SAA-C03 Exam Dumps : AWS Certified Solutions Architect - Associate (SAA-C03)

The correct answer isAbecause the application must acceptTLS connections from IPv4 clients, provideoutbound internet access, present asingle entry point, and maintain thelowest possible attack surface. Placing the Amazon ECS tasks inprivate subnetsis the key security design decision because it prevents direct inbound access from the internet to the tasks themselves. The public-facing entry point is the load balancer, while outbound internet access for the private tasks is provided through aNAT gatewayin the public subnet.

ANetwork Load Balancer (NLB)is well suited for handlingTLSat Layer 4 and can expose a single public endpoint for client connections. Withawsvpcnetwork mode, each ECS task receives its own elastic network interface, making it straightforward to place tasks securely in private subnets while still registering them as targets behind the load balancer.

Option B is incorrect because anegress-only internet gatewayis forIPv6 outbound traffic only, while the requirement specifically mentionsIPv4 clients. Option C is incorrect because placing ECS tasks inpublic subnetsincreases the attack surface by exposing application infrastructure more directly to the internet. Option D is also incorrect for two reasons: it uses anegress-only internet gateway, which does not satisfy IPv4 outbound needs, and it places tasks inpublic subnets, which violates the goal of minimizing exposure.

AWS security design guidance emphasizes reducing exposure by placing application workloads in private subnets and exposing only the required front-end endpoint. Therefore, a publicNLBwith private ECS tasks and aNAT gatewayis the most secure and appropriate architecture.

The correct answer isCbecause the existing application usesNFS storagefor an image cache that isa few terabytes in size, and the company wants themost cost-effective cloud alternative.Amazon EFS One Zoneis a managed file storage service that supports theNFS protocol, which allows the application to continue using a familiar file-based interface with minimal architectural change. Because this is acache, not primary durable data, storing it in aOne Zonefile system is a cost-optimized choice compared with a Regional EFS deployment.

Amazon EFS is designed for shared file storage and can scale to multiple terabytes automatically. It avoids the operational overhead of managing EC2 instances and local disks for cache storage. It is also better aligned than object storage for workloads that already expect direct NFS semantics. The application can mount the EFS file system and use it as the cache backend without redesigning around object APIs or in-memory caching models.

Option A is incorrect becauseElastiCache Memcachedis an in-memory cache and is typically much more expensive for multi-terabyte cache data than file storage. Option B is incorrect because using EC2 instance store volumes creates significant management overhead and the cache would be lost whenever instances are terminated or replaced. Option D is incorrect becauseAmazon S3 Express One Zoneis object storage, not NFS storage, and would require application redesign and additional metadata management in DynamoDB.

AWS storage guidance recommends matching file-based workloads to managed file services. For a largeNFS-based cache,Amazon EFS One Zoneis the most cost-effective and operationally simple solution.

The correct answer isBbecause the requirement explicitly calls for awrite once, read many (WORM)approach and a mandatory retention period of1 year.Amazon S3 Object Lock in compliance modeis the AWS feature designed specifically for this purpose. It prevents objects from being deleted or overwritten for a fixed retention period, even by privileged users. That directly satisfies the need to preserve confidential medical results for at least one year after creation.

Usingcompliance modeis important because it enforces retention in a way that cannot be bypassed by users or administrators. This is appropriate for regulated workloads such as medical records, where strong immutability controls are required. The company can then useIAM policiesto allow only a small set of approved users to upload new files while granting other authorized users read-only access.

Option A is incorrect becauseMFA Deletehelps protect against accidental deletion, but it does not provide a full WORM retention model and does not prevent overwrites in the same way as Object Lock. Option C is not sufficient because IAM and bucket policies can be changed by administrators with enough permissions and therefore do not provide the same immutable retention guarantee. Option D is overly complex and does not enforce WORM behavior; tracking object hashes only detects changes after the fact.

AWS best practices for immutable retention on S3 recommendS3 Object Lockwhen legal hold or retention requirements exist. For least implementation effort and proper WORM enforcement,S3 Object Lock in compliance modeis the most appropriate solution.