AWS Certified Solutions Architect - Associate (SAA-C03) — Questions 1–75

Because instance store volumes are physically attached to the host hardware, they avoid the network latency associated with EBS. This results in very high IOPS and low latency, making them perfect for high-performance computing tasks that require rapid access to temporary datasets.

Referencing the EC2 security group ID is a best practice for internal VPC communication. It ensures that any instance associated with that security group can connect to the database. This approach is highly dynamic, as it automatically handles instance IP changes and maintains a secure, restricted network path.

Amazon Aurora automatically replicates storage across three Availability Zones and promotes a read replica to primary within seconds if the primary instance fails. This prevents database downtime and protects against data corruption during infrastructure failures.

S3 Intelligent-Tiering charges a small monthly monitoring and automation fee per object. When applied to millions of tiny log files, these fees aggregate significantly. If the access patterns are predictable, using a different storage class like S3 Standard-IA avoids these per-object monitoring costs, resulting in lower total expenditure.

FSx for Lustre is built for high-performance computing and provides the sub-millisecond latencies and high throughput needed by HPC clusters. Its parallel file system architecture allows multiple compute nodes to read and write large datasets concurrently, making it the industry standard for HPC workloads running on AWS cloud infrastructure.

The ELB health check type ensures that the Auto Scaling group considers an instance unhealthy if the Application Load Balancer determines the application is not responding correctly. This provides a more accurate view of application health than basic EC2 status checks, which only monitor the underlying hardware and network connectivity of the virtual machine.

Even though Alice has an identity-based policy allowing 's3:PutObject', an explicit 'Deny' in a resource-based policy (like a bucket policy) always overrides any 'Allow'. This is a common cause of Access Denied errors when multiple layers of security policies are applied to a resource.

Compute Savings Plans are the most flexible option. They apply to usage across EC2 (any family, any region), Fargate, and Lambda. This flexibility allows the company to change their compute technology or move workloads between regions while still benefiting from the discounted rates, ensuring long-term cost optimization.

The instance is significantly over-provisioned, as shown by the low peak CPU and memory metrics. Scaling down to a smaller instance type within the same family reduces the hourly cost linearly. This right-sizing approach ensures that the company is not paying for unused compute capacity while still meeting performance needs.

By specifying a SourceVpce condition, the policy ensures that only requests coming through the designated VPC Gateway Endpoint are allowed. This configuration routes S3 traffic over the AWS private network backbone rather than the public internet. This results in more consistent performance, lower latency, and reduced data transfer costs for internal AWS traffic.

VPC Flow Logs provide a detailed view of all network traffic flowing through the VPC's network interfaces. This allows security teams to monitor for anomalous patterns, identify unauthorized traffic, and verify that security groups and NACLs are behaving as expected, making it the correct tool for this specific scenario.

Pre-baked AMIs remove the multi-minute bootstrap, so new instances serve traffic almost immediately and scale out before peak load causes 504s. The health check grace period prevents the Auto Scaling group terminating instances that are still initialising, avoiding premature replacement.

Amazon Macie automatically discovers, classifies, and protects sensitive data at scale. It uses built-in sensitive data identifiers for common PII types and allows for custom identifiers. This makes it the ideal tool for organizations needing to audit their S3 storage for regulatory compliance and data privacy.

Gateway Endpoints for S3 are provided at no additional cost and do not incur data processing charges. By routing S3 traffic through the endpoint instead of the NAT Gateway, the company eliminates the per-GB processing fee for all data transfers to and from S3, leading to massive cost savings.

Spot Instances are ideal for fault-tolerant, batch-oriented workloads like video transcoding. They offer significant cost savings, and since the application can handle interruptions by resuming jobs, the risk associated with Spot capacity reclamation is mitigated, resulting in an optimal high-performance and low-cost architectural design for this specific use case.

IRSA allows you to associate an IAM role with a Kubernetes service account. This provides each pod with the minimum necessary AWS permissions to access services like S3 or DynamoDB, rather than giving permissions to the entire worker node, adhering to the principle of least privilege.

Trusted Advisor includes a 'Cost Optimization' pillar that specifically flags idle resources, such as unassociated Elastic IP addresses, underutilized Amazon EBS volumes, and idle Amazon RDS instances. It provides a quick dashboard view of immediate savings that can be achieved by terminating or resizing these resources.

ElastiCache provides sub-millisecond latency for session data access. By offloading session state to an external cache, the application servers become stateless, which allows for seamless horizontal scaling. This architecture is both highly performant and the industry-standard approach for managing sessions in distributed, high-scale applications.

Aurora Serverless is the most cost-effective choice because it scales to zero capacity (in v1) or a very low baseline (in v2) when there is no traffic. You are only billed for Aurora Capacity Units (ACUs) when the database is actually processing requests, perfectly aligning costs with the 'unpredictable' usage pattern.

Attaching an IAM role to an EC2 instance allows the application to use temporary security credentials provided by the Instance Metadata Service. This eliminates the need to hardcode or store long-term keys, adhering to the principle of least privilege and significantly improving the overall security posture.

S3 Object Lock in compliance mode ensures that an object version cannot be overwritten or deleted by any user, including the root user in the AWS account. This mode is essential for meeting regulatory requirements where data must be preserved and remain unalterable for a specified duration without any exceptions.

Aurora Global Database is specifically designed for regional disaster recovery. It uses dedicated infrastructure to replicate data to secondary regions with minimal latency, typically under one second. This configuration allows for rapid promotion of a secondary region to read-write status in the event of a primary regional failure.

Moving from gp2 to gp3 is a direct cost-saving measure as gp3 is priced 20% lower per GB. It provides a baseline performance of 3,000 IOPS and 125 MB/s for free, regardless of volume size, which often meets or exceeds the performance of small gp2 volumes at a lower price.

AWS Cost Explorer is the service that enables users to query cost and usage data programmatically or via the console. The permissions listed in the exhibit allow the analyst to retrieve granular data about spending and the efficiency of their commitment-based pricing models, which is the core functionality of Cost Explorer.

Decomposing the monolith into independent services using containers provides the best fault isolation. If one service fails, the other services can continue to operate, limiting the impact of the failure. Using containers also allows for faster deployment, better resource utilization, and easier management, all of which contribute to a more resilient overall architecture.

Since inter-region data transfer is billed based on the amount of data (GB) moved across the network, reducing the size of the payload through compression directly reduces the cost. This is a simple, software-based optimization that requires no additional AWS infrastructure and scales effectively with the volume of data.

Reserved Instances are ideal for predictable, steady-state workloads because they offer up to 72% discount compared to On-Demand pricing. Since the company knows the database will be running during business hours for the foreseeable future, committing to a one-year or three-year term provides the most substantial baseline cost reduction.

The policy uses a Deny effect combined with a false condition for secure transport, which means any request not using HTTPS is blocked. This is a preventative control that ensures data is encrypted while moving between the client and S3, protecting it from interception by unauthorized parties.

Route 53 is the primary tool for global traffic management. Its health checks continuously monitor the status of regional endpoints. If an endpoint fails, Route 53 can update DNS records to route traffic to healthy infrastructure in other regions, providing the necessary resilience against regional-wide service interruptions.

Warm Standby keeps a minimized version of the full environment running in the second region. This ensures that the application is always ready to handle traffic, and only needs to be scaled up to meet production loads during a failover. This strategy easily fits the 30-minute RTO and 15-minute RPO requirements while remaining cost-conscious.

DynamoDB Global Tables enable multi-region, multi-active replication, allowing the database to survive a full regional failure. It provides automatic synchronization of data across multiple regions, enabling low-latency access for globally distributed users and ensuring that the application can remain operational even if one of the AWS regions experiences a complete outage.

S3 Versioning keeps multiple variants of an object in the same bucket, providing protection against accidental deletion. Lifecycle policies automatically handle the transition of older versions to S3 Glacier or perform expirations, ensuring that storage costs remain optimized while maintaining high data durability and recovery capabilities for the bucket.

S3 Standard-IA provides a lower storage cost for data that is infrequently accessed. Since the objects are accessed rarely after 30 days, this tier is perfectly suited for the workload. Transitioning via lifecycle policies ensures that storage costs are minimized automatically as the data ages past the frequent-access window.

ACM Private CA allows you to create a private CA hierarchy and issue certificates that are trusted within your organization. It integrates with ACM to automate certificate renewal and management, providing a highly available and secure way to implement TLS for internal applications without the manual effort of managing PKI.

AWS Secrets Manager provides built-in support for rotating credentials for Amazon RDS and other databases. It manages the lifecycle of the secret and can trigger a Lambda function to update the database password, making it the primary service for this requirement of automated rotation.

An SQS FIFO queue buffers checkout requests when payment Lambdas are throttled, decoupling API Gateway from the processor so requests persist rather than being lost to timeouts. FIFO ordering and exactly-once processing preserve transaction sequence, directly meeting the no-lost-transactions requirement during flash-sale spikes.

IAM roles provide temporary security credentials that are automatically rotated by AWS. By attaching a role to the EC2 instance, the application gains the necessary permissions without the need for static credentials, which is the industry standard for secure service-to-service authentication and authorization within the AWS ecosystem.

This storage class provides the low cost of Glacier storage with the same latency and throughput as S3 Standard. It is perfect for regulatory data that must be kept for years but needs to be available immediately for an auditor, offering the best balance of cost and access speed.

User Pools act as a managed user directory that provides sign-up and sign-in options for app users. They support standard identity providers like Google and Facebook, as well as custom attributes, making them the ideal choice for managing the authentication layer of a modern mobile or web application.

Multi-AZ deployment ensures that a synchronous standby instance is maintained in a separate Availability Zone. In the event of a primary instance failure, RDS automatically promotes the standby to primary, significantly reducing downtime and ensuring the database remains available for critical application traffic without manual intervention or data loss.

Using SSE-KMS with a Customer Managed Key (CMK) allows the security team to define specific key policies and manage rotation schedules independently. This solution ensures that the security team retains ownership of the cryptographic material while providing the necessary encryption for objects stored within the S3 bucket.

Stopping an RDS instance is highly effective for cost reduction in development environments. While the instance is stopped, you are not charged for compute hours or licensed software. You only pay for the provisioned storage and any manual snapshots, making it ideal for workloads that are strictly limited to business hours.

Object Lock provides WORM (Write Once, Read Many) protection. By preventing objects from being overwritten or deleted for a set period, it ensures that even an account compromise cannot destroy the backup data. This is the most effective way to secure backups against malicious actors and accidental data loss.

Cluster Placement Groups are purpose-built for low-latency and high-throughput network performance. By packing instances into the same physical rack or cluster, they enable the high-speed interconnect required for CPU-bound, latency-sensitive applications. This is the optimal configuration for HPC workloads demanding consistent, ultra-fast inter-instance communication within a single AZ.

AWS KMS allows for the creation of customer managed keys that support automatic annual rotation. Once enabled, AWS handles the rotation of the backing key material without requiring changes to the application or EBS configuration. This integrates natively with CloudTrail for auditing, making it the most efficient solution available.

gp3 volumes are the latest generation of general-purpose SSDs and are priced up to 20% lower per GB than gp2. Additionally, gp3 allows you to provision IOPS and throughput independently of storage capacity, which prevents the need to over-provision storage just to get higher performance, leading to further savings.

Route 53 failover routing policies monitor the health of primary region endpoints. If health checks fail, traffic is automatically routed to the secondary region. This is a foundational step in building a resilient multi-region architecture that provides automated business continuity during a regional disaster.

DAX is specifically designed to provide microsecond response times for DynamoDB reads. It handles the cache management and is API-compatible, meaning the application can use existing DynamoDB SDKs to access the cache, making it the most efficient way to achieve sub-millisecond latency.

Systems Manager Inventory collects metadata about software, applications, and configurations installed on EC2 instances. This provides the visibility needed to identify which instances are running the non-compliant software versions, which is the foundational step for both reporting and triggering the remediation actions required by the security audit.

Latency routing optimizes the user experience by serving requests from the AWS Region that provides the lowest network latency. When combined with health checks, it provides both performance optimization and high availability. Route 53 monitors the health of the endpoints and automatically skips any region that fails health checks during the routing decision.

Amazon RDS Multi-AZ uses synchronous replication to a standby instance in a different AZ, providing automatic failover and data redundancy. If the primary instance fails, AWS automatically updates the DNS record to point to the standby. This meets the high availability and zero-intervention requirements while handling maintenance windows with minimal impact on application uptime.

SCPs provide central control over the maximum permissions available for all accounts in your organization. By applying the policy at the root, the restriction is inherited by all member accounts, including the root user of those accounts, ensuring consistent compliance with the CISO's regional requirements.

Target tracking scaling policies allow the Auto Scaling group to maintain a specific metric value, such as average CPU utilization. This approach ensures the application scales out proactively to handle incoming traffic spikes while scaling in during low activity to maintain optimal performance and cost-efficiency.

In cross-account access, both the bucket policy and the user's local IAM policy must explicitly permit the action. The bucket policy allows access from the account, but the individual user identity still requires an IAM policy that authorizes the s3:GetObject action to complete the authorization request successfully.

RDS Multi-AZ is specifically designed for high availability. It maintains a synchronous secondary standby in another AZ. Upon detecting a failure, RDS automatically initiates a failover process. This is the fastest, most reliable way to maintain database availability and minimize downtime for mission-critical applications without manual intervention.

CloudFront is specifically engineered to deliver content globally with low latency. By distributing content to hundreds of edge locations, it ensures that users receive data from the geographically closest server, significantly reducing round-trip times and providing a high-performance experience that simple regional storage cannot match for global users.

This architecture provides both high availability and security. By spreading instances across multiple AZs, the application can survive a data center failure. Placing the application tier in private subnets ensures that sensitive back-end components are not directly reachable from the internet, significantly hardening the application against external attacks.

Redundant Direct Connect connections in different locations provide protection against local failures, such as fiber cuts or data center outages. This ensures that even if one physical path is entirely compromised, connectivity can be maintained through the alternate path, meeting the requirements for a highly available and resilient hybrid cloud network infrastructure.

The 'Condition' block acts as a filter on the 'Allow' statement. By using the 'aws:SourceIp' key, the policy ensures that the 's3:GetObject' action is granted only when the request comes from the specified network, effectively implementing a security perimeter around the S3 bucket's data.

Customer Managed Keys allow the user to define granular key policies and enforce rotation schedules. This provides the level of control required for compliance and security auditing. By managing the key lifecycle, the company fulfills the requirement for ownership and authority over the encryption process for their S3 stored data.

CloudTrail log file integrity validation creates digital signatures of log files using SHA-256 for hashing and SHA-256 with RSA for digital signing. This allows you to verify that log files were not modified, deleted, or forged after delivery.

Spot Instances offer the deepest discounts in exchange for the possibility that AWS may reclaim the capacity with a two-minute notice. Since the application can resume progress after being stopped, the company can maximize savings by utilizing these instances during the weekend when spare capacity is often high.

Read Replicas allow the application to scale read capacity independently of the primary instance. By directing read queries to replicas, the primary instance can be smaller and less expensive, while the replicas handle the high read pressure during business hours at a lower cost than a single massive instance.

The Multi-Site Active-Active approach runs the application in multiple regions simultaneously. Because both regions are already handling production traffic, a failure in one region does not require scaling or recovery time; traffic is simply routed to the remaining active region, resulting in the lowest possible RTO for the application.

Compute Savings Plans are the most versatile option as they apply regardless of instance family, size, AZ, region, OS, or even the compute service. This plan covers EC2, Lambda, and Fargate usage, making it the ideal choice for a multi-service environment where maximizing savings across all platforms is necessary.

Spot Instances allow you to bid on spare AWS capacity at a fraction of the On-Demand price. Because the batch processing job is interruptible and can resume, it is the perfect use case for Spot. If AWS needs the capacity back, the instance is terminated, but the cost savings remain substantial.

Amazon GuardDuty provides intelligent threat detection by analyzing various data sources including AWS CloudTrail event logs and VPC Flow Logs. It can identify specific threats like EC2 instances communicating with known malicious IP addresses or performing cryptocurrency mining, making it the correct choice for this scenario.

Concurrency Scaling is designed for exactly this scenario. It provides extra compute power when needed and scales back down when the spike is over. Since Redshift offers free Concurrency Scaling credits for every 24 hours the main cluster is running, the company may even handle these spikes at no additional cost.

FSx for Lustre is a high-performance file system optimized for workloads like HPC, machine learning, and video processing. It can provide hundreds of gigabytes per second of throughput and millions of IOPS, while also integrating seamlessly with S3 for long-term data storage.

While VPC endpoints keep traffic within the AWS network, they are primarily for security and private connectivity. CloudFront provides edge caching, which offers superior performance for large file retrieval by serving objects from closer geographical locations, whereas a VPC endpoint only optimizes the path to the S3 region.

Lambda functions are only billed during the time they are executing. For a workload that only runs for a total of 60 minutes a day (5 minutes every few hours), the company would only pay for those 60 minutes of compute, resulting in massive savings over a running EC2 instance.

S3 Versioning allows multiple variants of an object to be kept in the same bucket. When an object is deleted, S3 inserts a delete marker instead of permanently removing the data, which allows for easy recovery of the original file and maintains a full history of all changes.

Private subnets are designed for backend resources that do not require direct internet access. By placing the database here, the architect ensures that the database is not exposed to the public internet, satisfying the fundamental security requirement for protecting backend data tiers from external unauthorized access attempts.

S3 Versioning preserves every version of every object, ensuring deleted or overwritten files can be easily restored. Multi-Factor Authentication Delete adds an extra layer of authorization security, requiring physical or virtual MFA tokens for permanent deletion operations.

Blocking public access acts as a centralized safeguard to prevent accidental exposure of S3 buckets to the public internet. This is a crucial first line of defense, ensuring that no bucket within the account can be made public, regardless of individual bucket policy or IAM configuration errors.