AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 67
Question 660
A team enables S3 Transfer Acceleration on its EU-region bucket and claims that data is automatically durably replicated to every AWS Region. Which explanation is correct?
- Accelerated object uploads always create simultaneous replicas in every AWS Region with no replication configuration.
- An accelerated bucket URL becomes a multi-writer globally consistent database.
- Turning on acceleration automatically changes all object encryption keys to global multi-Region KMS keys.
- Transfer Acceleration speeds supported transfers to the bucket's existing Region; cross-Region replication is a separate data-placement control.
Explanation
Correct Answer
D:An accelerated endpoint is a transport optimization, not a global replica of the object's authoritative storage.
Incorrect Answers
A:The feature does not provision all-Region S3 copies or replace explicit replication rules.
B:The service remains S3 object storage with its configured bucket Region and replication behavior.
C:Transport acceleration and KMS key configuration are separate settings.
Question 661
A 250-GiB object upload over an unreliable WAN often fails midway. Transfer Acceleration has reduced network time but the client still resends the entire file when interrupted. What should be added?
- Use multipart upload with resumable part retries, potentially together with Transfer Acceleration if performance warrants.
- Send the entire 250-GiB object in one nonresumable PUT after every failure.
- Change S3 bucket public-access blocks to Disabled in order to support multipart retries.
- Shorten all object lifecycle retention to one hour to make intermittent connections reliable.
Explanation
Correct Answer
A:Multipart upload isolates retry work to incomplete parts and improves large-transfer parallelism; acceleration does not replace resumability.
Incorrect Answers
B:A full-request retry repeats all transferred bytes and fails to use multipart recovery semantics.
C:Public exposure is unrelated to correctly authenticated multipart upload calls.
D:Lifecycle retention does not recover partially uploaded bytes.
Question 662
A news website serves the same public S3-hosted static JS and image assets to visitors across continents. Repeated reads to the regional origin dominate latency. Which architecture improves access?
- Make every visitor use an EC2 bastion host in the origin VPC before retrieving public images.
- Serve static assets through Amazon CloudFront with an S3 origin and an appropriate caching policy.
- Store the active JS bundles in S3 Glacier Deep Archive and perform an archive restore for every page view.
- Use a private RDS Proxy endpoint as the CDN origin without hosting the static assets.
Explanation
Correct Answer
B:CloudFront can cache objects at edge locations closer to consumers, reducing repeated long-distance S3 fetches.
Incorrect Answers
A:Bastions add a network hop and are not a distributed public content cache.
C:Deep archive storage is intended for infrequent retrieval, not web asset delivery.
D:A database connection proxy does not distribute HTTP static content to global users.
Question 663
A CloudFront distribution caches a pricing JSON file that changes every ten minutes. The origin accidentally sets a 24-hour max-age, so customers see stale prices. What should be changed?
- Increase the default cache TTL to seven days to make the JSON update faster.
- Enable a larger S3 multipart part size for the pricing JSON.
- Set cache TTL and origin Cache-Control behavior that matches the accepted freshness interval, or version the mutable endpoint.
- Add more Route 53 TXT records until CloudFront automatically ignores Cache-Control.
Explanation
Correct Answer
C:Edge-cache lifetime must reflect update frequency and business tolerance for stale content.
Incorrect Answers
A:Longer TTL keeps old responses at the edge for more time.
B:Multipart size relates to object transfer, not cache invalidation or freshness.
D:Unrelated DNS records do not repair an overly long cache policy.
Question 664
A video service uses a CloudFront distribution with a correctly minimal cache key and long-lived cacheable segments. Its expensive packaging origin still receives nearly simultaneous cache misses for identical segments from many regional edge caches worldwide. The team can pay for an extra cache layer if it reduces redundant origin processing. Which CloudFront feature should it evaluate?
- Increase the CloudFront origin response timeout and expect each edge to share its cache with every other Region.
- Increase the origin-facing HTTP connection timeout and assume it combines distinct regional edge-cache misses for the same object into a single request.
- Disable regional edge caches so every viewer fetches a distinct uncached object directly from the packaging origin.
- Enable CloudFront Origin Shield at a suitable Region for the origin and compare the reduced origin requests with its request charges.
Explanation
Correct Answer
D:Origin Shield is an additional shared origin-facing cache tier that can consolidate duplicate requests across regional edge caches, lowering origin load while adding a charge.
Incorrect Answers
A:A longer origin response timeout changes wait behavior, not centralized cache-miss consolidation across regional edge caches.
B:A longer connection timeout does not consolidate independent misses arriving from multiple regional cache layers. Origin Shield provides the additional shared caching layer for eligible requests.
C:Removing intermediate caching increases origin request load rather than consolidating duplicate segment misses.
Question 665
An emergency revocation removes a malicious JavaScript file from the S3 origin, but CloudFront edges still serve the previously cached file under the same URL. Which release action should accompany the origin update?
- Invalidate the affected CloudFront paths or deploy versioned asset URLs and update references.
- Assume overwriting the origin object immediately erases every cached edge response without any TTL effect.
- Update only the S3 object’s Cache-Control metadata and assume this immediately invalidates previously stored CloudFront edge copies before their current TTL expires.
- Only change the Route 53 SOA record and leave the same cached asset URL in the distribution.
Explanation
Correct Answer
A:An edge cache may retain old bytes until expiration; invalidations or new immutable versioned names replace the served content promptly.
Incorrect Answers
B:CloudFront caches can continue serving previously fetched responses until expiry or invalidation.
C:Origin response headers affect subsequent cache decisions but do not forcibly evict an existing unexpired cached object. An explicit invalidation or versioned asset URL addresses the already-stale edge entry.
D:DNS zone metadata does not clear cached CloudFront object content.
Question 666
An on-premises asset system supports only SMB file shares, but archived documents should live as S3 objects with a local hot-file cache. Which hybrid AWS service is appropriate?
- Deploy an AWS Transit Gateway and treat its attachments as SMB file shares.
- Deploy an AWS Storage Gateway S3 File Gateway with the required SMB file-share configuration and cache capacity.
- Use S3 Select as a Windows SMB server for an unmodified application.
- Use AWS Backup Tape Gateway as the live interactive file mount for every SMB request.
Explanation
Correct Answer
B:File Gateway presents supported file protocols locally while persisting files as objects in S3.
Incorrect Answers
A:Transit Gateway routes networks, not file shares backed by S3.
C:An object query interface does not expose a native SMB file share.
D:Tape Gateway emulates virtual tape workflows, not a general SMB filesystem.
Question 667
A factory application writes to iSCSI block LUNs and cannot be rewritten for object or filesystem APIs. The team wants a hybrid Storage Gateway option that integrates block volumes with AWS-backed data protection. Which type fits?
- Use File Gateway's NFS object interface and claim it exposes the same iSCSI LUN format.
- Choose Tape Gateway because every iSCSI device automatically behaves as a virtual tape library for random database writes.
- Use Storage Gateway Volume Gateway with the appropriate cached or stored volume mode for the iSCSI workload.
- Use an S3 website endpoint and expect it to serve raw iSCSI block requests.
Explanation
Correct Answer
C:Volume Gateway exposes iSCSI block devices and supports cloud-backed volume workflows for legacy block applications.
Incorrect Answers
A:File protocols and block LUN APIs are different and not directly interchangeable.
B:Tape Gateway targets backup tape use cases, not normal application block read/write LUNs.
D:S3 website endpoints serve HTTP content and cannot terminate iSCSI storage protocol.
Question 668
An existing backup application expects a virtual tape library and follows tape rotation/retention procedures. The target is long-term storage integrated with AWS, without changing the backup application's tape API. Which gateway should be evaluated?
- Use File Gateway as the tape changer and assume SMB file shares are recognized as VTL media.
- Use FSx for Lustre and treat parallel POSIX files as a plug-and-play tape drive.
- Replace the virtual tape library with Storage Gateway Volume Gateway iSCSI volumes but do not modify the backup application’s tape-device configuration.
- Use Storage Gateway Tape Gateway to expose compatible virtual tapes to the on-premises backup software.
Explanation
Correct Answer
D:Tape Gateway emulates supported tape workflows and links their media lifecycle to AWS-backed storage.
Incorrect Answers
A:SMB fileshares do not expose the virtual tape changer/device protocol required by the backup tool.
B:Lustre is a parallel filesystem for compute, not a virtual tape library implementation.
C:Volume Gateway presents supported block volumes through iSCSI; that is not a virtual tape changer/cartridge interface. It might suit disk-oriented backup software, but the existing application requires Tape Gateway device semantics.
Question 669
A hospital's on-premises Storage Gateway caches a small portion of S3-backed files. Staff repeatedly request the same hot imaging studies, but each first access after eviction causes long retrieval delays. Which capacity decision improves the local experience?
- Size the gateway cache based on the hot working set and measured access pattern, allowing frequently used data to remain local.
- Decrease cache capacity further and assume uncached S3 reads have the same latency as local SSD.
- Increase the S3 bucket's object-lock retention as the principal fix for cache misses.
- Change the application DNS domain but leave the hot-file cache too small.
Explanation
Correct Answer
A:A sufficiently sized cache avoids repeated remote fetches for frequently accessed files while leaving S3 as authoritative storage.
Incorrect Answers
B:Misses still require remote retrieval and may incur WAN latency.
C:Retention enforcement does not add local cache space.
D:DNS naming does not keep repeatedly used imaging objects resident in gateway cache.
Question 670
A DataSync task moves research data from an on-premises NAS to S3 each night. Auditors require checks that destination objects reflect source content, but engineers have disabled task verification to shorten runs. What should be configured?
- Rely only on an S3 bucket name match as proof that every file byte was copied correctly.
- Select an appropriate AWS DataSync verification strategy and schedule, and monitor task reports for transfer integrity.
- Compare S3 ETags for every transferred object and assume they are always an end-to-end checksum of the original NAS file, including multipart uploads.
- Disable all task logs and assume a successful start request proves the entire transfer completed.
Explanation
Correct Answer
B:DataSync supports verification options; validating transferred content helps expose mismatches that raw copy-count totals miss.
Incorrect Answers
A:A name match cannot establish content fidelity for thousands of transferred files.
C:An S3 ETag is not a universal source-file MD5 checksum, particularly for multipart objects or other configurations. DataSync verification modes validate transferred content using supported checks rather than assuming ETag equality proves every file.
D:Starting a task is not proof that all files passed transfer and verification.