AWS Transfer Family SFTP Internal Server and Managed Workflows

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

D Create an AWS Transfer Family SFTP internal server in two Availability Zones. Use Amazon S3 storage. Create an AWS Lambda function to process order files. Use a Transfer Family managed workflow to invoke the Lambda function.

Question

A company wants to migrate an on-premises legacy application to AWS. The application ingests customer order files from an on-premises enterprise resource planning (ERP) system. The application then uploads the files to an SFTP server. The application uses a scheduled job that checks for order files every hour. The company already has an AWS account that has connectivity to the on-premises network. The new application on AWS must support integration with the existing ERP system. The new application must be secure and resilient and must use the SFTP protocol to process orders from the ERP system immediately. Which solution will meet these requirements?
  1. Create an AWS Transfer Family SFTP internet-facing server in two Availability Zones. Use Amazon S3 storage. Create an AWS Lambda function to process order files. Use S3 Event Notifications to send s3:ObjectCreated:* events to the Lambda function.
  2. Create an AWS Transfer Family SFTP internet-facing server in one Availability Zone. Use Amazon Elastic File System (Amazon EFS) storage. Create an AWS Lambda function to process order files. Use a Transfer Family managed workflow to invoke the Lambda function.
  3. Create an AWS Transfer Family SFTP internal server in two Availability Zones. Use Amazon Elastic File System (Amazon EFS) storage. Create an AWS Step Functions state machine to process order files. Use Amazon EventBridge Scheduler to invoke the state machine to periodically check Amazon EFS for order files.
  4. Create an AWS Transfer Family SFTP internal server in two Availability Zones. Use Amazon S3 storage. Create an AWS Lambda function to process order files. Use a Transfer Family managed workflow to invoke the Lambda function. Correct Answer

Key Takeaways

The exam tests the distinction between internet-facing and internal endpoints based on connectivity type, and the use of managed workflows for immediate trigger-based processing versus event notifications.

This question evaluates the design of a secure, resilient SFTP solution using AWS Transfer Family with an internal endpoint for on-premises integration. It establishes that managed workflows are required to process files immediately upon upload.

Common mistake: Many learners choose Option A because they overlook the 'internal' requirement implied by existing connectivity or mistakenly believe S3 Event Notifications are sufficient for immediate workflow invocation without considering security best practices.

Expert Analysis

Why the Answer Is Correct

Option D is correct because it aligns with all constraints: resilience (Multi-AZ), security (Internal Endpoint for existing connectivity), and immediate processing (Managed Workflow). An internal endpoint is preferred when the company already has connectivity (e.g., Direct Connect or VPN) as it avoids exposing the service to the public internet unnecessarily. The 'immediately' requirement is met by the Transfer Family managed workflow, which can invoke a Lambda function directly upon file upload, unlike scheduled checks.

Why the Other Options Are Wrong

Option A uses an internet-facing server, which is less secure given the existing private connectivity, and relies on S3 Event Notifications rather than the native Transfer Family workflow integration for invoking Lambda. Option B uses EFS, which is not the standard storage backend for Transfer Family SFTP servers (S3 is primary), and places the server in a single AZ, failing the resilience requirement. Option C uses Step Functions and EventBridge Scheduler, which introduces latency and does not meet the 'immediate' processing requirement compared to the synchronous nature of managed workflows.

Community Comment Notes

Community consensus strongly favors Option D. Users note that since connectivity already exists, an internal endpoint is more secure ('D looks more secure over existing on-prem to AWS connection'). Several commenters highlight that 'managed workflows' allow direct invocation of Lambda, satisfying the immediate processing need better than polling or generic event triggers.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always map the connectivity method to the endpoint type: if private connectivity exists, prefer Internal Endpoints for security. Look for keywords like 'immediately' to trigger managed workflows or Lambda integrations rather than scheduled jobs.

Frequently Asked Questions

Why not use S3 Event Notifications instead of Transfer Family managed workflows?

While S3 Event Notifications work, Transfer Family managed workflows provide a tighter integration specifically designed for file transfer events, ensuring immediate and reliable invocation of Lambda functions upon upload.

When should I choose an Internet-Facing vs Internal SFTP server?

Choose Internal when clients connect via private network links (Direct Connect/VPN) to enhance security. Choose Internet-Facing only if clients must access the server over the public internet.

More SAA-C03 FAQ →

Community Votes

D
83%
A
17%

83% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 12 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 12

  1. anikolov 👍 11 Answered D
    D looks more secure over existing on-prem to AWS connection -Transfer Family SFTP internal server in two Availability Zones. -Use Amazon S3 storage. -Use a Transfer Family managed workflow to invoke the Lambda function"
  2. ckhemani 👍 3 Answered D
    A and B is out since it is public facing and we don't need public facing SFTP since Company already have Connection to AWS thro ON-PREMISES. Initially i thought it will C since it was doing scheduled as they were doing scheduled job every hour on on-premises. Then the read thro question and saw they are saying with new solution, they want to process the file immediately after it is uploaded so D is correct since it will trigger the Lambda file as soon as file appears on S3.
  3. sandordini 👍 3 Answered D
    "order files from an on-premises enterprise resource planning (ERP)" - Therefore Internal Endpoint is enough, no need for Internet-facing, although Internet-facing also handles on-prem connections as well, but "most secure". Even tho we are talking about SecureFTP.... Very bad wording of the question... :( Definitely S3 against EFS, so D should be the answer...
  4. Hung23 👍 3 Answered A
    Correct answer is A because must support integration with existing erp system we need to choose sftp internal-facing
  5. xBUGx 👍 3 Answered D
    The company already has an AWS account that has connectivity to the on-premises network. So no need internet.
Show 7 more comments
  1. alawada 👍 2 Answered D
    has an AWS account that has connectivity to the on-premises network.
  2. 67a3f49 👍 2
    I would go in D as it's internal network.
  3. FlyingHawk 👍 1 Answered D
    A and D are similar, but A internet-facing server is less secure than D, also no need to use S3 Event Notifications to send s3:ObjectCreated:* events to the Lambda function because Transfer Family managed workflows can directly invoke Lambda.. https://docs.aws.amazon.com/transfer/latest/userguide/transfer-workflows.html
  4. buzzinmumbai 👍 1
    Answer is D . Both A&D are right but the question says it must support integration with existing erp system. I believe you can use transfer family for the existing job onprem as well to check for files.
  5. Andy_09 👍 3
    A is the correct option
  6. NayeraB 👍 2 Answered A
    I think A makes more sense
  7. Scheldon 👍 2 Answered D
    Answer D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide