AWS Solutions Architect – Associate (SAA-C03) — Free Sample Questions
Practice with 30 free sample questions for the most popular AWS certification. The Solutions Architect Associate (SAA-C03) exam tests your ability to design distributed systems that are secure, resilient, high-performing, and cost-optimized.
Domains Tested
- Design Secure Architectures (30%) — VPC isolation, IAM policies, encryption at rest and in transit, private endpoints
- Design Resilient Architectures (26%) — multi-AZ, auto-scaling, decoupled messaging, backup and restore
- Design High-Performing Architectures (24%) — caching, read replicas, global accelerators, edge computing
- Design Cost-Optimized Architectures (20%) — Spot Instances, S3 lifecycle policies, Reserved capacity, right-sizing
What Makes SAA-C03 Challenging
The exam presents multi-service scenarios requiring you to choose the combination that best satisfies all stated requirements. A typical question might describe a latency-sensitive, globally-distributed workload and ask which storage plus CDN configuration meets cost, durability, and performance targets simultaneously.
Tips from Our Question Bank
- Read every requirement carefully — "most cost-effective" versus "lowest latency" leads to different answers
- Eliminate options that violate a stated constraint before comparing the remaining choices
- Know the default limits and when you need to request increases
- Understand when to use ALB vs. NLB, RDS vs. DynamoDB, EBS vs. EFS vs. S3
Full Preparation
Beyond these 30 free samples, NestedCerts provides 600 SAA-C03 questions in 30 quizzes and 2 full-length 65-question practice exams, all with detailed explanations.
All 30 Free Sample Questions
Question 1
A startup has a team of 15 developers who share a single IAM admin account to manage AWS resources. After a security audit flags accountability and access control risks, the CTO tasks a Solutions Architect with improving their IAM posture. Which THREE actions should they prioritize?
- Consolidate developers under a single shared IAM user per team with CloudWatch alarms for monitoring
- Assign the root account to a senior engineer with MFA enabled for daily administrative tasks
- Rotate access keys regularly and remove unused credentials — Correct answer
- Implement least privilege access with granular IAM policies — Correct answer
- Enable MFA for all users, especially those with privileged access — Correct answer
- Disable CloudTrail data event logging to reduce storage costs and simplify audit reviews
Explanation:
- Why correct: Rotating access keys (C), implementing least privilege (D), and enabling MFA (E) are foundational IAM security practices recommended by AWS. Together they address credential hygiene, access scoping, and authentication hardening.
- Why A is wrong: Consolidating to one shared account per team still prevents individual accountability. Each developer must have their own IAM user or federated identity so that CloudTrail logs can trace every API call to a specific person.
- Why B is wrong: The root account has unrestricted access that cannot be reduced by IAM policies. AWS recommends locking root behind MFA and using it only for the rare tasks that require it (e.g., changing account-level settings or closing the account). Daily admin work should use IAM roles or federated identities with scoped permissions.
- Why F is wrong: CloudTrail provides the audit trail for all API calls in the account. Disabling data event logging removes visibility into object-level operations (e.g., S3 GetObject/PutObject), which are critical for detecting unauthorized data access and meeting compliance requirements. Cost concerns should be addressed with selective event filtering, not by disabling logging.
Question 2
A security audit requires implementing defense-in-depth for a VPC. Which THREE layers should be implemented?
- Security groups at the instance level — Correct answer
- AWS CloudTrail for API activity logging
- Amazon Inspector for vulnerability scanning
- VPC Flow Logs for network traffic monitoring
- AWS WAF at the application level — Correct answer
- Network ACLs at the subnet level — Correct answer
Explanation:
- Why correct: Defense-in-depth uses multiple overlapping security layers that actively filter or block traffic at different points in the network stack. Network ACLs provide stateless packet filtering at the subnet level, security groups provide stateful traffic control at the instance level, and AWS WAF inspects HTTP/HTTPS requests at the application level. Together, a failure or misconfiguration in one layer does not fully expose resources.
- Why A is correct: Security groups are stateful firewalls attached to ENIs that filter traffic at the instance level — a core layer in defense-in-depth.
- Why B is wrong: CloudTrail records API calls for auditing and forensic analysis, but it does not actively filter or block malicious traffic. It is a detective control, not a preventive security layer in the defense-in-depth model.
- Why C is wrong: Amazon Inspector scans workloads for software vulnerabilities and unintended network exposure. It identifies weaknesses but does not actively block or filter traffic at any network layer.
- Why D is wrong: VPC Flow Logs capture metadata about IP traffic for analysis, but they are a passive monitoring tool. They do not filter, block, or modify traffic and therefore do not constitute a defensive layer.
- Why E is correct: AWS WAF operates at Layer 7 and inspects application-level traffic for threats such as SQL injection and XSS, providing active protection that network-layer controls cannot offer.
- Why F is correct: Network ACLs provide stateless, subnet-level filtering that acts as a secondary boundary independently of security groups.
Question 3
A solutions architect is designing a data-at-rest encryption strategy for an application that stores files in Amazon S3 and uses Amazon RDS. The company requires centralized control over encryption keys and must encrypt all S3 objects automatically on upload. Which TWO services should the architect use? (Choose TWO.)
- Amazon S3 with server-side encryption — Correct answer
- AWS CloudHSM for dedicated hardware key management
- AWS Secrets Manager for storing and managing encryption keys
- AWS Config for monitoring encryption compliance across resources
- AWS KMS for key management and encryption — Correct answer
Explanation:
- Why correct: Amazon S3 server-side encryption (SSE-S3, SSE-KMS, or SSE-C) automatically encrypts objects at rest on upload. AWS KMS provides centralized key management, allowing the company to create, rotate, audit, and control access to encryption keys used across AWS services including S3 and RDS.
- Why A is correct: This is correct. S3 server-side encryption handles automatic data-at-rest encryption for stored objects.
- Why B is wrong: AWS CloudHSM provides dedicated hardware security modules for cryptographic operations and can store keys, but it does not integrate natively with S3 for automatic server-side encryption on upload. CloudHSM is designed for workloads requiring FIPS 140-2 Level 3 validated HSMs or direct cryptographic control, not for centralized key management across services like S3 and RDS.
- Why C is wrong: AWS Secrets Manager securely stores, rotates, and retrieves application secrets such as database credentials and API keys. It does not manage encryption keys for data-at-rest encryption of S3 objects or RDS databases—that is the role of AWS KMS.
- Why D is wrong: AWS Config records and evaluates AWS resource configurations for compliance (e.g., verifying that S3 buckets have encryption enabled). It monitors whether encryption policies are followed but does not perform encryption or manage encryption keys.
- Why E is correct: This is correct. AWS KMS provides centralized key management and encryption services.
Question 4
A company operating in a regulated industry must guarantee that no S3 bucket across their AWS Organization can ever be made publicly accessible, even by account administrators. What is the MOST effective enforcement method?
- Apply individual bucket policies to each S3 bucket denying public access
- Enable S3 Block Public Access at the account level and use an SCP to deny the s3:PutBucketPublicAccessBlock action — Correct answer
- Create an AWS Config rule to detect public buckets and use a Lambda function to remediate automatically
- Use CloudWatch Events to alert when a bucket ACL is changed to public
Explanation:
- Why correct: Account-level S3 Block Public Access is a preventive control that blocks all public access across every bucket in the account. Adding an SCP that denies the s3:PutBucketPublicAccessBlock action prevents any IAM principal — including account administrators — from disabling this protection. This combination provides the strongest enforcement because SCPs are applied at the AWS Organizations level and cannot be overridden by account-level policies.
- Why A is wrong: Individual bucket policies require manual configuration per bucket and can be modified or removed by anyone with s3:PutBucketPolicy permission. This approach is error-prone at scale and does not prevent new buckets from being created without the restrictive policy.
- Why C is wrong: AWS Config with Lambda remediation is a detective-then-corrective approach. There is a window between when the bucket is made public and when the remediation executes, during which data could be exposed. This is weaker than a preventive control that blocks the action entirely before it takes effect.
- Why D is wrong: CloudWatch Events (EventBridge) alerting only notifies staff after a bucket has already been made public. This is a detective control requiring human intervention, creating a gap where data could be exposed before someone responds to the alert.
Question 5
A company has an order processing application that reads messages from an Amazon SQS queue. Occasionally, an order fails to process due to transient downstream errors. The team needs a solution that automatically retries failed messages and isolates messages that repeatedly fail for later analysis. Which approach should the Solutions Architect recommend?
- Configure a long message retention period on the SQS queue
- Configure a visibility timeout with a dead-letter queue redrive policy — Correct answer
- Use Amazon SNS to republish failed messages to the SQS queue
- Delete failed messages and re-publish them with a custom retry counter
Explanation:
- Why correct: The SQS visibility timeout keeps a message hidden from other consumers while one consumer is processing it. If processing fails and the visibility timeout expires, the message reappears in the queue for another attempt. After a configurable number of failed attempts (maxReceiveCount), the message is automatically moved to a dead-letter queue (DLQ) for investigation. This ensures no messages are lost while preventing poison messages from blocking the queue indefinitely.
- Why A is wrong: Setting a long retention period (up to 14 days) only determines how long messages remain in the queue before automatic deletion. It does not provide any retry mechanism or failed-message isolation. Messages would still need to be manually reprocessed after failure.
- Why C is wrong: While Amazon SNS can fan out messages, adding SNS in front of SQS does not address retry logic. SNS does not provide message retry capabilities for application-level processing failures. SNS dead-letter queues only handle delivery failures to endpoints, not consumer processing failures.
- Why D is wrong: Deleting and re-publishing messages on failure requires custom application logic to track retry counts, handle concurrency, and manage failed messages. This is error-prone and duplicates functionality already built into SQS with visibility timeout and DLQ redrive policies.
Question 6
A company operates a primary application in us-east-1 and maintains a warm standby in us-west-2 for disaster recovery. During a failover test, the standby environment failed to scale because AWS service quotas in us-west-2 were set to default values, far below the primary region's production limits. How should the Solutions Architect prevent this issue?
- Request service quota increases in us-west-2 to match the primary region's production quotas before a failover occurs — Correct answer
- Use AWS Auto Scaling to automatically increase service quotas during failover
- Deploy all resources in us-west-2 at full production scale at all times
- Configure AWS CloudFormation StackSets to synchronize quotas across regions automatically
Explanation:
- Why correct: AWS service quotas are per-region and default to conservative values. For DR readiness, the standby region must have quota increases requested in advance through AWS Service Quotas or a support case. This ensures the standby environment can scale to production levels during failover without hitting limits.
- Why B is wrong: AWS Auto Scaling adjusts the number of resources (such as EC2 instances) within existing quotas. It cannot increase service quotas themselves, which require explicit requests and AWS approval.
- Why C is wrong: Running full production scale in the standby region at all times would work functionally, but it eliminates the cost savings of a warm standby DR strategy. The correct approach is to pre-request quota capacity without deploying all resources until failover occurs.
- Why D is wrong: CloudFormation StackSets can deploy infrastructure templates across regions and accounts, but they cannot modify or synchronize AWS service quotas. Quotas must be requested independently per region through the Service Quotas console or API.
Question 7
A retail company's web application experiences predictable traffic spikes every weekday from 9 AM to 6 PM and occasional unpredictable surges during flash sales. The company wants to minimize costs while ensuring performance during all traffic patterns. Which Auto Scaling configuration meets these requirements?
- Provision fixed capacity at the expected peak level and run at that capacity continuously
- Scheduled scaling actions for the daily weekday pattern combined with target tracking scaling for flash-sale surges — Correct answer
- Step scaling policies triggered by CloudWatch CPU alarms with no scheduled actions
- Target tracking scaling policy alone set to maintain 60% average CPU utilization
Explanation:
- Why correct: Scheduled scaling pre-provisions capacity before the known weekday peak, avoiding the reactive lag of scaling policies. Target tracking dynamically adjusts capacity for unpredictable flash-sale surges by maintaining a target metric (such as 60% average CPU utilization). Together they handle both predictable and unpredictable patterns cost-effectively, scaling down during off-peak hours.
- Why Option A is wrong: Provisioning for peak capacity 24/7 handles all load but wastes significant cost during off-peak hours (nights, weekends). This directly contradicts the cost-optimization requirement.
- Why Option C is wrong: Step scaling reacts only after CloudWatch alarms trigger, introducing a delay before new instances are ready. Without scheduled scaling for the known daily pattern, the application would experience degraded performance every morning until step scaling catches up.
- Why Option D is wrong: Target tracking alone handles dynamic load well but would need to reactively scale up every morning for the predictable daily pattern. Scheduled scaling eliminates this daily lag by pre-provisioning, providing faster readiness for known peaks.
Question 8
A healthcare company stores patient imaging data in Amazon S3. Access patterns are unpredictable — some images are retrieved frequently for active cases while others remain untouched for months. The company wants to minimize storage costs without managing lifecycle policies or predicting access patterns. Which S3 storage class is MOST appropriate?
- S3 Intelligent-Tiering — Correct answer
- S3 Standard-Infrequent Access with manual monitoring of access patterns
- S3 Glacier Flexible Retrieval with expedited retrievals enabled
- S3 Standard with S3 Storage Class Analysis to identify cold data
Explanation:
- Why correct: S3 Intelligent-Tiering automatically monitors access patterns and moves objects between a Frequent Access tier (same cost as S3 Standard) and an Infrequent Access tier (same cost as S3 Standard-IA) with no retrieval fees. It can also optionally enable Archive and Deep Archive tiers. Because the company cannot predict access patterns and wants to avoid managing lifecycle rules, Intelligent-Tiering handles optimization automatically.
- Why B is wrong: S3 Standard-IA charges a per-GB retrieval fee every time an object is accessed and imposes a 30-day minimum storage charge. If an image unexpectedly becomes frequently accessed (e.g., an active patient case), retrieval costs can spike. Standard-IA also requires the company to predict which images are infrequently accessed — the exact operational burden they want to avoid.
- Why C is wrong: S3 Glacier Flexible Retrieval has retrieval times of minutes (Expedited) to hours (Standard), making it unsuitable for patient images that may need immediate display for active clinical cases. Moving actively used data to Glacier would introduce unacceptable latency.
- Why D is wrong: S3 Standard is the most expensive storage class per GB. Keeping all images in Standard regardless of access patterns means paying full price for data that may not be accessed for months. While S3 Storage Class Analysis can recommend lifecycle transitions, it still requires manual rule creation and maintenance — the overhead the company wants to eliminate.
Question 9
A company wants to migrate a containerized data-processing pipeline to AWS. The team does not want to manage the underlying infrastructure or patch operating systems. The containers run for 5 to 20 minutes per task and are triggered by an Amazon SQS queue. Which compute solution meets these requirements with the LEAST operational overhead?
- AWS Fargate tasks launched by Amazon ECS with SQS integration — Correct answer
- AWS Lambda functions with container image support
- Amazon EC2 instances running Docker and polling the SQS queue
- Amazon EKS with a self-managed node group
Explanation:
- Why correct: AWS Fargate is a serverless compute engine for containers that eliminates the need to provision, configure, or scale clusters of EC2 instances. ECS tasks running on Fargate can be triggered by SQS messages, and the 5–20 minute runtime is well within Fargate’s capabilities. No OS patching or infrastructure management is required.
- Why B is wrong: AWS Lambda supports container images but has a maximum execution timeout of 15 minutes. Tasks running up to 20 minutes would exceed this limit and fail. Lambda also imposes a 10 GB memory limit and limited ephemeral storage that may not suit all data-processing workloads.
- Why C is wrong: Running Docker on EC2 instances requires the team to manage host OS patching, instance scaling, and Docker daemon maintenance. This directly conflicts with the requirement to avoid managing infrastructure.
- Why D is wrong: Amazon EKS with self-managed node groups requires the team to provision, patch, and scale the underlying EC2 worker nodes. While EKS with a Fargate profile would remove that burden, self-managed node groups do not meet the minimal-overhead requirement.
Question 10
A mobile gaming company is launching a new game. Player traffic is highly unpredictable—ranging from a few hundred requests per second during off-peak to millions during viral events. The company wants the database to scale automatically without any capacity planning or provisioning. Which database solution should the Solutions Architect recommend?
- Self-managed MySQL on Amazon EC2 with Auto Scaling groups
- Amazon DynamoDB with on-demand capacity mode — Correct answer
- Amazon Aurora Serverless v2 with PostgreSQL compatibility
- Amazon RDS MySQL with a fixed db.r6g.xlarge instance
Explanation:
- Why correct: DynamoDB on-demand capacity mode automatically adjusts read and write throughput in response to traffic with no capacity planning required. It can scale from hundreds to millions of requests per second within minutes.
- Why A is wrong: Self-managed MySQL on EC2 with Auto Scaling groups scales the compute layer, but the database itself still requires manual capacity management, replication setup, and connection handling.
- Why B is correct: DynamoDB on-demand mode handles unpredictable traffic spikes seamlessly with zero capacity planning overhead.
- Why C is wrong: Aurora Serverless v2 automatically scales compute via ACUs, but it operates on a connection-based relational model with upper ACU limits. It cannot natively scale to millions of simple key-value requests per second the way DynamoDB on-demand can, and its relational SQL capabilities are unnecessary for a gaming workload's access pattern.
- Why D is wrong: A fixed RDS MySQL instance has a ceiling on concurrent connections and throughput that cannot handle sudden spikes from hundreds to millions of requests without manual intervention or complex scaling procedures.
Question 11
A media company hosts video content in an S3 bucket in us-east-1. Users in Europe and Asia report slow load times and buffering. The company wants to reduce latency for global users without replicating the bucket to multiple Regions. Which solution should a Solutions Architect recommend?
- An Amazon CloudFront distribution with the S3 bucket configured as the origin — Correct answer
- Amazon Route 53 with simple routing pointing directly to the S3 bucket endpoint
- AWS Global Accelerator with the S3 bucket configured as an endpoint
- An Application Load Balancer in us-east-1 with cross-Region request routing to S3
Explanation:
- Why correct: Amazon CloudFront is a content delivery network (CDN) that caches content at 400+ edge locations worldwide. By setting the S3 bucket as the origin, CloudFront caches video content close to end users, dramatically reducing latency without requiring multi-Region S3 replication.
- Why B is wrong: Route 53 with simple routing resolves DNS to the S3 endpoint in us-east-1 but does not cache content or reduce the physical distance data must travel. Users in Europe and Asia still experience high latency fetching from a single US Region.
- Why C is wrong: AWS Global Accelerator optimizes routing for dynamic, non-cacheable traffic via the AWS global network. For static or cacheable content like video files, CloudFront is the better choice because it caches content at edge locations, eliminating repeated origin fetches.
- Why D is wrong: An Application Load Balancer distributes traffic among compute targets such as EC2 instances and does not serve content directly from S3. ALB does not provide global edge caching capabilities needed for low-latency content delivery.
Question 12
A media company collects 5 PB of user engagement data and needs to run complex SQL joins and aggregations across the full dataset for weekly business intelligence reports. The solution must minimize operational overhead. Which AWS service is MOST appropriate?
- Amazon RDS for PostgreSQL with read replicas
- Amazon Redshift — Correct answer
- Amazon DynamoDB with global secondary indexes
- Amazon Aurora Serverless v2
Explanation:
- Why correct (B): Amazon Redshift is a fully managed, petabyte-scale data warehouse that uses columnar storage and massively parallel processing (MPP). It is purpose-built for complex analytical SQL queries—joins, aggregations, and window functions—across very large datasets.
- Why A is wrong: Amazon RDS for PostgreSQL is designed for online transactional processing (OLTP). It lacks columnar storage and MPP, so it cannot efficiently run complex analytical queries on petabytes of data.
- Why C is wrong: Amazon DynamoDB is a NoSQL key-value and document database optimized for single-digit-millisecond lookups. It does not support complex SQL joins or aggregations.
- Why D is wrong: Amazon Aurora Serverless v2 is a relational database that auto-scales for transactional workloads. While it supports SQL, it is not designed for petabyte-scale analytical processing and does not provide columnar storage or MPP.
Question 13
A company is migrating a monolithic e-commerce application to AWS. During holiday sales the application experiences extreme traffic spikes, and the team wants each component (web front end, order processing, and image resizing) to scale independently. Which THREE design decisions support high-performing, independently scalable components? (Select THREE.)
- Place all components on a single large EC2 instance to reduce network latency
- Use Amazon SQS between the web tier and order processing to decouple workloads — Correct answer
- Deploy all components in a single Auto Scaling group to simplify management
- Use AWS Lambda for the image resizing service to scale automatically per request — Correct answer
- Deploy the web front end behind an Application Load Balancer with its own Auto Scaling group — Correct answer
- Use a shared relational database table for inter-component communication
Explanation:
- Why correct: Decoupling with SQS allows the order processing tier to scale independently from the web tier by buffering messages during traffic spikes. AWS Lambda for image resizing scales automatically per invocation with zero capacity management. Deploying the web front end behind its own ALB and Auto Scaling group lets it scale based on its own traffic metrics independently of other components.
- Why A is wrong: Placing all components on a single large EC2 instance is the monolithic pattern the company is migrating away from. It cannot scale components independently and creates a single point of failure.
- Why C is wrong: A single Auto Scaling group for all components forces them to scale together based on one metric. If order processing needs more capacity but the web tier does not, you cannot scale them independently.
- Why F is wrong: Using a shared relational database for inter-component communication creates tight coupling and a bottleneck. Database connections and row locking would limit throughput under heavy load. Messaging services like SQS are purpose-built for decoupled communication.
Question 14
A company hosts a photo-sharing application on AWS. The application generates thumbnail images that are accessed infrequently after the first week but must be available immediately when requested. The thumbnails can be regenerated from the original high-resolution images at any time. A Solutions Architect must select the MOST cost-effective S3 storage class for the thumbnails. Which storage class should the Solutions Architect recommend?
- S3 Standard-Infrequent Access (S3 Standard-IA)
- S3 One Zone-Infrequent Access (S3 One Zone-IA) — Correct answer
- S3 Glacier Flexible Retrieval
- S3 Glacier Deep Archive
Explanation:
- Why B is correct: S3 One Zone-IA is approximately 20% cheaper than S3 Standard-IA because it stores data in only one Availability Zone instead of a minimum of three. Since the thumbnails can be regenerated from the original high-resolution images at any time, the reduced availability risk of a single AZ is an acceptable trade-off for the cost savings.
- Why A is wrong: S3 Standard-IA replicates data across at least three AZs, providing higher durability. However, this extra protection is unnecessary for data that is easily reproducible. Standard-IA costs more than One Zone-IA without providing meaningful benefit in this scenario.
- Why C is wrong: S3 Glacier Flexible Retrieval is designed for archival data with retrieval times ranging from 1-5 minutes (expedited) to 3-5 hours (standard). The thumbnails must be served immediately when users browse the gallery, so retrieval delays are unacceptable.
- Why D is wrong: S3 Glacier Deep Archive has a standard retrieval time of up to 12 hours and is intended for long-term compliance or archival data accessed extremely rarely. It is far too slow for serving image thumbnails on demand.
Question 15
A company operates a fleet of Amazon EC2 instances for an internal reporting application used only during business hours (8 AM–6 PM, Monday–Friday). The instances currently run 24/7. The company wants to reduce compute costs without impacting availability during work hours. Which approach provides the GREATEST cost reduction?
- Purchase 1-year Reserved Instances for the fleet to reduce the hourly rate
- Migrate to smaller instance types to lower per-hour costs while running continuously
- Create Amazon EventBridge rules with AWS Lambda functions to automatically stop instances outside business hours and start them before business hours begin — Correct answer
- Convert the fleet to Spot Instances using a Spot Fleet to reduce hourly costs
Explanation:
- Why correct: Stopping instances outside business hours eliminates approximately 60% of compute costs (nights and weekends). EventBridge scheduled rules with Lambda automation ensures reliable, hands-off operation. You only pay for EBS storage while instances are stopped.
- Why A is wrong: Reserved Instances reduce the hourly rate (up to 72% for 1-year All Upfront), but you pay for the reservation 24/7 regardless of whether instances are running. Scheduling eliminates off-hours compute costs entirely, which is a larger savings for a workload that runs only 50 hours out of 168 per week.
- Why B is wrong: Migrating to smaller instances reduces per-hour costs but the instances still run 24/7, meaning roughly 60% of compute spend is wasted during off-hours. This addresses cost-per-hour but not the core problem of paying for unnecessary runtime.
- Why D is wrong: Spot Instances can provide up to 90% savings but can be interrupted with 2 minutes notice. For a business-critical internal reporting application during work hours, interruptions would impact availability and user productivity.
Question 16
A startup is launching a new mobile application backed by Amazon DynamoDB. Traffic patterns are unknown, with expected spikes during marketing campaigns and low activity between launches. The team cannot predict baseline throughput requirements. Which DynamoDB capacity mode should a Solutions Architect select to optimize costs?
- Provisioned capacity mode with a high fixed read and write capacity
- On-Demand capacity mode — Correct answer
- Provisioned capacity mode with Auto Scaling set to a wide range
- Provisioned capacity mode with reserved capacity
Explanation:
- Why correct: DynamoDB On-Demand capacity mode charges per read and write request with no minimum capacity commitment. It is ideal for new applications with unknown or highly unpredictable traffic patterns because there is no risk of over-provisioning during low-traffic periods or throttling during spikes.
- Why A is wrong: Provisioned capacity with high fixed values leads to paying for unused capacity during low-traffic periods. Without historical data to set appropriate values, this approach will likely overspend significantly between marketing campaigns.
- Why C is wrong: Provisioned capacity with Auto Scaling adjusts based on utilization but reacts to traffic changes with a delay. For completely unpredictable spikes such as marketing campaigns, Auto Scaling may not respond quickly enough, causing throttling. On-Demand handles instantaneous spikes without delay.
- Why D is wrong: Reserved capacity requires a one-year commitment for a specific throughput level. With unknown traffic patterns, committing to a fixed throughput baseline risks paying for unused capacity and is inappropriate for a new application without usage history.
Question 17
A company provisioned a 10 Gbps AWS Direct Connect dedicated connection two years ago for a large data migration. The migration is complete, and CloudWatch metrics show that current utilization averages 300 Mbps with peaks under 900 Mbps. Which approach MOST effectively reduces ongoing Direct Connect costs while maintaining private connectivity?
- Downgrade to a 1 Gbps AWS Direct Connect dedicated connection, which provides sufficient capacity for current traffic patterns at a fraction of the port-hour cost — Correct answer
- Add a Site-to-Site VPN as the primary path and keep the 10 Gbps Direct Connect connection as an idle standby for traffic bursts
- Enable bandwidth throttling on the Direct Connect connection to 1 Gbps to automatically reduce the port-hour billing rate
- Replace the Direct Connect connection entirely with multiple Site-to-Site VPN connections aggregated through AWS Transit Gateway
Explanation:
- Why correct (A): Direct Connect dedicated port charges are based on connection speed: 1 Gbps costs ~$0.30/port-hour (~$219/month) versus 10 Gbps at ~$2.25/port-hour (~$1,642/month). With utilization averaging 300 Mbps and peaks under 900 Mbps, a 1 Gbps connection provides adequate capacity while reducing port charges by approximately 87%. The per-GB data transfer rates remain the same regardless of connection speed, so there is no transfer cost penalty for the lower-capacity link.
- Why B is wrong: Keeping the 10 Gbps Direct Connect as a standby still incurs the full port-hour charge (~$1,642/month) whether or not traffic flows over it. Direct Connect ports are billed while provisioned, not based on utilization. Adding a VPN (~$36/month) as primary while paying for an idle 10 Gbps backup increases total costs rather than reducing them.
- Why C is wrong: There is no bandwidth throttling feature on Direct Connect that reduces the billed port speed. Direct Connect connections are provisioned at a fixed capacity, and billing is based on the provisioned speed regardless of actual utilization. To reduce port charges, the connection must be replaced with a lower-capacity connection.
- Why D is wrong: While VPN eliminates Direct Connect port fees, VPN routes traffic over the public internet at standard data transfer rates (~$0.09/GB outbound). At 300 Mbps average utilization (~97 TB/month), the per-GB cost increase from internet-rate pricing versus Direct Connect rates (~$0.02/GB) would far exceed the port-hour savings. VPN also provides less consistent latency and throughput compared to Direct Connect's dedicated bandwidth.
Question 18
A media company stores 50 TB of video files in Amazon S3. Analytics show that files are accessed frequently during the first 30 days after upload, occasionally during days 31-90, and rarely after 90 days. However, all files must remain retrievable within 12 hours when needed. Which S3 storage strategy MINIMIZES costs while meeting access requirements?
- Store all files in S3 Standard and manually move files to S3 Glacier when requested
- Store all files in S3 Standard permanently to ensure fast retrieval at all times
- Store all files in S3 One Zone-Infrequent Access from day one to reduce costs
- Use S3 Lifecycle policies to transition files to S3 Standard-IA after 30 days and S3 Glacier Flexible Retrieval after 90 days — Correct answer
Explanation:
- Why correct: S3 Lifecycle policies automate transitions between storage classes based on object age. S3 Standard-IA is cost-effective for data accessed less frequently but still needing millisecond retrieval (days 31-90), at approximately $0.0125/GB vs. $0.023/GB for Standard. S3 Glacier Flexible Retrieval costs approximately $0.0036/GB/month and supports standard retrievals within 3-5 hours or expedited retrievals within 1-5 minutes, well within the 12-hour retrieval requirement. Automation eliminates manual operational overhead.
- Why A is wrong: Manual migration does not scale at 50 TB and requires continuous operational effort. Without automation, files remain in the expensive S3 Standard class indefinitely because teams rarely remember to manually move aging data, resulting in unnecessary storage costs.
- Why B is wrong: S3 Standard costs approximately $0.023/GB/month. Storing 50 TB permanently in Standard costs roughly $1,150/month, whereas transitioning older data to Standard-IA and Glacier Flexible Retrieval could reduce costs for the 90%+ of data that is rarely accessed by 70-85%.
- Why C is wrong: S3 One Zone-IA stores data in a single Availability Zone. If that AZ experiences a destructive failure, the data is permanently lost. For video files that may be the only copy, this risk is unacceptable. Additionally, One Zone-IA has a 30-day minimum storage duration charge and per-GB retrieval fee, making it more expensive than Standard for the frequently accessed first 30 days.
Question 19
A logistics company receives GPS location updates from 50,000 delivery vehicles every 5 seconds. The data must be aggregated into 1-minute summary windows and stored in Amazon S3 for fleet analytics dashboards. Which architecture handles the ingestion and real-time aggregation MOST efficiently?
- Amazon Kinesis Data Streams for ingestion, Amazon Managed Service for Apache Flink for windowed aggregation, then delivery to Amazon S3 — Correct answer
- Amazon SQS queue consumed by AWS Lambda functions that aggregate records and write to S3
- Amazon Kinesis Data Firehose with Lambda transformation for aggregation, delivering to S3
- Amazon MSK cluster with Amazon EMR Spark Streaming for windowed aggregation and S3 output
Explanation:
- Why correct (A): Kinesis Data Streams handles high-throughput ingestion (up to 1 MB/sec or 1,000 records/sec per shard, scalable to thousands of shards). Amazon Managed Service for Apache Flink (formerly Kinesis Data Analytics) provides native windowed aggregation using SQL or Apache Flink applications, making 1-minute tumbling windows straightforward with built-in state management. The aggregated results are then delivered to S3.
- Why B is wrong: Amazon SQS is a message queue without native support for time-based windowed aggregation. Lambda would need custom logic to manage state across invocations, handle ordering, and implement window boundaries. SQS standard queues do not guarantee ordering, and FIFO queues are limited to 3,000 messages/sec with batching — far below the throughput needed.
- Why C is wrong: Kinesis Data Firehose can invoke Lambda for record-level transformation, but Lambda transforms within Firehose operate on micro-batches of delivery records, not time-based windows. Implementing stateful 1-minute aggregation within Firehose Lambda transforms would require external state management (e.g., DynamoDB), adding complexity and latency.
- Why D is wrong: Amazon MSK with EMR Spark Streaming can achieve this, but it introduces significantly more operational overhead — MSK requires cluster sizing and broker management, and EMR adds another cluster to maintain. This is over-engineered for a use case that Kinesis and Managed Apache Flink handle natively with less infrastructure.
Question 20
An insurance company is automating its claims-processing workflow. After an automated fraud-detection step, any claim above $10,000 must pause for manual review by a human adjuster before payment is authorized. The workflow must resume automatically once the adjuster approves or rejects the claim. Which approach should a solutions architect recommend?
- Use AWS Step Functions with a task token callback pattern that pauses the workflow until the adjuster submits approval through an external API call — Correct answer
- Configure an Amazon SQS queue to hold pending claims and have the adjuster poll the queue periodically to review and approve each claim
- Create an Amazon EventBridge rule that invokes a Lambda function every five minutes to check a DynamoDB table for the adjuster's approval decision
- Implement a Lambda function that uses a sleep loop to wait up to 15 minutes and retries until the adjuster's approval appears in a database
Explanation:
- Why correct: The Step Functions task token (callback) pattern is designed for exactly this use case. The workflow pauses at the approval step and generates a task token. When the adjuster completes their review, an external system calls SendTaskSuccess or SendTaskFailure with the token, and the workflow resumes. No polling or idle compute is required, and the workflow can wait for days if needed.
- Why B is wrong: Having the adjuster poll an SQS queue requires a custom UI and polling logic, and there is no built-in mechanism to resume a coordinated multi-step workflow once the adjuster acts. SQS is a message queue, not a workflow orchestrator.
- Why C is wrong: Polling every five minutes with EventBridge and Lambda introduces latency (up to five minutes after approval), wastes Lambda invocations on empty checks, and requires custom state management in DynamoDB to track workflow progress.
- Why D is wrong: Lambda functions have a maximum execution timeout of 15 minutes, so they cannot wait for a human review that might take hours or days. A sleep loop also wastes compute resources and Lambda concurrency during the entire wait period.
Question 21
A company runs a scientific simulation on Amazon EC2 that performs complex floating-point calculations. The application is single-threaded and bottlenecked on CPU clock speed. It currently runs on an m5.xlarge instance where CPU utilization is consistently at 100% while memory usage remains at 15%. Which instance type change should the Solutions Architect recommend?
- C5.xlarge — compute-optimized instance with a high CPU-to-memory ratio and higher clock speed processors — Correct answer
- R5.xlarge — memory-optimized instance to cache the large datasets in memory
- M5.2xlarge — doubling the vCPUs on the same general-purpose instance family
- T3.xlarge — burstable instance to handle CPU-intensive periods with burst credits
Explanation:
- Why correct (A): C5 instances use Intel Xeon Scalable processors with higher sustained clock speeds than M5 instances. Since the workload is single-threaded and CPU-bound, moving to a compute-optimized instance with a faster clock provides more processing power per core. The low memory usage (15%) confirms the workload does not benefit from M5's balanced memory allocation.
- Why B is wrong: Memory is not the bottleneck — only 15% of RAM is in use. R5 instances provide a high memory-to-vCPU ratio, which is the opposite of what this CPU-bound workload needs. The processor clock speeds on R5 are comparable to M5, not faster.
- Why C is wrong: The application is single-threaded, so doubling vCPUs from 4 to 8 provides no benefit — the extra cores sit idle. The instance costs roughly twice as much while delivering the same single-thread performance.
- Why D is wrong: T3 burstable instances accumulate CPU credits during idle periods and spend them during bursts. A workload running at 100% CPU continuously would exhaust burst credits immediately, then be throttled to the baseline (20-40% of a vCPU for T3). This would degrade performance significantly.
Question 22
A company runs a content management system on Amazon ECS with multiple tasks that must read and write to a shared file system. The content is updated frequently and must be immediately visible to all running tasks. When tasks are replaced during deployments, the data must persist. Which storage solution meets these requirements?
- Use the default ephemeral storage provided by AWS Fargate for each task
- Mount an Amazon EFS file system as a volume in the ECS task definition — Correct answer
- Attach an Amazon EBS volume to the container instance and share it across tasks
- Store files in the container image and rebuild the image when content changes
Explanation:
- Why correct (B): Amazon EFS provides a fully managed, shared file system that can be mounted by multiple ECS tasks simultaneously across Availability Zones. Data written by one task is immediately visible to others via NFS. EFS volumes persist independently of task lifecycle, so data survives task replacement during deployments. ECS natively supports EFS volumes in task definitions for both EC2 and Fargate launch types.
- Why A is wrong: Fargate ephemeral storage (20–200 GiB) is local to each task and is not shared between tasks. When a task stops, its ephemeral storage is deleted, so content would be lost during deployments.
- Why C is wrong: An EBS volume can only be attached to one EC2 instance at a time. While multiple tasks on the same instance could access it via bind mounts, tasks on different instances cannot share the same EBS volume. This does not work with Fargate either.
- Why D is wrong: Baking frequently changing content into container images means rebuilding and redeploying images for every content update, which is slow, impractical, and violates the principle of separating application code from data.
Question 23
A company is migrating a 500 GB on-premises MySQL 5.7 database to AWS. The application relies on complex joins and stored procedures. The business requires automatic failover across Availability Zones and the ability to scale read throughput during flash sales with minimal application changes. Which solution should the solutions architect recommend?
- Deploy MySQL Community Edition on Amazon EC2 instances with Multi-AZ EBS volumes and scripted failover
- Amazon Aurora MySQL with Multi-AZ deployment and up to 15 Aurora Replicas — Correct answer
- Amazon RDS for MySQL with a Single-AZ deployment and daily automated snapshots
- Amazon DynamoDB with a single-table design to replace relational joins
Explanation:
- Why correct (B): Aurora MySQL is wire-compatible with MySQL 5.7, so the application requires minimal code changes. Aurora provides up to 5x the throughput of standard MySQL, automatic storage scaling up to 128 TiB, and up to 15 low-latency read replicas that share the same distributed storage volume. Multi-AZ Aurora automatically maintains replicas across Availability Zones and provides automatic failover in under 30 seconds.
- Why A is wrong: Self-managed MySQL on EC2 requires the team to handle patching, backups, replication configuration, failover scripting, and storage management. This adds significant operational overhead compared to a fully managed service and introduces risk through manual failover scripts.
- Why C is wrong: Single-AZ RDS does not provide automatic failover. If the Availability Zone fails, the database becomes unavailable until restored from a snapshot, which does not meet the high-availability requirement. It also offers fewer read replicas (up to 5) compared to Aurora's 15.
- Why D is wrong: DynamoDB is a NoSQL key-value/document database. Migrating a 500 GB relational MySQL database with complex joins and foreign key relationships to a single-table DynamoDB design would require a complete application rewrite and loss of relational query capabilities.
Question 24
An e-commerce company tracks order completion rate and cart abandonment as key performance indicators. The operations team must receive alerts whenever the order completion rate drops below 85%. These business-specific metrics are not available in default CloudWatch metrics. What approach should the solutions architect recommend?
- Enable detailed monitoring on all EC2 instances to capture order completion metrics
- Publish custom metrics using the CloudWatch PutMetricData API and create CloudWatch alarms with threshold conditions — Correct answer
- Use AWS X-Ray to trace order processing transactions and set latency alerts
- Configure AWS CloudTrail to log order-related API calls and trigger notifications
Explanation:
- The business needs application-specific KPI monitoring (order completion rate) with automated alerting — capabilities that are not available through default AWS metrics.
- Why B is correct: CloudWatch custom metrics allow publishing any application-specific data point via the PutMetricData API. Combined with CloudWatch alarms, the team can set thresholds (e.g., order completion < 85%) and receive SNS notifications. This is the purpose-built approach for monitoring business KPIs.
- Why A is wrong: Detailed monitoring increases EC2 metric frequency from 5-minute to 1-minute intervals but only provides infrastructure metrics (CPU, network, disk). It does not add application-level business metrics like order completion rate.
- Why C is wrong: X-Ray provides distributed tracing to analyze request latency and errors across service boundaries. It is designed for diagnosing performance issues in request paths, not for continuous KPI monitoring and threshold-based alerting.
- Why D is wrong: CloudTrail logs AWS API calls (e.g., PutItem, CreateOrder API calls) for auditing and security analysis. It does not compute business metrics or provide threshold-based alerting capabilities.
Question 25
A security team noticed unusual outbound traffic spikes from several EC2 instances. They suspect cryptocurrency mining or compromised instances but have no continuous monitoring in place. The team needs a solution that detects compromised instances, unauthorized API calls, and malicious activity across all AWS accounts without installing agents. Which solution meets these requirements?
- Enable VPC Flow Logs and create CloudWatch alarms to alert when outbound traffic exceeds defined byte thresholds
- Deploy third-party intrusion detection software on each EC2 instance to monitor for malicious processes and network connections
- Enable Amazon GuardDuty to continuously analyze VPC Flow Logs, CloudTrail events, and DNS logs for threats using machine learning — Correct answer
- Configure AWS Config rules to evaluate EC2 instance security group configurations and flag overly permissive inbound rules
Explanation:
- Why correct: Amazon GuardDuty uses machine learning to analyze VPC Flow Logs, AWS CloudTrail management and data events, and DNS query logs. It detects threats such as cryptocurrency mining (CryptoCurrency:EC2/BitcoinTool.B), compromised instances communicating with command-and-control servers, and unauthorized API calls — all without requiring agents or custom rules.
- Why A is wrong: VPC Flow Logs with CloudWatch alarms can detect traffic volume anomalies, but they cannot identify the type of threat. A spike in outbound traffic could be legitimate. Flow Logs alone lack the intelligence to distinguish cryptocurrency mining from normal workloads.
- Why B is wrong: Host-based IDS requires installation and maintenance on every instance, doesn't analyze CloudTrail API activity or DNS logs, and cannot detect account-level threats like unauthorized API calls from compromised credentials.
- Why D is wrong: AWS Config evaluates resource configuration compliance (such as whether security groups are too permissive), but it does not perform runtime threat detection. It cannot identify active threats like cryptocurrency mining or data exfiltration.
Question 26
A media company stores video assets in Amazon S3 and runs a rendering application on premises that requires NFS access to these assets. The company wants to minimize latency for frequently accessed files while keeping S3 as the primary storage. What should the Solutions Architect recommend?
- Use Amazon S3 File Gateway to present S3 objects as an NFS mount with local caching — Correct answer
- Mount Amazon EFS directly from the on-premises rendering servers over AWS Direct Connect
- Use AWS DataSync to continuously replicate the S3 data to an on-premises NAS
- Replace the rendering application's NFS integration with direct S3 API calls using the AWS SDK
Explanation:
- Amazon S3 File Gateway provides an NFS/SMB interface that maps directly to S3 objects. It maintains a local cache of frequently accessed data on premises, giving the rendering servers low-latency NFS access while storing the canonical data in S3. This avoids any application changes.
- Why A is correct: File Gateway provides a transparent NFS mount backed by S3 with a local cache for low-latency access to hot data — no application modifications needed.
- Why B is wrong: Amazon EFS can be mounted over Direct Connect, but the requirement specifies the data must be stored in S3 for durability and cost. EFS is a separate storage service with its own pricing model.
- Why C is wrong: DataSync is designed for scheduled or one-time data transfers, not for providing a persistent NFS mount point that applications can read and write to in real time.
- Why D is wrong: Replacing the NFS integration with S3 API calls requires significant application refactoring, which violates the goal of minimizing changes to the existing rendering workflow.
Question 27
A startup is evaluating AWS Amplify for a new consumer-facing web application. The team needs managed backend services for user sign-up and data storage, plus automated deployments from their GitHub repository. Which TWO Amplify capabilities directly address these requirements? (Select TWO.)
- Amplify Backend to provision authentication, APIs, and database resources through a code-first approach — Correct answer
- Amplify Hosting to deploy and host the web application with Git-based CI/CD pipelines — Correct answer
- Amazon CloudFront to distribute the application's static assets from edge locations globally
- Amazon API Gateway to expose a REST API for the application's data layer
- AWS CodePipeline to create a continuous delivery pipeline from the GitHub repository
- Amazon Cognito configured manually to handle user sign-up and authentication flows
Explanation:
- Why A is correct: Amplify Backend provides code-first provisioning of authentication (Cognito), APIs (AppSync or API Gateway), and data (DynamoDB) — directly addressing the managed backend services requirement without manual resource configuration.
- Why B is correct: Amplify Hosting connects to a Git repository, runs builds on each commit, and deploys to a global CDN — directly addressing the automated deployment from GitHub requirement.
- Why C is wrong: CloudFront is an infrastructure-level CDN service. While Amplify Hosting uses CloudFront under the hood, selecting CloudFront alone does not provide CI/CD from GitHub or managed backend provisioning. It is not an Amplify capability.
- Why D is wrong: API Gateway is a standalone service for building APIs. While Amplify Backend may provision an API Gateway behind the scenes, selecting API Gateway directly does not provide the code-first backend provisioning or integrated developer experience the team needs.
- Why E is wrong: CodePipeline is a general-purpose CI/CD orchestration service, but Amplify Hosting already includes built-in Git-based CI/CD. Using CodePipeline separately adds unnecessary complexity and does not address the backend services requirement.
- Why F is wrong: Manually configuring Cognito provides authentication, but the team wants managed backend services provisioned from code. Amplify Backend handles Cognito setup automatically, reducing operational effort.
Question 28
An e-commerce company receives thousands of product reviews daily. The product team wants to automatically categorize each review's sentiment (positive, negative, neutral, mixed) and route negative reviews to the customer support team for follow-up. Which service should the Solutions Architect recommend?
- Amazon Translate to convert reviews into a standard format and analyze tone through translation confidence scores
- Amazon Kendra to index all reviews and use relevance ranking to identify negative sentiment
- Amazon Textract to extract review text from the website and flag reviews containing negative keywords
- Amazon Comprehend to detect sentiment and extract key phrases from each review — Correct answer
Explanation:
- Amazon Comprehend is a fully managed NLP service that provides pre-trained models for sentiment analysis, entity recognition, key phrase extraction, and language detection. It returns sentiment scores (positive, negative, neutral, mixed) with confidence levels, enabling automated routing of negative reviews without any ML expertise or custom model training.
- Why A is wrong: Amazon Translate is a neural machine translation service for converting text between languages. It does not analyze sentiment or tone — translation confidence scores reflect translation quality, not emotional content.
- Why B is wrong: Amazon Kendra is an intelligent enterprise search service. Its relevance ranking determines how well documents match a search query, not whether content is positive or negative. Kendra finds information — it does not classify sentiment.
- Why C is wrong: Amazon Textract extracts text, forms, and tables from scanned documents and images (OCR). Product reviews are already digital text on the website, so no text extraction is needed. Additionally, keyword matching is a brittle approach that misses sarcasm, context, and nuance that ML-based sentiment analysis handles.
Question 29
A company stores sensitive customer data including personally identifiable information (PII) in Amazon S3. A compliance audit requires that all data at rest be encrypted using keys that the company controls and can audit. The solution must minimize operational overhead. Which approach meets these requirements?
- Enable default encryption on the S3 bucket using SSE-S3 (Amazon S3 managed keys)
- Implement client-side encryption using application-managed keys before uploading to S3
- Create a customer managed AWS KMS key with a key policy restricting usage to authorized roles, and enable default S3 bucket encryption with SSE-KMS using that key — Correct answer
- Enable default encryption using SSE-S3 with S3 Bucket Keys enabled
Explanation:
- The application stores sensitive PII that is subject to compliance requirements mandating encryption key control. Option C is correct because a customer managed KMS key (CMK) gives the company full control over the encryption key — including key policies, rotation schedules, and the ability to audit key usage through CloudTrail. Enabling default encryption on the S3 bucket with SSE-KMS ensures every object is automatically encrypted at rest without requiring application-level changes.
- Why A is wrong: SSE-S3 uses Amazon-managed keys. The company cannot control the key policy, cannot audit individual key usage, and cannot restrict which principals can decrypt the data using key policies. This does not meet the compliance requirement to control and audit encryption keys.
- Why B is wrong: Client-side encryption with application-managed keys provides key control, but the company must build and maintain key management infrastructure — including secure storage, rotation, and availability of keys. This adds significant operational burden. SSE-KMS with a CMK achieves the same compliance goal with far less operational overhead because AWS manages the key infrastructure while the company retains policy control.
- Why D is wrong: SSE-S3 with S3 Bucket Keys is an optimization that reduces KMS API call costs when using SSE-KMS, but when used with SSE-S3 (Amazon-managed keys), the company still has no control over key policies or the ability to audit key usage. It does not satisfy the compliance requirement for customer-controlled encryption keys.
Question 30
A company runs daily backups of Amazon RDS databases and Amazon EBS volumes. Compliance requires retaining all backups for 7 years, but only the most recent 30 days of backups need to be quickly restorable. The current approach stores all backups in their original storage tier, and the monthly backup bill has grown to $15,000. Which strategy reduces backup costs while meeting the compliance requirement?
- Write Lambda functions to create daily snapshots of each resource and copy them to an S3 bucket with a Glacier lifecycle rule
- Use AWS Backup with a backup plan that applies lifecycle rules to transition backups to cold storage after 30 days, sets a 7-year retention policy, and enables incremental backups — Correct answer
- Enable RDS automated backups with a 35-day retention period and rely on EBS snapshot retention defaults for long-term storage
- Create daily manual snapshots and immediately copy them to S3 Glacier Deep Archive for lowest cost
Explanation:
- Why correct: AWS Backup provides a centralized, policy-driven backup solution that supports RDS and EBS. Lifecycle rules automatically transition backups to cold storage (Glacier) after 30 days, reducing long-term storage costs by up to 80 percent. A 7-year retention policy satisfies the compliance requirement. Incremental backups capture only changed blocks, minimizing storage consumed per backup.
- Why A is wrong: Writing custom Lambda functions to copy snapshots to S3 introduces operational overhead for scheduling, error handling, and cross-service orchestration. AWS Backup handles all of this natively with built-in lifecycle management.
- Why C is wrong: RDS automated backups have a maximum retention period of 35 days, which does not satisfy the 7-year compliance requirement. Manual snapshots persist indefinitely but require manual lifecycle management.
- Why D is wrong: Copying every snapshot to S3 Glacier manually requires converting snapshots to a portable format and managing the lifecycle outside of AWS Backup. This adds complexity and the snapshots would not be directly restorable without additional tooling.
JavaScript is required to use this application.
Please enable JavaScript in your browser to access the full NestedCerts platform.
Contact: support@nestedcerts.com