Week 3 review — databases, DR, migration, hybrid networking

30 timed scenario questions (~48 min, ~96 sec each). Reinforces night-22-week-3-review.md and Nights 15–21. No new lab deploy. Answer without peeking at night-22-quiz-answers.json first.

1. 1.You are sketching GSA's exam architecture on paper. Users browse the wiki over HTTPS. An ALB terminates TLS and forwards to Fargate tasks. Aurora holds resort_stats in private subnets. Where should the ALB sit relative to the NAT Gateway?

   A.ALB in public subnets with route to IGW; Fargate and Aurora in private subnetsB.ALB and Aurora in public subnets; only Fargate stays private for this workloadC.ALB in private subnets only — NAT Gateway replaces the need for public subnetsD.ALB attached directly to the Aurora writer endpoint on port 5432 for this workload

2. 2.Night 17 Lambda saa-study-gsa-stats-uploader times out on first invoke but succeeds on the second. Aurora security groups are correct. Most likely cause?

   A.Lambda must use the Aurora reader endpoint for UPSERT operations for this workloadB.Cold-start ENI attachment in the VPC before outbound TCP to Aurora completesC.SQS FIFO queue is required for any Lambda in a VPC for this workloadD.Secrets Manager blocks all connections until Multi-AZ failover finishes

3. 3.Leadership asks for automatic Aurora writer failover in the same Region with minimal write loss. BI dashboards must not hit the standby during normal operations. Best pattern?

   A.Point all SELECT queries at the synchronous Multi-AZ standby endpointB.Single-AZ Aurora with weekly manual snapshots only for this workloadC.Aurora cluster Multi-AZ with synchronous storage failover to a standbyD.Three cross-Region read replicas with Route 53 weighted routing to all writers

4. 4.A wiki counter table needs restore to any second within the last month after a bad script. The original table must remain untouched for comparison. Which DynamoDB feature?

   A.On-demand backup that overwrites the existing table in place for this workloadB.AWS Backup vault lock that replays CloudTrail PutItem events for this workloadC.DynamoDB Streams with TRIM_HORIZON that rewinds the live tableD.PITR — restore to a new table at a chosen timestamp within 35 days

5. 5.After a Region-wide outage, executives accept four hours to rebuild infrastructure from recovery points stored in a DR Region. Lowest-cost DR tier?

   A.Backup and restore — AWS Backup recovery points plus IaC redeployB.Multi-site active-active with DynamoDB global tables in every RegionC.Warm standby with min=2 Auto Scaling in the DR Region at all timesD.Aurora Global Database with active writes in both Regions 24×7

6. 6.On-prem resort_stats PostgreSQL must replicate ongoing INSERTs to Aurora in saa-study-gsa-vpc while production stays on-prem until cutover. Which DMS task type?

   A.Full load only — one-time table scan with no transaction log tailingB.Full load plus CDC — initial copy then tail the source WAL/binlogC.CDC only — assumes the target already has every historical rowD.DynamoDB export to S3 — streams live writes to Parquet automatically

7. 7.Resort HQ (192.168.0.0/16) needs encrypted connectivity to the Night 9 VPC (10.0.0.0/16) within days. No dedicated fiber yet. Fastest AWS option?

   A.VPC peering between the on-premises LAN and the VPC CIDR blocksB.AWS PrivateLink interface endpoint installed in the on-prem rackC.AWS Site-to-Site VPN — IPSec tunnels to a virtual private gateway or TGWD.Direct Connect 10 Gbps port provisioned this afternoon for hybrid use for this workload

8. 8.Night 18 stream Lambda should log both the old and new viewCount on every MODIFY. Which DynamoDB stream view type?

   A.KEYS_ONLY — partition and sort keys without attribute values for this workloadB.NEW_IMAGE only — previous attribute values are never included for this workloadC.OLD_IMAGE only — post-change state is omitted from each record for this workloadD.NEW_AND_OLD_IMAGES — both versions of the item in each stream record

9. 9.Fargate tasks in private subnets must read wiki assets from S3 without paying NAT data-processing charges for that traffic. Night 8/10 pattern?

   A.S3 Gateway VPC endpoint associated with the private route tableB.PrivateLink interface endpoint to a third-party S3-compatible vendorC.Internet Gateway attached to the private subnet route tableD.NAT Gateway with S3 prefix lists disabled for cost savings

10. 10.500 concurrent Lambdas each open a new MySQL connection to RDS at peak. Secrets Manager is already in use. Minimal-change fix from Night 15 theory?

    A.Enable Multi-AZ — doubles the connection limit on the standby for this workloadB.Deploy RDS Proxy — pool connections; Lambdas target the proxy endpointC.Switch all relational tables to DynamoDB with GSIs for JOINs for this workloadD.Use Aurora Backtrack on PostgreSQL to rewind connection storms for this workload

11. 11.Dev, Staging, and Logging VPCs must all reach each other and on-prem. Full mesh VPC peering is rejected. Hub design?

    A.One Site-to-Site VPN per VPC without a shared gateway for this workloadB.PrivateLink interface endpoint in every spoke for every resourceC.Transit Gateway with attachments per VPC and centralized route tablesD.Inter-Region VPC peering only — no hybrid connectivity for this workload

12. 12.night-19-lab tags saa-study-gsa-wiki-views with saa-study-backup=night-19. A new study table gets the same tag tomorrow. What happens?

    A.AWS Backup disables DynamoDB PITR on all tagged tables for this workloadB.Tags are cosmetic — only ARNs listed in the plan can be backed up for this workloadC.The vault name must exactly match the tag value or jobs fail for this workloadD.The new table auto-enrolls in the backup plan without editing the selection

13. 13.A vendor SaaS API runs in another AWS account. GSA consumers need private access without merging VPC route tables or peering entire CIDRs. Best fit?

    A.AWS PrivateLink — consumer interface endpoint to the provider NLB serviceB.VPC peering between GSA and vendor VPCs merging entire CIDR tablesC.S3 Gateway endpoint in the consumer VPC for SaaS API private accessD.Public internet with IP allow lists on the vendor Application Load Balancer

14. 14.Night 20 lab exports saa-study-gsa-wiki-views to S3 for Athena staging. A teammate calls this live CDC replication. Correct?

    A.Yes — export streams every PutItem to S3 in real time like DMS for this workload for this workloadB.No — export is a point-in-time snapshot to S3; ongoing changes need DMS or StreamsC.Yes — export and DMS CDC are identical for DynamoDB sources for this workloadD.Partially — export is CDC if PITR is enabled on the table for this workload

15. 15.Direct Connect is the primary hybrid link. Leadership wants resilience when the DX circuit fails. Standard companion?

    A.Second Internet Gateway in the VPC for automatic failover for this workloadB.Replace private VIF with public VIF only during outages for this workloadC.Site-to-Site VPN as backup terminating on the same Transit Gateway or VGWD.VPC peering to a second Direct Connect location in another Region for this workload

16. 16.GSA needs sub-second cross-Region RPO on Aurora PostgreSQL with a managed global topology. Which feature?

    A.RDS automated backup copy every five minutes as live replication for this workloadB.Promote a cross-Region read replica after manual health check for this workloadC.RDS Multi-AZ synchronous standby in the same Region only for this workloadD.Aurora Global Database — primary and secondary Region with low replication lag

17. 17.VPC A peers with VPC B. VPC B peers with VPC C. Can VPC A reach VPC C through VPC B?

    A.No — VPC peering is non-transitive; need A↔C peering or Transit GatewayB.Yes — peering is transitive across unlimited hops for this workloadC.Yes — if all three VPCs share the same /16 CIDR block for this workloadD.Only if an Internet Gateway is attached to VPC B as a hub for this workload

18. 18.Night 16 Aurora sits in Night 9 private subnets. Which ingress rule belongs on aurora-sg for the stats Lambda?

    A.Allow TCP 5432 from 0.0.0.0/0 — Lambda has no fixed IPB.Allow TCP 5432 from the Lambda security group ID as sourceC.Allow all traffic from the VPC CIDR 10.0.0.0/16 for this workloadD.No inbound — Aurora initiates connections to Lambda on 5432

19. 19.Terabytes of on-prem file shares must seed S3 before a narrow maintenance window. No sustained 10 Gbps link. Offline bulk transfer?

    A.AWS DataSync agent over a 1 Mbps VPN for this workloadB.DMS full load plus CDC from NFS mount points for this workloadC.AWS Snowball Edge device — ship drives, import into S3D.DynamoDB export to S3 with PITR enabled for this workload

20. 20.Compare warm standby and pilot light for the same RPO. Which statement is accurate?

    A.Pilot light runs full production ASG capacity in DR at all times for this workloadB.Warm standby never runs database instances until failover for this workloadC.Both have identical RTO because neither uses Route 53 health checks for this workloadD.Warm standby keeps a scaled-down live DR stack — typically lower RTO than

21. 21.Oracle on-prem must land on Aurora PostgreSQL with schema conversion before DMS cutover. Which AWS tool?

    A.AWS Schema Conversion Tool (SCT) — heterogeneous assessment and conversionB.AWS DataSync — converts PL/SQL packages during file sync for this workloadC.Snowball Edge — runs Oracle inside the appliance for conversion for this workloadD.RDS Proxy — translates Oracle wire protocol to PostgreSQL for this workload

22. 22.On-prem and the VPC both use 10.0.0.0/16. Site-to-Site VPN tunnels are up but routes never work. Root cause?

    A.VPN requires Direct Connect before BGP sessions establish for this workloadB.Overlapping CIDR blocks — hybrid routing cannot disambiguate addressesC.Virtual private gateway only supports /8 networks for this workloadD.Client VPN must be enabled before Site-to-Site VPN routes propagate

23. 23.Night 13 SQS visibility timeout is 60 seconds. Night 17 Lambda timeout is 30 seconds. Why is this pairing valid?

    A.Visibility timeout must equal Lambda timeout exactly for this workloadB.Lambda timeout must exceed visibility timeout to prevent duplicate processingC.Visibility timeout ≥ Lambda timeout — message stays hidden while Lambda runsD.Visibility timeout should be at least six times the Lambda timeout for this workload

24. 24.Compliance auditor asks whether CloudTrail replaces AWS Backup for wiki tables. Accurate response?

    A.Yes — CloudTrail stores full table snapshots in the trail S3 bucket for this workloadB.Yes — enabling data events on DynamoDB equals PITR plus AWS Backup for this workloadC.Partially — CloudTrail replaces backup when S3 Object Lock is enabled for this workloadD.No — CloudTrail records API activity; it is not a backup and restore service

25. 25.Aurora Serverless v2 dev cluster should eliminate overnight idle cost by scaling to zero ACUs like Serverless v1. Accurate for v2?

    A.No — v2 maintains a configurable minimum ACU; tear down dev stacks when idleB.Yes — v2 pauses after ten minutes without connections for this workload for this workloadC.Yes — but only for Aurora MySQL, not PostgreSQL Serverless v2 clustersD.Only when RDS Proxy holds open connections overnight for this workload

26. 26.Direct Connect private VIF carries production ETL to Aurora. Security asks whether DX encrypts traffic by default. Correct?

    A.Yes — AES-256 on every private VIF automatically without extra configB.No — dedicated circuit is private, not encrypted; add VPN over DX if requiredC.Yes — but only when Transit Gateway is the attachment target for this workloadD.No — DX only supports unencrypted public VIF; private VIF requires VPN for this workload

27. 27.GSA wiki page views need unpredictable scale with simple ADD increments. resort_stats needs SQL JOINs for BI. Store pairing?

    A.Aurora for both — one cluster simplifies operations for this workloadB.DynamoDB for both — model JOINs as multiple GetItem calls for this workloadC.DynamoDB for page-view counters; Aurora for relational stats and reportsD.S3 Iceberg only — eliminate databases for both workloads for this workload

28. 28.Before cutover, DMS shows replication lag dropping after writes stop to the on-prem source. What are you waiting for?

    A.Lag to exceed 24 hours so full load runs again automatically for this workloadB.SCT to reconvert the schema after every committed transaction for this workloadC.Snowball return shipment confirmation from the DR Region for this workloadD.Lag ≈ 0 so the target matches the source before DNS points to Aurora

29. 29.Remote engineers need individual laptop access to resources in saa-study-gsa-vpc from hotels. Whole data center already has Site-to-Site VPN. Add-on service?

    A.AWS Client VPN — per-user OpenVPN/WireGuard into the VPCB.Another Site-to-Site VPN tunnel per laptop public IPC.VPC peering from the laptop to the VPC for this workloadD.Direct Connect from each hotel broadband circuit for this workload

30. 30.You finished Week 3 database labs and want to stop Aurora charges but keep Night 9 VPC for Week 4 ElastiCache. Correct teardown order?

    A.Delete VPC first — Aurora auto-deletes with the subnet group for this workloadB.Night 16 Aurora first while Lambda is still connected — fastest cleanupC.Night 17 Lambda teardown, then Night 16 Aurora teardown — keep Night 9 VPCD.Delete NAT Gateway only — Aurora Serverless v2 scales to zero automatically