Newly Released Amazon Web Services SAA-C03 Exam PDF

The best practice to securely provide short-term access to AWS resources, such as Amazon S3, without using long-term credentials, is to use AWS Security Token Service (STS). According to the AWS IAM Best Practices and the Security Pillar of the AWS Well-Architected Framework, temporary credentials should always be used over long-term credentials when possible.

From AWS IAM Documentation:

“Use temporary credentials (IAM roles and AWS STS) instead of long-term access keys. Temporary security credentials are short-term, automatically expire, and are retrieved using AWS STS.”

(Source: IAM Best Practices – IAM User Guide)

Option D outlines the use of a trust relationship and assume-role mechanism via AWS STS. This allows the on-premises application to request temporary, scoped-down credentials to upload files to S3 securely. This approach is:

Secure – Uses short-lived credentials with least privilege

Scalable – No need for EC2 or VPN tunnels

Low Operational Overhead – No infrastructure to maintain

AWS-Recommended – Aligned with security best practices

In contrast:

Option A uses long-term credentials, which is a security risk.

Option B requires additional infrastructure (EC2, VPN), increasing complexity and cost.

Option C relies on IP-based access, which is insecure and not a form of identity-based authentication.

The workload is Windows-based and requires a shared file system with SMB support and very high throughput for 4K video editing.

Amazon FSx for Windows File Server is a fully managed, highly available native Windows file system that supports the SMB protocol, Active Directory integration, and can deliver high throughput and low latency suitable for media workloads.

FSx for Windows File Server supports automatic storage scaling to grow file system capacity as data increases, matching the requirement of +1 TB per week with minimal admin effort.

A Multi-AZ SSD deployment provides high availability and performance.

Why others are not correct:

B: Amazon EFS is NFS, not SMB, and is optimized for Linux clients, not Windows-based environments.

C: FSx for Lustre is a high-performance POSIX file system typically used with Linux-based HPC workloads, not Windows + SMB.

D: S3 File Gateway is not designed for sustained multi-GB/s shared-edit performance and adds additional complexity; it is more suited for backup/archival and limited shared file access.

ElastiCache for Redis OSS supportsMulti-AZ with automatic failover, which is exactly the feature required here. AWS documentation states that when Multi-AZ is enabled and the primary node fails, ElastiCache automatically promotes a read replica to primary, minimizing downtime and restoring write capability without requiring manual promotion steps. Backups are useful for recovery, but they do not provide automatic operational failover. A design that depends on manual promotion is also weaker than native automatic failover. Since the question explicitly asks for a solution that canautomatically fail over, the correct answer is to enableMulti-AZfor the replication group.

============

AWS WAF Bot Control is the best fit because the problem is abusive automated traffic submitting unnecessary requests and consuming compute resources. AWS documents that the Bot Control managed rule group is specifically designed to identify and manage bot traffic, including high-confidence bot signatures and common bot categories. This is more targeted than maintaining custom IP blocks and more directly aligned to the behavior described than general IP reputation controls. AWS Shield focuses on DDoS protection, not detailed application-layer bot categorization. Therefore, associating a WAF web ACL with the ALB and enabling Bot Control is the most appropriate solution.

============