AWS Certified Associate SAA-C03 Dumps PDF

EC2 Instance Connect Endpoint is the correct answer because it allows secure SSH access to private EC2 instances without public IP addresses, bastion hosts, NAT gateways, or inbound internet access. This directly satisfies the company’s restrictions and supports cost reduction by allowing the NAT gateways to be decommissioned if they are only used for this troubleshooting access pattern. Session Manager is not valid because the company does not support installing agents, and Session Manager requires the SSM Agent and Systems Manager connectivity. Bastion hosts require additional EC2 infrastructure and inbound access controls. Client VPN adds VPN management and does not remove the need for routing design across all VPCs as cleanly as EC2 Instance Connect Endpoint.

Service control policies (SCPs) in AWS Organizations apply to the accounts or OUs to which they are attached:

To restrict only nonproduction accounts, you can:

Attach the SCP directly to those specific member accounts (Option B), or

Create a dedicated OU for the nonproduction accounts and attach the SCP to that OU (Option E).

Both methods ensure that the deny policy affects only the nonproduction accounts and does not impact the production account.

Why the others are incorrect:

A: Attaching the SCP to the root OU would apply the deny to all accounts, including production, which does not meet the requirement.

C: SCPs attached to the management account only affect that account, not all member accounts.

D: Creating an OU for the production account and attaching the deny SCP there would block the prohibited instance types in production, which is the opposite of what is required.

The correct answer isDbecause the application runs onAWS Fargate On-Demand capacity, cannot tolerate interruptions, and the company wants tooptimize costswhile keeping the application operational. ACompute Savings Planis designed to reduce costs for consistent compute usage across AWS services, includingAWS Fargate, without requiring changes to the application architecture or using interruptible capacity.

A Savings Plan provides discounted pricing in exchange for a usage commitment over a period of time. This is ideal for workloads that must continue running without interruption because the application can remain onFargate On-Demand, which avoids the termination risk associated with Spot capacity. The company gets cost savings while preserving the reliability characteristics of the current deployment model.

Option A is incorrect becauseOn-Demand Capacity Reservationsare used to reserve EC2 capacity in a specific Availability Zone and do not apply as the main cost optimization mechanism for Fargate tasks. Option B is incorrect becauseConvertible Reserved Instancesapply to Amazon EC2, not Fargate. Option C is incorrect becauseFargate Spotcan be interrupted and therefore does not meet the requirement that the application cannot tolerate sudden interruptions.

AWS cost optimization guidance recommends selecting discount models that align with workload needs. For predictable, steady serverless container usage on Fargate that must remain highly available,Compute Savings Plansoffer the best balance of lower cost and uninterrupted operation. Therefore, purchasing aCompute Savings Planis the most appropriate solution.

Setting the RDS backup retention policy to 30 days forautomated backupsthrough AWS Backup allows the company to retain backups cost-effectively. Manual backups, however, are notautomatically managed by RDS ' s retention policy, so they need to be manually deleted if they are older than 30 days to avoid unnecessary storage costs.

Key AWS features:

Automated Backups: Can be configured with a retention policy of up to 35 days, ensuring that older automated backups are deleted automatically.

Manual Backups: These are not subject to the automated retention policy and must be manually managed to avoid extra costs.

AWS Documentation: AWS recommends using backup retention policies for automated backups while manually managing manual backups​.