Free SAP-C03 practice test: 30 questions with answers

Aurora Global Database replicates with typically sub-second lag and supports fast cross-Region failover, which fits a strict RTO and near-zero RPO. Daily snapshots or nightly exports give RPOs of many hours, and a single-AZ instance has no regional failover.

Spreading the load balancer and Auto Scaling group across AZs and moving session state to a shared store keeps sessions available when an AZ is lost. Pinning sessions to one instance or keeping them in memory loses them with that instance, and a larger single instance is still a single failure point.

Kinesis Data Streams ingests high-volume streams with configurable retention, and multiple consumers can read the same records independently. SES sends email, Route 53 is DNS, and AWS Backup manages backups rather than event streams.

MFA Delete requires an authenticated MFA code before versions can be permanently deleted or versioning can be suspended. Transfer Acceleration speeds uploads, Intelligent-Tiering moves objects between access tiers, and S3 Select queries object contents.

Direct Connect provides dedicated private bandwidth with more consistent latency, and a Site-to-Site VPN over the internet works as a lower-bandwidth failover. A plain internet link lacks the performance and consistency, and shipping devices is offline transfer rather than connectivity.

A NAT gateway in a public subnet lets private instances initiate outbound connections, and it does not accept unsolicited inbound connections. An internet gateway route with public IPs exposes instances, peering does not reach the internet, and an inbound rule opens them to everyone.

ECS on Fargate runs containers without managing servers and scales each service independently. Manual Docker on one instance and colocation servers add administration, and Lambda is not designed for long-running services.

DynamoDB is a managed key-value and document database with consistent low-latency access at scale. Redshift is an analytical warehouse, Neptune is a graph database, and Timestream is for time-series data.

Service control policies set the maximum permissions for accounts in an organization, so a deny in an SCP cannot be overridden by IAM grants inside a member account. Per-account IAM policies can be edited by administrators, a bucket policy does not stop the trail from being stopped, and a Config rule only detects changes after the fact.

Control Tower provisions landing zone accounts with a baseline, applies preventive and detective guardrails, and provides a compliance dashboard. AWS Batch runs batch jobs, WorkSpaces provides virtual desktops, and Snow Family is for offline data transfer.

AWS RAM can share VPC subnets with other accounts in the organization, and Transit Gateway can be shared with RAM to attach VPCs centrally. Full-mesh peering scales poorly and is hard to govern, and per-instance Elastic IPs or NAT instances do not solve central connectivity.

Customer managed KMS keys let the company control rotation, disablement and key policy, and CloudTrail records key use for audit. Service-managed keys give the company less direct control, keys stored beside the data defeat the purpose, and unencrypted storage fails the requirement.

A bucket policy that names specific cross-account roles and limits access to their prefixes grants exactly the required access. Public access and shared keys exceed what is needed, and copying data creates unmanaged duplicates.

IAM Identity Center federates the corporate identity provider and assigns permission sets across accounts centrally, with temporary credentials. IAM users with long-term keys, shared root credentials and wiki-stored keys all violate least privilege and credential hygiene.

AWS Managed Microsoft AD or AD Connector with a forest trust lets AWS resources use the existing directory. Ad hoc domain controllers without replication, local user databases and disabled Kerberos each break centralized authentication.

SCPs with an aws:RequestedRegion condition deny API calls outside the allowed list across the organization, and global services must be exempted. Security groups filter network traffic, bucket policies protect data access, and tags do not enforce Region placement.

Target tracking scales capacity with demand, and Savings Plans or Reserved Instances cover the steady baseline at lower rates. Running peak capacity all day wastes money, a single instance removes resilience, and disabling metrics prevents scaling decisions.

CloudWatch alarms evaluate metrics over periods and can notify SNS, and EventBridge or Systems Manager Automation can run a runbook in response. AWS Config tracks configuration, Flow Logs capture network traffic, and lifecycle rules manage object storage.

IAM last-accessed information and unused access findings in Access Analyzer show when roles and keys were last used, which supports least-privilege cleanup. Trusted Advisor cost checks, Macie discovery of sensitive data and Shield protection do not report unused permissions.

AWS Config records configuration state and evaluates resources against managed or custom rules, and conformance packs group them for reporting. Migration Hub tracks migrations, Connect is a contact center, and Storage Gateway provides hybrid storage.

AWS Budgets can alert on actual or forecasted cost per account or tag, which allows early intervention. CloudFormation drift detection, Inspector scanning and certificate renewals do not monitor spend.

Snapshots after the first are incremental, and copying snapshots across Regions supports recovery plans. Stopping instances is not required for every consistent backup, and snapshots can be restored into other AZs in the Region and shared with specific accounts without making them public.

Cooldowns and a suitable deregistration delay let in-flight requests finish before instances are terminated, which prevents errors during scale-in. Disabling scaling or removing the load balancer breaks elasticity or traffic distribution, and a larger instance does not fix in-flight termination.

The Schema Conversion Tool converts the schema and stored code for the target engine, and DMS replicates data with change data capture to minimize cutover downtime. DataSync moves files, Snowball is an offline device, and Route 53 Resolver is DNS.

Application Migration Service performs continuous block-level replication from source servers and supports automated test and cutover, which suits lift-and-shift migrations. Batch runs jobs, EventBridge Scheduler triggers schedules, and DataBrew prepares data.

Event-driven, spiky workloads benefit most from pay-per-use managed compute, and refactoring only pays off if the team can adopt the new operating model. Hardware brands, fonts and monitors do not affect the migration decision.

The strangler fig pattern moves functionality piece by piece behind a routing layer, which allows incremental migration and rollback. A big-bang cutover removes fallback options, duplicating the monolith does not split functionality, and untested rewrites carry high risk.

At 1 Gbps, 200 TB takes many weeks even at full utilization, so an offline device transfer such as Snowball Edge is the practical choice. Emailing or printing is impractical, and the link alone cannot finish within two weeks.

DataSync copies files between on-premises storage and AWS services with scheduling, incremental transfer and bandwidth limits. Glacier Select queries archived data, Step Functions orchestrates workflows, and WorkDocs is a document collaboration service.

Amazon MQ runs managed ActiveMQ or RabbitMQ brokers that support JMS and other standard protocols, so applications change little. SNS uses different APIs, Firehose delivers streams to destinations, and Pinpoint handles messaging campaigns.