancel an explicit Deny that applies to the calling principal and action.
D:Multiple Allow statements can broaden permissions only when no applicable Deny blocks the request. The existing denying statement still makes this download unauthorized.
Question 30
A platform group lets application teams create their own IAM roles. A developer can attach arbitrary administrator policies to newly created roles. Security requires a hard maximum permission set even when team-managed role policies are overly broad. Which control best provides this boundary?
- Add a resource tag named Restricted to every EC2 instance and leave role creation unchanged.
- Require each created role to have an approved IAM permissions boundary restricting its effective maximum permissions.
- Grant iam:* to each developer and rely on CloudWatch alarms as a substitute for authorization control.
- Add a Deny statement to each developer-managed role's identity policy and let developers remove or edit that same policy when creating new roles.
Explanation
Correct Answer
B:An IAM permissions boundary limits the maximum permissions of the role even if an attached identity policy grants broader actions. Delegated role creation must also be constrained so developers cannot omit or remove the approved boundary.
Incorrect Answers
A:Tags can support ABAC when policies use them but are not, by themselves, a ceiling on what newly created roles can do across AWS services.
C:Monitoring is detective rather than preventive. CloudWatch alerts do not stop a new role with broad effective permissions from being abused before an alert is investigated.
D:A Deny can restrict use while it remains effective, but an unconstrained creator able to remove it can escape the proposed ceiling. An enforced permissions boundary plus creation/update controls prevents bypass.
