Amazon Web Services SAA-C03 Exam With Confidence Using Practice Dumps

IAM Access Analyzeris the correct service because AWS documents that it helps identify and reviewunused accessfor IAM users and roles across AWS accounts and organizations. It can generate findings that show where permissions are broader than necessary and can recommend narrower policies when applicable. Network Access Analyzer focuses on network reachability, not IAM over-permission. CloudWatch alarms on user activity do not analyze granted permissions, and Amazon Inspector is not the service for IAM permission-rightsizing. Since the company wants the least administrative overhead across multiple accounts managed with AWS Organizations, IAM Access Analyzer is the AWS-native service purpose-built for this kind of access review. (AWS Documentation)

============

Option Censures dynamic scaling based on demand using a target tracking scaling policy, optimizing costs.

Option Aresults in over-provisioning, leading to higher costs.

Option Bincreases costs by using larger instances.

Option Dis not feasible as instance store volumes are ephemeral and unsuitable for shared storage like EFS.

AWS Secrets Manager is the managed service for securely storing, rotating, and retrieving database credentials. When you store Aurora credentials in Secrets Manager and enable automatic rotation, Secrets Manager updates the credentials in both the database and the stored secret.

Each Lambda function version or alias can call Secrets Manager at runtime to retrieve the current secret value, so even older deployed Lambda versions that use an alias will always obtain the most recent credentials without redeployment.

Why others are not suitable:

B: Embeds credentials in code, requiring redeployment on every rotation and violating security best practices.

C: Environment variables are version-specific; old aliases would continue using outdated values unless you redeploy or change them.

D: Parameter Store can store and rotate secrets but is less integrated for database credential rotation than Secrets Manager; Secrets Manager is the purpose-built minimal-overhead choice here.