Week 5 review + practice exam warmup

30 timed scenario questions (~48 min, ~96 sec each). Reinforces night-34-week-5-review.md and Nights 30–33. Complete before external 65-question Practice Exam 1. Answer without peeking at night-34-quiz-answers.json first.

1. 1.Night 30 applied lifecycle to globalskiatlas-backend-k8s-output/iceland/ with transitions at 90 and 365 days. Objects uploaded to iceland/2026-07/ this week remain S3 Standard. Which concept explains why nothing moved on deploy night?

   A.Lifecycle transitions evaluate object age — rules do not move objects on create nightB.Glacier Flexible Retrieval blocks every transition for 30 days across all RegionsC.S3 lifecycle rules apply only to objects stored in the us-west-2 RegionD.Intelligent-Tiering must be enabled before any lifecycle transition can run

2. 2.Finance needs an email when forecasted monthly spend crosses 80% of a $25 study-account cap. Which service sends that alert?

   A.Cost Explorer saved report with no notification channel configuredB.AWS Budgets with FORECASTED threshold notifications to email or SNSC.S3 Storage Lens dashboard export written nightly into an analysis bucketD.CloudWatch alarm on NAT Gateway BytesOut as the only spend signal

3. 3.CloudWatch shows Iceland Fargate tasks at p95 24% CPU and 38% memory on 2 vCPU / 4 GiB. The team wants to cut compute cost before any 1-year commit. Best first step?

   A.Buy a Compute Savings Plan sized to the current oversized task definitionB.Register a lower CPU/memory task definition revision aligned to utilizationC.Move the monthly batch transform onto Aurora Serverless v2 instead of FargateD.Enable S3 Transfer Acceleration on the output bucket to reduce Fargate spend

4. 4.The Iceland monthly batch tolerates a two-minute Spot interruption warning and retries next month. Which Fargate option best reduces per-run cost?

   A.Fargate On-Demand with assignPublicIp ENABLED for every private-subnet taskB.Fargate Spot capacity on the RunTask / capacity provider strategyC.EC2 Dedicated Hosts reserved for license compliance on the batch workerD.Lambda with a 15-minute timeout covering the full OSM download and transform

5. 5.Night 32 deploys Step Functions while legacy EventBridge rule saa-study-gsa-iceland-monthly still targets ECS directly. Both remain ENABLED. What is the operational risk?

   A.SQS FIFO ordering breaks for all wiki API traffic in the accountB.Two Iceland Fargate tasks may start on the same monthly scheduleC.CloudFront invalidates every /api/* path whenever the state machine runsD.Cognito JWTs expire twice as fast for wiki writers and anonymous readers

6. 6.The capstone state uses arn:aws:states:::ecs:runTask.sync. The container exits with code 1 after two Step Functions Retries. Catch routes to PublishFailureAlert (SNS). What happens?

   A.The execution succeeds because the Retry block already exhausted its attemptsB.Catch runs and publishes to the failure topic — Night 14 SNS alert patternC.SQS moves an unseen completion message into the DLQ without Catch runningD.EventBridge FailedInvocations increments even though the ECS target was invoked

7. 7.Which Well-Architected pillar is best demonstrated by Cognito JWT validation on mutating wiki API methods behind API Gateway?

   A.Sustainability — JWT checks reduce the number of Lambda warm startsB.Security — authenticate and authorize callers before business logic runsC.Cost Optimization — JWT validation removes all API Gateway request chargesD.Performance Efficiency — JWT parsing is always faster than any SQL lookup

8. 8.Config reports NON_COMPLIANT on a public S3 bucket that still serves static HTML through CloudFront. Site works. Strongest Security-pillar fix for the edge tier?

   A.Disable all CloudFront caching behaviors to shrink the HTTP attack surfaceB.Run Athena nightly on bucket access logs instead of changing bucket policyC.OAC plus block public access — private bucket origin served only via CloudFrontD.Move wiki counters from DynamoDB into ElastiCache as the durable source of truth

9. 9.A portfolio reviewer asks where CloudFront ends and ElastiCache begins in GSA. Best answer?

   A.CloudFront caches HTTP at the edge; Redis caches application objects near AuroraB.They are interchangeable CDN layers — pick whichever is cheaper this monthC.ElastiCache replaces Aurora entirely as the system of record for resort_statsD.CloudFront runs inside private subnets beside Lambda for in-VPC edge caching

10. 10.Live wiki visitor counter increments need millisecond writes with ACID. Historical 'resorts per country for three years' runs on S3 Iceberg. Which pairing is correct?

    A.Athena INSERT for the live counter; ElastiCache alone for the three-year reportB.Instance Store for the live counter; Glacier Deep Archive for the report pathC.CloudFront invalidation for the live counter; Route 53 geolocation for the reportD.DynamoDB for the live counter; Athena SQL on Iceberg for the historical report

11. 11.After lifecycle moves old iceland/ objects to Glacier Flexible Retrieval, finance sees a spike when analysts restore one month for debugging. What exam line item explains the spike?

    A.NAT Gateway data processing charged per GB of restored Glacier objectsB.Fargate Spot interruption fee applied whenever Glacier restores completeC.Glacier retrieval charges — billed separately from storage-class savingsD.Intelligent-Tiering monitoring fee assessed on every archived Glacier object

12. 12.Night 9 VPC has one NAT Gateway in public subnet AZ-a. Private subnets span two AZs. Biggest Cost Optimization note while labs are idle but VPC remains?

    A.NAT Gateway hourly plus per-GB — tear down VPC or add endpoints when pausingB.CloudFront invalidation cost per path dominates idle VPC spend every monthC.Route 53 hosted zone charge per wiki record exceeds NAT Gateway idle costD.Cognito MAU pricing for anonymous static readers is the largest idle VPC tax

13. 13.Step Functions InvokeStatsUploader calls Lambda; the function returns HTTP 200 with body {"error": "no rows"}. No Lambda service exception. What does the Task state do?

    A.Fails immediately and routes to Catch without attempting any Retry blockB.Retries until the runtime throws an AWSLambdaException service faultC.Waits indefinitely for EventBridge FailedInvocations before continuingD.Succeeds — Retry/Catch apply to integration failures, not business errors in JSON

14. 14.Teams want flexible 1-year spend commit across Fargate, Lambda, and EC2 in multiple Regions. Which purchase model fits?

    A.RDS Reserved Instance applied to the ECS cluster for Fargate discountsB.S3 One Zone-IA storage class for every pipeline output prefix in the accountC.EC2 Instance Savings Plan locked to m6i.large in us-east-1a onlyD.Compute Savings Plan covering Fargate, Lambda, and EC2 across Regions

15. 15.Exam scenario: Route 53 failover from PRIMARY ALB in us-east-1 to SECONDARY in us-west-2. Users must flip automatically when primary is unhealthy. What must exist on the PRIMARY record?

    A.Geolocation routing policy only — no health check attached to PRIMARYB.Weighted routing at 50/50 with health checks disabled on both recordsC.Latency-based routing among four Regions without a failover health checkD.Health check associated with the PRIMARY failover record for automatic flip

16. 16.Night 23 cache-aside Lambda on cache miss for resort_stats. Correct sequence?

    A.GET Redis → miss → SELECT Aurora → SETEX Redis → return JSON to the callerB.Redis read-through proxy loads Aurora without any application cache-miss codeC.CloudFront invalidates the path first, then Aurora pushes rows into RedisD.SNS fan-out triggers an Aurora write on every Redis cache miss event

17. 17.EventBridge rule targeting ECS shows FailedInvocations alarm. Same night, ECS task logs show container exit code 1. How do you classify the two signals?

    A.Both signals mean the container failed in exactly the same failure modeB.Both signals mean IAM denied ecs:RunTask before any task could startC.Both signals require configuring an SQS DLQ on the EventBridge ruleD.FailedInvocations = rule could not invoke target; exit 1 = task ran and failed

18. 18.Iceland pipeline durable GeoJSON must survive Spot interruption and AZ failure. Temp sort files on the worker can be discarded. Where should durable output live?

    A.EBS gp3 volume attached for the full lifetime of every batch worker taskB.Instance Store alone for maximum sequential throughput as the system of recordC.S3 Standard in the pipeline bucket as the durable system of recordD.EFS mounted by every Fargate task so workers share one durable output volume

19. 19.Which integration pattern matches ECS task success → durable handoff → Lambda consumer at human-scale throughput?

    A.SNS topic alone with no queue buffering between producers and consumersB.Kinesis Video Streams ingesting each ECS success event as a media fragmentC.EventBridge rule on task success → SQS queue → Lambda event-source pollerD.AppSync subscription fired on every S3 PUT to the pipeline output prefix

20. 20.A 2-hour monthly workflow needs per-step Retry/Catch and full execution history for operators. Sub-5-minute Express volume is not required. Pick orchestration.

    A.Step Functions Express for high-volume short flows with discarded historyB.SQS FIFO with content-based deduplication and no shared execution graphC.Step Functions Standard for long runs, Retry/Catch, and durable historyD.EventBridge schedule with five independent rules and no shared history

21. 21.Hourly line-item billing exports to S3 for custom Athena cost SQL. Which tool is purpose-built?

    A.AWS Cost and Usage Report (CUR) delivering hourly line items into S3B.AWS Budgets with SNS alerts only and no S3 line-item export pathC.CloudWatch Logs Insights queries run against the billing console UID.Macie classification jobs scanning buckets for sensitive cost documents

22. 22.Developer registers Fargate task definition with 2048 CPU units (2 vCPU) and 512 MiB memory. Registration fails. Most likely cause?

    A.Task role ARN must exactly equal the execution role name for registrationB.EventBridge cannot target any Fargate task definition configured above 1 vCPUC.512 MiB is below the minimum memory allowed for 2 vCPU on FargateD.awsvpc mode requires assignPublicIp ENABLED to save Fargate compute cost

23. 23.Night 4 attached AWS WAF to the CloudFront distribution for globalskiatlas.com. Which exam domain does this primarily reinforce?

    A.Cost Optimization — WAF reduces S3 GET charges for every cached objectB.Database — WAF caches Aurora query results at the CloudFront edgeC.Secure architectures — edge HTTP threat protection with managed rule groupsD.Migration — WAF replaces Database Migration Service for ongoing CDC

24. 24.Ongoing replication from on-prem PostgreSQL to Aurora with low-latency CDC. One-time bulk load already finished. Which DMS mode?

    A.Snowball Edge import only with no ongoing change-data-capture streamB.Athena CTAS statements run directly against the on-premises source databaseC.S3 Transfer Acceleration used as the primary CDC transport into AuroraD.Full load plus CDC task to keep Aurora updated after the bulk load

25. 25.Aurora cluster needs automatic failover for writer failure in the same Region. Read scaling for reporting is secondary. Minimum configuration?

    A.Multi-AZ Aurora with writer and reader placed in different Availability ZonesB.Single-AZ Aurora relying only on a daily manual snapshot for recoveryC.DynamoDB global tables used as the OLTP store for resort_stats insteadD.Athena partitioned table treated as the primary OLTP writer endpoint

26. 26.S3 versioning is enabled on a compliance prefix. You want to expire old versions after 90 days but keep current version indefinitely. Which lifecycle feature?

    A.Noncurrent version transition and expiration rules on the versioned prefixB.Abort incomplete multipart upload rules with no noncurrent version actionsC.Cross-Region Replication alone without any lifecycle expiration configurationD.Disable versioning and rely only on Intelligent-Tiering for old object cleanup

27. 27.Private subnet Fargate tasks pull container images and write pipeline output without public IPs. Which networking combination reduces NAT data processing?

    A.S3 gateway endpoint plus ECR interface endpoint — NAT only for other internetB.0.0.0.0/0 on the task security group to simplify outbound path selectionC.Public subnet placement with assignPublicIp DISABLED for every Fargate taskD.Remove all route tables so tasks rely on Instance Store for network routing

28. 28.Millions of sub-3-minute payment authorization flows per day; no requirement to retain execution history beyond minutes. Orchestration pick?

    A.Step Functions Standard with one-year execution history retention enabledB.Step Functions Express for high-volume short flows with optional discarded historyC.Always-on ECS service driving a Step Functions Map across 10,000 child statesD.SQS standard queue with no consumers and no workflow orchestration service

29. 29.You pause all study labs for three weeks. Which teardown step saves the most idle spend while keeping prod CloudFront and wiki API running?

    A.Delete WAF on the production CloudFront distribution before pausing labsB.Remove the Cognito user pool that production wiki writers still depend onC.Run night-34 master teardown through Aurora/ElastiCache/NAT — keep prod edgeD.Delete all S3 objects in the pipeline bucket including the current month prefix

30. 30.Practice Exam 1 tonight: 65 questions in 130 minutes. You score 44/65. Best next move before scheduling the real SAA-C03?

    A.Schedule the real exam for tomorrow — 44/65 is close enough to sit nowB.Skip Night 35 entirely and take Practice Exam 2 with no weak-area reviewC.Memorize every AWS service name alphabetically before any more practice examsD.Night 35 weak-area drill on top 3 missed domains — target ≥75% on Exam 2