Free SAA-C03 practice test: 30 questions with answers

An internet-facing ALB in public subnets receives HTTPS traffic and forwards to private instances, so the instances keep no public IPs. Public IPs on instances and VPNs per user do not match the requirement, and a private-only load balancer cannot receive internet traffic.

An instance role with a scoped policy plus a gateway endpoint keeps access private and limited. Stored keys, public buckets and NAT paths over the internet do not meet the requirements.

SSE-KMS with a customer managed key lets the company control rotation, key policy and disablement. SSE-S3 has no customer-managed key controls, co-located client keys defeat encryption, and private buckets still need encryption at rest.

SCPs define the maximum permissions for accounts in the organization, regardless of local IAM grants. Permissions boundaries apply per principal, security groups control network traffic, and bucket policies apply to S3 only.

GuardDuty analyses CloudTrail, VPC flow logs and DNS logs for threats without agents, and it can be managed across an organization. Macie targets S3 sensitive data, Shield protects against DDoS, and Inspector finds vulnerabilities rather than threats.

Referencing the application security group limits database access to application instances. Open CIDR rules, public placement and internet-gateway sharing expose the database.

AWS WAF with managed rule groups blocks common web exploits at CloudFront or ALB. Shield Standard protects against DDoS, NACLs are not designed for application attacks, and health checks do not inspect requests.

IAM Identity Center issues temporary credentials through permission sets assigned to users and groups. Shared IAM users, root use and shared passwords violate least privilege and auditability.

Spreading instances across AZs with a load balancer and Auto Scaling keeps the service available when one zone fails. A single instance, one-AZ setups and a single NAT gateway create single points of failure.

Multi-AZ deployments maintain a synchronous standby and fail over automatically. Read replicas are for scaling reads and are not automatic failover targets, snapshots are backups, and larger instances in one AZ do not survive zone failure.

SQS stores messages durably until consumers process them, which prevents loss during outages. Synchronous calls fail when the consumer is down, a shared file on one instance is a single point of failure, and an unsubscribed SNS topic has no consumer to receive messages.

An Auto Scaling group with scaling policies and health checks scales automatically and replaces unhealthy instances. Manual launches, fixed capacity without checks and nightly restarts do not meet the requirement.

S3 with CloudFront provides global caching and origin failover options for resilience. A single server in one Region and laptop-based hosting are not resilient or global.

Multiple zone subnets, cross-zone load balancing and zonal Auto Scaling provide resilience. A single NAT gateway in one zone and a single subnet remove resilience.

Continuous cross-Region replication with promotion meets low RPO and RTO. Daily snapshots, weekly tapes and manual restores cannot meet a one-minute RPO.

Spreading tasks across AZs with the scheduler and load balancer maintains capacity during zone failures. Single tasks and pinned instances in one AZ create single points of failure.

Caching product responses reduces latency and database read load. Write capacity does not address reads, more servers without caching still hit the database, and device storage is not a web architecture.

Snowball Edge devices move large datasets efficiently when the network is limited. Slow uploads over small links, email attachments and internal USB shipments are impractical.

A cluster placement group places instances close together within an AZ for low latency and high throughput. Spread groups separate instances for resilience, cross-Region placement adds latency, and public IPs do not reduce latency.

Athena runs serverless SQL queries directly on S3 data, with no infrastructure to manage. A small RDS instance, custom EC2 tools and EFS do not fit ad hoc queries over S3 without management.

Read replicas and caching offload reads and reduce latency. Write capacity does not help reads, removing indexes slows queries, and moving all reads to the primary adds load.

CloudFront caches content at edge locations close to users, with S3 as the origin. A single Region server adds latency for distant users, and FTP and dial-up are not appropriate.

EFS provides shared file storage across AZs for many instances. A single EBS volume attaches to one instance, instance store is ephemeral, and Glacier is archival.

Compute Savings Plans provide lower prices for a committed hourly spend with flexibility across families and Regions. On-Demand is more expensive, Spot can be interrupted, and dedicated hosts are used for specific licensing needs.

Spot instances are inexpensive and suit interruptible, restartable work when checkpointing exists. Reserved instances for monthly jobs, always-on On-Demand and dedicated hosts increase costs.

Glacier classes provide low-cost archival storage with retrieval options suited to rare access. S3 Standard is more costly for long retention, EBS is not archival storage, and local arrays do not meet the managed durability need.

Lifecycle transitions and cleanup of incomplete uploads reduce storage costs. Unlimited versions, Standard for rarely accessed data and provisioned IOPS do not fit S3's model or cost goals.

Spot task nodes reduce cost for interruptible work, and On-Demand core nodes keep the cluster stable. Always-on On-Demand, dedicated hosts and unused three-year reservations increase cost.

Lifecycle expiration removes objects automatically after the retention period. Manual deletion, indefinite storage and in-memory storage do not automate the policy.

CloudFront can reduce delivery costs for many internet-facing workloads by caching at the edge. Private DNS zones, AZ placement and instance size do not reduce internet transfer costs.