AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 7
Question 60
A platform network requires central stateful inspection of selected VPC traffic flows, including protocol-aware policies. Existing security groups are not sufficient for the mandated centralized inspection path. Which architecture meets the requirement?
- Set every instance security group to allow all traffic and use DNS names as the only security control.
- Use an S3 gateway endpoint as a stateful firewall for arbitrary TCP destinations.
- Create an Amazon CloudFront distribution for VPC-to-VPC east-west packets and inspect its HTTP cache headers.
- Deploy AWS Network Firewall endpoints in an appropriate inspection topology and update routing so the required flows actually traverse them.
Explanation
Correct Answer
D:AWS Network Firewall provides managed stateful inspection capabilities when correctly placed in VPC routing paths. Route tables and symmetrical traffic handling are essential so the intended flows are inspected.
Incorrect Answers
A:Allow-all security groups expand access and fail the centralized stateful inspection requirement. DNS names do not replace packet authorization.
B:S3 gateway endpoints provide private service routing for eligible object API traffic; they are not general-purpose network firewalls.
C:CloudFront is an HTTP content delivery service, not a VPC packet inspection appliance for private east-west routes.
Question 61
A company must keep recoverable copies of selected S3 objects in a separate AWS Region. The copies need to be maintained automatically for newly written source objects, and compliance requires appropriate encryption and replication permissions. Which design is most fitting?
- Configure S3 cross-Region replication for eligible source/destination buckets, with versioning and required replication/IAM/KMS settings.
- Put both copies in separate folders of the same single-Region bucket and call that cross-Region resilience.
- Configure an RDS read replica for the S3 bucket because relational replication automatically copies S3 object versions.
- Put an ALB in front of the source bucket and depend on request retries to copy objects into another Region.
Explanation
Correct Answer
A:S3 replication supports ongoing object copying under configured rules, with source and destination versioning and suitable permissions. SSE-KMS objects require the corresponding key-access configuration; historical objects may require a separate replication approach.
Incorrect Answers
B:Two prefixes within one regional bucket do not create independent Region-level object copies for a regional disaster.
C:An RDS read replica applies to supported relational databases, not a cross-Region S3 object replication configuration.
D:Load balancing and retries affect request delivery, not a persistent replication rule that creates separately stored object versions in another Region.
Question 62
An enterprise runs eligible EBS, EFS and RDS resources in several accounts. It wants centrally governed backup frequency, retention and copy policies instead of separate scripts for each resource type. Which managed approach should it use?
- Use CloudFront origin groups to produce database snapshots and block-volume backups on an hourly schedule.
- Set one EC2 Auto Scaling desired-capacity value and treat instance replacement as an immutable backup.
- Build AWS Backup plans and organizational policies for supported resource types and validate vault, IAM, copy and restore requirements.
- Use SQS message retention as the retention control for EFS file system versions and RDS snapshots.
Explanation
Correct Answer
C:AWS Backup supplies centralized schedules, retention, vault policies and supported cross-account or cross-Region copy workflows. Restore testing and supported-resource eligibility must be verified.
Incorrect Answers
A:CloudFront origin groups help content failover for supported origins; they do not schedule EBS, EFS and RDS backup jobs across accounts.
B:Auto Scaling can replace compute nodes but does not preserve stateful database or file contents as recovery points.
D:SQS retention governs queue messages, not database snapshot or filesystem backup retention for unrelated storage services.
Question 63
A web service accepts image uploads and invokes a thumbnail function. Image transformation can take several seconds, but the upload request should return quickly while processing continues. A durable failure-handling path is also needed. Which invocation pattern should the team evaluate?
- Have the browser synchronously wait for the entire thumbnail operation inside the initial response path.
- Invoke the Lambda function asynchronously, and configure suitable destinations or a DLQ/error-handling mechanism for failed events.
- Use Route 53 weighted DNS records to execute image-processing code in the background.
- Increase the frontend TCP keepalive interval until asynchronous invocations are no longer necessary.
Explanation
Correct Answer
B:An asynchronous invocation lets the caller submit the event without waiting for the function's result. The application must account for eventual processing, retries, duplicate events and configured failure destinations.
Incorrect Answers
A:Synchronous invocation couples the user-visible upload latency and availability to the transformation duration; it conflicts with the stated fast acknowledgment goal.
C:Route 53 DNS policies choose destinations for clients and do not invoke Lambda application logic or persist transformation tasks.
D:TCP keepalive settings affect idle network connections, not whether backend work is decoupled from a synchronous client request.
Question 64
A worker receives jobs from an SQS queue. Most jobs succeed, but one malformed payload fails on every retry and repeatedly blocks useful work. The architect wants bounded retries and a place to investigate the bad message without losing it. Which change is best?
- Set the main queue's retention period to zero and discard all jobs immediately after receipt.
- Increase the Lambda timeout indefinitely so the permanently malformed message cannot be received again.
- Create a CloudFront cache policy to stop queue delivery to the failing consumer.
- Configure an SQS dead-letter queue with a redrive policy and a suitable maxReceiveCount, then investigate failed messages.
Explanation
Correct Answer
D:An SQS DLQ separates messages that have exhausted configured delivery attempts. The team can inspect payloads, correct producers and safely redrive appropriate items without an endless main-queue poison loop.
Incorrect Answers
A:Discarding all messages would lose valid work, and an excessively short retention policy does not isolate malformed payloads for diagnosis.
B:Longer execution time does not fix invalid input. It would consume compute and delay useful work while the same payload continues failing.
C:CloudFront cache behavior governs HTTP content, not SQS redrive, receive count or worker failure processing.
Question 65
A small internal reporting system can remain unavailable for up to eight hours after a regional disaster and may lose up to several hours of recent changes. The company wants the lowest standing cost and does not need a running secondary environment. Which DR pattern fits?
- Use tested cross-Region backup-and-restore procedures with documented recovery steps, retention and restoration timing.
- Run a fully active-active stack in two Regions at all times regardless of the stated cost priority.
- Create a single-AZ EBS volume in the primary Region and call it a Region-independent backup.
- Use CloudFront caching as the only mechanism for restoring database writes after a regional disaster.
Explanation
Correct Answer
A:Backup-and-restore can minimize continuously running recovery capacity when the allowed RTO/RPO are measured in hours. The team must validate copied backup availability and full restoration duration.
Incorrect Answers
B:Active-active delivers stronger availability but incurs larger standing infrastructure and data synchronization cost than the stated recovery target requires.
C:A volume in one primary Region shares the regional disaster risk and is not a separate recoverable cross-Region backup strategy.
D:Cached HTTP responses cannot reconstruct authoritative database writes or provision a complete application recovery stack.
Question 66
Private application instances operate in three Availability Zones. All three private route tables currently send internet-bound traffic to one NAT gateway in a single AZ. Security accepts internet egress but requires resilience to the loss of any one AZ. Which change is most appropriate?
- Remove NAT completely and attach an internet gateway directly to private instances without public addresses.
- Place an NAT gateway only in a single standby subnet but preserve all routes to the existing AZ.
- Deploy regional CloudFront edge locations inside each VPC subnet as NAT replacements.
- Use a NAT gateway in each serving AZ and route private subnet egress to its local gateway, with appropriate resilience tests.
Explanation
Correct Answer
D:Zonal NAT gateways with local-AZ routes reduce dependency on another AZ's NAT service and avoid unnecessary cross-AZ egress hops. Public routing and gateway-endpoint options still need consideration.
Incorrect Answers
A:Private instances without public reachability cannot automatically use an internet gateway as NAT; the gateway does not translate their private IPv4 source addresses.
B:Keeping all active routes pointed to a gateway in a single AZ preserves the current failure domain even if another gateway exists but receives no traffic.
C:CloudFront is an edge content delivery service, not a subnet-level outbound source-NAT facility for arbitrary private-instance traffic.
Question 67
A scientific simulation runs distributed compute jobs that read and write many large files concurrently. The jobs require a POSIX-style high-throughput parallel file system and can use S3 for durable dataset exchange. Which AWS storage service is suited to this pattern?
- Use SQS FIFO as the filesystem because message order guarantees POSIX locking.
- Use Amazon FSx for Lustre with appropriate deployment and integration settings for the HPC data path.
- Use S3 Glacier Deep Archive as a mounted microsecond-access filesystem for active simulation scratch files.
- Use an RDS instance as a shared NFS file server without any additional service configuration.
Explanation
Correct Answer
B:FSx for Lustre is designed for high-performance parallel file access and can integrate with S3 for supported data movement patterns, making it a strong fit for HPC/ML compute jobs.
Incorrect Answers
A:FIFO queue ordering is not file-system concurrency, byte-range I/O or POSIX file semantics for a distributed compute job.
C:Deep Archive storage requires object restore workflows and cannot provide low-latency concurrent scratch-file I/O to an HPC cluster.
D:RDS provides relational database APIs, not a managed Lustre-compatible parallel filesystem mounted by compute nodes.
Question 68
A high-performance EC2 analytics worker produces temporary intermediate files that are always reproducible from durable S3 inputs. The files require very low latency and can be lost when the worker host fails. Which storage option is reasonable for compatible instance types?
- Use instance-store NVMe/local disks as ephemeral scratch space, persisting only necessary final artifacts to durable storage.
- Put temporary hot data into S3 Glacier Deep Archive before each processing step.
- Use Route 53 DNS records as a low-latency block device for each intermediate file.
- Buy RDS Multi-AZ storage for every worker and make the DB instance filesystem the compute scratch device.
Explanation
Correct Answer
A:EC2 instance store can offer host-local temporary high-I/O storage where supported, but data can disappear on stop, termination or host failure. Reproducible intermediates make that tradeoff acceptable.
Incorrect Answers
B:Deep Archive is intended for very cold object retention with restore time; it is unsuitable for active low-latency scratch files.
C:DNS records map names to data and do not expose a local writable filesystem or block storage for intermediate analytics files.
D:RDS relational storage is not an exposed per-worker scratch volume, and a dedicated Multi-AZ database for ephemeral files adds unnecessary architecture and cost.
Question 69
A Lambda function performing image transformations is consistently CPU-bound. Profiling shows that increased memory would fit the budget and the function needs more CPU capacity per invocation to reduce execution time. Which tuning change should be tested?
- Increase the SQS message retention period without changing the Lambda execution configuration.
- Increase only CloudWatch Logs retention and assume the processor receives more CPU time.
- Test higher Lambda memory settings, which also allocate proportionally more CPU resources, and measure latency/cost.
- Set function reserved concurrency to zero to increase execution parallelism.
Explanation
Correct Answer
C:Lambda CPU allocation scales with configured memory. Increasing memory can shorten CPU-heavy execution; performance testing should compare the total request cost and latency at candidate settings.
Incorrect Answers
A:SQS retention affects how long messages remain in a queue, not the CPU allocation of an executing Lambda function.
B:CloudWatch Logs retention affects stored observability records. It cannot assign additional processor capacity to a Lambda invocation.
D:Reserved concurrency zero throttles all invocations; it does not add per-invocation CPU or improve execution time.
Question 70
A team runs containerized scheduled jobs on ECS but no longer wants to patch, scale or maintain an EC2 worker fleet. Jobs need standard container semantics and per-task resource sizing. Which ECS compute model should it choose?
- Replace all container tasks with CloudFront Functions despite long-running job requirements.
- Move task placement to AWS Fargate and size supported CPU/memory combinations without managing EC2 hosts.
- Use EBS snapshots as the container scheduler and keep each EC2 worker always running.
- Increase the S3 multipart upload threshold so ECS automatically eliminates cluster hosts.
Explanation
Correct Answer
B:Fargate supplies serverless task compute for ECS, allowing teams to run supported containers without managing host instances, while still configuring networking, roles and task resources.
Incorrect Answers
A:CloudFront Functions handle lightweight edge request transformations and are not a drop-in runtime for regular ECS container jobs.
C:Snapshots back up block volumes; they do not place container tasks or remove responsibility for an EC2 cluster.
D:S3 upload configuration has no control over whether ECS services or jobs use EC2 or Fargate capacity providers.