AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 41
Question 400
An SNS topic broadcasts five event types, but a fulfillment queue needs only shipped and cancelled order events. The team does not want the worker to download and reject every unrelated event. Which SNS mechanism should be used?
- Configure SQS ReceiveMessage calls with an SNS message-attribute predicate so the queue rejects unrelated topic events before SNS delivery.
- Attach an SNS subscription filter policy selecting the allowed event attributes or supported message-body fields.
- Reduce SNS message size limit until unwanted event types no longer fit in the published payload.
- Create a second SNS topic with no publishers and assume all unwanted event types move there automatically.
Explanation
Correct Answer
B:Subscription filtering routes only matching published messages to the fulfillment subscription, reducing consumer-side irrelevant work.
Incorrect Answers
A:An SQS consumer cannot retroactively apply an SNS topic subscription filter through ReceiveMessage. The SNS subscription filter policy is evaluated before topic messages are delivered to that queue.
C:Arbitrary payload truncation is not an event-type filter and risks rejecting legitimate shipments.
D:A new topic without changed publishing or filtering rules has no effect on routing existing events.
Question 401
A payments platform publishes sequential balance-change events for each account. Two independent services—ledger posting and compliance auditing—must each receive every event in per-account order, while allowing unrelated accounts to proceed in parallel. Standard SNS-to-SQS fan-out previously lost strict ordering. Which event distribution design best meets these requirements?
- Publish to an SNS FIFO topic using account ID as the message group ID and subscribe separate SQS FIFO queues for ledger and audit consumers, with suitable deduplication and consumer idempotency.
- Keep an SNS Standard topic and two SQS Standard queues, assuming that multiple subscriptions automatically guarantee ordered delivery for each account.
- Use one SQS FIFO queue with both services as competing consumers, because every message is delivered to each consumer while preserving group ordering.
- Send every event directly to two SQS Standard queues and rely only on a timestamp sort at the receiving services to restore an authoritative delivery order.
Explanation
Correct Answer
A:SNS FIFO topics can preserve publishing order per message group when delivering to subscribed SQS FIFO queues. An account-specific MessageGroupId permits independent accounts to proceed in parallel while each subscribed service receives its own ordered stream; publishers/consumers should still handle deduplication and idempotent effects.
Incorrect Answers
B:SNS Standard and SQS Standard provide at-least-once and best-effort ordering, not the strict per-message-group ordering demanded by the ledger and audit services.
C:One shared SQS FIFO queue uses competing-consumer semantics: messages are not independently copied to both consumers. Each service requires its own subscription queue.
D:Downstream timestamp sorting cannot safely recover all missing or duplicated events or enforce ordered receipt under asynchronous Standard-queue delivery. The broker ordering and consumer guarantees must be designed explicitly.
Question 402
A central security account must receive custom application events sent through EventBridge by member AWS accounts. Rules are present but PutEvents is denied on the central bus. Which access boundary must be configured?
- Publish event messages to CloudTrail logs and assume this confers PutEvents authorization automatically.
- Grant the sending accounts or principals the permitted events:PutEvents action using the central event bus resource policy.
- Increase the event bus archive retention because longer archives automatically remove resource-policy denies.
- Create a new private hosted zone for the sender account because event bus permissions use DNS zoning.
Explanation
Correct Answer
B:Cross-account event delivery requires policy authorization on the destination event bus. Routing rules alone do not grant a sender permission to submit events.
Incorrect Answers
A:Audit logging records supported calls but does not authorize cross-account writes to the event bus.
C:Archive retention governs stored historical events, not who may call the event submission API.
D:DNS zones cannot grant IAM or EventBridge resource-policy access to a bus in another account.
Question 403
An operations team mistakenly updated the eligibility logic for an EventBridge consumer. It needs to replay a stored subset of historical events from the same event bus after correcting the rule. Which managed capability may help?
- Increase SQS visibility timeout on an unrelated queue and assume EventBridge retrieves its original history.
- Enable ALB access logs, which become the canonical source for EventBridge business event replay.
- Use EventBridge archive and replay for eligible captured bus events with the desired time/event criteria.
- Change the event bus rule priority to negative numbers, which reconstructs all previously discarded events.
Explanation
Correct Answer
C:EventBridge can store bus events in an archive and replay them later, subject to configuration and limits. This addresses recovery from faulty consumer logic.
Incorrect Answers
A:Queue visibility is a separate consumer retry control and cannot recreate bus events absent from the archive.
B:Load balancer logs record web access metadata, not guaranteed preserved custom business-event payloads from the bus.
D:Rule configuration does not create an archive or recover past events that were never stored for replay.
Question 404
An EventBridge rule sends transactions to a Lambda target. The Lambda permission configuration was fixed, but some events still fail transiently and consumers can be retried. What reliability design should accompany the rule?
- Reduce event TTL to zero in every queue, which guarantees every transient target failure is recovered instantly.
- Assume EventBridge always commits exactly one business side effect in the downstream database without any retry handling.
- Disable the rule after the first transient error and discard subsequent events without investigation.
- Configure supported target retry and dead-letter handling, and make the consumer idempotent for possible repeated events.
Explanation
Correct Answer
D:EventBridge delivery may retry after failures. A durable failure destination and duplicate-safe handler reduce data loss and double-processing risk.
Incorrect Answers
A:Eliminating retention windows removes opportunities for recovery rather than implementing durable target failure handling.
B:Delivery success and external database commit are separate failure boundaries; an event may be attempted more than once.
C:Permanently dropping new events abandons recoverability and does not fix the transient dependency problem.
Question 405
A claims workflow may pause for days while a human reviews a case. It needs an auditable execution history and must survive restarts. Which Step Functions execution type best fits?
- Use a Step Functions Standard workflow for durable, potentially long-running executions.
- Place one Lambda in a sleep loop for days while waiting for the review decision.
- Use only SQS long polling with a single receive request that remains open for several days.
- Use an Express workflow and assume it supports the same long-running duration as Standard workflows.
Explanation
Correct Answer
A:Standard workflows support long-running orchestrations with execution history and state transitions, a better fit for days-long human approval waits.
Incorrect Answers
B:Lambda invocation duration limits and cost make multi-day blocking waits unsuitable for a single handler.
C:SQS receive wait times are measured in seconds, not a durable orchestration state lasting several days.
D:Express workflows have much shorter execution-duration semantics and are intended for high-volume short tasks.
Question 406
A telemetry processor must coordinate short, high-volume Step Functions flows, each lasting seconds, and accepts the Express workflow visibility and delivery characteristics. Which state-machine type should be considered?
- Use a single synchronous Lambda invocation to sleep through each external wait, without state transitions or retry handling.
- Use Step Functions Express workflows for the supported high-throughput short-duration orchestration pattern.
- Choose a Standard workflow only because it always has higher throughput and a lower per-execution price at any traffic volume.
- Use an EC2 cron process that serializes all telemetry flows on one instance to preserve orchestration throughput.
Explanation
Correct Answer
B:Express is optimized for very high execution rates and shorter duration state-machine flows, provided the application tolerates its observability and execution semantics.
Incorrect Answers
A:One blocking handler does not provide the state-machine coordination and failure handling required by the workflow.
C:Standard has different history and charging characteristics; high-frequency short flows can favor Express when appropriate.
D:A single cron host creates a bottleneck and failure point instead of using the managed scalable orchestration capability.
Question 407
A Step Functions workflow invokes a payment API and then updates a ledger. The payment API can return throttling errors while ledger update can fail permanently. What should the state machine express?
- Assume every task failure is retried forever automatically even when no Retry or Catch definitions are present.
- Remove all state transitions and use a single CloudWatch metric as the payment success indicator.
- Define targeted Retry policies for transient errors and Catch transitions for failures requiring compensating or alerting steps.
- Alarm on the Step Functions execution-failure CloudWatch metric but leave the payment and ledger Task states without Retry or Catch handling.
Explanation
Correct Answer
C:Step Functions error transitions make recovery behavior explicit. Controlled backoff handles transient throttling; Catch routes unrecoverable outcomes for reconciliation.
Incorrect Answers
A:Unbounded automatic recovery is not a safe state-machine default and can repeatedly invoke an external payment endpoint.
B:Metrics describe observations and cannot coordinate ledger actions or compensating transitions.
D:An execution alarm can tell operators that the overall workflow failed, but it cannot define task-level retry backoff, a reconciliation path or a compensating ledger transition inside the running state machine.
Question 408
An ingestion service invokes a Lambda function asynchronously to analyze compliance documents. Most events complete, but a small number continue to fail or expire after the service-managed retry window. The original caller already received an acknowledgement. Investigators need the failed event and invocation outcome for controlled replay. Which configuration best meets this requirement?
- Use the original HTTP caller timeout as the only failure-recovery control, because asynchronous invocation keeps the connection open until processing finishes.
- Turn on CloudWatch execution logging alone and assume a log entry contains a durable, directly replayable copy of every discarded invocation payload.
- Use a FIFO SQS queue as the Lambda function-level dead-letter queue without checking which DLQ types asynchronous Lambda supports.
- Configure an asynchronous Lambda on-failure destination, such as a supported standard SQS queue, with required delivery permissions and monitoring for failed destination deliveries.
Explanation
Correct Answer
D:Lambda asynchronous on-failure destinations can retain invocation records after retries are exhausted or maximum event age is reached. A standard SQS destination with sqs:SendMessage permission and DestinationDeliveryFailures monitoring enables investigation and controlled replay without expecting a synchronous caller exception.
Incorrect Answers
A:An asynchronous Lambda Invoke returns after the event is accepted, not after its eventual processing. The original HTTP connection cannot carry a later terminal function error or hold the failed event for replay.
B:CloudWatch execution logs help diagnose failures but are not the same as an on-failure invocation record with request context, response details and a replayable payload. Recovery requires deliberate event retention and handling.
C:Lambda function-level dead-letter queues for asynchronous invokes support standard SQS queues or standard SNS topics, not FIFO queues. An unsupported destination can fail to capture the discarded event.
Question 409
One Lambda function consumes two SQS Standard queues, a latency-sensitive orders queue and a bursty batch queue. The function has reserved concurrency 40. The team wants the batch queue limited to 12 concurrent function invocations while keeping capacity available for orders; neither mapping uses provisioned mode. Which configuration is appropriate?
- Set MaximumConcurrency=12 on the batch queue event-source mapping, and keep the function reserved concurrency at least the sum of mapping maxima.
- Set only the SQS batch queue visibility timeout to 12 seconds, which directly caps Lambda concurrent invocations at 12.
- Enable provisioned polling mode and MaximumConcurrency simultaneously on that batch mapping to combine both controls.
- Disable reserved concurrency and rely on the batch queue message retention period to protect the account-wide Lambda quota.
Explanation
Correct Answer
A:MaximumConcurrency is per SQS event-source mapping, not per function; with function reserved concurrency sufficient for mapping maxima it isolates bursty queues.
Incorrect Answers
B:Visibility timeout controls message reappearance after processing attempts, not invocation concurrency caps.
C:Provisioned mode and mapping MaximumConcurrency are mutually exclusive in Lambda SQS event-source mappings.
D:Message retention does not cap Lambda invocation concurrency, and removing reserved limits can expose other functions to noisy neighbors.
Question 410
A Lambda function processes async fraud events and writes a settlement adjustment to DynamoDB. Because the original invocation can be delivered or retried more than once, one business event occasionally posts two adjustments even though each invocation succeeds. What application change protects settlement correctness?
- Set reserved concurrency to one and assume serialized invocations prevent the same business event from executing twice.
- Increase the Lambda timeout and memory until an occasional duplicate delivery can no longer occur.
- Disable asynchronous retry attempts and treat the event-delivery path as a guarantee of exactly-once downstream side effects.
- Use a stable business event ID and an idempotent conditional write or transaction, recording completed IDs so repeated deliveries do not apply the settlement adjustment again.
Explanation
Correct Answer
D:Lambda asynchronous delivery can retry or duplicate events. An idempotency key backed by a DynamoDB conditional write or transaction ensures an event already committed does not perform the financial side effect twice, even if invoked again.
Incorrect Answers
A:Reserved concurrency governs simultaneous invocation capacity, not whether the same event is processed again. Two duplicate deliveries can still run sequentially and both mutate the ledger.
B:More time or memory may change runtime behavior but cannot eliminate duplicate event deliveries or ensure an external settlement write executes only once.
C:Reducing retries can lose recoverable events and still does not rule out duplicate delivery. Correctness must be enforced at the business side effect, not inferred from transport settings.
