Amazon Web Services SAA-C03 - AWS Certified Solutions Architect - Associate (SAA-C03)

EC2 Image Builder is the AWS-managed service specifically designed to automate the creation, patching, hardening, and testing of AMIs.

For this scenario, best practice is to:

Use EC2 Image Builder pipelines to generate new golden AMIs whenever features are deployed or on a schedule.

Include build components such as update-linux to automatically apply OS security patches and updates during image creation.

Deploy the new AMIs through existing Auto Scaling groups, ensuring that every newly launched instance is already patched and compliant.

This approach:

Prevents OS vulnerabilities from being introduced at deployment time.

Scales across dozens of applications because AMI pipelines are reusable and automated.

Minimizes manual effort and reduces drift between instances.

Amazon Inspector (Option A) identifies vulnerabilities but does not itself patch AMIs.

AWS Backup (Option B) is for data protection, not vulnerability management.

Patch Manager (Option C) patches running instances, but the requirement is to ensure vulnerabilities are not introduced with new AMIs; golden image pipelines with EC2 Image Builder are the recommended solution.

Comprehensive and Detailed 250 to 300 words of Explanation (AWS documentation-based, no links):

The company wants to increase security and reduce operational overhead for SQL Server relational databases. The most direct AWS managed service for SQL Server is Amazon RDS for SQL Server, which offloads routine database administration tasks such as provisioning, backups, patching (within managed service controls), monitoring integrations, and high availability management compared with running SQL Server on self-managed EC2.

Choosing Multi-AZ enhances availability and resilience by maintaining a synchronous standby in a separate Availability Zone with automated failover. This improves overall security posture and operational reliability because the platform handles common infrastructure failure scenarios without requiring custom clustering or manual intervention.

For encryption of sensitive data, integrating RDS with AWS KMS allows encryption at rest using KMS keys. Using an AWS managed key is operationally simple while still providing strong encryption controls, auditability, and centralized key management.

Option A still requires managing the database on EC2 (OS patching, SQL Server patching, backups, HA design, monitoring, recovery), which increases operational overhead significantly. Option C is not a database migration approach; S3 plus Macie does not provide a relational SQL Server engine for applications. Option D changes the data model by moving to DynamoDB and does not preserve SQL Server relational capabilities; CloudWatch Logs is not a data security control for database content.

Therefore, B best satisfies the goals: a managed relational database service (RDS for SQL Server) with built-in high availability (Multi-AZ) and encryption at rest via KMS, reducing ongoing operational work while improving security controls.

Amazon RDS Proxy helps manage thousands of concurrent database connections by pooling and reusing them efficiently. It is especially useful for serverless applications like AWS Lambda that can open numerous connections quickly, potentially overwhelming the database. Using RDS Proxy reduces connection management overhead and improves fault tolerance.

Amazon QuickSight includes built-in ML-powered forecasting capabilities, allowing you to create, visualize, and interact with time series forecasts directly within the BI dashboard, with no ML experience or infrastructure management required. This is the lowest management overhead solution.

AWS Documentation Extract:

" Amazon QuickSight provides built-in ML-powered forecasting, allowing business users to forecast future trends with a few clicks and no machine learning expertise required. "

(Source: Amazon QuickSight documentation)

A, C, D: Require additional setup, management, or ML knowledge.

EBS Encryption:

Default EBS Encryption: Can be enabled for new EBS volumes.

Use of AWS KMS: Specify AWS KMS keys to handle encryption and decryption of data transparently.

Amazon RDS Encryption:

RDS Encryption: Encrypts the underlying storage for RDS instances using AWS KMS.

Configuration: Enable encryption when creating the RDS instance or modify an existing instance to enable encryption.

Least Amount of Changes:

Both EBS and RDS support seamless encryption with AWS KMS, requiring minimal changes to the existing infrastructure.

Enables compliance with regulatory requirements without modifying the application.

Operational Efficiency: Using AWS KMS for both EBS and RDS ensures a consistent, managed approach to encryption, simplifying key management and enhancing security.

The recommended and simplest method for granting cross-account access to an S3 bucket is to use a bucket policy that grants permission to the other AWS account.

This provides direct, controlled, IAM-based access without duplication of data or use of distribution mechanisms like CloudFront.

Transfer Acceleration and replication are unrelated to permissions.

=====================================================

Amazon Macie: Detects sensitive data such as PII in S3 buckets using machine learning.

EventBridge Rule: Filters Macie findings for specific sensitive data events (e.g., SensitiveData).

SNS Notification: Provides real-time alerts to the security team for immediate action.

Amazon Macie Documentation,Amazon EventBridge Documentation

Amazon Managed Streaming for Apache Kafka (Amazon MSK) is a fully managed service that makes it easy to build and run applications that use Apache Kafka to process streaming data. By using Amazon ECS with the AWS Fargate launch type, you can run containers without managing servers or clusters. This combination reduces operational overhead and provides scalability.

Instances in a private subnet cannot directly reach the internet because they do not have public IP addresses and the private subnet route table typically does not send 0.0.0.0/0 traffic to an internet gateway. However, these instances still need outbound-only internet access to download patches and updates while remaining inaccessible from the internet. The standard AWS design to achieve this is a NAT gateway deployed in a public subnet.

Option C is required because a NAT gateway must reside in a public subnet that has a route to the internet gateway. This allows the NAT gateway to forward outbound traffic from private instances to the internet and return responses, without allowing inbound connections initiated from the internet to those instances.

Option A is required because a NAT gateway uses an Elastic IP address to represent its public-facing identity on the internet. Without an Elastic IP, the NAT gateway cannot communicate with internet endpoints. The Elastic IP is associated with the NAT gateway, not with the internet gateway.

Option B is required because the private subnet needs a route for 0.0.0.0/0 (default route) that targets the NAT gateway. This ensures that outbound internet-bound traffic from the private instances is sent to the NAT gateway rather than being dropped.

Option D is incorrect because a NAT gateway in a private subnet would not have a working route to the internet gateway and would not provide internet egress. Option E is incorrect because the public subnet’s default route should point to the internet gateway, not to the NAT gateway. Option F is incorrect because you do not associate Elastic IPs with an internet gateway.

Therefore, A, B, and C correctly implement private subnet outbound internet access while keeping the instances unreachable from the internet.

AWS App2Container is a command-line tool that helps containerize existing Java and .NET applications running on-premises or on virtual machines, with minimal refactoring. By using Amazon EKS, the company benefits from a managed Kubernetes service, which significantly reduces the operational overhead compared to managing Kubernetes on EC2.

Amazon RDS for SQL Server provides a fully managed SQL Server database engine with automated backups, patching, and high availability through Multi-AZ deployments. This eliminates the need for the company to manage database infrastructure and software manually.

Overall, option A provides the most streamlined and managed approach for both the application and database layers with the least operational effort.

The most secure and AWS-recommended way for EC2 instances to access AWS services is by using IAM roles attached through instance profiles. Option C correctly implements this pattern.

IAM roles provide temporary credentials via the EC2 metadata service, eliminating the need for long-term access keys. Using CloudFormation ensures consistent, repeatable deployments across Regions while maintaining security best practices.

All other options expose long-term credentials, increasing the risk of compromise and violating AWS security guidance. Therefore, C is the correct and most secure solution.

CloudFront requires ACM certificates to be created in us-east-1. Origin Access Control (OAC) securely allows CloudFront to upload objects to S3 without exposing the bucket publicly. Transfer Acceleration and S3 website endpoints are unnecessary or incompatible for this use case.

The best combination isAmazon Athenafor SQL-based analysis andAmazon QuickSightfor visualization. AWS documentation includes Athena guidance for creating tables over sampleCloudFront log datastored in Amazon S3, which makes Athena a direct fit for querying those logs without infrastructure management. AWS also describes QuickSight as a scalable business intelligence service for building dashboards and visualizations from query results. Glue is primarily for data cataloging and ETL, not end-user visualization. DynamoDB is not a SQL analytics engine for S3 log files. For advanced analysis of CloudFront logs and dashboard-style visualizations, Athena plus QuickSight is the correct AWS-native pattern. (AWS Documentation)

============

To prevent loss of access to the AWS root user account due to a lost MFA device, AWS recommends enabling multiple MFA devices for the root user.

Multiple MFA Devices: AWS allows up to eight MFA devices (virtual, hardware, or security keys) to be associated with a single root user account. This redundancy ensures that if one device is lost, others can be used to authenticate and access the account.

Security Best Practices: Implementing multiple MFA devices enhances account security and provides resilience against potential access issues.

By proactively setting up multiple MFA devices, the company can maintain uninterrupted access to its critical AWS resources, even in the event of a lost or malfunctioning MFA device.

Amazon EFS offers an Infrequent Access (IA) storage class, which can be managed via EFS lifecycle policies. Frequently accessed files remain in the Standard storage class, while infrequently accessed files are automatically moved to the IA class, significantly reducing storage costs with minimal effort and no application changes.

Reference Extract:

" EFS lifecycle management automatically transitions files that are not accessed for a set period to the EFS Infrequent Access (IA) storage class, reducing storage costs. "

Source: AWS Certified Solutions Architect – Official Study Guide, EFS and Lifecycle Management section.

Aservice control policyis the right control because SCPs apply guardrails at the AWS Organizations level across member accounts. AWS documentation states that SCPs do not grant permissions; instead, they define the maximum permissions available in member accounts. An explicit deny oniam:CreateUserapplied through an SCP prevents new IAM users from being created in those accounts, while existing IAM users can continue to operate within the permissions they already have, subject to the SCP. IAM policies and permissions boundaries are not the best organization-wide control for this requirement because they are not the same centralized account-level guardrail mechanism that SCPs provide. Therefore, the correct answer is to use anSCP denying iam:CreateUser. (AWS Documentation)

============

AWS Secrets Manager natively supports automatic rotation of RDS for Oracle credentials, fully integrating with Amazon RDS. Rotation workflows are managed automatically by the service, eliminating custom scripting and reducing operational effort.

Migrating to EC2 (Option C) requires custom rotation logic. Converting to DynamoDB or Neptune (Options A and D) would require complete database redesign and do not fulfill the requirement to run Oracle.

Amazon EFS is a fully managed, scalable file storage service that can be accessed concurrentlyby thousands of EC2 instances. It supports General Purpose performance mode for latency-sensitive use cases and provides high availability and durability across multiple Availability Zones with minimal changes to application code.

The right solution isAPI Gateway + Lambda + Amazon Comprehend + DynamoDB. AWS documents that Amazon Comprehend is the NLP service for detecting entities, sentiment, and key phrases, which matches the workload exactly. DynamoDB is a fully managed, distributed database designed for high-throughput workloads and single-digit millisecond performance at scale, making it a strong fit for a highly available application handling many concurrent requests. The other answers misuse services: Amazon Translate is for translation, Amazon Textract is for extracting text from documents, and ElastiCache is a cache rather than the durable primary database described in the question. This makes option A the only architecture that aligns with both the NLP functions and the scalable database requirement. (AWS Documentation)

============