Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Questions

Answer : C

Amazon RDS read replicas provide a way to offload read traffic from the primary database, allowing read-intensive applications to query the replica without impacting the performance of the production (write) database. This is especially effective for workloads that involve frequently changing data but do not benefit from caching, since queries are rarely repeated.

Reference Extract from AWS Documentation / Study Guide:

'Read replicas allow you to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads.'

Source: AWS Certified Solutions Architect -- Official Study Guide, RDS Read Replica section.

Answer : B

AWS Organizations is the best fit because it providesaccount-level isolationandconsolidated billingacross member accounts. AWS documentation states that the management account receives a single bill that combines usage from all member accounts, which directly supports a consolidated monthly chargeback view. Creating a member account per business unit also satisfies the isolation requirement better than sharing one account with tags. Separate organizations per unit would add unnecessary overhead and remove the simplicity of a single consolidated management structure. Therefore, a single AWS Organization with one member account per business unit is the cleanest and lowest-overhead design. (docs.aws.amazon.com)

============

Answer : B

For logs that are:

Written and processed within a short period (24 hours)

* Accessed quickly for compute/analytics

* With unknown object count and size

Amazon S3 Standard is the most appropriate and cost-effective. Intelligent-Tiering is designed for data stored for longer periods (typically 30+ days) with changing access patterns and charges a per-object monitoring and automation fee that becomes inefficient for very short-lived objects.

S3 Glacier Deep Archive and S3 One Zone-IA are optimized for long-term archival or infrequently accessed data with retrieval time or availability constraints that are not suitable for nightly active processing.

Answer : C

This is a classic session-persistence problem. AWS Elastic Load Balancing documentation explains thatstickinesslets a load balancer bind a user's session to a specific target. For an ALB,application-based cookie stickinesscan be enabled at the target group level, which is useful when the application expects a user to continue hitting the same backend instance for the duration of a session. That prevents users from being redirected back to login because of requests landing on different instances. The other options either do not solve the session problem or reduce availability by forcing traffic to one instance. (docs.aws.amazon.com)

============

Answer : C

AWS DataSync Enhanced mode is designed for large-scale transfers between AWS storage services and provides increased scalability for transferring very large object datasets. It is an agentless option for transfers between S3 buckets, which eliminates the need to deploy, size, secure, and maintain an EC2-based DataSync agent. DataSync provides task monitoring, transfer metrics, logging, and configurable verification to confirm that destination data matches the source. These capabilities satisfy the requirements for post-copy verification and visibility into migration progress. A manually managed AWS CLI copy operation would require custom retry logic, progress tracking, parallelization, and verification, creating significant operational overhead for petabytes of data. Basic mode has lower task scale limits than Enhanced mode and is less suitable for a very large S3-to-S3 migration that must be completed as quickly as possible.

Answer : A

AWS Global Accelerator is the best answer because it providesstatic anycast IP addressesand routes users to the optimal healthy endpoint over the AWS global network. AWS documentation explains that Global Accelerator continuously monitors endpoint health and redirects traffic to the next best healthy endpoint almost immediately, which avoids dependence on DNS resolver caching or client-side IP caching. That is especially important for low-latency global applications such as Voice over IP. Route 53 geolocation routing does not provide the same fast failover characteristics, and CloudFront is not the service for generic bidirectional VoIP application traffic. (docs.aws.amazon.com)

============

Answer : C

Correct Approach:

AWS Security Groups:

Security groups operate at the instance level, making them the ideal tool for controlling access to specific resources such as an Amazon RDS database.

By default, security groups deny all incoming traffic. You can allow access by explicitly specifying another security group.

Associating an RDS database security group with the EC2 instances' security group ensures only the specified EC2 instances can access the RDS database.

Incorrect Options Analysis:

Option A: Using CIDR blocks for IP-based access is less secure and more difficult to manage. Additionally, Auto Scaling groups dynamically allocate IP addresses, making this approach impractical.

Option B: Network ACLs (NACLs) operate at the subnet level and are stateless. While NACLs can deny or allow traffic, they are not suited to application-specific access control.

Option D: Similar to Option B, using a NACL with CIDR ranges for EC2 IPs is difficult to manage and not application-specific.

References:

Amazon RDS Security Groups

Security Group Best Practices

Differences Between Security Groups and NACLs