SAA-C03 (SAA-C03) — Questions 76–150

SSE-KMS with customer managed keys gives the company control over the KMS key, including key policies, rotation, and auditing via AWS CloudTrail. It integrates natively with S3, so no application changes are needed, minimizing operational overhead. This meets the requirements for customer-controlled keys, rotation, and auditability while leveraging AWS-managed infrastructure.

This is correct because API Gateway's JWT authorizer validates the RS256 signature, issuer, audience, and expiry of a JWT issued by your customer's OpenID Connect (OIDC) provider. It automatically discovers the provider's JWKS keys through the OIDC discovery endpoint, so no custom Lambda code is required. The verified token claims are then passed to the integration via context, enabling clean, low-operational-overhead authentication for public API users. This directly matches the need to confirm the identity of each caller.

If the visibility timeout is shorter than the processing time, the message becomes visible again and a second consumer can pick it up, causing duplicate settlement charges. Setting the timeout above the worst-case processing duration prevents this overlap and is essential for minimizing duplicates in a pull-based worker fleet.

This change directly restricts trust to one named role in Account B and adds a confused-deputy defense with the external ID. The role trust policy is the correct place to control who can assume the role, and the external ID ensures only the expected caller can complete the STS request.

Storing session data in ElastiCache for Redis with Multi-AZ provides automatic failover to a replica in another Availability Zone. Spreading the Auto Scaling group across zones lets replacement instances launch in a healthy zone and reconnect to the session store, preserving sessions through a zone failure.

Warm standby runs a fully functional but reduced-capacity version of the application stack in the secondary Region, including application servers and a database that is continuously replicated from the primary Region (for example, via Amazon RDS cross-Region read replicas or Aurora Global Database). Because the environment is already running, failover only requires scaling up the existing infrastructure and promoting the replica, which keeps RTO well under 2 hours. Continuous replication also keeps data lag within the 15-minute RPO, making this the correct choice for the given constraints.

S3 Standard-IA is designed for data accessed infrequently but requiring rapid access when needed, and its lower storage price with a 30-day minimum duration matches the access pattern described. A lifecycle transition applies automatically without application changes and preserves the objects for the required retention period.

AWS Systems Manager Session Manager establishes an interactive shell connection through the SSM Agent using a bidirectional channel over the AWS API, controlled by the instance's IAM role. Because no security group ingress rule is needed, there is no inbound SSH/RDP exposure, and each session is automatically audited through AWS CloudTrail with optional session logs to S3/CloudWatch Logs. The required IAM role grants least-privilege permissions (e.g., AmazonSSMManagedInstanceCore) and lets administrators restrict actions centrally via IAM policies, providing secure, audited administrative access.

CloudTrail management events capture control-plane API calls, including PutBucketPolicy and PutKeyPolicy, recording the request parameters, principal, source IP, and timestamp. An EventBridge rule can match these event names and invoke an SNS topic or Lambda function to notify the security team within seconds of the call. Delivering the raw CloudTrail logs to a dedicated S3 bucket creates a tamper-evident, centrally retained audit trail for post-incident analysis and compliance reporting, whereas simply watching resource state via Config would not provide the same event-level specificity.

Permission boundaries work by intersecting allowed actions from the role’s attached policies with the actions permitted by the boundary policy. If the automation tool fails to set the PermissionBoundary ARN (or sets an incorrect one), then the role can use the developer’s attached policies without the intended restriction. Fixing the PermissionBoundary parameter in the role creation call is the direct remedy.

On-demand capacity is suitable for unpredictable workloads and charges per request without capacity planning.

A Retry policy with exponential backoff lets Step Functions re-invoke the task when the gateway times out, absorbing transient failures without abandoning the workflow. Bounding MaxAttempts prevents infinite retries that could amplify load on a struggling gateway. Because retries happen within the state machine, the workflow resumes automatically once the gateway responds, satisfying the resilience requirement.

An Auto Scaling group across multiple Availability Zones redistributes capacity when a zone is lost, and its health checks replace instances that fail. Attaching the group to an Application Load Balancer target group means ELB health checks drive replacement of unhealthy instances. This satisfies both zone-failure survival and automatic instance replacement with minimal operational overhead.

A dead-letter queue combined with a redrive policy's maxReceiveCount is the correct solution. Each time a message is received, SQS increments its receive count; when the count exceeds maxReceiveCount, SQS moves the message from the source queue into the configured DLQ, isolating it from normal traffic. This lets the payments consumer continue processing healthy messages while the poison message is held for investigation. An appropriate threshold (for example, 3 to 5) balances retrying transient errors against letting a permanently bad message consume all subsequent visibility timeouts and retries.

CloudFront caching with appropriate TTLs is correct because CloudFront edge locations store copies of S3 objects and serve them directly to viewers based on the configured cache TTL. If the S3 origin becomes temporarily unavailable, requests can still be fulfilled from cached content at the edge as long as the object is still in the cache and its TTL has not expired—this effectively masks origin downtime. Choosing appropriate TTLs (e.g., long TTL for immutable static assets) maximizes the chance that cached copies remain available during an outage while balancing freshness, and CloudFront can even serve stale content when it fails to reach the origin.

The hit ratio is low because CloudFront is varying the cache on request attributes that do not change versioned static files. Removing Authorization, cookies, and irrelevant query strings from the cache key allows CloudFront to reuse cached objects across users and sessions. Reducing the origin request policy avoids sending unnecessary viewer context to the origin. Because the filenames are already versioned, long TTLs can be used safely and will lower origin requests and S3 request costs.

Scheduled scaling lets you increase or decrease the desired capacity of an Auto Scaling group based on a date and time, which matches a workload with a known, repeating peak pattern. Scaling in overnight and on weekends terminates unneeded instances, so you pay only for the capacity actually required, while scaling out before business hours preserves availability during peak traffic.

S3 Cross-Region Replication (CRR) creates an asynchronous, automatic copy of every object in the us-west-2 source bucket to a destination bucket in us-east-1. By updating the application to read from the us-east-1 bucket, all GET requests stay within the same Region, eliminating inter-Region data transfer charges that currently accrue for each cross-Region read. Since CRR transfers each object once during replication (rather than on every read), this pattern becomes cost-effective when the application frequently reads the same large objects. You must still account for a short replication lag, so the app should tolerate eventual consistency for newly written objects.

A target tracking scaling policy automatically adjusts the number of instances to maintain a specified metric, such as average CPU utilization, at a target value. This is ideal for variable traffic because it scales out when CPU rises and scales in when it falls. It helps handle sudden spikes and reduces costs during low traffic by terminating unnecessary instances.

An interface VPC endpoint, powered by AWS PrivateLink, creates an elastic network interface with a private IP address directly in the subnets of your VPC. This allows instances in the private subnets to reach Systems Manager and Parameter Store using private DNS, with no internet gateway, NAT gateway, or public IP required. The traffic stays entirely within the AWS network, satisfying the requirement for fully private connectivity. This endpoint also supports security group attachment for granular traffic control.

SSE-KMS with a customer managed key allows the company to control key rotation and audit usage via AWS CloudTrail. The key policy can be scoped to allow only the application's IAM role to perform the Decrypt operation, ensuring that no other principals can access the data. This meets all stated requirements.

Expiring noncurrent versions after a retention period removes old versions that are no longer needed, directly reducing storage charges while keeping current objects and recent versions protected. This is the standard S3 lifecycle action for controlling version accumulation cost.

A bucket policy is a resource-based policy that can explicitly grant the partner's IAM role principal (e.g., 'arn:aws:iam::partner-account-id:role/PartnerReadOnlyRole') permission to call 's3:GetObject' on the 'reports/' prefix. By scoping the 'Resource' to 'arn:aws:s3:::your-bucket/reports/*' and optionally adding a condition such as 'aws:SourceArn' or 'ExternalId', you enforce least privilege without creating or distributing long-lived keys. This is the standard AWS pattern for granting cross-account read-only access to a limited S3 prefix.

gp3 is the best fit because it lets you provision IOPS and throughput separately from volume size. The exhibit shows the workload needs around 10,000 IOPS and experiences queue buildup on gp2. With gp3, the team can raise performance without unnecessarily increasing storage capacity, which is usually more cost-effective for this kind of database workload.

NLB is designed for Layer 4 TCP/UDP traffic with very low latency and high throughput. It supports TCP health checks and preserves the original client source IP by default, which enables accurate client-IP-based rate limiting for a custom TCP protocol.

If the ASG is attached to subnets in multiple Availability Zones, when instances in the failed AZ become unhealthy/terminate, Auto Scaling can launch new instances in the remaining AZs to restore the desired capacity. This directly addresses the root cause: the ASG cannot create capacity outside the AZs it is configured for.

A role-based approach removes long-lived keys and supports temporary credentials. Using a permissions-policy condition to require MFA presence enforces that the session must have MFA to perform actions, aligning with the “actions only allowed with MFA present” requirement.

A FIFO queue with content-based deduplication and per-order message group IDs delivers each message once and preserves order within a group, while a DynamoDB conditional write using an order ID attribute rejects a second attempt even if a retry slips through. Together they provide exactly-once processing with high parallelism across order groups.

Amazon CloudFront is a content delivery network that caches static content at edge locations and can also forward dynamic requests to the ALB origin. By configuring both the S3 bucket and the ALB as origins, CloudFront can serve static content from cache and dynamically route API calls, reducing latency for global users. This is the most effective solution for mixed content.

The sts:ExternalId condition is a common protection against confused-deputy scenarios in cross-account role assumption. It ensures that only principals who know the unique external ID can successfully assume the role. This mitigates a third party tricking the vendor’s identity into assuming your role, even if they can call AssumeRole.

Fargate Spot offers up to 70% lower cost for interruptible tasks, and mixing it with a small on-demand baseline preserves availability when Spot capacity is reclaimed. Because the API runs behind an ALB with multiple tasks, a reclaimed Spot task is replaced and traffic continues, making this a valid cost reduction.

A gateway VPC endpoint for S3 keeps traffic between the VPC and S3 on the AWS network without using the public internet or a NAT gateway. This is the standard private-connectivity pattern for S3 access from private subnets. It also simplifies the architecture and reduces NAT-related cost while preserving access to the bucket from workloads that must remain nonpublic.

With SSE-KMS using a customer-managed key, the caller must have both s3:GetObject and kms:Decrypt on the key. The KMS key policy grants only the account root, so the EC2 role has no kms:Decrypt permission. Without it, S3 cannot decrypt the object for the caller, resulting in AccessDenied. Adding kms:Decrypt to the role or key policy resolves the issue.

Active/active with multi-Region replication (such as DynamoDB global tables) allows writes to succeed in multiple AWS Regions simultaneously, ensuring near-zero RPO and immediate write availability during a Regional failure. Routing traffic by health and latency distributes load intelligently and automatically shifts users to the nearest healthy Region, which directly satisfies the global, write-heavy workload's requirement for continuous writes with minimal data loss.

ListBucket must be authorized at the bucket ARN level, then scoped using a Condition on the request prefix (so only the approved listing prefix is allowed). GetObject is authorized at the object ARN level and is restricted to exports/acme/*, preventing reads outside the prefix.

S3 scales request rates by partitioning an index by key prefix, and a hot prefix can throttle GET throughput. Distributing keys with a high-cardinality prefix spreads the load across many partitions, raising the request rate the bucket can sustain. This complements byte-range fetches and keeps objects durable in S3, directly improving the reported GET bottleneck.

Configuring an HTTPS listener on the ALB with an ACM certificate terminates TLS at the load balancer, encrypting all traffic between clients and the ALB. The ACM certificate is validated and managed by AWS, and the listener negotiates a TLS connection using an appropriate security policy. Adding an HTTP-to-HTTPS redirect rule ensures that any request sent to port 80 is automatically sent over port 443, so every client is forced to use an encrypted connection. This directly meets the requirement for encrypting traffic in transit for the internal web application.

Spot Instances offer the largest discounts (up to 90% off On-Demand) and are ideal for fault-tolerant, flexible workloads like batch processing that can be interrupted and resumed. Since the job checkpoints its progress, it can handle interruptions gracefully. Using Spot Instances directly addresses the cost minimization goal while accommodating the job's interruptible nature.

Kinesis Data Streams retains ordered records for a configurable period, letting multiple independent consumers read the same stream at their own pace via separate iterators. This satisfies the stem's requirement for parallel, independent processing of high-volume click events.

Using On-Demand for the master node keeps the cluster's control plane stable, while Spot Instances on task nodes can reduce compute cost because the stateless batch jobs can be re-run if a Spot node is reclaimed. This matches the SAA-C03 cost-optimization goal for transient, fault-tolerant analytics workloads.

Amazon SQS is a distributed message queue that decouples the patient portal from the order-processing backend: the portal sends each order as a message, and SQS durably stores it across multiple Availability Zones until a consumer polls and processes it. During a burst, SQS absorbs the unprocessed messages, allowing the backend to scale out or catch up at its own pace rather than being overwhelmed. The visibility timeout prevents the same message from being processed by multiple workers, while a dead-letter queue captures any messages that fail repeatedly after a configured number of attempts. This buffering plus retry capability directly addresses the bursting workload described in the scenario.

An Application Load Balancer is a regional service that routes traffic to healthy targets across the Availability Zones it is enabled in. By spanning the ALB and Auto Scaling group across at least two AZs, an AZ failure leaves the remaining instances serving traffic while health checks automatically redirect requests away from the failed zone, preserving availability for the stateless web API. This aligns with AWS best practices for fault-tolerant multi-AZ architectures.

Deletion protection on DynamoDB tables is a table-level setting that blocks delete table operations via the API, console, or SDK, while tightly controlled IAM permissions ensure only authorized principals can execute destructive actions. Together they create a robust defense-in-depth mechanism that directly mitigates the risk of accidental table removal. This is a required control for a payments API because losing the entire table would be catastrophic, even if backups exist.

Permission boundaries cap the maximum effective permissions for the role by intersecting the identity policy and the permissions boundary at authorization time. Even if the identity policy later expands, the boundary still prevents actions not allowed by the boundary policy, providing deterministic enforcement against privilege escalation.

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache designed specifically for Amazon DynamoDB, delivering microsecond response times for repeated reads. When the document portal queries the same product key frequently, DAX serves subsequent identical queries from memory, drastically reducing read latency and offloading read capacity units from the table. It integrates seamlessly with the DynamoDB API, requiring only an endpoint change, and is the correct solution for this read-heavy, hot-key access pattern.

Spreading ECS tasks across subnets in multiple Availability Zones with a desired count of two or more means the loss of one Availability Zone leaves running tasks in the remaining zones, and the Application Load Balancer health checks route traffic only to healthy targets. The ALB DNS name stays constant, so callers need no changes and no manual failover step is required.

A dead-letter queue (DLQ) paired with a redrive policy that sets a specific maxReceiveCount (for example, 5) is the correct solution. When a message is received from the source queue more times than the configured limit without being deleted, SQS automatically moves the message to the DLQ. This quarantines unfixable messages so they can be analyzed or replayed later, preventing them from consuming worker instances and blocking normal workflow processing.

Reserved Instances with All Upfront payment provide the highest discount (up to 72% off On-Demand) for a 1- or 3-year commitment. By paying the entire amount upfront, the company maximizes savings. This option is ideal for steady-state workloads where the instance type and region are known, and the company is willing to commit for 3 years.

SQS Standard provides at-least-once delivery, so duplicates can still occur. The most resilient design is to make the payment handler idempotent so repeated deliveries do not create duplicate side effects, and to set the visibility timeout long enough to cover the worst-case processing time to reduce unnecessary re-delivery.

SCPs set the outer boundary for permissions in an account or OU. They do not grant access, but they can block actions even when the IAM role has AdministratorAccess. The explicit deny in the SCP is therefore the reason CreateSnapshot fails. To allow the operation, the organization must change the SCP or move the account out of the restrictive scope.

RequestCountPerTarget matches the actual demand reaching each instance and scales capacity before the thread pool saturates. Because CPU is still low, CPU-based scaling would react too late or not at all. Target tracking on request count helps keep queue depth and latency down while avoiding unnecessary overprovisioning during quieter periods.

A customer managed key in AWS KMS gives the company control over the key policy, rotation settings, and key state. Enabling automatic rotation rotates the backing key material annually while retaining the same key ID, and disabling the key immediately prevents new decrypt operations, satisfying both the rotation and revocation requirements.

For multipart uploads, S3 clients use s3:AbortMultipartUpload to stop/cleanup an in-progress multipart upload (for example, when an upload fails or the client cancels). Granting s3:AbortMultipartUpload only on the uploads prefix matches the denied API in the symptom and keeps the permission scoped to the exact objects the service uploads.

S3 Glacier Instant Retrieval is designed for long-lived, rarely accessed data that still needs millisecond retrieval. It costs significantly less than S3 Standard-IA for storage while meeting the auditors' requirement to fetch any image within minutes. This aligns storage cost with the access pattern over the seven-year retention period.

A Compute Savings Plan is the most cost-effective option because it provides a significant discount (up to 66% versus On-Demand) in exchange for a one- or three-year hourly spend commitment, while allowing flexibility across instance families, sizes, availability zones, regions, and even compute services like Lambda and Fargate. For a production portal that runs continuously, the predictable, always-on usage justifies the commitment, and the plan automatically applies to any EC2 instance usage without needing specific instance configurations.

Implementing idempotency with a DynamoDB table keyed by a deterministic payment request ID (for example, an MD5/SHA-256 hash of the order ID, amount, and currency) lets a consumer use a conditional PutItem with ConditionExpression 'attribute_not_exists(id)'. A successful conditional write claims the ID for the first request; a failed write on retry tells the consumer the payment was already handled, so no charge is created again. This turns at-least-once SQS delivery into effectively exactly-once processing because duplicate messages either see the existing record or lose the race to create it, and the payment action is triggered only on the first successful claim.

Gateway endpoints provide private routing to S3, and interface endpoints provide private access to Secrets Manager without internet traversal. Security group controls on interface endpoints restrict traffic to only the application subnets, meeting segmentation and cost constraints.

Converting to a Multi-AZ DB instance deployment creates a synchronous standby in a different Availability Zone and provides automatic failover. The DNS endpoint remains the same, so the hardcoded connection string continues to work after failover. This meets the requirements for zone resilience and minimal downtime with the least application change.

Right sizing reduces cost by matching instance capacity to actual demand. If average CPU is consistently low (around 10%) and performance is stable, it strongly indicates overprovisioning. Moving to a smaller instance (or a smaller capability within the same family) typically lowers hourly cost while maintaining sufficient capacity for the workload.

Pilot light keeps only core components such as the database replication running in the second Region, so recovery within hours is achievable without rebuilding everything, while ongoing cost stays well below an active-active deployment. It matches the lower-cost, few-hours RTO constraint.

This design places instances in private subnets so they have no public IPs or direct internet route, while the NAT gateway in a public subnet provides outbound internet access. Referencing the load balancer's security group as the source of the inbound rule on the instances' security group ensures that only the ALB can open connections to port 443, which is exactly the required restriction and avoids hardcoding CIDR ranges.

CloudFront caches the static images and JavaScript at edge locations worldwide, so distant users retrieve objects from nearby points of presence instead of the S3 origin region. This directly cuts latency, and it is a managed AWS-native service, satisfying the architecture review board's stated preference.

Compute Savings Plans apply to AWS Fargate usage as well as EC2 and Lambda, so they reduce the effective rate for Fargate vCPU and memory while preserving the existing task definitions. For a continuous 3-year commitment, this is the direct way to lower Fargate compute cost without changing the architecture.

This is the standard supported method to encrypt an existing unencrypted RDS instance. You snapshot the instance, restore the snapshot with encryption enabled and a customer managed KMS key, then update the application connection string. It satisfies the requirement for customer-controlled key rotation, auditing, and revocation via KMS.

S3 Cross-Region Replication with Replication Time Control provides a predictable 15-minute replication SLA and replicates objects, versions, and metadata to the destination bucket. The application can be pointed to the destination bucket during a Regional outage, and no code changes are needed because S3 APIs remain the same, meeting both RPO and low-overhead requirements.

RDS Proxy pools and shares database connections, so bursts of application connections are multiplexed onto a smaller set of database connections, eliminating TooManyConnections errors without code changes beyond the endpoint. It preserves Aurora failover by automatically redirecting to the new writer, and it can be associated with read-only endpoints for reader traffic. This directly addresses connection exhaustion while keeping resilience.

IAM database authentication generates short-lived tokens from the EC2 instance role, so no database password is stored on the instance. This directly satisfies the requirement that credentials never reside on EC2 and that authentication uses temporary tokens.

A gateway VPC endpoint for Amazon S3 inserts a prefix-list route into the VPC route table, directing traffic destined for S3 to the AWS network without leaving through a NAT gateway or internet gateway. Gateway endpoints are free—there is no hourly fee and no per-GB data processing charge—so the NAT gateway's per-GB processing fee on these downloads is completely eliminated. This is the only option that directly removes the data processing cost while preserving private connectivity.

Amazon DAX is an in-memory caching layer for DynamoDB that accelerates repeated reads. When many clients request the same items (for example, “latest status” point reads by deviceId), DAX can serve cached responses directly, reducing round trips to DynamoDB and lowering read latency during peak periods.

Amazon SQS is a fully managed queue that satisfies durable, at-least-once messaging without requiring broker administration. It removes the EC2 broker fleet, patching, backups, and failover testing, and it reduces outage risk from broker maintenance. Because the workload does not need AMQP-specific features such as exchanges or routing keys, SQS is the most cost-effective and operationally simple replacement.

Referencing the application tier security group as the source in the RDS security group rules ensures that only application instances can connect to the database. This enforces least privilege and prevents internet access. It also simplifies management because instances added to the application security group automatically gain access.

EFS General Purpose performance mode is designed for latency-sensitive use cases with a broad range of I/O sizes, including typical file-sharing and web-content workloads. Throughput mode Bursting provides baseline throughput and allows throughput to scale up during demand spikes, which matches the pattern of short read bursts from many instances. When traffic drops, the system returns to baseline without requiring you to provision peak throughput for all time.

For multipart uploads, SSE-KMS is specified on CreateMultipartUpload rather than on individual UploadPart calls. Supplying the required SSE-KMS settings and CMK key ID on the upload initiation request satisfies the bucket policy's condition without weakening the encryption requirement.

Because editors assume a permission set role through IAM Identity Center, CloudTrail records each kms:Decrypt and kms:GenerateDataKey call with the role session and the federated user identity, satisfying the audit requirement. Removing a single editor from the permission set assignment in IAM Identity Center removes their ability to assume the role, revoking only that person's access without touching the shared key policy.