Mixed Domain Full-Length Mini Exam

This capstone lesson presents 10 mixed-domain scenario questions covering all four SAA-C03 domains: Secure Architectures, Resilient Architectures, High-Performing Architectures, and Cost-Optimised Architectures. Each scene presents a scenario with four answer choices followed by the correct answer and explanation. Treat each question as a timed challenge — aim for 2 minutes per question. Use the keyword and elimination techniques from previous lessons. At the end, the Quick Check quiz tests a final capstone scenario.

Q1 (Domain 1): An EC2 instance needs to access S3 without storing long-term credentials. Best solution: Attach an IAM role via instance profile. The application retrieves temporary credentials from the instance metadata service automatically — no keys stored anywhere.

Q2 (Domain 1): A developer accidentally committed IAM access keys to a public GitHub repository. What is the FIRST action? Answer: Immediately deactivate and delete the exposed access key pair. Attackers can find and use GitHub-exposed keys in seconds via automated scanners. Deleting the repository or rotating the key is too slow — the old active key must be invalidated first.

Q3 (Domain 2): A Lambda function processing SQS orders fails 5% of the time. Orders are lost. Fix? Answer: Configure a Dead-Letter Queue (DLQ) with maxReceiveCount=3. Failed messages are preserved for investigation instead of disappearing after visibility timeout expires.

Q4 (Domain 2): A company needs a disaster recovery solution for RDS with RPO 1 hour, RTO 4 hours, moderate budget. Answer: Pilot Light — replicate RDS to a second Region using Cross-Region Read Replica. On disaster, promote the replica to standalone and launch app servers from pre-baked AMIs.

Q5 (Domain 3): An application requires single-digit millisecond latency for key-value lookups at 1 million writes per second globally. Answer: Amazon DynamoDB with On-Demand capacity mode and Global Tables for multi-Region active-active replication.

Q6 (Domain 3): A content management system needs a shared file system accessible simultaneously by 20 EC2 Linux instances. Answer: Amazon EFS. EFS supports thousands of concurrent mounts with a POSIX-compliant shared namespace. EBS can only be mounted read-write on a single instance at a time (Multi-Attach is limited). Self-managed NFS adds operational overhead.

Q7 (Domain 4): A company runs video transcoding jobs that take 2-4 hours, tolerate interruptions with checkpoint restart, and run continuously. Best pricing model? Answer: EC2 Spot Instances with AWS Batch managing retries. Spot offers up to 90% discount — the maximum for interruption-tolerant batch workloads.

Q8 (Domain 4): A Python script runs every night at 2 AM for 20 minutes on a t3.micro EC2 that runs 24/7. How to minimise cost? Answer: Move the script to a Lambda function triggered by an EventBridge scheduled rule, and terminate the EC2 instance. Lambda for 20 minutes/night costs less than $0.01/month versus $7.49/month for the always-on t3.micro.

Q9 (Mixed): A company needs to enforce that ALL AWS resources are created only in eu-central-1 across 50 AWS accounts in an Organisation. Answer: Create a Service Control Policy (SCP) denying actions where RequestedRegion is not eu-central-1, attached to the Organisation root. SCPs apply to all IAM entities including root users in all member accounts simultaneously.

Q10 (Mixed): A startup builds a REST API that must authenticate users, store data, handle 1 million requests/day, with no infrastructure management. Answer: API Gateway HTTP API + Lambda + Cognito User Pool + DynamoDB On-Demand. This is the fully serverless, lowest-cost stack with no capacity planning or servers to manage.

Quick-reference for the most commonly confused SAA-C03 service choices:

• S3 access from VPC privately, free → S3 Gateway Endpoint
• Shared POSIX filesystem, Linux → Amazon EFS
• Windows SMB shares → FSx for Windows File Server
• Multiple consumers, same stream, replay → Kinesis Data Streams
• Exactly-once ordered queue → SQS FIFO
• Fan-out to many subscribers → SNS
• Content-based event routing → EventBridge
• Multi-step workflow with error handling → Step Functions
• Serverless ETL → AWS Glue
• Ad hoc SQL on S3 → Athena

Summarising the database selection framework for the exam:

• ACID relational, managed → Amazon RDS or Aurora
• Single-digit ms key-value at scale → DynamoDB
• In-memory cache, session store → ElastiCache Redis or Memcached
• Complex SQL analytics on petabytes → Amazon Redshift
• Graph relationships, fraud detection → Amazon Neptune
• IoT time-series data → Amazon Timestream
• Search and full-text queries → Amazon OpenSearch Service
• Document / JSON, MongoDB-compatible → Amazon DocumentDB

When in doubt, pick the service whose primary design purpose matches the stated workload requirement exactly.

Summarising DR strategy selection for the exam:

• Highest RTO/RPO tolerated, lowest cost → Backup and Restore (S3 snapshots + AWS Backup)
• Moderate RTO (hours), low cost → Pilot Light (replicated DB only in DR Region, launch servers on disaster)
• Lower RTO (minutes), scaled-down copy → Warm Standby (reduced fleet running in DR Region)
• Near-zero RTO, highest cost → Multi-Site Active-Active (full production capacity in 2+ Regions, Route 53 latency routing)

Exam signal: the shorter the RTO and RPO, the more expensive the DR strategy. Questions give RTO/RPO targets — match them to the appropriate tier.

Quick reference for encryption and compliance questions:

• Encrypt S3 objects with AWS-managed key → SSE-S3 (AES-256, free)
• Encrypt S3 with customer control and audit → SSE-KMS (CMK, KMS API calls logged in CloudTrail)
• Encrypt EBS/RDS/EFS at rest → KMS CMK (must be enabled at creation for RDS)
• TLS certificates for ALB/CloudFront → AWS Certificate Manager (ACM, free for public certs)
• Rotate DB credentials automatically → AWS Secrets Manager
• Audit all API calls in account → AWS CloudTrail
• Detect threats in real time → Amazon GuardDuty
• Find PII in S3 → Amazon Macie
• Block OWASP top-10 attacks → AWS WAF
• DDoS protection → AWS Shield (Standard free, Advanced paid)

Migration 7 Rs quick reference:

• Rehost (Lift-and-Shift) → AWS MGN, fastest migration
• Replatform → RDS instead of MySQL on EC2, least operational overhead
• Refactor → Lambda + DynamoDB, highest cloud benefit
• Repurchase → SaaS replacement for legacy app
• Retire → decommission unused apps
• Retain → keep on-premises for now
• Relocate → VMware Cloud on AWS

Serverless services: Lambda, API Gateway, DynamoDB On-Demand, Aurora Serverless v2, Fargate, Athena, Glue, Step Functions Express, SQS/SNS, EventBridge, S3 — when 'no servers to manage' is stated, answer from this list.

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

Congratulations on completing the full AWS Solutions Architect (SAA-C03) course. You have covered all four exam domains: Secure Architectures (30%), Resilient Architectures (26%), High-Performing Architectures (24%), and Cost-Optimised Architectures (20%). Key takeaways: recognise keyword signals to identify services, use the two-pass elimination method, allocate 2 minutes per question with pacing checkpoints, and always match DR strategies to stated RTO/RPO targets. Schedule your exam, review weak domains with practice tests, and apply the techniques you have learned. Best of luck on the SAA-C03!