AWS Certified Associate SAA-C03 Exam Questions and Answers PDF

Partition Key Issue:

Using " service name " as the partition key results in uneven data distribution. Some shards may become hot due to excessive logs from certain services, leading to throttling errors.

Changing the partition key to " creation timestamp " ensures a more even distribution of records across shards.

Incorrect Options Analysis:

Option A: On-demand capacity mode eliminates throughput management but is more expensive and does not address the root cause.

Option B: Adding more shards does not solve the issue if the partition key still creates hot shards.

Option D: Using separate streams increases complexity and is unnecessary.

The correct answer isDbecause the company needs to authenticate users from anon-premises LDAP directoryto theAWS Management Console, but the directory isnot SAML-compatible. In this scenario, the AWS-recommended pattern is to use acustom identity brokerthat authenticates users against the existing LDAP directory and then requeststemporary AWS credentialsfromAWS Security Token Service (AWS STS). This enables federated access to AWS without creating long-term IAM user credentials for each person.

A custom identity broker serves as the intermediary between the non-SAML directory and AWS. After validating a user with LDAP, the broker can call AWS STS to issue short-lived credentials or console sign-in access. This approach preserves the use of the company’s existing identity source while meeting AWS security best practices for temporary credentials and centralized identity management.

Option A is incorrect becauseAWS IAM Identity Centertypically relies on supported identity sources and federation methods, and the question explicitly states that the LDAP directory is not SAML-compatible. Option B is incorrect because IAM policies do not integrate directly into LDAP as an authentication mechanism. Option C is incorrect because rotating IAM credentials tied to LDAP changes still relies on long-term credentials and does not provide a proper federated sign-in model.

AWS federation guidance supports the use of acustom identity brokerwhen an organization has a non-SAML-compatible identity system. Therefore, the best solution is to develop anon-premises custom identity brokerthat usesAWS STSto obtain short-lived credentials for AWS Management Console access.

Durable storage of incoming orders with buffering and ability to handle surges is exactly what Amazon SQS is designed for. SQS provides highly durable, scalable queues that decouple producers from consumers.

Centrally tracking workflow steps is a core use case of AWS Step Functions, which gives a visual workflow and state machine, tracks the state of each order, and can orchestrate calls to multiple microservices (in this case, Lambda functions).

Combining SQS + Step Functions + Lambda gives:

Durable queueing for orders (SQS).

Loose coupling and surge handling (SQS decoupling + auto-scaling Lambda).

Central orchestration and tracking of order-processing steps (Step Functions).

Why the other options are not correct:

A: SNS is a pub/sub service, not a durable work queue, and is not designed for “store-and-retry until processed” workloads in the same way SQS is.

C: SQS + EventBridge provides decoupling but no central, stateful workflow tracking; EventBridge is event routing, not workflow orchestration.

D: SNS + EventBridge still lacks durable order storage and explicit centralized workflow/state tracking.

AWS Step Functions can orchestrate Lambda executions without modifying the Lambda code, and the Map state is designed to run a Lambda function once per item in a list—perfect for activating many devices in parallel or controlled batches.

This eliminates the loop inside the Retrieve function and prevents timeouts.

EventBridge (Option A) only changes the schedule. DynamoDB Streams (Option B) is unrelated to the activation workflow. EC2 (Option D) increases operational overhead.