SAA-C03 Sample Questions & Answers

This architecture meets all requirements. Kinesis Data Streams is designed for high-volume streaming data. Using the device ID as the partition key ensures that data from each device is processed in order. AWS Lambda provides scalable, serverless processing. Kinesis Data Firehose is the simplest, most cost-effective way to durably store the raw streaming data in Amazon S3 for later analysis.

This statement is false. A VPC endpoint policy is an IAM resource policy that you attach to an endpoint. You can use this policy to control access to the service. The policy can restrict access to specific resources (like S3 buckets) and also to specific API actions (like s3:GetObject or s3:PutObject). This allows for granular control over what actions can be performed on which resources through the endpoint.

Amazon EFS provides a shared file system that can be mounted concurrently by multiple EC2 instances, even across different Availability Zones. This makes it the perfect solution for this scenario. Both the primary and standby instances can read and write to the same EFS file system, ensuring that the temporary data is always available to the active instance. EBS volumes are tied to a single AZ, and instance stores are ephemeral and cannot be shared.

Service Control Policies (SCPs) are the correct tool for this requirement. SCPs are a type of organization policy that you can use to manage permissions in your organization. They offer central control over the maximum available permissions for all accounts in your organization. An explicit Deny in an SCP overrides any Allow from IAM policies and applies to all principals in the account, including the root user. This makes them ideal for enforcing security guardrails.

Enabling caching directly on the API Gateway stage is the simplest and most integrated solution. It allows you to cache the responses from your backend Lambda function, reducing the number of calls made to the function and the downstream DynamoDB table. This provides a low-latency experience for frequently requested data without requiring significant changes to the Lambda function or adding another service like ElastiCache to manage.

The assume-role action is governed by the role's trust policy (also known as the assume role policy). This policy defines which principals (users, roles, or AWS services) are trusted to assume the role. The principal making the assume-role call must be listed and allowed the sts:AssumeRole action within this trust policy.

Amazon FSx for Lustre is specifically designed for high-performance computing workloads. It provides a fully managed, high-performance file system optimized for fast processing of workloads like HPC, machine learning, and media processing. It offers sub-millisecond latencies, up to hundreds of gigabytes per second of throughput, and millions of IOPS. Its native integration with Amazon S3 makes it ideal for processing data from a data lake.

An Origin Access Identity (OAI) is a special CloudFront user that can be associated with a distribution. By creating an OAI and modifying the S3 bucket policy to grant s3:GetObject permission only to this OAI, you can effectively block all direct access to the S3 bucket. Users will be forced to access the content through CloudFront, which will use the OAI to fetch content from the S3 origin securely.

AWS Transit Gateway acts as a cloud router and simplifies network architecture. By establishing a single Direct Connect connection with a transit virtual interface (VIF) to a Transit Gateway, the company can connect its on-premises network to hundreds or thousands of VPCs in a hub-and-spoke model. This is highly scalable and much easier to manage than creating multiple VIFs or a complex VPC peering mesh.

The root cause of the issue is that the scaling trigger (CPU utilization) does not accurately reflect the workload (number of orders to process). Since the CPU is low, the scaling policy isn't triggered. The most direct and effective metric for this decoupled architecture is the number of messages waiting in the SQS queue. A target tracking policy based on ApproximateNumberOfMessagesVisible will automatically scale the number of consumer instances up or down to keep the queue backlog at a desired level.