SAA-C03 (SAA-C03) — Questions 826–900

Kinesis Data Streams retains records for up to 365 days and allows many consumers to read the same data independently, each tracking its own position. Using the instrument symbol as the partition key routes all events for a symbol to the same shard, which preserves per-symbol ordering. The Kinesis Client Library handles shard discovery, checkpointing, and load balancing across consumer instances.

Read replicas are designed to serve read-only traffic using MySQL's asynchronous replication. Directing the application's read queries to the existing replicas removes that read load from the primary DB instance, which is the goal here. Because replicas are already deployed and receiving some traffic, extending application read routing to them is the minimal-change, correct optimization for reducing primary load.

SSE-KMS with customer managed keys allows the company to create and rotate keys on its own schedule. AWS KMS records every use of the key in AWS CloudTrail, providing the required audit trail. This satisfies both the control over rotation and the need to log each cryptographic operation.

Failover routing is designed for this pattern: Route 53 returns the primary alias while the primary endpoint is healthy, and switches to the secondary alias when the primary health check fails. Alias records integrate cleanly with ALB targets, and the health check provides the signal that drives the failover decision.

An Auto Scaling policy driven by a suitable CloudWatch metric, such as average CPU utilisation or ALB request count per target, adds instances when demand rises and removes them afterwards. This directly addresses the sustained high CPU and latency during peak traffic.

Spot provides significantly lower pricing than On-Demand for EC2 capacity. Because the workload is designed to tolerate interruption (checkpointing + resubmission from the last checkpoint), the team can safely accept Spot interruptions. Resubmission from durable checkpoints preserves correctness while still capturing the cost advantage of Spot.

The right cost-optimization review here is to ask whether the batch analytics job truly needs a NAT gateway in every Availability Zone or whether one per AZ is sufficient. A NAT gateway is a zonal resource, and the standard high-availability pattern is to deploy one per AZ and route each AZ's private subnets to its local gateway; having two NAT gateways in the same AZ adds no resiliency because an AZ failure affects both, and the second gateway only doubles the hourly and per-GB costs. If the batch job is not required to be highly available or can tolerate an AZ outage, a single NAT gateway per AZ (or even one total) could be enough, which is exactly what should be evaluated before paying for four gateways.

The ASG health check grace period tells Auto Scaling to ignore failing health checks for a period after instance launch. This prevents newly launched instances from being replaced before the application has finished booting and can pass ALB health checks.

Target tracking scaling with ALB request count per target directly measures actual demand by dividing incoming requests by the number of healthy EC2 instances. The policy automatically adjusts capacity to keep the average near a target value, and because the ALB metric updates in near real time, it can add instances within minutes when a traffic spike begins. This ties scaling directly to the user-facing load that causes queuing and latency, making it the most responsive and precise option.

A Compute Savings Plan lets you commit to a specific dollar-per-hour amount for a one- or three-year term in a given region, and the discount automatically applies to any EC2 instance family or size in that region. This is ideal for an Auto Scaling group with steady 24/7 API traffic because it captures predictable usage while preserving the flexibility to scale or change instance families without renegotiating the commitment. Usage above the committed amount simply runs at normal on-demand rates, so you still receive the lower rate on the bulk of your steady baseline.

AWS Systems Manager Session Manager uses the SSM agent and an IAM instance role to provide secure shell access without needing inbound ports such as 22 or 3389. It authenticates through the AWS control plane, encrypts all session traffic, and can record sessions in CloudTrail and S3 for auditing. This provides the required audited, secure administrative access while keeping instances in a private subnet.

Compute-optimized families provide the highest ratio of vCPUs to memory and are engineered for workloads that need sustained, high-throughput CPU processing. These instances feature high-performance processors and low per-core latency, making them ideal for batch rendering where the application spends most of its time executing compute instructions. By selecting a compute-optimized family, you ensure the rendering service gets the maximum CPU resources per dollar without paying for unnecessary memory or storage.

CloudFront caches content at edge locations worldwide, reducing latency for global users by serving requests from the nearest edge. Using the S3 bucket as the origin with default cache behavior is a low-cost, standard pattern for static sites. It requires minimal configuration and scales automatically, making it the best fit for the startup's goals.

Provisioned concurrency during campaign windows is the correct solution because it initializes the Lambda runtime and application code in advance, removing the cold-start penalty for the first request in each concurrently processed execution environment. By setting a provisioned concurrency level prior to the campaign, the booking site can handle unpredictable spikes with consistently low latency, and the configuration can be scaled or scheduled to align with expected traffic patterns.

io2 is designed for mission-critical workloads that need sustained, predictable, low-latency random I/O. Unlike gp2, it does not depend on burst credits for performance. Provisioning the required IOPS directly addresses the exhausted BurstBalance and the sustained throughput requirement above 16,000 IOPS.

Amazon EFS is the managed AWS file service built for shared POSIX-style file access from multiple instances. It supports concurrent read/write access from many EC2 hosts and is a better fit than EBS, which is attached to a single instance, or S3, which provides object storage rather than a native shared filesystem. For an application that expects standard filesystem semantics, EFS is the correct storage layer.

The aws:sourceVpce condition key in an S3 bucket policy checks the VPC endpoint ID from which the request originated. When the EC2 instance sends traffic through the designated VPC endpoint, the request includes the endpoint's ID, allowing the condition to match and granting access. Any request not coming through that endpoint, even with valid IAM credentials, would fail the condition and be denied, thus forcing the traffic to traverse the private endpoint.

Spot Instances offer spare EC2 compute capacity at up to a 90% discount compared to On-Demand, with the tradeoff that AWS can reclaim this capacity with a two-minute warning for other customers' workloads. Because the batch analytics job runs nightly, lasts several hours, and can be interrupted and resumed, it is exactly the kind of fault-tolerant, flexible workload that Spot was designed for. Using Spot Instances dramatically reduces compute costs while accommodating the job's tolerance for interruptions, making it the correct answer for a cost-optimized architecture.

Versioned filenames let each asset be cached with a long TTL because a content change produces a new URL, so the cache-hit ratio rises for static assets while revalidation behaviour prevents stale content being served under an unchanged name.

Spot Instances let you bid on spare EC2 capacity at steep discounts — often 60-90% off On-Demand prices. Since the batch analytics job runs for several hours each night and can be interrupted and resumed, it is exactly the type of fault-tolerant workload AWS designed Spot Instances for. You can use Spot with a checkpointing strategy to save intermediate results, making it the most cost-effective choice.

Amazon ECS is a native container orchestration service. You can run containers without Kubernetes, and ECS integrates with AWS-native autoscaling (for example, ECS Service Auto Scaling with targets such as CPU/memory or request-based metrics when applicable to the architecture).

Moving the uploaded source images to Amazon S3 decouples the data from any single EC2 instance, so terminating an instance no longer destroys in-flight uploads. S3 provides durable, highly available object storage that all instances can access concurrently. Because the API already treats instances as stateless workers, replacing local storage with S3 is the standard resilience pattern and requires no change to the fleet's scaling behavior.

An Auto Scaling policy that uses a CloudWatch metric such as Average CPUUtilization immediately addresses the symptom: when CPU load rises beyond a threshold, it launches additional EC2 instances to distribute incoming ALB traffic, and when utilization falls it terminates excess instances. This is the standard, automated horizontal-scaling mechanism for a retail API and directly matches the need to accommodate fluctuating CPU load without manual intervention.

A gateway endpoint for S3 adds a prefix list route to the subnet route tables that directs S3-bound traffic to the endpoint instead of an internet gateway or NAT device. Because the private subnets have no internet route, the gateway endpoint is what allows patch downloads from the company's bucket to succeed while keeping the traffic on the AWS network.

A dead-letter queue or failure destination captures invocation records after Lambda exhausts its asynchronous retries, retaining failed events for later investigation. This is native Lambda configuration, so no custom operational scripts are needed, satisfying the requirement to retain failures without extra tooling.

An interface VPC endpoint (AWS PrivateLink) creates private ENIs in the subnets, routing Secrets Manager HTTPS traffic over the AWS network without internet or NAT. Security group rules permitting HTTPS from the application subnets complete the private path.

An instance profile delivers temporary credentials through the instance metadata service, so no long-term access keys are stored on the instances. Scoping the role policy to the exact bucket and the two needed actions enforces least privilege. This directly addresses both the credential and the permission requirements for the workload.

The cluster endpoint always resolves to the current writer, so reconnecting after failover targets the promoted instance rather than a stale writer address; retry logic lets long-lived connections re-establish without restarting clients, reducing write interruption.

Spot capacity is typically the lowest-cost EC2 option and can be reclaimed by AWS with interruption notices. Because the workload is explicitly restartable and checkpoints to durable storage, interruptions do not break correctness. Since there is no requirement to reserve capacity, the variable workload aligns well with Spot’s spare-capacity model.

AWS WAF, when attached to an Application Load Balancer, acts as a web application firewall that inspects each HTTP(S) request at the application layer (Layer 7). It uses managed rule groups (e.g., AWS Managed Rules for SQL injection and XSS) and custom rules to filter and block malicious traffic before it reaches the backend instances. This is the appropriate service for detecting and mitigating SQL injection and cross-site scripting because it can parse HTTP headers, body, and URI patterns, and it integrates natively with ALB rules to allow, block, or count matching requests.

Referencing the load balancer's security group as the source in the instance security group's inbound rule allows only traffic that originates from the load balancer. Because security group references are evaluated on the source's security group membership, no IP ranges need to be maintained. This satisfies the requirement that instances accept traffic only from the ALB and cannot be reached directly from the internet.

KMS key policies are the primary access control for a customer managed key. Removing broad decrypt permissions from the root statement and granting kms:Decrypt only to the analytics role ensures that no other principal can decrypt, even if they have broad S3 permissions, because S3 decrypt operations require both S3 object access and kms:Decrypt on the key. Identity-based policies granting decrypt elsewhere must also be removed.

This architecture places the ALB in public subnets to receive internet traffic, while the EC2 instances remain in private subnets without public IPs. The ALB security group allows inbound 80/443 from the internet, and the EC2 security group allows inbound only from the ALB, ensuring that instances are not directly accessible. This meets all requirements and follows AWS best practices.

With automated backups enabled, RDS supports PITR within the retention window. PITR lets you restore to any second within that window, so you can select a timestamp just before the destructive deletion occurred. This avoids restoring a potentially stale snapshot and eliminates the need for risky manual compensating scripts.

Cross-account access to SSE-KMS encrypted objects requires KMS authorization in addition to S3 authorization. The key policy must trust the partner role, and the permissions should be limited to the needed KMS actions such as Decrypt, Encrypt, and GenerateDataKey with a service condition for S3. That is why the partner can have valid S3 permissions and still fail until the KMS policy is fixed.

IAM database authentication for RDS allows an EC2 instance to use its instance role to request a short-lived authentication token from AWS STS and present that token to PostgreSQL as the password. Because the credentials are temporary and scoped by IAM policies, there is no persistent database password stored in the application, and rotation is handled automatically when the token expires. This approach also lets you control access per IAM role or user, exactly the application's identity, while still requiring standard PostgreSQL authorization after authentication succeeds.

A Multi-AZ deployment creates a synchronized standby replica in a different Availability Zone of the same Region. Amazon RDS automatically fails over to the standby when a problem is detected on the primary, providing high availability for the DB instance. This is the correct solution for automatic, synchronous failover with minimal data loss.

Route 53 failover routing is purpose-built for active-passive architecture across two endpoints. The PRIMARY ALIAS record is tied to a health check that monitors the API Gateway regional endpoint in the primary region; when that health check fails, Route 53 automatically returns the SECONDARY record's endpoint, redirecting traffic to the secondary region. This is the correct, fully managed way to achieve automatic regional failover for public APIs.

Hot partition throttling usually occurs when too many requests target a single partition key value. Salting transforms the partition key so that one high-traffic customerId maps to multiple distinct partition keys (e.g., customerId#0, customerId#1, etc.), which increases the number of partitions that can serve that customer’s workload concurrently and reduces the probability that a single partition becomes overloaded.

SSE-KMS with a customer managed key allows you to control the KMS key, and you can enable automatic key rotation with a period of one year. This meets the requirement for encryption at rest using KMS keys and annual rotation. S3 default encryption ensures all new objects are encrypted automatically.

These Deny conditions directly block noncompliant requests regardless of the caller’s IAM permissions because explicit Deny in a resource policy overrides any Allow. aws:SecureTransport identifies whether the request used TLS. The SSE-KMS headers (s3:x-amz-server-side-encryption and s3:x-amz-server-side-encryption-aws-kms-key-id) identify whether SSE-KMS was requested and which CMK key id was used.

A gateway VPC endpoint for Amazon S3 works by adding a prefix-list route to the VPC route table, directing S3-destined traffic from private subnets over the AWS backbone to the regional S3 endpoint. It requires no NAT gateway, no internet gateway, and no hourly charge, eliminating the per-GB NAT data processing fees on large media downloads. This is the correct cost-optimization mechanism for private-subnet access to S3.

Increasing the Auto Scaling group minimum to at least 2 and using subnets in at least two Availability Zones guarantees baseline EC2 capacity in multiple AZs. If one AZ becomes unavailable, the ALB can route traffic to healthy targets in the remaining AZ, and ECS has compute available to reschedule tasks. This directly provides the cross-AZ redundancy needed for the service to continue operating.

ASG scale-out uses the configured Launch Template version at instance launch time. Switching the ASG to the latest version ensures new instances are consistent. An instance refresh helps apply changes to running instances safely and predictably.

A CloudFront distribution with the S3 bucket as its origin places static images at edge locations strategically positioned near end users, so each request is served from the nearest Point of Presence instead of traversing the entire Internet to the S3 origin. This dramatically lowers latency for global users, reduces the number of direct requests hitting S3, and can reduce origin data transfer costs. CloudFront also supports persistent connections and HTTP/2, which further improve the download experience for mobile clients.

Switching from gp2 to gp3 decouples IOPS and throughput from volume capacity, so you pay only for the storage size needed rather than provisioning extra gigabytes to reach a performance tier. This directly cuts the per-GB cost of the test servers' volumes while preserving equivalent baseline performance and full snapshot recovery options.

A Multi-AZ DB cluster runs one writer and two readable standbys across three Availability Zones and provides a single writer endpoint plus a reader endpoint. Failover is automatic and typically faster than a Multi-AZ DB instance, and the endpoint remains stable, so the application is unaffected. This meets the zone-failure and no-connection-string-change requirements.

Provisioned IOPS SSD volumes such as io2 deliver consistently high, configurable IOPS independent of volume size, meeting the transactional database's steady performance demand. gp3 and gp2 burst and scale IOPS with capacity, so they cannot guarantee the sustained throughput required.

Aurora Global Database is the correct choice because it uses a primary Region plus up to five secondary Regions with dedicated storage-level replication typically under one second. This gives a low recovery point objective (RPO) and fast promoted read replica failover for disaster recovery, unlike snapshot-based or single-Region options. It also allows local reads in secondary Regions for low-latency access, directly meeting the ticket system's requirement for fast access and rapid DR.

Application Auto Scaling supports target tracking for ECS services, and ALBRequestCountPerTarget is a predefined metric that scales tasks based on the load each task receives from the load balancer. It responds to demand changes automatically, works with Fargate because no EC2 capacity needs to be managed, and requires no custom scaling logic.

S3 CRR replicates objects asynchronously to a bucket in another Region and requires versioning on both source and destination, preserving version history. If us-east-1 becomes unavailable, the application can read from the replica bucket, and writes can be redirected there, satisfying the low-latency read and continued-write requirements.

An SCP is an AWS Organizations policy that applies a permission guardrail to all IAM principals in member accounts, and it can deny ec2:CreateVolume when the request does not include the ec2:Encrypted condition key set to true. For example, a statement using the Bool condition on ec2:Encrypted: false will block any attempt to launch an unencrypted volume in every account under the organizational unit, regardless of IAM permissions. This is a preventive control that stops noncompliant resources before creation, which exactly satisfies the requirement, and an SCP cannot be overridden by user or role policies.

Point-in-time restore uses automated backups plus transaction logs to recreate the database at a specific moment. For accidental deletion, this is the correct RDS recovery method because it can recover the database to just before the bad change while preserving all legitimate data up to that point.

A bucket policy that sets the Principal element to the partner role's ARN (e.g., arn:aws:iam::123456789012:role/PartnerRole) and the Resource to backup/prefix/* grants read-only access to only that prefix while keeping the bucket private. This resource-based policy is evaluated together with the partner role's own identity-based policy, so both administrators can enforce least privilege, and the source account can revoke access centrally by editing the bucket policy. Using a role also leverages temporary credentials and CloudTrail auditing.

CloudFront caches the static images and JavaScript at edge locations worldwide, so distant users fetch objects from nearby points of presence rather than the S3 origin, cutting latency. This directly addresses the slow load times reported in distant countries.

FSx for Lustre is a high-performance file system optimized for compute-intensive workloads like genomics. It provides sub-millisecond latencies, millions of IOPS, and hundreds of gigabytes per second of throughput. It supports POSIX permissions and can be linked to an S3 bucket for durable long-term storage. The file system can scale to hundreds of terabytes and is accessible from thousands of EC2 instances concurrently, making it ideal for this scenario.

NAT gateways are provisioned per Availability Zone, and the standard high-availability pattern is one NAT gateway per AZ, not multiple in the same AZ. If the batch analytics job runs in only one AZ or its required private subnets are all within a single AZ, a second NAT gateway in that same AZ provides no additional resilience while doubling the hourly and data-processing charges. The cost optimization is to confirm that each AZ contains at least one private subnet needing egress; if not, the NAT gateway count should be reduced to one per AZ with active private workloads.

An interface VPC endpoint for Secrets Manager creates elastic network interfaces (ENIs) with private IPs inside your subnets, enabling direct, private access to the service over the AWS backbone. You can attach security groups to the endpoint to enforce inbound and outbound traffic controls, and endpoint policies further restrict which secrets or actions are allowed. This fully satisfies the requirement to avoid internet egress because no traffic leaves the AWS network.

Pilot light is a disaster recovery pattern that keeps a minimal, low-cost core of the application running in the backup Region—often just the database, replication, and a small compute tier—so that in a full Region outage you can quickly scale out the remaining services by invoking pre-written IaC and orchestration runbooks. It deliberately avoids paying for idle production-scale capacity, trading a longer failover time (typically minutes to an hour) for significant cost savings while still preserving recovery capability.

For public assets, Authorization should not vary the cache key. Removing it from the cache key allows CloudFront to reuse cached objects across requests, and not forwarding it to the origin avoids unnecessary origin variation and request overhead.

S3 Glacier Instant Retrieval is designed for long-lived archive data that is rarely accessed but requires millisecond retrieval. It costs less than S3 Standard-IA for long-term storage and meets the requirement that documents remain immediately retrievable for seven years. A lifecycle policy can transition objects after the active 90-day period.

Gateway VPC endpoints for Amazon S3 provide private connectivity without requiring an internet gateway or NAT device. They are free of charge and do not incur data processing fees. Updating the route tables to direct S3 traffic to the gateway endpoint ensures that traffic stays within the AWS network, meeting both the private access and cost minimization requirements.

An HTTPS listener on the ALB encrypts traffic between clients and the load balancer using an ACM certificate. A security group attached to the ALB can restrict inbound access to the corporate CIDR range on port 443. This enforces both encryption in transit and source IP restriction without changing the application. The ALB terminates TLS, so backend traffic can be configured separately if needed.

An IAM role attached to the EC2 instance profile supplies temporary credentials via instance metadata, so the application reads DynamoDB and writes to S3 without embedded long-lived access keys. Removing those keys eliminates a persistent credential that could be leaked or rotated manually.

Rate-based rules are designed specifically to mitigate abusive traffic by limiting the number of requests from an identified source (typically by IP). When the threshold is exceeded, you can set the rule action to Block (or count first for tuning).

Secrets Manager is designed for this use case: it stores secrets encrypted with KMS, and it offers built-in rotation for Amazon RDS through a managed Lambda function. The application retrieves credentials at runtime via the API or SDK, so nothing is stored in code or on disk, and rotation occurs automatically on the configured schedule.

Amazon SQS is a fully managed message queue that decouples the warehouse integration service from order-producing applications. Producers enqueue each order, and consumers poll for messages at their own pace, allowing the queue to absorb sudden bursts and hold messages until processing capacity is available. Visibility timeout temporarily hides in-flight messages to prevent duplicate processing, while a dead-letter queue captures messages that repeatedly fail, enabling safe retries and preserving the order data during transient outages.

VPC endpoints provide private connectivity from your VPC to supported AWS services without traversing the public internet or a NAT Gateway. For example, you can use a gateway endpoint for S3 (and interface endpoints for other services where supported), which avoids NAT Gateway hourly and data-processing charges.

S3 Object Lock in compliance mode ensures that objects, once written, cannot be overwritten or deleted by any user, including the root account, until the specified retention period expires. This "write-once-read-many" (WORM) model is crucial for audit logs, providing an immutable record that meets stringent regulatory compliance requirements for data integrity and non-repudiation. It directly prevents any accidental or malicious alteration of the log data, making it tamper-proof.

The aws:sourceVpce condition in a bucket policy restricts access to requests that arrive through a specific VPC endpoint, matching the endpoint ID exactly. This enforces the network path by verifying that the request source is the VPC endpoint you created for the private subnet, preventing access from the public internet or other VPCs. It is a robust, network-based condition that works alongside IAM identity policies, and it directly proves that traffic transited the endpoint.

Global Accelerator assigns two static anycast IP addresses and accepts TCP/UDP traffic at AWS edge locations, then forwards it across the AWS private global backbone to the configured Application Load Balancer. This avoids the public internet's variable routing hops and packet loss, which materially reduces latency and jitter for dynamic, non-cacheable telemetry traffic. It also supports weighted endpoint groups and automatic failover, making it the right performance layer for an ALB-backed pipeline.

A Standard Reserved Instance is ideal for a steady, always-on instance that will not change family or Region. It provides a significant discount over On-Demand in exchange for a one- or three-year commitment, and it requires no architectural change. This directly lowers the monthly compute bill while preserving availability.

AWS Secrets Manager is the only option that provides a purpose-built, managed secret lifecycle with automatic rotation. Rotation is implemented by a custom or AWS-provided Lambda function that updates the secret value in the store and in the target database or service, ensuring credentials are periodically changed without application downtime. The service also supports fine-grained access policies, versioning during rotation, and native integration with Amazon RDS, Redshift, and other AWS services, so it is the optimal choice for an order-processing API that must rotate credentials automatically.

Aurora automatically promotes an Aurora Replica to writer when the current writer fails, and the cluster writer endpoint is repointed to the new writer, so the application keeps using the same endpoint and resumes writes without code changes. Having the replica in a separate Availability Zone ensures the failover target survives the zone event.