SAA-C03 — frequently asked questions

Stored Volumes keep the entire dataset on-premises, violating the 'limited space' constraint and offering no latency advantage over cached volumes for hot data.

No, S3 File Gateway provides file-level interfaces (NFS/SMB), whereas the question requires block storage (iSCSI) compatibility for existing applications.

On-Demand is priced higher per request. For gaming traffic which can be predicted or scaled, Provisioned with Auto Scaling offers significant cost savings.

Yes, but it requires custom code to handle conflict resolution and replication logic, making it less robust and more complex than managed Global Tables.

CloudFront caches content at edges. For dynamic ERP data that changes frequently, caching provides little benefit and risks serving stale data. Global Accelerator optimizes the network path without caching.

Yes, per-unit costs vary, but Direct Connect requires dedicated physical lines for each customer, which is prohibitively expensive for a public API. Global Accelerator uses shared AWS infrastructure, making it far more cost-effective for this scenario.

It doesn't know about the ALB IP target group registration, so it patches the instance while traffic is still routed to its IP.

While possible, it changes your architecture. The question asks to resolve errors within the current setup, making Automation the direct fix.

While SSE-S3 is free, the question specifies the company currently uses AWS KMS and wants to optimize THAT cost structure. S3 Bucket Keys allow you to keep the flexibility of KMS (like custom policies) while drastically cutting the per-request cost.

It maintains the same security level as SSE-KMS but improves performance and reduces latency because S3 doesn't have to wait for a remote KMS API call for every single object upload.

CPU utilization might remain high even if there are no messages, or low if a single message is complex. Queue depth directly reflects the backlog needing processing.

No. ElastiCache speeds up database reads. It does not help the processing tier consume messages from SQS faster, which is the stated bottleneck.

Attaching multiple policies to the EC2 instance profile grants all pods on that node access to all associated AWS resources, violating least privilege.

No. IRSA works by binding a Kubernetes Service Account to an IAM Role, which the pod then assumes via the OIDC provider.

Managed AD requires replicating directory data and managing a separate Windows Server instance, which creates high operational overhead compared to the lightweight AD Connector proxy.

Yes, AD Connector serves as an identity source for IAM Identity Center, allowing you to map on-premises AD groups to AWS permissions sets across multiple accounts.

No, API Gateway is a managed service and does not support Security Groups. You must use Resource Policies or AWS WAF.

Private Integration restricts backend connectivity within a VPC, while a Resource Policy restricts who can call the API endpoint from the internet.

SageMaker requires ML expertise to train models and deploy endpoints, conflicting with the 'no ML experience' requirement.

No, it is closed to new customers as of July 2024, but it remains the correct answer for this specific legacy exam question.

No, standard EBS volumes are bound to a single AZ. While EBS Multi-Attach allows multiple instances to attach, it is restricted to the same AZ and specific instance families.

No, DataSync is designed for periodic, scheduled data transfers between endpoints. It does not provide the low-latency, continuous synchronization required for frequent web content changes.

Geoproximity uses geographic location and can apply biases, but it doesn't measure real-time network latency. Latency-based routing directly optimizes for the fastest response time.

While the question options use A/CNAME, AWS recommends using Alias records for Application Load Balancers because they are free and resolve to IP addresses dynamically. However, the routing policy is the key exam concept here.

A bucket policy controls object access (GetObject) but cannot stop a user with KMS permissions from decrypting the data. You must restrict the KMS key usage directly.

No. ACM manages certificates for TLS/HTTPS (data in transit). For data at rest, use SSE-KMS or SSE-S3.

A NAT Gateway only allows outbound internet traffic from private instances. It does not support unsolicited inbound connections from the internet.

No, instances in private subnets do not automatically get public IPs. They require a gateway like an ALB to be reachable from the internet.

No, S3 is an object store and cannot be mounted as a native filesystem volume in Fargate tasks. You must use EFS or FSx for Windows File Server.

EBS volumes are tied to specific EC2 instances. Since Fargate abstracts away the underlying infrastructure and tasks can move between hosts, EBS cannot be reliably attached to Fargate tasks.

Route 53 only resolves DNS names and doesn't optimize the actual network path. Global Accelerator uses AWS's private backbone to reduce latency significantly.

Yes, but for TCP/UDP gaming apps, NLBs are preferred because they handle raw packet traffic better and preserve source IPs without Layer 7 overhead.

No. Snowball Edge devices upload data to Amazon S3. FSx for Lustre must be configured as a linked repository pointing to that S3 bucket.

Amazon EFS is a general-purpose file system. For HPC workloads requiring sub-millisecond latency and massive throughput, FSx for Lustre is the specialized, high-performance choice.

No, SCPs apply to Organizations roots, OUs, or member accounts. They do not apply to individual IAM roles or users.

Attaching to the Root applies the policy to ALL accounts in the organization, including the production account, which violates the exclusion requirement.

Private hosted zones store records locally in AWS. They cannot resolve names that reside on your on-premises DNS servers unless you manually replicate them, which defeats the purpose of hybrid integration.

Outbound endpoints forward queries FROM the VPC TO on-premises. Inbound endpoints allow queries TO come FROM on-premises INTO the VPC. You need outbound here.

RequestCount is an aggregate metric for the entire Load Balancer, not individual targets. It cannot tell you which specific EC2 instance is overloaded.

Use Least Outstanding Requests when request processing times vary significantly or when instances have different capacities, ensuring balanced load distribution.

Savings Plans Alerts only notify about plan expiration and queued purchases. They do not provide notifications for daily coverage or utilization drops.

Yes, you can create a Savings Plans budget in AWS Budgets to track coverage percentage and set thresholds to trigger SNS or email notifications.

No, MSK is designed to handle client connections directly. Using an NLB adds complexity and cost without providing the necessary functionality for Kafka protocol handling.

Creating a new VPC requires additional setup like VPC peering and route table updates, which reduces operational efficiency compared to simply changing the subnet type of the existing cluster.

While S3 Event Notifications work, Transfer Family managed workflows provide a tighter integration specifically designed for file transfer events, ensuring immediate and reliable invocation of Lambda functions upon upload.

Choose Internal when clients connect via private network links (Direct Connect/VPN) to enhance security. Choose Internet-Facing only if clients must access the server over the public internet.

VPN creates network connectivity but does not solve the management complexity or scalability of the Hadoop cluster itself. You still manage the on-prem Hadoop nodes, which contradicts the goal of reducing operational complexity.

Yes, EMR on Outposts runs on dedicated Outposts hardware within your data center, allowing you to use the same EMR APIs and tools but with data staying on-premises and low-latency access.

S3 File Gateway requires managing a virtual appliance and adds latency. FSx for ONTAP is a fully managed native file system with lower operational overhead for in-region EC2 access.

No, Amazon EFS only supports the NFS protocol. It cannot be mounted by Windows instances using SMB.

Yes, AWS Lambda allows you to deploy individual functions as independent services, fitting the microservices pattern without container overhead.

Elastic Beanstalk manages EC2 instances behind the scenes, requiring more operational effort than Lambda's fully managed serverless environment.

AWS restricts each EC2 instance to a single IAM role/instance profile at any given time. To add permissions, you must replace the role or use a feature like DHCM that handles this automatically.

Yes, when enabled, it automatically registers existing unmanaged EC2 instances in the region as managed instances and attaches the necessary IAM role.

No. DAX is exclusively for Amazon DynamoDB. It cannot connect to or cache data from RDS instances.

Multi-AZ ensures high availability and failover capability, but it does not increase read/write throughput or reduce latency for application requests.

Stored volumes require the entire dataset to reside on-premises. Since the company is 'running out of storage capacity,' storing everything locally is not feasible without expanding hardware, which violates the migration goal.

No. Data stored in S3 Standard (the default for cached volumes) allows for immediate retrieval at no additional cost beyond standard storage and request fees, unlike Glacier which has retrieval fees and delays.

Read replicas increase capacity but do not eliminate the overhead of repeated database queries. Caching serves the data directly from memory, which is faster and cheaper for identical requests.

For high-frequency identical reads, yes. The cost of a small cache node is usually less than running additional full-sized Aurora instances that still process the same redundant queries.

Bidirectional replication ensures that any upload from any region is instantly available everywhere. One-way replication would force users in other regions to upload to the primary region, causing high latency.

Yes, MRAP supports both read and write operations. It automatically routes write requests to the nearest region, which then replicates the data to other regions.

Standard CloudFront is optimized for caching and delivering content. While it supports POST/PUT methods, it does not provide the same optimized network routing and latency reduction as S3 Transfer Acceleration for uploads.

While storing data closer reduces physical distance, S3 Transfer Acceleration optimizes the network path through CloudFront edges, providing better performance than just selecting a nearby region without accelerated routing.

SNS can filter and fan out, but every Lambda needs an SQS queue and polling, adding components and configuration that EventBridge rules do not require.

No. The limit is per rule, and you can create additional rules to reach more targets while still avoiding SQS queues and polling overhead.

No. IAM authentication changes how users log in. While it supports SSL/TLS, you must still explicitly configure clients to use the AWS-provided certificates to ensure encryption.

AWS provisions its own SSL certificates for RDS instances. Using AWS-provided certificates ensures compatibility and trust without the overhead of managing custom CA infrastructure.

ALB nodes use dynamic public IPs, and AWS does not support assigning Elastic IPs to an ALB. That makes ALB unsuitable when clients must whitelist fixed addresses.

An A record only maps a DNS name to an address; it does not attach that Elastic IP to the ELB. The web service itself still needs a static IP that clients can authorize.

While IAM Roles are used under the hood, the CloudFormation template automates the creation and trust relationship configuration across all accounts, ensuring consistency and reducing manual errors.

No. SCPs only define permission boundaries (deny lists). They do not grant permissions or enable the actual data flow and visualization capabilities required for cross-account dashboards.

Security Groups are stateful virtual firewalls that only support allow rules. You cannot specify a 'deny' rule for a specific IP in a Security Group.

Yes. NACLs operate at the subnet level and are less granular for web traffic analysis. WAF inspects HTTP/S requests and is the designated service for protecting web applications from threats like SQL injection and IP abuse.

Yes, AWS Transfer Family supports mounting to Amazon EFS file systems, allowing users to transfer files directly to EFS volumes.

While S3 is highly available, it uses an object API. EFS provides a native POSIX-compliant file system interface, allowing existing batch applications to access files without code modification.

AWS WAF is only supported on Application Load Balancers, CloudFront, API Gateway, and AppSync. An NLB works at layer 4, so it has no HTTP request context for WAF to inspect.

CloudFront serves content from large sets of dynamically changing edge IP addresses, so no fixed address can be published. Global Accelerator instead provides two static anycast IPs as a permanent entry point.

Object Lambda processes data on-demand during retrieval, eliminating the need for scheduled jobs, EC2 instance management, and storage of duplicate redacted files, thus reducing operational overhead.

Yes, the external provider can request specific objects or ranges from the Object Lambda Access Point just like a standard S3 bucket, allowing them to pick samples as needed while receiving redacted content.

AWS EC2 instances are bound to a single Availability Zone. Multi-AZ is supported by managed services like RDS or ElastiCache, not raw EC2 instances. You would need two separate instances and a load balancer to achieve Multi-AZ redundancy.

No. RAID (Redundant Array of Independent Disks) only protects against physical disk failures. If the OS crashes, the application hangs, or the underlying host fails, RAID cannot restore service. CloudWatch alarms are required to detect and recover these states.

Expedited Retrieval is strictly limited to objects up to 250 MB. For larger objects, even Expedited mode cannot guarantee the 1-5 minute retrieval window.

Glacier is cheaper for storage but incurs high retrieval costs and latency. Standard-IA balances cost and performance for data that needs instant access when requested.

Lambda is limited to 15-minute executions and has strict storage caps (max 10GB total). It is not suitable for long-running containerized applications or large temporary file processing.

EFS is a durable file system, but in this exam context, it acts as the persistent network storage layer for the container's working directory, satisfying the 50GB requirement without managing servers.

Aurora is MySQL-compatible but is a different engine, so it may require schema or feature changes. Amazon RDS for MySQL uses the same engine as on-premises MySQL, minimizing changes.

Yes, RDS for MySQL supports point-in-time recovery to any second within the backup retention period (up to 35 days), so it meets the restore requirement without Aurora.

While researchers use files, the prompt specifies 'storage arrays' (block level). File Gateway serves file protocols (NFS/SMB) and doesn't utilize the specific 'cached volume' block-caching mechanism optimized for this hybrid array scenario.

No, DataSync is a data transfer service for migration or replication. It does not provide an active, mountable storage endpoint for applications requiring immediate, low-latency read/write access.

Nonproduction runs only during weekday business hours, so a one- or three-year Reserved Instance commitment would cover many idle nights and weekends.

Yes. Compute Savings Plans cover EC2, Lambda, and Fargate usage, so they fit the event-driven Lambda portion as well as the steady EC2 production load.

Lambda supports container images but is designed for short-lived, event-driven functions, not for managing long-running containerized applications or services that require orchestration.

Both use Fargate for serverless execution, but ECS is simpler and native to AWS, while EKS provides Kubernetes compatibility for more complex orchestration needs.

ElastiCache nodes and CloudFront caching of dynamic content add ongoing cost and complexity, while demand-based Auto Scaling pays only for EC2 capacity actually used during the sale.

Stopped instances still count toward the group's desired capacity and are treated as unhealthy, so the group replaces them instead of using them as spare scale-out capacity.

Redis supports replication, snapshots and persistence, while Memcached is a pure volatile cache with neither. The question explicitly requires replication and snapshots, so Redis is the only cache option that qualifies.

DynamoDB meets the sub-millisecond and replication goals, but it requires re-platforming the relational metadata model and global tables solve multi-Region writes, which this workload does not need. Caching in front of the existing RDS database is faster to deliver and lower risk.

Snowmobile is designed for 10 PB or more in a single location and was retired by AWS in March 2024, so it cannot serve 80 separate 1 PB sites cost-effectively.

No; at 1–2 Gbps per office, internet transfer cannot move 1 PB within four weeks, and Volume Gateway is not an offline bulk migration tool.

Option C describes an identity policy attached to the EFS file system, but identity policies attach only to IAM users, groups, or roles. The deny must come from an EFS resource policy (option B).

Yes. ClientWrite controls write and delete permissions, while ClientMount grants read access when the EFS file system uses IAM authorization with the instance role.

Each stream record appears once, but Lambda stream consumers are at-least-once and can retry a batch, so the same payment could be reprocessed without an idempotency check.

Yes. Millions per day is low average throughput; FIFO high-throughput mode supports up to 3,000 messages per second per partition with batching, and Lambda scales by message group.

SCPs evaluate API calls at the Organization level and typically cannot parse the complex JSON structures within CloudFormation templates to block specific inline policy definitions.

Proactive controls prevent resource creation if they violate rules, while Detective controls only identify and report non-compliant resources after they have been successfully created.

Identity Pools provide temporary AWS credentials for accessing AWS services, whereas User Pools handle user registration and sign-in for applications.

Yes, Lambda Authorizers require managing code and incur cold start latency, making them more operationally intensive than the native Cognito integration.

AWS Config evaluates resource state against rules but cannot directly intercept and cancel active API operations like DeleteKey. It is best for compliance checking, not real-time prevention.

No, using Lambda adds significant operational overhead for maintenance and error handling. SSM Automation Runbooks are pre-built, managed templates designed exactly for this type of automated remediation.

Spot Instances can be interrupted with short notice. For monthly reports where timing matters, interruptions could cause delays or failures, making Lambda's reliability superior.

Lambda charges per millisecond of execution. Even for multiple reports totaling ~30 minutes, the cost is negligible compared to paying for always-on EC2 or ECS instances.

Autopilot creates custom ML models, but the question explicitly forbids training a machine learning model.

No, Comprehend is for natural language processing of text, not for analyzing visual content like photos.

AWS Glue is fully serverless and managed, fitting the 'serverless wherever possible' constraint better than EMR, which typically involves managing clusters unless EMR Serverless is specified.

It allows you to create, train, and deploy machine learning models using standard SQL commands on your Redshift data warehouse without needing other ML tools.

EFS is more expensive than S3. For large-scale archival or infrequent access, S3's lifecycle policies to Glacier are far more cost-effective than EFS IA.

Yes, Amazon S3 File Gateway provides both NFS (for Linux/macOS) and SMB (for Windows) interfaces, making it ideal for migrating existing file shares.

Reserved concurrency only carves a concurrency budget out of the account limit and does not pre-initialize execution environments, so cold-start latency remains and a marketing-event burst can be throttled.

Yes. Lambda allocates vCPU proportionally to memory, so CPU-bound functions finish faster; the shorter GB-second duration often outweighs the higher per-millisecond rate.

Yes, ECR Basic Scan detects Common Vulnerabilities and Exposures (CVEs) for Linux-based container images.

It requires building and maintaining custom code (Lambda) and managing event notifications, whereas ECR provides a fully managed, native scanning feature.

EventBridge Scheduler only runs on cron or rate schedules; it cannot match service events. You need an EventBridge rule with an event pattern for AWS Batch job state changes.

Yes. The API destination uses a connection resource that holds authorization credentials, including basic auth with a username and password, which EventBridge injects into the HTTP request.

AMG is a fully managed service that runs outside your account's VPC. It connects to your VPC via PrivateLink interfaces.

Yes, AWS PrivateLink allows you to expose services privately using Interface Endpoints (VPC Endpoints) within your VPC.

DataSync is optimized for transferring large datasets of file-based data, not for continuous, low-latency real-time ingestion from multiple third-party sources.

No. The EC2 instances host the application, but the data ingestion path is separate. Third-party apps send data directly to Kinesis, bypassing the EC2 instances.

SSE-S3 rotates keys automatically, but AWS does not disclose the rotation schedule or allow you to enforce a specific frequency like 'every year'. KMS CMKs allow you to enable explicit annual rotation.

No. If you import your own key material into a KMS key, you must manage the rotation manually. Automatic rotation is only supported for KMS keys where AWS generates the key material.

Aurora Standard charges extra for I/O operations after a free tier. For high-traffic apps, these fees accumulate quickly, making I/O-Optimized cheaper.

Provisioned IOPS guarantees latency but doesn't solve the I/O cost issue. Aurora I/O-Optimized provides high performance without per-request fees, fitting the 'cost-effective' requirement.

SNS filtering selects which subscribers receive the message based on attributes, but it forwards the complete, unmodified message body to every matching subscriber.

Yes, because EventBridge provides native input transformation capabilities out-of-the-box, whereas SQS requires a separate Lambda function to parse and transform messages before forwarding them.

Public VIFs have no hourly configuration fee and typically lower data transfer costs compared to the hourly charge and data processing fees of Interface Endpoints.

No, traffic to AWS public services via a Public VIF stays on the AWS backbone network and does not traverse the public internet, maintaining security.

A NAT Gateway still sends traffic out to the public internet (or through the NAT appliance's public interface). The question explicitly requires avoiding internet traversal.

No, Transit Gateway is for inter-VPC or hybrid cloud connectivity. For direct S3 access from a VPC, a Gateway Endpoint is the dedicated and optimized solution.

CloudFront optimizes HTTP/HTTPS traffic. The question specifies TCP acceleration for RTMP, which Global Accelerator handles better via its Anycast IP routing.

Yes, Global Accelerator supports both TCP and UDP protocols, making it suitable for RTMP streams that require low-latency connection acceleration.

No native copy exists from EBS snapshot to S3 Glacier; you must create volumes from snapshots, attach them to EC2, and copy files, adding significant admin overhead and delays.

Yes, DLM lifecycle policies automatically move monthly EBS snapshots to the archive tier and can delete them after the 7-year retention period.

Yes, it is a native feature of Amazon EFS that requires no infrastructure management, fitting the definition of an AWS managed service.

AWS Backup stores snapshots, incurring ongoing storage costs. Native replication maintains a live copy which can be more efficient for continuous availability needs without extra backup tier fees.

Read Replicas help scale read operations but do not provide automatic high availability for write operations or dynamic scaling for the web tier, unlike Auto Scaling Groups.

Multi-AZ primarily improves availability and durability through synchronous replication and automatic failover, not necessarily performance, though it can offload some I/O.

FSx is designed for cloud workloads. Storage Gateway is specifically built as a hybrid appliance to extend on-premises file servers to AWS object storage seamlessly.

No. The application continues to interact with the local gateway instance via standard SMB protocols, unaware that the backend storage is in AWS S3.

A CloudWatch alarm is reactive: it scales only after CPU utilization crosses the threshold, so users may already experience degraded performance during the demand spike.

No. Raising the maximum is a manual capacity limit change; it does not schedule or trigger additional EC2 instances ahead of the known peak like a recurring scheduled action does.

RDS is relational. Querying deep dependency chains requires complex recursive SQL joins, which are harder to manage and less efficient than native graph traversal in Neptune.

Neptune supports both Gremlin and SPARQL. SPARQL is ideal for RDF-based graph queries, which are common in semantic web and security ontology contexts.

Option B uses provisioned Aurora instances which run 24/7 and incur full hourly costs even when idle. For intermittent use, this is far less cost-effective than Aurora Serverless, which scales to zero.

Yes. You can create multiple logical databases within a single Aurora Serverless cluster. Each developer gets their own schema/database namespace, satisfying the 'separate' requirement without needing separate physical instances.

Yes, the Management Account can view aggregated Trusted Advisor recommendations for all linked member accounts, providing a centralized view for cost optimization.

The Idle DB Instances check identifies underutilized resources. Since the prompt specifies 'high utilization,' these instances are actively used and thus unsuitable for the 'idle' check, making RI optimization the correct path.

ElastiCache is an in-memory cache best for repeated read queries; it does not absorb the regular imports and write operations that are overloading the MySQL database.

Choose Provisioned IOPS SSD when the database needs sustained high IOPS, such as write-heavy transactional imports, rather than burst-only General Purpose SSD performance.

DAX is a caching service built specifically for Amazon DynamoDB. It cannot connect to or cache data from Amazon Aurora or other RDS databases.

Yes. A Read Replica shares the same underlying storage infrastructure as the primary instance (in some configurations) or is simply a lighter-weight copy, making it significantly cheaper and faster to provision than a whole new secondary cluster.

No, IAM Groups cannot be principals in a trust policy. You must use specific Users, Roles, or the entire Account.

Best practice dictates roles reside in the account they grant access to. This simplifies permission management and follows the principle of least privilege.

Security Hub aggregates findings from other tools like Inspector. It does not perform the initial vulnerability scanning itself, so you still need Inspector to generate the data.

No. AWS Config tracks configuration changes and compliance status. It cannot install patches or updates on instances; that is the role of Systems Manager Patch Manager.

CloudFormation creates resources on-demand during a disaster event. The time taken to launch EC2 instances, attach volumes, and start applications introduces significant latency, violating the 'minimal downtime' requirement.

DynamoDB Global Tables replicate data across regions with low latency. However, application-level failover (routing traffic via Route 53) must still be configured manually or via automation to direct users to the active region.

While Interface Endpoints provide private access, they incur hourly charges and data processing fees. Since the question asks for the MOST cost-effective solution, the free Gateway Endpoint is superior.

A NAT Gateway allows outbound internet access but does not inherently keep S3 traffic off the public internet. Without a VPC endpoint, traffic would still traverse the public internet unless a specific endpoint is configured.

An alias allows you to hide the actual destination and change the backend recipient without changing the public-facing email address, providing flexibility and security against personnel turnover.

No, best practice dictates separate distribution lists for Billing, Operations, and Security to ensure segregation of duties and prevent unauthorized access to sensitive data across teams.

ElastiCache is optimized for read-heavy workloads. Purchase transactions involve writes, making cache invalidation complex and inefficient for this use case.

No. RDS Proxy optimizes database connections, while SQS buffers incoming requests. They solve different bottlenecks: one for DB load, the other for application throughput.

Cache-Control private tells shared caches like CloudFront NOT to cache the object. Since the goal is to improve performance via caching, this option would defeat the purpose.

Not entirely. CloudFront uses origin headers unless overridden by Cache Policy settings like Default TTL or Minimum TTL. Invalidation bypasses TTL logic entirely.

An EC2 Instance Savings Plan only covers EC2 usage. It does not provide any discount for Lambda functions, which are part of the workload.

No. By default, Lambda runs in a service-managed VPC. To access resources in your VPC, you must explicitly configure the Lambda function's VPC settings.

Yes, AWS Budgets supports actions that can trigger IAM policies to deny permissions for launching new resources when a budget threshold is breached.

Cost Anomaly Detection only identifies unusual spending patterns and sends alerts; it does not have the capability to block or restrict further resource creation.

AWS Config is detective: it evaluates existing volumes and can trigger remediation, but it does not block the CreateVolume action, so an unencrypted volume can still be created before the rule reacts.

Encryption by default applies to newly created EBS volumes and snapshot copies in the Region; it does not retroactively encrypt existing unencrypted volumes or snapshots.

Firehose is for near-real-time delivery to storage. The question requires real-time analysis, which implies immediate processing logic better handled by Streams + Lambda.

No, AWS Glue is primarily designed for batch ETL jobs. While it has some streaming capabilities, it is not the standard solution for low-latency real-time analysis compared to Lambda.

While Standard-IA offers immediate access, S3 Glacier Instant Retrieval has a significantly lower storage cost per GB. For data stored for 4 years, the savings from using Glacier Instant Retrieval outweigh any minor differences in retrieval costs.

No. Unlike standard Glacier or Glacier Deep Archive, S3 Glacier Instant Retrieval provides millisecond access times, meeting the immediate accessibility requirement while offering lower storage prices.

Legacy apps often lack session synchronization or database locks needed for concurrent access, so running two instances causes state conflicts.

Yes, it ensures that if the single instance fails, AWS automatically launches a new one from the AMI, maintaining service continuity.

Organizations manages account structure but does not provide automated security guardrails or blueprints out-of-the-box like Control Tower does.

Yes, RAM allows sharing VPC subnets from a central networking account to workload accounts, reducing the need to manage VPCs in every account.

ElastiCache is for caching dynamic data, not hosting files. It adds cost and complexity without providing the global CDN benefits of CloudFront.

Yes, CloudFront reduces data transfer costs and origin requests by caching content at edge locations, lowering the load on your S3 bucket.

VPC Peering requires a full mesh of connections for all-to-all communication, leading to O(N^2) complexity and unmanageable route tables.

Yes, Transit Gateway allows traffic to flow between any attached VPCs without needing direct peering connections between them.

Batch operations manage existing objects but don't provide ongoing, automated access control per application. It also relies on ACLs, which are discouraged.

Access Points themselves have minimal cost, but you pay for API requests. However, this is far less overhead than managing multiple buckets or object-level permissions.

CloudFormation is a regional service running on AWS infrastructure, not inside your VPC. VPC endpoints only handle traffic originating from within a VPC.

Yes, for temporary access. It uses signed credentials and expires automatically, ensuring no permanent public access or long-lived secrets are exposed.

Standard-IA has a higher storage price than Glacier Instant Retrieval for rarely accessed data. More importantly, without grouping, both incur the 128 KB minimum charge, making them equally inefficient for small files.

No. DataSync transfers files as they are. To optimize cost for millions of small files, you must pre-process them into larger archives using external tools before or during migration.

The AWS documentation states that the maximum IOPS for an io1 volume is strictly capped at 64,000, regardless of volume size or cost.

Standard LVM striping (RAID 0 equivalent) does not provide redundancy; if one volume fails, the striped set is corrupted. It is purely for performance aggregation.

AWS designed HTTP APIs with fewer features and lower per-request pricing; this scenario needs only Lambda invocation and SNS delivery, so those REST-only features add cost without value.

Yes; REST APIs support API keys, per-client throttling, request validation, AWS WAF, and private endpoints. The question specifies none of those, so HTTP API remains the most cost-effective answer.

No. Users must assume the role via the AssumeRole API call. The role provides temporary credentials, whereas users have permanent credentials.

Cognito is built for external end-users of web or mobile applications. Internal employees should use standard IAM identities or federated identity providers like Active Directory.

An AMI is a static image. While useful for deployment, the question asks for steps to resolve performance and availability. Using Compute Optimizer (A) and Auto Scaling (E) are the active mechanisms that achieve these goals.

No. Auto Scaling groups manage the number of instances (horizontal scaling). Vertical scaling involves changing the instance type size, which is best guided by tools like AWS Compute Optimizer.

Governance mode allows users with specific IAM permissions to override the retention lock, meaning data could be deleted or modified before the period ends, which violates strict compliance rules.

No. While versioning keeps previous versions, it does not prevent the deletion of the current version or provide legal holds. An attacker or admin can still delete the active object.

Yes, Fargate Spot is ideal for fault-tolerant, flexible schedule, or stateless batch jobs where interruptions are acceptable.

No, it provides recommendations for vCPU and memory limits; you must adjust task definitions manually or via automation based on its advice.

No, AWS WAF only works with Application Load Balancers (ALB), API Gateway, and CloudFront distributions, as it operates at Layer 7.

Shield Advanced protects against DDoS attacks (volumetric/protocol), not specific unauthorized IP access attempts. It doesn't filter legitimate traffic from bad IPs selectively like a Security Group.

Option D requires rewriting the web portal to host on S3/API Gateway and Lambda. This violates the explicit requirement for 'no code changes' and 'minimal implementation effort'.

No. Spot Instances are interruptible and cannot guarantee the 100% uptime required by the employee web portal. On-Demand or Reserved Instances are necessary for high availability.

SQS adds buffering and decoupling, changing the architecture. The question asks for direct invocation via subscription, making direct permissions the simpler, correct path.

No. For receiving events from SNS, Lambda uses a Resource Policy (allowing invocation), not an Execution Role (which defines what resources Lambda can access internally).

AWS Auto Scaling Groups are region-specific resources. They manage capacity within a single AWS Region. To scale across regions, you must deploy separate ASGs in each target region.

No. Cross-region read replicas introduce higher network latency compared to local AZ replicas. For reducing read latency in a primary region, local Aurora readers in different AZs are superior.

Parameter Store does not have native automatic rotation features. Implementing rotation would require writing custom Lambda functions, increasing operational overhead.

While you can import the SDK, a Lambda layer centralizes the retrieval logic/code for all functions. This reduces maintenance overhead when updating how secrets are fetched across thousands of functions.

60% CPU is a healthy operating level for a primary database. It indicates the instance is handling its workload efficiently without being overloaded. Right-sizing is typically recommended when usage is consistently above 80-90% or below 20%.

No, because the question explicitly states the company wants to provide enough performance for future growth. Deleting the replica removes the ability to offload read traffic, potentially causing bottlenecks during future peak periods.

No, SSE-S3 uses keys managed entirely by S3 and does not expose key rotation details or logs to CloudTrail. You cannot track or control the rotation process.

Customer Managed Keys (CMKs) incur a monthly fee of approximately $1 per key regardless of usage, whereas AWS Managed Keys have no monthly fee, only per-API request charges.

Multi-AZ provides high availability across zones but uses a fixed instance size. It does not automatically scale compute capacity up or down based on data volume.

No, DMS replication instances are managed services. You cannot attach them to EC2 Auto Scaling groups. Use DMS Serverless for automatic scaling.

Direct Connect provides a private physical connection but traffic is unencrypted by default. You would need to configure MACsec or run a VPN over Direct Connect to achieve encryption.

Transit Gateway itself is a router and does not encrypt traffic. However, you can attach IPsec VPN devices to it to encrypt traffic, making it a viable but more complex solution than Option C for this specific scenario.

SSE-S3 keys are region-specific. If you replicate to another region, the destination region cannot decrypt the data unless the key is shared, which SSE-S3 does not support natively.

Yes, Amazon Athena is a fully serverless, interactive query service that lets you analyze data in S3 using standard SQL without managing infrastructure.

Glacier Deep Archive has retrieval times of 12+ hours, which may delay the bi-annual AI training process. Immediate access is preferred for operational workflows.

One Zone-IA stores data in a single Availability Zone. It is less durable than multi-AZ options like Standard-IA but significantly cheaper, suitable here if backups exist elsewhere.

Lambda has cold start issues and execution timeouts. Loading 1GB of data repeatedly for irregular traffic makes it slower and less reliable than persistent ECS containers.

Yes. SQS provides buffering and decoupling. An ALB cannot buffer thousands of concurrent requests effectively if the backend is slow, leading to timeouts.

Option D sets the ASG capacity to zero, implying no instances are running. For a 30-minute RTO with Aurora Global DB, you need the database infrastructure ready to promote immediately. While global DB is fast, Option A represents the 'Warm Standby' pattern more accurately by keeping minimal resources alive, whereas D might imply a slower start-up sequence or misinterpretation of Pilot Light vs Warm Standby.

Yes. Aurora Global Database replicates data asynchronously across regions. Promoting a secondary cluster to primary status typically takes less than a minute, well within the 30-minute limit.

Spot Instances can be interrupted by AWS at any time. The question explicitly states the batch jobs 'cannot be disrupted,' so only On-Demand or Reserved Instances provide the necessary reliability.

Glacier Instant Retrieval has a 90-day minimum storage duration. Since data transitions out after 30 days, using Instant Retrieval would be inefficient and potentially incur extra fees. Deep Archive is cheaper for long-term retention.

State Manager is designed for maintaining desired configurations (compliance), not for simple scheduled start/stop events. Using it requires more setup than EventBridge's native scheduling.

No, CloudWatch Alarms trigger on metric thresholds (like CPU usage), not time-based schedules. EventBridge is the correct service for time-based triggers.

No, it does not reduce the volume of data transferred. It simply changes the billing entity from the bucket owner to the requester.

Replication triggers cross-region data transfer charges that the source bucket owner must pay, thereby increasing their costs rather than minimizing them.

No. Global Accelerator operates at Layer 4 and does not support AWS WAF integration. You must apply WAF to a supported resource like an ALB, API Gateway, or CloudFront distribution.

The question asks for the LEAST implementation effort. Since the ALB is already part of the architecture, adding WAF there requires no new infrastructure deployment, unlike introducing a new CloudFront distribution.

It queries the live DynamoDB table directly, so each SQL scan consumes provisioned read capacity units and can slow the customer-facing website.

No. It exports a point-in-time-recovery snapshot to Amazon S3, and AWS documents that this export process does not consume the source table's provisioned read capacity.

SSE-KMS encrypts data after it arrives at S3. The question requires encryption to happen before the data is stored, which SSE-KMS cannot do.

Option A specifically requires customer-managed keys. Using client-side encryption with AWS KMS or S3 managed keys would not fit the specific key management constraints implied by the correct answer context.

It shortens the path to the ap-northeast-1 bucket but every server still retrieves all 100 files from that Region, with no edge caching to serve repeated downloads locally.

Disabling caching means CloudFront never stores the software files at edge locations, so every request returns to ap-northeast-1 and the latency reduction is effectively lost.

FSx for Windows provides SMB/NFS file shares, not block storage. Stock trading apps often require block-level access for performance.

No. EBS volumes are single-AZ. Replicating them across AZs requires manual setup or third-party tools, increasing implementation effort significantly.

It opens the ALB's egress to the entire internet when the ALB only needs to reach the web application instances. Egress should be scoped to the instances on 443 and 8443, as in options C and E.

No. The instances never initiate connections to the ALB; the ALB initiates both forwarding and health check connections. That inbound rule belongs on the instance security group with the ALB security group as its source.

CloudFront is a global service. For public certificates associated with custom domain names, AWS mandates that they be provisioned in the us-east-1 Region only.

Yes. OAC restricts access to the S3 bucket so that only CloudFront can access it. While often used for downloads, it secures the origin for any authorized interaction, including uploads if the application logic permits.

Yes, Athena can query data encrypted with CSE-KMS if the IAM role used by Athena has permission to decrypt the data using the KMS key.

S3 Select is optimized for retrieving subsets of data from individual objects, whereas Athena provides a full SQL engine capable of complex aggregations like moving averages across datasets.

Geolocation routes based on the user's country or continent, not true geographic proximity. It cannot dynamically calculate the closest region as geoproximity does.

Yes, NLB supports internet-facing traffic and can distribute across Availability Zones, though ALB is often used for HTTP/HTTPS-specific features.

Because the scenario states there is a dedicated bucket for each customer, meaning the number of buckets is dynamic. Listing them all in an IAM policy would require constant updates and high operational overhead.

A VPC Gateway Endpoint provides a private connection to S3 within the AWS network, avoiding the cost and complexity of NAT Gateways and keeping traffic off the public internet.

ALB listeners only support HTTP, HTTPS and gRPC at Layer 7, so they cannot forward a plain TCP workload. A Network Load Balancer handles TCP at Layer 4 with less per-connection processing.

No. Spreading instances across two AZs helps, but the app still needs a single resilient entry point. The NLB provides healthy-target routing across both AZs as capacity changes.

Data transfer from EC2 to S3 is free within the same Region. However, the question focuses on EC2-to-EC2 transfer, which incurs costs across AZs.

Being in the same Region is not enough. If instances are in different AZs, AWS charges for the data transferred between them. Same AZ means zero cost.

Lambda has a 15-minute maximum execution timeout and limited ephemeral storage, so it cannot handle continuous processing tasks that run for 20 minutes on terabyte-sized videos.

S3 Intelligent-Tiering automatically moves objects between access tiers based on changing access patterns, reducing storage costs for large video files without operational overhead.

Because it scales the Auto Scaling groups on 'notifications that the queues send.' SQS is pull-based and does not send notifications that resize capacity; you scale instead on queue depth via target tracking or a CloudWatch alarm.

Messages stay durably stored in the queue while fulfillment instances are added or terminated, so a slow fulfillment tier only builds a backlog instead of dropping orders. Default retention is four days, configurable up to 14.

Mountpoint for Amazon S3 is a Linux FUSE client for compute running inside AWS and offers no on-premises cache, so reads would hit S3 over the network and add latency.

Yes. The gateway stores file contents and metadata as S3 objects and only caches frequently accessed data locally, so you avoid paying for a full second copy in FSx.

Amazon Lex builds conversational voice and chat bots; it does not detect sentiment. Amazon Comprehend is the NLP service designed to analyze text sentiment, so option D fails on service fit.

DynamoDB TTL automatically deletes items after the specified timestamp, so setting it 365 days ahead keeps each survey result available for the previous 12 months without custom cleanup code.

SSE-S3 uses Amazon S3-managed keys, not customer-controlled KMS keys, and it is server-side encryption applied in S3 after Glue writes the data, not while Glue processes it.

Yes. A Glue security configuration can reference a customer managed KMS key ARN, so with one job per customer you can use a distinct KMS key for each customer's clinical trial data.

It fixes capacity at two instances that must be scaled by hand, so it cannot react seamlessly to busy periods and never scales back down to save cost.

No — the app is stateless and highly resilient, and the Auto Scaling group plus ALB health checks replace reclaimed Spot capacity with new Spot or On-Demand instances.

SCT converts database schemas and code to a new engine, which is re-platforming rather than rehosting the VM. Lift-and-shift uses AWS Application Migration Service block-level replication with the AWS Replication Agent instead.

Yes. Writes must stop so the final delta can replicate, otherwise the cutover instance would boot from an inconsistent point. Test instances run earlier while the source is still live.

A user pool only authenticates users and issues OIDC/JWT tokens for your app. Only an identity pool exchanges those tokens for temporary, IAM-scoped AWS credentials that can access S3.

Yes — a gateway endpoint lets instances in the private subnet reach S3 over the AWS network without a NAT gateway or internet exposure, which is part of the secure integration.

Spot Instances can be reclaimed by AWS at any time, and the question explicitly states the instances cannot tolerate interruptions, so options C and D are eliminated.

The Monday–Saturday workload runs constantly and needs no instance-family or OS flexibility, so Standard RIs provide a deeper discount than Convertible RIs.

AWS Batch is fully managed: it builds the compute environment, queues, schedules and retries jobs automatically, while an ECS design forces you to size clusters, manage Spot interruptions and maintain task definitions.

S3 gives near-unlimited, low-cost, durable object storage with no filesystem to operate, whereas FSx or EFS are only warranted when the workflow needs a shared POSIX filesystem.

Global Accelerator endpoints must be ALB, NLB, EC2 instances, or Elastic IPs; an S3 bucket is not a supported endpoint, so option D is invalid.

CloudFront already caches images at edge locations worldwide; adding multiple buckets, replication rules, and redirects increases cost and operational effort without replacing the need for edge caching.

It also keeps traffic off the internet via PrivateLink, but it is billed hourly per Availability Zone plus per GB processed, while the S3 gateway endpoint is free.

No. Gateway endpoints are route-table targets, not ENIs, so access is controlled by endpoint policies and bucket policies rather than security groups.

Custom endpoints only route traffic to chosen instances within a cluster; they don't pool, queue, or multiplex client connections, so spiky Lambda invocations would still overwhelm the PostgreSQL instance.

The RDS for PostgreSQL instance is private and has no public endpoint, so functions outside a VPC cannot reach it; attaching them to VPC subnets with proper security groups is mandatory.

Direct Connect provides dedicated bandwidth, but VPC peering is non-transitive and must be manually created for every new VPC. As the number of VPCs grows, the administrative overhead of managing many peering connections exceeds that of Transit Gateway.

Yes, Transit Gateway supports both VPC attachments and Direct Connect attachments (for dedicated lines) or VPN attachments (for IPsec). This allows you to centrally manage all hybrid connectivity from a single gateway.

Assigning to users does not scale well. Adding a new developer requires assigning the permission set individually to every new user, whereas adding them to a group applies it automatically.

A Group is a collection of users. A Permission Set is a set of IAM permissions (like an IAM role). You attach Permission Sets to Groups to grant those permissions to all members of the group.

Lambda requires custom code, deployment, and maintenance. AWS Config Managed Rules are pre-built, serverless, and require zero configuration effort, better meeting the prompt's constraints.

The default managed rule only evaluates and flags non-compliance. To automatically fix it, you would need to create a custom rule or trigger a remediation action via Systems Manager Automation.

Random prefixes prevent throttling on a single prefix but do not increase the speed of transferring a single large object.

No, access points simplify security policy management per application but do not change the underlying transfer mechanism's speed.

Maintaining custom replication and failover for an embedded database across AZs creates high operational overhead, violating the 'least overhead' constraint.

Yes, in the context of this exam scenario, AWS DMS is the recommended tool for migrating data from self-managed or embedded database engines to managed services like DynamoDB.

Sticky sessions bind users to specific EC2 instances. If the instance fails or scales out, the session/cart data is lost, violating the persistence requirement.

No. OpenSearch is for search and log analytics. It lacks the low-latency, high-throughput key-value features required for real-time session state management.

CloudTrail logs API calls for security and compliance auditing. It does not capture application performance metrics, latency between services, or internal code execution paths required for troubleshooting.

No. ElastiCache is used to cache data and reduce database load to improve response times. It is a performance optimization tool, not a monitoring or observability service.

WAF operates at Layer 7 and requires specific rule criteria. Blocking 'unknown' random IPs is impossible without blackholing all traffic, making it unsuitable for volumetric DDoS defense.

No, Shield Advanced provides automatic mitigation for common attacks. It integrates seamlessly with ALBs and CloudFront with minimal setup, unlike custom firewall rules.

Glue is an ETL tool for transforming structured/semi-structured data, not for simple file replication. It adds unnecessary complexity and cost for syncing files.

Use Direct Connect when you need consistent, high-throughput connectivity for large-scale data migration or hybrid cloud applications, not for small periodic backups.

ALB operates at Layer 7 (Application Layer) and only supports HTTP and HTTPS protocols. It cannot route raw UDP traffic, which is essential for many online games.

Only if you need to inspect traffic with a third-party virtual appliance like a firewall. For pure traffic distribution, NLB is significantly more cost-effective and performant.

Read replicas generally replicate within the same engine. For different engines like MySQL to PostgreSQL, you need DMS to translate the schema and data types.

CDC captures ongoing changes in the source database, allowing you to keep the target synchronized until you switch applications over.

CloudTrail logs API calls to AWS services, not the HTTP requests processed by the ALB. For traffic visibility, you must use ALB access logs.

Yes. Athena is serverless and requires no infrastructure management, whereas EMR requires provisioning and managing EC2 instances and clusters.

A NAT Gateway routes traffic through the public internet, whereas a VPC Endpoint keeps traffic entirely within the AWS private network.

No, IAM policies control permissions but do not restrict the network path; traffic can still traverse the public internet.

ElastiCache adds complexity and potential data consistency issues. RDS Proxy is natively integrated with Aurora to handle connection pooling efficiently without modifying data access patterns.

Reader instances primarily offload read queries. However, reducing overall load on the primary writer via read distribution helps prevent resource exhaustion that contributes to timeouts.

DynamoDB has a strict maximum item size of 400 KB. Storing 20 MB photos would exceed this limit by 50x, causing write failures.

Not necessarily. Standard-IA has higher per-request costs and retrieval fees. Intelligent-Tiering eliminates retrieval fees and optimizes automatically for unpredictable patterns.

Lambda has a maximum execution timeout of 15 minutes. Since the report takes 20 minutes, Lambda cannot complete the task.

No, Spot Instances can be interrupted with little notice. This makes them unsuitable for stateful, long-running tasks like report generation where interruption causes failure.

A Direct Connect gateway allows you to connect your Direct Connect connection to multiple Transit Gateways across different Regions or accounts, providing greater flexibility and scalability.

Yes, route propagation automatically adds routes from the Transit Gateway to the attached VPCs' route tables, eliminating manual maintenance for new subnets or changes.

HPA scales the number of pod replicas within existing nodes, while Cluster Autoscaler adds or removes nodes from the cluster when pods cannot be scheduled.

Karpenter is a newer, faster alternative, but Cluster Autoscaler remains the standard exam answer for general Kubernetes autoscaling scenarios unless specified otherwise.

Each part of an incomplete multipart upload is stored as a separate object in S3, incurring standard storage charges until the upload is completed or aborted.

No, Lifecycle policies for incomplete multipart uploads only support deletion or aborting, not transition to different storage classes like Glacier.

PITR allows you to restore data after deletion but does not prevent the deletion event itself, so it fails to stop the operational disruption.

No, Deletion Protection is a metadata setting that only impacts the DeleteTable API call and has no effect on table performance or latency.

Yes, but it won't handle unexpected spikes. The question requires handling 'live changes', so Dynamic is necessary alongside Predictive.

Scheduled scaling is rigid and time-based. It cannot react to 'live changes' in utilization or adapt to unpredictable variations in daily/weekly trends.

Yes, strongly consistent reads may have slightly higher latency than eventually consistent reads because they gather data from all replicas before responding.

No, GSIs only support eventually consistent reads. You cannot request strong consistency on a Global Secondary Index.

No, WAF must be associated with an Application Load Balancer (ALB), CloudFront distribution, or API Gateway, not directly with EC2.

Security Groups filter traffic by IP and port (Layer 3/4), whereas SQL injection occurs within the HTTP request payload (Layer 7).

CloudTrail logs API calls but does not analyze database-specific login patterns for anomalies like brute force attacks automatically.

Yes, the RDS Protection feature extends to Amazon Aurora databases, monitoring both MySQL and PostgreSQL engine types.

VPC Peering connects VPCs to each other but does not inherently route traffic to on-premises data centers. Achieving this would require additional complex routing setups, increasing operational overhead.

Yes, but in this scenario, since the company acquired another corporation, they may need to ensure all VPCs are associated correctly. However, the key architectural pattern for multi-region DX is the Direct Connect Gateway.

SQS FIFO maintains order but has lower throughput than Kinesis and incurs higher management overhead if paired with EC2, which violates the prompt's constraints.

Yes, DynamoDB replicates data across three Availability Zones by default, providing built-in high availability without manual configuration.

Lifecycle policies manage storage class transitions and expiration within a single bucket, not copying objects between different buckets or accounts.

While compute costs might be low, Lambda adds significant operational overhead for maintenance, debugging, and permission management, violating the 'minimal overhead' requirement.

S3 Default Encryption typically uses SSE-S3 or SSE-KMS. SSE-C requires the client to send the key with every PUT request, so S3 cannot automatically encrypt new uploads without external key management integration.

No. AWS Usage Reports provide aggregate usage metrics (like storage size or request counts) but do not contain object-level metadata such as encryption status. S3 Inventory is required for this level of detail.

Private hosted zones are only accessible from within specified VPCs. They cannot resolve records for users on the public internet.

No, importing the zone file only updates the DNS records in Route 53. You must also update your domain registrar's NS records to point to Route 53 name servers.

Parameter Store can store secrets, but Secrets Manager offers automatic rotation and auditing out-of-the-box, reducing admin overhead for database credentials.

No, AppConfig is a general-purpose configuration management service that can deploy any type of application setting, not just feature flags.

EBS Optimized guarantees bandwidth for storage I/O between the instance and EBS, not for network traffic between EC2 instances.

No, separate accounts add administrative overhead and do not influence the physical network path or latency between instances.

Amazon S3 is object storage and does not support the SMB protocol. Applications expecting SMB shares cannot access S3 directly without modification.

Direct Connect is a network link, not a transfer tool. DataSync optimizes transfers over any network (including Direct Connect) by compressing and parallelizing data, reducing operational overhead.

IAM users are standalone AWS identities and cannot be linked directly to an external IdP for authentication. You must use IAM roles for federation or IAM Identity Center.

No, AWS RAM is for sharing AWS resources (like VPCs or RDS instances) between accounts, not for managing user identities or authentication.

Resource-based policies are attached to AWS resources (like S3 buckets or DynamoDB tables) to define who can access them. They cannot be attached to IAM identities like users, groups, or roles.

AdministratorAccess is a managed policy that grants full access to all AWS services and resources. SystemAdministrator is a managed policy that grants access to only a limited subset of services (around 28).

SNS is a publish-subscribe service that does not guarantee message ordering or deduplication. It may deliver duplicate messages or lose them under high load, failing the exactly-once requirement.

No. EKS requires managing Kubernetes control planes, worker nodes, and configurations, which significantly increases infrastructure management compared to the fully managed Lambda service.

It primarily reduces the impact of failover on applications by handling reconnections, rather than speeding up the underlying DB promotion.

Multi-AZ handles infrastructure failover but doesn't manage application-side connection pools, leading to potential connection exhaustion errors.

Lambda is event-driven and short-lived, so it does not provide ECS-style task spreading across three AZs or a meaningful minimum capacity of 3 for an always-on container service.

Self-managed EKS requires you to install and maintain node components such as kubelet and kube-proxy, while ECS manages more of the orchestration and integrates directly with service auto scaling.

IAM Identity Center requires the upstream identity provider to support SAML 2.0. If your LDAP is not SAML-compatible, it cannot establish the trust relationship needed for SSO.

AWS STS issues temporary security credentials. The custom broker uses these to allow LDAP users to assume IAM roles, providing secure, short-lived access to AWS resources.

Cross-account copying provides robust disaster recovery but involves high operational overhead for management, unlike the automated Retention Rules in Recycle Bin.

No, Recycle Bin protects against accidental deletions only. Malicious deletions bypass these retention rules unless additional IAM controls are in place.

Snowmobile is optimized for exabyte-scale (up to 100PB) moves. It is far too expensive and unnecessary for only 150TB.

It takes approximately 17 days of continuous 100% utilization. Since uploads are only allowed at night, this becomes even more constrained and risky.

IAM policies are identity-based and attached to identities in your account. To use them for cross-account access, the external party must assume a role, which requires trust configuration and potentially affects their permissions.

It is a resource-based policy attached directly to the SQS queue that specifies which AWS principals (accounts/users) can perform actions like SendMessage or ReceiveMessage.

A bastion host must reside in a public subnet to receive inbound traffic from the internet. Instances in a private subnet cannot accept direct inbound connections.

There is no additional charge for the Session Manager service itself, but you pay for the underlying EC2 instance hours and data transfer costs as usual.

AWS Backup is valid but requires policy management. PITR is simpler, continuous, and optimized for frequent small restores.

Yes, once enabled, PITR retains data for 35 days by default, easily covering the 24-hour requirement without extra setup.

While SNS can trigger Lambda, S3 native event notifications are the direct, standard integration for object creation events, offering better cost-efficiency and simplicity.

Kinesis is appropriate for continuous, high-throughput data streams requiring real-time analytics, not for sporadic file uploads processed in batches.

No. AWS SCT is required to convert the source schema (Oracle) to the target format (PostgreSQL) before DMS can migrate the data.

DataSync synchronizes files to/from S3, not relational database transactions. It cannot capture ongoing SQL changes in real-time.

AWS Config managed rules are pre-built and maintained by AWS, requiring zero code maintenance. Lambda requires you to write, deploy, and maintain the script, increasing operational overhead.

SCPs can deny the creation of insecure rules, but they do not provide the notification mechanism requested. The question asks for notification upon breach, which SCPs alone cannot do.

NLB requires manual creation of target groups and endpoints for each service, increasing overhead. VPC Lattice automates discovery.

Yes, VPC Lattice is designed to simplify service connectivity across multiple AWS accounts and regions seamlessly.

Launch permissions only allow the user to initiate the launch process. Since the AMI uses KMS-encrypted snapshots, the launching instance role/account must also have KMS Decrypt permissions to read the snapshot data.

Yes, but it is less scalable. Using OU ARNs (Options A and C) allows all current and future accounts in that OU to inherit the permissions automatically, whereas account ARNs require manual updates for each new account.

Groups can only contain IAM users within the same AWS account. Cross-account access requires a Role with a trust policy.

Generally no. Roles provide temporary credentials, reducing risk. Users require long-term secrets which are harder to manage securely externally.

Cost Explorer is an analytics tool for viewing historical and forecasted data. It does not have a built-in feature to send notifications when a spending threshold is crossed.

Yes, to track spending by department, you must first tag your resources with the relevant department identifiers and activate those tags in the Billing Console.

A Public ALB is associated with a public subnet and has a public DNS name, making it accessible from the internet. An internal ALB stays within the VPC/private network.

Yes. The NAT Gateway itself resides in a public subnet and requires an Internet Gateway attached to the VPC to route traffic to the internet.

DynamoDB Streams capture changes but are not inherently immutable or cryptographically verifiable against tampering like QLDB's central ledger authority.

QLDB is generally cost-effective for transactional ledgers compared to provisioning a full Redshift cluster, especially given its serverless nature.

Lambda lacks native distributed state management and complex dependency ordering. You would have to write custom code to track job states and handle retries, which increases operational overhead.

No, AWS Data Pipeline is largely legacy. For modern ETL and data preparation workflows, AWS Glue combined with Step Functions offers a more flexible, serverless, and managed alternative.

Systems Manager manages running instances but lacks the automatic discovery of dependencies and historical usage metrics required for migration assessment.

Migration Hub acts as a central dashboard to track progress, while Application Discovery Service performs the actual data collection task described in the question.

Control Tower requires the management account to act as the root of trust for the organization. Deploying it in a member account breaks the hierarchical governance structure.

No, they serve different purposes. GuardDuty detects threats, while Security Hub aggregates findings and checks compliance against standards like FSBP. They work together.

While both query S3, Athena is typically more cost-effective for occasional use as it has no cluster maintenance and a simpler pay-per-query model compared to Redshift Spectrum.

For Parquet files, a crawler helps automatically discover the schema and partitioning, saving manual table definition time. However, you can also create tables manually in the Glue Data Catalog.

NAT Gateways handle outbound traffic from private subnets. Inbound web traffic requires a Load Balancer or Public Subnet.

No, vertical scaling (larger instances) does not eliminate single points of failure. You need redundancy across multiple instances/AZs.

Parameter Store is a valid alternative, but the question specifically tests the native Lambda encryption helper feature which allows direct encryption of environment variables without changing how the code retrieves them.

No, the decryption happens transparently by the Lambda runtime before your code executes. The developer simply sees the decrypted value as a standard environment variable.

Global Accelerator optimizes traffic for internet-facing apps across regions, not the low-latency, intra-cluster communication required by tightly coupled HPC nodes.

While EBS provides block storage, FSx for Lustre is specifically designed for HPC to deliver higher throughput and lower latency for shared file systems accessed by many instances simultaneously.

Yes, AWS allows registering up to eight MFA devices of any type (virtual or hardware) for the root user to ensure redundancy.

A new admin account does not grant access to the root user credentials. If the root MFA is lost, only additional registered MFA devices for the root user can unlock it.

Kinesis is built for high-volume data processing pipelines, not simple notifications. It requires custom consumers to read and deliver messages, adding unnecessary development effort.

Yes, SNS is designed to scale horizontally and can fan out messages to thousands of subscribers simultaneously with minimal latency and operational overhead.

Forecast is for time-series predictions, not text entity extraction.

No, SageMaker requires ML expertise to build and train models.

DataSync duplicates data, incurring extra storage costs and sync complexity. VPC peering allows direct access to the single source of truth, which is more cost-effective.

No. Cross-account access to EFS from Lambda requires network connectivity, typically established via VPC peering, Transit Gateway, or AWS PrivateLink.

AWS KMS manages the keys within the AWS Cloud environment. The requirement explicitly states keys must be managed outside the AWS Cloud.

Yes. Since data is encrypted before leaving the data center, it remains encrypted during transit via HTTPS and at rest in S3.

API Gateway is preferred for receiving HTTP requests from mobile devices directly. SQS is typically used for decoupling microservices or background job queues, not as the primary ingress point for mobile apps.

Standard EKS requires managing worker nodes (EC2). While EKS on Fargate exists, Option B specifies 'self-managed nodes,' making it operationally heavy compared to pure ECS Fargate.

IAM Identity Center is designed for employee access to AWS services, not for consumer-facing app authentication. It lacks the specific risk-based adaptive triggers for individual user devices and locations found in Cognito.

User Pools manage user identity (sign-up/sign-in), while Identity Pools provide temporary AWS credentials to access AWS resources after authentication. Only User Pools handle the adaptive authentication logic described.

While Snowball Edge supports container workloads, it is not a long-term, managed extension of AWS like Outposts. Outposts is the standard for running managed EKS clusters on-premises.

Local Zones are in AWS facilities near users, whereas Outposts are racks installed inside the customer's own data center, providing full control over physical data location.

Glue Studio is primarily for creating ETL jobs that may require code or complex mapping. It lacks the dedicated data profiling dashboard and simple 'recipe' sharing mechanism that DataBrew offers for non-technical analysts.

Yes, DataBrew supports various input formats including CSV, JSON, Parquet, and Avro, making it suitable for the described data lake ingestion pipeline.

While CNAME is often preferred for ALBs, AWS allows A records (alias records) for root domains or when specifically configured. The question focuses on the routing logic, not the record type nuance.

NLB does not support path-based or host-based listener rules in the same flexible way ALB does for HTTP/HTTPS content switching. ALB is the standard choice for this scenario.

Route 53 relies on DNS resolution, which can suffer from caching delays and variable resolver performance. Global Accelerator uses anycast IPs and the AWS backbone for more consistent, lower latency.

Yes, Global Accelerator can route traffic to ALBs, NLBs, EC2 instances, and Lambda functions. The choice depends on whether you need Layer 4 (NLB) or Layer 7 (ALB) termination.

S3 File Gateway only supports SMB and NFS protocols for on-premises file shares. It does not support SFTP, which is why AWS Transfer Family is required.

No. AWS DMS is designed for database migration and replication, not for providing persistent file transfer endpoints for external vendors.

SageMaker offers customization but requires significant operational overhead for training and maintenance. The question prioritizes 'least operational overhead,' making Comprehend the superior choice.

No, Textract is strictly for OCR and document structure extraction. It outputs raw text or forms/tables, requiring a separate service like Comprehend for semantic analysis.

Compression is variable; it may not reduce the data enough to fit under the 400 KB hard limit, causing write failures.

No, S3 is more cost-effective and operationally simpler for large binary objects. DocumentDB adds unnecessary management overhead.

Lambda has a maximum timeout of 15 minutes. Since the requirement specifies jobs running up to 20 minutes, Lambda cannot accommodate the full duration.

Yes, if the application is already containerized. You just need to ensure the Dockerfile works in Fargate, which requires no infrastructure changes.

VPC Peering only connects two AWS VPCs. Salesforce is an external SaaS provider and does not have a VPC that you can peer with.

No, DataBrew is a data preparation tool for ad-hoc cleaning. AppFlow is designed for automated, ongoing data synchronization between SaaS and AWS services.

Glacier has retrieval times ranging from minutes to 12 hours, which would break the application's ability to index and serve files in a timely manner.

Yes, generally S3 is cheaper for object storage. Intelligent-Tiering adds further savings by automating tier movement based on actual access patterns.

NLB operates at Layer 4 (TCP/UDP) and does not inspect HTTP payload content like query strings. Only ALB (Layer 7) can perform this inspection.

While ALB can use IAM certificates, AWS recommends using ACM for easier management and automatic renewal. The key differentiator here is the routing capability, not just the cert source.

RDS can be highly available, but the option didn't specify an Auto Scaling Group for the EC2s, making the whole solution less scalable than Option C's Serverless approach.

No, ElastiCache is for caching, not primary storage. It cannot replace the persistent MySQL database required by the application.

A simple trust (Option C) doesn't automatically make it the identity source for IAM Identity Center. You need the specific integration described in Option B.

No, it acts as a bridge. The two-way trust allows the cloud directory to validate users against the on-premises AD, preserving your existing management structure.

CloudTrail logs API activity but does not evaluate resource configurations against compliance frameworks. It proves who did what, not if the system meets NIST/PCI DSS rules.

No. Security Hub aggregates findings from multiple services including GuardDuty, Inspector, and Macie. It is a dashboard/aggregator, not a standalone detector.

No, S3 Intelligent-Tiering does not charge retrieval fees for any access tier, making it ideal for unpredictable access patterns.

Standard-IA charges per retrieval and is optimized for infrequent access. Random access would incur high retrieval costs and lacks the automated tiering of Intelligent-Tiering.

RDS struggles with performance when traversing multiple levels of relationships due to the computational cost of repeated JOINs or recursive CTEs.

No, Athena is designed for serverless interactive SQL queries on S3 data, not for low-latency graph traversal algorithms.

Direct Connect needs dedicated circuits or partner provisioning and can take weeks to activate, so it suits sustained high-bandwidth traffic, not the small, fast link described in the question.

A client VPN gives individual remote users access into a VPC; it does not build a network-to-network tunnel between a company's on-premises environment and AWS.

D omits AD Connector, so Directory Service has no path to the on-premises Active Directory; without that link, existing AD credentials cannot authenticate.

Not directly; you need AD Connector or an AD trust so Directory Service can query on-premises AD while preserving the current authentication mechanism.

Backup instances in Aurora are snapshots used for disaster recovery and cannot be accessed via an endpoint for live querying.

No, Multi-AZ provides high availability by synchronously replicating data to a standby. Read scaling requires explicit read replicas.

An ALB is a Regional resource, and its target group must contain targets in the same Region; it cannot route to instances or IPs in another Region for this multi-Region requirement.

It associates health checks with each record and returns only the values for healthy resources, so traffic is not sent to the Region whose website is unhealthy.

S3 is object storage accessed through APIs, not a POSIX file system that EC2 applications can mount. The existing applications need shared file access to 25 GB files, which EFS provides natively.

No. A snapshot must be restored into a volume first, and EBS Multi-Attach only works with io1/io2 volumes attached to instances in a single Availability Zone.

SSL/TLS is a transport protocol configured with certificates such as ACM, not KMS keys, and it protects data in transit only — it leaves EBS and RDS volumes unencrypted at rest.

No. RDS encryption covers the database storage, so option D also enables Amazon EBS encryption to protect the EC2 instance volumes where PII may be written.

SQS is a message queue, not a notification service. Messages sit there until a consumer polls and processes them, so options B and D would still need extra code to actually send an email.

Yes. A Scan reads the whole table, but with 15 items it is fast and inexpensive; a Query on an indexed start-date attribute would only matter at much larger scale.

No. Parameter Store can store a password as a SecureString, but it has no built-in rotation scheduler, so you would have to build and maintain your own Lambda rotator.

KMS key rotation replaces the cryptographic key material used to encrypt data or secrets; it never changes the PostgreSQL login password, so the credential itself would stay static.

Standard RDS for Oracle hides the OS and database host, so third-party tools needing privileged access cannot be installed or configured. RDS Custom for Oracle is the managed option that exposes that level of control.

Yes. RDS Custom for Oracle supports the Bring Your Own License model, letting the company reuse its existing Oracle Database Enterprise Edition licence instead of paying for new AWS-included licensing.

State Manager only enforces desired configuration state on managed nodes and can run scripts; it creates no backup vaults, retention policies, or restore workflows for RDS and DynamoDB.

No. AWS Config records and evaluates resource configuration compliance and can trigger remediation, but it has no native snapshot lifecycle management across those services.

An hourly sync can leave content stale for up to 60 minutes, and each EC2 instance stores its own EBS copy, so files diverge instead of staying shared in real time.

EBS volumes are scoped to one Availability Zone, and snapshots are point-in-time copies, so EC2 instances in other AZs cannot attach the same live volume or see new writes.

Firewall Manager centrally deploys and manages WAF web ACLs, Shield Advanced protections, and security group policies across accounts; it is a management plane, not a behavioral threat detection engine that produces findings.

No. Inspector only scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure, and it has no integration that rewrites AWS WAF rules.

AWS Private CA certificates are trusted only by clients that import your CA, so public browsers reject them. They also incur recurring CA and certificate charges, breaking the no-additional-cost requirement.

CloudFront is a global service whose control plane reads ACM certificates only from us-east-1 (N. Virginia); certificates from other Regions cannot be selected for an alternate domain name.

No. Public SSL/TLS certificates provisioned through ACM are free; you pay only for the AWS resources that run your application, so option C satisfies the cost constraint.

It creates long-lived credentials that must be scoped to the report, delivered to the consultant, and manually revoked after 7 days. A presigned URL expires automatically and grants object-level access only.

Yes. SigV4 presigned URLs generated with the AWS CLI can use --expires-in up to 604800 seconds (7 days), which matches the requirement exactly.

A capacity reservation only guarantees that EC2 capacity is held for you in a specific Availability Zone; it says nothing about how close the nodes are or how fast they talk. Latency and throughput come from the placement group, which can be used together with a reservation.

No. A cluster placement group is scoped to a single Availability Zone, which is what lets instances share a high-bandwidth, low-latency network segment. If you need multi-AZ resilience you would use a spread placement group instead, trading away the tight coupling.

A uses two locations and two separate devices, but only from the primary data center, so the secondary site has no dedicated Direct Connect connection and stays dependent on the primary.

No. One Direct Connect location remains a single point of failure, and each data center is single-homed, so D reaches high resiliency at best rather than maximum.

NAT gateways do provide outbound access, but they charge hourly plus per-GB data processing, so heavy S3 traffic becomes expensive and the data still leaves the AWS private network path.

Interface endpoints are needed for on-premises, peered, or cross-Region clients that cannot use route-table gateway endpoints, but they add hourly and per-GB charges that fail this cost requirement.

SSE-KMS encrypts objects only after they arrive at Amazon S3, so the plaintext reaches AWS first. The requirement demands encryption before transmission, which only client-side encryption provides.

No. An S3 managed key (SSE-S3) is a server-side encryption key managed by AWS; client-side encryption must use a key the application controls, such as an AWS KMS key.

Lambda has a 15-minute maximum execution timeout per invocation, and Step Functions cannot extend that limit. The job takes 30 minutes, so B cannot host the processing work.

Kinesis Data Firehose ingests streaming application data serverlessly and scales automatically, while AWS DMS is designed for database migration and replication, not near-real-time streaming ingestion.

Amazon S3 buckets cannot be registered as Network Load Balancer targets, since an NLB forwards Layer 4 TCP/UDP traffic to EC2 instances, IP addresses, or Lambda. Option B is therefore not a supported private path to S3.

Yes. It creates a private path to S3 within the AWS network, and the route-table entry for the S3 prefix list directs S3-bound traffic to that endpoint without an internet gateway, NAT device, or public IP.

CloudWatch provides raw EBS metrics but no right-sizing recommendations or dollar savings estimates; Compute Optimizer consumes those metrics to generate actionable recommendations.

Yes. It analyzes EBS volume utilization and can project monthly savings from changing volume type, size, or provisioned IOPS to match workload needs.

IAM Access Analyzer only evaluates bucket policies and ACLs for unauthorized access risks. It cannot check bucket properties like versioning.

AWS Config would also be a valid answer for auditing configuration compliance, but between Storage Lens and Access Analyzer, only Storage Lens reports on versioning status.

SNS Standard guarantees at-least-once delivery, meaning duplicates can occur. It does not guarantee message ordering, which is critical for order processing.

No. SQS FIFO queues scale automatically to handle high volumes of requests. You can also enable High-throughput mode to further increase throughput.

Standard Lambda runs in specific regions. For global low-latency access, Lambda@Edge executes code at CloudFront edge locations closer to the user.

No, S3 Transfer Acceleration is designed to speed up file uploads to S3, not to manage user access policies or authentication flows.

IAM policies must be maintained individually in each account. With many accounts, this creates high operational overhead compared to a single SCP applied at the organization level.

No. AWS Resource Access Manager (RAM) is used for sharing resources like VPC subnets or RDS instances between accounts, not for controlling API permissions or preventing resource creation.

The question specifies the application uses the transport layer (TCP), not the application layer (HTTP/HTTPS). An ALB is designed for Layer 7 routing and would be an unnecessary cost.

Route 53 can distribute traffic across AZs, but it does not perform health checks at the application level or balance loads within an AZ as effectively as an ELB. It also has DNS propagation delays, making it less ideal for immediate HA compared to an NLB+ASG setup.

ECS requires running containers continuously or warming them up, which is expensive for <100 visits/month. Lambda scales to zero.

SNS can subscribe to an email endpoint (SES or SMTP relay). It acts as the fan-out service to notify the team upon form submission.

CloudWatch is for operational metrics/logs, not for querying large S3-based financial reports like CUR.

QuickSight can connect to S3, but Athena provides the SQL engine needed to efficiently query structured CUR files for custom dashboards.

AWS security groups are stateful. Once an inbound rule allows traffic, the corresponding outbound response traffic is automatically allowed.

Yes, but using Security Group IDs is more dynamic and secure as it adapts to instance changes without manual IP updates.

No. Compute Savings Plans cover EC2, Lambda, and Fargate. SageMaker requires a Machine Learning Savings Plan.

No. You need at least two: a Compute Savings Plan for general compute and an ML Savings Plan for SageMaker.

No. AWS DMS migrates data between heterogeneous databases but does not modify or rewrite the SQL queries inside your application code.

Babelfish allows Aurora PostgreSQL to accept connections and T-SQL queries from existing SQL Server applications, eliminating the need to rewrite application code.

CloudTrail logs API calls but doesn't natively aggregate bucket configuration states like versioning status into a dashboard for easy identification.

Yes, S3 Storage Lens can collect metrics across multiple AWS regions and accounts if configured to do so, making it suitable for global companies.

Regional endpoints require the application to know which region is best and manage failover manually. MRAP provides a single global endpoint that AWS handles automatically.

No, MRAP only routes traffic. You must separately configure S3 Cross-Region Replication (CRR) to copy objects between the buckets in different regions.

No. Volume Gateway provides iSCSI block storage. Only Storage Gateway File Gateway supports SMB/CIFS.

While possible, EC2 requires manual OS patching, role installation, and HA configuration, creating higher administrative overhead than FSx.

Cross-Region Replication often involves asynchronous replication and lacks the seamless, managed automated failover capabilities inherent to Aurora Global Database.

No, it replicates data with no impact on database performance, providing low-latency reads and synchronous writes to secondary regions.

AWS Lambda has a maximum synchronous execution timeout of 15 minutes. Even with asynchronous invocation, processing a single continuous 1-hour stateful task is not supported.

EventBridge Scheduler is the newer, simplified scheduling service recommended for creating cron-based schedules for various AWS targets including ECS tasks, replacing older CloudWatch Events patterns.

Lake Formation is a governance tool. While it can host data, you still need to build the ingestion pipeline (e.g., with Glue), whereas Security Lake automates the collection of security-specific logs.

No, it aggregates CloudTrail along with VPC Flow Logs, GuardDuty findings, and third-party data into a single location for easier analysis.

Fargate is a serverless compute engine provided by AWS that runs exclusively within the AWS Cloud. It cannot execute on physical on-premises hardware.

No, NLB operates at Layer 4 (Transport Layer) and forwards raw TCP/UDP traffic. HTTP traffic requires Layer 7 processing, which is handled by an Application Load Balancer.

EC2 is Infrastructure as a Service (IaaS), requiring you to manage the OS, database software, and backups manually. This creates high operational overhead, contradicting the requirement to reduce it.

No. DynamoDB is a NoSQL database, while SQL Server is relational. Migrating would require significant application code changes to adapt to the different data model and query patterns.

No, AWS WAF cannot be directly associated with an Auto Scaling Group. It must be attached to a supported resource like an ALB, API Gateway, or CloudFront distribution.

Placement Groups are designed for low-latency, high-throughput networking between instances, not for high availability or fault tolerance across Availability Zones.

SQS provides buffering and retry capabilities, ensuring messages are processed even if Lambda fails or scales slowly. SNS is a pub/sub service that delivers notifications immediately but does not buffer messages if the subscriber is overwhelmed.

Yes, the maximum execution timeout for AWS Lambda is 900 seconds (15 minutes), which comfortably covers the 2-minute requirement specified in the scenario.

ALBs operate at Layer 7 and only support HTTP/HTTPS. They cannot process raw UDP or TCP streams required by the application.

Yes, Global Accelerator can route traffic to on-premises servers via IP addresses as endpoints, provided they are reachable from the AWS edge locations.

Yes, within the retention period, you can restore any EBS snapshot moved to Recycle Bin back to its original state.

Snapshots remain in Recycle Bin during the retention period, so you pay standard EBS snapshot storage fees until they are automatically deleted after the period expires.

Session Manager initiates outbound connections, so you don't need to open inbound port 22. It also provides encrypted sessions and detailed CloudTrail logs without managing SSH keys.

No, the SSM Agent must be installed and running on the EC2 instance to establish the secure channel with the AWS Systems Manager service.

Multi-AZ standbys are strictly for failover and are not exposed for endpoint connections. You cannot route read traffic to them.

No, cross-Region replicas incur data transfer charges between regions, making them more expensive than same-region replicas for identical functionality.

Standard monitoring collects metrics every 5 minutes. Detailed monitoring collects metrics every 1 minute and incurs additional costs.

CloudWatch Logs store application logs, not performance metrics. For performance analysis, use CloudWatch Metrics.

EC2 incurs hourly charges while running. For 150 daily uploads, paying for 24/7 uptime is far more expensive than paying milliseconds of Lambda time.

No. S3 Storage Lens is strictly for analytics and dashboards. It cannot execute code or interact with other AWS services like Lambda.

EC2 is not serverless and incurs ongoing costs and management overhead. The question specifically requires a serverless solution.

Yes, but for complex logic like excluding retained subsets, Lambda provides the necessary flexibility to process each object's metadata during the batch job.

While bucket policies can use ARN conditions, they are less flexible and harder to manage for many functions compared to dedicated IAM roles.

No, this violates least privilege. You should create separate roles to limit access to only what each specific function needs.

While DynamoDB persists data, ElastiCache Redis offers lower latency for frequent read/write updates typical in real-time leaderboards.

No, Memcached is purely in-memory. Any restart results in total data loss, making it unsuitable for this requirement.

Storing keys in S3 lacks the centralized audit trail and fine-grained access control that AWS KMS provides natively.

While there is a small cost per key, it is negligible compared to the operational overhead of managing external appliances or manual key storage.

SQS decouples the web tier from the processing tier, allowing the system to absorb traffic spikes without losing orders or crashing.

Multi-AZ ensures high availability and automatic failover, meeting the requirement to not lose customer orders during failures.

It demonstrates the architectural pattern. Even if currently set to one instance, it configures the system to scale out if needed, unlike a static instance.

No. RDS Read Replicas are strictly read-only. Any write operations must go to the primary DB instance to maintain data integrity.

Amazon Inspector scans EC2 instances and container images for software vulnerabilities, not IAM policies or user permissions.

Yes, when enabled in AWS Organizations, it can analyze resources and permissions across all member accounts centrally.

WAF focuses on web application layer threats like SQL injection, whereas DDoS attacks overwhelm infrastructure capacity, requiring Shield.

Yes, Shield Advanced can protect Route 53 DNS records to prevent DNS-based DDoS attacks alongside EC2 and ALB resources.

Lambda doesn't need KMS permissions directly. However, the SNS service needs KMS permissions in the key policy to encrypt the message on behalf of Lambda when using a CMK.

No. Specifying the ARN (Option D) allows the call, but without the KMS key policy (Option C), the SNS topic cannot encrypt the payload using the Customer Managed Key.

Network policies only filter traffic (allow/deny). They do not assign IP addresses or determine which VPC subnets pods are placed in.

Yes, the VPC CNI plugin supports both IPv4 and IPv6 addressing for pods, allowing flexible subnet configuration.

Yes, you can modify an existing RDS instance to enable Multi-AZ deployment during a maintenance window or immediately.

Migrating to DynamoDB requires schema redesign and application changes, which contradicts the 'least implementation effort' requirement.

No, Amazon S3 File Gateway only exposes data via the NFS protocol. It cannot serve SMB shares to Windows clients.

No, FSx for Lustre is optimized for high-performance computing and only supports the NFS protocol.

Cost Explorer helps visualize and forecast costs but does not provide specific resource-level optimization recommendations like Compute Optimizer does.

Yes, AWS Compute Optimizer analyzes EBS volume usage and provides recommendations to right-size volumes or switch to more cost-effective storage classes.

Standard EBS volumes attach to one instance. Multi-Attach allows limited sharing on specific io1/io2 volumes, but EFS is the primary solution for general-purpose multi-instance file sharing.

S3 is object storage accessed via API/SDK. It cannot be mounted as a native file system volume like EFS or EBS, making it unsuitable for applications requiring POSIX file semantics.

No Upfront preserves cash but offers the smallest discount. Since the question asks for 'MOST cost-effective,' total price matters more than cash flow timing.

EC2 Instance Savings Plans offer similar discounts to RIs but provide flexibility across instance families. Both are valid cost-saving mechanisms when paired with All Upfront/Long Term.

Attaching to the node grants permissions to all pods on that node, violating least privilege. IRSA scopes permissions to specific service accounts.

The OIDC provider enables the IAM role to trust tokens issued by the EKS cluster's Kubernetes service account, allowing dynamic assumption of the role.

Yes. You must explicitly activate Cost Allocation Tags in the Billing Console. Until activated, AWS ignores them for billing segmentation.

Running an RDS instance incurs hourly costs. Cost Explorer is included with AWS billing at no extra charge, making it far more cost-effective for simple reporting.

NLBs do not support the GENEVE protocol required by most third-party security appliances for transparent traffic inspection.

It acts as a target for traffic, directing it via GENEVE tunnels to the GWLB in the networking account for inspection.

No. The Reader Endpoint balances traffic across ALL available reader instances in the cluster and does not support filtering or excluding specific nodes.

Aurora automatically removes the failed instance from the custom endpoint and routes traffic to the remaining healthy members in that specific group.

Parameter Store does not have a native, built-in mechanism for automatically rotating secrets. You would need to build and maintain custom Lambda functions or scripts to handle rotation, which increases operational overhead significantly compared to Secrets Manager.

No. AWS KMS is designed for managing encryption keys used to encrypt data. It is not intended for storing application secrets like database usernames and passwords, nor does it provide functionality for rotating those credentials.

PrivateLink is bidirectional; the SaaS provider needs to send data back to your VPC. Blocking all inbound would break the service.

Transit Gateway routes traffic but doesn't provide the private service endpoint integration that PrivateLink offers for SaaS APIs.

Parameter Store stores secrets securely but does not have a built-in feature for automatic rotation. You must write custom Lambda code and logic to rotate them, which violates the 'minimal programming effort' requirement.

No. KMS is used to encrypt data, including the secrets stored in other services like Secrets Manager. It does not store or manage the lifecycle of database credentials themselves.

VPN traffic crosses the public internet, so latency is variable and cannot be guaranteed at single-digit milliseconds. It is cheaper, but it fails the stated latency requirement.

A transit VIF is what allows the Direct Connect gateway to be associated with a Transit Gateway, giving one dedicated connection reach to every attached VPC.

SNS is a pub/sub messaging service that delivers messages to multiple subscribers instantly. It does not store messages for later retrieval or handle retries for failed consumers, making it unsuitable for durable job queuing.

CPU usage is only a good proxy if each job has a consistent and predictable computational cost. If job complexity varies, queue depth (backlog) is a much more accurate indicator of the required compute capacity.

Lambda is function-as-a-service, which can be hard to modularize from a monolith. Containers on Fargate allow you to break down services more naturally while keeping code packaged together.

No. EKS requires managing the Kubernetes control plane and worker nodes (unless using Fargate profile, but even then, configuration is heavier). ECS with Fargate is simpler and has less operational overhead.

Instance profiles attach permissions to the EC2 node itself, meaning all jobs on that node share the same permissions. They also require accessing IMDS to get temporary credentials, which violates the requirement.

No, the requirement is to ensure workloads do NOT access IMDSv2. EMR runtime roles achieve this by injecting credentials directly into the job environment rather than fetching them from the metadata service.

Standard queues provide at-least-once delivery, which allows duplicates. The requirement explicitly states 'exactly once', so Standard is invalid.

FIFO queues have slightly lower throughput than Standard but still meet most 'quick' processing needs. The trade-off is necessary for the consistency guarantee.

App Runner is a service for deploying and scaling web applications and APIs directly from source code or container images. It does not perform the act of containerization itself, which is why App2Container is the correct tool for this step.

Yes, Amazon ECS on Fargate supports Application Auto Scaling based on CloudWatch metrics, such as CPU utilization, memory usage, or custom application metrics, allowing for elastic scaling without managing servers.

No, it is a native API call within AWS Secrets Manager. It does not require the AWS Batch compute service.

Parameter Store is designed for configuration data. Secrets Manager offers native encryption, rotation, and auditing specifically for sensitive secrets like passwords.

Amazon RDS Automated Backups have a hard maximum retention limit of 35 days. You cannot configure them for longer periods.

Yes, if you need retention beyond 35 days. AWS Backup complements automated backups by allowing extended retention policies via backup plans.

The question explicitly requires a 'relational database.' DynamoDB is a NoSQL key-value store, so it does not meet the fundamental architectural requirement.

No. Provisioned IOPS requires you to reserve and pay for a specific amount of I/O capacity regardless of actual usage, which is inefficient for variable traffic.

IAM Roles are ideal for AWS services, but for human users accessing the console/API, Identity Center provides centralized group-based management which has lower overhead than individual role assignments.

While isolation is good, creating separate accounts for each team introduces high operational overhead in account management, billing, and cross-account role configuration, violating the 'least overhead' constraint.

Secrets Manager stores long-term static credentials. IAM Roles Anywhere provides short-lived temporary credentials, reducing risk if compromised.

Yes, it can be configured to trust certificates issued by your existing identity provider, including those managed via IAM Identity Center.

Yes, you can attach a Direct Connect gateway to a Transit Gateway to route traffic between VPCs and on-premises networks.

Individual VPNs require separate configuration and maintenance per account, increasing operational overhead compared to a centralized Transit Gateway.

Yes, CloudFront can serve dynamic content by fetching it from the origin (like an ALB) when not cached, or by caching dynamic responses if TTLs are set appropriately.

Route 53 only routes traffic based on geography; it does not cache or accelerate content delivery like CloudFront, leading to higher latency and origin load.

S3 Standard-IA requires manual management or lifecycle policies to move data, whereas Intelligent-Tiering automates this based on actual access patterns, ensuring optimal cost without retrieval fees.

No, S3 Intelligent-Tiering does not charge retrieval fees for any tier, unlike S3 Standard-IA or Glacier classes which may incur fees when accessing archived data.

Standard EBS volumes can only be attached to one EC2 instance at a time. While Multi-Attach exists for io1/io2, it does not support general purpose gp2/gp3 volumes.

No, EFS uses the NFSv4.1 protocol, which is native to Linux. Applications can mount the file system via standard mount commands without modification.

Tag Policies only validate tag values and keys; they cannot deny API actions like RunInstances if a tag is missing.

No. SCPs can only check if a tag exists or not. To restrict values, you must use an Organizations Tag Policy.

AWS Backup is a separate service that incurs additional costs. Since RDS has native automated backup retention, using AWS Backup adds unnecessary expense for a single-region, single-account scenario.

Not natively within RDS. Manual snapshots require explicit deletion. While Lambda could automate this, the question asks for the MOST cost-effective solution, and manual deletion has zero monetary cost compared to running Lambda functions.

Security Groups filter traffic but do not encrypt it. Traffic goes over the public internet unencrypted. Private Subnets + VPN ensures both isolation and encryption.

No. Best practice dictates RDS should never be in public subnets. Even with a VPN, public IPs increase the attack surface unnecessarily.

Parameter Store does not have built-in automatic rotation for database credentials. You must write and maintain custom Lambda code to rotate the password, which increases operational effort.

Yes, but it is high-effort. You would need to manage the lifecycle of the credentials, update connection strings in your application, and ensure security compliance manually.

Managed Node Groups still require you to manage the node group itself, including scaling configurations and ensuring capacity. Fargate removes the node abstraction entirely.

Fargate supports most standard Kubernetes features but may have limitations regarding certain daemonsets or host-networking pods compared to EC2-backed nodes.

On-Demand RDS charges for the entire instance capacity continuously, even during low traffic. Aurora Serverless scales down to zero compute units, reducing costs significantly for spiky workloads.

Generally no. Spot Instances can be interrupted with a two-minute warning, leading to potential data loss or downtime. Databases require high availability and persistence that Spot Instances cannot guarantee.

Amazon S3 is a global service and cannot reside inside a VPC. You must use VPC endpoints to access it privately.

No. An Access Point manages permissions but doesn't change routing. You still need a VPC Endpoint to keep traffic off the public internet.

CRR needs a staging bucket per site, versioning, replication rules, and origin cleanup, and it charges cross-Region transfer fees. Transfer Acceleration gets data to the destination bucket in one hop using AWS's edge network.

Multipart upload works for any object above the minimum part sizes and is recommended for large or parallel uploads. Sites pushing 500 GB daily routinely exceed these thresholds, so it is a valid performance booster.

Redshift requires loading the logs into a provisioned cluster you must create, scale, and patch, adding cost and steps. For simple on-demand queries, Athena's serverless in-place SQL is far lower overhead.

No. CloudWatch Logs is for log ingestion, storage, and metric filters/insights on its own log groups; it cannot run ANSI SQL against an S3 bucket, so it fails both the query and minimal-change requirements.

It does restrict access to the organization, but it requires creating and maintaining department OUs and an exact path string. The question asks for the LEAST operational overhead, which aws:PrincipalOrgID satisfies with one policy edit.

Yes. The condition key is evaluated at request time against the principal's account membership, so newly added accounts gain access automatically without any bucket policy change.

An instance profile only attaches an IAM role so S3 API calls are authorized; it does not change the network path, so traffic would still require an internet gateway or NAT device.

No. S3 and DynamoDB support gateway endpoints, which are free and route via route tables; interface endpoints (PrivateLink) are used for other AWS services.

S3 File Gateway still transfers all 70 TB of data over the network (internet or Direct Connect) to reach S3. Unlike Snowball Edge, which physically ships data on a device, File Gateway relies entirely on network connectivity.

Direct Connect typically takes 4–8 weeks to provision a new physical connection. Since the question requires migrating 'as soon as possible,' the long setup time makes Direct Connect unsuitable compared to Snowball Edge's 6–9 day timeline.

Yes. Snowball Edge devices support large individual files well beyond 500 GB. The device capacity per job is approximately 80 TB, easily accommodating the 70 TB total dataset in this scenario.

A single Kinesis shard supports roughly 1 MB/s or 1,000 records/s, so it cannot absorb a sudden 100K/sec burst. Option D scales through SNS fan-out to multiple SQS queues.

Yes. Each microservice gets its own SQS subscription and queue, so it consumes independently, buffers bursts, and can scale or retry without affecting other consumers.

FSx adds capacity and low-latency SMB access but has no built-in lifecycle management, so it fails the requirement to prevent future storage issues.

Those files are rarely accessed, so the long retrieval time of Deep Archive is acceptable and it minimizes archival storage cost.

Standard queues provide high throughput but only best-effort ordering, so messages may be processed out of sequence. The requirement here is strict arrival-order processing, which only a FIFO queue satisfies.

SNS is a pub/sub notification service that fans out messages to subscribers without durable, ordered queuing. A standard SNS topic has no ordering guarantee, so a FIFO queue is required.

Parameter Store has no built-in rotation engine for database credentials. You would have to author, deploy, and maintain your own Lambda rotation function, which defeats the goal of minimizing operational overhead.

S3 and EBS only relocate the stored file; the application still reads static credentials and someone must still update the file on every rotation. Neither service performs automatic credential rotation for you.

Option B specifies a Single-AZ deployment, so the primary has no synchronous standby for high availability, and readers are added manually rather than autoscaled for unpredictable read demand.

Yes. Aurora is MySQL-compatible, so schema and drivers carry over, and Aurora Replicas share the cluster volume to add read capacity without extra storage or write overhead.

SNS pushes each message to the second Lambda immediately, so the loader still faces the full ingest rate and can hit concurrency limits. SQS lets the loader pull messages only when capacity is available, creating a real buffer.

The bottleneck is Lambda concurrency during ingestion, not database throughput. Switching to DynamoDB would force a NoSQL data-model rewrite and application changes, adding large effort without removing the quota constraint.

A bucket policy cannot distinguish an accidental delete from an intentional one; it would block all deletes by the denied principals and still protect nothing when an authorized user removes the wrong object by mistake.

No. Versioning preserves prior versions and lets you restore deleted objects, but a delete marker still hides the object. MFA Delete adds the deliberate confirmation step that reduces accidental deletes in the first place.

Intelligent-Tiering can move objects to infrequent or archive tiers after 30, 90, or 180 days; optional archive tiers may add retrieval latency, so it doesn't cleanly enforce a one-year hot window.

Metadata is small and S3-native, so storing it in S3 Standard avoids RDS instance and management costs while still enabling fast lookup before the lifecycle transition.

An EventBridge rule routes events; it cannot itself detect certificates expiring within 30 days. AWS Config's acm-certificate-expiration-check performs that evaluation and reports noncompliance for SNS alerting.

Yes. The AWS Config managed rule evaluates ACM certificates, including imported ones, and reports noncompliance when they are within the configured expiry threshold; imported certificates are not auto-renewed.

Kinesis Data Analytics requires a Kinesis Data Streams or Kinesis Data Firehose as its input source. API Gateway cannot serve as a direct input to Kinesis Data Analytics, so the ingestion path in option D is architecturally incomplete.

Lambda does not store data itself, but it can write incoming location data to Amazon DynamoDB, Amazon S3, or directly into the company's existing analytics platform as part of its execution logic behind API Gateway.

RDS event notifications are for operational events like instance, parameter group, security group, and snapshot changes, not row-level INSERT, UPDATE, or DELETE operations.

No. FIFO adds ordering and deduplication that the scenario does not require; a standard SQS queue is sufficient for the Lambda-to-target decoupling.

DataSync moves data over the network, so a 50 TB copy task would consume WAN capacity the site does not have and take weeks, violating the 'begin as soon as possible' requirement.

EC2 means ongoing patching, monitoring, and instance lifecycle management. Glue is serverless and runs custom ETL scripts, so it carries lower operational overhead after the one-time job migration.

A raw EC2 Auto Scaling group has no orchestrator, so you must place containers, handle Spot interruptions, and manage rollouts yourself. EKS managed node groups automate all of that.

The EKS control-plane fee is small compared with running On-Demand Instances, and Spot savings of 70–90% far outweigh it. Since no ECS option is offered, EKS plus Spot is the cheapest managed path.

SSE-S3 is fully managed by AWS, requiring zero key management overhead. SSE-KMS requires managing key permissions, rotation, and incurs API call costs, increasing operational complexity.

Yes, Athena automatically handles decryption if the data is encrypted with SSE-S3 or SSE-KMS, provided the IAM role has access to the data and keys.

On-Demand burst capacity costs far more than Spot, and because the queue already absorbs interruption, the extra reliability is unneeded — so D is dominated on cost by C.

Read replicas only shift queries away from the primary instance; the application still issues the same total number of database reads, so overall read volume on the database tier is unchanged.

Memcached has no replication or automatic failover, so it cannot satisfy the high-availability requirement. Redis supports replication groups with multi-AZ replicas and failover.

Option B describes a gateway endpoint as being created per Availability Zone and attaching security groups, but gateway endpoints are VPC-level route-table targets and support no security groups. The flawed wording makes B invalid.

S3's published service IP ranges are public internet addresses, so routing to them still sends traffic over public internet routes. Private connectivity requires a VPC endpoint instead.

Standard-IA table classes are designed for data accessed infrequently (roughly once per day or less). Since the company actively analyzes this data, Standard-IA would increase read costs and defeat the purpose of cost optimization.

No. In on-demand mode, DynamoDB automatically handles capacity based on traffic, and you pay per request. You cannot specify RCUs or WCUs, and reserved capacity is not available with on-demand mode.

Trusted Advisor organizational view in the management account aggregates member-account results, so the finance team can see the relevant checks without reviewing each account separately.

The Idle DB Instances check targets databases with no connections, while these Oracle instances have high utilization; Reserved Instance Optimization is the relevant cost-saving check.

It keeps only one running instance at a time, so a failure causes a replacement gap and no concurrent capacity in another AZ. Fault tolerance needs a second live copy.

NLB is Layer 4 and handles arbitrary TCP/UDP legacy workloads, while ALB is HTTP/HTTPS-specific and may not fit unmodified applications.

S3 CRR supports SSE-S3 objects and encrypts replicas with S3-managed keys, so no KMS key policy or multi-Region key administration is needed.

RDS is a managed relational database, not a serverless query engine over S3, and it adds instance, schema, and database operations that Athena avoids.

CRR copies objects to another region, but the bucket owner pays replication bandwidth and storage. It does not remove the marketing firm's request and data transfer charges.

Yes. With Requester Pays enabled, the requester must include the request-payer header and its AWS account is billed for requests and data transfer.