Amazon Web Services Updated SAA-C03 Exam Questions and Answers by crystal

The correct answers areA, B, and Cbecause the company needs to handle a sharp increase inread traffic, maintainhigh availability, and avoidapplication changes. These three options improve scaling at different layers of the architecture while remaining aligned with the current application design.

A. Amazon CloudFronthelps reduce load on the web tier by caching content closer to users at edge locations. This improves responsiveness and reduces the number of requests that must reach the origin web servers during the marketing event. It is a common way to scale web traffic without changing the application.

B. Auto Scaling for the application layeris also appropriate because the application layer is already described asstatelessand supports automatic scaling. Adding or removing EC2 instances based on demand helps the application remain responsive under high load.

C. Amazon Aurora with Aurora Replicas and Aurora Auto Scalingis the best way to scale the relational database layer for read-heavy workloads. Aurora Replicas can offload read traffic from the writer instance, and Aurora Auto Scaling can automatically adjust replica capacity based on demand. This preserves the relational architecture while improving read scalability and availability.

OptionDcan reduce database read pressure, but adding ElastiCache effectively requires the application to use the cache, which conflicts with the requirement to avoid modifying the application. OptionEis incorrect because replacing the ALB with an NLB does not solve the application’s scaling or read-traffic bottlenecks. OptionFis incorrect because migrating from a relational database to DynamoDB would require a major redesign.

So the best combination isCloudFront,Auto Scaling for the stateless application tier, andAurora with read scaling features.

Amazon EC2 On-Demand Instances: Since the batch jobs cannot be disrupted, On-Demand Instances provide the necessary reliability and availability.

Amazon S3 Standard: Storing data in S3 Standard for the first 30 days ensures quick and frequent access.

S3 Glacier Deep Archive: After 30 days, moving data to S3 Glacier Deep Archive significantly reduces storage costs for data that is rarely accessed.

S3 Lifecycle Configuration: Automating the transition and deletion of objects using lifecycle policies ensures cost optimization and compliance with data retention requirements.

Correct Approach:

AWS Security Groups:

Security groups operate at the instance level, making them the ideal tool for controlling access to specific resources such as an Amazon RDS database.

By default, security groups deny all incoming traffic. You can allow access by explicitly specifying another security group.

Associating an RDS database security group with the EC2 instances ' security group ensures only the specified EC2 instances can access the RDS database.

Incorrect Options Analysis:

Option A: Using CIDR blocks for IP-based access is less secure and more difficult to manage. Additionally, Auto Scaling groups dynamically allocate IP addresses, making this approach impractical.

Option B: Network ACLs (NACLs) operate at the subnet level and are stateless. While NACLs can deny or allow traffic, they are not suited to application-specific access control.

Option D: Similar to Option B, using a NACL with CIDR ranges for EC2 IPs is difficult to manage and not application-specific.

Aurora encryption at rest must be enabled when the DB cluster is created; an existing unencrypted Aurora cluster cannot simply be modified in place to become encrypted. The least operationally heavy migration path is to create a DB cluster snapshot, copy or restore it with encryption using an AWS KMS key, and then restore that encrypted snapshot as a new Aurora PostgreSQL cluster. This avoids a manual logical migration and preserves the database contents more efficiently than rebuilding and copying data at the application level. Option A is invalid because encryption cannot be enabled directly on the existing unencrypted cluster. Option C incorrectly refers to generic SSE instead of Aurora storage encryption through AWS KMS.