Lab 2D part 1 — Aurora Serverless v2 study stack

15 timed scenario questions (~24 min, ~96 sec each). Reinforces night-16-aurora-lab.md and night-16-lab-aurora-setup scripts. Answer without peeking at night-16-quiz-answers.json first.

1. 1.night-16-lab-aurora-setup places Aurora in Night 9 private subnets. A stats Lambda in the same VPC must connect on port 5432. Both use security groups. What ingress rule belongs on the Aurora security group?

   A.TCP 5432 from saa-study-gsa-lambda-stats-sg — source is the app security groupB.TCP 5432 from 10.0.0.0/16 — open the entire VPC CIDR for simpler connectivityC.TCP 443 from lambda-stats-sg — PostgreSQL uses HTTPS like the RDS Data APID.No inbound rule — Aurora initiates outbound connections to Lambda on port 5432

2. 2.The lab creates saa-study-gsa-aurora-subnets spanning private-a and private-b. Why must the DB subnet group include subnets in at least two Availability Zones?

   A.Aurora requires public subnets in two AZs for Internet Gateway routing to the writerB.Aurora storage replication mandates two AZs for subnet group creation and HA placementC.NAT Gateway must sit in the same DB subnet group as the Aurora writer instance in every AZD.Lambda ENIs can only attach to subnets that are already listed in the Aurora DB subnet group

3. 3.You deploy Aurora Serverless v2 with MinCapacity=0.5 and MaxCapacity=1 ACU for the study cluster. Overnight the database has no connections. What happens to billing?

   A.Billing drops to zero ACU — Serverless v2 scales to zero like Serverless v1 clustersB.Aurora stops the instance automatically and charges only for snapshot storage overnightC.Minimum 0.5 ACU still bills while the cluster and serverless instance continue to existD.Only NAT Gateway cost applies because the database lives in a private subnet with no IGW

4. 4.night-16-lab enables --enable-http-endpoint on the cluster so -InitSchema runs from your laptop without psql in the VPC. Which service executes the CREATE TABLE statements?

   A.AWS Systems Manager Session Manager tunneling psql through the NAT Gateway pathB.Amazon API Gateway HTTP API proxying SQL statements to the Aurora writer endpointC.AWS CloudFormation custom resource Lambda with VPC attachment and an embedded psql binaryD.Amazon RDS Data API over HTTPS using the cluster ARN and Secrets Manager secret

5. 5.The setup script sets --no-publicly-accessible on saa-study-gsa-aurora-instance. A developer tries to connect with psql from a home laptop using the writer endpoint. What is the expected result?

   A.Connection fails — the instance has no public IP; clients must be on the VPC network pathB.Connection succeeds if they retrieve the master password from Secrets Manager before connectingC.Connection succeeds when they use the cluster reader endpoint instead of the writer endpointD.Connection succeeds after adding 0.0.0.0/0 on TCP 5432 to the Aurora security group inbound

6. 6.Night 17 Lambda will INSERT into resort_stats. Which Aurora endpoint should the stats uploader use for writes?

   A.Cluster reader endpoint — load-balanced across Aurora replicas for INSERT and SELECTB.Cluster writer endpoint — all writes go to the primary instance in the Aurora clusterC.Custom CNAME you create in Route 53 pointing at the current writer instance private IPD.RDS Proxy endpoint only — the cluster writer endpoint rejects all INSERT SQL statements

7. 7.Master credentials for saa-study-gsa-aurora use --manage-master-user-password. Where does the setup script read the secret ARN for RDS Data API calls?

   A.SSM Parameter Store String parameter written by the teardown script for later reuseB.Lambda environment variable GSA_DB_PASSWORD exported into night-9-vpc-ids.jsonC.MasterUserSecret.SecretArn on the DB cluster from describe-db-clusters outputD.IAM user access key embedded in night-16-aurora-result.json by the setup defaults

8. 8.A teammate proposes placing Aurora in the Night 9 public subnets (public-a/public-b) to avoid NAT costs for patching. What is the best response for a production-style GSA stats database?

   A.Correct — public subnets remove the need for security groups on the database tierB.Correct — Aurora requires IGW routes for automated minor version patching to succeedC.Use public subnets but disable the writer endpoint to block inbound SQL from the internetD.Use private subnets with NAT — databases stay non-public; apps reach them via SG rules

9. 9.After night-16-lab-aurora-setup.ps1, describe-db-instances shows DBInstanceClass db.serverless. Where is the MinCapacity=0.5 / MaxCapacity=1 scaling configuration stored?

   A.On the Aurora cluster as ServerlessV2ScalingConfiguration for ACU min and maxB.On the DB instance as a modify-db-instance --max-allocated-storage capacity flagC.On the DB subnet group as a capacity attribute applied to each member subnetD.On the lambda-stats-sg as a tag consumed by Aurora Auto Scaling for ACU changes

10. 10.You run night-16-lab-aurora-teardown.ps1 after the lab. Which resources does it intentionally leave running?

    A.Aurora cluster and instance — teardown only removes the attached security groupsB.Night 9 VPC, NAT Gateway, and Night 12–14 EventBridge/SQS/SNS lab resourcesC.Only the resort_stats table — the cluster is stopped but not deleted from the accountD.DB subnet group and Secrets Manager secret kept for Night 17 Lambda reuse only

11. 11.GSA stores wiki page-view counts in DynamoDB and monthly resort aggregates in Aurora resort_stats. A report needs SELECT with JOIN across resort rows. Which store fits?

    A.DynamoDB — enable DAX and use PartiQL JOIN across partition keys for the reportB.S3 Iceberg only — Aurora cannot query relational aggregates with SQL JOIN clausesC.Aurora PostgreSQL — relational schema and SQL JOINs on resort_stats for reportsD.ElastiCache Redis — store JSON blobs keyed by resort_id to emulate JOIN results

12. 12.The Iceland batch completion path uses Night 13 SQS. Night 16 adds Aurora. Where does resort_stats fit in the pipeline relative to SQS?

    A.SQS messages are stored inside Aurora as BLOB columns inside the resort_stats relational tableB.Aurora replaces SQS entirely — the batch writes SQL rows instead of publishing queue messagesC.Aurora publishes completion events back to SQS via RDS Event Notifications on INSERTD.Downstream stats uploader (after SQS) writes relational rows into Aurora resort_stats

13. 13.A junior engineer adds 0.0.0.0/0 on TCP 5432 to saa-study-gsa-aurora-sg so they can psql from home. What is the exam-aligned fix?

    A.Remove the rule — use VPC Lambda or RDS Data API; allow only source SG referencesB.Enable public accessibility on the instance — an open world SG is then considered exam-safeC.Switch to Aurora MySQL — port 3306 does not require any security group inbound rules at allD.Attach the Aurora security group to the Lambda function ENI instead of the database instance

14. 14.night-16-lab creates saa-study-gsa-lambda-stats-sg with no inbound rules. Night 17 Lambda will attach to this SG in private subnets. Why is empty inbound acceptable?

    A.Aurora opens return traffic automatically without security group connection trackingB.Lambda in a VPC never receives inbound connections — only outbound to Aurora mattersC.NAT Gateway security group mirrors all inbound traffic onto Lambda ENIs in the VPCD.Inbound rules are inherited automatically from the Night 9 Fargate task security group

15. 15.You need a read-only BI dashboard querying resort_stats without adding write load to the primary. Aurora has one writer and no extra reader instances yet. What is the practical first step?

    A.Point BI at the cluster reader endpoint — it load-balances SELECTs even with only a writerB.Use DynamoDB streams to replicate resort_stats into a second Aurora cluster dedicated to BIC.Add an Aurora read replica instance, then use the reader endpoint for SELECT queriesD.Enable Aurora Backtrack on PostgreSQL so historical read queries completely avoid the writer