A company wants to migrate its on-premises data center to AWS. According to the company's compliance requirements, the company can use only the ap-northeast-3 Region. Company administrators are not permitted to connect VPCs to the internet.Which solutions will meet these requirements? (Choose two.)
Answer(s): A,C
A) Correct: AWS Control Tower can implement data residency guardrails, including restricting regions and enforcing internet access policies, aligning with ap-northeast-3-only and no internet exposure for administrators.C) Correct: AWS Organizations with Service Control Policies (SCPs) can block internet egress and constrain region usage to ap-northeast-3, applying at the organization/account level.B) Incorrect: WAF governs web traffic for resources like CloudFront or ALB, not outbound regional access controls or VPC-level egress; SCPs are the proper mechanism for broad account-level restrictions.D) Incorrect: Network ACLs are per-subnet, not global policy enforcement; IAM policies cannot centrally enforce region restrictions at the VPC/telemetry level.E) Incorrect: Config rules detect configurations but do not prevent actions; protection requires preventive controls (SCPs/guardrails) rather than solely detection.
A company uses a three-tier web application to provide training to new employees. The application is accessed for only 12 hours every day. The company is using an Amazon RDS for MySQL DB instance to store information and wants to minimize costs.What should a solutions architect do to meet these requirements?
Answer(s): D
Starting and stopping the RDS instance on a schedule with Lambda and EventBridge minimizes compute and storage costs during idle periods without maintaining always-on infrastructure.A) Incorrect: Session Manager IAM config and automatic RDS start/stop is not a standard, cost-effective method for automating RDS lifecycle; Session Manager is for EC2/session access, not scheduling RDS power states.B) Incorrect: ElastiCache adds cost and complexity; it’s not a required substitute for a stopped RDS, and cache invalidation on restart can risk stale data and downtime.C) Incorrect: Running an EC2 instance to proxy or access the DB adds unnecessary cost and management overhead versus native RDS stop/start automation.D) Correct: Lambda + EventBridge provides serverless, low-cost, event-driven lifecycle control for RDS with scheduled start/stop.
A company sells ringtones created from clips of popular songs. The files containing the ringtones are stored in Amazon S3 Standard and are at least 128 KB in size. The company has millions of files, but downloads are infrequent for ringtones older than 90 days. The company needs to save money on storage while keeping the most accessed files readily available for its users.Which action should the company take to meet these requirements MOST cost-effectively?
S) D) is correct because an S3 Lifecycle policy can automatically transition objects from S3 Standard to S3 Standard-IA after 90 days, reducing storage costs for infrequently accessed files while keeping them readily available when needed. A) S3 Standard-IA applies to objects initially; not aligned with the requirement to start in Standard and transition later. B) S3 Intelligent-Tiering may incur unnecessary monitoring fees; though it automatically moves, it is not as cost-optimal for a predictable 90-day access pattern with large number of objects. C) S3 Inventory is a reporting feature, not an automatic data movement mechanism.
A company needs to save the results from a medical trial to an Amazon S3 repository. The repository must allow a few scientists to add new files and must restrict all other users to read-only access. No users can have the ability to modify or delete any files in the repository. The company must keep every file in the repository for a minimum of 1 year after its creation date.Which solution will meet these requirements?
Answer(s): B
S3 Object Lock in compliance mode with a retention period of 365 days ensures immutability for 1 year after creation, meeting the read-only requirement for most users and preventing deletion or modification. Compliance mode enforces write-once-read-many behavior for all objects, regardless of IAM, protecting against both user and account-level changes.A) Governance mode allows users with special permissions to override, which fails the no-modification requirement.C) IAM role + bucket policy can block deletes but does not guarantee immutability or prevent override without Object Lock.D) Lambda hash tracking does not enforce immutability and cannot prevent deletions or modifications.
A large media company hosts a web application on AWS. The company wants to start caching confidential media files so that users around the world will have reliable access to the files. The content is stored in Amazon S3 buckets. The company must deliver the content quickly, regardless of where the requests originate geographically.Which solution will meet these requirements?
Answer(s): C
A) CloudFront edge servers cache and deliver S3-stored media content from edge locations globally, reducing latency for users worldwide, meeting the requirement for fast, geographically distributed access.B) Global Accelerator optimizes global application availability and performance for IP endpoints, but it does not cache or serve S3 content from edge locations.C) CloudFront is a CDN that caches S3 content at edge locations, providing low-latency delivery worldwide.D) SQS is a queuing service for decoupled workflows and does not provide content caching or geographic acceleration.
Post your Comments and Discuss Amazon SAA-C03 exam prep with other Community members: