Question 430
An interface VPC endpoint has healthy ENIs in AZ-a and AZ-b and private DNS enabled. A private application in AZ-b resolves the service to an endpoint address but its connections time out. The endpoint security group permits HTTPS only from AZ-a application CIDRs. What should be corrected?
- Delete the existing AZ-b endpoint ENI and route every private API call through AZ-a for higher resilience.
- Move all applications to public subnets and disable endpoint private DNS even though the service supports PrivateLink.
- Allow the actual AZ-b workload source CIDRs or security group to reach HTTPS on the endpoint ENI, while retaining least-privilege access and network ACL compatibility.
- Replace the interface endpoint with an S3 gateway endpoint for an arbitrary non-S3 API service.
Explanation
Correct Answer
C:Security groups on interface endpoints must permit the client traffic, including AZ-b source addresses. Functional DNS and multi-AZ placement do not bypass SG evaluation.
Incorrect Answers
A:Removing the surviving-zone ENI creates a new shared AZ dependence rather than fixing the blocked endpoint security-group path.
B:Supported interface endpoints serve private clients; public routing is not required for a missing endpoint ingress rule.
D:A gateway endpoint is not interchangeable with an interface endpoint for arbitrary AWS or PrivateLink services.
Question 431
An order API queues incoming orders while inventory is intermittently unavailable. The business can authorize a card but must not CAPTURE a payment until a later inventory reservation has actually succeeded. Which transaction boundary should the system enforce?
- Capture the full payment immediately when SQS acknowledges the order message, even if inventory is unreserved.
- Treat an ALB sticky-session cookie as an irreversible proof of stock ownership and bill before the worker runs.
- Discard all order-state identifiers on retry, so a repeated authorization becomes a distinct financial charge.
- Track the order as pending and use a payment-provider-supported authorization/capture flow: capture only after verified reservation, reconcile timeouts idempotently, and release/void authorization on rejection.
Explanation
Correct Answer
D:An authorization hold can precede fulfillment while capture is delayed until a confirmed reservation, if provider features and applicable timing rules permit; persistent order and idempotency records govern retries.
Incorrect Answers
A:SQS accepted-message durability does not establish inventory commit or justify settlement of unreserved merchandise.
B:Session routing neither verifies stock nor provides a payment authorization contract.
C:A new ID on retry can create duplicate financial operations rather than safely resume an uncertain prior attempt.
Question 432
A single Amazon SNS topic publishes billing, shipping and marketing events to three dedicated SQS subscriber queues. All three queues currently receive every message, but the shipping queue must receive only events whose message attribute eventType equals ShipmentReady. Which SNS configuration solves the isolation without changing other subscriptions?
- Use a single shared SQS queue for all three teams and assume competing consumers can inspect and recover every individual event copy.
- Set a subscription filter policy on the shipping SQS subscription with eventType=ShipmentReady and the matching MessageAttributes scope, allowing for filter-update propagation.
- Set the SNS topic to FIFO and assume message ordering itself excludes billing and marketing messages from selected subscriptions.
- Increase the shipping queue visibility timeout; this changes which event types SNS publishes to the queue.
Explanation
Correct Answer
B:SNS applies filter policies on individual subscriptions to select matching attributes/body values. With the proper scope and publisher metadata, only eligible messages are delivered after eventual propagation.
Incorrect Answers
A:Competing consumers on one queue cannot independently retain each required event, and do not implement type-based topic filtering.
C:Ordering and subscriber-specific message eligibility are different controls. FIFO does not select event types for a given subscription.
D:Visibility hides an already delivered SQS message temporarily, not publisher-to-subscriber routing eligibility.
Question 433
A Step Functions Task retries a stable InvalidPaymentMethod error three times. Its valid Retry array first contains a broad States.TaskFailed retrier, then a specific InvalidPaymentMethod rule with MaxAttempts:0, and finally a States.ALL catch-all. The team intended to avoid retrying business validation failures. Why did the invalid payment still get retried?
- Step Functions always checks the last Retry entry first, so the later specific no-retry rule automatically wins.
- A Catch handler executes before any Retry policy and converts a failed payment into a committed success.
- Step Functions cannot match a custom business error name in a specific Retry ErrorEquals rule.
- Step Functions examines retriers in listed order; the broad earlier States.TaskFailed match captures the custom error before the later zero-retry rule. Put the specific business error first, keeping States.ALL only as the last catch-all.
Explanation
Correct Answer
D:States.TaskFailed matches Task errors other than timeout, including the custom validation error; an early match is applied before a later specific rule. Specific MaxAttempts=0 must be evaluated first for the intended terminal behavior.
Incorrect Answers
A:Retriers are evaluated in order; the first wildcard can intercept the custom error before the explicit no-retry rule.
B:Matching Retry policy precedes Catch processing and never implies that failed financial settlement succeeded.
C:A known custom Task error name can be matched by an explicit retrier condition.
Question 434
An event can be delivered at least once, and a billing operation may partially commit before a timeout. Which layer must enforce duplicate safety?
- Assume an SQS visibility timeout is a global exactly-once transaction guarantee.
- Generate a different financial operation ID on every retry to ensure uniqueness.
- The billing transaction boundary, using a stable idempotency key and authoritative state reconciliation.
- Rely on a Route 53 primary/secondary failover switch as proof the payment provider did not already commit a timed-out request.
Explanation
Correct Answer
C:Message deduplication alone may not cover delayed retries or partial provider commits.
Incorrect Answers
A:Visibility is not money-moving idempotency.
B:New IDs can lead to multiple charges.
D:DNS failover changes request destination but does not guarantee transaction settlement, idempotency or consistency of payment IDs.
Question 435
The business demands RPO under five minutes but accepts four hours to restore service. Which DR dimension should shape frequent data-copy policy even if the app can scale slowly?
- Choose weekly backups solely because application restore can take four hours.
- Treat RTO as the age of the last stored transaction.
- Use an hourly S3 backup as the only recovery point and claim it satisfies a five-minute data-loss threshold because recovery time may take four hours.
- Implement and test replication/backup point frequency that meets the five-minute RPO; recovery orchestration separately meets four-hour RTO.
Explanation
Correct Answer
D:RPO determines acceptable lost data age while RTO determines service downtime.
Incorrect Answers
A:Weekly points violate the five-minute data-loss limit.
B:That confuses downtime with data loss.
C:The time to restore service is independent of the age of recoverable data. Hourly backups can lose more than five minutes of changes.
Question 436
A database backup job passes daily but administrators suspect missing network/IAM dependencies during cross-account restore. Which validation reduces false confidence?
- Treat backup size larger than zero as proof the complete app is recoverable.
- Perform a periodic cross-account restore drill including keys, roles, routes, application dependencies and verified data integrity.
- Validate only AWS Backup console success while leaving destination-account KMS grants and network reachability untested.
- Disable encryption to avoid testing KMS permissions.
Explanation
Correct Answer
B:A backup job success flag does not prove a restored service can authenticate, reach dependencies or meet RTO.
Incorrect Answers
A:Some backup bytes do not validate workload dependencies.
C:A completed backup is not proof that a different account can decrypt, route and restore the application; exercise the full recovery dependencies.
D:Weakening security does not satisfy the approved restore controls.
Question 437
A crash-consistent snapshot of all EBS volumes is captured successfully, but a financial database requires transaction-consistent checkpoint semantics. What additional step may be needed?
- Assume a crash-consistent volume image always includes every in-memory uncommitted transaction.
- Quiesce/flush or use a database-aware consistency method before the coordinated snapshot, then test recovery.
- Snapshot each related volume at random separate times for stronger consistency.
- Take EBS multi-volume snapshots and rely only on crash consistency for a financial database whose documented recovery standard requires flushed transaction boundaries.
Explanation
Correct Answer
B:Crash-consistency and application transaction consistency are distinct guarantees; the database may need log replay or quiescence.
Incorrect Answers
A:RAM/application buffers may not be part of the snapshot.
C:Different capture points make coherence worse.
D:Crash consistency is useful, but stricter transaction/application consistency may require a database-aware flush, quiescence or replay plan.
Question 438
A DynamoDB table was restored using point-in-time recovery to a separate new table, and an application cutover now reads the recovered records. The original table had TTL cleanup, DynamoDB Streams consumers and CloudWatch alarms, but none of those features are working on the restored table. Why?
- PITR always restores every operational integration and policy automatically; the issue can only be a global table name mismatch.
- The restore secretly modified the old production table in place, so all stream and alarm settings stayed attached to that old resource.
- Deleting the earlier original table automatically copies its streams, alarms and TTL settings into the new table.
- PITR restores table data to a new resource, but administrators must separately configure supported operational settings such as TTL, Streams, alarms, scaling, IAM and protection on the restored table.
Explanation
Correct Answer
D:AWS requires manual reconfiguration of TTL, Streams, IAM, alarms, tags, autoscaling and other relevant settings after restore, followed by validation of each dependent consumer.
Incorrect Answers
A:AWS documentation explicitly lists settings and auxiliary controls not inherited by a restored table; data recovery is not automatic application-operational parity.
B:Point-in-time restore creates a new target table, not an in-place mutation of the source table.
C:Deletion neither initializes streams nor recreates CloudWatch alarms on a new resource and can destroy useful forensic evidence.
Question 439
AWS Resilience Hub assesses an EC2/RDS application and recommends additional alarms and a recovery standard operating procedure to improve compliance with its recovery policy. A team simply marks the report as resolved without changing the application. What action makes the assessment useful?
- Rename the assessed application and assume the same unsupported RTO automatically passes without workload changes.
- Delete the recovery policy so all outstanding resilience recommendations disappear.
- Implement and test the relevant supported resilience recommendations or SOPs, then rerun the assessment to evaluate the changed posture against the approved targets.
- Increase the S3 Intelligent-Tiering archive fee to create a simulated RTO improvement.
Explanation
Correct Answer
C:Resilience Hub findings guide real mitigations and repeat assessments; a report is an input to execution, not a remediation step by itself.
Incorrect Answers
A:A different label does not alter dependency recovery behavior or measured recovery-policy status.
B:Removing a policy suppresses the standard rather than fixing the actual application risk.
D:Storage price settings cannot implement missing alarms, tested recovery automation or application RTO performance.
Question 440
During an AWS Fault Injection Service experiment, a CloudWatch alarm for application checkout errors enters ALARM and the experiment stops before additional instance disruptions. What did that configured stop condition achieve?
- It proved that checkout never experienced a single failed request during the controlled experiment.
- It automatically restored every impacted EC2 and database resource without needing service recovery.
- It guaranteed a passing business RTO solely because a monitoring alarm exists.
- It acted as a safety guardrail to halt further fault injection when measured impact exceeded the approved threshold; the team must still inspect outcomes and recovery evidence.
Explanation
Correct Answer
D:AWS FIS stop conditions can be bound to alarms so an experiment ends when an approved impact threshold triggers, limiting further injected disruption.
Incorrect Answers
A:A stop condition can activate after an error threshold; it does not establish that no initial errors occurred.
B:Stopping future FIS actions is not identical to full rollback of every fault or recovery of all affected components.
C:An alarm is a blast-radius bound, while demonstrated RTO requires timing and application availability evidence.
AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests