Free SAA-C03 diagnostic: where are your gaps?

Secrets Manager stores secrets encrypted and supports built-in automatic rotation, including managed rotation for supported databases — exactly the requirement. Why not the others: standard Parameter Store stores configuration and can hold SecureString values but does not provide built-in scheduled secret rotation the way Secrets Manager does. An encrypted S3 object has no rotation mechanism. Hard-coded credentials are the anti-pattern this replaces. Automatic credential rotation is Secrets Manager.

AWS WAF inspects HTTP(S) requests and blocks common exploit patterns like SQL injection and cross-site scripting, and attaches to CloudFront, an ALB or API Gateway. Why not the others: security groups and network ACLs filter by IP, port and protocol at layers 3–4, so they cannot understand an HTTP injection payload. GuardDuty detects threats from logs but does not inline-block web requests. Layer-7 web exploit filtering is AWS WAF.

Step Functions is a managed orchestration service that coordinates steps with built-in branching, retries and error handling as a state machine — the described multi-step workflow. Why not the others: cramming everything into one Lambda re-implements orchestration by hand and hits timeout and complexity limits. SQS decouples producers and consumers but does not orchestrate a workflow's control flow. CloudWatch Events (EventBridge) triggers targets on events but is not a step-by-step orchestrator. Managed workflow orchestration is Step Functions.

Kinesis Data Streams ingests high-throughput real-time streaming data and lets multiple consumers read the same stream for near-real-time processing — the clickstream use case. Why not the others: an SQS queue delivers each message to a single consumer and is not built for multiple independent stream readers or ordered high-throughput streaming. S3 event notifications react to object writes, not a continuous high-rate stream. RDS is a relational database. Real-time streaming ingestion is Kinesis.

Athena is serverless and queries data in S3 directly with standard SQL — no servers, no loading, ideal for ad-hoc analysis. Why not the others: RDS is a transactional relational database, not an S3 query engine. Redshift is a powerful warehouse but involves a provisioned cluster and loading data, more than 'ad-hoc, serverless, query in place' asks. EMR runs big-data frameworks on a cluster you manage. Serverless SQL on S3 is Athena.

AWS PrivateLink exposes a service through an interface VPC endpoint with a private IP in your subnet, so access stays on the AWS network with no internet exposure. Why not the others: an internet gateway and a NAT gateway both route to the public internet, the opposite of the requirement. VPC peering connects two VPCs you control, not a managed AWS service or a SaaS behind PrivateLink. Private access to a service via a private IP is PrivateLink.

EFS lifecycle management automatically transitions files not accessed within a set period to the cheaper EFS Infrequent Access class, cutting cost without changing how the application mounts the file system. Why not the others: EFS is a file system, not S3, so moving it to S3 Glacier or an S3 storage class is not applicable. Deleting old files loses data the requirement wants to keep, just cheaper. Automatic cost reduction for cold EFS files is EFS lifecycle management to IA.

A CloudWatch Logs metric filter turns matching log events into a metric, and a CloudWatch alarm on that metric notifies you when the pattern appears — the native, real-time alerting path. Why not the others: polling from an instance re-implements what the metric filter does natively and adds cost. CloudTrail records API activity, not application log patterns. Querying S3 with Athena daily is batch analysis, not timely alerting. Alerting on a log pattern is a metric filter plus an alarm.

GuardDuty continuously analyzes VPC flow logs, DNS logs and CloudTrail events with threat intelligence and machine learning to flag anomalous or malicious activity, with no agents to deploy. Why not the others: WAF blocks web-layer exploits inline, it is not an account-wide threat-detection analyzer. Amazon Inspector assesses workloads for software vulnerabilities. AWS Config tracks resource configuration and compliance. Agentless threat detection from logs is GuardDuty.

Aurora Global Database spans multiple Regions with a primary Region for writes and fast, low-latency read replicas in secondary Regions, plus rapid cross-Region failover — the relational fit for this requirement. Why not the others: single-Region Multi-AZ protects against an AZ failure but not across Regions and offers no other-Region low-latency reads. DynamoDB global tables meet a similar goal but are NoSQL, not the relational database specified. Same-AZ read replicas do nothing for global latency or DR. Global relational with cross-Region reads is Aurora Global Database.