AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 61
Question 600
An application performs nightly backups, but data corruption may go unnoticed for 21 days. The current backup lifecycle deletes every recovery point after seven days. Which adjustment meaningfully changes the recovery capability?
- Double the CPU allocation of the backup monitoring instance while keeping seven-day retention.
- Enable more frequent backups but keep only the latest seven days of recovery points.
- Rely solely on an application health check that is green after the latest backup.
- Extend backup retention beyond the plausible detection window, accounting for policy and restore-point frequency.
Explanation
Correct Answer
D:Recovery requires a usable restore point from before corruption. A seven-day horizon cannot provide one for a 21-day undetected problem.
Incorrect Answers
A:Monitoring CPU capacity does not preserve older clean data when recovery points already expired.
B:Higher frequency within the same short history does not recover data from before a 21-day-old corruption event.
C:Availability checks can succeed while corrupted logical records remain undetected in every retained backup.
Question 601
A ransomware exercise assumes the production account and its runbooks may become unavailable. Backups exist in a dedicated recovery account, but the only restore operator and the restore instructions depend on production IAM access. What improves independent recovery?
- Provide tightly controlled break-glass access and tested restore procedures in the separate recovery account.
- Grant the production deployment role unrestricted access to both accounts and use it exclusively for restores.
- Store the only backup encryption-key recovery instructions on an EC2 root volume in production.
- Keep backup controls unchanged and shorten the period between production EC2 health checks.
Explanation
Correct Answer
A:Independent recovery requires usable restore identity, vault/key permissions and instructions outside the compromised production trust boundary.
Incorrect Answers
B:An attacker who compromises production deployment credentials could then control the purportedly isolated recovery route.
C:Loss or compromise of that volume would also remove the steps needed to recover encrypted data.
D:Health checks do not address the missing independent recovery identity or runbook dependency.
Question 602
A nightly invoice enrichment job currently runs on a single EC2 instance in one Availability Zone. Each invocation needs less than three minutes, holds no local state, and has unpredictable arrival times. Which design removes the single-host execution dependency with minimal server operations?
- Keep the same EC2 instance but enable detailed CPU monitoring.
- Run the stateless job as AWS Lambda functions invoked by an appropriate regional event source.
- Move the EC2 instance into a public subnet without deploying any second worker.
- Store the worker's user data in a cross-Region S3 bucket and retain the sole worker EC2 instance.
Explanation
Correct Answer
B:Lambda supplies managed regional invocation capacity for short stateless code, removing the need to maintain one zonal worker host.
Incorrect Answers
A:Metrics reveal failure but do not eliminate the single-instance execution dependency.
C:Public routing does not give a single instance redundant compute capacity or replace a failed host.
D:Replicated configuration is useful but a still-single worker cannot process jobs during host failure.
Question 603
A team moves all application code from an EC2 fleet to Lambda, then claims that a single-AZ self-managed PostgreSQL instance is now highly available. An AZ failure still removes the DB writer. What is the necessary architecture correction?
- Raise Lambda memory limits while leaving the sole database host unreplicated.
- Use a larger Lambda function timeout and assume transactions survive database AZ loss.
- Make the database tier independently resilient, such as with a supported Multi-AZ database deployment or tested failover design.
- Add a second API Gateway stage name without changing the database topology.
Explanation
Correct Answer
C:Lambda's regional execution availability does not create a surviving DB writer in a different AZ; availability must cover every critical dependency.
Incorrect Answers
A:More execution memory can improve function performance but cannot make lost database storage available.
B:Timeout changes do not restore the database or satisfy application consistency requirements.
D:An additional stage is configuration, not database redundancy.
Question 604
A Lambda function invokes a third-party payment endpoint. During transient network failures the function times out, and some requests are retried while earlier payments may already have succeeded. What should the design add?
- Retry indefinitely with no timeout and a fresh payment identifier for each attempt.
- Treat any Lambda service invocation as exactly-once execution and remove application deduplication.
- Increase the function's log retention and assume the destination will deduplicate automatically.
- Bounded retries with backoff and a durable idempotency key recognized by the payment operation.
Explanation
Correct Answer
D:Retries recover transient errors, while an idempotency key protects a payment from duplicate side effects when the earlier outcome is uncertain.
Incorrect Answers
A:Unbounded retries amplify outages and new identifiers can create duplicate charges.
B:A managed invocation service does not promise exactly-once external effects for arbitrary integrations.
C:Logs help investigate failures but cannot enforce uniqueness in an external payment API.
Question 605
An S3 event can be delivered more than once to a Lambda thumbnail generator. Duplicate events occasionally cause two workers to overwrite the same image metadata. Which design handles the delivery characteristic?
- Make processing idempotent using the object version/event identity and an appropriate conditional write or deduplication record.
- Depend on S3 event notifications being strictly one-time and globally ordered.
- Disable Lambda retries but continue to perform nonconditional overwrites on every event.
- Give the Lambda execution role administrator privileges to prevent duplicate notifications.
Explanation
Correct Answer
A:S3 event notifications are at-least-once; explicit idempotency and durable conditional state keep repeated deliveries from creating inconsistent results.
Incorrect Answers
B:S3 event notification delivery is not an exactly-once global serialization mechanism.
C:Retry suppression cannot prevent duplicate initial deliveries or overlapping invocations.
D:Authorization breadth does not change asynchronous event delivery semantics.
Question 606
A ticketing site writes orders directly into a batch analytics worker. When workers are offline for maintenance, API clients receive permanent failures and transaction details are discarded. What change best decouples acceptance from processing?
- Increase the failed analytics worker's root-volume size while keeping the API's synchronous dependency.
- Accept requests into a durable Amazon SQS queue and process them asynchronously with retriable consumers.
- Put a CloudFront cache in front of the order-submission POST endpoint and cache prior responses.
- Change the API DNS TTL from 60 seconds to one second without any store-and-forward layer.
Explanation
Correct Answer
B:The queue preserves accepted work while consumers are unavailable, provided retention, admission and idempotency are designed for the outage.
Incorrect Answers
A:Additional disk space does not preserve incoming requests when the worker cannot accept them.
C:Caching mutable write requests is not a durable work buffer and can misrepresent whether new orders were accepted.
D:DNS refresh does not hold user transactions during worker downtime.
Question 607
A container worker processes messages from an SQS Standard queue. Most jobs finish in two minutes, but some valid jobs need forty minutes. The queue uses a five-minute visibility timeout, so slow jobs become visible and are processed concurrently by another worker before the first deletes them. The team wants a bounded, failure-recoverable method rather than a fixed 12-hour timeout for every message. What should the consumer do?
- Increase only the queue message retention period to fourteen days; retention automatically holds received messages invisible until processing finishes.
- Disable acknowledgements and rely on SQS Standard to guarantee exactly-once processing no matter how long a message is visible.
- Use a realistic initial visibility timeout and periodically call ChangeMessageVisibility while the job is healthy, then delete the message on success and keep the handler idempotent.
- Set the SQS delivery delay to its maximum and assume it extends the visibility of messages already being processed by the worker.
Explanation
Correct Answer
C:ChangeMessageVisibility can extend an individual message’s invisibility while work proceeds, avoiding a very long global timeout. The consumer must respect the overall 12-hour receive limit, delete on success and implement idempotency because duplicates remain possible.
Incorrect Answers
A:Message retention determines how long an undelivered or undeleted message can remain in the queue; it is separate from post-receive invisibility and does not prevent duplicate concurrent processing.
B:Standard queues may redeliver, and omitting DeleteMessage does not provide exactly-once processing. It increases retries instead of coordinating long-running consumers.
D:Queue delivery delay affects when newly sent messages first become eligible for delivery. It does not extend the visibility timeout after a consumer receives a message; ChangeMessageVisibility controls that interval.
Question 608
During a regional processor incident, SQS queue depth grows to millions. Workers return after five days, but unprocessed messages approach their retention deadline. Which signals most directly guide catch-up scaling?
- Scale solely from producer EC2 CPU utilization even while the queue backlog grows.
- Only monitor the number of healthy DNS records for the API domain.
- Disable SQS metrics and use a fixed once-a-month manual queue inspection.
- Alarm on ApproximateAgeOfOldestMessage alongside backlog depth and effective consumer throughput, then increase safe processing capacity.
Explanation
Correct Answer
D:Oldest-message age indicates expiration risk while depth and measured drain rate determine whether catch-up can finish before retention expires.
Incorrect Answers
A:Producer CPU does not show how long queued work has waited or whether consumers can clear it.
B:DNS health is unrelated to SQS processing age and expiry risk.
C:Monthly inspection may miss expiration during a multi-day recovery window.
Question 609
A team enables an SQS dead-letter queue for poison messages and calls the entire order-ingest path fault tolerant. The API still crashes when its only load balancer target fails. Which assessment is correct?
- Keep DLQ/redrive controls, but independently make the producer/API path highly available across appropriate failure domains.
- Use the DLQ as a substitute for additional API targets and health-checked routing.
- Reduce maxReceiveCount to one and assume it will repair failures in the API's load balancer.
- Delete the source queue because a DLQ alone is sufficient to durably ingest all requests.
Explanation
Correct Answer
A:DLQs isolate failed consumption attempts; they cannot keep an unrelated single-target producer endpoint accepting new requests.
Incorrect Answers
B:A dead-letter queue has no mechanism to serve HTTP traffic after the only API target fails.
C:Receive-count policy affects consumer retries, not producer compute or routing.
D:A DLQ is not the primary producer queue and is not a drop-in replacement for the request-ingest layer.
Question 610
An SaaS platform alarms only when EC2 CPU exceeds 90%. Customers experience checkout errors while CPU stays at 25% because a third-party authorization dependency is down. Which monitoring design gives meaningful availability signals?
- Raise the EC2 CPU threshold to 100% and keep all other metrics disabled.
- Add CloudWatch alarms for user-facing error rates, request latency and critical dependency failure indicators, with actionable thresholds.
- Monitor the size of the AMI file in S3 as the sole availability indicator.
- Only alert when the next monthly billing invoice increases.
Explanation
Correct Answer
B:Service-level failures can occur independently of host CPU; monitoring must observe the business request path and its dependencies.
Incorrect Answers
A:Changing a utilization threshold still misses failures at low CPU.
C:An image artifact's size does not report live checkout success or authorization latency.
D:Billing data cannot provide timely incident detection for broken customer transactions.
