SAA-C03 Exam Dumps - AWS Certified Solutions Architect - Associate (SAA-C03)

Amazon EFS offers an Infrequent Access (IA) storage class, which can be managed via EFS lifecycle policies. Frequently accessed files remain in the Standard storage class, while infrequently accessed files are automatically moved to the IA class, significantly reducing storage costs with minimal effort and no application changes.

Reference Extract:

" EFS lifecycle management automatically transitions files that are not accessed for a set period to the EFS Infrequent Access (IA) storage class, reducing storage costs. "

Source: AWS Certified Solutions Architect – Official Study Guide, EFS and Lifecycle Management section.

Amazon RDS Multi-AZ deployments provide automatic failover for relational databases such as MySQL, ensuring high availability and durability. The feature maintains synchronous replication between a primary DB instance and a standby in a separate Availability Zone. AWS guarantees that failover typically completes within minutes, ensuring an RTO and RPO of less than 2 minutes. Option A requires manual promotion of replicas, which cannot meet the strict RTO/RPO requirement. Option C depends on custom scripts and manual synchronization, introducing operational risk. Option D creates active-active EC2-based databases, which do not provide synchronous replication or automated failover. Therefore, Multi-AZ RDS (B) is the managed, resilient, and operationally efficient solution that meets the business requirements.

AWS documentation states that you can associate a security group with a Network Load Balancer and use it to allow inbound traffic only from specified source IP ranges. AWS also recommends referencing theNLB’s security groupin the target instances’ security groups so the targets accept traffic only from the load balancer. That maps exactly to option B: allow the listed client IPs into the NLB on port 22, then allow port 22 from the NLB security group to the EC2 targets. The network ACL answer is less precise and harder to manage, and options C and D are broader than necessary.

============

Amazon RDS for MySQL supports read replicas that offload read-intensive workloads such as reporting, leaving the primary instance free for write operations.

“You can use Amazon RDS read replicas to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads.”

— Working with Read Replicas

This is the recommended approach for minimizing performance impact on the primary DB instance.

Option A is the most operationally efficient because it moves permissions from individual users todepartment-based IAM groups, which is easier to manage consistently at scale. AWS IAM best practices emphasize applyingleast privilegeand note that managed policies can help get started, though broad managed policies like AdministratorAccess are not least privilege in the strictest sense. Given the answer choices, placing engineering and operations users into separate groups with the appropriate policies and removing direct user-level permissions is the cleanest and most maintainable improvement. Options C and D still leave user-by-user administration, and option B is clearly over-permissive.

============

S3 Glacier Flexible Retrieval is designed for long-lived archive data that is accessed infrequently and can be retrieved in minutes to hours, making it a strong cost-effective choice for medical records that are rarely accessed. AWS documentation states that standard retrievals from this storage class typically finish in 3 to 5 hours, which fits the requirement to retrieve records within a few hours. For immutability, AWS S3 Object Lock provides a WORM model and can prevent deletion or overwriting for a fixed retention period. Together, Glacier Flexible Retrieval and Object Lock satisfy the needs for low-cost archival storage, long retention, immutability, and acceptable restore times. S3 Standard and Intelligent-Tiering cost more than necessary for rarely accessed 10-year data, and One Zone-IA does not provide the same resilience posture.

============

This solution meets the requirement of encrypting each customer’s data separately with the least operational overhead by leveraging AWS Key Management Service (KMS).

Separate AWS KMS Keys: By creating separate KMS keys for each customer, you can ensure that each customer’s data is encrypted with a unique key. This approach satisfies the compliance requirement for separate encryption and provides fine-grained control over access to the keys.

Granular Access Control: AWS KMS allows you to define key policies and use IAM policies to grant specific permissions to the keys. This ensures that only authorized users or services can access the keys, thereby maintaining the principle of least privilege.

Logging and Monitoring: AWS KMS integrates with AWS CloudTrail, which logs all key usage and management activities. This provides an audit trail that is essential for meeting compliance requirements.

Why Not Other Options?:

Option A (Store keys in S3): Storing keys in S3 is not recommended because it does not provide the same level of security, access control, or integration with AWS services as KMS does.

Option B (Hardware security appliance): Deploying a hardware security appliance adds significant operational overhead and complexity, which is unnecessary given that KMS already provides a secure and centralized key management solution.

Option C (Single KMS key for all data): Using a single KMS key does not meet the requirement of encrypting each customer ' s data separately.

AWS References:

AWS Key Management Service (KMS)- Overview of KMS, its features, and best practices for key management.

Using AWS KMS for Multi-Tenant Applications- Guidance on how to design applications using KMS for multi-tenancy.

Amazon RDS Custom for Oracle: This service allows you to bring your own Oracle Database licenses and provides the flexibility to customize the database settings, making it suitable for applications that require privileged access and third-party database features.

BYOL (Bring Your Own License):

RDS Custom supports the BYOL model, allowing you to use your existing Oracle licenses and comply with licensing requirements.

This helps in leveraging existing investments and reducing migration costs.

Customization and Third-Party Features:

RDS Custom allows for deeper customization of the database environment compared to standard RDS instances.

This makes it possible to support the third-party features that your application relies on without significant changes.

Migration Process:

Use native Oracle tools like Data Pump or RMAN to migrate the database to RDS Custom.

Customize the database settings post-migration to ensure compatibility with third-party features.