Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 43

Question 420

A CDN origin group protects static GET pages but a payment checkout performs POST writes. Which supplemental resilience approach handles payment writes safely?

Design application-level regional failover with idempotent transaction IDs and reconciliation rather than relying on CloudFront origin failover for POST.
Assume CloudFront automatically replays every POST across origins with exactly-once payment commit.
Use a low cache TTL to turn a POST into an eligible idempotent GET.
Configure CloudFront origin failover to recognize HTTP 503 responses and assume the same setting automatically retries POST financial mutations with one-and-only-one commit.

Explanation

Correct Answer

CDN GET failover and transactional mutation recovery have different semantics.

Incorrect Answers

Unsupported generic POST replay risks duplicate or missing writes.

HTTP semantics are not converted by TTL.

CloudFront failover method constraints are separate from status codes and do not guarantee idempotent payment side effects.

Question 421

Two Regions must accept DynamoDB writes. Business rules demand zero cross-region read staleness and can tolerate greater network latency if the chosen Regions/configuration support it. Which mode needs assessment?

Default MREC and assume a local strongly consistent read always sees the latest remote write.
DynamoDB global tables configured for MRSC in a supported region topology, with latency and feature limitations tested.
One SQS FIFO queue in Region A as the only database persistence for all Regions.
Use DynamoDB global tables in default MREC mode and rely on each local strongly consistent read to see the latest acknowledged write made in a different Region immediately.

Explanation

Correct Answer

MRSC can offer global strong consistency at cross-region coordination cost; MREC does not promise that behavior.

Incorrect Answers

A local strong read on MREC may be stale relative to another Region.

An ordered message queue is not a strongly consistent multi-region table.

MREC asynchronous replication means a local strong read may be stale relative to a remote Region. MRSC has different global consistency, latency and availability constraints.

Question 422

A healthy Aurora Global Database has a primary in Region A and a ready secondary in Region B. The company plans a controlled relocation of the write-primary Region for maintenance and requires no transaction loss during this PLANNED migration. Which Aurora procedure fits rather than an unplanned outage failover?

Force a disaster-recovery failover without checking synchronization despite both Regions being healthy.
Stop every cluster and restore a week-old S3 CSV export into a new relational database.
Perform the supported Aurora Global Database switchover to the secondary Region, coordinating writes and validation under its supported no-data-loss planned procedure.
Change a Route 53 latency record only, expecting DNS to promote the Aurora regional writer and replicate outstanding data.

Explanation

Correct Answer

AWS distinguishes planned global-database switchover, designed for zero data loss under its conditions, from unplanned failover and replication-loss exposure.

Incorrect Answers

An emergency failover is designed for unavailable primary Regions and may involve replication lag; it is not the intended coordinated procedure for a healthy planned relocation.

A stale CSV recovery loses intervening data and does not use Aurora Global Database managed planned promotion.

DNS can redirect applications only after the primary database role is changed; record routing alone does not promote or synchronize database clusters.

Question 423

A business wants S3 DR copies in another Region but does not require every ephemeral object replicated. Which design avoids unnecessary copying?

Replicate every object including temp files regardless of documented recovery scope.
Enable versioning only and claim it creates a second Region automatically.
Use CRR with explicit prefix/tag filters for eligible objects, destination encryption and replication monitoring.
Replicate all temporary S3 objects with the production recovery prefix and assume a lifecycle rule in only the source Region removes their extra destination storage charges.

Explanation

Correct Answer

Rule filtering can copy only business-recovery objects rather than all transient source data.

Incorrect Answers

Unnecessary copies increase cost and do not improve the defined business RPO.

Versioning is local until replication is configured.

CRR rule filters determine what is copied. Source lifecycle behavior does not prevent initial replication expenses or guarantee destination objects are removed on the same schedule.

Question 424

A bucket receives frequent corrections to product catalogs. Accidentally overwritten content must be recoverable, but retaining all historic versions forever would be expensive. What balance is suitable?

Disable versioning and rely only on current objects.
Expire all noncurrent versions immediately without considering recovery window.
Enable S3 Versioning and apply reviewed noncurrent-version lifecycle retention consistent with recovery policy.
Set a noncurrent-version expiration of zero days and assume the latest overwritten S3 object revision will remain recoverable for the required month.

Explanation

Correct Answer

Versioning gives restoration history while lifecycle bounds long-term stale-version storage cost.

Incorrect Answers

Overwritten content cannot be restored from absent versions.

That removes the intended rollback history.

Overly short noncurrent retention defeats the rollback objective. Choose noncurrent-version lifecycle durations that preserve the business recovery window.

Question 425

AWS Backup has copied encrypted EBS recovery points to a second account and Region. The destination vault shows the copies, but a restore test fails because the destination recovery role lacks permission to use the recovery point encryption keys. Which recovery dependency needs correction?

Delete destination backup vault encryption and assume already encrypted recovery points automatically become readable by every principal.
Use Route 53 health checks to issue KMS decrypt grants to the recovery role during failover.
Leave the existing KMS key policy/grants unchanged and assume a visible cross-account backup is necessarily restorable by every destination role.
Verify supported cross-account/cross-Region key, vault and restore-role policy/grant permissions for the specific backup resource type, then retest decryption and restore.

Explanation

Correct Answer

AWS Backup copy and restore encryption has resource-specific requirements and destination key usage; least-privilege roles must be granted the appropriate decrypt/restore rights and validated in an actual restore.

Incorrect Answers

Removing one vault setting is not a safe or supported authorization substitute for the keys encrypting the recovery data.

DNS records cannot authorize KMS key access or a protected AWS Backup recovery point.

Copy success and object visibility do not prove a different execution role can decrypt or restore protected data; KMS and vault authorization are independent dependencies.

Question 426

A pilot-light disaster recovery design already replicates its database into Region B and has valid infrastructure templates. During a recovery drill, the web fleet cannot launch because its AMI and encrypted boot-volume snapshot remain accessible only in source Region A. What dependency should the DR plan add?

Keep only the source-region AMI and rely on Route 53 DNS failover to reconstruct its underlying encrypted snapshot in Region B.
Provision the missing AMI only after deleting the original production instances, to avoid regional duplication.
Increase the Route 53 weighted routing ratio to Region B and assume DNS allocation makes the AMI accessible there.
Copy or create an appropriate supported AMI and associated encrypted snapshots in the recovery Region, preserve KMS access, and validate fleet launch during a DR test.

Explanation

Correct Answer

The required boot image/snapshots and destination encryption credentials must be ready before reliable pilot-light scale-out; recovery testing catches these hidden prerequisites.

Incorrect Answers

An AMI is Region-scoped and its launch prerequisites must exist in the target Region before EC2 recovery.

Deleting healthy source capacity is not a safe replacement for preparing and testing the destination boot image.

Routing requests does not move a machine image or KMS key permissions between Regions.

Question 427

A warm-standby application has a small but fully functional secondary-region web and database stack. It is intended to be able to serve read-only synthetic transactions before the regional disaster, but all test requests presently go to the primary region. What verification best proves the standby is independently usable?

Direct approved synthetic test requests to the secondary Region’s own application endpoint and dependencies, verify expected reads/authentication and data freshness, and keep normal production routing unchanged.
Describe the standby’s Auto Scaling group and assume instance count proves live user requests can complete.
Make both Regions active for all production payments without validating data consistency or application readiness.
Check only S3 replication bytes in the primary Region and assume that measures standby application availability.

Explanation

Correct Answer

A controlled test of the standby endpoint and real dependent operations demonstrates the small functional stack can serve and helps identify config and data-lag failures before cutover.

Incorrect Answers

A running instance count does not prove its app, security policies or database connections are working.

Sending live mutation traffic to unverified standby may introduce business-data problems and is not needed for a read-only recovery-readiness drill.

Backup metrics and storage duplication do not demonstrate that the secondary deployment handles complete application calls.

Question 428

An ASG web tier must tolerate losing one AZ without exhausting users’ SLO. What scaling configuration should be planned?

Set ASG maximum capacity to the current healthy instance count and assume it can replace half a fleet after AZ loss without ever exceeding this ceiling.
Use one AZ because the ALB is regional.
Disable ASG health replacement for fear of churn during failover.
Place capacity across AZs and size scaling limits so surviving AZ capacity can handle the expected failover load.

Explanation

Correct Answer

Self-healing depends not just on target count but replacement capacity and healthy subnet quotas.

Incorrect Answers

A maximum at the current count can prevent replacement or surge capacity when one AZ disappears. Size headroom and achievable surviving AZ capacity.

Regional load balancing needs eligible targets in surviving zones.

That leaves failed instances in service and impairs healing.

Question 429

A VPC adds a new Availability Zone every quarter. Today its private IPv4 workloads use one zonal NAT gateway per AZ, and engineers manually add public subnet NAT and route configuration in each expansion. For public Internet egress, which 2026 AWS NAT capability can reduce that operational work while retaining zonal affinity?

A regional NAT gateway in automatic mode uses a single NAT gateway ID and expands across AZs as workloads appear, subject to supported-zone and expansion timing limitations.
A private zonal NAT gateway automatically supplies public Internet addresses in any AZ without an Internet gateway.
One zonal NAT gateway in the original AZ automatically expands to a new AZ as soon as instances appear in that AZ.
Deploy a new regional public NAT gateway and assume it provides private NAT translation and acts as a VPC peering router for every other account.

Explanation

Correct Answer

A supported regional NAT gateway automatically expands its egress footprint across AZs, simplifying per-zone management; expansion can take time and the service does not implement private NAT.

Incorrect Answers

Private NAT is for private address translation, not public Internet egress, and regional NAT does not provide private NAT.

Zonal NAT gateways remain tied to one AZ and do not automatically follow new workloads into other zones.

Regional public NAT is an egress feature under its supported rules, not universal private NAT or automatic cross-account transit routing.

Question 430

An interface VPC endpoint has healthy ENIs in AZ-a and AZ-b and private DNS enabled. A private application in AZ-b resolves the service to an endpoint address but its connections time out. The endpoint security group permits HTTPS only from AZ-a application CIDRs. What should be corrected?

Delete the existing AZ-b endpoint ENI and route every private API call through AZ-a for higher resilience.
Move all applications to public subnets and disable endpoint private DNS even though the service supports PrivateLink.
Allow the actual AZ-b workload source CIDRs or security group to reach HTTPS on the endpoint ENI, while retaining least-privilege access and network ACL compatibility.
Replace the interface endpoint with an S3 gateway endpoint for an arbitrary non-S3 API service.

Explanation

Correct Answer

Security groups on interface endpoints must permit the client traffic, including AZ-b source addresses. Functional DNS and multi-AZ placement do not bypass SG evaluation.

Incorrect Answers

Removing the surviving-zone ENI creates a new shared AZ dependence rather than fixing the blocked endpoint security-group path.

Supported interface endpoints serve private clients; public routing is not required for a missing endpoint ingress rule.

A gateway endpoint is not interchangeable with an interface endpoint for arbitrary AWS or PrivateLink services.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 420

Explanation

Correct Answer

Incorrect Answers

Question 421

Explanation

Correct Answer

Incorrect Answers

Question 422

Explanation

Correct Answer

Incorrect Answers

Question 423

Explanation

Correct Answer

Incorrect Answers

Question 424

Explanation

Correct Answer

Incorrect Answers

Question 425

Explanation

Correct Answer

Incorrect Answers

Question 426

Explanation

Correct Answer

Incorrect Answers

Question 427

Explanation

Correct Answer

Incorrect Answers

Question 428

Explanation

Correct Answer

Incorrect Answers

Question 429

Explanation

Correct Answer

Incorrect Answers

Question 430

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests