SAA-C03 (SAA-C03) — Questions 526–600

FSx for Lustre is designed for HPC workloads, providing a POSIX-compliant file system with sub-millisecond latencies and hundreds of GB/s throughput. A scratch file system is cost-effective for temporary workloads and does not replicate data, which suits the few-hours-per-week pattern. Linking to S3 allows seamless data import and export, reducing manual data movement.

Provisioned concurrency keeps a defined number of Lambda execution environments initialized and ready behind a specific alias. When traffic ramps up—especially after inactivity—invocations can use pre-initialized environments, reducing or eliminating cold starts for those requests.

Spreading the Auto Scaling group across subnets in at least two Availability Zones with health checks enabled ensures instances in a surviving AZ absorb traffic when one fails. This satisfies the requirement to tolerate a single AZ failure using AWS-native controls.

Enabling S3 Block Public Access at either the account or bucket level is the most robust and recommended control for preventing unintended public exposure of S3 buckets. This feature provides four distinct settings that can be applied to block public access granted through new or existing bucket policies, access control lists (ACLs), or any combination thereof. By enforcing these settings, S3 Block Public Access acts as a comprehensive safeguard, overriding any conflicting permissions that might otherwise inadvertently grant public read or write access to objects.

S3 Block Public Access provides four independent settings—BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets—that prevent users from making objects or buckets public through ACLs or bucket policies. When enabled at the account level, these settings act as a guardrail for all current and future buckets, and they take precedence over any conflicting public ACL or bucket policy. For an IoT ingestion API where objects must remain private, this is the decisive control.

CloudFront caches responses at edge locations close to users, so repeated reads of the same catalogue JSON are served from the edge with low latency. It supports the ALB as a custom origin, honors cache headers, and can forward dynamic requests to the origin while caching cacheable GET responses, which directly solves the distant-user latency for a read-heavy API.

SQS provides at-least-once delivery, meaning the same message can be delivered to a consumer more than once, especially during network timeouts or consumer crashes. An idempotent handler design ensures that processing a duplicate message does not cause duplicate side effects, such as creating duplicate database records or processing the same payment twice. This is typically achieved by storing a unique message identifier or business key and checking for prior processing before executing the business logic. Idempotency is the fundamental corrective control for SQS's inherent lack of exactly-once semantics.

An RDS read replica offloads read-only reporting traffic from the primary MySQL instance via asynchronous replication, directly relieving the contention described. Because the replica is a distinct endpoint, the team can enforce routing of reporting queries to it during normal operations, satisfying the stem's enforceability constraint.

A dead-letter queue isolates messages that repeatedly fail so they stop wasting worker capacity. Idempotency ensures a message processed more than once does not create duplicate side effects, which is essential when visibility timeouts expire or retries occur. Together, these controls address both poison-message handling and at-least-once delivery behavior.

Origin Access Control (OAC) enables CloudFront to authenticate every origin request to S3 using SigV4, so S3 can distinguish requests made by your distribution from all other traffic. You then write a bucket policy that allows s3:GetObject only when the principal is cloudfront.amazonaws.com and the aws:SourceArn matches your distribution's ID, thereby denying direct S3 bucket URL access. This is the standard secure pattern for a private S3 origin and is preferred over the older Origin Access Identity. It ensures that if someone finds a direct S3 URL, the bucket policy rejects it.

Lambda provisioned concurrency pre-initializes a specified number of execution environments and holds them in a ready state, so requests are served immediately without the initialization delay that causes cold starts. By configuring a baseline concurrency, you ensure that latency-sensitive APIs experience consistent response times even during traffic spikes, as new environments are warmed ahead of actual invocations.

A Redis replication group with automatic failover maintains a primary and replicas across Availability Zones; if the primary's AZ is impaired, ElastiCache promotes a replica automatically, so cached reads continue during maintenance events as the stem requires.

S3 Standard-IA offers lower per-gigabyte storage pricing than S3 Standard while still providing millisecond latency and immediate access. It is intended for long-lived, infrequently accessed data, so it fits the requirement to keep objects instantly retrievable for five years while cutting storage cost. A lifecycle rule automates the transition.

Multi-AZ instance capacity ensures tasks have eligible compute in another AZ when one AZ loses instances.

RDS Proxy is a fully managed, highly available database proxy that sits between the application and Amazon Aurora, maintaining a pool of established connections and reusing them for multiple app sessions. It dramatically reduces the overhead of opening and closing connections, which is particularly valuable for serverless applications like AWS Lambda that scale quickly and create connection storms. By multiplexing client connections through a small set of persistent connections, RDS Proxy keeps Aurora within its max connection limits and also improves failover resilience by preserving connection paths.

S3 Object Lock in Compliance mode establishes an unalterable Write Once, Read Many (WORM) state for objects. This mode prevents any user, including the AWS account root user, from deleting or overwriting objects until the specified retention period, in this case, 7 years, has expired. The retention period cannot be shortened or removed by anyone, ensuring the highest level of data immutability required for strict financial regulatory compliance.

Amazon RDS Multi-AZ provides a synchronous standby in another Availability Zone with automatic failover, protecting committed orders. An Auto Scaling group across AZs keeps the web tier available, and ElastiCache for Redis externalizes session state so users are not tied to one instance, delivering resilience with minimal application redesign.

General Purpose is the best EFS performance mode when the priority is low latency for small file operations. The exhibit describes a moderate number of clients and latency-sensitive metadata access, which matches the strengths of General Purpose. It is the usual choice for most applications unless the workload specifically needs very large-scale parallel throughput.

An SQS standard queue is designed for decoupling components and provides at-least-once delivery with high throughput, ensuring that every message placed in the queue is eventually delivered to a consumer. Because at-least-once delivery can produce duplicate messages, consumers must be built to process each event idempotently so that repeated handling does not corrupt state or create duplicate outcomes. This combination satisfies the requirement that every event is processed.

Correct. SQS provides at-least-once delivery, so the same message can be processed more than once if the worker times out, retries, or crashes after partially completing the work. An idempotency key lets the application recognize that the payment was already created and prevents duplicate charges.

AWS Global Accelerator is correct because it uses static anycast IP addresses at AWS edge locations to route inbound TCP/UDP traffic over the high-quality AWS global network, delivering it to the Application Load Balancer without relying on content caching. This directly reduces latency, jitter, and packet loss for dynamic API requests from global users, making it ideal for an analytics dashboard that repeatedly fetches live data.

With only three possible partition key values, all writes for a given value are routed to the same partition, which is hard-capped at 1,000 write capacity units per second. A higher-cardinality partition key, such as a composite key combining customer ID with a timestamp, spreads write traffic across many partitions and uses the table's provisioned throughput more effectively, preventing hot-partition throttling.

A read replica is a separate RDS instance that receives asynchronous replication from the primary. It offloads read-only reporting queries, reducing load on the primary and allowing the primary to remain at its current size. Because the application tolerates slightly stale reads, asynchronous replication lag is acceptable. The read replica can be sized independently and stopped or scaled down when not needed, making it more cost-effective than scaling up the primary.

A dead-letter queue with a configured maxReceiveCount is the standard SQS mechanism for poison messages. When a message is received that many times without being deleted, SQS automatically moves it to a separate DLQ, isolating the problematic message from the main queue. This lets you inspect and debug the payload while healthy traffic continues unaffected. This also protects downstream consumers from continuous failure loops.

CloudFront caching with appropriate TTL values lets the CDN store static objects at edge locations and continue serving those cached copies even when the S3 origin is temporarily unreachable, as long as the cached object has not expired. Setting longer TTLs for immutable content (e.g., versioned images, scripts, and stylesheets) reduces the frequency of origin fetches and widens the window of resilience during an S3 outage. This is the only proposed solution that keeps content available to end users during an origin failure, directly addressing the requirement to tolerate an S3 outage.

An S3 lifecycle policy automates object transitions based on age, aligning storage cost with actual access patterns. Since logs are queried only for 30 days, rules can move older logs to S3 Standard-IA after 30 days, then to S3 Glacier Instant Retrieval or S3 Glacier Flexible Retrieval, and eventually to S3 Glacier Deep Archive for archival. This approach minimizes storage cost while keeping recent logs immediately accessible, and it requires no manual intervention. Lifecycle rules are evaluated daily per object, making them the ideal cost optimization mechanism for time-decaying log data.

Fargate runs the ECS task only when EventBridge triggers the schedule, so billing covers actual task runtime rather than idle hours. It removes server patching and capacity management, and the 45-minute maximum fits comfortably within a single scheduled task run.

An Auto Scaling group with a desired capacity of one continuously maintains a single healthy instance, so if AWS terminates or the instance fails, the group replaces it and the launch template's user data reruns the idempotent job. A lifecycle hook can delay termination long enough for a clean shutdown, and this is fully managed with no custom monitoring code.

SQS is the right durability and buffering layer for this requirement. EventBridge can publish orders.checkout events to a queue, and workers can consume them at a controlled rate even when the payment API is unavailable. This decouples event ingestion from downstream processing, absorbs bursts, and preserves events until the outage ends. A DLQ provides a safe landing zone for messages that continue to fail after retries so they are not silently dropped.

Spot Instances are priced lower because AWS can reclaim capacity. When your workload can be interrupted and later restarted from checkpoints, the interruption model is compatible with Spot, making it the most cost-optimized option among the choices.

aws:MultiFactorAuthPresent is a condition key designed to reflect whether MFA was used when establishing the STS session. By requiring it to be true in the trust policy, STS denies AssumeRole when the caller did not authenticate with MFA.

AWS Secrets Manager stores the credentials securely and supports automatic rotation for Amazon RDS for MySQL. The EC2 instance role grants permission to retrieve the secret, so credentials are never stored on the instances. Access to the secret can be audited using AWS CloudTrail. This meets all requirements: no hardcoded credentials, automatic rotation, and auditability.

A cluster placement group is the optimal choice because it launches instances in a single Availability Zone on the same underlying hardware and low-latency network backbone. This physical proximity minimizes network hop count and inter-instance communication latency, while the consistent network path reduces jitter—variation in packet delivery times—which is critical for a jitter-sensitive trading analytics system. The group is designed specifically for tightly coupled, high-performance workloads that require high-throughput, low-latency inter-node traffic, and when combined with enhanced networking, it can achieve microsecond-level latency and high bandwidth. Note that this comes at the cost of fault isolation, as a single hardware failure can affect all instances, but for this performance-driven use case, that trade-off is acceptable.

Global Accelerator routes user traffic over the AWS global network to the nearest edge location, reducing latency for dynamic content without caching. It satisfies the no-custom-scripts constraint because it is a managed service configured declaratively, unlike Route 53 latency routing with custom health-check logic.

Storing session data in ElastiCache for Redis with Multi-AZ enabled externalizes the state, allowing any instance in the Auto Scaling group to access it. The Auto Scaling group across two Availability Zones ensures high availability, and the Application Load Balancer distributes traffic. If an instance fails, a new one launches and retrieves session data from ElastiCache.

A read replica offloads the long-running read-only reports from the primary database, which preserves write performance and reduces read latency for the reporting workload. Because the business accepts slightly stale report data, the asynchronous replication delay is acceptable. This is the most direct and AWS-native way to separate read pressure from writes.

A warm standby keeps a scaled-down but functional stack in the secondary Region, which can be scaled up during a failover. Route 53 failover routing with health checks automatically redirects traffic when the primary endpoint becomes unhealthy. This balances cost and recovery time, meeting the cross-Region availability requirement without paying for full duplicate capacity.

Scheduled EBS snapshots copied cross-Region provide point-in-time recovery and durability in a second Region, satisfying the restore-elsewhere requirement. Snapshots capture only changed blocks after the first, keeping replication efficient, and restoration creates fresh volumes from any snapshot in the target Region.

Failover routing is the correct Route 53 policy for active-passive architecture, where the ALB is the primary endpoint and the S3 static website endpoint is the secondary. You configure a primary record pointing to the ALB, associate it with a Route 53 health check that monitors the ALB, and create a secondary record pointing to the S3 website endpoint. When the health check fails, Route 53 automatically returns the S3 endpoint, providing DNS-level failover. The S3 bucket must be configured for static website hosting with a publicly accessible endpoint, and this setup requires no manual intervention to switch traffic.

A date-only partition key funnels every write into a single partition, hitting its 1,000 WCU ceiling regardless of table capacity. Switching to a high-cardinality key such as booking ID or customer ID spreads writes across many partitions, eliminating the hot partition and the throttling, while remaining fully AWS-native.

S3 Glacier Deep Archive is the lowest-cost S3 storage class and is designed for long-term retention of data accessed rarely, with a standard retrieval time of 12 hours and a bulk retrieval option of 48 hours. Because the auditor requirement allows up to 12 hours, Deep Archive satisfies the retrieval window while minimizing storage cost for petabytes held over seven years.

CloudFront caches the static HTML, CSS, and images at edge locations, so repeat requests are served from the edge instead of hitting the ALB and EC2 instances. This lowers origin CPU because far fewer requests reach the instances, and global visitors get content from a nearby edge. It requires only a distribution and cache behavior configuration, matching the low-effort requirement.

S3 automatically partitions a bucket by key prefix, and each partition supports a limited request rate. By issuing ranged GETs and spreading reads across many prefixes, the fleet drives parallel requests to multiple partitions, raising aggregate throughput. This is the standard approach for maximizing read performance from EC2 in the same Region without changing storage class or paying for acceleration.

Cross-account access without long-term credentials is achieved with an IAM role that the external account assumes. Scoping the role policy to s3:GetObject on a specific prefix limits the blast radius if the external account is compromised. This is the standard AWS pattern for temporary cross-account access and meets the read-only requirement.

Converting to Multi-AZ creates a synchronous standby in a different AZ. RDS automatically fails over to the standby in the event of an AZ failure, and the application can continue using the same endpoint. This provides minimal downtime and no data loss because replication is synchronous.

Redshift is a columnar data warehouse built for large analytical scans, so moving reporting there removes that load from the primary entirely. Loading via AWS DMS or RDS zero-ETL integration keeps the warehouse refreshed, and the primary no longer spends CPU on long analytical queries, which improves transactional write performance.

For content-addressed/versioned URLs, a long max-age lets CloudFront treat the object as fresh for a long period. Adding the immutable directive tells clients not to revalidate while the max-age is still valid, supporting high cache hit rates and fewer origin fetches for repeat requests.

EFS provides shared, persistent, POSIX-compliant file access across multiple EC2 instances and Availability Zones. That matches the requirement that all nodes see the same workspace immediately and that files survive instance replacement. It is the right choice when the application needs a common filesystem rather than an object store or local-only disk.

An ASG launches instances into the AZs of the subnets you specify. By placing the ASG in at least two AZs, the ALB can route traffic to healthy targets in the remaining AZ(s) if one AZ fails, enabling recovery as new instances maintain desired capacity.

Aurora stores six copies of data across three Availability Zones, and distributing the writer plus two Aurora Replicas across those zones means a zone failure leaves surviving replicas available. Aurora automatically promotes a replica to writer and updates the cluster endpoint, so the application reconnects without manual steps, while the reader endpoint load-balances read queries across the replicas.

CloudFront caches video segments at edge locations close to viewers on every continent, so Asian viewers retrieve content from a nearby POP instead of crossing the Pacific to us-east-1. OAC lets the distribution access the private bucket securely without making objects public. This directly addresses global latency with minimal operational effort because AWS manages the edge network.

AWS Graviton processors use Arm64 architecture, delivering better price-performance than comparable x86 instances. Since the software is open-source with no architecture-specific licensing restriction, and no custom operational scripts are added, migrating after performance testing satisfies the cost-reduction requirement without introducing operational overhead.

Using pub/sub decouples the producer from consumers. Order processing publishes once and can complete without waiting for each downstream service. Each consumer receives events independently, so analytics latency does not directly block inventory or shipping processing.

An SQS DLQ with a redrive policy is specifically designed for poison-message handling. When a message exceeds maxReceiveCount without successful processing (for example, the worker crashes before deletion), SQS moves the message to the DLQ. This quarantines bad messages and protects throughput for valid messages.

AWS WAF can be attached to an Application Load Balancer and provides managed rule groups that protect against common exploits like SQL injection and cross-site scripting. It also supports geographic match conditions to allow or block requests based on the country of origin. This directly addresses both requirements.

S3 Object Lock with a 90-day compliance-mode retention prevents any principal, including the root user, from deleting or overwriting the protected object versions until the retention expires. Versioning is required for Object Lock, and compliance mode provides the strongest immutability, directly satisfying both recovery and permanent-deletion-prevention requirements with minimal ongoing effort.

AWS WAF associated with the Application Load Balancer is the correct answer because it operates at Layer 7, inspecting HTTP/HTTPS requests, headers, body, and query strings for signatures of SQL injection and cross-site scripting (XSS). Managed rule groups such as the Core Rule Set (CRS) and OWASP Top 10 rules specifically detect and block these application-layer exploits. Attaching AWS WAF to an ALB enables centralized, content-aware filtering of all traffic destined to your application, which is exactly the capability required to protect a claims portal against these attack types.

An Auto Scaling group configured with subnets in at least two Availability Zones ensures that if an entire AZ becomes unavailable, the ASG can launch replacement instances in another AZ, preserving capacity. Health checks on the load balancer and EC2 allow the ASG to detect failed instances and replace them automatically. This architecture eliminates the single point of failure that comes with a single AZ and provides fault tolerance for both planned maintenance and unexpected outages.

Aurora provides a writer endpoint designed specifically for write traffic. During failover, Aurora updates where the writer endpoint points, so the same DNS name continues to resolve to the current writer instance without requiring manual endpoint changes in the application.

PITR allows restoration to a specific second within the supported recovery window.

Aurora Replicas are independent compute nodes attached to the same distributed storage volume as the writer, so they can serve SELECT traffic without competing for the writer's CPU or memory. The Aurora reader endpoint automatically load-balances connections across all healthy replicas, enabling the cluster to scale read throughput far beyond a single writer instance. Routing only SELECT queries to the reader endpoint preserves write consistency because all write operations continue through the writer endpoint, and replica lag is typically low enough for most use cases.

This lifecycle policy is the right approach because it automatically transitions 30-day-old log objects to a lower-cost storage class — such as S3 Standard-IA or S3 Glacier Instant Retrieval — which directly matches the noted shift in access pattern after the first 30 days. The separate expiration action after 18 months enforces the compliance requirement to retain logs for exactly that period and then delete them, preventing both premature deletion and runaway storage growth. Lifecycle transitions are managed by S3, so the team does not need custom code to move or expire objects.

AWS WAF integrated with an Application Load Balancer operates at Layer 7 to inspect each HTTP/HTTPS request for malicious patterns, including SQL injection and cross-site scripting (XSS). It uses managed rule groups and custom rules to filter traffic before it reaches the application instances. WAF supports real-time visibility and rate-based controls, making it the only listed option that can inspect application payloads and block these attack types.

A date-only partition key concentrates every write into a single partition, hitting its throughput ceiling. A higher-cardinality key spreads items across many partitions, so write capacity is consumed in parallel and throttling during business-hour peaks is eliminated.

Provisioned IOPS SSD volumes like io2 are purpose-built for business-critical workloads that require consistent, predictable high IOPS and low latency. They allow you to provision specific IOPS independent of capacity, and io2 offers 99.999% durability, making it the correct choice for a document portal where database performance is essential.

A gateway VPC endpoint for Amazon S3 is a free resource that you attach to a subnet's route table, enabling instances to reach S3 via private IP addresses. Traffic to S3 through a gateway endpoint does not traverse an internet gateway or NAT gateway, thereby eliminating the NAT data processing charge. It is the recommended and most cost-effective way to access S3 from private subnets when no internet connectivity is required.

Cross-Region Replication automatically copies objects to a destination bucket in another Region, and versioning is a prerequisite for it. This meets the disaster-recovery copy requirement without custom operational scripts, since replication is handled natively by S3.

An Application Load Balancer distributes traffic across healthy targets, and an Auto Scaling group can replace instances that fail health checks. Together, they provide automatic recovery from instance failure and keep the application available across multiple Availability Zones. This is the standard resilient design for stateless EC2 web tiers.

io2 is a Provisioned IOPS SSD EBS volume engineered for business-critical workloads that demand consistent, single-digit-millisecond latency and sustained IOPS. For a 4 TB media archive requiring durable, high-performance storage, io2 delivers 99.999% durability and allows you to provision up to 256,000 IOPS (with Block Express), ensuring predictable performance for transactional or indexing workloads rather than relying on burst credits.

Provisioned concurrency keeps a set number of Lambda execution environments initialized and ready to serve traffic. That directly reduces or removes cold starts for predictable workloads such as business-hours APIs. It is the most appropriate choice when the team wants to preserve serverless architecture while delivering consistent response times for the first request and subsequent requests.

A redrive policy defines a dead-letter queue (DLQ) and a maxReceiveCount; once a message is received that many times without being deleted, SQS moves it to the DLQ, quarantining poison messages for inspection or manual redrive. Setting the visibility timeout longer than the worst-case processing time prevents the message from becoming visible again while a consumer is still working, which would otherwise cause duplicate deliveries. Together, these settings bound both the retry window and the queue depth, allowing transient failures to retry while isolating permanent failures without losing data.

An Auto Scaling group spanning multiple Availability Zones automatically replaces failed instances and can launch replacements in healthy zones when one zone fails. Attaching an Application Load Balancer distributes traffic across healthy instances and provides a single stable endpoint. This is a managed, low-overhead solution that meets both instance and zone failure requirements.

Secrets Manager supports Interface VPC endpoints powered by AWS PrivateLink. An interface endpoint attaches an elastic network interface (ENI) with a private IP address to your chosen subnets, allowing your instances to call the Secrets Manager API without traversing the internet, a NAT gateway, or an internet gateway. You can also enable private DNS so standard secretsmanager.region.amazonaws.com resolves to the private IP, and traffic stays entirely inside the VPC.

DynamoDB on-demand capacity mode charges you only for the actual read and write requests your application makes, with no minimum capacity and no need to forecast traffic patterns. It instantly accommodates spikes from unpredictable developer workloads, and when the table is idle, you pay nothing beyond storage costs. This directly solves the problem of paying for unused capacity during long idle periods, which is exactly why on-demand is the correct choice for this dev sandbox.