Courseiva

SAA-C03 (SAA-C03) — Questions 301302

302 questions total · 5pages · All types, answers revealed

Page 4

Page 5 of 5

301
MCQmedium

An event ingestion service writes to a DynamoDB table where the partition key is tenantId and the sort key is eventTime. During a campaign, one tenant generates a disproportionate share of traffic, causing write throttling and increased latency for that tenant’s writes. You can change the data model and application queries, but you must still efficiently retrieve events for a tenant for the last 10 minutes. Which change best improves write throughput by reducing hot partitions?

A.Keep tenantId as the partition key and rely on DynamoDB adaptive capacity to automatically remove all throttling.
B.Add a shard attribute to the partition key (partition key = tenantId#shard, where shard is randomly selected from a fixed range). Query all shards for the tenant for eventTime values in the last 10 minutes, then merge results in the application.
C.Change the sort key to eventTimeBucket (for example, eventTime rounded to 1-minute buckets) while keeping the partition key as tenantId.
D.Enable DAX and use it for write operations so throttled writes are served from cache instead of reaching DynamoDB.
AnswerB

This “write sharding” spreads a tenant’s traffic across multiple partition key values, which distributes the write load across multiple DynamoDB partitions (and thus multiple throughput slices). Reads for the last 10 minutes remain efficient because each shard still supports a sort-key range query on eventTime; the application merges results across shards.

Why this answer

It distributes writes for a hot tenant across multiple partitions by appending a random shard suffix to the tenantId partition key. This eliminates a single hot partition, allowing DynamoDB to scale write capacity horizontally. The application can then query all shards for the last 10 minutes and merge results, satisfying the retrieval requirement.

Exam trap

The trap here is that candidates assume adaptive capacity or caching (DAX) can solve write throttling, but neither addresses the root cause—a single partition exceeding its write capacity—which requires redistributing the partition key across multiple physical partitions.

How to eliminate wrong answers

Option A is wrong because DynamoDB adaptive capacity can only mitigate moderate hot spots by temporarily allocating extra capacity, but it cannot eliminate throttling when a single partition exceeds its 1,000 WCU or 3,000 RCU limit; sustained high traffic from one tenant will still cause throttling. Option C is wrong because changing the sort key to eventTimeBucket does nothing to distribute writes across partitions—the partition key remains tenantId, so all writes for that tenant still target the same partition, leaving the hot partition problem unsolved. Option D is wrong because DAX is a read-through cache and does not handle write operations; throttled writes are not served from cache, and DAX cannot increase write throughput or reduce hot partition contention.

302
MCQmedium

Your team hosts a private web app on an S3 bucket and serves it through CloudFront using a modern Origin Access Control (OAC). After deployment, users receive HTTP 403 from CloudFront with the S3 origin error "AccessDenied". Which S3 bucket policy change best aligns with CloudFront OAC so the distribution can fetch objects privately?

A.Allow the CloudFront service principal cloudfront.amazonaws.com to perform s3:GetObject, and scope access with a condition on AWS:SourceArn matching your CloudFront distribution ARN.
B.Allow only the S3 bucket owner account to perform s3:GetObject without any condition, so CloudFront can inherit access automatically.
C.Add a policy statement that denies s3:GetObject when the request does not include the header CloudFront-Viewer-Country.
D.Grant s3:GetObject permission to an Origin Access Identity (OAI) canonical user ID even though you are using Origin Access Control (OAC).
AnswerA

With CloudFront OAC, the request to S3 is authorized using the CloudFront service principal. Granting s3:GetObject to cloudfront.amazonaws.com and constraining it with AWS:SourceArn to the specific distribution is the standard secure pattern for private S3 origins.

Why this answer

CloudFront Origin Access Control (OAC) requires an explicit S3 bucket policy that allows the CloudFront service principal (`cloudfront.amazonaws.com`) to perform `s3:GetObject`, and the recommended best practice is to scope the permission using a condition on `AWS:SourceArn` matching the specific CloudFront distribution ARN. This ensures that only requests originating from that distribution can access the bucket objects, preventing unauthorized access from other sources.

Exam trap

The trap here is that candidates often confuse Origin Access Control (OAC) with the older Origin Access Identity (OAI) and incorrectly select an OAI-based policy (Option D), or they assume that bucket owner permissions automatically extend to CloudFront (Option B), failing to recognize that OAC requires an explicit service principal-based policy with a source ARN condition.

Why the other options are wrong

B

CloudFront OAC does not automatically inherit permissions from the bucket owner; it requires an explicit bucket policy that allows the CloudFront service principal with a condition on the source ARN. Option B lacks this condition and principal, so it would not grant CloudFront access.

C

This option is wrong because CloudFront OAC does not use headers like CloudFront-Viewer-Country for authentication; the 403 error is due to missing permissions for CloudFront to access S3, not due to missing headers.

D

The question specifies using Origin Access Control (OAC), not Origin Access Identity (OAI). OAI uses a canonical user ID, but OAC uses the CloudFront service principal with a source ARN condition. Granting permissions to an OAI canonical user ID does not work with OAC, so the distribution will still receive 403 errors.

When would these options actually be correct?

B

This option would be correct if the question asked about a scenario where the S3 bucket is publicly accessible and no CloudFront origin access control is needed, such as when serving static assets directly from S3 without CloudFront.

C

This option would be correct in a scenario where you need to restrict access to your S3 content based on viewer's country, such as when serving content only to specific countries for licensing or compliance reasons, and you want to deny access from other countries.

D

If the question stated that the distribution uses an Origin Access Identity (OAI) instead of OAC, then granting s3:GetObject permission to the OAI's canonical user ID would be correct. For example: 'You configured CloudFront with an OAI to restrict access to an S3 bucket. Which bucket policy allows CloudFront to fetch objects?'

Why candidates pick the wrong answer

B

Candidates may mistakenly think that CloudFront inherits the bucket owner's permissions automatically, not realizing that OAC requires an explicit policy statement with the CloudFront service principal and source ARN condition.

C

Candidates might think that adding a header-based condition could resolve the access issue, misunderstanding that the 403 is about authorization, not about missing headers for geo-restriction.

D

Candidates may confuse OAI with OAC, or think that any identity-based access works similarly. They might recall that OAI uses canonical user IDs and assume it applies to OAC as well, not realizing OAC uses a different authorization mechanism.

Page 4

Page 5 of 5

All pages