AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 9
Question 80
A development account runs many nonproduction EC2 instances every night even though engineers need them only during business hours. The instances can be stopped without losing necessary persistent state. Which change most directly reduces unused instance charges?
- Schedule stop/start actions for eligible development instances and document exceptions and persistence requirements.
- Add more Availability Zones to every development instance so idle compute has additional redundancy.
- Attach a CloudFront distribution to instances to stop EC2 hourly charges while they remain running.
- Retain full-time operation and delete all cost allocation tags so the charges are harder to discover.
Explanation
Correct Answer
A:Automated stop/start policies reduce EC2 compute hours when environments are not used. Persistent volumes and IP behavior should be accounted for, and services that cannot stop safely need exemptions.
Incorrect Answers
B:More AZ diversity can help availability but does not reduce idle instance hours for a nonproduction workload.
C:CloudFront caching might offload web requests, but an EC2 instance left running continues to incur its instance charges.
D:Removing tags weakens accountability and does not change the underlying instance-hour consumption or its costs.
Question 81
A retail company runs complex scans across billions of historical sales rows using its customer-facing PostgreSQL OLTP database. The scans contend with transaction requests. It wants a query-optimized analytical environment while keeping the transaction database authoritative. What architecture best fits?
- Increase the OLTP database's write locks so analytics can run without any concurrency contention.
- Add one ordinary PostgreSQL RDS read replica for reporting and continue running the same massive row-oriented analytical scans with no analytical data-model optimization.
- Copy suitable analytical datasets into a Redshift warehouse or another appropriate analytical store and direct large reporting queries there.
- Turn on CloudWatch Database Insights and keep all historical reporting scans executing on the original transaction-serving writer.
Explanation
Correct Answer
C:An analytical warehouse can execute large scans and aggregations using storage/query patterns suited to reporting, leaving OLTP capacity for short transactions. ETL and freshness requirements must be designed.
Incorrect Answers
A:Holding more write locks would worsen contention rather than isolate long reporting scans from transactional workload latency.
B:A read replica can offload some production reads, but it remains a transactional PostgreSQL query engine and does not provide the columnar and parallel analytical architecture requested for recurring billion-row aggregations.
D:CloudWatch Database Insights helps diagnose expensive database activity, but observation alone does not create an isolated analytical query environment or remove scan contention from the OLTP writer.
Question 82
A company is moving a supported production relational database to RDS with limited cutover downtime. It plans a baseline copy followed by ongoing change replication until applications can switch over. Which AWS service should the migration team evaluate?
- Rebuild the entire database manually from monthly CSV exports at the cutover and accept several weeks of writes lost.
- Use AWS Database Migration Service with suitable endpoints, full-load and CDC tasks where supported, plus schema preparation and cutover validation.
- Run CloudFront signed URLs to translate SQL transaction logs into target database changes.
- Use EFS lifecycle policies to replay database commits into the new engine.
Explanation
Correct Answer
B:AWS DMS supports suitable full-load and change-data-capture migration patterns for compatible engines/sources. Schema conversion and application cutover are separate tasks that require testing.
Incorrect Answers
A:Periodic exports alone cannot capture ongoing changes during the migration window and violate the low-downtime/data-freshness requirement.
C:CloudFront URLs control delivery access to web assets; they do not decode or replicate transactional database change logs into a relational target.
D:EFS tiering manages filesystem storage classes and has no native CDC mechanism for transactional database migrations.
Question 83
A public HTTPS service runs behind an ALB. Operations currently hardcodes observed ALB IP addresses in Route 53 A records, and these addresses are not guaranteed stable. Which DNS configuration should replace this fragile design?
- Use a Route 53 alias record pointing to the supported ALB target instead of embedding changing load balancer IP addresses.
- Use a CloudWatch metric alarm as an A record containing the ALB's latest backend EC2 addresses.
- Put the ALB IP in an S3 object and rely on client browsers to read that object as authoritative DNS.
- Keep the static A records and lengthen their TTL to ensure stale IPs remain cached longer.
Explanation
Correct Answer
A:Route 53 alias records can target supported AWS resources such as an ALB without encoding its current addresses. That keeps DNS aligned with AWS-managed load-balancer resolution.
Incorrect Answers
B:A metric alarm can report operational states but is not an authoritative DNS record mechanism automatically tracking load-balancer address changes.
C:An S3 object is not the zone's A record and browsers do not treat arbitrary bucket data as authoritative DNS resolution.
D:A longer TTL makes stale hardcoded addresses linger longer and increases the risk of prolonged connectivity failures after endpoint changes.
Question 84
A branch-office modernization project needs hybrid connectivity. Projected traffic is modest, variable and not latency-critical, while a procurement proposal claims Direct Connect is always cheaper than an internet VPN. What should the architect do before choosing a network option?
- Order a full dedicated Direct Connect port without analyzing traffic or redundancy needs.
- Use an S3 gateway endpoint as a branch-office IPsec tunnel replacement.
- Assume any VPN is free because AWS never charges for gateways or transferred bytes.
- Compare Direct Connect port and data-transfer charges against Site-to-Site VPN and transport costs, capacity, latency and required redundancy.
Explanation
Correct Answer
D:The correct decision depends on throughput, latency consistency, availability and both fixed and variable charges. Comparing total connection economics avoids treating dedicated connectivity as automatically cheapest.
Incorrect Answers
A:A fixed dedicated port can introduce unnecessary spend at modest throughput; Direct Connect should be justified using actual capacity, availability and economics.
B:An S3 gateway endpoint provides private S3 access for VPC-associated routing and cannot establish branch-to-VPC hybrid IPsec connectivity.
C:VPN options have connection and data-transfer billing considerations; neither networking option is universally free.
Question 85
A company investigates a privileged IAM change discovered six months after it occurred. It needs centrally retained AWS API event records that can outlive the short console event-history view and support incident investigations. Which architecture is most appropriate?
- Store only ALB access logs because they record every IAM policy update.
- Enable appropriate CloudTrail trails or organization trails with controlled delivery and retention of relevant management events in a protected destination.
- Configure an S3 lifecycle rule to create IAM policy audit events retroactively.
- Use Route 53 health checks on the IAM API hostname as the identity audit system.
Explanation
Correct Answer
B:CloudTrail records supported AWS API activity, including identity-bearing management events. Delivering events to protected long-retention storage and monitoring changes supports investigations beyond limited event-history windows.
Incorrect Answers
A:ALB access logs document supported load-balancer traffic, not general IAM and AWS management API operations across accounts.
C:Object lifecycle configuration can manage retained log files but does not itself collect events that were never recorded or reconstruct missing IAM operations.
D:DNS health checks monitor endpoint reachability; they do not capture who called CreatePolicy or changed IAM role trust policies.
Question 86
An enterprise has hundreds of project teams sharing AWS resources. Access should follow project ownership, and security wants to avoid editing a separate IAM policy every time a resource is created. The organization can enforce trusted tags on principals and resources. Which model helps scale authorization?
- Grant all developers an administrator policy and label resources for billing only.
- Use one AWS root login per project and share each password among team members.
- Use tag-based ABAC conditions matching approved principal and resource project tags, with controls over who can set or change those tags.
- Create an IAM role per project and hardcode each new resource ARN into a separate inline permission policy every time a project adds resources.
Explanation
Correct Answer
C:Attribute-based access control can condition access on trusted principal and resource attributes. Tag governance is essential because unauthorized tag edits could otherwise expand effective permissions.
Incorrect Answers
A:Tags alone do not limit AdministratorAccess. Without effective policy conditions, project labels are merely metadata and overbroad access remains.
B:The root user is an account-level principal, not an appropriate per-project identity scheme. Shared root accounts undermine least privilege and attribution.
D:Per-project static resource lists can be made secure but reproduce the exact policy maintenance problem. Controlled ABAC tags permit authorized principal/resource matches as projects grow.
Question 87
A SaaS API is deployed behind an internet-facing Application Load Balancer. The company wants a trusted public TLS certificate and automated renewal for the ALB listener without maintaining a manual private-key deployment process. Which AWS feature fits?
- Request and attach a supported public ACM certificate to the ALB HTTPS listener, completing validation and lifecycle controls.
- Store an unencrypted private key in an S3 public website bucket and manually download it to each target on every request.
- Use an AWS WAF rate-based rule as the TLS certificate authority for the load balancer.
- Configure a Network ACL to negotiate HTTPS certificates on behalf of clients.
Explanation
Correct Answer
A:AWS Certificate Manager can issue and manage supported public certificates and integrate them with an ALB HTTPS listener. DNS/email validation and certificate eligibility should be confirmed.
Incorrect Answers
B:Publishing private keys exposes a sensitive credential; it does not provide a secure managed TLS certificate lifecycle.
C:WAF examines HTTP requests and enforces web protection rules but is not a certificate authority or TLS key manager for ALB listeners.
D:Network ACLs are stateless subnet packet filters and do not perform TLS handshakes or certificate renewal.
Question 88
An EC2 application should accept TCP 443 requests only from its ALB security group. The application initiates responses to those requests, and the team does not want to open unnecessary inbound ephemeral ports. Which security-group design is appropriate?
- Open all inbound TCP ports from 0.0.0.0/0 because stateful return paths require a separate allow rule.
- Use only a Network ACL inbound allow and remove the instance's security group to make responses stateful.
- Allow TCP 443 inbound to the instance from the ALB security group and rely on security-group statefulness for response traffic.
- Use an S3 bucket policy allowing HTTPS to establish the EC2 packet filter.
Explanation
Correct Answer
C:Security groups are stateful ENI-level controls. Referencing the ALB security group on the target's port 443 supports only intended load-balancer traffic and automatically allows responses to established flows.
Incorrect Answers
A:An unrestricted inbound rule expands exposure. Stateful security groups track permitted connections, so return packets do not require a separate inbound ephemeral-port authorization.
B:Network ACLs are stateless and their response traffic must be accounted for separately; removing EC2 security groups is not the way to obtain stateful filtering.
D:An S3 bucket policy authorizes S3 API operations and has no role in filtering TCP traffic to an EC2 instance.
Question 89
A business collects private HR documents in S3. Multiple teams may adjust bucket policies, and the security requirement is to reduce the risk of accidental public exposure through ACLs or policies. Which foundational S3 protection should it apply?
- Enable S3 Block Public Access at appropriate account/bucket scope alongside restrictive IAM and bucket policies.
- Enable static website hosting so private objects are automatically encrypted and never public.
- Use S3 Transfer Acceleration as the primary permission-evaluation control.
- Route all S3 access through a NAT gateway and assume public bucket policies can no longer apply.
Explanation
Correct Answer
A:S3 Block Public Access provides protective settings against public ACL/policy exposure. It complements properly scoped access policies and monitoring; necessary private workflows should be tested.
Incorrect Answers
B:Static website hosting can expose content and does not enforce the intended private policy model.
C:Transfer Acceleration optimizes eligible upload paths and is not a mechanism to reject public bucket ACLs or policies.
D:Network egress routing does not override server-side S3 authorization; a publicly accessible bucket can remain public even when some internal clients use NAT.
Question 90
A workload role has an IAM policy allowing kms:Decrypt, but requests to use a customer-managed KMS key still fail. The key is in the same account and security has not authorized the role through its key policy model. What should the team examine?
- Increase EBS volume throughput because KMS Decrypt depends on provisioned IOPS.
- Check that the KMS key policy enables the intended permissions or appropriate IAM delegation, and verify all applicable IAM/grant/condition constraints.
- Add an S3 object version to bypass KMS key authorization for decryption.
- Allow public internet DNS lookups to the key alias and treat that as cryptographic permission.
Explanation
Correct Answer
B:KMS authorization depends on the key's resource policy, applicable IAM policies and grants where used. An IAM Allow alone does not necessarily authorize key use without the required key-policy arrangements.
Incorrect Answers
A:Storage throughput is unrelated to whether a principal is authorized to call KMS Decrypt on a specific key.
C:An S3 object version changes object history, not the KMS key permission evaluation required to decrypt SSE-KMS ciphertext.
D:A key alias is a resource reference and DNS visibility is not an authorization grant or substitution for KMS policy.
