AWS Certified Associate Changed SAA-C03 Questions

The correct answer isBbecause the requirement explicitly calls for awrite once, read many (WORM)approach and a mandatory retention period of1 year.Amazon S3 Object Lock in compliance modeis the AWS feature designed specifically for this purpose. It prevents objects from being deleted or overwritten for a fixed retention period, even by privileged users. That directly satisfies the need to preserve confidential medical results for at least one year after creation.

Usingcompliance modeis important because it enforces retention in a way that cannot be bypassed by users or administrators. This is appropriate for regulated workloads such as medical records, where strong immutability controls are required. The company can then useIAM policiesto allow only a small set of approved users to upload new files while granting other authorized users read-only access.

Option A is incorrect becauseMFA Deletehelps protect against accidental deletion, but it does not provide a full WORM retention model and does not prevent overwrites in the same way as Object Lock. Option C is not sufficient because IAM and bucket policies can be changed by administrators with enough permissions and therefore do not provide the same immutable retention guarantee. Option D is overly complex and does not enforce WORM behavior; tracking object hashes only detects changes after the fact.

AWS best practices for immutable retention on S3 recommendS3 Object Lockwhen legal hold or retention requirements exist. For least implementation effort and proper WORM enforcement,S3 Object Lock in compliance modeis the most appropriate solution.

AWS Lambda supports functions up to 10 GB of memory and 15 minutes execution time. Each invocation here requires only 1 GB of memory and finishes in 30 seconds, making it an ideal fit for Lambda. Lambda is cost-effective for event-driven, short-duration workloads and requires no infrastructure management. AWS Glue and EMR are better suited for large-scale ETL or distributed processing, which is unnecessary and more costly for this workload.

AWS Documentation Extract:

“AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers. You pay only for the compute time you consume. Lambda supports up to 10 GB memory and 15 minutes per invocation.”

(Source: AWS Lambda documentation)

B, D: AWS Glue is intended for ETL on larger datasets or batch jobs, usually with higher operational overhead and cost.

C: EMR is for large-scale distributed processing and is not cost-effective for single, fast, memory-bound jobs.

The correct answer isDbecause the company needsNFS supportfor its on-premises environment and wants to back up files intoAmazon S3in themost cost-effectiveway.AWS Storage Gateway File Gatewayis the AWS service designed to present a file interface usingNFS(and SMB) while storing the files as objects in Amazon S3. This allows the company to keep using NFS-based workflows without redesigning the backup process.

The company also wants toarchive the backup files after 5 daysand is willing to waita few daysto retrieve archived data for disaster recovery. That retrieval tolerance aligns well withAmazon S3 Glacier Deep Archive, which is the lowest-cost S3 archival storage class for long-term retention when fast retrieval is not required. By applying anS3 Lifecycle ruleto transition files to Glacier Deep Archive after 5 days, the company can minimize storage cost while still retaining the backups durably in S3.

Option A is incorrect becauseS3 Standard-IAis cheaper than Standard for infrequent access, but it is not archival storage and is more expensive than Glacier Deep Archive for long-term backup retention. Option B is incorrect becauseVolume Gatewayprovides block storage interfaces, not NFS file access. Option C is incorrect becauseTape Gatewayis intended for virtual tape backup workflows, not direct NFS file storage access.

AWS best practices recommendFile Gatewaywhen on-premises applications need file-based access to Amazon S3, andS3 Glacier Deep Archivewhen the lowest-cost archival tier is acceptable. Therefore,File Gateway with a lifecycle transition to S3 Glacier Deep Archiveis the best solution.

AWS Compute Optimizerprovides detailed recommendations for optimizingAmazon EBS volumes, including insights into underutilized volumes, inefficient configurations, and potential cost savings. It analyzes usage patterns and provides recommendations based on historical data, making it the ideal tool for this use case.

Option A (Amazon Inspector): Amazon Inspector is for security assessments, not for cost optimization.

Option B (Systems Manager): Systems Manager does not specifically provide EBS optimization recommendations.

Option C (CloudWatch): CloudWatch metrics help monitor usage but do not offer optimization recommendations like Compute Optimizer.

AWS References:

AWS Compute Optimizer