Free SAA-C03 flashcards

In IAM evaluation, when does an explicit Deny in a bucket policy actually block an identity-based Allow?

Only when the Deny's conditions match the requesting principal. IAM unions all applicable Allows then lets a matching explicit Deny override. A Deny conditioned on external principals never fires for an in-account principal, so the Allow stands.

Common misconceptionThat an explicit Deny always beats an Allow whatever its conditions say. A Deny fires only when its conditions match the request, so a non-matching Deny leaves the Allow standing.

How can an application on Amazon EC2 read from a specific Amazon S3 bucket without any stored long-lived credentials?

Attach an IAM role through an instance profile with a policy scoped to s3:GetObject on that one bucket. The instance metadata service supplies short-lived credentials that rotate automatically, removing static access keys while granting least privilege.

Common misconceptionThat keys held in Secrets Manager no longer count as static credentials. The application still signs requests with a long-lived IAM user key, so nothing has been removed.

How can a web tier absorb traffic spikes and stop dropping work when downstream EC2 workers are overwhelmed, with the least operational effort?

Put an Amazon SQS standard queue between the producer and the workers. SQS is a durable, pull-based buffer: producers enqueue messages that persist for the retention period, and workers poll and delete them at their own pace. Bursts are smoothed because messages wait in the queue instead of being dropped when consumers are saturated.

What messaging design lets one upload event trigger several independent tasks in parallel, where teams can be added or removed without changing the producer?

Use the SNS-to-SQS fan-out pattern: publish the event to an Amazon SNS topic and subscribe one Amazon SQS queue per task. SNS broadcasts a copy to every subscribed queue, so each task gets its own durable copy to process in parallel and at its own pace. Tasks are added or removed by changing subscriptions, not the uploader code.

Common misconceptionThat every consumer polling one SQS queue gets its own copy of each message. A standard queue hands each message to a single consumer, so competing tasks split the events between them.

In Amazon S3, how do you raise the achievable request rate for a workload hitting HTTP 503 slow-down responses on a single key prefix?

Amazon S3 scales request throughput per key prefix, supporting at least 3,500 PUT and 5,500 GET requests per second on each prefix independently. Concentrating requests on one prefix hits that single ceiling. Spreading keys across many prefixes lets requests run against many prefix limits in parallel, multiplying aggregate throughput without leaving S3.

How do you raise IOPS and throughput on an Amazon EBS volume at lowest cost without growing the volume size?

General Purpose SSD gp3 separates provisioned IOPS and throughput from capacity, unlike gp2 where the baseline scales with size. A gp3 volume can be provisioned for the exact IOPS and throughput needed on the existing capacity, and gp3 carries a lower per-GiB price than gp2, raising performance at lowest cost with no size change.

Common misconceptionThat the way to buy more IOPS is to buy more capacity. That held for gp2, where baseline IOPS scaled with volume size; gp3 provisions IOPS separately from size.

For S3 data that is hot for 30 days then almost never read but must be kept 7 years, with multi-hour retrieval acceptable, what is the lowest-cost design?

An Amazon S3 Lifecycle rule that transitions objects to S3 Glacier Flexible Retrieval at the date they turn cold (day 30), with an expiry action at 7 years. Because the cold-access date is known in advance, a direct lifecycle transition is cheaper than monitoring, Glacier's few-hour retrieval matches the requirement, and expiry enforces retention.

Common misconceptionThat Intelligent-Tiering is always the cheapest choice. Its per-object monitoring charge buys nothing when the date the data turns cold is already known.

Which S3 storage class minimises cost for objects whose per-object access is unpredictable, without retrieval fees or any application change?

Amazon S3 Intelligent-Tiering. It monitors each object individually and shifts it between a frequent-access tier and an infrequent-access tier based on that object's own usage, charging only a small monitoring fee and no retrieval fee. Tiering is transparent to readers, so a mix of hot and cold objects is handled automatically without code or per-object retrieval penalties.

Common misconceptionThat the lower per-gigabyte rate of Standard-Infrequent Access makes it the cheapest place to put everything. Its retrieval fee on every read can wipe out the storage saving.