Lab 3A — ElastiCache (Redis) cache-aside in front of Aurora

15 timed scenario questions (~24 min, ~96 sec each). Reinforces night-23-elasticache-redis.md and night-23-lab-elasticache-setup scripts. Answer without peeking at night-23-quiz-answers.json first.

1. 1.GSA dashboard hammers SELECT resort_stats for IS-001 thousands of times per minute. Aurora CPU spikes. You add ElastiCache in the same VPC. Which pattern does night-23-lab implement?

   A.Cache-aside — app reads Redis first; on miss queries Aurora then SETEX with TTLB.Write-through — every Aurora UPSERT also writes Redis before commit for this workloadC.Read-through — ElastiCache service pulls Aurora rows without app code for this workloadD.Write-behind — Redis batches async flushes to Aurora every hour for this workload

2. 2.An exam scenario needs session storage with sorted-set leaderboards and optional Multi-AZ automatic failover. Memcached or Redis?

   A.Memcached — multithreaded horizontal scale with no data types for this workloadB.ElastiCache Redis — richer types, replication groups, failover optionsC.S3 Standard — session objects with 11 nines durability for this workloadD.DynamoDB DAX — in-memory accelerator for DynamoDB only for this workload

3. 3.night-23-lab places saa-study-gsa-redis in Night 9 private subnets. Which ingress rule belongs on saa-study-gsa-redis-sg?

   A.TCP 5432 from lambda-stats-sg — Redis uses the PostgreSQL port for this workloadB.TCP 443 from the internet gateway for TLS termination at Redis for this workloadC.TCP 6379 from saa-study-gsa-lambda-stats-sg — source is the app security groupD.TCP 6379 from 0.0.0.0/0 so operators can redis-cli from home for this workload

4. 4.saa-study-gsa-cache-reader runs in private subnets like Night 17 stats-uploader. First invoke after idle takes 30+ seconds. Primary cause?

   A.ElastiCache Redis scales to zero and must cold-boot from S3 for this workloadB.Aurora Serverless v2 pauses the writer until cache-reader pings it for this workloadC.Secrets Manager throttles GetSecretValue to one call per minute for this workloadD.Lambda VPC ENI attach on cold start before private Redis/Aurora paths work

5. 5.Static wiki HTML is cached at CloudFront POPs. Relational resort_stats rows are cached in Redis inside the VPC. What is the best distinction?

   A.CloudFront caches HTTP responses at the edge; ElastiCache caches app-chosenB.CloudFront replaces Aurora; ElastiCache replaces DynamoDB for this workloadC.Both are identical layers — pick whichever is cheaper that month for this workloadD.CloudFront requires VPC endpoints; ElastiCache requires an internet gateway

6. 6.Wiki viewCount hot reads already live on DynamoDB (Night 18). Which AWS cache targets DynamoDB specifically?

   A.CloudFront origin shield in the database subnet for this workloadB.DAX — DynamoDB Accelerator for microsecond DynamoDB readsC.ElastiCache Memcached cluster in front of the wiki tableD.Aurora read replica in front of the WikiPages table for this workload

7. 7.Night 17 stats-uploader UPSERTs monthly_runs in Aurora. Night 23 cache-reader may return stale counts until TTL expires. Exam-aligned mitigation?

   A.Disable Aurora automated backups so writes propagate faster for this workloadB.Move Redis to a public subnet for lower latency invalidation for this workloadC.Delete or update the Redis key on successful write (cache invalidation)D.Switch to Memcached because it never caches relational rows for this workload

8. 8.You need the simplest horizontal in-memory cache for opaque JSON blobs — no failover, no lists or sets. Best fit?

   A.ElastiCache Redis with cluster mode and AOF persistence enabled for this workloadB.Aurora Global Database for sub-millisecond wiki reads for this workloadC.DMS CDC task streaming cache entries into Redis from the source databaseD.ElastiCache Memcached — multithreaded key-value without advanced structures

9. 9.An operator asks whether saa-study-gsa-redis is the system of record for resort_stats. Correct answer?

   A.No — Aurora remains source of truth; Redis is ephemeral accelerationB.Yes — ElastiCache persists all writes to EBS like RDS for this workloadC.Yes — Redis snapshots replace Aurora automated backups for this workloadD.No — only DynamoDB can be a source of truth in AWS for this workload

10. 10.night-23-lab creates saa-study-gsa-redis-subnets spanning private-a and private-b. Why is a cache subnet group required?

    A.Subnet groups encrypt Redis traffic with KMS at the subnet boundary for this workloadB.ElastiCache nodes must launch in subnets you designate — typically privateC.Subnet groups replace security groups for port 6379 authorization for this workloadD.Redis clusters cannot use security groups — subnet group is the only firewall

11. 11.Bench invoke clears the key then calls GET twice. Second response shows cache_hit true and lower latency_ms. What happened?

    A.Aurora read replica served the second call from another Region for this workloadB.CloudFront edge cached the Lambda response between invokes for this workloadC.First call populated Redis via cache-aside; second call read RAM onlyD.DAX intercepted the second call before DynamoDB for this workload

12. 12.Production Redis often enables in-transit encryption and AUTH tokens. night-23 study lab skips them. Why still deploy redis-sg?

    A.Security groups are optional decoration when Redis is in a private subnetB.Network ACLs alone block all east-west traffic in the VPC for this workloadC.IAM policies on the Lambda role replace SG rules for port 6379 for this workloadD.SGs enforce which ENIs may open TCP 6379 — defense in depth inside the VPC

13. 13.High availability Redis with automatic failover to a replica in another AZ. Which ElastiCache construct?

    A.Redis replication group with Multi-AZ and automatic failover enabledB.Single-node cache.t4g.micro cluster with no replica — tonight's labC.Memcached cluster with one node per AZ and client-side hashing onlyD.Aurora Serverless v2 reader endpoint in front of Redis for this workload

14. 14.saa-study-gsa-cache-reader reuses saa-study-gsa-lambda-stats-sg from Night 16/17. Which connections does that SG need to initiate?

    A.Inbound TCP 6379 from redis-sg and inbound 5432 from aurora-sgB.Outbound TCP 6379 to redis-sg and outbound TCP 5432 to aurora-sgC.Inbound TCP 443 from API Gateway for cache warming webhooksD.Outbound ICMP to the NAT gateway for Redis health probes for this workload

15. 15.You run night-23-lab-elasticache-teardown.ps1. Correct resource order concept?

    A.Delete Night 9 VPC first so Redis loses its subnets automaticallyB.Delete Aurora cluster before ElastiCache to flush cache keys for this workloadC.Delete Lambda then ElastiCache cluster then subnet group and redis-sgD.Delete redis-sg while the cluster is running to force immediate eviction