Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

Enforce tenant-scoped database authorization and key-based access would help if a shared table filters tenants only in app memory after querying all records. Safe multitenancy requires robust data-level boundaries. That is not the symptom described here: storage costs rise because tenant audit histories are retained indefinitely. The matching response is Implement compliant tiering and expiration for historical records, because data lifecycle policies control unbounded growth.

For the alternative failure customers' usage swings unpredictably throughout the day, the control Consider Aurora Serverless v2 or DynamoDB on-demand where workload semantics fit is relevant: elastic pricing aligns capacity with variable demand. Here the evidence instead is storage costs rise because tenant audit histories are retained indefinitely. The selected technical mechanism is Implement compliant tiering and expiration for historical records: data lifecycle policies control unbounded growth.

Keep dedicated databases/accounts according to compliance rather than pooling solves a different operational problem where tenants require physical data separation by legal contract. Isolation requirements override cost optimization. It does not directly address storage costs rise because tenant audit histories are retained indefinitely. The case calls for Implement compliant tiering and expiration for historical records, since data lifecycle policies control unbounded growth.

Evaluate a Secrets Manager interface endpoint including hourly and data-processing charges would help if frequent Secrets Manager calls in one VPC incur NAT traffic and can use private endpoints. Endpoint economics depend on call volume and hourly charges. That is not the symptom described here: instances download large volumes from S3 through a billed NAT gateway. The matching response is Use an S3 gateway endpoint and associate the appropriate route tables, because gateway endpoints avoid NAT data-processing fees for supported S3 routes.

For the alternative failure eC2 calls DynamoDB from private subnets through NAT, the control Add a DynamoDB gateway VPC endpoint with route associations is relevant: dynamoDB gateway routes avoid internet egress for API calls. Here the evidence instead is instances download large volumes from S3 through a billed NAT gateway. The selected technical mechanism is Use an S3 gateway endpoint and associate the appropriate route tables: gateway endpoints avoid NAT data-processing fees for supported S3 routes.

Reassess egress design against traffic, availability and endpoint costs solves a different operational problem where a quiet development VPC pays for multiple NAT gateways continuously. NAT gateway hourly charges matter for very low-traffic workloads. It does not directly address instances download large volumes from S3 through a billed NAT gateway. The case calls for Use an S3 gateway endpoint and associate the appropriate route tables, since gateway endpoints avoid NAT data-processing fees for supported S3 routes.

Use an S3 gateway endpoint and associate the appropriate route tables solves a different operational problem where instances download large volumes from S3 through a billed NAT gateway. Gateway endpoints avoid NAT data-processing fees for supported S3 routes. It does not directly address eC2 calls DynamoDB from private subnets through NAT. The case calls for Add a DynamoDB gateway VPC endpoint with route associations, since dynamoDB gateway routes avoid internet egress for API calls.

The competing option Place NAT gateways per relevant AZ with local private route tables when cost-effective would be useful when private apps cross an AZ to use a shared NAT gateway and pay cross-AZ data transfer. AZ-local egress avoids cross-AZ data transfer and improves resilience. The present issue is eC2 calls DynamoDB from private subnets through NAT; it is more directly addressed by Add a DynamoDB gateway VPC endpoint with route associations. DynamoDB gateway routes avoid internet egress for API calls.

The option Reassess egress design against traffic, availability and endpoint costs addresses a separate condition: a quiet development VPC pays for multiple NAT gateways continuously. NAT gateway hourly charges matter for very low-traffic workloads. The actual requirement is eC2 calls DynamoDB from private subnets through NAT. Recommended corrective action: Add a DynamoDB gateway VPC endpoint with route associations. DynamoDB gateway routes avoid internet egress for API calls.

Use an S3 gateway endpoint and associate the appropriate route tables solves a different operational problem where instances download large volumes from S3 through a billed NAT gateway. Gateway endpoints avoid NAT data-processing fees for supported S3 routes. It does not directly address frequent Secrets Manager calls in one VPC incur NAT traffic and can use private endpoints. The case calls for Evaluate a Secrets Manager interface endpoint including hourly and data-processing charges, since endpoint economics depend on call volume and hourly charges.

The competing option Reassess egress design against traffic, availability and endpoint costs would be useful when a quiet development VPC pays for multiple NAT gateways continuously. NAT gateway hourly charges matter for very low-traffic workloads. The present issue is frequent Secrets Manager calls in one VPC incur NAT traffic and can use private endpoints; it is more directly addressed by Evaluate a Secrets Manager interface endpoint including hourly and data-processing charges. Endpoint economics depend on call volume and hourly charges.

The option Place NAT gateways per relevant AZ with local private route tables when cost-effective addresses a separate condition: private apps cross an AZ to use a shared NAT gateway and pay cross-AZ data transfer. AZ-local egress avoids cross-AZ data transfer and improves resilience. The actual requirement is frequent Secrets Manager calls in one VPC incur NAT traffic and can use private endpoints. Recommended corrective action: Evaluate a Secrets Manager interface endpoint including hourly and data-processing charges. Endpoint economics depend on call volume and hourly charges.

The option Evaluate a Secrets Manager interface endpoint including hourly and data-processing charges addresses a separate condition: frequent Secrets Manager calls in one VPC incur NAT traffic and can use private endpoints. Endpoint economics depend on call volume and hourly charges. The actual requirement is private apps cross an AZ to use a shared NAT gateway and pay cross-AZ data transfer. Recommended corrective action: Place NAT gateways per relevant AZ with local private route tables when cost-effective. AZ-local egress avoids cross-AZ data transfer and improves resilience.

Use an S3 gateway endpoint and associate the appropriate route tables would help if instances download large volumes from S3 through a billed NAT gateway. Gateway endpoints avoid NAT data-processing fees for supported S3 routes. That is not the symptom described here: private apps cross an AZ to use a shared NAT gateway and pay cross-AZ data transfer. The matching response is Place NAT gateways per relevant AZ with local private route tables when cost-effective, because aZ-local egress avoids cross-AZ data transfer and improves resilience.

For the alternative failure a quiet development VPC pays for multiple NAT gateways continuously, the control Reassess egress design against traffic, availability and endpoint costs is relevant: nAT gateway hourly charges matter for very low-traffic workloads. Here the evidence instead is private apps cross an AZ to use a shared NAT gateway and pay cross-AZ data transfer. The selected technical mechanism is Place NAT gateways per relevant AZ with local private route tables when cost-effective: aZ-local egress avoids cross-AZ data transfer and improves resilience.

The option Place NAT gateways per relevant AZ with local private route tables when cost-effective addresses a separate condition: private apps cross an AZ to use a shared NAT gateway and pay cross-AZ data transfer. AZ-local egress avoids cross-AZ data transfer and improves resilience. The actual requirement is a quiet development VPC pays for multiple NAT gateways continuously. Recommended corrective action: Reassess egress design against traffic, availability and endpoint costs. NAT gateway hourly charges matter for very low-traffic workloads.

Add a DynamoDB gateway VPC endpoint with route associations would help if eC2 calls DynamoDB from private subnets through NAT. DynamoDB gateway routes avoid internet egress for API calls. That is not the symptom described here: a quiet development VPC pays for multiple NAT gateways continuously. The matching response is Reassess egress design against traffic, availability and endpoint costs, because nAT gateway hourly charges matter for very low-traffic workloads.

Evaluate a Secrets Manager interface endpoint including hourly and data-processing charges solves a different operational problem where frequent Secrets Manager calls in one VPC incur NAT traffic and can use private endpoints. Endpoint economics depend on call volume and hourly charges. It does not directly address a quiet development VPC pays for multiple NAT gateways continuously. The case calls for Reassess egress design against traffic, availability and endpoint costs, since nAT gateway hourly charges matter for very low-traffic workloads.

Enable appropriate HTTP compression and compact response formats would help if an API is billed for large uncompressed HTTP responses. Compression lowers bytes transmitted. That is not the symptom described here: every global user downloads identical static images directly from a regional ALB. The matching response is Use CloudFront caching with an appropriate cache policy, because edge cache hits reduce origin requests and data transfer paths.

For the alternative failure a live service pays for CloudFront yet caching is disabled for every route, the control Enable cache behaviors only on safe reusable content and measure hit ratio is relevant: cache utility depends on response reusability. Here the evidence instead is every global user downloads identical static images directly from a regional ALB. The selected technical mechanism is Use CloudFront caching with an appropriate cache policy: edge cache hits reduce origin requests and data transfer paths.

Add cache-control headers and versioned object filenames solves a different operational problem where s3 origin serves immutable assets but clients re-request them despite unchanged contents. Versioned immutable assets permit long cache retention. It does not directly address every global user downloads identical static images directly from a regional ALB. The case calls for Use CloudFront caching with an appropriate cache policy, since edge cache hits reduce origin requests and data transfer paths.

For the alternative failure an API is billed for large uncompressed HTTP responses, the control Enable appropriate HTTP compression and compact response formats is relevant: compression lowers bytes transmitted. Here the evidence instead is hTML personalized per customer is accidentally shared by cache to other users. The selected technical mechanism is Separate non-cacheable authenticated content from public cacheable assets: cache policy must not leak customer-specific responses.

The competing option Enable cache behaviors only on safe reusable content and measure hit ratio would be useful when a live service pays for CloudFront yet caching is disabled for every route. Cache utility depends on response reusability. The present issue is hTML personalized per customer is accidentally shared by cache to other users; it is more directly addressed by Separate non-cacheable authenticated content from public cacheable assets. Cache policy must not leak customer-specific responses.

The option Add cache-control headers and versioned object filenames addresses a separate condition: s3 origin serves immutable assets but clients re-request them despite unchanged contents. Versioned immutable assets permit long cache retention. The actual requirement is hTML personalized per customer is accidentally shared by cache to other users. Recommended corrective action: Separate non-cacheable authenticated content from public cacheable assets. Cache policy must not leak customer-specific responses.

The competing option Use CloudFront caching with an appropriate cache policy would be useful when every global user downloads identical static images directly from a regional ALB. Edge cache hits reduce origin requests and data transfer paths. The present issue is an API is billed for large uncompressed HTTP responses; it is more directly addressed by Enable appropriate HTTP compression and compact response formats. Compression lowers bytes transmitted.

The option Separate non-cacheable authenticated content from public cacheable assets addresses a separate condition: hTML personalized per customer is accidentally shared by cache to other users. Cache policy must not leak customer-specific responses. The actual requirement is an API is billed for large uncompressed HTTP responses. Recommended corrective action: Enable appropriate HTTP compression and compact response formats. Compression lowers bytes transmitted.

Enable cache behaviors only on safe reusable content and measure hit ratio would help if a live service pays for CloudFront yet caching is disabled for every route. Cache utility depends on response reusability. That is not the symptom described here: an API is billed for large uncompressed HTTP responses. The matching response is Enable appropriate HTTP compression and compact response formats, because compression lowers bytes transmitted.

The option Enable appropriate HTTP compression and compact response formats addresses a separate condition: an API is billed for large uncompressed HTTP responses. Compression lowers bytes transmitted. The actual requirement is s3 origin serves immutable assets but clients re-request them despite unchanged contents. Recommended corrective action: Add cache-control headers and versioned object filenames. Versioned immutable assets permit long cache retention.

Use CloudFront caching with an appropriate cache policy would help if every global user downloads identical static images directly from a regional ALB. Edge cache hits reduce origin requests and data transfer paths. That is not the symptom described here: s3 origin serves immutable assets but clients re-request them despite unchanged contents. The matching response is Add cache-control headers and versioned object filenames, because versioned immutable assets permit long cache retention.

For the alternative failure hTML personalized per customer is accidentally shared by cache to other users, the control Separate non-cacheable authenticated content from public cacheable assets is relevant: cache policy must not leak customer-specific responses. Here the evidence instead is s3 origin serves immutable assets but clients re-request them despite unchanged contents. The selected technical mechanism is Add cache-control headers and versioned object filenames: versioned immutable assets permit long cache retention.

Add cache-control headers and versioned object filenames would help if s3 origin serves immutable assets but clients re-request them despite unchanged contents. Versioned immutable assets permit long cache retention. That is not the symptom described here: a live service pays for CloudFront yet caching is disabled for every route. The matching response is Enable cache behaviors only on safe reusable content and measure hit ratio, because cache utility depends on response reusability.

For the alternative failure an API is billed for large uncompressed HTTP responses, the control Enable appropriate HTTP compression and compact response formats is relevant: compression lowers bytes transmitted. Here the evidence instead is a live service pays for CloudFront yet caching is disabled for every route. The selected technical mechanism is Enable cache behaviors only on safe reusable content and measure hit ratio: cache utility depends on response reusability.

Use CloudFront caching with an appropriate cache policy solves a different operational problem where every global user downloads identical static images directly from a regional ALB. Edge cache hits reduce origin requests and data transfer paths. It does not directly address a live service pays for CloudFront yet caching is disabled for every route. The case calls for Enable cache behaviors only on safe reusable content and measure hit ratio, since cache utility depends on response reusability.