Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 33

Question 320

An ECS service runs successfully on Fargate, but new tasks placed in private subnets fail to pull a private image from Amazon ECR. The task execution role is already correctly authorized, and the subnets have no NAT or Internet egress. Which connectivity design should the team check?

Provide the relevant ECR API and Docker interface VPC endpoints and S3 gateway endpoint with usable private DNS, route-table and security-group settings, or provide authorized NAT egress.
Move from Fargate to EC2 launch type because ECS tasks cannot pull ECR images when placed in private subnets.
Assign a larger CPU value to the Fargate task definition because insufficient CPU makes ECR endpoints public-only.
Create a new IAM Identity Center permission set for end users and assume workforce SSO automatically supplies Fargate image-pull network routing.

Explanation

Correct Answer

Private Fargate tasks still need a network path to their registry and image layers. Supported ECR interface endpoints plus S3 gateway routing (and any required logging/secrets endpoints) or NAT can supply connectivity without public task IPs.

Incorrect Answers

ECS on Fargate supports private tasks and ECR image pulls, provided execution-role permission and service access paths are properly configured. EC2 host management is not required.

Increasing task compute capacity cannot create missing private network routes, VPC endpoints or Internet translation needed to fetch container image layers.

Workforce identity provisioning does not establish the task ENI routing or service DNS paths required by ECR image pull requests.

Question 321

An organization already relies on Kubernetes custom resources, native operators and a standardized kubectl-based deployment contract. Teams want managed control-plane availability. Which AWS compute platform is least disruptive?

Use Amazon EKS and arrange worker/node provisioning with managed or serverless options appropriate to the workload.
Switch to ECS with no translation of custom resource controllers.
Move operators into Route 53 health checks.
Keep ECS as the orchestration interface but copy Kubernetes CustomResourceDefinitions into S3 and expect native Kubernetes operators to reconcile them.

Explanation

Correct Answer

EKS preserves Kubernetes API and operator patterns while AWS manages the Kubernetes control plane.

Incorrect Answers

ECS has a different orchestration API and does not directly run Kubernetes CRDs.

DNS probes are not Kubernetes controllers.

S3 object files are not Kubernetes API resources reconciled by an EKS control plane. An app standardized on native CRDs/operators needs an actual compatible Kubernetes API contract.

Question 322

An EC2 Auto Scaling group uses CPU target tracking. New instances run CPU-heavy initialization for several minutes before handling real requests. After each scale-out, the elevated startup metrics trigger another unnecessary scale-out, even though actual client demand is stable. Which setting directly addresses this measurement artifact?

Increase the group minimum capacity permanently to the highest observed startup burst, even during idle periods.
Configure default instance warmup to cover the startup stabilization interval, so target tracking accounts correctly for warming capacity and aggregate usage metrics.
Disable Auto Scaling health checks, because failed instances otherwise make startup CPU too high.
Use only target-group health-check grace period while leaving Auto Scaling default instance warmup unset, expecting startup CPU to be excluded from target tracking.

Explanation

Correct Answer

Default instance warmup helps exclude transient initialization measurements from effective aggregate scaling metrics and prevents excessive scaling during launch.

Incorrect Answers

A fixed high floor may waste capacity and does not prevent initialization metrics from corrupting scaling decisions.

Health checks determine instance replacement, not the warmup-aware aggregation of target-tracking utilization.

Health-check grace period defers selected unhealthy replacement decisions; it does not control warmup-aware CPU aggregation for target tracking. Configure default instance warmup appropriately.

Question 323

A web app stores ephemeral browser sessions in a single EC2 instance’s memory; the fleet must scale horizontally with no user session loss when hosts change. Which design best preserves the session contract?

Place encrypted session data in a shared highly available store such as appropriately designed ElastiCache, or adopt suitably secured stateless sessions.
Rely only on ALB sticky sessions for all persistence, even when an instance dies.
Put the session token in a shared browser cookie but keep all authoritative server-side cart data only on one EC2 instance.
Disable Auto Scaling so the same host is never replaced by policy.

Explanation

Correct Answer

Any application instance can use shared state while servers scale independently; set TTL, consistency and security appropriately.

Incorrect Answers

Affinity selects a target but does not replicate its memory.

A stable cookie identifier cannot recover server-side session contents that live only in a lost host’s memory. Persist session state in a shared store or adopt valid self-contained stateless state.

This sacrifices availability and does not prevent hardware failures.

Question 324

An order backend on AWS Lambda is bursty and creates thousands of short database sessions against a smaller RDS engine. It must minimize connection churn without changing its SQL application. Which service is relevant?

Scale the RDS instance solely by adding CloudFront cache behaviors for writes.
Create an RDS read replica but continue opening every transaction as a separate unpooled connection to the same writer, expecting replica creation to multiplex clients.
Use RDS Proxy for supported engine/configuration, preserving database authentication and transaction semantics.
Deploy multiple IAM users and assume each has a separate RDS max-connections budget.

Explanation

Correct Answer

Connection pooling can absorb intermittent Lambda connections and reuse backend database sessions.

Incorrect Answers

CDN caching cannot pool or authorize transactional database connections.

Read replicas can offload supported read workloads but do not pool database connections from Lambda clients to the writer. RDS Proxy manages connection reuse.

Database connection quota is enforced by the engine/instance, not account identity count.

Question 325

A video portal serves publicly cacheable logos and static site assets worldwide. It wants lower origin egress and low viewer latency but does not need personalized edge computation. Which choice is a suitable first optimization?

Run every image request through a new uncached regional Lambda regardless of existing static assets.
Use Route 53 records alone and claim DNS responses cache the actual image bytes.
Turn off HTTP caching and increase the origin instance count as the only mechanism.
Place a CloudFront distribution with an appropriate cache policy in front of the existing origin.

Explanation

Correct Answer

Edge caches serve repeated objects near viewers and reduce requests/transfer from the backend when cacheable.

Incorrect Answers

This adds origin compute rather than reducing repeated static fetches.

DNS caching does not store HTTP object bodies.

This may scale the origin but misses the clear edge caching opportunity.

Question 326

A public API is rate-limited by a third-party supplier to 100 calls per second. Its AWS callers can burst to 2000 requests per second. What architecture prevents excess immediate backend calls?

Increase the supplier’s API calls by manipulating Route 53 DNS TTL.
Accept permitted requests durably into SQS, then pace outbound consumer calls using a measured 100-requests-per-second supplier rate limit; use API Gateway throttling as an additional best-effort admission control.
Set Lambda reserved concurrency to 2000 and assume supplier traffic stays under 100.
Remove all API authorization because unauthenticated requests are cheaper.

Explanation

Correct Answer

A queued producer/worker architecture separates spikes from third-party execution. An explicit token-bucket or rate-pacing mechanism on outbound workers protects the supplier hard ceiling; API Gateway throttling by itself is best-effort and should not be treated as exact quota enforcement.

Incorrect Answers

Name caching cannot create third-party quota.

Higher invocation capacity amplifies rather than limits supplier request pressure.

Access controls are separate from throughput and must remain enforced.

Question 327

A DynamoDB Orders table changes continuously. Fulfillment must react to committed item updates asynchronously, while the order-write API remains independent. Which AWS capability publishes the data changes?

Use CloudTrail API logs as the only exact item-level change stream for every write.
Enable DynamoDB Streams and consume change records with a supported event source or stream processor.
Poll the Orders table for every item from the beginning each second.
Poll the base DynamoDB table with a Scan every second and assume a filter can exactly reconstruct the ordered committed change stream with no gaps.

Explanation

Correct Answer

Streams provides ordered change records per item within its retention, allowing asynchronous side effects without synchronously calling fulfillment.

Incorrect Answers

Management/audit events do not replace DynamoDB item change stream semantics.

Full scans add cost and provide weak change detection.

Scanning current table state cannot reliably reconstruct each item mutation and order, particularly when values change between polls. DynamoDB Streams emits retained item-change records.

Question 328

Telemetry needs multiple independent analytics consumers able to replay a bounded history of ordered events per shard. It must support high-ingest streaming rather than one worker claiming each job. Which service fits?

Use one SQS Standard queue with many competing workers and expect every consumer app to see all events.
Use Amazon Kinesis Data Streams with appropriately sized shards/on-demand capacity and independent consumers.
Use an S3 lifecycle transition as the only live ordered event transport.
Keep one synchronous REST connection open to every analytics consumer for all live events.

Explanation

Correct Answer

A stream retains ordered records by shard for replay and supports multiple consumer applications.

Incorrect Answers

Queue workers compete for messages, unlike replaying multiple stream consumers.

Object lifecycle is not a low-latency streaming log.

Direct fanout couples producer availability to each consumer.

Question 329

A broker-based enterprise application depends on standard AMQP/JMS interoperability and cannot be rewritten to AWS SDK queue APIs before migration. Which managed service may preserve its wire protocol?

Use SQS exclusively without any JMS transport or adapter changes.
Rewrite the application to a native SQS SDK client while keeping its existing JMS broker transactions unchanged, assuming the protocols are wire-compatible.
Use Kinesis Data Firehose as a bidirectional legacy JMS transaction broker.
Use Amazon MQ with a supported managed broker type and validate transaction/client compatibility.

Explanation

Correct Answer

Managed compatible brokers can preserve legacy protocol interactions, while SQS is an AWS API queue rather than a JMS drop-in.

Incorrect Answers

SQS SDK/API is not generic JMS broker wire compatibility.

SQS has supported SDK/API abstractions and wrappers but is not a drop-in standards broker for every AMQP/JMS transaction pattern. Amazon MQ preserves eligible broker protocols.

Delivery streaming does not expose generic JMS broker semantics.

Question 330

A nightly workflow must apply the same transformation to 150 independent S3 files, wait for results, and control maximum parallel executions. Which Step Functions feature fits?

Hard-code 150 sequential Lambda calls without failure branch information.
Send 150 independent Lambda invocations directly and infer final completion only from the count of API invocation acceptances without tracking each result.
Run an S3 bucket replication rule and assume it executes the custom transform code.
Use a Map state with supported concurrency and failure controls for the independent items.

Explanation

Correct Answer

A Map state fans out similar work with bounded concurrency and tracks each item’s results, instead of wiring 150 bespoke branches.

Incorrect Answers

This unnecessarily serializes independent tasks and increases orchestration maintenance.

Invocation acceptance is not a coordinated run receipt for per-file outcomes and concurrency. A Step Functions Map state supplies bounded fan-out and workflow item results.

Replication copies supported object versions, not arbitrary application transforms.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 320

Explanation

Correct Answer

Incorrect Answers

Question 321

Explanation

Correct Answer

Incorrect Answers

Question 322

Explanation

Correct Answer

Incorrect Answers

Question 323

Explanation

Correct Answer

Incorrect Answers

Question 324

Explanation

Correct Answer

Incorrect Answers

Question 325

Explanation

Correct Answer

Incorrect Answers

Question 326

Explanation

Correct Answer

Incorrect Answers

Question 327

Explanation

Correct Answer

Incorrect Answers

Question 328

Explanation

Correct Answer

Incorrect Answers

Question 329

Explanation

Correct Answer

Incorrect Answers

Question 330

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests