AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 76
Question 750
An Aurora PostgreSQL-compatible application handles low traffic on weekdays but bursts sharply during a two-hour batch of billing reconciliations. Its current provisioned DB instance is oversized most of the week. The team wants database compute to adjust within an approved min/max range without manually changing instance classes before each burst. Which capability fits?
- Use an S3 Intelligent-Tiering storage-class transition to change Aurora DB CPU capacity every hour.
- Use a supported Aurora Serverless v2 writer or reader with appropriate minimum and maximum ACU capacity configured on the cluster, after verifying engine-version compatibility and performance.
- Create only an additional DNS alias for the same provisioned DB instance and assume DNS scales its memory.
- Raise the Aurora database connection timeout to unlimited values, which provisions CPUs when query throughput grows.
Explanation
Correct Answer
B:Aurora Serverless v2 automatically varies supported DB instance compute capacity in ACUs between configured minimum and maximum values. Version eligibility and workload memory/connection requirements should be checked when selecting the capacity range.
Incorrect Answers
A:S3 object storage transitions have no effect on a running Aurora database instance class.
C:DNS aliases change how a database is addressed, not its CPU and memory allocation.
D:Longer connection timeouts do not allocate additional compute capacity and may worsen contention.
Question 751
A reservation application stores a room-availability item and a separate booking-ledger item in DynamoDB in one AWS Region. A booking must reserve the last room and write the ledger entry atomically; if the conditional availability check fails, neither item may change. Which API design best protects this invariant?
- Issue independent PutItem calls to each item and rely on their arrival order to ensure all-or-nothing updates in concurrent writers.
- Enable DynamoDB global tables and assume multi-Region replication makes unrelated writes in one Region a single atomic business transaction.
- Use a DynamoDB TransactWriteItems request containing appropriately conditioned operations on the separate items, with a client request token for retried attempts.
- Use BatchWriteItem to group the item changes because it guarantees all actions succeed together when a condition fails.
Explanation
Correct Answer
C:TransactWriteItems commits supported writes and condition checks atomically across distinct items in tables belonging to the same account and Region, or cancels the entire request. An idempotency token protects short-window retries after uncertain responses.
Incorrect Answers
A:Separate PutItem operations cannot guarantee cross-item atomicity, and concurrent bookings could leave partial business state.
B:Global tables replicate regional writes but do not transform multiple standalone changes into an atomic reservation and ledger transaction.
D:BatchWriteItem has no all-or-nothing transaction guarantee or per-item conditional expression support equivalent to TransactWriteItems.
Question 752
Regional analytics reads from an Aurora Global Database secondary Region. After a spike, users notice that newly committed records appear a few seconds late. What should the architect measure and communicate?
- Assume all secondary Regions receive each transaction synchronously before primary commit.
- Increase the client's DNS TTL until the replicas become strongly consistent.
- Delete all read queries when lag appears because lag is mathematically proof of irreversible data loss.
- Monitor cross-Region replication lag and route freshness-critical reads according to the application's consistency requirement.
Explanation
Correct Answer
D:Asynchronous regional replicas can lag the primary; regional proximity does not inherently guarantee immediate visibility.
Incorrect Answers
A:That is not the general asynchronous Global Database replication contract.
B:DNS caching does not change database replication freshness.
C:A lagging replica can catch up; the condition requires design and monitoring, not a blanket deletion policy.
Question 753
An Aurora PostgreSQL Global Database has one primary Region and a secondary Region serving nearby readers. The application uses the secondary cluster’s reader endpoint to run an INSERT and receives a read-only transaction error. The secondary has not enabled global write forwarding. The product manager wants a reliable write path immediately, without promoting the secondary or assuming cross-Region multi-writer replication. What should the architect do?
- Direct application writes to the active primary cluster writer endpoint (or its global writer endpoint where applicable); enable supported global write forwarding deliberately later only if its session and consistency requirements are met.
- Keep issuing INSERTs to the secondary reader endpoint and set the client-side transaction isolation to SERIALIZABLE, because that setting grants writer rights on a secondary cluster.
- Create an RDS Proxy endpoint in the secondary Region and point writes at it; the proxy turns ordinary reader DB instances into independent writers without cross-Region write forwarding.
- Change the secondary cluster’s reader endpoint DNS record to a primary-sounding name; Route 53 endpoint renaming changes the Aurora writer topology and permits local DML.
Explanation
Correct Answer
A:With ordinary Aurora Global Database secondary clusters, mutations originate at the primary writer. Route writes to the active primary writer or supported global writer endpoint. Global write forwarding is a separate configured feature that forwards supported secondary SQL to the primary and has session/consistency rules.
Incorrect Answers
B:Transaction isolation controls concurrency semantics, not the primary-versus-secondary writer role. SERIALIZABLE is not a workaround for a read-only secondary and is itself unsupported for Aurora PostgreSQL global write forwarding sessions.
C:RDS Proxy manages connections and can help with endpoint resilience or pooling; it does not promote secondary readers or implicitly enable Aurora Global Database write forwarding. The underlying cluster must support the requested write path.
D:DNS labels do not alter Aurora cluster role assignments or permission to perform writes. The application must use a genuine active writer path or an explicitly supported and enabled forwarder rather than cosmetic endpoint naming.
Question 754
A production RDS for PostgreSQL application starts rejecting new database sessions during a weekly burst. EC2 and database CPU utilization remain moderate, while the PostgreSQL max_connections threshold is being reached. The existing alerting policy monitors only CPU. Which monitoring approach most directly detects the actual bottleneck and adjacent capacity risks before user requests fail?
- Enable only ALB HTTP 5xx and network packet alarms, since endpoint errors reveal database session capacity before applications attempt connections.
- Create CloudWatch alarms for RDS DatabaseConnections and relevant free memory, storage and read/write latency metrics, and use supported DB load or wait analysis to investigate the session surge.
- Enable AWS Config configuration recording for the DB instance and use its compliance timeline as a substitute for real-time database saturation metrics.
- Enable VPC Flow Logs for the database subnet and treat allowed TCP connections as proof the database can admit new SQL sessions.
Explanation
Correct Answer
B:CloudWatch DatabaseConnections provides direct visibility into connected sessions. Together with supported memory, storage and I/O latency indicators, alarms expose independent RDS constraints, and DB load/wait data can help explain the underlying pressure. Thresholds should reflect the engine configuration.
Incorrect Answers
A:HTTP error and packet metrics may detect the downstream symptom, but they do not show when the database reaches its connection limit. Existing connection saturation can cause application failures even with a healthy load balancer and moderate CPU usage.
C:AWS Config tracks resource configuration and compliance changes, not live SQL session counts. A correctly configured DB instance can still run out of available application connections without any configuration change.
D:VPC Flow Logs describe accepted and rejected network flows, not the number of active PostgreSQL sessions or the database engine connection quota. TCP reachability does not imply a successful new authenticated database session.
Question 755
An application repeatedly opens thousands of short-lived SQL connections, and login/authentication work dominates CPU. The RDS storage queue is almost empty. What mitigation differs from a disk-throughput upgrade?
- Provision additional EBS IOPS as the primary fix for login CPU spikes with idle disks.
- Increase allocated RDS backup retention from seven days to thirty days as a way to retain pooled live SQL sessions across logins.
- Consider RDS Proxy pooling and client connection reuse, and check database max-connection settings.
- Disable persistent client connections and open a fresh TLS-authenticated database connection for each individual request.
Explanation
Correct Answer
C:Connection churn is a session-management bottleneck; pooled backend connections reduce repeated setup cost.
Incorrect Answers
A:No evidence supports storage throughput as the limiting resource.
B:Backup retention improves historical recovery options, not the count or cost of active SQL connection establishments. Frequent handshakes and authentication CPU still need client-side reuse or pooling controls.
D:Creating a new connection per request increases authentication work and churn precisely where CPU is already saturated. Connection pooling or reuse addresses the observed bottleneck rather than worsening it.
Question 756
An index deployment cuts the average reporting query latency by 80%, but p99 latency and lock waits have worsened under peak writes. What should be validated before calling the optimization successful?
- Approve the rollout solely because the arithmetic mean improved.
- Add indexes on more write-heavy columns without checking whether each new index increases lock contention and commit latency.
- Scale up the database writer and declare the index deployment safe without reproducing the new lock-wait behavior under peak load.
- Run representative peak-load tests covering tail latency, DB load, locks and consistency, not only average response time.
Explanation
Correct Answer
D:Averages can hide severe tail regressions or contention introduced by indexes and cache changes.
Incorrect Answers
A:A lower average does not prove tail latency, write throughput or correctness are acceptable.
B:Indexes can accelerate selected reads but add maintenance work to INSERT and UPDATE paths. The reported p99 regression must be tested under the actual write workload before introducing further indexes.
C:Extra CPU or memory may hide some symptoms but does not prove the revised index layout avoids write contention and tail latency regressions. The deployment still needs representative load and correctness testing.
Question 757
A CloudFront distribution serves viewers on www.example.com using a valid ACM viewer certificate in us-east-1. Its HTTPS-only custom origin is an Application Load Balancer in eu-central-1 configured in CloudFront as api-origin.example.net. The ALB is healthy and reachable, but its trusted TLS certificate covers only api.example.net, not api-origin.example.net, and CloudFront returns 502 errors. The company must retain end-to-end HTTPS. Which correction is appropriate?
- Install a trusted TLS certificate on the regional ALB that covers api-origin.example.net (or consistently change the configured origin hostname and certificate); keep the already valid CloudFront viewer certificate separate.
- Reissue the existing viewer-facing ACM certificate in us-east-1 without changing the ALB origin TLS certificate or the CloudFront origin domain name.
- Change CloudFront-to-origin connections to unencrypted HTTP so that the origin TLS certificate is not checked, despite the company’s end-to-end HTTPS requirement.
- Create a Route 53 private DNS record for api-origin.example.net but leave the ALB certificate bound only to api.example.net.
Explanation
Correct Answer
A:For an HTTPS custom origin, CloudFront validates a publicly trusted certificate whose name matches the configured origin domain name (subject to the Host header rules). The ALB certificate can be provisioned in its own Region. The viewer ACM certificate in us-east-1 is a separate CloudFront-side TLS requirement and is already valid.
Incorrect Answers
B:Reissuing a viewer certificate cannot repair the separate TLS handshake between CloudFront and the origin. The viewer domain already has a valid certificate; the mismatch is on the regional ALB.
C:Using plaintext HTTP might bypass the origin certificate check but directly violates the stated end-to-end HTTPS requirement, so it is not an eligible repair.
D:DNS resolution alone does not change the subject alternative names presented during HTTPS verification. The origin still presents a certificate that does not cover the configured CloudFront origin hostname.
Question 758
An ALB routes traffic to EC2 app servers that reply 200 to `/` but return 503 from `/ready` until their database migrations finish. Users receive errors during rollout. Which health-check configuration helps?
- Check only whether the instance answers a TCP SYN while ignoring the failing HTTP readiness endpoint.
- Use a target-group health check that reports genuine readiness, including required dependencies, and withhold routing until healthy.
- Disable target health checks and route every request to all registered targets immediately.
- Increase the load balancer idle timeout without changing the readiness signal.
Explanation
Correct Answer
B:ALB target health can prevent unready application instances from receiving production traffic.
Incorrect Answers
A:A reachable socket does not establish that the app can complete real requests.
C:This forces clients onto instances known to be unable to serve traffic.
D:Idle timeout affects connection management, not the correctness of a migration-dependent health check.
Question 759
A real-time voice gateway communicates over UDP. A proposed ALB configuration includes a 443 HTTPS listener with an HTTP path rule, claiming it will load-balance the UDP media packets. Which design is appropriate?
- Keep ALB and insert the word UDP into the path-rule name.
- Switch ALB routing to host-header conditions and expect it to accept all UDP packets.
- Use an NLB or other supported UDP load balancing architecture instead of an ALB HTTP listener.
- Increase ALB stickiness cookie lifetime to convert UDP datagrams into HTTP requests.
Explanation
Correct Answer
C:ALB handles HTTP/HTTPS/gRPC application protocols and cannot act as a general raw UDP load balancer.
Incorrect Answers
A:HTTP path names do not change transport-protocol support.
B:Host-header matching requires HTTP request headers, which raw UDP voice packets lack.
D:Session affinity settings cannot perform that protocol translation.
Question 760
A company serves cached product documentation through CloudFront. For a cache miss, its primary S3 origin may return a configured 503 response during maintenance; a secondary origin has an updated copy. The requirement is to retry GET or HEAD retrieval from the secondary origin when the primary returns that status. What should be configured?
- Configure a Route 53 failover record for each viewer and expect it to change an already chosen CloudFront distribution origin.
- Add a higher S3 object-storage class to the primary origin, which automatically makes CloudFront reroute a 503 to an alternate origin.
- Enable failover for arbitrary HTTP POST mutations through CloudFront origin groups with no method restrictions.
- Use a CloudFront origin group with the primary and secondary origins and include the appropriate failover status code in its origin-failover criteria.
Explanation
Correct Answer
D:CloudFront origin groups can retry supported GET, HEAD, or OPTIONS requests against a secondary origin when a configured response status triggers failover on an origin request. Cached responses do not require origin retrieval.
Incorrect Answers
A:External DNS routing does not configure the origin selection policy inside an existing CloudFront distribution.
B:Changing an S3 storage class does not define a secondary CloudFront origin or failover trigger.
C:CloudFront origin failover is limited to supported read-style methods and does not apply to arbitrary POST requests.
