SAA-C03 — Frequently Asked Questions

Stored Volumes keep the entire dataset on-premises, violating the 'limited space' constraint and offering no latency advantage over cached volumes for hot data.

No, S3 File Gateway provides file-level interfaces (NFS/SMB), whereas the question requires block storage (iSCSI) compatibility for existing applications.

CloudFront caches content at edges. For dynamic ERP data that changes frequently, caching provides little benefit and risks serving stale data. Global Accelerator optimizes the network path without caching.

Yes, per-unit costs vary, but Direct Connect requires dedicated physical lines for each customer, which is prohibitively expensive for a public API. Global Accelerator uses shared AWS infrastructure, making it far more cost-effective for this scenario.

While SSE-S3 is free, the question specifies the company currently uses AWS KMS and wants to optimize THAT cost structure. S3 Bucket Keys allow you to keep the flexibility of KMS (like custom policies) while drastically cutting the per-request cost.

It maintains the same security level as SSE-KMS but improves performance and reduces latency because S3 doesn't have to wait for a remote KMS API call for every single object upload.

Attaching multiple policies to the EC2 instance profile grants all pods on that node access to all associated AWS resources, violating least privilege.

No. IRSA works by binding a Kubernetes Service Account to an IAM Role, which the pod then assumes via the OIDC provider.

Managed AD requires replicating directory data and managing a separate Windows Server instance, which creates high operational overhead compared to the lightweight AD Connector proxy.

Yes, AD Connector serves as an identity source for IAM Identity Center, allowing you to map on-premises AD groups to AWS permissions sets across multiple accounts.

No, API Gateway is a managed service and does not support Security Groups. You must use Resource Policies or AWS WAF.

Private Integration restricts backend connectivity within a VPC, while a Resource Policy restricts who can call the API endpoint from the internet.

CloudWatch is for operational metrics/logs, not for querying large S3-based financial reports like CUR.

QuickSight can connect to S3, but Athena provides the SQL engine needed to efficiently query structured CUR files for custom dashboards.

No. Compute Savings Plans cover EC2, Lambda, and Fargate. SageMaker requires a Machine Learning Savings Plan.

No. You need at least two: a Compute Savings Plan for general compute and an ML Savings Plan for SageMaker.

No. AWS DMS migrates data between heterogeneous databases but does not modify or rewrite the SQL queries inside your application code.

Babelfish allows Aurora PostgreSQL to accept connections and T-SQL queries from existing SQL Server applications, eliminating the need to rewrite application code.

CloudTrail logs API calls but doesn't natively aggregate bucket configuration states like versioning status into a dashboard for easy identification.

Yes, S3 Storage Lens can collect metrics across multiple AWS regions and accounts if configured to do so, making it suitable for global companies.

Regional endpoints require the application to know which region is best and manage failover manually. MRAP provides a single global endpoint that AWS handles automatically.

No, MRAP only routes traffic. You must separately configure S3 Cross-Region Replication (CRR) to copy objects between the buckets in different regions.

No. Volume Gateway provides iSCSI block storage. Only Storage Gateway File Gateway supports SMB/CIFS.

While possible, EC2 requires manual OS patching, role installation, and HA configuration, creating higher administrative overhead than FSx.

Cross-Region Replication often involves asynchronous replication and lacks the seamless, managed automated failover capabilities inherent to Aurora Global Database.

No, it replicates data with no impact on database performance, providing low-latency reads and synchronous writes to secondary regions.

AWS Lambda has a maximum synchronous execution timeout of 15 minutes. Even with asynchronous invocation, processing a single continuous 1-hour stateful task is not supported.

EventBridge Scheduler is the newer, simplified scheduling service recommended for creating cron-based schedules for various AWS targets including ECS tasks, replacing older CloudWatch Events patterns.

Lake Formation is a governance tool. While it can host data, you still need to build the ingestion pipeline (e.g., with Glue), whereas Security Lake automates the collection of security-specific logs.

No, it aggregates CloudTrail along with VPC Flow Logs, GuardDuty findings, and third-party data into a single location for easier analysis.