AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 83
Question 820
A firm transports sensitive healthcare records on portable media for physical ingest. The planned courier handoff has no media encryption or custody tracking, although devices may be lost before arrival. What should the plan require?
- Ship plaintext drives because the AWS destination S3 bucket is encrypted at rest after ingest.
- Use only a higher S3 bucket replication frequency after delivery to compensate for an unencrypted courier shipment.
- Assume a courier tracking number alone makes plaintext customer health records confidential.
- Encrypt the media with appropriately governed keys and document custody and verified receiving/ingest procedures.
Explanation
Correct Answer
D:Physical movement introduces theft and substitution risk, requiring cryptographic protection and traceable handoff controls.
Incorrect Answers
A:Destination encryption does not protect bytes while devices are in transit.
B:S3 replication after receiving the data protects a later stored copy, but it does not encrypt portable media while the drives are physically transported. Confidentiality during courier transit requires encryption and custody safeguards before shipment.
C:Package location tracking is not data encryption or proof that custody controls were enforced.
Question 821
After a one-time 300-TB physical ingest, an on-premises source continues generating 40 GiB of daily updates. The WAN can transfer those daily changes overnight. What is a suitable delta migration strategy?
- Use a supported incremental DataSync task to copy subsequent changed data within the available online window.
- Reship the entire original 300-TB dataset every night even though only 40 GiB changes.
- Use CloudTrail API call logs as the authoritative copy of each newly changed file.
- Stop synchronizing changes after the initial ingest and assume the S3 lake remains current forever.
Explanation
Correct Answer
A:A physical bulk seed followed by online incremental deltas avoids repeating costly device shipping when the WAN can handle daily changes.
Incorrect Answers
B:Full physical reloads add needless cost and are inconsistent with the overnight update requirement.
C:API event metadata does not reproduce arbitrary source file bytes.
D:The daily source mutations would be absent from the cloud dataset.
Question 822
A data lake stores structured files in S3 and analysts using Athena cannot locate tables or partitions consistently. A team configures Lake Formation governance but has no catalog table definitions. What metadata foundation is needed?
- Create only an IAM user with Athena access and expect table schemas to appear without discovery or registration.
- Register usable AWS Glue Data Catalog database/table definitions and location/partition metadata for the lake assets.
- Add more S3 bucket replication rules with no table or partition metadata.
- Use an NLB TLS listener as a substitute for a shared metastore.
Explanation
Correct Answer
B:Lake Formation can govern cataloged data, while query tools need schemas and locations to discover and scan it.
Incorrect Answers
A:IAM authorization is not an automatic data catalog metadata generator.
C:Copies of objects do not create discoverable analytics schemas by themselves.
D:Transport load balancing cannot describe lake tables or columns.
Question 823
An Athena analyst can list a Glue Data Catalog table but receives AccessDenied trying to read the underlying S3 location. Administrators already granted the table's Lake Formation permissions. What distinction should be checked?
- Assume a Glue catalog table grant universally overrides every S3 bucket and KMS key denial.
- Delete the Glue table because data-object access errors prove its schema is incorrect.
- Verify Lake Formation/S3 location access, registered location roles and any relevant IAM/KMS permissions in addition to catalog grants.
- Grant the analyst AmazonAthenaFullAccess but leave the underlying S3 location policy and KMS key authorization unchanged.
Explanation
Correct Answer
C:Catalog-level visibility and data-location authorization are separate layers, and both may need correct grants for real queries.
Incorrect Answers
A:Catalog permissions cannot bypass unrelated explicit storage or cryptographic authorization controls.
B:A cataloged schema can be valid while storage permissions block reads.
D:An Athena client or service permission does not override separate data-location and encryption key restrictions. The denied source access must be evaluated for the actual principal and registered location role.
Question 824
A shared lake contains employee salary and operations datasets. HR analysts may see salary columns, while operations users may only see departmental aggregates. Teams propose separate copies of the entire data lake per role. Which governance approach could reduce duplication?
- Grant all users unrestricted S3 GetObject and rely on dashboard hiding to keep salaries secret.
- Create a new full copy of every dataset per employee and keep all copies permanently synchronized.
- Use an ALB listener to delete unauthorized SQL columns from S3 object bytes.
- Apply supported Lake Formation table, column or row-level data filters and permissions matched to each principal.
Explanation
Correct Answer
D:Fine-grained governed access can expose different subsets of the same cataloged data without multiplying complete copies.
Incorrect Answers
A:Client UI visibility is not a security authorization boundary.
B:Unnecessary physical copies increase cost and introduce consistency risks.
C:Load balancers do not enforce lake table and column permissions.
Question 825
A retailer needs repeated joins and aggregations over years of sales facts and dimensional tables, with dashboards running complex SQL. Its current transactional DB struggles with full-history scans. Which data service fits?
- Evaluate Amazon Redshift analytical warehousing with data loads and schema suited to the reporting workload.
- Move all analytics into individual DynamoDB GetItem calls without changing business query requirements.
- Use ElastiCache as the only historical system of record for multiyear reports.
- Increase ALB target group size to supply columnar SQL execution capacity.
Explanation
Correct Answer
A:Redshift's analytical execution is designed for large scans, joins and aggregations rather than frequent small OLTP row updates.
Incorrect Answers
B:GetItem cannot execute arbitrary warehouse joins and historical GROUP BY reports.
C:A memory cache is not a durable warehouse for all analytical facts.
D:Web load balancers do not implement analytical query processing.
Question 826
A warehouse ingestion script sends one million individual INSERT statements for a nightly large file, taking hours. The transformed batch already exists in S3 as files compatible with Redshift load. What should be optimized?
- Increase the number of individual SQL INSERT retries without changing the row-by-row approach.
- Load data through Redshift COPY or a supported efficient bulk-ingest approach instead of per-row network inserts.
- Create Redshift Spectrum external tables for the S3 files but keep executing one million row-by-row client INSERT calls into the target warehouse table.
- Enable Redshift Concurrency Scaling and continue the identical client-side row-by-row INSERT loop, expecting scaling to combine the inserts into a bulk COPY load.
Explanation
Correct Answer
B:Bulk load processes many rows efficiently and avoids per-row statement overhead for large staged datasets.
Incorrect Answers
A:More network round trips may increase contention and does not capture bulk loading benefits.
C:External tables make S3 data queryable by Redshift, but they do not automatically consolidate a million client INSERT requests. Loading the target table efficiently requires a bulk load or set-based approach.
D:Concurrency Scaling can add capacity for eligible concurrent queries; it does not rewrite independent INSERT statements into parallel S3 COPY ingestion. The per-row overhead persists.
Question 827
A Redshift star schema repeatedly joins a large events table to a customer dimension and filters on event date. The cluster suffers unnecessary data shuffles. Which layout should be evaluated?
- Choose random distribution and sort keys permanently without measuring joins or pruning.
- Increase S3 bucket versioning retention as the main mechanism for reducing Redshift join redistribution.
- Tune distribution and sort keys based on observed join patterns and frequent filters, validating the optimizer's chosen plan.
- Set all SQL client timeouts to infinity and assume the same costly query plan becomes efficient.
Explanation
Correct Answer
C:Redshift physical layout affects data movement and selective scans; representative query patterns should drive choices.
Incorrect Answers
A:Unexamined layout can force expensive redistribution and broad scans.
B:Object history does not determine warehouse physical row distribution.
D:Longer execution allowance does not remove network shuffles or scans.
Question 828
A Redshift workload mixes overnight ingestion with interactive dashboard queries. Reports slow severely during the import window. The architect proposes increasing only S3 storage capacity. What should be reviewed?
- Enable Redshift result caching for repeated reports but leave the high-volume ingest contention and queue layout unchanged.
- Increase only the S3 source-bucket capacity and its retention period while continuing the identical Redshift load schedule.
- Increase dashboard query timeouts and remove WLM queue dashboards instead of identifying the shared resource bottleneck.
- Monitor query workload management, resource queues and supported scaling/concurrency mechanisms alongside ingest scheduling.
Explanation
Correct Answer
D:Redshift workload management and supported concurrency/scaling choices should be evaluated alongside load windows. Query queues, waits, execution metrics and resource classes show whether ingestion competes with interactive queries for warehouse resources.
Incorrect Answers
A:Caching can help identical queries, but does not isolate uncached interactive work from compute, memory, or concurrency pressure during bulk ingestion.
B:More object storage does not grant the warehouse additional query capacity or isolate conflicting warehouse work groups.
C:Longer timeouts merely tolerate slow completion and suppressing queue metrics hides the likely contention; neither manages warehouse concurrency.
Question 829
A streaming intake API writes financial events into Kinesis. Producers currently use one embedded broad IAM key shared by all clients, and a compromised client can write across every business stream. Which authentication model improves isolation?
- Use separate scoped IAM roles or temporary credentials for approved producers, limited to their specific stream write actions.
- Grant every client a temporary role whose resource policy allows PutRecords to all Kinesis streams with a wildcard ARN.
- Use one shared EC2 instance profile granting broad Kinesis write rights to all tenants, with no producer-specific trust boundary.
- Keep a single shared IAM producer role and rotate its sessions frequently while leaving PutRecord permissions unrestricted across streams.
Explanation
Correct Answer
A:Least-privilege producer identities restrict the blast radius of compromised application credentials.
Incorrect Answers
B:Temporary credentials reduce long-lived key exposure but a wildcard stream grant still lets one compromised client write across business streams. The roles must be scoped to each producer’s authorized resources.
C:An instance profile can supply temporary credentials, but a single broadly shared role still permits lateral writes across streams. Separate identities or tighter resource constraints are needed for isolation.
D:Frequent session rotation limits credential lifetime, but it does not change the authorization scope of the shared role. A compromised producer can still target unauthorized streams until policy boundaries are tightened.
Question 830
A security team classifies the content of an Amazon Kinesis Data Streams application as sensitive and requires controlled key use at rest. An architect assumes the default transport encryption alone meets storage-key policy. What should be configured?
- Use HTTPS to submit events and assume this alone supplies a customer-controlled encryption key for persisted stream records.
- Enable and govern supported Kinesis server-side encryption with an appropriate KMS key and producer/consumer key permissions.
- Enable server-side encryption but leave IAM and KMS key policy permissions broad enough for any internal principal to read the stream.
- Use a Kinesis VPC interface endpoint to keep API traffic private while leaving the stream at-rest encryption configuration unchanged.
Explanation
Correct Answer
B:TLS protects transit, while KMS-backed server-side encryption and grants address encryption at rest and controlled key use.
Incorrect Answers
A:Transport TLS and managed-at-rest cryptographic policies are different controls.
C:Encryption at rest does not replace producer and consumer authorization or governed key usage. The requirement includes limiting which principals may use the stream and encryption key, not just ciphertext storage.
D:A VPC endpoint can provide private network connectivity to the service but does not itself enable governed server-side encryption for retained stream records. Data-at-rest controls remain separately required.
