Free AWS Certified Solutions Architect Associate SAA-C03 Practice Test

Amazon S3 Cross-Region Replication (CRR) is the correct choice for this scenario as it allows automatic replication of S3 objects to a destination bucket located in a different AWS Region. This enhances data availability and can help serve users in different geographical locations with lower latency. S3 Transfer Acceleration is used to speed up the transfer of files into S3 but does not address the need for geographical read access. EBS snapshots are point-in-time backups of EBS volumes, but they do not provide real-time access across regions. RDS Multi-AZ deployments provide high availability within a region, but they do not fulfill the low-latency access requirement across geographical locations like CRR does.

By placing compute instances and the database within the same Availability Zone, data transfer costs between them can be eliminated since AWS does not charge for intra-AZ traffic. In contrast, inter-AZ data transfers, even within the same region, incur costs. AWS Global Accelerator is not related to cost optimization of traffic between EC2 instances and databases; it is intended to optimize global traffic and improve application performance for end-users. Configuring a NAT Gateway or using an additional load balancer between the compute instances and the database would needlessly increase complexity and costs, as neither addresses intra-region data transfer costs between compute instances and databases.

Amazon S3 is the correct choice because it is designed to store and retrieve any amount of data, at any time, from anywhere on the web, making it an excellent foundation for a secure and scalable data lake. Amazon S3 offers comprehensive security and compliance capabilities that can help meet even the most stringent regulatory requirements. For data at rest, S3 provides encryption features such as SSE-S3, SSE-C, and SSE-KMS, ensuring data is encrypted automatically when saved to the data lake. For data in transit, it uses HTTPS to secure data as it travels over the internet. Its scalability ensures that as the company's data grows, S3 can handle the increase in storage demand without the need for manual intervention. The other options do not offer the same level of security, scalability, or are not designed for data lake operations.

Geographic dispersal of the application across multiple AWS Regions close to the users provides for both high availability and optimized latency for users in different continents. This choice offers the advantage of maintaining application operations even if one AWS Region is down. A Multi-Region deployment is generally more cost-effective and operationally less complex than managing global clusters with cross-region read replicas. Deploying within a single region—even across multiple Availability Zones—does not offer protection against a regional outage. Global clusters provide a high level of resiliency and availability but may introduce unnecessary complexity and cost in this scenario, where regional deployments near user populations are sufficient. Using Amazon Route 53 with health checks alone does not address the requirement of operating during a regional data center outage.

Amazon RDS with Multi-AZ deployments is designed for high availability and failover support for DB instances within AWS. It automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a planned or unplanned outage of your primary DB instance, RDS performs an automatic failover to the standby, minimizing disruption. Other services mentioned such as Amazon DynamoDB, Amazon Aurora Global Databases, and Amazon S3 do not fit the scenario described. DynamoDB is a NoSQL service and does not provide a relational database. Aurora Global Databases are used for cross-region disaster recovery, not within a single region. Amazon S3 is object storage and does not support relational database features.

Implementing private and public subnets in a VPC can achieve network segmentation, providing a secure environment for resources. The databases should be placed in a private subnet with no direct access from the internet, while the web servers can be placed in a public subnet. By using security groups, one can allow specific traffic from the public subnet to the private subnet. This ensures that while the web servers can communicate with the databases, the databases remain inaccessible directly from the internet. A wrong answer might incorrectly suggest exposing the databases to the internet or using incorrect components for traffic control.

Amazon CloudFront is the optimal choice since it is a global content delivery network service that speeds up the distribution of static and dynamic web content such as .html, .css, .js, and video files to users. CloudFront delivers content through a worldwide network of data centers called edge locations. When a user requests content that is being served by CloudFront, the request is routed to the edge location that provides the lowest latency. Therefore, the service ensures that end-users experience faster page load times and a boost in overall performance. Other services mentioned, such as global database deployment or multi-region load balancing, are not primarily designed for the purpose of content caching and global distribution which is essential for the described scenario.

The main reason for placing an Amazon EC2 instance in a private subnet is to ensure the instance is not accessible directly from the internet, providing a higher level of security for sensitive applications or data. Instances in a private subnet can access the internet via a NAT gateway or instance, which is located in a public subnet, without exposing these instances directly to inbound internet traffic.

AWS Lambda's concurrency model does limit the number of function instances that can run simultaneously. By default, AWS imposes an account-wide concurrency limit, which affects how many instances of all your Lambda functions can run at the same time. However, you can set reserved concurrency limits at the individual function level, which allocates a portion of the account-level limit to a particular function. This question tests understanding of Lambda's concurrency controls, rather than its ability to scale, which is often misunderstood. The statement is true because it is possible to adjust the concurrency limit for each function, which offers control over scaling and ensures that critical functions have the necessary resources.

Setting up a lifecycle policy to transition objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 60 days takes advantage of the lower storage cost for infrequently accessed data, while still providing rapid access when needed. After one year, moving the objects to S3 Glacier provides a low-cost storage solution for archiving, with retrieval times ranging from minutes to hours, which should suffice for the client's occasional access needs. Moving objects directly to S3 Glacier or S3 One Zone-IA after 60 days is not recommended because Glacier is better suited for archiving rather than infrequent access, and One Zone-IA has a lower durability since it stores data in a single Availability Zone only.

Using Amazon S3 lifecycle policies is an effective solution to automatically manage the retention and deletion of documents in cloud storage. Setting up these policies allows documents to be deleted after they've reached the end of the required retention period. Access to these documents can be controlled with fine-grained permissions using Bucket Policies and IAM roles. Other provided options, such as using S3 Object Lock, AWS KMS policies, or Glacier Vault Lock, do not fulfill the specific requirement of automatic data deletion after a retention period. S3 Object Lock is for immutability, KMS manages encryption keys, and Glacier Vault Lock is for long-term archival, not lifecycle management.

This statement is false because Amazon Aurora is optimized for online transaction processing (OLTP), while Amazon Redshift is designed specifically for data warehousing and analytics, which often involves complex querying of large volumes of columnar data. Amazon Redshift’s columnar storage and massively parallel processing (MPP) architecture make it better suited and more cost-effective for data warehousing tasks.

Utilizing a service to provision, manage, and deploy public SSL/TLS certificates enables secure HTTPS connections, a standard protocol for encrypted communication over the internet. This service is responsible for the encryption of data in transit by facilitating SSL/TLS protocols, which is a necessity for the encryption of web traffic. This ensures that data is secure while being transmitted. Options related to key management systems and client-side or server-side encryption generally refer to protecting data at rest or providing encryption tools within the application but are not directly related to establishing secure browser to server communication.

The service best suited for automating the discovery and classification of sensitive content, allowing the enforcement of retention policies, is Amazon Macie. It leverages machine learning and pattern matching to assist in accurately and efficiently identifying and classifying different types of content, making it ideal for this requirement. While other services mentioned may be related to data management or protection, none offer the same specialization in automated data discovery and classification as Macie.

By choosing customer managed keys with enabled automatic rotation, the security team has central control over the encryption keys and satisfies the need for regular, automated updates to the key material. Built-in automatic rotation occurs yearly, reinforcing security best practices. Managed keys provided by the cloud service rotate less frequently, which does not meet the stricter rotation requirements typically desired for sensitive financial data. Using a Lambda function for manual rotation or relying on developers for key updates deviates from the requirement for automated processes, introducing potential human error and inconsistency in security practices.