Amazon Web Services Updated SAA-C03 Exam Questions and Answers by kobie

Unpredictable Lambda traffic can create a “connection storm” against a relational database because each concurrent Lambda invocation may open its own database connection. Relational engines like PostgreSQL have finite connection capacity, and excessive connections can degrade performance, increase latency, and exhaust database resources. Amazon RDS Proxy is designed to address this by pooling and reusing database connections, multiplexing many application requests over a smaller number of established database connections. This helps keep database performance more predictable under spiky, highly concurrent workloads such as Lambda.

Because the database is a private RDS for PostgreSQL instance, the Lambda functions must run with network access to the VPC subnets and security groups that can reach the database and proxy. Therefore, deploying the Lambda functions inside a VPC and pointing the database client to the RDS Proxy endpoint is the correct operational pattern. RDS Proxy also provides benefits like improved failover behavior handling and centralizing credential management integration patterns (commonly with IAM authentication and/or Secrets Manager), further reducing operational risk.

Option A uses a custom endpoint, which does not solve the fundamental connection scaling problem; it’s not a connection pooler. Option C and D place Lambda outside the VPC, which will not work for a private database that has no public connectivity path. Even if connectivity were possible, D would still be incomplete because you’d need private networking to reach the proxy.

Therefore, B best meets the requirement by introducing managed connection pooling via RDS Proxy and ensuring private network reachability by running Lambda in the VPC.

A. Mutual TLS:Provides secure communication but does not integrate with AWS credential exchange.

B. AWS Signature v4:Requires direct integration with AWS and is less secure for external systems.

C. Kerberos:Not natively supported for AWS API authentication.

D. IAM Roles Anywhere:Enables AWS API access using X.509 certificates without long-term credentials.

Amazon S3 Storage Lens with advanced activity metrics is the most operationally efficient answer because AWS documentation explicitly says you can use S3 Storage Lens advanced metrics to identify “cold” buckets, meaning buckets whose objects are no longer accessed or are accessed only rarely. That is exactly the requirement in the question. This avoids building a custom analytics workflow on top of CloudTrail or CloudWatch metrics. The standard S3 console does not provide the same purpose-built fleet-level analysis for cold-bucket identification. Athena and CloudTrail can be used for access analysis, but they require more setup, data handling, and query maintenance. S3 Storage Lens is the native managed feature for this storage-optimization scenario. (AWS Documentation)

============