AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 42
Question 410
A Lambda function processes async fraud events and writes a settlement adjustment to DynamoDB. Because the original invocation can be delivered or retried more than once, one business event occasionally posts two adjustments even though each invocation succeeds. What application change protects settlement correctness?
- Set reserved concurrency to one and assume serialized invocations prevent the same business event from executing twice.
- Increase the Lambda timeout and memory until an occasional duplicate delivery can no longer occur.
- Disable asynchronous retry attempts and treat the event-delivery path as a guarantee of exactly-once downstream side effects.
- Use a stable business event ID and an idempotent conditional write or transaction, recording completed IDs so repeated deliveries do not apply the settlement adjustment again.
Explanation
Correct Answer
D:Lambda asynchronous delivery can retry or duplicate events. An idempotency key backed by a DynamoDB conditional write or transaction ensures an event already committed does not perform the financial side effect twice, even if invoked again.
Incorrect Answers
A:Reserved concurrency governs simultaneous invocation capacity, not whether the same event is processed again. Two duplicate deliveries can still run sequentially and both mutate the ledger.
B:More time or memory may change runtime behavior but cannot eliminate duplicate event deliveries or ensure an external settlement write executes only once.
C:Reducing retries can lose recoverable events and still does not rule out duplicate delivery. Correctness must be enforced at the business side effect, not inferred from transport settings.
Question 411
A retail team is replacing a lightly used web-API endpoint with fully managed request/response processing. Each HTTPS POST must validate an order payload with stateless code and return its application-generated HTTP status and JSON response immediately; there is no requirement to buffer a background job. Which AWS integration should the team configure?
- Publish the request to an EventBridge event bus with a Lambda target, expecting the caller’s HTTP connection to remain open until the target function returns its JSON body.
- Create an API Gateway HTTP API route with a Lambda proxy integration and a supported payloadFormatVersion, with the function returning an appropriate status and body.
- Place the request body in an SQS Standard queue with a Lambda consumer and treat message acceptance as the synchronous application-generated validation result.
- Configure a static API Gateway mock integration that returns the same HTTP status and body regardless of what the order-validation Lambda would compute.
Explanation
Correct Answer
B:An HTTP API Lambda proxy integration passes the request to the function and maps its supported response format to the client response, fitting the short-lived synchronous stateless endpoint.
Incorrect Answers
A:EventBridge can route events asynchronously to Lambda, but publishing an event does not synchronously return the eventual Lambda computation as the HTTP response to the producer.
C:SQS decouples producers from workers and can acknowledge queueing, but it does not supply the consumer’s completed validation body as an immediate synchronous API reply.
D:A mock integration can generate predetermined responses without invoking the validation code, so it cannot return order-specific status and computed JSON results.
Question 412
A REST endpoint starts a data export that can run for forty minutes. Browsers should receive a job ID immediately and poll a status endpoint later. The current API Gateway integration waits for the entire export and times out. What redesign is appropriate?
- Keep the export synchronous and raise API Gateway timeouts to several hours because all integration types support unlimited waits.
- Force every browser to open one TCP connection continuously until the batch finally completes.
- Have the API enqueue the export request through SQS or EventBridge and return a job identifier; process it asynchronously.
- Run the entire export in the API Gateway mapping template, removing all worker processes.
Explanation
Correct Answer
C:An HTTP front end need only acknowledge durable work acceptance; a queue or event bus decouples long-duration processing from the short request lifecycle.
Incorrect Answers
A:Managed API front ends have finite integration timing; an hours-long handler is not a durable async execution pattern.
B:Long-held client connections create fragility and are not a reliable tracking or acknowledgement model.
D:Mapping templates transform requests and responses; they are not a compute environment for a forty-minute data export.
Question 413
A public API Gateway REST API accepts POST requests to an RDS-backed order service. Repeated requests omit required customer IDs or send malformed JSON payloads, consuming backend connections before the application can reject them. The architect wants these structurally invalid requests rejected at API Gateway with HTTP 400 before integration, while retaining application-side business checks. Which change directly meets that requirement?
- Configure only API Gateway usage-plan and burst throttling, expecting valid and invalid request payloads to be distinguished by request rate.
- Configure a REST API method request validator for required parameters and an applicable JSON-schema request model for the body, with the validation applied to that method.
- Enable AWS WAF IP reputation blocking and assume it guarantees JSON schema and required field validation for each legitimate-looking request.
- Increase RDS instance size and provision more storage IOPS so malformed JSON always becomes syntactically valid before the integration request.
Explanation
Correct Answer
B:API Gateway REST API request validators can check the presence of required method parameters and validate bodies against a configured model schema for the applicable content type. Invalid requests receive a 400 before the backend integration.
Incorrect Answers
A:Throttling can protect backends against high request rates, but it does not inspect whether required request parameters exist or whether a JSON body satisfies an API method schema. It does not meet the early 400 validation requirement.
C:A web ACL provides security filtering and rate-based controls but does not replace the API method request validator and JSON-schema model for the stated structural contract.
D:More database capacity is not a substitute for rejecting invalid parameters and payloads. This would continue wasting backend resources on requests that could be rejected at the API front door.
Question 414
An API Gateway endpoint invokes a Lambda function connected to a private database. The API is reachable, but security tests show anonymous callers can invoke privileged actions simply because the Lambda has VPC connectivity. What distinct layer must the design enforce?
- Configure appropriate API authentication and authorization, independent of Lambda-to-database network rules.
- Use only private subnets for database hosts and leave API methods completely unauthenticated.
- Allow the database to accept inbound traffic from API Gateway public IP addresses and treat that as end-user authorization.
- Increase Lambda memory so anonymous callers cannot obtain enough CPU time to complete a privileged operation.
Explanation
Correct Answer
A:Backend security groups govern connectivity. The API front door must separately verify and authorize clients before privileged requests reach a trusted execution role.
Incorrect Answers
B:Private subnet placement protects one path but does not enforce who may trigger the public application logic.
C:Network reachability to the database does not establish the identity or permissions of the external API caller.
D:Compute sizing has no identity semantics and cannot distinguish authorized from anonymous API users.
Question 415
A store deploys six identical web instances across two Availability Zones. One instance stops serving valid HTTP responses but its operating system remains running. Which traffic-entry design provides HTTP-aware distribution and health checks?
- Send users directly to a single EC2 Elastic IP and rely on manual DNS edits whenever the web process fails.
- Use a NAT gateway as the incoming HTTP load balancer for the public site.
- Place an Application Load Balancer ahead of instance target groups with HTTP health checks.
- Give every web instance a static S3 website endpoint and treat the object service as a dynamic instance health checker.
Explanation
Correct Answer
C:ALB targets can be checked using application-level health paths and removed from service when they fail, while distributing web requests across healthy targets.
Incorrect Answers
A:One public instance cannot reliably balance load or automatically remove unhealthy members of the fleet.
B:NAT gateways serve outbound connectivity for private networks; they do not offer managed HTTP target groups.
D:S3 static website hosting does not probe and distribute dynamic HTTP sessions to an EC2 target fleet.
Question 416
One HTTPS hostname hosts three independently deployed services: /orders, /catalog and /profile. The engineering team wants clients to keep one TLS endpoint while requests reach different target groups. What should be configured?
- Assign the same Elastic IP to every EC2 service and expect the internet routing fabric to parse URL paths.
- Configure only an S3 bucket lifecycle policy to direct HTTP requests to the correct microservice.
- Use Network Load Balancer TCP health checks alone to select targets by the HTTP request URI path.
- Use Application Load Balancer listener rules with path conditions directing requests to the appropriate target groups.
Explanation
Correct Answer
D:ALB provides layer-7 rule evaluation including URL paths, so multiple independently scaled services can share an HTTPS listener.
Incorrect Answers
A:IP routing alone does not inspect HTTP paths to select application target groups.
B:Object lifecycle policies handle S3 data transitions, not live web request routing.
C:NLB operates primarily at the connection layer and does not support ALB-style HTTP path-rule routing.
Question 417
An ALB receives traffic for a payment service, but one target responds HTTP 503 while EC2 health checks report a running VM. Requests continue reaching the broken process. What is the correct load-balancer adjustment?
- Point the ALB to an unrelated NAT gateway as its only target; NAT automatically repairs HTTP 503.
- Disable all ALB health checks so the failed process receives fewer requests.
- Increase the EC2 instance's root EBS capacity regardless of application errors to mark it healthy.
- Configure target-group health checks against an application endpoint and confirm expected success codes and thresholds.
Explanation
Correct Answer
D:ALB target health operates at the listener target level. A meaningful application probe lets the load balancer stop directing requests to a server whose process is unhealthy.
Incorrect Answers
A:NAT gateways are not application targets or diagnostic substitutes for a failing web process.
B:Without checks, the load balancer cannot reliably distinguish a broken application from a healthy target.
C:Disk allocation does not establish that HTTP service endpoints return correct responses.
Question 418
A stateless web fleet scales out during holidays. User login state is kept in each instance's memory; after the ALB routes a later request to a different instance, customers appear logged out. What makes scaling independent of the chosen web server?
- Move persistent session data to a shared store such as ElastiCache or DynamoDB, with appropriate expiration.
- Enable ALB sticky sessions for a specific backend instance while leaving all login state on that instance’s ephemeral disk across replacements.
- Keep all sessions only in one designated EC2 host and send every browser there indefinitely.
- Disable EC2 Auto Scaling for the entire site to avoid moving users between healthy targets.
Explanation
Correct Answer
A:Shared session state survives requests moving across instances and instance replacements, reducing reliance on sticky routing and single-host memory.
Incorrect Answers
B:Stickiness routes a client to the same live target while it is eligible; it does not recover session state when that target is terminated or loses its local storage.
C:This creates a stateful bottleneck and failure point contrary to resilient horizontal scaling.
D:Refusing to scale sacrifices availability and does not provide a durable shared session model.
Question 419
A real-time gaming service transports UDP packets and has clients that must connect to static IP addresses. An engineer suggests an ALB because it is familiar from HTTP workloads. Which AWS load balancer better matches protocol and endpoint requirements?
- Place an Application Load Balancer in front of the service and configure its HTTPS listener to forward the raw UDP gaming packets as UDP.
- Use a Network Load Balancer with suitable UDP listeners and static address configuration.
- Use API Gateway REST methods as a general-purpose transparent UDP packet forwarder.
- Use an ALB path-based rule because HTTP URL paths are required to deliver all UDP datagrams.
Explanation
Correct Answer
B:NLB handles supported transport protocols, including UDP, and offers stable network-layer endpoints; ALB routes application-layer HTTP/HTTPS traffic.
Incorrect Answers
A:An ALB supports HTTP/HTTPS application routing, not arbitrary UDP balancing. A suitable NLB listener and target group support the required transport protocol.
C:API Gateway REST APIs handle supported HTTP request patterns, not arbitrary UDP datagram forwarding.
D:UDP datagrams do not contain ordinary HTTP URL paths, so ALB path routing is the wrong protocol interface.
Question 420
A network team migrates a TLS-over-TCP device protocol behind an NLB. Its previous ALB target health configuration expected a web URI path and HTTP header, but the new service exposes only TCP. What should be adapted?
- Turn off target health checking entirely and expect NLB to route around broken transport connections automatically.
- Keep an ALB /health URL check unchanged even though the target has no HTTP listener.
- Configure appropriate NLB listeners, target groups and protocol-compatible health checks for the TCP service.
- Use S3 lifecycle object count to mark each TCP appliance healthy for the load balancer.
Explanation
Correct Answer
C:NLB target groups can use network-layer health behavior rather than ALB-style URL path routing. The check must match what a healthy device can answer.
Incorrect Answers
A:Target-group health remains important to avoid sending new client connections to failed services.
B:A health probe against an absent HTTP endpoint would incorrectly mark otherwise healthy TCP targets unavailable.
D:Bucket inventory is not a network-protocol health response from the appliance target.
