100 Free AWS SAA-C03 Practice Questions and Answers

Why B is right

Option B uses Data Lifecycle Manager to automatically create AMI backups twice daily (meeting 24-hour RPO) and automatically copies them to us-west-2 for disaster recovery, with minimal administrative effort. Option D uses AWS Backup to create automated backup plans with built-in cross-region copy functionality and scheduled backups, also meeting requirements with minimal overhead. Both eliminate manual processes while ensuring automated cross-region replication.

Why D is right

Option B uses Data Lifecycle Manager to automatically create AMI backups twice daily (meeting 24-hour RPO) and automatically copies them to us-west-2 for disaster recovery, with minimal administrative effort. Option D uses AWS Backup to create automated backup plans with built-in cross-region copy functionality and scheduled backups, also meeting requirements with minimal overhead. Both eliminate manual processes while ensuring automated cross-region replication.

Why C is right

on AWS Fargate. Amazon ECS on AWS Fargate is the only option that removes the responsibility for provisioning and managing underlying infrastructure. Fargate is serverless and automatically handles infrastructure scaling and maintenance, allowing the company to focus entirely on their critical applications. Options A and D require EC2 instance management, while option B requires managing EC2 worker nodes.

Why C is right

Service Control Policies (SCPs) are the correct solution for preventing tag modification across all accounts in an AWS Organization. SCPs enforce organization-wide policies at the account level and can explicitly deny tag modification actions except for authorized principals. This provides the centralized, enforceable control needed across multiple accounts that other options cannot achieve.

Why B is right

Amazon RDS Proxy addresses the 'too many connections' error by pooling database connections, reducing connection overhead on the Aurora database. This also reduces failover time because there are fewer connections to reestablish when a replica is promoted to primary. Connection pooling maintains a manageable set of connections to the database backend, improving recovery efficiency during failover by approximately 20% or more.

Why B is right

S3 Object Lock in compliance mode with a 365-day retention period meets all requirements: it prevents modification or deletion of objects for the specified period (satisfying the 1-year minimum retention), allows designated users to add files through proper IAM policies, and enforces read-only access for others. Compliance mode cannot be bypassed even by administrators, ensuring regulatory compliance.

Why A is right

Configuring a TLS listener and deploying the server certificate on the NLB directly encrypts data in transit between clients and the load balancer. This is the most direct and appropriate solution for securing data flowing through the network load balancer, addressing the specific security concern mentioned in the question.

Why B is right

AWS Config tracks configuration changes to AWS resources over time, while AWS CloudTrail records all API calls made to those resources. This combination provides comprehensive compliance, governance, and auditing capabilities as required.

Why A is right

AWS WAF (Web Application Firewall) is specifically designed to protect web applications from common attacks including SQL injection. By placing AWS WAF in front of the ALB and configuring appropriate web ACLs with SQL injection protection rules, the company can filter malicious requests before they reach the application. This is the standard AWS solution for application-layer attack prevention.

Why A is right

Amazon FSx for Lustre is a high-performance file system specifically designed for HPC workloads on Linux. It integrates seamlessly with Amazon S3, allowing data to be linked from S3 for processing and output files to be written back to S3 for long-term persistent storage. This combination provides both the high-performance file system needed for HPC and the persistent storage for analytics without operational complexity.

Why B is right

The company has a 1 Gbps connection with less than 10% utilization, indicating significant overprovisioning. Downgrading to a 200 Mbps Direct Connect connection reduces costs substantially while still meeting actual usage needs. This can be provisioned directly through the AWS Management Console as a standard dedicated connection with full security maintained. A 200 Mbps connection at current low utilization rates provides adequate capacity while reducing monthly port charges.

Why C is right

Option C minimizes operational overhead by using fully managed services: API Gateway (no server management), Kinesis Data Streams (managed real-time ingestion), Lambda (serverless transformations), Kinesis Data Firehose (managed delivery to S3 with built-in buffering), and S3 (managed storage). No EC2 instances or manual scaling policies are required. Option A requires EC2 instance management, option B uses Glue incorrectly (not designed for streaming APIs or delivery), and option D also attempts to use Glue in a non-standard manner. API Gateway is superior to EC2 for serverless API hosting.

Why C is right

Application Load Balancers support listener rules that can redirect HTTP traffic to HTTPS at the ALB layer. This is the native, built-in mechanism for enforcing HTTPS and requires no changes to backend applications or infrastructure. Option A uses network ACLs which block rather than redirect, option B attempts to manipulate URLs which ALBs don't do, and option D unnecessarily replaces the ALB.

Why A is right

AWS Snowball devices are the optimal solution for migrating 700 TB within one month. With 500 Mbps of available bandwidth, transferring 700 TB over the internet would take approximately 16 days of continuous transfer; Snowball accelerates this significantly. Snowball can transfer data in bulk without consuming internet bandwidth, and the lifecycle policy to transition to Glacier Deep Archive provides the lowest long-term storage cost for infrequently accessed backup data requiring 7-year retention.

Why A is right

AWS CloudWatch cross-account observability is the native AWS feature designed specifically for this use case. It allows a central monitoring account to query and visualize observability data across multiple accounts in an organization. The monitoring account enables the feature, and then CloudFormation templates are deployed in member accounts to establish the trust relationship and data sharing, enabling centralized dashboards and monitoring across the entire organization.

Why B is right

Adding the development account as a principal in the trust policy of the production role allows IAM users from the development account to assume the role in the production account. This leverages existing IAM user management in the development account while granting precisely defined permissions through the role in production. This approach adheres to least privilege by only granting the specific permissions defined in the role's policy, avoiding over-permissive policies or creating duplicate user credentials.

Why B is right

Option B correctly establishes a two-way forest trust relationship between the on-premises self-managed Active Directory and AWS Directory Service for Microsoft Active Directory, which is then integrated with IAM Identity Center for single sign-on across multiple AWS accounts. This preserves existing user and group management on-premises while enabling SSO across the organization. Option A creates a new AWS-managed directory instead of using the existing on-premises one. Option C creates a trust relationship but doesn't integrate with IAM Identity Center for SSO. Option D uses an external IdP which unnecessarily replaces the existing Active Directory infrastructure.

Why A is right

AWS Fargate on ECS with Service Auto Scaling provides the least operational overhead for containerized applications. Fargate eliminates EC2 instance management, Application Load Balancer handles request distribution, and Service Auto Scaling automatically adjusts capacity based on demand. This requires minimal code changes since the application runs in its existing container format. EC2 requires instance management; Lambda requires code rewrite; HPC is unnecessary for web request processing.

Why B is right

AWS Key Management Service (KMS) external key store (XKS) is purpose-built to meet regulatory requirements by allowing cryptographic keys to remain outside AWS while supporting multiple external key manager vendors. It requires the least operational overhead compared to alternatives, as it integrates seamlessly with AWS services without requiring custom key store setup or CloudHSM cluster management. CloudHSM requires provisioning and managing clusters, and the default KMS managed key store keeps keys within AWS, violating the compliance requirement.

Why C is right

Amazon Aurora global database provides the least operational overhead for multi-region MySQL disaster recovery. It automatically handles replication across regions, provides near-zero RTO/RPO, and requires no manual configuration of replication. Unlike RDS Multi-AZ which only covers availability zones within a single region, Aurora global database natively spans multiple AWS Regions with read-only secondary clusters that can be promoted to primary in a DR event.

Why C is right

VPC Flow Logs capture all network traffic flowing in and out of network interfaces, including RDP (port 3389) and SSH (port 22) connections. By publishing these logs to CloudWatch Logs, creating metric filters for these specific ports, and setting CloudWatch alarms with SNS notifications, the operations team receives real-time alerts whenever RDP or SSH access is established. This is the most direct and reliable method for detecting access events.

Why D is right

Option D provides seamless auto-scaling at minimal cost using Auto Scaling groups with Spot Instances. Since the application is stateless and resilient, it can leverage Spot Fleet for significant cost savings (up to 90% less than On-Demand). The Auto Scaling group automatically scales instances based on demand, and the ALB distributes traffic. This handles the performance degradation and 5xx errors while maintaining cost-effectiveness. Option A uses only two On-Demand instances with no auto-scaling. Option B uses Route 53 weighted routing which requires manual instance management. Option C stops/changes instance type causing downtime.

Why C is right

Using cost allocation tags on all resources, activating them in the billing system, and leveraging Cost Explorer provides an automated, scalable, and cost-effective solution for ongoing cost tracking by application. Cost Explorer dynamically analyzes tagged resources and generates reports without additional storage or processing infrastructure, making it ideal for regular reporting with minimal operational overhead and no additional AWS service costs.

Why B is right

Creating a read replica of the RDS database and directing the reporting script to query only the read replica offloads read traffic from the primary instance, improving application performance with minimal operational overhead. Read replicas are automatically managed, cost-effective, and require no code changes beyond pointing the script to the replica endpoint. This approach is simpler and more scalable than identifying connections, manual exports, or caching.

Why B is right

Amazon EMR is the primary service for parallel processing of large semistructured data in S3, providing distributed computing capabilities. EMR can also connect to Amazon Redshift to enrich data, making it the best choice for both parallel processing and data enrichment from Redshift in a single solution.

Why C is right

EventBridge detecting the DeleteKey operation with a Systems Manager Automation runbook provides the least operational overhead. The runbook can directly cancel the KMS key deletion through native AWS capabilities, while EventBridge simultaneously publishes SNS notifications. This approach avoids the complexity of custom Lambda logic (Option B) and Config rules (Option A), and is more actionable than CloudTrail logs with alarms that only monitor (Option D). The solution is automated, scalable, and requires minimal custom code.

Why A is right

For a stateful production application requiring at least two running instances with high availability and fault tolerance, setting the minimum capacity to two and deploying one On- Demand instance in each of two different Availability Zones is the correct approach. This ensures the application can survive an AZ failure while maintaining the minimum required instances at the lowest cost. On-Demand instances are preferred for stateful applications where availability cannot be compromised.

Why B is right

Amazon Aurora Serverless for MySQL is ideal because it automatically scales compute capacity based on actual demand without requiring users to select or manage a specific instance type. This is perfect for the infrequent access patterns described, as it scales down to minimal capacity during idle periods and scales up when needed, reducing costs. Serverless also provides minimal downtime during migration and meets the requirement of not committing to a particular instance type in anticipation of growth.

Why D is right

AWS Lambda with EventBridge is the most cost-effective and maintenance-minimal solution for automatically starting and stopping EC2 and RDS instances on a schedule. Lambda eliminates the need to maintain additional infrastructure (unlike option C which requires launching and maintaining another EC2 instance), and it's a native AWS service that integrates seamlessly with EventBridge for cron-based scheduling. This approach requires minimal code changes and no third-party marketplace solutions.

Why A is right

Lambda Function URLs provide a simple, direct HTTPS endpoint for the Lambda function without additional infrastructure. Launched specifically to address webhook scenarios, they require minimal setup and operational overhead, no load balancer, queue, or topic configuration needed. The third party simply calls the provided URL.

Why A is right

Both Amazon ECS with Fargate and Amazon EKS with Fargate are fully managed container orchestration platforms that automatically scale containers based on demand without requiring infrastructure management. Fargate eliminates the need to provision or manage EC2 instances, providing complete serverless container deployment. Both support Docker containers and handle scaling transparently.

Why B is right

Both Amazon ECS with Fargate and Amazon EKS with Fargate are fully managed container orchestration platforms that automatically scale containers based on demand without requiring infrastructure management. Fargate eliminates the need to provision or manage EC2 instances, providing complete serverless container deployment. Both support Docker containers and handle scaling transparently.

Why B is right

Reserved Instances provide the lowest cost for the frontend nodes that run continuously 24/7, while Spot Instances offer up to 90% savings for the variable backend workload that scales in and out based on demand. This combination optimizes costs by matching instance types to their usage patterns.

Why D is right

Amazon SQS provides durable message queuing that decouples producers from consumers, and SNS with multiple SQS subscriptions enables multiple independent consumer applications to process the same messages. This architecture naturally scales to handle sudden spikes to 100,000 messages per second and allows each consumer application to scale independently.

Why B is right

AWS Global Accelerator with a Network Load Balancer (NLB) is the correct solution for global gaming applications requiring both TCP and UDP traffic with minimal latency. Global Accelerator routes traffic through AWS's private global network to the nearest edge location, and NLB supports both TCP and UDP protocols. CloudFront (C, D) is designed for HTTP/HTTPS content delivery, not for gaming protocols requiring TCP and UDP support. ALB (A) does not support UDP, making it unsuitable for games that use UDP for real-time communication.

Why B is right

AWS Storage Gateway S3 File Gateway presents S3 as NFS storage, providing seamless migration from on-premises NFS while leveraging S3's scalability and cost-efficiency. S3 Lifecycle policies transition infrequent data to cheaper storage classes (Glacier, Deep Archive). Volume Gateway is block-based, less suitable for NFS workloads. EFS is more expensive than S3 for large-scale storage and lacks the lifecycle transition flexibility needed for cost optimization.

Why C is right

Option C implements a decoupled architecture using Amazon SQS to queue orders, which prevents message loss during outages. EC2 instances consume from the queue, and Auto Scaling ensures capacity for processing. If instances fail, messages remain in the queue for reprocessing without manual intervention. This provides automatic resilience and prevents order reprocessing issues. Option A doesn't address message persistence. Option B doesn't decouple the system. Option D uses SNS which doesn't provide the guaranteed delivery and queuing needed for critical orders.

Why C is right

Application Load Balancer (ALB) natively supports session affinity/sticky sessions and can be associated with AWS WAF web ACLs for security. ALB is the appropriate choice for web applications requiring sticky sessions and WAF protection. Network Load Balancer does not support sticky sessions in the traditional sense. Gateway Load Balancer is for third-party virtual appliances. A second target group and Elastic IPs do not implement session affinity or meet requirements.

Why E is right

Application Load Balancer (ALB) natively supports session affinity/sticky sessions and can be associated with AWS WAF web ACLs for security. ALB is the appropriate choice for web applications requiring sticky sessions and WAF protection. Network Load Balancer does not support sticky sessions in the traditional sense. Gateway Load Balancer is for third-party virtual appliances. A second target group and Elastic IPs do not implement session affinity or meet requirements.

Why D is right

S3 Multi-Region Access Points provide a single global endpoint that intelligently routes requests to the nearest S3 bucket, eliminating public network congestion and requiring minimal management. When combined with Cross-Region Replication, it creates an active-active configuration with automatic failover capabilities. The global endpoint handles all routing logic automatically, minimizing operational overhead. Option B uses passive configuration, which doesn't meet the active-active requirement. Option A requires manual endpoint management. Option C requires manual cross-account setup with no failover automation.

Why A is right

Amazon RDS read replicas reduce database reads by distributing read traffic across multiple database instances while maintaining high availability. This is the most direct solution for reducing the number of reads on the primary database while ensuring data consistency and HA capabilities. Replicas can be promoted to primaries if needed. Caching solutions like ElastiCache are secondary and require application code changes to implement cache invalidation, whereas read replicas transparently serve read requests.

Why A is right

Converting a Single-AZ RDS instance to Multi-AZ deployment is the simplest solution that requires no application code changes. AWS handles the failover automatically if the primary instance fails, maintaining a standby replica in another AZ. This is a straightforward modification that minimizes downtime and provides the required redundancy.

Why B is right

A NAT gateway placed in a public subnet enables EC2 instances in private subnets to initiate outbound connections to the internet while remaining unreachable from the internet. The private subnet route table routes outbound traffic (0.0.0.0/0) through the NAT gateway. This is the standard AWS architecture for providing outbound internet access from private subnets without exposing instances directly to inbound traffic.

Why A is right

CloudWatch metrics in the AWS/Events namespace provide visibility into EventBridge rule invocations, including the number of triggered rules, failed invocations, and dead-letter queue sends. These metrics directly indicate whether rule conditions are being met and if targets are being invoked, making this the proper monitoring solution for EventBridge.

Why B is right

Read replicas distribute read traffic away from the primary database, reducing load and improving performance during high traffic periods. ElastiCache caches frequently accessed query results, reducing database load further and improving application response times. Both solutions directly address the heavy read load problem identified in the scenario.

Why D is right

Read replicas distribute read traffic away from the primary database, reducing load and improving performance during high traffic periods. ElastiCache caches frequently accessed query results, reducing database load further and improving application response times. Both solutions directly address the heavy read load problem identified in the scenario.

Why A is right

AWS Secrets Manager is specifically designed for storing and rotating database credentials securely. It provides automatic rotation, encryption at rest, and fine-grained IAM policies to grant web servers access to retrieve credentials on-demand without embedding them in code. This meets both the security requirement for frequent credential rotation and the requirement for secure, frequent access.

Why D is right

AWS Systems Manager Session Manager provides secure, auditable SSH access to EC2 instances without requiring bastion hosts, VPNs, or SSH key management. By attaching the AmazonSSMManagedInstanceCore IAM policy to EC2 instances, developers can access instances through Session Manager from anywhere with AWS credentials. This is the most cost-effective solution as it requires no additional infrastructure, provides encryption and audit logging, and works seamlessly with private subnets and NAT gateways.

Why C is right

AWS CloudTrail records all API calls made in an AWS account, including who made the call, when, what resource was affected, and what changes were made. It is the appropriate service to audit and trace which IAM user made configuration changes to security group rules. CloudTrail logs provide the detailed audit trail needed to identify the specific user responsible for the configuration changes.

Why D is right

Lambda SnapStart for Java 11 is the most cost-effective solution to reduce cold starts without strict latency requirements. SnapStart creates a snapshot of the initialized function and restores it, dramatically reducing startup time with minimal additional cost. It specifically addresses cold starts and outlier latencies during scaling without the ongoing cost of provisioned concurrency.

Why B is right

with a 7year retention period. EBS Snapshots Archive tier is specifically designed for long-term retention of snapshots at a significantly lower cost than standard storage while maintaining immediate accessibility. The solution keeps daily snapshots in the standard tier for short-term recovery (1 month) and automatically moves monthly snapshots to the archive tier for the 7-year retention requirement. This approach minimizes administrative effort through automated lifecycle policies and is more cost-effective than copying to S3 Glacier or maintaining all snapshots in standard tier.

Why A is right

AWS Backup is a centralized, policy-based service that handles backup and restore for both EC2 instances and RDS databases, with built-in support for cross-region copying. It requires minimal operational overhead as it automates the entire backup lifecycle and cross-region replication without requiring manual management of AMIs, snapshots, or S3 exports. This is simpler and more maintainable than the alternatives.

Why B is right

Option B provides the least operational overhead by combining CloudFront with S3 for static content hosting (no server management), Lambda with API Gateway for microservices (fully managed, auto-scaling), and RDS for MySQL (managed relational database with automated backups and failover). This eliminates the need to manage EC2 instances while providing global availability through CloudFront.

Why B is right

VPC Flow Logs sends network traffic information to CloudWatch Logs. Kinesis Data Firehose is the ideal service for reliably streaming log data from CloudWatch Logs to OpenSearch Service with built-in transformation and buffering capabilities. This provides near real-time analysis while being the most straightforward integration path.

Why C is right

Using NetApp SnapMirror to replicate data from the primary FSx for ONTAP instance to a secondary region requires the least operational overhead. SnapMirror is a native NetApp replication technology that maintains the same file system structure and protocols (CIFS and NFS), requires minimal configuration, and automatically handles replication. This avoids manual copying, backup/restore procedures, and data migration efforts, while ensuring the secondary region can serve traffic using identical protocols and configurations.

Why A is right

A. Deploy Amazon CloudFront for content delivery and caching. C. Use Amazon Elastic Transcoder to convert the video files to more appropriate formats. CloudFront (A) is essential for content delivery and caching to reduce buffering and improve playback performance on mobile devices by distributing content geographically and caching at edge locations. Amazon Elastic Transcoder (C) converts large raw video files into mobile-optimized formats, reducing file sizes and enabling smooth playback on mobile devices. Together, these solutions maximize performance and scalability while minimizing operational overhead.

Why C is right

A. Deploy Amazon CloudFront for content delivery and caching. C. Use Amazon Elastic Transcoder to convert the video files to more appropriate formats. CloudFront (A) is essential for content delivery and caching to reduce buffering and improve playback performance on mobile devices by distributing content geographically and caching at edge locations. Amazon Elastic Transcoder (C) converts large raw video files into mobile-optimized formats, reducing file sizes and enabling smooth playback on mobile devices. Together, these solutions maximize performance and scalability while minimizing operational overhead.

Why C is right

S3 Storage Lens provides comprehensive visibility into incomplete multipart uploads across all S3 buckets in multiple AWS accounts and regions. It automatically collects and reports metrics with minimal configuration, requiring no custom rules or policies. Storage Lens is purpose-built for organization-wide S3 analytics and compliance reporting with the least operational overhead.

Why D is right

S3 Inventory provides a manifest of all objects across the bucket, an AWS Lambda function filters objects by age and retention status, and S3 Batch Operations executes deletions at scale using the Lambda function as the action. This is fully serverless, requires no EC2 or Batch infrastructure, and efficiently handles millions of objects across multiple prefixes in Glacier Deep Archive.

Why B is right

Configuring the Auto Scaling group across multiple Availability Zones ensures EC2 instance redundancy, while Multi-AZ Aurora PostgreSQL provides automatic database failover with minimal data loss. Adding RDS Proxy improves connection efficiency and resilience. This solution achieves high availability with minimal downtime and data loss while requiring the least operational effort compared to managing cross-region replication, manual snapshots, or complex S3-based architectures.

Why D is right

AWS Backup with vault lock in compliance mode is the correct solution for regulatory requirements to retain and protect backup files. Compliance mode ensures that backup files cannot be deleted or altered during the retention period, even by authorized users or AWS administrators. This meets the immutability requirement mandated by regulatory compliance. The backup plan can then be configured to handle both EC2 data and S3 buckets.

Why A is right

AWS Backup is the purpose-built service for managing backups across AWS services including RDS. It provides centralized backup management, enforces retention policies, ensures consistency, and supports recovery. A backup vault with a daily schedule and 2- year expiration directly addresses the requirements. This is more robust than manual snapshot management and provides better compliance tracking.

Why B is right

Horizontal Pod Autoscaler (HPA) with Kubernetes Metrics Server scales pods based on metrics like CPU and memory, while Cluster Autoscaler manages the underlying EC2 nodes to ensure pods have adequate resources. Together, these two components provide automatic scaling of both application workloads and cluster capacity with minimal operational overhead. This is the standard Kubernetes approach requiring no custom Lambda functions or additional AWS services.

Why C is right

Horizontal Pod Autoscaler (HPA) with Kubernetes Metrics Server scales pods based on metrics like CPU and memory, while Cluster Autoscaler manages the underlying EC2 nodes to ensure pods have adequate resources. Together, these two components provide automatic scaling of both application workloads and cluster capacity with minimal operational overhead. This is the standard Kubernetes approach requiring no custom Lambda functions or additional AWS services.

Why A is right

AWS WAF can be attached directly to Global Accelerator to provide DDoS protection with rate-based rules at the edge. This requires minimal implementation effort compared to other options. While WAF on ALB (option C) could work, attaching it to Global Accelerator is more efficient as it filters malicious traffic earlier in the pipeline, protecting the entire downstream infrastructure. Global Accelerator integrates seamlessly with WAF without additional architectural changes.

Why B is right

DynamoDB has a 400 KB item size limit (item size includes attribute names and values). For data approaching 700 KB that will grow further, storing large objects in S3 and referencing them via URLs in DynamoDB items is the standard, operationally efficient pattern. This approach requires minimal refactoring and scales seamlessly as data sizes increase.

Why D is right

Configuring an Auto Scaling group to dynamically scale out as traffic increases during the seasonal sale, combined with a preconfigured AMI launch template, provides cost- effective capacity that grows on-demand only when needed. This approach avoids paying for unused capacity during non-peak times while ensuring the ability to handle traffic surges efficiently.

Why D is right

An Application Load Balancer placed in front of the application servers allows the security group associated with the ALB's target group to accept traffic only from the web servers' security group. This creates a logical access boundary where web servers can access application servers through the ALB, while the security group rules enforce this restriction at the instance level.

Why C is right

AWS Elastic Disaster Recovery meets the RPO of 30 seconds and RTO of 60 minutes requirements. Configured as a pilot light, it continuously replicates disk changes to AWS at near-real-time intervals, providing recovery capability without running expensive infrastructure continuously. This is more cost-effective than warm standby and faster than backup-based approaches while using Standard edition licensing.

Why D is right

The cost increase is primarily due to accumulating snapshots rather than increased EBS volume storage (the company states it does not purchase additional storage). Amazon Data Lifecycle Manager automates snapshot creation and deletion according to retention policies, preventing the accumulation of expired snapshots without manual intervention. This reduces snapshot costs with minimal operational overhead compared to manually deleting snapshots or monitoring storage utilization.

Why A is right

AWS AppSync pipeline resolvers provide the most operationally efficient solution for a serverless application that needs to retrieve data from multiple DynamoDB tables without impacting baseline performance. AppSync is designed specifically for GraphQL APIs that can efficiently query multiple data sources, and pipeline resolvers allow complex data retrieval logic while remaining serverless with minimal operational overhead.

Why B is right

For CPU-intensive workloads with high concurrency, reserved concurrency ensures consistent performance under load, while increasing memory also increases CPU allocation proportionally (Lambda pricing ties CPU to memory), reducing execution time and overall costs. Decreasing memory would worsen CPU-intensive performance. Provisioned concurrency adds warm-start cost without addressing the fundamental CPU efficiency issue. AWS Compute Optimizer recommends memory increases for CPU-bound workloads.

Why D is right

AWS Step Functions provides serverless orchestration with state machines that coordinate complex workflows across distributed components, including Lambda functions. This meets all requirements: event-driven architecture, distributed processing, serverless concepts, and minimal operational overhead. Step Functions manages the workflow logic without requiring infrastructure management.

Why C is right

This solution provides reliability and fault tolerance without changing application designs. Creating an AMI preserves each application as-is, launching two instances in separate Availability Zones ensures fault tolerance across infrastructure failures, and a Network Load Balancer provides load distribution and failover. Option A with min/max of 1 provides no redundancy or fault tolerance. Option B's hourly backups don't prevent downtime during failures. Option D requires significant application refactoring into microservices, violating the constraint that application design cannot change.

Why A is right

To balance performance with fresh content, set CloudFront's default TTL to 2 minutes (option A) so content caches briefly at edge locations while remaining relatively fresh. Additionally, implement CloudFront invalidation on deployment (option E) to immediately clear changed files from edge caches, preventing stale content from being served. This combination achieves caching benefits while ensuring minimal staleness after deployments.

Why E is right

To balance performance with fresh content, set CloudFront's default TTL to 2 minutes (option A) so content caches briefly at edge locations while remaining relatively fresh. Additionally, implement CloudFront invalidation on deployment (option E) to immediately clear changed files from edge caches, preventing stale content from being served. This combination achieves caching benefits while ensuring minimal staleness after deployments.

Why B is right

Lambda needs kms:Decrypt permissions in its execution role (B) to decrypt environment variables at runtime, and the KMS key policy must allow the Lambda execution role (D) to perform decryption. Option A places permissions in the wrong resource type, option C conflates function policy with execution role, and option E tries to add the resource policy to the key policy which is incorrect.

Why D is right

Lambda needs kms:Decrypt permissions in its execution role (B) to decrypt environment variables at runtime, and the KMS key policy must allow the Lambda execution role (D) to perform decryption. Option A places permissions in the wrong resource type, option C conflates function policy with execution role, and option E tries to add the resource policy to the key policy which is incorrect.

Why A is right

AWS Control Tower (Option A) provides guardrails that can enforce data residency and deny internet access at scale. AWS Organizations SCPs (Option C) can restrict service usage to specific regions and deny internet-related actions like creating IGWs. Together, these solutions provide organization-wide policy enforcement that meets both the regional and internet access compliance requirements without relying on individual resource configurations.

Why C is right

AWS Control Tower (Option A) provides guardrails that can enforce data residency and deny internet access at scale. AWS Organizations SCPs (Option C) can restrict service usage to specific regions and deny internet-related actions like creating IGWs. Together, these solutions provide organization-wide policy enforcement that meets both the regional and internet access compliance requirements without relying on individual resource configurations.

Why A is right

Amazon ElastiCache provides a distributed, in-memory session store that works seamlessly with horizontally scaled EC2 instances across multiple Availability Zones. As instances scale up and down, all instances can access the same session data from ElastiCache, avoiding session loss. This is the standard pattern for distributed session management in cloud architectures.

Why B is right

Security groups can reference other security groups by ID, allowing traffic only from the ALB's security group to the EC2 instances' security group. This implements the principle of least privilege, restricting inbound access to only the ALB while preventing access from any other source inside or outside the subnet, including other EC2 instances in the same private subnet.

Why C is right

Amazon SQS provides a message queue that buffers incoming tracker data, preventing data loss when the application is overwhelmed. The application polls the queue for messages to process at its own pace, decoupling data ingestion from processing. This provides reliable data replay capability and requires minimal operational overhead compared to other solutions.

Why B is right

The requirement is to allow external internet traffic to reach a web server in a private subnet while maintaining security compliance. Option B correctly uses an internet-facing Application Load Balancer in a public subnet to receive external traffic on ports 80 and 443, then routes it to the EC2 instance in the private subnet via a target group. The ALB handles the network translation and provides a single entry point for traffic, meeting both the compliance requirement (instances in private subnets) and the accessibility requirement.

Why A is right

AWS Global Accelerator provides automated failover across AWS Regions with health checks, ensuring high availability for latency-sensitive applications like VoIP. It uses Anycast IP addresses that don't require client-side IP caching, directing users to the nearest healthy endpoint globally. This meets all requirements: global distribution, automated failover, low latency, and no reliance on IP caching. Route 53 geolocation routing requires DNS resolution time and may rely on caching; CloudFront is for content delivery, not real-time VoIP; and Application Load Balancers only operate within a region.

Why B is right

Amazon RDS Proxy manages database connections through connection pooling and multiplexing, allowing applications to establish multiple connections without exhausting the database's connection limit. This efficiently handles scaling workloads with minimal operational overhead since RDS Proxy is fully managed by AWS, no EC2 instances to maintain or custom code to develop. Applications simply change their connection endpoint to point to the RDS Proxy endpoint.

Why A is right

Amazon FSx for NetApp ONTAP is purpose-built to support both SMB and NFS protocols simultaneously on the same storage system, allowing protocol-agnostic file sharing. It provides Availability Zone level redundancy through multi-AZ deployment and is a fully managed AWS service, making it ideal for consolidating Windows SMB and Linux NFS file servers.

Why A is right

The AWS Cost Explorer API provides programmatic access to current year usage costs and includes forecasting capabilities for the next 12 months. This is the most direct solution for integrating cost data into an operations dashboard, requiring no manual file downloads or email scheduling, and supports pagination for handling large datasets.