AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 45
Question 440
A private service's DNS discovery record continues directing clients to an instance after the service has stopped responding. The provider supports health-aware discovery. Which mechanism should the architect examine?
- Delete all healthy service records and preserve only the failed instance's DNS address.
- Change EBS IOPS only, which updates Cloud Map DNS health status without any discovery integration.
- Configure appropriate service-discovery health checks or health status integration so unhealthy endpoints are excluded.
- Increase every service record's TTL to twenty-four hours so clients keep using failed addresses longer.
Explanation
Correct Answer
C:Discovery health information can remove failing targets from eligible responses, provided the checks and client caching behavior are designed correctly.
Incorrect Answers
A:Publishing only a broken endpoint defeats the objective of steering callers to viable service members.
B:Volume performance settings do not establish service health for DNS registration or endpoint selection.
D:Longer stale DNS caching generally delays removal of unhealthy endpoints and worsens failed connection attempts.
Question 441
Several payroll microservices call one another inside a VPC. A team proposes public internet DNS records and public IPs for every internal RPC endpoint solely to make naming easier. What is the more secure naming approach?
- Disable security groups entirely so private names can resolve across unrelated public networks.
- Use internal service discovery or a private hosted zone with private network connectivity between the services.
- Expose every service publicly with no authentication because DNS does not affect the confidentiality of RPC traffic.
- Use publicly hosted S3 websites as the control plane for all private TCP microservice routing.
Explanation
Correct Answer
B:Private discovery keeps east-west service addresses within intended network boundaries while avoiding unnecessary internet-facing endpoints.
Incorrect Answers
A:DNS resolution and packet authorization are separate; unrestricted security groups weaken segmentation rather than fix discovery.
C:Public exposure adds an unnecessary attack surface and does not replace authenticated service-to-service access.
D:Static websites do not provide private service discovery for running RPC endpoints.
Question 442
Two ECS services in separate VPCs each register names into private namespaces. Their teams add private DNS records, but cross-VPC calls still fail because no routing path exists. What must the solution include?
- Provide suitable cross-VPC network connectivity and resolver/namespace association so naming and reachability both work.
- Increase the private hosted zone's record count; DNS records automatically establish routes between all VPCs.
- Convert the endpoint name to uppercase to trigger AWS internal network peering.
- Remove all ECS task security groups and rely on the private DNS name to authorize any source VPC.
Explanation
Correct Answer
A:Service discovery names do not create network routes. VPC peering, Transit Gateway or other allowed paths and DNS settings must align with the endpoint placement.
Incorrect Answers
B:Name resolution cannot replace route tables, security policies or an inter-VPC transport path.
C:Case changes in DNS labels do not provision connectivity or security permissions between VPC networks.
D:DNS names do not enforce network permission, and a missing inter-VPC connection persists regardless of group rules.
Question 443
A media workflow continuously polls an S3 bucket every fifteen seconds to detect new image uploads. Scans are costly, and objects should be transformed shortly after arrival. Which event-driven arrangement fits?
- Enable S3 Versioning only and assume object creation automatically triggers the image processor with no notification rule.
- Move all images into EBS snapshots, which are automatically sent as Lambda S3 event payloads.
- Configure suitable S3 object-created notifications to SQS, Lambda or EventBridge, then process events asynchronously.
- Keep frequent ListObjects scans and increase their rate to one per second to improve cost efficiency.
Explanation
Correct Answer
C:Object event notifications decouple ingestion from transformation and avoid repeatedly enumerating an entire bucket for new files.
Incorrect Answers
A:Version history does not itself deliver events to a worker or establish a target invocation path.
B:EBS snapshots are block backups and do not directly implement bucket object-created notification delivery.
D:More polling raises request work and does not create the managed event mechanism requested.
Question 444
An S3 event-driven worker extracts metadata into DynamoDB. Under load, two notifications for the same object version sometimes arrive, and the update can be processed out of order. What should the consumer design assume?
- Disable DynamoDB conditional writes because checks interfere with the exact-once guarantee from S3.
- Assume S3 notifications always occur exactly once in upload order and remove deduplication from the table write.
- Increase S3 bucket size limits, which ensures each event is delivered in strict chronological order.
- Treat S3 notifications as potentially duplicate and non-globally ordered; use object identity/version and idempotent updates.
Explanation
Correct Answer
D:Object notifications can be delivered more than once, and arrival order is not an end-to-end transaction ordering guarantee across all object changes.
Incorrect Answers
A:Removing conditional consistency safeguards makes repeated or out-of-order events more dangerous, not less.
B:At-least-once behaviors and possible reorderings make blindly applying updates vulnerable to duplicated or stale records.
C:Bucket storage capacity does not control the ordering or uniqueness of asynchronous notification delivery.
Question 445
An object-created S3 notification should launch a PDF parser only for keys under incoming/ that end in .pdf. Photos and unrelated files must not waste parser capacity. What should the rule use?
- Add a Lambda event-source filtering configuration directly to the S3 notification, treating it as an SQS/Kinesis stream event-source mapping.
- Keep an unfiltered S3 object-created notification and let the Lambda handler discard non-PDF files after each invocation begins.
- Create an EventBridge rule that matches the incoming/ prefix but never tests the .pdf suffix before invoking the parser.
- Use compatible S3 event notification key prefix and suffix filters for incoming/ and .pdf.
Explanation
Correct Answer
D:S3 supports event filter rules on object-key naming patterns, allowing selected file types or prefixes to invoke the processor.
Incorrect Answers
A:S3 invokes supported notification targets directly and uses its own object-key prefix/suffix filters. Lambda event-source mapping filters are configured for supported polled streams and queues, not as a replacement for S3 event notification key filters.
B:Application-side filtering can avoid heavy parsing work but still invokes the function for every unrelated upload. Prefix and suffix event filters avoid the unnecessary invocations required by the scenario.
C:EventBridge can route S3 events, but a prefix-only match still sends non-PDF uploads from that folder. The scenario requires filtering on both the destination prefix and filename suffix; the S3 notification filter provides both directly.
Question 446
An S3-triggered image converter writes its outputs into the same prefix that generates ObjectCreated events. One processed image causes another invocation and the process repeats. What prevents the notification loop?
- Write outputs to a nontriggering bucket/prefix or configure matching event filters and processing guards.
- Extend the S3 lifecycle expiration to ten years, which prevents newly created outputs from firing events.
- Enable multipart uploads for every output; multipart completion can never trigger an S3 object-created notification.
- Increase Lambda reserved concurrency without changing input and output event scope.
Explanation
Correct Answer
A:When a processor writes back into its own trigger scope, each result becomes new input. Separating output paths and idempotency avoids recursive processing.
Incorrect Answers
B:Retention rules do not suppress notifications generated when a matching object is created.
C:Completed multipart object creation is eligible for object-created event delivery, so this is not a safe loop guard.
D:More concurrent executions can accelerate a recursive invocation storm instead of stopping the event feedback loop.
Question 447
A customer profile table updates frequently in DynamoDB. A search-index service currently scans all rows every minute to discover what changed. Which change-feed capability avoids full scans?
- Use an S3 transfer job to copy the entire table after each write, without considering incremental updates.
- Enable DynamoDB Streams and process the relevant item-change records.
- Add a DynamoDB global secondary index and assume it emits a durable ordered event on every item change automatically.
- Increase the table read capacity and continue scanning all items for every update.
Explanation
Correct Answer
B:Streams expose ordered change records within their ordering scope so consumers can incrementally update downstream indexes.
Incorrect Answers
A:Full exports are heavyweight and do not provide a low-latency stream of item changes to consumers.
C:Indexes accelerate queries; they are not a stream-consumer mechanism for event-based change propagation.
D:More read throughput reduces throttling but preserves wasteful full-table change detection.
Question 448
A DynamoDB Streams consumer Lambda receives changes in large batches, but the downstream HTTP service can process only a small number concurrently. Repeated batch failures create retry storms. Which integration controls should the team adjust?
- Disable DynamoDB Streams and use full table scans on every HTTP request, because scans offer automatic backpressure.
- Increase batch size without limit while leaving the constrained downstream HTTP service unchanged.
- Tune the Lambda event-source mapping batch, concurrency and failure-handling settings to match downstream capacity.
- Disable all Lambda error reporting so batch retries are counted as successful automatically.
Explanation
Correct Answer
C:DynamoDB Streams event-source mapping controls how records are batched and retried. Downstream capacity and idempotency must guide configuration.
Incorrect Answers
A:Direct scans can increase load and do not provide the intended controlled event-driven stream consumption.
B:Bigger failed batches can amplify retry work and pressure on a service with fixed request capacity.
D:Hiding failures does not establish correct stream processing or preserve changed record delivery.
Question 449
A DynamoDB Streams client assumes all changes from unrelated partition keys have one global order. It receives events from two independent keys in a different interleaving than wall-clock timestamps. Which ordering guarantee is safer to design around?
- Preserve ordering expectations for changes to a given item or key while avoiding assumptions of global cross-shard ordering.
- Sort all events by Lambda invocation start time and treat that as the authoritative commit order for every partition.
- Disable read consistency checks on the source table so stream records acquire a total order across shards.
- Assume DynamoDB Streams guarantees one total order across every key in every shard and Region.
Explanation
Correct Answer
A:Stream partitioning/shards do not create one transaction-ordered sequence across unrelated keys. Consumers should model the supported per-key order.
Incorrect Answers
B:Invocation scheduling adds its own delays and cannot reconstruct a guaranteed global database commit sequence.
C:Read-consistency settings do not change the fundamental partitioned change stream ordering contract.
D:A globally serialized history of unrelated keys is stronger than the service's applicable ordering guarantees.
Question 450
A DynamoDB Streams-driven Lambda commits a search-index update, then times out before its event batch is acknowledged. Later the same records are retried. How should the search-index update behave?
- Delete the source DynamoDB table after each batch to prevent event retries.
- Treat each retried stream record as a brand-new change requiring another irreversible counter increment.
- Use idempotent index operations and a replay-aware failure strategy for retried stream batches.
- Assume exactly-once search-index commits are guaranteed merely because DynamoDB Streams retains sequence numbers.
Explanation
Correct Answer
C:Stream event-source mappings may retry failed batches; updates should converge correctly even if a record is processed again.
Incorrect Answers
A:Deleting production data is not an event replay control and introduces far more serious data loss.
B:Blind duplicate increments can corrupt derived state when the original effect already committed before timeout.
D:Sequence information supports tracking but does not atomically coordinate the downstream index commit and Lambda batch acknowledgement.
