Free AWS Certified Solutions Architect - Associate (SAA-C03) Sample Questions

Correct answer: C — Security groups are stateful, while NACLs are stateless.

• A. Incorrect. This statement reverses the operational levels. Security groups act as a firewall for associated EC2 instances and operate at the instance (or more specifically, the Elastic Network Interface - ENI) level. Network ACLs (NACLs) act as a firewall for a subnet, controlling traffic in and out of one or more subnets.
• B. Incorrect. This statement reverses the statefulness of the two components. Security groups are stateful, and NACLs are stateless.
• C. Correct. This is a fundamental difference. Security groups are stateful, meaning if you allow inbound traffic on a certain port, the corresponding outbound return traffic is automatically allowed, regardless of any outbound rules. Network ACLs are stateless, meaning you must explicitly define rules for both inbound and outbound traffic; return traffic must be explicitly allowed by an outbound rule.
• D. Incorrect. This statement reverses the rule types. Security groups only support 'allow' rules. By default, all traffic is denied, and you cannot create explicit 'deny' rules. In contrast, Network ACLs support both 'allow' and 'deny' rules, which are evaluated in numerical order.

Correct answers: B, C — Place frontend resources that require direct internet access, like web servers, in public subnets.; Place backend resources, like databases and application servers, in private subnets.

• A. Incorrect. This is a significant security anti-pattern. Placing sensitive resources like databases in public subnets exposes them directly to the internet, creating a large attack surface and violating the principle of least privilege.
• B. Correct. This is a core principle of the multi-tier architecture in a VPC. Public subnets are designed for internet-facing resources, such as web servers or load balancers, that need to accept incoming traffic directly from the internet via an Internet Gateway.
• C. Correct. This is a fundamental security best practice. Backend resources, which often contain sensitive data or business logic, should be isolated from direct internet access by placing them in private subnets. This minimizes their exposure to external threats and allows access to be tightly controlled from within the VPC.
• D. Incorrect. Using a single, large subnet is the opposite of network segmentation. Proper security design involves dividing the network into smaller, isolated subnets to control traffic flow, enforce security policies at boundaries, and contain the impact of a potential security breach.
• E. Incorrect. A subnet with a direct route to an Internet Gateway is, by definition, a public subnet. The purpose of a private subnet is specifically to *not* have a direct route to the internet. Outbound internet access from a private subnet should be routed through a NAT Gateway located in a public subnet.

Correct answer: B — To create and manage cryptographic keys and control their use across a wide range of AWS services.

• A. Incorrect. This describes the function of AWS Certificate Manager (ACM), which is responsible for provisioning, managing, and deploying public and private SSL/TLS certificates for use with AWS services.
• B. Correct. This is the core function of AWS KMS. It is a managed service that makes it easy to create and control cryptographic keys and their usage. KMS is deeply integrated with other AWS services to simplify data encryption.
• C. Incorrect. This describes AWS Secrets Manager, a service for managing and rotating secrets like database credentials and API keys. While Secrets Manager uses AWS KMS to encrypt the secrets it stores, its primary function is secret management, not key management.
• D. Incorrect. This describes AWS CloudHSM, which provides dedicated, single-tenant Hardware Security Modules (HSMs) in the cloud. Although AWS KMS uses FIPS 140-2 validated HSMs to protect your keys, its primary service function is centralized key management, not providing dedicated HSM hardware to customers.

Correct answer: B — Enable automated backups and set the backup retention period to 14 days.

• A. Incorrect. A Multi-AZ deployment is a high-availability feature that creates a synchronous standby replica in a different Availability Zone for automatic failover. It enhances database availability and durability but does not provide the historical transaction logs needed for point-in-time recovery (PITR).
• B. Correct. Amazon RDS Point-in-Time Recovery (PITR) is enabled by automated backups. This feature combines daily full snapshots with the continuous backup of transaction logs. By setting the backup retention period to 14 days, you can restore the database to any specific second within that window, which meets the business requirement.
• C. Incorrect. Manually creating snapshots every minute is operationally impractical, cost-prohibitive due to storage, and would likely cause significant performance degradation on the database. Automated backups are the correct, managed service feature for this use case.
• D. Incorrect. Read replicas are used for scaling read-heavy workloads and can be part of a disaster recovery strategy. They are not designed for granular point-in-time recovery. While a replica could be promoted, it would only reflect a single point in time, not any arbitrary point within a 14-day window.

Correct answer: B — To create and provide trusted users with temporary security credentials that can control access to AWS resources.

• A. Incorrect. AWS STS does not store or rotate long-term IAM user credentials. Its primary purpose is to issue temporary credentials, not manage long-term ones, which is a function of AWS Identity and Access Management (IAM).
• B. Correct. The core function of AWS Security Token Service (STS) is to grant temporary, limited-privilege credentials for IAM users or for users that you authenticate (federated users). This enhances security by reducing the risks associated with long-term credentials.
• C. Incorrect. Analyzing AWS account activity for malicious behavior is the primary function of Amazon GuardDuty, which analyzes data from sources like AWS CloudTrail logs. This is not a function of AWS STS.
• D. Incorrect. Centrally managing single sign-on (SSO) is the function of AWS IAM Identity Center (formerly AWS SSO). While IAM Identity Center uses STS under the hood to vend temporary credentials, STS itself is not the management service for SSO.

Correct answer: C — Attach an IAM role to the EC2 instances and configure the RDS database to use IAM database authentication.

• A. This is a secure method for managing secrets and is a significant improvement over hardcoding or using plain text files. However, it is not the MOST secure method because the application still retrieves and handles a static, long-lived password. This password could potentially be exposed in application memory or logs and requires a rotation strategy.
• B. Incorrect. Hardcoding credentials in source code is a major security anti-pattern. It exposes sensitive information to anyone with access to the code repository and makes credential rotation extremely difficult, as it requires code changes and redeployments.
• C. Correct. This is the MOST secure method because it completely eliminates the need to manage static database passwords. The application uses its assigned IAM role to request a short-lived authentication token from RDS, which is then used to log in. This approach centralizes access control in IAM, removes the burden of password rotation, and enhances security by using temporary, automatically generated credentials.
• D. Incorrect. Storing credentials in a plain text file on an EC2 instance is highly insecure. If the instance is compromised, an attacker can easily read the file and gain access to the database. This method lacks encryption and proper access control for the credentials.

Correct answer: C — Create a new IAM group, attach a single IAM policy with the required permissions to the group, and add all five IAM users to the group.

• A. Incorrect. While functional, attaching the same policy directly to each individual user is not efficient or scalable. It increases administrative overhead because any future permission changes would require modifying the attachments for every single user, which is error-prone and unmanageable as the team grows.
• B. Incorrect. IAM roles are primarily intended for granting temporary permissions to AWS services, users from another AWS account, or federated users. While an IAM user can assume a role, it adds an unnecessary layer of operational complexity for this use case. IAM groups are the more direct and appropriate solution for managing permissions for a set of users within the same account.
• C. Correct. This is the AWS best practice for managing permissions for multiple users with similar job functions. By creating an IAM group, attaching a single policy, and adding users to that group, you centralize permission management. This makes the process highly efficient and scalable; permissions can be updated in one place, and access is managed simply by adding or removing users from the group.
• D. Incorrect. This is the least efficient and most unmanageable approach. Creating multiple copies of the same policy leads to 'policy sprawl' and a significant maintenance nightmare. If a permission needs to be updated, it would have to be changed in all five separate policies, which is highly inefficient and likely to lead to inconsistencies.

Correct answers: A, D — Amazon Elastic Container Registry (Amazon ECR); Amazon Elastic Container Service (Amazon ECS)

• A. Correct. Amazon Elastic Container Registry (Amazon ECR) is a fully managed Docker container registry service. It allows developers to securely store, manage, and deploy Docker container images. It integrates with other AWS services like Amazon ECS and AWS IAM, directly fulfilling the requirement for a private and secure image registry.
• B. Incorrect. AWS CodeCommit is a managed source control service that hosts secure Git-based repositories. It is used for storing application source code, not for storing container images or orchestrating container deployments.
• C. Incorrect. Amazon S3 is an object storage service. While a container image could technically be stored as a file in an S3 bucket, S3 is not a Docker registry. It lacks the specific functionalities of a registry, such as native integration with the Docker CLI for `push` and `pull` operations, image versioning, and lifecycle management that are provided by a purpose-built service like ECR.
• D. Correct. Amazon Elastic Container Service (Amazon ECS) is a fully managed container orchestration service that simplifies deploying, managing, and scaling containerized applications. It allows users to define application requirements using Task Definitions and manage the desired state of the application using Services, directly meeting the requirement for a managed orchestration service.
• E. Incorrect. AWS Lambda is a serverless, event-driven compute service. Although Lambda functions can be packaged as container images, Lambda itself is not a container orchestration service designed for managing clusters of long-running microservices like ECS is. It also does not provide a registry to store images.

Correct answer: C — AWS Fargate

• A. Incorrect. AWS Lambda is a serverless compute service, but it has a maximum execution timeout of 15 minutes. This is insufficient for the 45-minute batch job, making Lambda unsuitable for this use case.
• B. Incorrect. While AWS Batch is designed for batch computing, using it with an EC2 compute environment requires managing an underlying cluster of EC2 instances. This directly contradicts the requirement for a serverless option where the company wants to avoid instance management.
• C. Correct. AWS Fargate is a serverless compute engine for containers that works with both Amazon ECS and Amazon EKS. It allows you to run containers without managing the underlying servers or clusters. It is the most suitable choice as it meets the serverless requirement and can easily handle long-running containerized tasks like this 45-minute batch job.
• D. Incorrect. Amazon EC2 Spot Instances are a cost-effective option for compute capacity, but they are not a serverless solution. This option still requires the management of EC2 instances and does not meet the core requirement of the question. Furthermore, Spot Instances can be interrupted, which may not be ideal for a critical end-of-day report.

Correct answers: C, D — RDS Cross-Region Read Replicas; RDS Cross-Region Automated Backups

• A. Incorrect. RDS Multi-AZ deployment provides high availability and automatic failover by maintaining a synchronous standby replica in a different Availability Zone within the *same* AWS Region. It is designed to protect against failures of a single Availability Zone, not a full regional outage, and thus is not a cross-region DR solution.
• B. Incorrect. RDS Storage Auto Scaling is a feature that automatically manages storage capacity by increasing it when needed to prevent running out of space. It does not create copies of the database or replicate data to another region for disaster recovery.
• C. Correct. RDS Cross-Region Read Replicas create a live, asynchronously replicated, read-only copy of the primary database in a different AWS Region. In the event of a regional disaster, the read replica can be promoted to a standalone, writable database instance. This approach provides a low Recovery Point Objective (RPO) and Recovery Time Objective (RTO).
• D. Correct. RDS Cross-Region Automated Backups is a feature that automatically copies system snapshots and transaction logs to a secondary AWS Region. If the primary region becomes unavailable, the database can be restored from the latest backup in the secondary region. This is a valid DR strategy, although it typically has a higher RPO and RTO compared to using a read replica.
• E. Incorrect. RDS Performance Insights is an advanced database performance monitoring and tuning feature. It helps diagnose and resolve performance bottlenecks but plays no role in data replication, backups, or disaster recovery.

Correct answer: B — Deploy the EC2 instances in an Auto Scaling group across multiple Availability Zones, with an Application Load Balancer, and use an Amazon RDS Multi-AZ database.

• A. Deploying all resources in a single Availability Zone creates a single point of failure. If that Availability Zone experiences an outage, the entire application, including the web servers and the database, will become unavailable. This design does not meet the high availability requirement.
• B. This is the ideal architecture for high availability within a single AWS Region. An Application Load Balancer distributes traffic across multiple Availability Zones. The Auto Scaling group ensures the application has a desired number of EC2 instances running across these zones, automatically replacing failed instances. An Amazon RDS Multi-AZ deployment maintains a synchronous standby replica in a different AZ, providing automatic failover. This comprehensive design ensures both the web and database tiers can withstand a single data center (Availability Zone) failure.
• C. AWS Backup provides a solution for data durability and disaster recovery, not high availability. Daily snapshots allow for restoring data after a failure, but this process involves downtime and does not prevent the application from becoming unavailable when an Availability Zone fails.
• D. Deploying across multiple AWS Regions is a disaster recovery strategy to handle the failure of an entire region, which is more than what is required. This approach is significantly more complex and costly, requiring cross-region data replication and advanced routing. For surviving a single data center failure, a multi-AZ architecture within a single region is the most effective and cost-efficient solution.

Correct answer: D — Amazon RDS Proxy

• A. Incorrect. Amazon API Gateway acts as a front door for applications to access backend services like Lambda. It is used to create, publish, and secure APIs but does not manage or pool database connections between a service and a database.
• B. Incorrect. Amazon SQS is a message queuing service used to decouple application components. While it can help buffer requests and manage the rate of Lambda invocations, it does not provide database connection pooling.
• C. Incorrect. An Application Load Balancer (ALB) distributes incoming HTTP/S traffic across multiple targets, such as EC2 instances or Lambda functions. It operates at the application layer but does not manage database connections.
• D. Correct. Amazon RDS Proxy is a fully managed, highly available database proxy specifically designed for this use case. It sits between the application (Lambda) and the RDS database to pool and share established database connections. This is crucial for serverless applications like Lambda, which can open many concurrent, short-lived connections, as it prevents the database from becoming overwhelmed and improves application scalability and fault tolerance.

Correct answer: C — Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ enabled.

• A. This solution is incorrect because a single EC2 instance represents a single point of failure, which directly contradicts the requirement for high availability and resilience. Furthermore, instance store is ephemeral storage, meaning all cached data would be lost if the instance stops, fails, or is terminated.
• B. This solution is incorrect because Amazon S3 is an object storage service, not an in-memory cache. While S3 is highly available and durable, its latency is significantly higher than that of a dedicated caching service and is not suitable for the sub-millisecond performance needed for an application caching layer.
• C. This is the correct solution. Amazon ElastiCache for Redis is a fully managed, in-memory caching service designed for high performance. Enabling the Multi-AZ feature provides high availability and fault tolerance by automatically replicating the cache data to one or more standby replica nodes in different Availability Zones and managing automatic failover in the event of a primary node failure.
• D. This solution is incorrect because browser local storage is a client-side caching mechanism. It is specific to each user's browser and cannot be used as a centralized, shared caching layer to reduce the load on the backend database for all users of the application. It does not address the server-side high availability requirement.

Correct answer: A — It uses a log-structured, shared storage volume that is replicated across three Availability Zones.

• A. Correct. The core architectural innovation of Amazon Aurora is its distributed, log-structured storage subsystem. This shared storage volume is decoupled from the compute instances and is replicated six ways across three Availability Zones for extreme durability and availability. This separation of storage and compute is what allows for features like fast failovers, near-instantaneous crash recovery, and independent scaling of compute and storage.
• B. Incorrect. This statement describes the behavior of standard Amazon RDS. A key benefit of Aurora's architecture is that storage scales automatically. The storage volume grows in 10 GB increments as needed, up to 128 TiB, without requiring manual intervention to provision capacity or IOPS.
• C. Incorrect. Amazon Aurora is designed from the ground up for high availability and is inherently a multi-AZ service. Its storage volume is always replicated across three Availability Zones, and a cluster can have compute instances (a primary writer and multiple read replicas) distributed across those zones.
• D. Incorrect. While Amazon Aurora was initially launched with MySQL compatibility, it now also offers a PostgreSQL-compatible edition. Therefore, it does not exclusively use the MySQL database engine.

Correct answer: C — Provisioned IOPS SSD (io2 Block Express)

• A. Incorrect. Magnetic (standard) storage is a legacy, HDD-based option offering the lowest performance. It is designed for workloads with infrequent data access and is not suitable for any performance-sensitive application, especially a write-intensive OLTP database.
• B. Incorrect. General Purpose SSD (gp3) provides a good balance of price and performance for a wide variety of transactional workloads. However, for a mission-critical, high-performance, and write-intensive OLTP application, a storage type with higher, more consistent IOPS is a better choice.
• C. Correct. Provisioned IOPS SSD (io2 Block Express) is the highest-performance block storage for Amazon RDS. It is specifically designed for I/O-intensive and mission-critical workloads like write-heavy OLTP databases that require sustained high IOPS performance and low latency. This makes it the ideal choice to handle a high volume of write operations.
• D. Incorrect. Throughput Optimized HDD (st1) is a low-cost HDD option designed for large, sequential workloads where throughput (MB/s) is the key performance metric, such as data warehousing or log processing. It is not suitable for the small, random I/O patterns typical of OLTP applications, which require high IOPS.

Correct answers: B, C — A heterogeneous migration involves changing the database engine, requiring schema conversion.; A homogeneous migration is migrating from an on-premises MySQL database to Amazon RDS for MySQL.

• A. This statement is incorrect. A migration between different database engines, such as from Oracle to PostgreSQL, is defined as a heterogeneous migration. A homogeneous migration involves using the same database engine for both the source and the target.
• B. This statement is correct. A heterogeneous migration involves changing the database engine. Because the underlying schema structures, data types, and database code (e.g., stored procedures) are often incompatible between different engines, a schema conversion process is a necessary step.
• C. This statement is correct. A homogeneous migration occurs when the source and target database engines are the same or compatible. Migrating from an on-premises MySQL instance to Amazon RDS for MySQL is a classic example of a homogeneous migration, as the schema and data are directly compatible.
• D. This statement is incorrect. While AWS Database Migration Service (DMS) is used to migrate the actual data, a heterogeneous migration also typically requires the AWS Schema Conversion Tool (SCT). SCT is used to convert the source database schema and code objects (like views and stored procedures) to a format compatible with the target database engine. Therefore, DMS alone is usually insufficient.
• E. This statement is incorrect. Database migrations to the cloud can be either homogeneous or heterogeneous. If the migration is between the same database engines (e.g., on-premises PostgreSQL to Amazon RDS for PostgreSQL), it is classified as a homogeneous migration.

Correct answer: C — AWS Lake Formation

• A. Incorrect. AWS Identity and Access Management (IAM) is used to manage access to AWS services and resources at a broad level, such as controlling access to entire S3 buckets or objects. It does not natively provide the fine-grained, data-level controls like column-level and row-level security required for the data lake use case described.
• B. Incorrect. Amazon Macie is a data security and privacy service that uses machine learning to discover, classify, and protect sensitive data within S3. While it is important for data lake security, its function is discovery and alerting, not enforcing fine-grained access control policies.
• C. Correct. AWS Lake Formation is a managed service designed specifically to build, secure, and manage data lakes. A core capability of Lake Formation is providing a centralized location to define and enforce fine-grained access control policies for data in Amazon S3. This includes permissions at the database, table, column, and row level, which directly addresses the requirement to restrict access for different teams.
• D. Incorrect. Amazon S3 Access Points simplify managing data access at scale for shared datasets in S3 by creating unique hostnames with distinct permissions for a bucket. However, the permissions are still based on S3 and IAM policies, which do not provide the granular, in-data controls at the row and column level.

Correct answer: C — Launch a transient EMR cluster for the job and configure it to terminate automatically upon completion.

• A. This approach is not cost-effective. A persistent cluster is designed for long-running workloads. For a job that runs only 3 hours a day, keeping a cluster persistent, even with On-Demand instances, leads to unnecessary costs outside the processing window. Furthermore, EMR clusters are terminated, not stopped like EC2 instances, making this concept flawed.
• B. This is incorrect because Reserved Instances provide savings for continuous, long-running workloads (e.g., 24/7). Committing to a Reserved Instance for a cluster that is only used for 3 hours daily would be highly cost-inefficient, as you would pay for 21 hours of unused capacity every day.
• C. This is the most cost-effective and recommended approach for periodic batch workloads. A transient EMR cluster is designed to be launched just for the duration of a job and then terminated. By configuring it to terminate automatically upon completion, the company ensures it only pays for the compute resources precisely when they are needed, directly minimizing costs.
• D. This is incorrect because processing 'large datasets' requires the distributed computing power of worker nodes (core and task nodes). Using only a master node would be severely underpowered, leading to extremely long processing times or job failure. This would not be a performant or cost-effective solution.

Correct answer: C — Amazon Kinesis Data Analytics

• A. Amazon Kinesis Data Firehose is a fully managed service for delivering real-time streaming data to destinations like Amazon S3, Amazon Redshift, or Amazon OpenSearch Service. It is primarily a data loading and delivery service and lacks the advanced processing capabilities required for complex aggregations over specific time windows, such as a 5-minute tumbling window.
• B. AWS Glue is a fully managed extract, transform, and load (ETL) service primarily designed for batch data processing. While AWS Glue does support streaming ETL jobs, it is not the optimal choice for low-latency, real-time analytics and complex windowed aggregations directly on a Kinesis Data Stream. It is better suited for larger, more complex ETL workflows rather than stateful stream processing.
• C. Amazon Kinesis Data Analytics is the purpose-built service for processing and analyzing streaming data in real time. It directly integrates with Amazon Kinesis Data Streams and allows you to run SQL queries or Apache Flink applications on the streaming data. It explicitly supports stateful computations like tumbling window aggregations, making it the perfect and most cost-effective solution for aggregating data over a defined 5-minute window.
• D. Amazon EMR is a managed cluster platform for running big data frameworks like Apache Spark and Hadoop. While it can process streaming data using Spark Streaming, it is typically used for large-scale batch or micro-batch processing. For this specific use case of a tumbling window aggregation on a Kinesis stream, EMR would be overly complex and less cost-effective than the purpose-built, serverless Kinesis Data Analytics service.

Correct answers: C, E — Amazon ECS with the AWS Fargate launch type; AWS Lambda with container image support

• A. Incorrect. The Amazon ECS EC2 launch type requires you to provision, manage, and scale a cluster of Amazon EC2 instances. This includes responsibility for patching the operating system and managing the capacity of the cluster, which directly contradicts the requirement to avoid managing underlying server infrastructure.
• B. Incorrect. While Amazon EKS with managed node groups automates some operational tasks like provisioning and lifecycle management of worker nodes, the customer is still responsible for the underlying EC2 instances. This includes tasks like updating the AMI and applying security patches to the node's operating system, which does not fully meet the requirement of avoiding server management.
• C. Correct. AWS Fargate is a serverless compute engine for containers that works with Amazon ECS. It allows you to run containers without having to manage servers or clusters. AWS handles all the infrastructure management, including provisioning, patching, and scaling the underlying compute resources, which perfectly aligns with the startup's requirements.
• D. Incorrect. This option represents the most manual approach. It requires the team to fully manage the EC2 instances, including installing and configuring Docker, patching the operating system, managing security, and implementing scaling mechanisms. This is the opposite of the stated requirement to avoid infrastructure management.
• E. Correct. AWS Lambda with container image support allows developers to package and deploy Lambda functions as container images. This provides a fully serverless compute environment where AWS manages the entire underlying infrastructure. The team can run their containerized microservices without worrying about servers, patching, or scaling, which is ideal for a team with limited operational experience.

Correct answer: C — Amazon CloudFront with Lambda@Edge

• A. Incorrect. Amazon S3 Transfer Acceleration uses the AWS edge network to speed up data transfers (uploads and downloads) to and from an S3 bucket. However, it is not a full-fledged Content Delivery Network (CDN) and does not provide a mechanism to execute custom logic at the edge.
• B. Incorrect. AWS Global Accelerator improves application availability and performance by using the AWS global network to route traffic to the optimal regional endpoint, such as an Application Load Balancer. It operates at the network and transport layers to optimize the path, but it does not cache content or execute custom compute logic at the edge.
• C. Correct. This is the ideal solution. Amazon CloudFront is a global CDN that caches content at edge locations close to users, which directly addresses the low-latency delivery requirement. Lambda@Edge is a feature of CloudFront that allows you to run custom code (like user authentication checks) at these edge locations in response to CloudFront events. This combination perfectly satisfies all the stated requirements.
• D. Incorrect. While deploying an EC2 fleet in multiple regions could reduce latency for users in those regions, it is a complex and costly solution to build and manage. It does not provide the extensive global presence, built-in caching, and seamless edge compute capabilities of a managed CDN service like CloudFront with Lambda@Edge.

Correct answer: C — S3 Intelligent-Tiering storage class.

• A. Incorrect. S3 Lifecycle policies automate the transition of objects between storage classes based on their age (time since creation or last modification), not on their access patterns. Since the access patterns are unpredictable, a time-based policy is not suitable for dynamically optimizing costs based on usage.
• B. Incorrect. S3 Cross-Region Replication (CRR) is a feature used to copy objects to a different AWS Region for disaster recovery, compliance, or to reduce latency for users in different geographic locations. It does not manage storage tiers to optimize costs based on access patterns.
• C. Correct. The S3 Intelligent-Tiering storage class is designed specifically for this use case. It automatically monitors access patterns and moves objects between a frequent access tier and an infrequent access tier to optimize storage costs. This provides cost savings for data with unknown or changing access patterns without any performance impact or operational overhead.
• D. Incorrect. S3 Standard-Infrequent Access (S3 Standard-IA) is a storage class, not an automated management feature. It is cost-effective for data that is infrequently accessed but requires rapid access when needed. However, you must explicitly place objects in this class. It does not automatically move objects based on changing access patterns.

Correct answer: C — Throughput Optimized HDD (st1)

• A. Incorrect. General Purpose SSD (gp3) volumes are designed to offer a balance of price and performance for a wide variety of transactional workloads. While they provide decent throughput, they are not the most cost-effective option for workloads that are primarily characterized by large, sequential operations, as HDD-based volumes offer a lower price per gigabyte for this use case.
• B. Incorrect. Provisioned IOPS SSD (io2) volumes are designed for critical, I/O-intensive database and transactional workloads that require high IOPS and low latency. Since the requirement is for high throughput, not IOPS, this is an expensive and inappropriate choice for this scenario.
• C. Correct. Throughput Optimized HDD (st1) volumes are specifically designed to provide low-cost magnetic storage for frequently accessed, throughput-intensive workloads with large datasets and large I/O sizes, such as data warehousing, big data processing, and log processing. Performance is measured in megabytes per second (throughput), making it the ideal and most cost-effective choice for this use case.
• D. Incorrect. Cold HDD (sc1) volumes provide the lowest-cost magnetic storage and are designed for less frequently accessed data. While cheap, they offer lower throughput compared to st1 volumes and are not suitable for performance-sensitive, frequently accessed workloads like the one described.

Correct answer: B — AWS Storage Gateway – Volume Gateway

• A. Incorrect. AWS Storage Gateway – File Gateway provides a file-level interface (NFS or SMB) for storing files as objects in Amazon S3. It is designed for file-based workloads and does not provide block-level storage or support the iSCSI protocol required to extend a SAN.
• B. Correct. AWS Storage Gateway – Volume Gateway is specifically designed for this use case. It presents cloud-backed storage volumes to on-premises applications as iSCSI block devices. This allows a company to extend its on-premises SAN to AWS, meeting the exact requirements of the question.
• C. Incorrect. Amazon FSx for Windows File Server is a fully managed file storage service, primarily accessed via the SMB protocol. It is a file-level solution, not a block-level storage service, and it does not support the iSCSI protocol for mounting volumes.
• D. Incorrect. Amazon S3 is an object storage service and does not natively support block-level access protocols like iSCSI. While AWS Direct Connect provides a dedicated network connection between on-premises and AWS, it does not change the fundamental nature of S3 as an object store, making it unsuitable for this SAN extension use case.

Correct answers: D, E — Network Load Balancer; AWS PrivateLink (via a VPC endpoint service)

• A. Incorrect. An Application Load Balancer (ALB) operates at the application layer (Layer 7) for HTTP/HTTPS traffic. While it can be part of the service architecture, it does not by itself provide the required private connectivity across different VPCs and accounts. The service that integrates directly with AWS PrivateLink for this purpose is a Network Load Balancer.
• B. Incorrect. VPC Peering connects two VPCs, but the requirement is to connect to hundreds of VPCs. Creating and managing a mesh of hundreds of peering connections would be extremely complex and unscalable, directly contradicting the requirement to avoid complex VPC peering.
• C. Incorrect. While AWS Transit Gateway simplifies VPC-to-VPC connectivity compared to VPC peering, it still requires management of routing tables within the Transit Gateway and the attached VPCs. The question explicitly asks to avoid managing complex routing tables, making AWS PrivateLink a more suitable solution for this specific service-exposure use case.
• D. Correct. A Network Load Balancer (NLB) is a mandatory prerequisite for exposing a service through AWS PrivateLink. The provider creates a VPC endpoint service and configures it to point to an NLB. The NLB then distributes the incoming private traffic from consumer VPCs to the backend service targets.
• E. Correct. AWS PrivateLink is the core service designed for this scenario. It allows a service provider to create a VPC endpoint service, which consumers in other VPCs (and other accounts) can connect to using an interface VPC endpoint. This provides secure, private, and unidirectional connectivity to the service without traversing the internet, and it completely abstracts away the need for VPC peering, Transit Gateway, or complex route table management for the consumers.

Correct answer: C — AWS Global Accelerator

• A. Incorrect. Amazon CloudFront is a Content Delivery Network (CDN) service optimized for caching and delivering static and dynamic web content. It primarily supports HTTP and HTTPS protocols and is not designed to handle custom TCP protocols.
• B. Incorrect. AWS Direct Connect provides a dedicated, private network connection from an on-premises environment to AWS. It is used for hybrid cloud connectivity and does not improve performance for global users accessing an application over the public internet.
• C. Correct. AWS Global Accelerator is designed specifically for this use case. It improves the performance and availability of applications for global users by using the AWS global network backbone. It routes user traffic to the nearest edge location and then over the optimized AWS network to the application endpoint. This significantly reduces latency and jitter for both TCP and UDP traffic, even when the application is hosted in a single region.
• D. Incorrect. Amazon Route 53 with latency-based routing directs users to the AWS region with the lowest latency. However, this is ineffective because the application is deployed in only a single region, leaving no alternative regions to route traffic to. Additionally, Route 53 only optimizes the initial DNS lookup, while the actual application traffic still travels over the public internet.

Correct answers: A, C — A Security Group for the web servers that allows all outbound traffic.; A Security Group for the database servers that allows inbound traffic on the database port sourcing from the web server's Security Group ID.

• A. Correct. For a web server to initiate a connection to a database server, its associated security group must have an outbound rule that permits the traffic. While allowing all outbound traffic (`0.0.0.0/0`) is a permissive rule, it is a valid configuration that enables the web server to send requests to the database. A more secure best practice would be to restrict this outbound rule to the database's security group and port, but this option correctly identifies a necessary component for initiating the connection.
• B. Incorrect. Network ACLs are stateless, meaning return traffic must be explicitly allowed. Denying all outbound traffic from the private subnet would block legitimate response traffic, such as for software updates via a NAT Gateway in the public subnet. This would break necessary connectivity and is not a recommended practice for this use case, as confirmed by AWS documentation.
• C. Correct. This is a security best practice that implements the principle of least privilege. By referencing the web server's security group ID as the source, you ensure that only instances in that group can connect to the database on its specific port. Because security groups are stateful, return traffic to the web servers for these established connections is automatically allowed, while new connections initiated from the database to the web servers would be blocked by the web server security group's default-deny inbound policy.
• D. Incorrect. AWS route tables do not support explicit 'deny' rules. Route tables are used to direct traffic from a subnet to a destination, such as an internet gateway or NAT gateway. Traffic control and filtering are the responsibility of security groups and network ACLs.
• E. Incorrect. AWS WAF is a web application firewall that operates at the application layer (Layer 7). It is used to protect web applications from common exploits like SQL injection. It does not control network traffic at the IP and port level (Layer 3/4) between EC2 instances in different subnets.

Correct answers: A, D — An Elastic IP address; Association of the IP at the instance level

• A. Correct. An Elastic IP address (EIP) is a static, public IPv4 address designed for dynamic cloud computing. It can be allocated to your AWS account and then associated with an EC2 instance. This association persists even when the instance is stopped and restarted, ensuring the instance always has the same public IP address.
• B. Incorrect. A DNS CNAME record in Amazon Route 53 is used to map an alias domain name to another canonical domain name, not directly to an IP address. While using a DNS name is a best practice, the CNAME record itself does not provide a static IP.
• C. Incorrect. An EC2 instance's default public IP address is dynamic and ephemeral. It is assigned to the instance at launch and released when the instance is stopped. A new, different public IP will be assigned upon restart.
• D. Correct. The association of an Elastic IP with an EC2 instance is the crucial mechanism that connects the static IP to the compute resource. The EIP is the resource, and its association with the instance is the feature that allows it to persist through stop/start cycles. These two work together to solve the requirement.
• E. Incorrect. An Application Load Balancer (ALB) does not have a static IP address. It provides a static DNS name, but the underlying IP addresses it resolves to are dynamic and can change. Only a Network Load Balancer or a Global Accelerator can provide static IP addresses as an entry point for a load balancer.

Correct answer: B — It allows the combined usage from all accounts to qualify for volume pricing tiers.

• A. This is incorrect. AWS consolidated billing does not apply a flat discount. Cost savings are realized by aggregating usage to benefit from volume-based tiered pricing, not through a fixed-rate discount.
• B. This is the correct answer. The primary cost optimization benefit of consolidated billing is that AWS combines the usage from all accounts within an organization. This aggregated usage allows the organization to reach higher volume pricing tiers for services like Amazon S3 and data transfer more quickly, resulting in a lower overall cost than if each account were billed separately.
• C. This is incorrect. While a major benefit of AWS Organizations is sharing the discounts from Savings Plans and Reserved Instances across member accounts, the service does not automatically purchase them. An administrator must explicitly purchase these commitments in the management or a designated member account.
• D. This is incorrect. Consolidated billing generates a single, unified invoice for the entire organization under the management account, which is the opposite of providing separate invoices. For departmental chargebacks, organizations should use other AWS tools like cost allocation tags and AWS Cost Explorer to analyze and report on costs.

Correct answer: C — Use provisioned capacity mode with DynamoDB Auto Scaling.

• A. On-demand capacity mode is ideal for unpredictable or spiky workloads where traffic is difficult to forecast. While it simplifies capacity management, it generally has a higher per-request cost than provisioned capacity. For a workload with a known, cyclical pattern, it is not the most cost-effective option.
• B. Over-provisioning capacity to handle the highest peak at all times is not a cost-effective strategy. This approach leads to significant waste, as you would be paying for unused capacity during off-peak hours, which constitute the majority of the time.
• C. This is the most cost-effective solution for this scenario. Provisioned capacity mode combined with DynamoDB Auto Scaling allows the table's capacity to automatically scale up to meet demand during peak evening hours and scale down during periods of low traffic. This ensures performance when needed while minimizing costs by aligning provisioned capacity with actual usage.
• D. While it is technically possible to create a custom scaling solution using AWS Lambda, this approach introduces unnecessary complexity, operational overhead, and risk of misconfiguration. DynamoDB Auto Scaling is the native, managed, and recommended solution that is simpler, more reliable, and purpose-built for this task.

Correct answer: B — It has zero charges for read and write I/O operations.

• A. This is incorrect. The Aurora I/O-Optimized configuration actually has higher pricing for database instances and storage compared to the standard configuration. The cost-saving benefit comes from eliminating the variable I/O charges, not from a lower storage price.
• B. This is correct. The primary benefit of Aurora I/O-Optimized is providing predictable costs for I/O-intensive applications. It achieves this by having zero charges for read and write I/O operations. While instance and storage costs are higher, for workloads where I/O costs are a significant portion of the total bill (typically over 25%), this model results in significant overall cost savings.
• C. This is incorrect. Amazon Aurora is a fully managed database service that runs on its own dedicated, highly available infrastructure. It does not use EC2 Spot Instances, which are designed for stateless, fault-tolerant, and interruptible workloads and are unsuitable for a stateful relational database cluster.
• D. This is incorrect. The need for Read Replicas is determined by the application's read throughput requirements, allowing you to scale read operations horizontally. The I/O-Optimized configuration addresses the cost model and performance of the storage layer. These are independent concepts; an I/O-intensive application might still require Read Replicas to scale its read capacity, regardless of which I/O configuration is used.

Correct answer: C — AWS Cost and Usage Report (AWS CUR)

• A. Incorrect. AWS Cost Explorer is a tool that provides pre-built reports and visualizations to explore AWS costs and usage. While useful for high-level analysis, it does not provide the most granular, resource-level data required for deep custom analysis with external BI tools and complex SQL queries.
• B. Incorrect. AWS Budgets is a tool for setting cost and usage thresholds and receiving alerts when those thresholds are breached or are forecasted to be breached. It is a proactive cost control mechanism, not a data source for detailed historical analysis and reporting.
• C. Correct. The AWS Cost and Usage Report (AWS CUR) is the most comprehensive and granular source of AWS cost and usage data. It delivers detailed data files (e.g., hourly, resource-level) to an Amazon S3 bucket. This raw data can then be ingested by business intelligence (BI) tools or queried directly using services like Amazon Athena with standard SQL, which perfectly matches the requirements.
• D. Incorrect. Cost Allocation Tags are metadata labels applied to AWS resources to categorize and track costs. They enrich the data provided by tools like AWS CUR and Cost Explorer but do not provide the cost and usage data themselves. They are a way to organize data, not a data source.

Correct answer: C — S3 Intelligent-Tiering

• A. Incorrect. S3 Standard is designed for frequently accessed data and provides high performance but is not the most cost-effective option for data that becomes infrequently accessed. It does not automatically transition objects to a lower-cost tier, failing the requirement for automatic cost optimization for changing access patterns.
• B. Incorrect. S3 Standard-Infrequent Access (Standard-IA) is cost-effective for infrequently accessed data but incurs retrieval fees. It does not automatically adjust to changing access patterns; moving data to or from this tier would require manual intervention or explicit lifecycle rules, which the company wants to avoid.
• C. Correct. S3 Intelligent-Tiering is specifically designed for data with unknown, changing, or unpredictable access patterns. It automatically optimizes storage costs by moving data between frequent and infrequent access tiers based on monitoring actual usage. This is achieved without performance impact for frequently accessed data and without the operational overhead of creating and managing complex lifecycle policies, perfectly matching all requirements.
• D. Incorrect. S3 One Zone-IA is for infrequently accessed data that does not require multi-Availability Zone resilience. Like Standard-IA, it does not automatically tier data based on access patterns. Furthermore, storing data in a single AZ introduces a risk of data loss if the AZ fails, which may not be acceptable.

Correct answer: C — Amazon CloudFront

• A. AWS Global Accelerator improves the performance and availability of applications by using the AWS global network to route user traffic to the optimal application endpoint. However, it does not cache content and is not designed for static content delivery. Therefore, it would not reduce data transfer out costs from S3 for a video streaming workload.
• B. Amazon S3 Transfer Acceleration speeds up long-distance file transfers to and from an S3 bucket by leveraging AWS edge locations. It is primarily for accelerating uploads and specific downloads, not for a one-to-many distribution model like media streaming. It does not reduce data transfer out costs; in fact, it has its own pricing model focused on speed.
• C. Amazon CloudFront is a Content Delivery Network (CDN) service that is ideal for this use case. It caches copies of the video files at edge locations around the world, closer to the users. This significantly improves video playback performance by reducing latency. It also drastically reduces costs, as data transfer from S3 to CloudFront is free, and subsequent user requests are served from the cache, minimizing data transfer out directly from the S3 bucket.
• D. An Application Load Balancer (ALB) operates at the application layer to distribute incoming traffic across multiple targets, such as EC2 instances. It is not designed to cache content or optimize the delivery of static files from S3. An ALB would not address the requirements of reducing data transfer costs or improving global playback performance.

Correct answers: A, B — Create a gateway VPC endpoint for Amazon S3.; Create a gateway VPC endpoint for Amazon DynamoDB.

• A. Correct. According to AWS documentation, a gateway VPC endpoint is the recommended and most cost-effective method for privately connecting to Amazon S3 from within a VPC. It allows traffic to flow between the VPC and S3 without passing through an internet gateway or NAT gateway, keeping the traffic on the AWS network. There are no additional charges for using gateway endpoints.
• B. Correct. Similar to S3, the recommended and most cost-effective approach for in-VPC access to Amazon DynamoDB is to use a gateway VPC endpoint. This ensures that API calls to DynamoDB from the EC2 instances are routed through the AWS private network, enhancing security and performance. Gateway endpoints for DynamoDB are also free of charge.
• C. Incorrect. While Amazon DynamoDB does support interface VPC endpoints (AWS PrivateLink), the officially recommended and more cost-effective solution for in-VPC access is a gateway endpoint. Interface endpoints incur hourly and data processing costs and are typically used for accessing DynamoDB from on-premises networks or from peered VPCs in different regions.
• D. Incorrect. Attaching an Internet Gateway would enable traffic to flow to and from the public internet. This directly contradicts the requirement to keep traffic private and off the public internet.
• E. Incorrect. AWS Direct Connect is a service used to establish a dedicated private network connection from an on-premises data center to AWS. It is not used for connecting resources that are already within an AWS VPC to other AWS services in the same region.