AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 43
Question 420
A network team migrates a TLS-over-TCP device protocol behind an NLB. Its previous ALB target health configuration expected a web URI path and HTTP header, but the new service exposes only TCP. What should be adapted?
- Turn off target health checking entirely and expect NLB to route around broken transport connections automatically.
- Keep an ALB /health URL check unchanged even though the target has no HTTP listener.
- Configure appropriate NLB listeners, target groups and protocol-compatible health checks for the TCP service.
- Use S3 lifecycle object count to mark each TCP appliance healthy for the load balancer.
Explanation
Correct Answer
C:NLB target groups can use network-layer health behavior rather than ALB-style URL path routing. The check must match what a healthy device can answer.
Incorrect Answers
A:Target-group health remains important to avoid sending new client connections to failed services.
B:A health probe against an absent HTTP endpoint would incorrectly mark otherwise healthy TCP targets unavailable.
D:Bucket inventory is not a network-protocol health response from the appliance target.
Question 421
An audit system must see the true client IP for connections terminating through an NLB. After a target-type migration, its logs show addresses that do not match the external callers. What should the network architect evaluate?
- Review NLB target type/protocol and supported client-IP preservation or proxy-protocol settings end to end.
- Assume any NLB configuration always preserves the source IP exactly, even when proxying modes change.
- Move the log file to another EBS volume so existing TCP packets automatically acquire the true public source IP.
- Add an HTTP X-Forwarded-For parser to a binary UDP protocol with no HTTP headers and no proxy-protocol support.
Explanation
Correct Answer
A:NLB client address behavior depends on listener and target arrangements. Backend parsing and preservation settings must match the chosen integration.
Incorrect Answers
B:Client-IP visibility is configuration-dependent and cannot be guaranteed without checking the actual target architecture.
C:Storage placement cannot alter packet source addressing or proxy-protocol metadata.
D:An HTTP header parser cannot recover source addresses from a transport protocol that never carries that header.
Question 422
A product owner requires routing HTTPS requests to /v2 and /v1 target groups based on URL path. A teammate proposes an NLB because it has static IP addresses. What limitation is decisive?
- Publish weighted Route 53 DNS records for the two NLB endpoints to select /v1 versus /v2 traffic based on each request URL.
- Attach an AWS WAF web ACL to the NLB and use URL path match rules to forward requests into the appropriate NLB target group.
- Use an ALB for path-aware HTTPS routing, or introduce a separate application-aware router when static network addresses are mandatory.
- Configure two NLB target groups with HTTP path-pattern conditions exactly as in an ALB listener rule.
Explanation
Correct Answer
C:NLB provides transport-layer distribution rather than ALB host/path listener conditions; the routing requirement is explicitly application-layer.
Incorrect Answers
A:DNS routing acts on hostnames and record policies rather than the HTTP path of an individual request. Weighted Route 53 records cannot read /v1 or /v2 to select the correct backend.
B:WAF web ACL rules can filter HTTP requests on supported layer-7 integrations, including ALB, but do not add application-path forwarding rules to Network Load Balancer listeners.
D:NLB listeners do not provide the requested ALB-style HTTP host/path content routing conditions.
Question 423
An order microservice commits a successful payment status update to Amazon RDS and then sends an event to SQS. If the process crashes after the RDS commit but before the queue send, downstream inventory is never informed. The company needs a reliable notification path without a distributed cross-service database transaction. Which design best solves the gap?
- Publish to SQS first and assume a later failed or rolled-back RDS transaction can never cause an inconsistent downstream inventory update.
- Write the payment update and an outbox event in one RDS transaction, then reliably relay committed outbox events to SQS with idempotent consumers.
- Enable SQS FIFO deduplication alone while preserving two separate application statements for the RDS commit and queue send.
- Add an RDS read replica and rely on asynchronous replication to publish queue messages for every committed payment row automatically.
Explanation
Correct Answer
B:A transactional outbox closes the database-write-versus-message-publish gap because both business state and pending notification are committed together. A separate publisher retries committed events; downstream consumers must tolerate possible duplicate delivery.
Incorrect Answers
A:Sending the message before commit reverses but does not eliminate the dual-write failure window. SQS can deliver an event referring to a payment update that never successfully committed.
C:FIFO deduplication can reduce repeat delivery of messages sent to SQS, but it cannot publish an event that was never sent after a process crash. The atomic RDS/outbox commit addresses that failure window.
D:An RDS replica supplies a read-only copy of database state but does not directly make a separate SQS SendMessage operation atomic with the source transaction. A relay or suitable change-capture design is still required.
Question 424
Users upload product photos through a fleet of transient web servers. The photos are currently written to /tmp on whichever EC2 instance receives each POST, so later GETs on different instances return 404. What is the right durable object-store design?
- Keep using per-instance /tmp directories and enable ALB sticky sessions as the sole durability guarantee.
- Write the images only to each instance's memory cache and assume autoscaling synchronizes memory automatically.
- Use a NAT gateway as permanent image storage, because it sits between the web tier and the internet.
- Store uploaded images in Amazon S3 and refer to them by stable object keys from all web instances.
Explanation
Correct Answer
D:S3 separates durable object content from ephemeral compute lifecycle, making uploads independently accessible after horizontal scaling and instance replacement.
Incorrect Answers
A:Affinity may temporarily route repeat clients to one instance but cannot preserve files when that instance disappears.
B:Scaling EC2 instances does not replicate arbitrary in-memory files across fleet members.
C:A NAT gateway performs network address translation, not object persistence or HTTP image serving.
Question 425
A retail checkout application runs on eight EC2 nodes and already retrieves feature-flag configurations through AWS AppConfig Agent. Its existing AWS AppConfig freeform configuration profile references a Systems Manager Parameter Store value. The team previously deployed a checkout flag with an all-at-once strategy and caused a regional outage. For future flag changes it needs configuration validation, a staged rollout, and automatic rollback if a checkout-error CloudWatch alarm fires, without redeploying the application binaries. Which configuration deployment should it use?
- Use AWS AppConfig with a configuration profile referring to the source, appropriate validators, a gradual deployment strategy and an environment CloudWatch alarm with rollback permissions.
- Use Parameter Store version history and labels to restore a former flag manually after an incident, without changing the existing all-at-once update procedure.
- Push the source flag to all EC2 nodes using an AWS Systems Manager State Manager association, treating association compliance as equivalent to application-health alarm rollback.
- Use AWS CodeDeploy blue/green traffic shifting to replace the EC2 application fleet for every flag edit, without adding AppConfig configuration validators.
Explanation
Correct Answer
A:AWS AppConfig can validate a configuration profile sourced from Parameter Store, perform gradual deployments, monitor the environment's configured CloudWatch alarms, and roll back a problematic deployed value. Because these EC2 applications already fetch through AppConfig Agent, the service can distribute a safer configuration version without introducing a new configuration retrieval path or redeploying application binaries. The environment must have suitable permissions to monitor the alarms.
Incorrect Answers
B:Parameter Store version history can support manual restoration but is not itself a managed gradual configuration deployment with schema validation and automatic CloudWatch-alarm rollback. All-at-once changes retain the original outage risk.
C:State Manager can distribute and assess instance configuration, but its association compliance is not a substitute for AppConfig configuration validation, phased deployment and rollback triggered by a checkout-error CloudWatch alarm.
D:CodeDeploy can shift application traffic during blue/green deployments and use alarms for application release rollback. It does not replace AppConfig freeform configuration validators, and replacing application instances for a flag update violates the no-binary-redeployment constraint.
Question 426
A travel booking API must return seat-search results quickly, but emailing confirmation after purchase can take minutes. The current handler waits for email service completion and causes client timeouts. What decoupling change fits?
- Disable booking database transactions because that makes the email service complete instantly.
- Enqueue email work using SQS and process it with separate workers after committing the booking.
- Keep the email call synchronous and increase the browser timeout to several minutes.
- Store notification jobs only as local variables in the API handler after it has returned.
Explanation
Correct Answer
B:Durable asynchronous work allows the API to return its primary transaction result without waiting on a slow independent notification dependency.
Incorrect Answers
A:Removing transaction safeguards threatens purchase correctness and does not remove email service latency.
C:Long blocking requests couple availability to an ancillary service and undermine the fast API response requirement.
D:Process memory is not a durable background job queue and may disappear after the response or instance restart.
Question 427
A batch worker Auto Scaling group consumes SQS messages. Product traffic increased tenfold, but the web tier still uses fast cached responses and low CPU. Worker queues are growing. Which target tracking input best scales the worker fleet?
- Match worker desired capacity to the number of public ALB listeners, regardless of backlog.
- Scale all web instances by five and leave worker count fixed because producers drain queues automatically.
- Use SQS backlog per running worker or a latency-aligned queue metric, rather than frontend request counts alone.
- Use only queue retention duration as the scale signal, because it rises automatically when traffic spikes.
Explanation
Correct Answer
C:The correct feedback loop measures outstanding queued work and worker throughput so the asynchronous tier scales independently of HTTP frontend behavior.
Incorrect Answers
A:Listener count is largely static and does not represent actual background processing demand.
B:Increasing producing capacity does not guarantee additional queue consumption and can worsen the backlog.
D:Configured retention is a policy setting rather than an operational measure of messages awaiting work.
Question 428
A storefront has web API requests increasing during flash sales while nightly report workers run an unrelated SQS backlog. The architect wants both components to scale independently without one tier's demand forcing arbitrary expansion of the other. How should scaling be organized?
- Tie background worker count permanently to the number of DNS records in the public hosted zone.
- Disable workers during peak web traffic so they cannot affect Auto Scaling decisions.
- Scale both tiers only on the average CPU of a single frontend instance, regardless of queue state.
- Use separate Auto Scaling policies and workload-specific signals for frontend servers and background consumers.
Explanation
Correct Answer
D:Independent tiers should react to their own useful metrics, such as request load for web nodes and backlog/processing age for workers.
Incorrect Answers
A:DNS record count has no direct relationship to job throughput or frontend load.
B:Shutting off a needed tier worsens processing backlog and is not a resilient independence strategy.
C:One frontend metric cannot reliably reflect asynchronous worker demand or the different resource profiles of both tiers.
Question 429
An Auto Scaling group repeatedly launches replacement EC2 workers after Spot interruptions. Current replacements require an operator to install packages and copy code, causing minutes of inconsistent behavior. What should be standardized?
- Disable health checks on all workers to avoid triggering replacements that require configuration.
- Depend on SSH changes made on the previously terminated instance to appear automatically on future instances.
- Use a versioned launch template with a reproducible AMI and bootstrap process so replacement workers initialize consistently.
- Store only the current operator's terminal history in S3 and expect it to configure worker capacity at launch.
Explanation
Correct Answer
C:Launch templates define repeatable instance settings and support immutable worker construction, reducing manual drift after scale-out or replacement.
Incorrect Answers
A:Disabling replacement hides unhealthy capacity instead of repairing the inability to build consistent servers.
B:Replacement instances do not inherit ad hoc runtime changes unless those changes were captured in a reproducible image or bootstrap.
D:Shell history is not a tested software delivery or instance configuration workflow.
Question 430
An Auto Scaling group terminates worker nodes as queue depth falls. Some nodes are still finishing long database imports and need a controlled drain before termination. Which feature can hold termination while cleanup occurs?
- Use an EC2 Auto Scaling lifecycle hook to perform supported drain or cleanup actions before termination completes.
- Set the instance's EBS volume type to gp3, which pauses any Auto Scaling termination until database imports finish.
- Use only an ALB listener priority value to delay all instance termination events for an unlimited time.
- Disable CloudWatch Logs because log delivery is the cause of premature Auto Scaling termination.
Explanation
Correct Answer
A:Lifecycle hooks can pause the termination progression while external logic completes bounded cleanup, reducing interruption to in-flight work.
Incorrect Answers
B:Volume performance selection does not provide an Auto Scaling lifecycle wait/heartbeat mechanism.
C:Listener routing priorities do not govern instance shutdown lifecycle waits or worker job completion.
D:Logging is unrelated to the missing lifecycle drain control and disabling it removes diagnostics.
