SAA-C03 Exam Preparation Material | AWS Certified Solutions Architect - Associate

Explanation:
The best solution to enforce encryption at rest for Amazon EBS volumes is to use an IAM policy to restrict the creation of unencrypted volumes. To automatically identify and remediate unencrypted volumes, you can use AWS Configrules, which continuously monitor the compliance of resources, and AWS Systems Manager to automate the remediation by encrypting existing unencrypted volumes. This setup requires minimal administrative overhead while ensuring compliance.
Option B (KMS): KMS is for managing encryption keys, but Config and Systems Manager provide a better solution for automatic detection and enforcement.
Option C (Macie): Macie is for data classification and is not suitable for this use case.
Option D (Inspector): Inspector is used for security vulnerabilities, not encryption compliance.
AWS
Reference: AWS Config Rules
AWS Systems Manager

Explanation:
The correct answer is B because the production environment runs continuously 24 hours a day, all year, which makes Reserved Instances the most cost-effective purchasing model for steady-state workloads.
Reserved Instances provide a significant discount compared to On-Demand pricing when the usage is predictable and long-term.
Since production instances are always running, the company can maximize savings by committing to Reserved Instances for that environment.
For the development and test environments, the company specifically wants to automate stopping the EC2 instances when they are not in use.
Because those instances do not run continuously, On-Demand Instances are a better fit.
On-Demand pricing allows the company to pay only for the compute time that is actually used.
This flexibility works well with scheduled stop and start automation and avoids paying for unused reserved capacity.
Option A is less cost-effective because Reserved Instances for development and test environments would likely result in underutilized commitments due to those instances being stopped outside working hours.
Option C is incorrect because production workloads are business-critical and should not rely on Spot capacity, which can be interrupted.
Option D is also incorrect because keeping production on On-Demand misses substantial savings, and using Spot for development and test may be possible in some cases but is not the most appropriate answer here given the requirement simply to stop instances when not in use.
AWS cost optimization guidance recommends matching pricing models to workload patterns: use Reserved Instances for predictable, always-on workloads and On-Demand Instances for intermittent workloads.
That makes option B the most cost-effective solution.

Explanation:
Option B is the best answer because AWS Budgets can take automated actions, and forecast-based thresholds let the company intervenebeforeactual spending fully lands. AWS documentation explains that AWS Budgets actions can target EC2 instances, and forecast-based budget alerts are specifically intended to warn when projected spend is expected to exceed the threshold during the period. That makes forecasted costs more proactive than waiting until actual spend reaches the full budgeted amount.
Option A works, but it adds extra operational overhead by introducing SNS and Lambda when AWS Budgets actions can already automate the response directly.
Option C is unrelated because a scheduled rule does not respond to budget state. Therefore, forecast-based AWS Budgets actions that automatically stop the EC2 instances is the most cost-effective and direct design. (AWS Documentation)

Explanation:
AWS Well-Architected recommends multi-AZ, elastic architectures: use Auto Scaling groups across multiple Availability Zones for EC2 to eliminate single-AZ failure and automatically replace capacity. For relational databases, Amazon RDS Multi-AZ provides synchronous replication and automatic failover for high availability. Serving static content via Amazon CloudFront (with S3 origin) improves resiliency and performance by caching at edge locations and reducing origin load/latency.
Options A and C concentrate compute in one AZ and lack resilient static delivery.
Option D changes the stack unnecessarily and proposes EFS One Zone-IA for static assets, which is not multi-AZ and is intended for infrequently accessed, single-AZ workloads, reducing resilience. Therefore, B aligns with best practices for high availability, fault tolerance, and global performance.
Reference: AWS Well-Architected Framework ― Reliability Pillar (multi-AZ, elasticity); Amazon EC2 Auto Scaling across AZs; Amazon RDS Multi-AZ deployments; Amazon CloudFront benefits and edge caching.

Explanation:
Option B: Pre-signed URLs provide temporary, authenticated access to S3, limiting uploads to the time frame specified. This solution is lightweight, efficient, and easy to implement.
Option A requires the management of IAM temporary credentials, adding complexity.
Option C involves unnecessary development effort.
Option D introduces more complexity with STS and roles than pre-signed URLs.