AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 6
Question 50
A multi-AZ analytics application uses an EFS file system. Most files are read intensively for one week and then rarely accessed for months. The business wants to retain a normal shared filesystem interface while lowering cold-data storage cost. What should it evaluate?
- Configure appropriate EFS lifecycle management to move eligible infrequently accessed files into a lower-cost EFS storage class, accounting for access charges.
- Migrate cold files into S3 Glacier Flexible Retrieval, but make no changes to the existing NFS clients or their file access paths.
- Create scheduled AWS Backup recovery points for EFS and shorten backup retention while leaving all live files in the EFS Standard storage class.
- Switch EFS to Elastic throughput mode and rely on the throughput setting to automatically reclassify the old files as infrequently accessed storage.
Explanation
Correct Answer
A:EFS lifecycle management can shift eligible cold files into its infrequent-access tiers while retaining the EFS shared-filesystem model. Retrieval/access charges and latency tradeoffs should be considered.
Incorrect Answers
B:S3 Glacier Flexible Retrieval is an archival object-storage class rather than transparent EFS lifecycle tiering. Its restore and object-access workflow will not keep unchanged NFS mounts serving those files.
C:Backup recovery point retention controls backup copies, not the storage class of cold live files inside the active EFS file system. Its main Standard storage footprint would persist.
D:Throughput mode determines filesystem throughput economics, whereas lifecycle policies decide when eligible file contents transition into EFS IA or Archive. Changing throughput mode alone does not move cold data.
Question 51
A business runs a stable baseline of EC2 services but expects to change instance families, Regions and sometimes use Fargate or Lambda during the next year. It wants a commitment discount with broad eligible compute flexibility. Which pricing option should it assess?
- Purchase a dedicated EC2 capacity reservation in one AZ and assume it automatically discounts all Lambda and Fargate usage.
- Buy an S3 Reserved Storage Plan covering the entire application including compute.
- Move all base services to Spot and ignore the no-interruption production availability requirement.
- Assess Compute Savings Plans against credible baseline spend and commitment utilization, considering their eligible EC2, Fargate and Lambda coverage.
Explanation
Correct Answer
D:Compute Savings Plans can apply to qualifying EC2, Fargate and Lambda usage while providing more configuration flexibility than an EC2 Instance Savings Plan. The commitment still requires adequate forecasted eligible usage.
Incorrect Answers
A:An EC2 capacity reservation protects capacity availability for matching instances, but it is not a general cross-service committed-price discount for Lambda and Fargate.
B:S3 storage pricing does not offer a generic reservation that automatically converts into EC2 and Lambda compute commitments.
C:Spot can reduce cost for interruptible tasks, but it can be reclaimed and is unsuitable as the sole unprotected baseline for a noninterruptible service.
Question 52
A research group needs a handful of EC2 instances for a one-week experiment, with unknown follow-up demand. Its workloads cannot be interrupted, and the group does not want a one-year or three-year spend commitment. Which purchase option is most appropriate?
- Use EC2 On-Demand instances and terminate them when the experiment completes.
- Buy three-year EC2 Reserved Instances for the exact one-week experiment and keep paying regardless of use.
- Use only Spot capacity and assume AWS guarantees each instance will remain uninterrupted for the full week.
- Use an EBS snapshot retention policy as the EC2 purchasing model.
Explanation
Correct Answer
A:On-Demand EC2 provides compute capacity without long-term purchase commitment, making it appropriate for short, uncertain experiments that must not rely on interruptible Spot supply.
Incorrect Answers
B:A long reserved pricing commitment can be economical for steady use, not an isolated one-week test with no reliable ongoing baseline. It introduces unwanted obligation.
C:EC2 Spot capacity may be interrupted by AWS with notice. It does not satisfy a requirement for continuous, guaranteed availability as the only capacity option.
D:EBS snapshot policies manage storage backups. They do not choose or price the instance-hour purchase option for EC2 compute.
Question 53
A payment processor has kept its production RDS instance family and engine size unchanged for two years and expects the same always-on baseline for at least another year. Which approach can lower the instance component of its recurring database bill?
- Move all backups to S3 Intelligent-Tiering and assume it discounts RDS instance hours.
- Evaluate eligible RDS Reserved Instance offerings for the stable usage after comparing commitment terms, coverage and flexibility.
- Switch relational transactions to SQS Standard queues so the database is billed as a queue.
- Double the DB instance size immediately to unlock a universal free capacity tier.
Explanation
Correct Answer
B:RDS Reserved Instances can reduce eligible long-term database instance usage costs where the deployment matches the commitment. The architect should compare term, payment and expected workload stability.
Incorrect Answers
A:S3 storage class choices affect eligible objects, not the purchase model of an RDS database instance's running compute hours.
C:SQS queues do not implement relational transactions or SQL data integrity, and moving payments into messages would not preserve the required database semantics.
D:A larger RDS instance generally increases compute spend. There is no universal rule that doubling capacity makes a database free.
Question 54
A DynamoDB table stores temporary one-time authorization records that should no longer occupy storage after their expiration timestamps. Delayed background deletion is acceptable, but the application will independently reject expired records when reading them. Which option supports this housekeeping?
- Create an RDS automated backup of the table every minute to clear old items.
- Place a CloudFront TTL header on the table's API responses and assume records disappear at that instant.
- Configure DynamoDB TTL on an epoch-seconds expiration attribute and design for asynchronous item deletion.
- Increase DynamoDB read capacity until every expired item is automatically removed on its exact deadline.
Explanation
Correct Answer
C:DynamoDB TTL allows eligible expired items to be removed asynchronously, reducing unnecessary storage and enabling associated stream events where applicable. Application authorization must not assume immediate deletion.
Incorrect Answers
A:RDS backups apply to RDS databases and do not prune items in a DynamoDB table based on individual item expiry timestamps.
B:CloudFront response caching does not delete source DynamoDB items; HTTP cache lifetimes do not enforce database row expiry.
D:Read capacity affects request throughput, not the TTL deletion scheduler. Expired items are not guaranteed to be deleted at the exact timestamp.
Question 55
A project team expects a NAT gateway to cost nothing outside business hours because almost no traffic flows at night. Its estimate includes only per-GB data processing and has no standing-cost line. Which correction should the architect make to the network cost model?
- Include applicable NAT gateway hourly charges as well as data processing and other relevant transfer charges, even when traffic volume is near zero.
- Omit NAT hours because a NAT gateway is priced only when its translation table contains active entries.
- Count only internet data transfer in, because NAT processing and hourly charges are always included in S3 storage fees.
- Replace the NAT cost line with an EC2 Savings Plans estimate because NAT gateway usage is discounted as EC2 compute.
Explanation
Correct Answer
A:A NAT gateway has usage-based data processing charges and a time-based hourly component under normal pricing. Both belong in a realistic cost estimate even if usage is low at night.
Incorrect Answers
B:Low or idle traffic does not automatically stop the NAT gateway billing clock. Leaving the hourly component out understates the cost of keeping it deployed.
C:NAT has its own applicable charges, and internet transfer-in assumptions do not replace accurate NAT time/volume billing.
D:Compute Savings Plans cover eligible compute services, not a universal discount for VPC NAT gateway hourly and data processing charges.
Question 56
A batch service exchanges large volumes of temporary data between two EC2 tiers. Measurements show most data-transfer charges arise from unnecessary cross-AZ hops. Each tier remains redundantly deployed across AZs, and the business permits keeping each producer with a same-AZ consumer. Which change should be prioritized?
- Route all intra-tier traffic through a NAT gateway in a third AZ to centralize billing.
- Use AZ-aware placement/routing so each producer preferentially reaches a local consumer, preserving independent cross-AZ capacity and failover.
- Remove the multi-AZ resilience requirement entirely and run one unprotected host in the cheapest AZ.
- Enable an internet gateway on every instance to exempt cross-AZ data transfer fees.
Explanation
Correct Answer
B:Locality-aware routing and matching application tiers within an AZ can reduce unnecessary cross-AZ bytes while keeping redundant groups deployed elsewhere. The strategy must still support cross-AZ failover.
Incorrect Answers
A:Sending private east-west traffic through a distant NAT gateway introduces extra hops and charges; NAT is not a discount mechanism for inter-AZ data exchange.
C:Eliminating redundant AZ capacity would reduce availability beyond the explicitly permitted change; cost savings must not violate resilience requirements.
D:An internet gateway enables network egress routing; it does not waive AZ transfer billing for EC2-to-EC2 application traffic.
Question 57
An AWS organization contains 40 member accounts. A security administrator must prevent member-account IAM administrators from enabling selected prohibited services, while still allowing each team to manage its own permitted roles. Which organization-wide control best applies?
- Attach an AWS Organizations service control policy that denies the prohibited actions to the applicable accounts or OUs, while retaining ordinary IAM permissions for approved actions.
- Grant an IAM AdministratorAccess policy in every account and assume it overrides organization-wide restrictions.
- Create a CloudWatch Logs subscription filter without changing any authorization policies.
- Add an S3 lifecycle rule to the logging bucket to prevent EC2 launches in member accounts.
Explanation
Correct Answer
A:SCPs set maximum effective permissions for affected organization accounts. They can deny selected actions even when an IAM identity has broad Allow statements; SCPs do not themselves grant remaining allowed actions.
Incorrect Answers
B:AdministratorAccess is still subject to applicable SCP denials. A broad identity policy does not bypass the organization-level permission ceiling.
C:A log subscription can help observe API activity but is not an authorization guardrail that rejects prohibited service operations.
D:An S3 lifecycle rule changes object retention or storage classes; it has no authority to deny EC2 or other service APIs in organization member accounts.
Question 58
A regulated company owns numerous S3 buckets and KMS keys across AWS accounts. Auditors ask it to find resource policies that unintentionally allow external principals, even where no request has yet appeared in access logs. Which AWS capability is best suited?
- Rely only on CloudTrail API events, because unused external permissions always appear as successful requests.
- Use IAM Access Analyzer external access findings to identify supported resources whose policies grant access outside the chosen trust boundary.
- Use Amazon Route 53 health checks on every bucket DNS name to discover external IAM permissions.
- Create a VPC NAT gateway and inspect outbound network addresses instead of resource policies.
Explanation
Correct Answer
B:IAM Access Analyzer analyzes supported resource policies for external-access findings relative to an account or organization zone of trust, helping security teams identify unintended grants before exploitation.
Incorrect Answers
A:Audit logs show activity that occurred; an exploitable resource-policy grant can exist without a caller ever exercising it, so log-only review can miss this configuration exposure.
C:Route 53 health checks test endpoint health for routing decisions, not identity principals or policy grants on S3 and KMS resources.
D:NAT translates private subnet egress traffic and cannot infer whether a bucket or KMS key policy grants an external principal resource access.
Question 59
A customer API hosted on Amazon API Gateway uses a frontend app and short-lived identity tokens. A developer proposes distributing one API key to all customers as the sole proof of who may read private invoices. What should the architect recommend?
- Use only a custom domain name because TLS hostnames authenticate each API customer.
- Put the API key in browser JavaScript and trust it as the authenticated principal for every invoice.
- Choose an API Gateway authorization mechanism appropriate to the API type, such as validated JWT authorizers for HTTP APIs, IAM authorization, or supported Lambda authorizers, and enforce object access in the backend.
- Enable an ALB access log and remove all token or signature validation from the request path.
Explanation
Correct Answer
C:Supported API Gateway authorizers can establish request identity and enforce authorization policy. Backend object-level checks must still verify rights to each invoice before returning it.
Incorrect Answers
A:TLS hostnames establish server identity and secure transport; they do not determine which customer may retrieve a particular invoice.
B:API keys are useful for usage plans and client identification in supported API Gateway arrangements but are not a secure per-user authentication and object-authorization mechanism.
D:Access logging aids investigation but cannot reject unauthorized reads in place of token verification and resource authorization.
Question 60
A platform network requires central stateful inspection of selected VPC traffic flows, including protocol-aware policies. Existing security groups are not sufficient for the mandated centralized inspection path. Which architecture meets the requirement?
- Set every instance security group to allow all traffic and use DNS names as the only security control.
- Use an S3 gateway endpoint as a stateful firewall for arbitrary TCP destinations.
- Create an Amazon CloudFront distribution for VPC-to-VPC east-west packets and inspect its HTTP cache headers.
- Deploy AWS Network Firewall endpoints in an appropriate inspection topology and update routing so the required flows actually traverse them.
Explanation
Correct Answer
D:AWS Network Firewall provides managed stateful inspection capabilities when correctly placed in VPC routing paths. Route tables and symmetrical traffic handling are essential so the intended flows are inspected.
Incorrect Answers
A:Allow-all security groups expand access and fail the centralized stateful inspection requirement. DNS names do not replace packet authorization.
B:S3 gateway endpoints provide private service routing for eligible object API traffic; they are not general-purpose network firewalls.
C:CloudFront is an HTTP content delivery service, not a VPC packet inspection appliance for private east-west routes.
