AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 84
Question 830
A security team classifies the content of an Amazon Kinesis Data Streams application as sensitive and requires controlled key use at rest. An architect assumes the default transport encryption alone meets storage-key policy. What should be configured?
- Use HTTPS to submit events and assume this alone supplies a customer-controlled encryption key for persisted stream records.
- Enable and govern supported Kinesis server-side encryption with an appropriate KMS key and producer/consumer key permissions.
- Enable server-side encryption but leave IAM and KMS key policy permissions broad enough for any internal principal to read the stream.
- Use a Kinesis VPC interface endpoint to keep API traffic private while leaving the stream at-rest encryption configuration unchanged.
Explanation
Correct Answer
B:TLS protects transit, while KMS-backed server-side encryption and grants address encryption at rest and controlled key use.
Incorrect Answers
A:Transport TLS and managed-at-rest cryptographic policies are different controls.
C:Encryption at rest does not replace producer and consumer authorization or governed key usage. The requirement includes limiting which principals may use the stream and encryption key, not just ciphertext storage.
D:A VPC endpoint can provide private network connectivity to the service but does not itself enable governed server-side encryption for retained stream records. Data-at-rest controls remain separately required.
Question 831
Sensitive event processors run in private VPC subnets and must call supported Kinesis APIs without a NAT gateway and without routing through the public internet. Which network option is relevant?
- Use only a public internet gateway route from private instances without public addressing and call it a private endpoint.
- Use a gateway endpoint configured for S3 to carry all Kinesis stream API traffic.
- Evaluate supported Kinesis interface VPC endpoints/PrivateLink access with private DNS and appropriate endpoint security groups.
- Use a Direct Connect public VIF between two subnets within the same VPC to replace an interface endpoint.
Explanation
Correct Answer
C:Interface endpoints provide private ENI paths to supported AWS APIs and can eliminate unnecessary public egress for these calls.
Incorrect Answers
A:An IGW path neither creates PrivateLink nor makes private source addresses routable to public services automatically.
B:S3 gateway endpoints do not route arbitrary Kinesis API destinations.
D:DX connects external networks to AWS and is not a VPC-local API endpoint for the stated service.
Question 832
An ingest pipeline receives malformed Avro records. Its current consumer silently drops records after a deserialize exception, so finance cannot reconcile missing events. Which design provides operational recoverability?
- Increase Kinesis stream retention without changing the consumer that acknowledges and discards malformed records.
- Add an SQS dead-letter queue to an unrelated notification subscriber while the Avro-deserialization consumer still marks failed events successful.
- Retry the same permanently malformed Avro bytes without bounded attempts or a quarantine destination.
- Preserve failed records and error metadata in a controlled dead-letter or error S3 path/queue, alert on failures and support corrected replay.
Explanation
Correct Answer
D:Preserve the original payload, parsing error context and stream offset/record identifier in a protected error queue or S3 quarantine path. Alert, diagnose and replay corrected inputs while making acknowledgement/checkpoint progression reflect actual processing success.
Incorrect Answers
A:Longer retention may preserve upstream data temporarily, but an application silently discarding known bad events still needs failure capture, observability and a controlled replay path.
B:A DLQ on a separate subscriber will not retain payloads lost by this consumer. Its error handling must actually route the failed records or prevent premature acknowledgement.
C:Syntax errors are not transient service failures; indefinite retries create poison-message loops and never explain or reconcile the bad data.
Question 833
A website serves thumbnails that are fetched thousands of times per hour and must return without archive restore delay. A cost proposal moves them to S3 Standard-IA based solely on the lower per-GB storage rate. What storage-class choice should be evaluated?
- Keep frequently accessed thumbnails in S3 Standard and compare total storage, request and retrieval charges.
- Use Standard-IA for all frequently accessed thumbnails because it has the lowest total cost in every read pattern.
- Move every thumbnail to Glacier Deep Archive without changing the public website's access requirements.
- Use One Zone-IA solely because the thumbnail is public and assume no availability/durability tradeoff exists.
Explanation
Correct Answer
A:High access frequency can make Standard-IA retrieval/request economics worse despite a lower storage rate per GiB.
Incorrect Answers
B:Retrieval charges and minimum-size/duration rules can negate storage savings.
C:Archive restore latency is inconsistent with immediate high-frequency delivery.
D:Single-AZ storage has a different failure boundary and does not address the high retrieval frequency.
Question 834
Legal documents are read a few times per quarter, but they must be available immediately when a subpoena arrives. The archive is large, object sizes meet applicable thresholds, and expected retention exceeds storage minimums. Which S3 class merits evaluation?
- Use Deep Archive because every data object read quarterly is guaranteed to be immediately accessible without restore.
- Use S3 Standard-Infrequent Access after modeling retrieval and minimum-duration costs.
- Keep all documents in the highest-access S3 Standard class without comparing the infrequent request pattern.
- Choose One Zone-IA for the only legally required copy while ignoring AZ failure risk.
Explanation
Correct Answer
B:Standard-IA provides fast retrieval with lower storage cost for suitable low-frequency access patterns.
Incorrect Answers
A:Deep Archive has restore preparation and is unsuitable for the immediate retrieval promise.
C:Standard may be unnecessary expense for long-lived cold yet immediately required items.
D:Single-AZ resilience may breach retention risk tolerance for the sole copy.
Question 835
A rendering pipeline can regenerate intermediate files from durable S3 source objects within minutes. The intermediate objects are read rarely after generation, and losing the AZ's copies is acceptable. Which storage option could save cost?
- Use One Zone-IA for the organization's only immutable tax filings with no independent backup.
- Use S3 Glacier Deep Archive for intermediate files that must be opened instantly by active render jobs.
- Consider S3 One Zone-Infrequent Access for the reproducible intermediate objects, accounting for retrieval and minimum duration.
- Keep every regenerable intermediate object in Standard regardless of measured cold access and cost.
Explanation
Correct Answer
C:One Zone-IA trades multi-AZ resilience for lower-priced suitable infrequently accessed data when recreation is acceptable.
Incorrect Answers
A:That different dataset cannot tolerate the reduced fault-domain protection.
B:Deep archive retrieval is not a low-latency active working tier.
D:Frequently accessed Standard may be safe but is not necessarily cost-optimal for reproducible cold artifacts.
Question 836
An application stores 80 million 24-KB JSON fragments. Finance expects S3 Intelligent-Tiering to transition each rarely accessed fragment into cheaper automated access tiers after 30 or 90 days. A pilot shows no tier transitions for these fragments. Which explanation is accurate?
- Intelligent-Tiering automatically sends every object smaller than 128 KB to Deep Archive within one day.
- Object sizes are never considered for S3 Intelligent-Tiering eligibility.
- Changing the Route 53 routing policy for the bucket will allow small objects to move to infrequent tiers.
- Objects smaller than 128 KB are not monitored or eligible for automatic Intelligent-Tiering moves, so compare S3 Standard and suitable alternate layouts or lifecycle economics rather than expecting these small fragments to transition.
Explanation
Correct Answer
D:AWS states that objects smaller than 128 KB stay in the Frequent Access tier and do not undergo automatic Intelligent-Tiering transitions. For this workload, object aggregation and other storage-class economics may matter more than automated tiering.
Incorrect Answers
A:Deep Archive is not the default automatic destination for objects under the size threshold and has different retrieval conditions.
B:The size threshold is explicitly part of S3 Intelligent-Tiering automatic monitoring eligibility.
C:DNS routing is unrelated to storage-class tiering thresholds and billing behavior.
Question 837
A mobile application stores millions of 1-KiB short-lived telemetry objects for 24 hours. Engineers propose Intelligent-Tiering because its automatic tier moves sound universally cheaper. What factor should be evaluated?
- Account for the 128-KB Intelligent-Tiering auto-tiering threshold, short object lifetime and relevant storage/request charges before choosing a class.
- Move every 1-KiB object to S3 Standard-IA immediately, comparing only its lower per-GiB list price.
- Enable the optional Intelligent-Tiering archive tiers and expect 1-KiB objects to move after one day.
- Use S3 Glacier Deep Archive for the one-day working dataset and retrieve every object immediately before its expiration.
Explanation
Correct Answer
A:Objects smaller than 128 KB remain in the Intelligent-Tiering Frequent Access tier: they are not monitored or charged the per-object monitoring fee, but neither do they automatically migrate to cheaper tiers. A 24-hour lifetime is too short for typical tier transitions; evaluate actual storage and request costs.
Incorrect Answers
B:Standard-IA has a 128-KB minimum billable size and a 30-day minimum duration. A 1-KiB object discarded after 24 hours does not realize the headline per-GiB savings.
C:Objects smaller than 128 KB are ineligible for automatic tiering, and optional archive transitions require much longer inactivity intervals.
D:Deep Archive is designed for long retention with asynchronous retrieval and minimum-duration billing; it does not match short-lived daily object use.
Question 838
A medical image archive uses Intelligent-Tiering for mixed access. The team considers its optional archive access tiers, but clinicians sometimes require an image within seconds. What should determine whether archive tiers are enabled?
- Enable deep archival for every image and promise instant retrieval in all circumstances.
- Match optional archive-tier restore behavior to the required retrieval SLO and keep frequently/urgently used data in suitable rapid-access tiers.
- Assume an S3 key prefix containing 'hot' overrides the actual access tier's retrieval behavior.
- Turn off all access logs and declare the image workload permanently cold.
Explanation
Correct Answer
B:Optional archival tiers can introduce asynchronous restore time; not every object can tolerate that latency.
Incorrect Answers
A:Archive-oriented tiers require restoration workflows and may not meet the urgent-care latency requirement.
C:S3 storage class and restore state determine whether an archived object can be read promptly. A key prefix such as hot/ changes object naming only; it cannot bypass a Glacier restore or tier retrieval delay.
D:Removing telemetry does not prove clinical usage or restore tolerance.
Question 839
A research institution must retain immutable scientific results for 15 years. The records are almost never read, and a multi-hour restore is acceptable. Which S3 archival class is a sensible candidate?
- Use S3 Standard solely because Deep Archive cannot preserve objects for multiple years.
- Use S3 Express One Zone for every historical archive based solely on its low-latency access properties.
- Use S3 Glacier Deep Archive with retention, retrieval and minimum-storage-duration costs modeled.
- Use an EBS boot volume as the only 15-year record store without backup or compute continuity.
Explanation
Correct Answer
C:Deep Archive targets very long-lived rarely accessed records when slower retrieval is acceptable.
Incorrect Answers
A:Deep Archive is designed for very long retention; the choice turns on retrieval and management needs.
B:A high-performance single-AZ active tier is not necessarily economical or resilient for long-retained archives.
D:A compute-attached disk is an operational storage dependency, not a natural durable long-term archive solution.
Question 840
A compliance service reads old document packages unpredictably and needs millisecond access even though most documents are rarely requested. It wants archive-style storage economics without a restore job. Which class should it evaluate?
- Use Glacier Deep Archive while promising all retrievals complete in milliseconds without restores.
- Use Glacier Flexible Retrieval without restore initiation because its retrieval semantics are identical to hot S3 Standard.
- Keep every object in an EFS standard filesystem solely because it has an NFS API.
- Use S3 Glacier Instant Retrieval after comparing access, object-size and minimum-duration economics.
Explanation
Correct Answer
D:Instant Retrieval is an archive class designed for infrequently accessed objects that still require immediate access.
Incorrect Answers
A:Deep Archive requires retrieval preparation and does not match that latency.
B:Flexible Retrieval has restore workflows and differing retrieval speed/cost options.
C:An always-online POSIX filesystem is unnecessary if the application is already built around S3 object GET.
