SAA-C03 Online Practice Questions

Explanation:
The application requires independent scaling, ordered asynchronous processing, and relational data storage.
Option A provides a microservices-oriented, decoupled architecture using managed services.
Amazon ECS with AWS Fargate enables containerized workloads without server management and allows each component to scale independently. Amazon RDS supports relational data storage for user profiles and content. Amazon SQS ensures reliable, ordered message processing and decouples long-running background tasks, allowing services to evolve independently.
Option B uses SNS, which does not guarantee message ordering.
Option C uses DynamoDB, which does not meet the relational data requirement.
Option D offers less granular scaling and higher coupling.
Therefore, A best meets scalability, resilience, and modularity requirements.

Explanation:
This solution meets the company's requirements with minimal administrative overhead and ensures security and ease of management.
AWS AppConfig: AWS AppConfig is a service designed to manage application configuration in a secure and validated way. It allows you to deploy configurations safely and quickly without affecting the application's performance or availability.
AWS Secrets Manager: AWS Secrets Manager is specifically designed to manage, retrieve, and rotate credentials for databases and other services. It integrates seamlessly with AWS services like Amazon RDS, making it an ideal solution for securely storing and retrieving database credentials. Secrets Manager also provides automatic rotation of credentials, reducing the operational burden.
Why Not Other Options?
Option B (AWS Lambda + Parameter Store): While AWS Lambda can be used for managing configurations and AWS Systems Manager Parameter Store can store credentials, this approach involves more manual setup and does not offer the same level of integrated management and security as AppConfig and Secrets Manager.
Option C (Encrypted S3 Configuration File): Storing configuration and credentials in S3 files involves more manual management and security considerations, increasing the administrative overhead.
Option D (AppConfig + RDS for credentials): RDS is not designed for storing application credentials; it's better suited for managing database instances and their configurations.
AWS
Reference: AWS AppConfig- Describes how to use AWS AppConfig for managing application configurations.
AWS Secrets Manager- Provides details on securely storing and retrieving credentials using AWS Secrets Manager.

Explanation:
Edge-optimized API Gateway endpoints utilize the Amazon CloudFront global network to decrease latency for clients globally. This setup ensures that the request is routed to the closest edge location, significantly reducing response time and improving performance for worldwide users.
Reference: AWS Documentation C Amazon API Gateway Endpoint Types

Explanation:
Why Option B is Correct:
AWS WAF: Provides a simple way to create geographic match rules to block or allow traffic based on country IP ranges.
Least Operational Overhead: Attaching the WAF rule to the ALB ensures centralized control without modifying ACLs or instance firewalls.
Why Other Options Are Not Ideal:
Option A: Network ACLs operate at the subnet level and can become complex to manage for dynamic or evolving IP ranges.
Option C: Managing IP-based rules in security groups and ACLs lacks scalability and does not provide country-based filtering.
Option D: Configuring host-based firewalls increases operational overhead and does not leverage AWS-managed solutions.
AWS
Reference: AWS WAF Geomatch: AWS Documentation - WAF Geomatch

Explanation:
To decouple the monolith and enhance scalability, AWS best practice is to introduce an asynchronous message queue, such as Amazon SQS, between the web/API tier and the order-processing logic.
AWS Lambda functions consuming from the SQS queue provide serverless, auto-scaling processing without managing servers.
To track and reprocess failed orders, SQS supports dead-letter queues (DLQs). Messages that cannot be processed successfully after a configurable number of attempts are automatically moved to the DLQ, where operations teams or automated processes can inspect and reprocess them.
Why others are not correct:
B: ECS tasks can consume an SQS queue, but this requires managing container infrastructure and does not inherently provide as simple reprocessing/visibility as combining Lambda with a DLQ.
Visibility timeout is not a tracking or archival mechanism.
C: Kinesis is a streaming service designed for ordered event streams, not primarily for order-queue semantics and DLQs; SQS is simpler and purpose-built for this pattern.
D: Long polling reduces empty responses and API calls but does nothing for tracking or reprocessing failed messages; without a DLQ, failed orders are harder to manage