Amazon SAA-C03 Exam Questions

Amazon RDS does not support enabling encryption at rest on an existing unencrypted DB instance. To encrypt an existing RDS instance's data at rest, the recommended method is to:

Take a snapshot of the unencrypted DB instance.

Create an encrypted copy of the snapshot using AWS KMS. This encrypted snapshot contains the existing data encrypted at rest.

Restore a new DB instance from the encrypted snapshot. This new instance will have encryption at rest enabled.

Additionally, to manage encryption keys securely, companies can use customer managed keys (CMKs) in AWS Key Management Service (KMS). CMKs provide greater control over key management policies, rotation, and usage permissions compared to default AWS managed keys. Using a CMK allows customization of access control and auditability.

Option A is incorrect because you cannot enable encryption directly on a snapshot; you must create an encrypted copy. Option C is invalid because encryption cannot be enabled by modifying an existing instance's configuration. Option D refers to the default AWS managed key, which is less flexible than customer managed keys.

References:

Encrypting Amazon RDS Resources (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html)

Copying an Encrypted Snapshot (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CopySnapshot.html)

AWS KMS Customer Master Keys (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html)

AWS Well-Architected Framework --- Security Pillar (https://d1.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf)

Compute Savings Plans apply to EC2, AWS Fargate, and AWS Lambda usage, maximizing coverage for mixed architectures while retaining flexibility across instance families, regions, OS, and tenancy. For private connectivity, Lambda functions must be configured with VPC access to attach ENIs in the target subnets, enabling direct network access to EC2 in private subnets (no public subnets are required for intra-VPC communication). EC2 Instance Savings Plans only discount EC2 usage and are tied to a specific instance family in a region, reducing flexibility and leaving Lambda costs undiscounted. Keeping Lambda in the service VPC prevents direct access to private EC2 without VPC configuration. Thus, a 1-year Compute Savings Plan plus connecting Lambda to the private subnets minimizes total cost and meets connectivity needs.

References: AWS Savings Plans --- Compute Savings Plans applicability (EC2, Fargate, Lambda); AWS Lambda Developer Guide --- Configuring Lambda to access VPC resources (ENIs, subnets, security groups).

The most cost-effective general solution isDynamoDB auto scaling. AWS recommends atarget utilization of 70%for provisioned throughput with auto scaling, which lets DynamoDB adjust capacity up or down based on sustained workload patterns. That improves both read and write performance while controlling cost better than manual scaling. A GSI is only useful for specific alternate query patterns and does not solve overall throughput management by itself. DAX helps only with read-heavy caching, not writes. A custom CloudWatch-plus-Lambda scaling solution adds unnecessary operational work compared to native auto scaling. Because the question asks broadly for read and write performance at the best cost, auto scaling with the recommended 70% target is the strongest answer.

============

The correct answer isBbecause the company wants to view bothAmazon EKS clustersandon-premises Kubernetes clustersfrom acentral locationwith theleast operational overhead.Amazon EKS Connectoris designed for this purpose. It allows externally managed Kubernetes clusters, including on-premises clusters, to be registered to AWS so they can be viewed in theAmazon EKS consolealongside native EKS clusters. This creates a centralized management experience without requiring the company to migrate or rebuild the existing on-premises clusters.

EKS Connector is a low-overhead solution because it extends visibility into Kubernetes environments that are not running directly on Amazon EKS. It provides centralized cluster registration and observability at the AWS management layer while preserving the existing cluster deployments. This is especially useful for hybrid Kubernetes environments where organizations want a single control point for inventory and visibility.

Option A is incorrect becauseAmazon CloudWatch Container Insightsis primarily for metrics, logs, and performance monitoring. Although it provides observability, it is not the primary service for centrally registering and viewing clusters themselves in a unified cluster-management context. Option C is incorrect becauseAWS Systems Manageris not the main service for centralized Kubernetes cluster management. Option D is incorrect becauseAmazon EKS Anywhereis used to run Kubernetes on-premises, but it is not the simplest way to centrally view existing clusters with the least operational effort.

AWS guidance for hybrid Kubernetes visibility recommendsAmazon EKS Connectorfor connecting external Kubernetes clusters to AWS. Therefore, it is the most appropriate solution.

The workload isstateless,parallel, and each job runs for about20 minutes, which makes Lambda a poor fit because Lambda has a maximum execution time of 15 minutes. AWS Fargate is a strong match for event-driven container workloads because it removes server management overhead, andFargate Spotlowers cost for interruption-tolerant processing. AWS also provides patterns for runningevent-driven workloads at scale with Fargate, and EventBridge can be used to trigger container tasks from S3-originated events. Compared with EKS or EC2 On-Demand, ECS on Fargate Spot is the most cost-effective managed container approach here.

============