Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 28

Question 270

A task queue grows sharply during peak uploads. Workers have been scaling on CPU but many jobs are I/O-bound, so backlog increases even at low CPU. Which autoscaling metric better reflects pending work?

Scale the worker fleet exclusively on average CPU utilization and assume low CPU proves every I/O-bound request has already finished.
Use a workload-calibrated SQS backlog-per-worker or queue age target rather than CPU alone, with processing-time and scaling-lag measurements.
Disable scaling entirely because CPU is below 50%.
Use Route 53 TTL as the number of desired worker instances.

Explanation

Correct Answer

Queue backlog or age reflects delayed I/O-bound work even when CPU is low. For EC2 target tracking, raw messages visible is not necessarily proportional to worker count; normalize by active capacity or use a suitable metric and evaluate worker service-time and age limits.

Incorrect Answers

Workers can spend most of their time waiting for I/O while the queue grows. A queue age or backlog-per-worker signal can measure unfinished work more directly.

I/O-bound queues can accumulate despite low CPU.

DNS TTL is unrelated to SQS backlog or compute capacity.

Question 271

An ECS deployment runs many microservices and wants a managed way for service-to-service clients to find logical service endpoints and route traffic consistently. Which ECS-native capability should be considered?

Use Amazon ECS Service Connect with configured client/server services and service discovery names.
Hard-code every task’s changing private IP address in application images.
Publish static per-task IP addresses in Route 53 and require each client release to include the newest list, assuming this is equivalent to managed ECS service discovery.
Enable public SSH on each container as the normal RPC path.

Explanation

Correct Answer

Service Connect simplifies ECS service-to-service connectivity and consistent logical endpoint naming within supported deployments.

Incorrect Answers

Ephemeral task addresses will drift as ECS schedules or replaces containers.

Hard-coded dynamic task addresses create deployment coupling. ECS Service Connect manages logical names and routing for supported service-to-service communication.

SSH access does not provide managed service discovery and adds exposure.

Question 272

A VPC application needs a service registry so clients can locate instances that are replaced frequently. The team must avoid embedding literal host IPs into deployments. Which AWS service supplies discovery registration?

Use an S3 multipart upload as a service discovery record.
Publish one instance address in code and redeploy every consumer when it changes.
Use IAM resource tags to identify all running endpoints and require every client to scan those tags manually as a substitute for service-discovery registration and health.
Use AWS Cloud Map with appropriate namespace, discovery and health registration for the service instances.

Explanation

Correct Answer

Cloud Map maintains service-instance discovery metadata as deployments change rather than requiring clients to hard-code addresses.

Incorrect Answers

Uploading object fragments does not register running service endpoints.

Hard-coded endpoints cause avoidable coupling and downtime.

Tags can help inventory but do not automatically maintain a DNS/API endpoint registry with instance health. Cloud Map stores discoverable service instances.

Question 273

A service currently uses ALB stickiness and in-memory login sessions. Leadership wants replacement of any web node without requiring a shared server-side session database. Which authentication design removes node-specific affinity while supporting safe revocation requirements?

Use a client-side session token with no signature, expiration or issuer checks and assume every backend can safely trust any content submitted by the browser.
Set the target group timeout to several days so user memory survives instance termination.
Use cryptographically signed, time-bounded tokens validated by every backend with managed key rotation and an explicit revocation strategy for high-risk accounts.
Retain ALB sticky sessions, but move the instance-local session into an EBS volume attached to only that one ephemeral target and assume this follows any replacement host automatically.

Explanation

Correct Answer

Short-lived signed access tokens can be verified consistently by any healthy web instance without that instance holding the original login state. Protect signing keys, verify issuer/audience/expiry and use an explicit revocation or short-life/refresh pattern when immediate invalidation is required.

Incorrect Answers

Statelessness alone is not secure authentication. Each backend must validate integrity, expiry, trusted issuer and relevant authorization claims; otherwise a client can forge its own privileges.

A load balancer timeout cannot preserve a dead process’s RAM.

A host-specific volume/affinity still introduces failure and attachment handling. A stateless signed session credential or shared state external to the host avoids dependence on one target.

Question 274

A producer sends tasks to an SQS queue but workers poll one older queue URL. API accepts jobs while the visible oldest-message age increases. Which defect explains the apparent missing tasks?

A bucket versioning switch automatically moved the SQS payloads to another S3 storage class.
Change the visibility timeout on the new producer queue without checking that workers are polling that same queue and expect all backlog to migrate automatically.
Producers and consumers are configured with different queue identities, so workers never read the queued work.
Adding CPU to workers necessarily fixes the missing messages without checking the destination.

Explanation

Correct Answer

SQS decoupling requires both sides to address the same region/account/queue; inspect configured URLs and receive counts.

Incorrect Answers

S3 object versioning does not reroute messages between queues.

Visibility changes do not redirect consumer ReceiveMessage calls to another queue or move messages between queue identities. Align producer and consumer Region/account/URL.

More workers polling the wrong queue still cannot process the producer’s messages.

Question 275

An SQS FIFO queue uses the same MessageGroupId for every unrelated customer. One slow payment blocks all customers despite many healthy workers. Why is parallelism low?

Every message shares one FIFO message group, which serializes processing within that group.
Standard queues always guarantee exact customer-order execution, unlike FIFO.
Increase SQS FIFO deduplication interval to reduce serialization within the one MessageGroupId, assuming deduplication controls per-group parallelism.
The queue must switch from a dead-letter queue to Route 53 latency routing.

Explanation

Correct Answer

FIFO ordering is group-scoped; use independent stable groups for independent entities while retaining per-entity ordering.

Incorrect Answers

Standard queues do not offer strict ordered per-group delivery guarantees.

Deduplication limits duplicate publication within its supported window; processing order and concurrency are governed by MessageGroupId selection. One common group serializes all orders.

DNS routing does not resolve FIFO message group serialization.

Question 276

A video transcode worker receives an SQS message, works four minutes, and deletes it only after output is saved. A second worker starts the same transcode after 30 seconds. Which queue behavior caused this?

Set the queue’s message retention to several days while leaving a 30-second visibility timeout for four-minute jobs, assuming retention prevents another worker from receiving the in-flight message.
Amazon SQS permanently removes each message as soon as ReceiveMessage is called.
A DynamoDB GSI automatically generated a second SQS work item.
The visibility timeout expired before completion, allowing the in-flight message to be received again.

Explanation

Correct Answer

Visibility controls temporary invisibility, not message retention; extend it as necessary and retain idempotent processing.

Incorrect Answers

Retention preserves messages for their lifecycle; it does not extend the visibility lease after a worker receives one. The message can be delivered again when visibility expires.

Messages remain until successfully deleted or retention expires, not removed at receive.

A database index does not itself explain visibility-expiry redelivery.

Question 277

A malformed SQS payload repeatedly fails parsing, reaches receive count 15 and returns to the primary queue forever. The team expected it to be quarantined after five tries. What is missing?

Increasing EC2 CPU reservations on workers will correct malformed JSON.
Increase the SQS long-poll wait time to 20 seconds and assume this automatically quarantines messages with high ApproximateReceiveCount.
Changing the message visibility timeout always sends it directly to a DLQ.
A correctly associated redrive policy with an accessible dead-letter queue and the intended maxReceiveCount.

Explanation

Correct Answer

Without an effective DLQ redrive configuration, receives alone do not quarantine a poison message.

Incorrect Answers

More compute does not repair invalid data.

Long polling controls the receive waiting interval, not DLQ routing. The source queue needs a configured redrive policy with reachable DLQ and maximum receive count.

Visibility duration and DLQ threshold are independent settings.

Question 278

A team expected three subscribers to each process every invoice event, but instead put their workers in one SQS queue. Only one team handles any given invoice. What is the architectural error?

Give the three teams different IAM credentials for ReceiveMessage on the same SQS queue and assume identities cause three copies of every event to be delivered.
A queue visibility timeout longer than the event retention makes all consumers receive it.
SQS distributes each message among competing consumers; it does not fan out one copy to every consumer group.
All consumer teams need identical EC2 instance types to receive every message.

Explanation

Correct Answer

Each subscriber needs a separate queue/subscription or other fanout path so every team receives its own event.

Incorrect Answers

Different consumer identities do not turn one queue into fanout. With competing receivers each message is processed by one consumer; independent queues or SNS fanout are required.

Visibility does not clone a message for each consumer.

Compute type does not change work-queue competition semantics.

Question 279

An EventBridge rule is configured with source=com.orders, but the publisher sends events with source=com.order. Target permissions are valid, and the bus shows incoming events but no rule matches. Why?

Target Lambda concurrency is the only reason a rule cannot match any event.
Increase retry attempts on the EventBridge target while leaving the event pattern source=com.orders and the submitted event source=com.order.
The rule’s event pattern does not match the event’s actual source field.
An EventBridge rule always ignores source and matches only the event time.

Explanation

Correct Answer

EventBridge routes only events matching a rule pattern; matching input schemas and target permissions are independent.

Incorrect Answers

Target throttling happens after a rule matches and invokes the target.

Targets are invoked only after a rule matches; retries cannot repair an event-pattern mismatch that prevents the target from being invoked at all.

EventBridge event patterns can explicitly filter source and detail properties.

Question 280

A monthly job is scheduled with cron in EventBridge Scheduler but runs at the wrong local hour after a daylight-saving change. The scheduler is healthy. What configuration explains it?

Use a fixed UTC cron offset throughout the year while the business expects local wall-clock time through daylight-saving changes.
The EC2 default subnet changed the UTC time used by the Scheduler service.
The schedule uses an unintended time zone or UTC interpretation rather than the business calendar’s required zone.
The target Lambda runtime version alone controls all daylight-saving transitions.

Explanation

Correct Answer

Scheduler supports time-zone configuration; validate the selected zone and DST behavior, not simply the cron minute.

Incorrect Answers

A fixed UTC offset drifts relative to a region with DST. EventBridge Scheduler can evaluate an appropriate named time zone; test DST behavior and calendar assumptions.

Managed schedule time-zone settings are separate from EC2 networking.

The invocation schedule is evaluated by Scheduler before the target runs.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 270

Explanation

Correct Answer

Incorrect Answers

Question 271

Explanation

Correct Answer

Incorrect Answers

Question 272

Explanation

Correct Answer

Incorrect Answers

Question 273

Explanation

Correct Answer

Incorrect Answers

Question 274

Explanation

Correct Answer

Incorrect Answers

Question 275

Explanation

Correct Answer

Incorrect Answers

Question 276

Explanation

Correct Answer

Incorrect Answers

Question 277

Explanation

Correct Answer

Incorrect Answers

Question 278

Explanation

Correct Answer

Incorrect Answers

Question 279

Explanation

Correct Answer

Incorrect Answers

Question 280

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests