Amazon Web Services SAA-C03 Exam With Confidence Using Practice Dumps

The correct answer isCbecause the requirement specifically calls for anAmazon EBS data volumethat providesconfigurable and consistent IOPSfor a transaction-heavy application.Provisioned IOPS SSD (io2)volumes are designed for workloads that need high performance, low latency, and predictable I/O performance. These volumes are the best fit for applications that process a large number of transactions and require storage performance to remain stable under load.

Using agp3volume for the root device is appropriate because the operating system volume usually does not require the same high and sustained performance characteristics as the application data volume. Theio2data volume provides the ability to provision IOPS independently to match the application’s transactional demands. This separation of root and data storage is a common AWS design pattern for performance-sensitive workloads.

Option A is incorrect becausest1andsc1are HDD-based volumes intended for large, sequential workloads, not high-transaction workloads that require consistent low-latency I/O. Option B is also incorrect becausest1does not provide the required configurable and consistent IOPS characteristics. Option D is incorrect because the requirement explicitly states that the application needs anAmazon EBS data volume, and Amazon S3 is object storage rather than block storage attached as an EBS volume.

AWS storage best practices recommendProvisioned IOPS SSD volumesfor mission-critical applications, transactional systems, and workloads that need sustained, predictable performance. Therefore, agp3 root volumecombined with anio2 data volumeis the most appropriate solution for this use case.

The best practice to securely provide short-term access to AWS resources, such as Amazon S3, without using long-term credentials, is to use AWS Security Token Service (STS). According to the AWS IAM Best Practices and the Security Pillar of the AWS Well-Architected Framework, temporary credentials should always be used over long-term credentials when possible.

From AWS IAM Documentation:

“Use temporary credentials (IAM roles and AWS STS) instead of long-term access keys. Temporary security credentials are short-term, automatically expire, and are retrieved using AWS STS.”

(Source: IAM Best Practices – IAM User Guide)

Option D outlines the use of a trust relationship and assume-role mechanism via AWS STS. This allows the on-premises application to request temporary, scoped-down credentials to upload files to S3 securely. This approach is:

Secure – Uses short-lived credentials with least privilege

Scalable – No need for EC2 or VPN tunnels

Low Operational Overhead – No infrastructure to maintain

AWS-Recommended – Aligned with security best practices

In contrast:

Option A uses long-term credentials, which is a security risk.

Option B requires additional infrastructure (EC2, VPN), increasing complexity and cost.

Option C relies on IP-based access, which is insecure and not a form of identity-based authentication.

Amazon CloudFront is a global content delivery network (CDN) that caches and distributes content to users with low latency. By setting the existing ALB as the origin, CloudFront can cache dynamic and static content closer to users worldwide, improving performance and reducing the load on the application servers. This is the most cost-optimized and AWS-recommended way to globally serve dynamic content for web applications.

Reference Extract:

" CloudFront accelerates delivery of both static and dynamic content, reducing latency and offloading origin resources by caching content at edge locations. "

Source: AWS Certified Solutions Architect – Official Study Guide, CloudFront and Global Application section.