AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 8
Question 70
A team runs containerized scheduled jobs on ECS but no longer wants to patch, scale or maintain an EC2 worker fleet. Jobs need standard container semantics and per-task resource sizing. Which ECS compute model should it choose?
- Replace all container tasks with CloudFront Functions despite long-running job requirements.
- Move task placement to AWS Fargate and size supported CPU/memory combinations without managing EC2 hosts.
- Use EBS snapshots as the container scheduler and keep each EC2 worker always running.
- Increase the S3 multipart upload threshold so ECS automatically eliminates cluster hosts.
Explanation
Correct Answer
B:Fargate supplies serverless task compute for ECS, allowing teams to run supported containers without managing host instances, while still configuring networking, roles and task resources.
Incorrect Answers
A:CloudFront Functions handle lightweight edge request transformations and are not a drop-in runtime for regular ECS container jobs.
C:Snapshots back up block volumes; they do not place container tasks or remove responsibility for an EC2 cluster.
D:S3 upload configuration has no control over whether ECS services or jobs use EC2 or Fargate capacity providers.
Question 71
A fleet of Lambda functions uses RDS Proxy to connect to Aurora. A traffic spike drives proxy sessions close to the database's safe maximum and starves a maintenance tool that connects directly. Which proxy configuration should the database team evaluate?
- Increase the Lambda reserved concurrency without examining database connection pressure.
- Add Aurora reader instances while leaving all Lambda transactions and the maintenance tool attached to their existing writer connections.
- Set a safe RDS Proxy MaxConnectionsPercent and associated pool behavior so it leaves database connection headroom for direct clients.
- Enable IAM database authentication for the Lambda proxy clients but keep the current high target-group database connection limit unchanged.
Explanation
Correct Answer
C:RDS Proxy pool limits can cap the number of database connections it uses relative to the configured maximum, preserving headroom for other clients. The team should validate pool and borrow-timeout behavior under peak load.
Incorrect Answers
A:Increasing concurrency without controlling pool capacity can worsen the downstream connection pressure and maintenance starvation.
B:Additional readers do not reduce saturation on the writer when the affected sessions still use its existing connection paths. They do not reserve a share of writer connections for direct maintenance clients.
D:IAM database authentication changes how callers prove identity; it does not cap RDS Proxy backend connections. The writer may still be saturated and direct administrative access starved.
Question 72
A news application repeatedly queries an RDS table for the same popular articles. It tolerates a short period of cache staleness and wants lower DB read load without changing the authoritative database engine. Which architecture should it evaluate?
- Run Redis/Valkey on Amazon ElastiCache as an application-managed cache with appropriate keys, TTL and invalidation policy.
- Add an RDS read replica and claim it is automatically an in-memory response cache for unchanged SQL queries.
- Use an SQS DLQ to return cached SQL result sets for every HTTP request.
- Reduce the database storage encryption key size as the primary method for eliminating repeated query work.
Explanation
Correct Answer
A:An ElastiCache in-memory tier can hold frequently requested values and reduce repeated reads on the source DB. Cache invalidation, staleness tolerance, high availability and hit rate determine the benefit.
Incorrect Answers
B:A read replica can scale reads but still executes queries and does not automatically implement request-result caching with TTL and invalidation semantics.
C:An SQS DLQ holds messages that failed processing; it is not a low-latency keyed response cache for database reads.
D:Cryptographic key settings are not a query caching strategy and should not be weakened to optimize read performance.
Question 73
A company needs an encrypted network connection between its office gateway and VPC. Traffic is modest and variable, the company can use internet transport, and installing a dedicated circuit is not justified. Which connectivity choice fits?
- Establish an AWS Site-to-Site VPN with appropriate tunnel routing, on-premises device setup and redundancy validation.
- Order Direct Connect solely because its private path guarantees IPsec encryption without additional controls.
- Place a public S3 bucket at the office to provide BGP routing between the office network and private VPC subnets.
- Create an ALB path rule that maps office CIDR addresses into an IPsec tunnel.
Explanation
Correct Answer
A:Site-to-Site VPN establishes IPsec-encrypted tunnels over supported connectivity and is suitable for hybrid links where internet-based transport is acceptable. Redundant tunnels and route failover should be tested.
Incorrect Answers
B:Direct Connect is dedicated connectivity but does not inherently encrypt every packet with IPsec. It may be useful for stable bandwidth, but it is not the indicated low-overhead encrypted option.
C:S3 objects do not create router-to-router tunnels, BGP neighbor sessions or private subnet routing connectivity.
D:ALB rules route supported HTTP requests to targets; they are not customer gateway VPN routers and do not build IPsec tunnels.
Question 74
A SaaS vendor hosts a private TCP service in one VPC and wants customer VPCs to access only that service without allowing general VPC-to-VPC routes or overlapping CIDR changes. Which network pattern is best?
- Peer every customer VPC to the provider and add routes to every other provider subnet.
- Use Transit Gateway to transit full customer IP address ranges through the provider's application VPC.
- Create public internet endpoints and require all customers to connect through ordinary NAT.
- Publish an endpoint service using supported PrivateLink architecture and allow customers to create authorized interface endpoints.
Explanation
Correct Answer
D:PrivateLink connects customers to a specific provider endpoint service through interface endpoints without creating full transitive network connectivity. Provider setup typically uses a supported Network Load Balancer configuration and acceptance/policy controls.
Incorrect Answers
A:Peering requires compatible routing and CIDR constraints and grants network reachability beyond one narrowly published service when broadly configured.
B:Transit Gateway is useful for network transit among attachments but is more connectivity than the specified service-only access pattern and does not solve overlapping CIDRs generically.
C:Public internet exposure is unnecessary and conflicts with the private service access requirement.
Question 75
A company is moving an existing Apache Kafka event platform to AWS. Producers and consumers rely on Kafka APIs and libraries, but operations wants AWS to manage Kafka broker infrastructure. Which service is closest to the current compatibility requirement?
- Use Route 53 DNS health checks as a Kafka broker and event retention engine.
- Use Amazon MSK with compatible Kafka client connections, authentication and topic capacity planning.
- Replace Kafka with S3 Object Lock because write-once retention implements Kafka consumer offsets.
- Use CloudFront Functions to store partitions and broker replication logs at the edge.
Explanation
Correct Answer
B:Amazon MSK manages Apache Kafka infrastructure while retaining Kafka APIs and ecosystems for supported configurations. The migration still needs network, broker sizing, security and offset compatibility testing.
Incorrect Answers
A:Route 53 is authoritative DNS, not a Kafka-compatible event broker or retained log with partitions and consumer offsets.
C:S3 Object Lock applies retention to object versions, not Kafka topics, partition ordering or consumer group semantics.
D:CloudFront Functions perform lightweight request manipulation at edge locations and are not durable Kafka brokers.
Question 76
A data lake stores Parquet objects in S3 and uses Glue Data Catalog tables. Analysts need different table and column access permissions across teams, with centralized administration rather than broad bucket-level access alone. Which governance service is most appropriate?
- Grant all analysts s3:* on the entire data lake and rely on dashboard filters to hide sensitive fields.
- Use an ALB listener rule to distinguish authorized SQL columns in every S3 file.
- Configure Lake Formation permissions integrated with the catalog and supported query engines, with suitable IAM and S3 access patterns.
- Create CloudFront signed cookies as the sole permission model for Athena table columns.
Explanation
Correct Answer
C:Lake Formation supports centralized data lake permissions at catalog/table/column scopes for supported integrations. IAM and underlying location grants must be aligned rather than leaving unrestricted direct S3 access.
Incorrect Answers
A:Broad S3 permissions expose data beyond the required table/column boundaries; UI filtering is not equivalent to enforced data access policy.
B:ALB forwards web requests; it cannot enforce data lake table and column authorization for Athena/Glue query engines.
D:CloudFront signed cookies govern access to selected web content paths, not SQL table-column authorization in a governed data lake.
Question 77
A finance application retains a set of completed EBS backups for seven years for compliance; restores are extremely rare and may take days, not minutes. The architect is considering the EBS snapshot archive tier to reduce storage cost. Which requirement must be included in the decision?
- Assume every archived EBS snapshot is incremental and can be restored to a volume instantly at the same rate as a standard snapshot.
- Set EBS gp3 throughput to zero; throughput changes automatically move existing snapshots into archive at no retention cost.
- Model the archive tier’s 90-day minimum charge and full-snapshot footprint, and accept that restores from archive can take up to 72 hours.
- Delete archived snapshots after one day to eliminate all remaining monthly archive charges, regardless of the minimum storage period.
Explanation
Correct Answer
C:EBS archive snapshots are full copies rather than incremental snapshots, have a minimum billed period of 90 days, and may require up to 72 hours for archive-to-standard restoration. Those limits must fit retention and recovery needs.
Incorrect Answers
A:The archive tier has different restore latency and stores full snapshots, so the stated performance and incremental assumptions are incorrect.
B:Volume performance settings do not tier existing snapshots or eliminate archive storage pricing.
D:Early deletion or permanent restoration before 90 days can still incur remaining minimum-period storage charges.
Question 78
A media company holds years of S3 Standard source-image objects under several prefixes. Finance wants to know whether only the older /finished/ images should move to Standard-IA; the /active/ images are read frequently. The architect must gather actual access-pattern evidence for the /finished/ group rather than deciding only from total bucket size. Which AWS-native analysis is most appropriate before setting a lifecycle transition?
- Enable S3 Inventory for all bucket objects and assume that a large object count alone demonstrates infrequent reads, without collecting retrieval-pattern metrics.
- Configure S3 Storage Class Analysis with a /finished/ prefix filter, observe sufficient access history and use its Standard-to-Standard-IA access findings to shape the lifecycle rule.
- Use the bucket-wide S3 Storage Lens storage-class breakdown as if it directly provided per-prefix age-based retrieval recommendations for S3 Standard to Standard-IA.
- Immediately transition the entire bucket, including /active/ images, to a low-access class solely from its aggregate stored-gigabyte volume.
Explanation
Correct Answer
B:S3 Storage Class Analysis examines filtered sets of S3 Standard objects and reports measured access patterns to inform Standard-to-Standard-IA lifecycle transitions. Prefix-level observations can distinguish cold finished assets from actively read data; minimum-storage-duration and retrieval costs should still be assessed.
Incorrect Answers
A:S3 Inventory inventories object metadata and classes but does not by itself measure how the filtered group of objects is actually accessed over time; object count cannot justify a retrieval-fee tradeoff.
C:S3 Storage Lens provides aggregated footprint and activity metrics, useful for broad cost visibility, but its bucket-wide class distribution is not the same as filtered S3 Storage Class Analysis recommendations based on age and reads.
D:Aggregate storage size says nothing about which prefix incurs frequent reads. Blanket transitions could increase retrieval fees or degrade economics for active data and do not satisfy the evidence-based design requirement.
Question 79
An e-commerce service reaches peak demand only on weekends. Its EC2 Auto Scaling group's minimum size equals the weekend peak, so most servers are idle during weekdays. The service can scale quickly and load is measurable. Which cost change is best?
- Keep the peak minimum forever and buy larger instance types to eliminate the need for scaling.
- Replace the workload with S3 Glacier Flexible Retrieval so EC2 instances are billed as archive objects.
- Use only manual weekly instance deletion without health or demand metrics.
- Lower the justified minimum, configure target-tracking and tested capacity bounds, and let the fleet shrink between demand peaks.
Explanation
Correct Answer
D:Target tracking with sensible min/max capacity can reduce excess instances when measured demand falls and restore capacity under load. Scale-in safeguards and startup times should be tested.
Incorrect Answers
A:A permanently high minimum guarantees idle compute capacity. Larger instances can increase rather than reduce waste when traffic is low.
B:Glacier is archival object storage, not a compute platform for serving an active web application.
C:Manual deletion lacks a responsive capacity policy and can jeopardize availability when demand changes unexpectedly.
Question 80
A development account runs many nonproduction EC2 instances every night even though engineers need them only during business hours. The instances can be stopped without losing necessary persistent state. Which change most directly reduces unused instance charges?
- Schedule stop/start actions for eligible development instances and document exceptions and persistence requirements.
- Add more Availability Zones to every development instance so idle compute has additional redundancy.
- Attach a CloudFront distribution to instances to stop EC2 hourly charges while they remain running.
- Retain full-time operation and delete all cost allocation tags so the charges are harder to discover.
Explanation
Correct Answer
A:Automated stop/start policies reduce EC2 compute hours when environments are not used. Persistent volumes and IP behavior should be accounted for, and services that cannot stop safely need exemptions.
Incorrect Answers
B:More AZ diversity can help availability but does not reduce idle instance hours for a nonproduction workload.
C:CloudFront caching might offload web requests, but an EC2 instance left running continues to incur its instance charges.
D:Removing tags weakens accountability and does not change the underlying instance-hour consumption or its costs.
