Free SAA-C03 practice exam 2: the harder pass

Shield Advanced provides enhanced DDoS protection, access to the AWS DDoS Response Team, and billing protection for scaling caused by an attack — matching every part of the requirement. Why not the others: Shield Standard is automatic and free but does not include advanced mitigation, the response team, or cost protection. A larger instance does not defend against a volumetric attack. An SQS queue decouples components; it is not DDoS mitigation. Advanced, managed DDoS protection is Shield Advanced (with WAF).

AWS DataSync is a managed service for fast, online bulk transfer between on-premises storage (NFS/SMB) and AWS storage such as EFS and S3, with automatic scheduling, encryption and verification. Why not the others: a manual rsync script is exactly the fragile toil DataSync replaces. Snowball Edge is for offline transfer when the network is too slow or the data too large to send online. S3 Transfer Acceleration speeds S3 uploads, not NFS-to-EFS migration. Online bulk file migration is DataSync.

When the data is large and the network too slow, the Snow Family physically transfers the data on a rugged device you load and ship back, bypassing the internet bottleneck. Why not the others: multipart uploads and DataSync both still depend on the slow internet connection, so they take just as long. Emailing hundreds of terabytes is not viable. Offline transfer of large data over a slow link is the Snow Family.

DynamoDB Streams captures item-level changes in order and can invoke a Lambda function for each change — the event-driven reaction the requirement describes. Why not the others: scanning the whole table every minute is wasteful, slow to react, and costly. SQS does not poll a DynamoDB table. A CloudWatch alarm monitors metrics, not item changes. Reacting to item-level changes is DynamoDB Streams plus Lambda.

Parameter Store holds configuration and secrets in a hierarchy, supports plaintext and encrypted (SecureString) values, and its standard tier is free — the fit for config that does not need managed rotation. Why not the others: Secrets Manager adds automatic rotation but at a per-secret cost, more than plain configuration needs. S3 with tags is not a parameter hierarchy for app config. Hard-coding defeats central management. Low-cost hierarchical config is Parameter Store; rotating secrets is Secrets Manager.

Amazon SES is a scalable email service for sending transactional and marketing email with high deliverability — exactly receipts and password resets. Why not the others: SNS sends notifications to subscribers (including SMS and application endpoints) but is not a full email-sending service for rich transactional mail. SQS is a message queue, not an email sender. Pinpoint targets customer engagement campaigns and can use SES underneath, but the direct transactional-email service is SES. Sending email at scale is SES.

Fargate runs containers serverlessly — no EC2 instances to provision or manage, and you pay for the vCPU and memory the tasks consume, which suits bursty variable load. Why not the others: the EC2 launch type means managing and scaling the cluster's instances yourself. A fixed large fleet pays for peak continuously. Lambda is for event-driven functions with a runtime limit, not long-running containers. Serverless containers are Fargate.

Weighted routing assigns a proportion of traffic to each record, so you can send, say, 5% to the new version and raise it over time — a canary or blue/green rollout. Why not the others: failover routing switches to a secondary only when the primary is unhealthy. Geolocation routes by the user's location. Latency-based routing picks the fastest Region. Percentage-based gradual rollout is weighted routing.

FSx for Lustre is a high-performance file system built for compute-intensive workloads like machine learning and HPC, and it integrates with S3 to process data at very high throughput. Why not the others: EFS Standard is a general-purpose shared file system, not tuned for the extreme throughput of HPC/ML. An EBS gp2 volume attaches to a single instance and is not a shared high-performance file system. Accessing S3 object-by-object lacks the POSIX file-system semantics and throughput the workload needs. High-performance compute file system on S3 data is FSx for Lustre.

AWS Transfer Family provides fully managed SFTP (and FTPS/FTP) endpoints that store files directly in S3, removing the need to run SFTP servers. Why not the others: running an SFTP daemon on EC2 is exactly the server maintenance the requirement avoids. DataSync moves data between storage systems on a schedule, not an interactive SFTP endpoint for partners. Presigned URLs enable HTTPS uploads, not the SFTP protocol partners require. Managed SFTP into S3 is AWS Transfer Family.