AWS Certified Solutions Architecture - Associate (SAA-C03)

Not the best choice for least overhead. aws:PrincipalOrgPaths can restrict access based on OU membership, but it introduces additional complexity and potential maintenance if accounts move between OUs or if the OU structure changes. The requirement is simply “within the Organization,” so using Organization ID is simpler and more stable than OU path-based controls.

High operational overhead. CloudTrail-driven automation to detect org membership changes and then rewrite bucket policies is complex, brittle, and unnecessary. It adds moving parts (rules, functions, permissions, error handling) and creates risk of policy drift or delayed enforcement. Native IAM condition keys already provide real-time evaluation without custom automation.

Not aligned with the requirement and increases admin work. Tagging each user (or role) and enforcing aws:PrincipalTag requires consistent tag governance across 25 accounts and ongoing lifecycle management as identities change. It also doesn’t inherently ensure the principal is in the Organization—only that it has a tag—so it’s not the most reliable or minimal-maintenance control for Organization membership.

AWS Data Pipeline is primarily for scheduled/batch data movement and orchestration, not high-volume real-time streaming ingestion. While S3 + EMR can analyze large datasets, the ingestion layer here is the weak point: Data Pipeline does not provide the same real-time buffering, scaling, and replay semantics as Kinesis. This option also increases operational complexity for near-real-time requirements.

An Auto Scaling group of EC2 instances to capture and forward streaming events is a DIY ingestion approach that is harder to scale reliably and operate (capacity planning, backpressure handling, retries, ordering, and failure recovery). It can work, but it is not the most appropriate managed pattern for 25 TB/day of real-time telemetry. Kinesis provides these capabilities natively with less operational overhead.

Amazon CloudFront is designed to cache and deliver content with low latency; it is not intended to store or collect user interaction telemetry as a primary data ingestion mechanism. Triggering Lambda from S3 object creation implies batch/object-based ingestion rather than continuous streaming, and it can create scaling and latency challenges at very high volumes. This is an architectural mismatch for real-time behavior analytics.

Incorrect. Although IAM Identity Center is the right service for multi-account SSO, the trust model described here is not the standard supported approach for integrating AWS Managed Microsoft AD with an on-premises self-managed AD for this use case. A one-way forest or domain trust is not the best answer when the expected architecture for IAM Identity Center with Microsoft AD relies on a two-way forest trust. Because the option specifies the wrong trust relationship, it is less effective and technically inaccurate for the scenario.

Incorrect. AWS Directory Service by itself does not provide the centralized AWS account SSO experience required across all 15 AWS accounts. It can support directory-aware workloads, domain joining, and trust relationships, but it does not replace IAM Identity Center for assigning users and groups to multiple AWS accounts through AWS Organizations. The question explicitly asks for a unified SSO authentication system across accounts, which points to IAM Identity Center rather than Directory Service alone.

Incorrect. An on-premises identity provider such as AD FS can federate users into AWS, but this adds operational overhead and is not the most effective solution for centralized access across many AWS accounts. IAM Identity Center already provides native integration with AWS Organizations, centralized permission sets, and streamlined account assignments, which are key requirements here. This option also does not clearly preserve the existing Microsoft AD as the direct centralized identity source in the simplest AWS-native way.

AWS Systems Manager Automation is best for executing operational workflows (patching, AMI baking steps, instance recovery actions) using runbooks. While it can orchestrate API calls, it is not designed to model and version an entire multi-resource architecture as a reusable, declarative blueprint. It also does not inherently provide the same repeatable, environment-parameterized stack lifecycle management that CloudFormation provides.

AWS Config primarily records configuration history, evaluates resources against rules, and reports compliance. Although Config remediation can trigger automation to correct specific noncompliant settings, it is not intended to provision an entire application stack from scratch across multiple AZs. Using Config as a deployment mechanism is a misuse and would be complex, brittle, and not aligned with standard IaC best practices.

Elastic Beanstalk is a managed application deployment service that provisions underlying resources for supported web/app platforms. It is not well-suited for a bespoke architecture requiring explicit control of a Network Load Balancer configuration, Auto Scaling details, and an Aurora cluster designed for banking transactions. Beanstalk can deploy across multiple AZs, but it abstracts infrastructure and is not the best fit for replicating a validated prototype exactly.

Denying ec2:DeleteSnapshot in IAM can reduce accidental deletions for a specific principal, but it’s not a reliable safety net. The script could run under another role, an admin could still delete, and it doesn’t provide recovery if deletion happens. It also conflicts with the requirement to allow deletions (not keep snapshots forever) because you’d need exceptions and more policy management.

Copying snapshots to another Region is primarily a disaster recovery strategy for regional outages, not an accidental-deletion safety net. If the same automation or operator deletes snapshots in both Regions (or if permissions allow), you can still lose them. It also adds ongoing cost and operational complexity (copy schedules, monitoring, retention management) compared to a simple recycle bin rule.

EBS snapshots are not objects you can copy directly into an S3 bucket and then choose S3 Standard-IA. Snapshots are stored and managed by the EBS snapshot service. While some AWS services can export certain data to S3, “copy snapshots to S3 Standard-IA” is not a valid native mechanism for EBS snapshot retention and recovery in this context.

Creating EBS snapshots of the AMIs and storing them in another account protects the underlying block data, but it does not preserve the AMI registration itself. To recover, the company would need to identify the correct snapshots and manually re-register a new AMI, which adds operational steps and complexity. This is less convenient than copying the AMI directly. Therefore, it does not best satisfy the requirement for easy recovery with minimal effort.

A Recycle Bin retention rule can help retain deleted EBS snapshots and, in some cases, EBS-backed AMIs if configured appropriately, but it is not the strongest answer for protecting critical AMIs in a broadly recoverable way. It depends on retention rules being in place beforehand and does not provide the account-isolation benefits of a separate backup account. In many exam scenarios, Recycle Bin is better suited to snapshot or AMI undelete retention use cases rather than full backup protection of critical machine images. Because the question asks for protecting AMIs and snapshots with easy recovery, a cross-account AMI copy is the more complete solution.

AMIs are not stored by uploading them as objects into an S3 bucket for Cross-Region Replication. An AMI consists of EC2 image metadata plus references to underlying snapshots, typically EBS snapshots. AWS provides AMI copy functionality for duplicating AMIs across accounts or regions, not S3 CRR. This option is technically incorrect and reflects a misunderstanding of how AMIs are managed in AWS.

Uploading 85 TB via AWS CLI over the internet consumes significant WAN bandwidth and is usually slow and operationally risky (retries, long transfer windows). While multipart upload helps with large objects, it does not meet the requirement to minimize network bandwidth usage. This option is best only when bandwidth is ample and time constraints are modest.

S3 File Gateway provides an NFS mount backed by S3, but it still transfers data to AWS over the network. Copying 85 TB through the gateway will consume substantial bandwidth and can take a long time depending on the internet link. File Gateway is better for ongoing hybrid workflows and caching, not for minimizing bandwidth during a bulk migration.

Direct Connect can provide higher, more consistent throughput than the public internet, but it still uses network bandwidth and typically has provisioning lead time and ongoing costs. For a one-time, static 85 TB migration with a requirement to minimize network usage, Snowball is more appropriate and usually faster to initiate than setting up Direct Connect.

SQS + Auto Scaling workers is a solid decoupled pattern, but scheduled scaling is not “maximum resilience and automatic scaling” for highly variable workloads. It relies on predictions and historical patterns, which can miss unexpected spikes or changes in month-end timing/volume. It can also keep excess capacity running during low periods, increasing cost and operational tuning effort compared to queue-depth-driven scaling.

Keeping a coordinator server preserves a single point of failure and a scaling choke point, reducing resilience. CloudTrail is for auditing API calls, not for capturing or routing job distribution events. Scaling based on coordinator CPU is an indirect metric that may not correlate with backlog or throughput, and it can lead to delayed or unstable scaling behavior during spikes.

EventBridge can route events, but it does not replace the need for durable task buffering and back-pressure the way SQS does for batch workloads. Retaining a coordinator server still introduces a single point of failure and operational overhead. CPU-based scaling on workers is less accurate than queue-depth scaling because CPU may not reflect pending work (e.g., I/O waits), causing under/over-scaling.

Incorrect. AWS IAM Identity Center (formerly AWS SSO) commonly integrates with external IdPs using SAML 2.0, and its native directory options do not equate to “direct LDAP federation” for console access. LDAP by itself is not a web federation protocol for AWS console sign-in. Without a SAML-capable IdP or a translation layer, users cannot authenticate to the AWS console directly with LDAP credentials.

Incorrect. Creating an IAM policy and “integrating it into LDAP” misunderstands the separation of authentication (who you are) and authorization (what you can do). LDAP can store identities and groups, but it does not natively issue AWS credentials or enforce IAM policies. AWS permissions must be enforced by IAM roles/policies in AWS, not embedded into LDAP as a substitute for federation.

Incorrect. Rotating IAM credentials whenever LDAP credentials change implies managing long-term IAM users and synchronizing passwords/keys across systems. This is operationally complex, does not provide true federated SSO, and violates best practices that recommend using temporary credentials (STS) and centralized identity management. It also increases risk because long-lived credentials are harder to control and audit.

Kinesis Data Streams is designed for real-time streaming ingestion, not batch processing of video files in S3. You would still need a speech-to-text service (e.g., Transcribe) to extract spoken content. Relying on custom regex to remove PHI/PII is brittle and likely to miss sensitive data, creating HIPAA risk. This option adds complexity without meeting the core requirement reliably.

Amazon Textract extracts text from documents and images (OCR and forms/tables), not from audio tracks in video recordings. A Lambda-triggered Textract job would not transcribe speech. Even if text were present as burned-in captions, Textract would not address PHI/PII redaction automatically. This option mismatches the media type and the compliance requirement.

Amazon Chime SDK meeting flows are intended for live meeting audio processing, not for offline transcription of stored S3 video files. Adding Comprehend Medical for PHI detection increases complexity and still requires a transcription step first. EventBridge can trigger workflows, but S3 event notifications are simpler here. Overall, this is an overengineered and less appropriate architecture for the stated batch-on-upload requirement.

Incorrect. Systems Manager Parameter Store SecureString provides encrypted storage and IAM-controlled access, but it is not the best fit for automated database credential rotation at scale compared to Secrets Manager. While rotation can be engineered with custom automation, it increases operational burden and complexity. For exam scenarios involving RDS credential rotation and compliance, Secrets Manager is typically the intended service.

Incorrect. Storing encrypted credential files in S3 still relies on distributing and managing credential artifacts and does not provide a robust, integrated rotation mechanism with RDS. It also increases the risk of misconfiguration (bucket policies, object ACLs) and complicates least-privilege access patterns. S3 encryption addresses data at rest, not secret lifecycle management and rotation.

Incorrect. Encrypting EBS volumes protects credentials at rest on each instance, but credentials remain locally stored and must be rotated across 15 instances, increasing administrative burden and risk of inconsistency. A custom Lambda rotation script adds complexity and does not inherently ensure atomic rotation with RDS and immediate propagation to all instances. This is not the recommended AWS-native approach.

Amazon ECS on EC2 is not cost-effective for a static landing page. You must pay for EC2 instances (and potentially an ALB), manage scaling policies, patch underlying hosts (unless using Fargate), and operate container infrastructure. While it can handle traffic, it adds unnecessary complexity and ongoing costs compared to S3 for static HTML/CSS/JS and media assets.

A single EC2 t3.medium with Apache introduces fixed compute cost and operational overhead (OS patching, web server maintenance, monitoring). It also creates availability and scaling risks: one instance can become a bottleneck or single point of failure during traffic spikes. Even with Auto Scaling and load balancing, the solution becomes more expensive and complex than S3 for static content.

API Gateway with Lambda to dynamically render pages is unnecessary for static promotional content. This design adds complexity (templates, function code, deployments) and can increase cost due to per-request charges and execution time, especially if serving large media assets. It is better suited for dynamic, personalized, or API-driven experiences—not a static landing page with images/videos/CSS/JS.

Incorrect. AWS DataSync does not support transferring data directly into Amazon FSx for Lustre as described in this option. The explanation's claim that FSx for Lustre exposes an NFS endpoint for DataSync destination use is inaccurate; FSx for Lustre uses the Lustre protocol rather than acting as a generic NFS destination for DataSync. Because the transfer path itself is not valid, this option cannot be selected even though DataSync does preserve POSIX metadata in supported scenarios.

Incorrect. Using rsync to copy files into Amazon S3 converts filesystem data into objects and does not preserve POSIX permissions, ownership, and symbolic links as native filesystem constructs. Once the data is staged in S3 this way, the required metadata fidelity may already be lost before DataSync is used. This makes the option unsuitable for a compliance-sensitive migration that explicitly requires preservation of POSIX attributes and symlinks.

Incorrect. AWS Snowmobile is intended for extremely large migrations, typically in the multi-petabyte range or larger, so it is excessive for a 500 TB workload. The option also introduces Amazon S3 as an intermediate staging layer, which is not ideal when strict preservation of POSIX permissions and symbolic links is required. Snowball Edge is the more appropriate offline transfer service for this data volume and operational scenario.

A Network Load Balancer can distribute TCP/UDP traffic, but it is not purpose-built for transparent inline security appliance insertion across VPCs. NLB does not provide the same route-table-based service insertion model (via endpoints) that makes steering traffic to appliances operationally simple. You would still need additional routing, NAT, or proxy patterns and may lose key transparency requirements, increasing management overhead.

An Application Load Balancer operates at Layer 7 (HTTP/HTTPS) and typically terminates client connections, which is not appropriate for generic packet inspection and can break end-to-end encryption expectations unless you manage certificates and re-encryption. DLP appliances that inspect packets at the network layer are not integrated through ALB in a transparent way. This adds complexity and is not the intended AWS pattern.

A transit gateway is excellent for hub-and-spoke connectivity and centralized routing between VPCs and on-premises networks. However, it does not by itself provide a managed mechanism to load balance traffic through a fleet of security appliances or to perform transparent service insertion. You would still need to build custom routing and scaling/HA patterns for the appliance, increasing operational overhead compared to GWLB.

Amazon GuardDuty analyzes signals (e.g., VPC Flow Logs, DNS logs, CloudTrail) to detect threats and generate findings. It is primarily a detective control and does not function as an inline firewall performing DPI, protocol validation, or intrusion prevention. While you can automate responses (e.g., via Lambda) to quarantine resources, it is not designed to centrally enforce stateful filtering for all north-south and east-west traffic at high throughput.

VPC Traffic Mirroring copies traffic from ENIs to a monitoring appliance for analysis. This is useful for IDS tooling, troubleshooting, and forensics, but it is out-of-band: mirrored traffic inspection does not inherently block or filter the original traffic flow. It also introduces operational complexity (scaling EC2 appliances, managing failover) and does not provide the native centralized, inline policy enforcement required for IPS-like controls across AZs.

AWS Firewall Manager is a governance and policy orchestration service that helps centrally deploy and manage protections across accounts and VPCs (e.g., AWS WAF, Shield Advanced, security group policies, and AWS Network Firewall policies). However, it is not itself a traffic inspection or intrusion prevention engine. Security groups and NACLs also lack DPI/IPS capabilities and are limited to L3/L4 controls, so this option does not meet the stated requirements.

This option meets the performance requirement because S3 Standard provides immediate access, and transitioning to IA later can reduce some cost. However, it is not the most cost-effective option because all content starts in the most expensive storage class, even though older movies are explicitly lower demand. The question asks to minimize hosting cost based on demand, and this option does not take advantage of lower-cost archival storage for older content.

This option is flawed because it refers to 'standard retrieval' for old movies in S3 Standard-IA, but Standard-IA does not use Glacier-style retrieval tiers or restore operations. While Standard-IA does provide immediate access and could meet the timing requirement, the wording indicates confusion about the service behavior. More importantly, it is not as cost-efficient for very old, low-demand movies as Glacier Flexible Retrieval with expedited retrieval, which is what the question is steering toward.

This option fails the 5-minute requirement because bulk retrieval from S3 Glacier Flexible Retrieval typically takes hours, not minutes. Although Glacier Flexible Retrieval is cost-effective for storage, the selected retrieval tier is too slow for on-demand streaming shortly after purchase. Therefore, it cannot satisfy the stated availability target.

Instance store can provide very high IOPS, but restoring EBS snapshots directly onto instance store is not a native “restore” operation; you would need to copy data at the OS/file level after creating EBS volumes from snapshots, which is time-consuming for 50 TB. It also adds operational complexity and risk of missing the 4-hour window. Additionally, instance store is ephemeral, which is usually undesirable for repeatable compliance testing datasets.

EBS Multi-Attach is only supported for io1/io2 and is intended for clustered applications with coordinated writes, not for creating isolated clones. Attaching the same production volumes to staging violates the requirement for complete isolation and risks data corruption or performance impact if the staging environment performs writes. Snapshots do not change the fact that the option proposes attaching production volumes, which is the core issue.

Creating new EBS volumes and restoring from snapshots provides isolation, but without Fast Snapshot Restore the volumes are lazy-loaded. To achieve consistent high performance, you often must initialize the volumes by reading all blocks, which for 50 TB can take a long time and may exceed the 4-hour window. This option is plausible but does not minimize cloning time nor guarantee immediate sustained 10,000+ IOPS performance after restore.

AWS Budgets is primarily designed for setting cost or usage thresholds and sending alerts when spending exceeds defined limits. Although budgets can be scoped with filters and cost categories, they are not intended for detailed exploratory analysis of historical EC2 spending patterns over a 60-day period. The question asks for investigation and visualization of what drove the increase, which is better handled by Cost Explorer. Budgets is useful as a complementary governance tool, but not as the primary analysis solution here.

The AWS Billing Dashboard provides summary-level billing views and basic charts, but it does not offer the level of drill-down needed to isolate which EC2 instance types or related families caused the compute cost increase. It is useful for seeing that costs changed, but not for performing detailed analysis across a custom time window with flexible grouping. Because the requirement is to identify the specific drivers of the spike, the Billing Dashboard is too limited. It lacks the richer investigative capabilities available in Cost Explorer.

AWS Cost and Usage Reports combined with Amazon S3 and Amazon QuickSight can absolutely provide highly detailed and customizable cost analytics, including line-item billing analysis. However, this approach requires enabling CUR, storing and managing report data, preparing datasets, and building dashboards, which adds more implementation and maintenance effort. The question explicitly asks for minimal management effort, so this solution is unnecessarily complex for a 60-day EC2 cost investigation. It is more appropriate when an organization needs advanced custom reporting beyond native billing tools.

EC2 with Docker Engine and Auto Scaling Groups can scale the number of instances, but it leaves significant operational work: AMI maintenance, OS patching, capacity planning, container scheduling, service discovery, and rolling deployments. You would also need additional tooling (or build your own) to orchestrate containers across instances. This contradicts the requirement to eliminate server provisioning and minimize infrastructure management.

ECS with EC2 launch type improves orchestration versus raw EC2 + Docker, but you still manage the EC2 cluster: instance selection, patching, scaling policies, and ensuring enough spare capacity for task placement during spikes. Cluster Auto Scaling helps, yet it remains more operationally heavy than Fargate and can require careful tuning to avoid capacity shortages during rapid traffic surges.

Using ECS-optimized AMIs on EC2 and manually configuring orchestration is the highest operational burden among the options. Even if ECS is used, “manually configure” implies more hands-on management of cluster capacity, deployments, and maintenance. This directly conflicts with the requirement to focus on application logic and avoid server provisioning and ongoing infrastructure maintenance.