SAA-C03 Exam Dumps : AWS Certified Solutions Architect - Associate (SAA-C03)

Correct Approach:

AWS Security Groups:

Security groups operate at the instance level, making them the ideal tool for controlling access to specific resources such as an Amazon RDS database.

By default, security groups deny all incoming traffic. You can allow access by explicitly specifying another security group.

Associating an RDS database security group with the EC2 instances ' security group ensures only the specified EC2 instances can access the RDS database.

Incorrect Options Analysis:

Option A: Using CIDR blocks for IP-based access is less secure and more difficult to manage. Additionally, Auto Scaling groups dynamically allocate IP addresses, making this approach impractical.

Option B: Network ACLs (NACLs) operate at the subnet level and are stateless. While NACLs can deny or allow traffic, they are not suited to application-specific access control.

Option D: Similar to Option B, using a NACL with CIDR ranges for EC2 IPs is difficult to manage and not application-specific.

The correct answer is A because the legacy mainframe requires a synchronous RESTful API and the new service takes approximately 3 minutes to complete each request. Among the choices, Amazon API Gateway REST API is the appropriate option for exposing a synchronous REST endpoint to the mainframe. API Gateway REST APIs support longer integration timeouts than HTTP APIs, which makes them more suitable for workloads that take an extended time to process. The REST API can invoke an AWS Lambda function to execute the stock price calculation and return the result synchronously.

Option B is incorrect because API Gateway HTTP APIs have a shorter integration timeout and are not the best fit for a request that takes around 3 minutes. Option C is incorrect because WebSocket APIs are not RESTful and do not meet the requirement for synchronous REST-based integration with the mainframe. Option D is incorrect because Lambda function URLs do not provide the same API management features and are not the best choice for a long-running synchronous enterprise integration requirement of this kind.

AWS design guidance favors API Gateway when exposing managed APIs to external consumers. In this case, the REST API option best matches the requirement for synchronous RESTful access while supporting the longer processing duration. It also provides a managed front door for authentication, throttling, and operational control if the company needs those features later.

One note of honesty: some exam versions treat the REST API timeout detail as the deciding factor here. That is the key reason REST API is preferred over HTTP API for this question.

A: Amazon Macie can scan S3 buckets for sensitive data and identify PII.

C: S3 Object Lock legal hold prevents object deletion until a review is complete, meeting compliance requirements.

E: EventBridge can trigger the Lambda function automatically when Macie detects sensitive data, creating an automated workflow.

AWS Documentation Extract:

" Amazon Macie automatically discovers, classifies, and protects sensitive data in AWS. You can use EventBridge to invoke a Lambda function for post-processing, such as applying Object Lock legal hold to flagged objects. "

(Source: AWS Macie and S3 Object Lock documentation)

B, D: Moving to Glacier Deep Archive or applying retention in governance mode is not specific to deletion prevention pending review.

F: MFA Delete adds a security layer but does not automate object retention for flagged PII.