AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 82
Question 810
Multiple teams share an Athena workgroup. One accidentally submits a very expensive full-lake scan, and another tries to query sensitive columns outside its role. Which controls should be configured?
- Create separate Athena workgroups for each team but continue granting all groups unrestricted S3 and Lake Formation access to the sensitive tables.
- Use Athena workgroup query limits/cost controls with appropriate IAM, Lake Formation or data-access policies.
- Set a workgroup-wide bytes-scanned SNS alert while leaving the single-query scan cutoff and underlying data permissions unchanged.
- Enable query-result encryption and restrict the results bucket, but keep unrestricted table permissions and no scan limits for the analysts.
Explanation
Correct Answer
B:Workgroup settings can constrain query spending, while identity/catalog permissions determine what data a principal may read.
Incorrect Answers
A:Workgroup separation can isolate workloads and settings, but it cannot repair overbroad permissions to confidential data. The scenario also needs per-query scan limits or equivalent workgroup governance for expensive SQL requests.
C:An aggregate Athena workgroup alert signals threshold overruns; it is not the same as a per-query byte cutoff that cancels an oversized scan. Neither alert grants or denies access to sensitive columns, which requires data permissions.
D:Encryption and a private results bucket reduce result exposure, yet do not stop unauthorized source-table queries or bound scan-heavy SQL. Identity/data controls and bytes-scanned limits remain necessary.
Question 811
A data platform uses an AWS Glue ETL job to transform order data destined for S3 analytics. Downstream consumers require an order_id unique across each published partition and nonnull customer_id. The team wants defined data-quality checks executed before the publishing step. What is the most relevant AWS-native mechanism?
- Increase EMR worker ephemeral HDFS storage so malformed order records are silently repaired before Glue publishes them.
- Turn on S3 Transfer Acceleration, which validates order IDs and customer fields during object transfer.
- Define and evaluate AWS Glue Data Quality DQDL rules for uniqueness and completeness in the pipeline, then gate publication on the evaluation results.
- Enable CloudWatch Database Insights to infer row-level quality violations in the S3 output without inspecting the transformed records.
Explanation
Correct Answer
C:Glue Data Quality evaluates specified rules such as IsUnique and IsComplete; the pipeline must explicitly act on failed results to gate publication.
Incorrect Answers
A:Ephemeral HDFS storage capacity is unrelated to validating unique keys and nonnull fields in Glue transformations.
B:Transfer Acceleration optimizes long-distance S3 upload paths; it does not evaluate per-record data-quality predicates.
D:Database monitoring cannot validate transformed S3 rows without instrumenting or querying those rows.
Question 812
A daily AWS Glue Spark ETL job reads many small S3 files before performing one expensive parallel join. A fixed allocation of 50 Glue workers stays idle during file enumeration and then becomes saturated during the join. The job runs on a supported Glue 4.0 Spark worker type. Which configuration improves stage-level resource elasticity?
- Create a permanent EC2 Auto Scaling group and assume it automatically manages the worker count inside a managed Glue job.
- Enable Spark-level dynamic executor settings while permanently allocating the same 50 billable Glue workers through the entire supported job.
- Assign a fixed 50 workers to every step and treat idle executors as unavoidable for all Glue Spark jobs.
- Enable AWS Glue Auto Scaling with an appropriate maximum worker count so supported job stages can provision and release worker capacity as needed.
Explanation
Correct Answer
D:For supported Glue Spark jobs, Auto Scaling can scale workers up or down based on stage and microbatch parallelism. A configured maximum bounds the workers used; actual job metrics should validate benefits and startup behavior.
Incorrect Answers
A:A separate EC2 Auto Scaling group is not the worker scheduler used by managed AWS Glue jobs.
B:Executor scheduling alone does not guarantee managed Glue worker capacity is allocated and released per stage. Supported AWS Glue Auto Scaling is the feature that can adjust provisioned job resources to demand.
C:Fixed capacity may waste workers when Spark stages have lower parallelism than the peak join.
Question 813
A company runs intermittent supported Spark jobs but has no operational need to administer an always-on cluster. It wants managed elastic workers and job-level orchestration. Which AWS capability should be compared?
- Evaluate EMR Serverless for the supported job framework and workload requirements.
- Deploy an always-on maximum-size EMR cluster because every Spark workload requires customer-managed EC2 worker nodes.
- Use Lambda for every multi-hour distributed Spark job irrespective of invocation limits.
- Use an S3 bucket alone to schedule and execute Spark transformation code with no compute engine.
Explanation
Correct Answer
A:EMR Serverless can run eligible distributed processing jobs without maintaining a persistent customer-managed EMR EC2 cluster.
Incorrect Answers
B:Some jobs can use a serverless EMR execution model.
C:Lambda is not a universal substitute for long-running distributed Spark workloads.
D:Object storage does not execute arbitrary distributed Spark jobs.
Question 814
A legal department is migrating a Windows SMB file share into Amazon S3 with AWS DataSync. The SMB folders contain NTFS discretionary ACLs, and the security officer assumes every user’s existing Windows file permission will be enforced automatically against the resulting S3 objects. Which migration control is required?
- Enable the SMB task’s security descriptor copy option and assume S3 object reads automatically evaluate the original Windows NTFS ACL entries.
- Use DataSync for the supported transfer, but explicitly design and test destination S3 IAM, bucket and application access controls because SMB-to-S3 transfers do not preserve Windows ACL enforcement.
- Enable S3 Versioning and Object Lock only, as these features automatically translate NTFS user and group access decisions for every future GetObject.
- Associate an S3 gateway endpoint with the file server’s VPC and assume the endpoint route-table entries retain NTFS folder security descriptors.
Explanation
Correct Answer
B:DataSync can move file contents between supported endpoints, but S3 authorization uses AWS policies and application identity rather than native Windows NTFS folder ACL enforcement. The destination permission design must be mapped and tested independently.
Incorrect Answers
A:The metadata DataSync can preserve varies by location pair; AWS documents that Windows-based ACL metadata is not preserved as enforceable NTFS permissions for an SMB-to-S3 transfer.
C:Versioning and Object Lock protect object history and retention. They do not convert Windows discretionary ACLs into principals or resource authorization for S3 requests.
D:A gateway endpoint controls a private network path to S3, not file ownership semantics or Windows ACL enforcement for objects already migrated into a bucket.
Question 815
An analytics platform must copy 90 million already-uploaded S3 objects, each 1–50 MB, from a single source bucket to a separate target bucket for a new dataset. It needs managed progress reporting and retry visibility rather than building millions of custom Lambda invocations. Which AWS service is specifically built for this?
- Use a DataSync agent attached to the source on-premises NAS even though all source objects already reside in S3 and no NAS exists.
- Create an ALB listener that copies a different S3 object on every HTTP health-check probe.
- Create an S3 Batch Operations Copy job with a source-object manifest, necessary permissions and detailed completion report.
- Convert the S3 objects to EBS snapshots in place, because EBS Snapshots automatically duplicate S3 bucket keys.
Explanation
Correct Answer
C:S3 Batch Operations executes one supported operation over a manifest of many objects and tracks success and failure without per-object application orchestration.
Incorrect Answers
A:DataSync can move data, including some S3-to-S3 cases, but an on-premises agent adds needless infrastructure for this S3-resident bulk object operation.
B:ALB health checks do not act as managed S3 bulk copy and completion-report jobs.
D:EBS snapshots capture block-volume contents and do not copy independent S3 object keys between buckets.
Question 816
An AWS DataSync Basic-mode task copies an NFS research archive into an S3 bucket. The task reports the expected object count, but the compliance team requires source-to-destination checksum validation of the files actually transferred. Which task setting and evidence should the architect use?
- Compare only S3 Inventory object keys and lengths with the source file listing and treat matching metadata as proof of byte-level integrity.
- Set DataSync VerifyMode to NONE because its absence of post-transfer checks eliminates checksum and content-mismatch risk.
- Rely on CloudTrail PutObject management-event counts to establish that each S3 payload exactly matches its original NFS source bytes.
- Configure DataSync to verify only transferred files after transfer and inspect its verification status, failure logs and task reports for mismatches.
Explanation
Correct Answer
D:DataSync supports VerifyMode ONLY_FILES_TRANSFERRED for a post-transfer checksum comparison of copied data. In Basic mode the chosen verification phase supplies integrity status and error details; a documented report and remediation of mismatches are needed before the compliance team accepts the transfer.
Incorrect Answers
A:An S3 object count, key list and length comparison can miss a corrupted byte sequence that has the same length. These measurements are useful reconciliation aids but do not satisfy the requested content-integrity verification.
B:DataSync performs integrity checks during transfers even when additional end-of-task verification is disabled. VerifyMode NONE skips the added post-transfer comparison, so it does not meet the requirement for explicit post-copy checksum evidence.
C:CloudTrail can document API calls but an API audit record does not include a verified source-to-destination payload checksum for each transferred file. It is not a substitute for DataSync verification results.
Question 817
A migration plan must move 450 TB before a fixed cutover date over a 100-Mbps site connection. Engineers promise that an online transfer will finish in two days without estimating protocol or network overhead. What decision evidence is essential?
- Calculate achievable time from data volume and measured effective throughput, then compare eligible online DataSync and physical ingest alternatives.
- Assume the destination S3 bucket's maximum object count determines how quickly the remote WAN link sends bytes.
- Choose the lower-cost cloud storage class first and ignore transfer duration entirely.
- Increase DNS TTL so one 100-Mbps link can transmit 450 TB in two days.
Explanation
Correct Answer
A:Data volume divided by usable transfer rate provides a lower bound that can show the online plan cannot meet the deadline.
Incorrect Answers
B:Object-count capacity does not change site uplink speed.
C:Storage pricing cannot make an infeasible network schedule meet the cutover objective.
D:DNS caching has no such effect on link bandwidth.
Question 818
A new AWS enterprise customer must ingest a huge dataset that cannot arrive through its site WAN before cutover. Staff can transport supported storage devices to an AWS facility and have the required enterprise support arrangements. What current physical intake option should it investigate?
- Assume new AWS Snowball Edge orders are available universally to first-time customers without checking updated service eligibility.
- Evaluate AWS Data Transfer Terminal service eligibility, facility logistics and compatible device handoff requirements.
- Use a VPC gateway endpoint as the physical shipping destination for on-premises hard drives.
- Use Route 53 latency routing to transport the offline dataset without sending its bytes.
Explanation
Correct Answer
B:The terminal enables eligible physical device-based ingress through supported facilities; availability and support prerequisites must be confirmed.
Incorrect Answers
A:New customer ordering restrictions make that blanket recommendation unsafe.
C:Endpoints route VPC API traffic; they do not accept handed-in storage devices.
D:DNS selection does not move bulk media contents.
Question 819
An archive team can transport storage devices to a supported physical ingest facility, but the nearest facility requires weeks of travel and reservation logistics. A temporary 10-Gbps link is available for a short period. What should it compare?
- Reserve the physical ingest location immediately using only its advertised device-port speed, and schedule validation after shipment.
- Use S3 Transfer Acceleration for the full file-system migration without measuring achievable client throughput or source change rate.
- Benchmark a bounded DataSync online copy over the temporary 10-Gbps path against the complete physical handoff timeline, including preparation, transit and terminal availability.
- Buy long-term AWS Direct Connect capacity before measuring whether the short migration window can be met over the already available temporary connection.
Explanation
Correct Answer
C:Measured source-to-target throughput, bytes and validation time can be compared with all physical logistics and service charges. DataSync is a viable managed online path; the faster option depends on the whole schedule, not advertised link speed alone.
Incorrect Answers
A:Port ingest performance measures only one phase. Weeks of booking, preparation, transportation and verification can dominate end-to-end time, so physical delivery speed alone is insufficient.
B:S3 Transfer Acceleration optimizes supported object transfers to S3, but it does not independently migrate an on-premises file system and cannot justify an unmeasured throughput assumption.
D:A dedicated connection may be appropriate for enduring hybrid requirements, but procurement lead time and recurring commitments might make it unsuitable for one short transfer where a high-bandwidth link already exists.
Question 820
A firm transports sensitive healthcare records on portable media for physical ingest. The planned courier handoff has no media encryption or custody tracking, although devices may be lost before arrival. What should the plan require?
- Ship plaintext drives because the AWS destination S3 bucket is encrypted at rest after ingest.
- Use only a higher S3 bucket replication frequency after delivery to compensate for an unencrypted courier shipment.
- Assume a courier tracking number alone makes plaintext customer health records confidential.
- Encrypt the media with appropriately governed keys and document custody and verified receiving/ingest procedures.
Explanation
Correct Answer
D:Physical movement introduces theft and substitution risk, requiring cryptographic protection and traceable handoff controls.
Incorrect Answers
A:Destination encryption does not protect bytes while devices are in transit.
B:S3 replication after receiving the data protects a later stored copy, but it does not encrypt portable media while the drives are physically transported. Confidentiality during courier transit requires encryption and custody safeguards before shipment.
C:Package location tracking is not data encryption or proof that custody controls were enforced.
