Pearson SAA-C03 New Attempt

The most secure option is to use across-account IAM rolein the central logging account and allow authorized Lambda functions in member accounts to assume that role. AWS cross-account access guidance is based on trusted roles rather than sharing long-term IAM user credentials. This keeps access temporary, auditable, and centrally controlled. The IAM user answers are weaker because they depend on long-term credentials, which is not the recommended pattern for Lambda-based cross-account access. A bucket policy that broadly allows “AWS Lambda” is also too permissive and not scoped to the organization’s trusted workloads. Therefore, a central role with an appropriate trust policy is the strongest design among the listed choices.

============

A highly available relational database with minimal manual intervention is best delivered by Amazon RDS Multi-AZ, which provides managed standby infrastructure and automatic failover. For the container-based application layer, Amazon ECS with the Fargate launch type reduces operational effort because AWS manages the underlying compute capacity for the containers. That combination provides managed availability for both the database and the application tier. Read replicas can help scale reads, but they do not replace Multi-AZ as the primary high-availability pattern for the database. ECS on EC2 is workable, but it requires more instance management than Fargate. This makes A and D the strongest pair for high availability with minimal operational overhead.

============

To securely publish messages to an encrypted Amazon SNS topic, the following steps are required:

A. Resource policy for SNS topic:Ensures that the Lambda function is explicitly allowed to publish messages to the topic.

C. Resource policy for KMS key:Provides the necessary permissions to use the customer-managed key for encryption.

F. Lambda execution role:Grants the Lambda function the necessary IAM permissions to use the encryption key.

Other options:

Bis invalid because using SSE-KMS does not eliminate the need for resource policies.

Doverlaps with A, but specifying the ARN in the topic policy is covered by creating the resource policy.

Eis unrelated as API Gateway is not required for this setup.

AWS Documentation Reference:

Amazon SNS and KMS Permissions

Comprehensive and Detailed 250 to 300 words of Explanation (AWS documentation-based, no links):

The requirements are straightforward: expose the Lambda microservice through an HTTPS endpoint and authenticate calls using IAM. Lambda function URLs are a built-in feature that provides a dedicated HTTPS endpoint for a Lambda function without requiring API Gateway, ALB, or CloudFront. When configured with the authentication type AWS_IAM, the endpoint requires requests to be signed with AWS Signature Version 4 and authorized by IAM policies. This directly satisfies the “must use IAM to authenticate calls” requirement with the least architectural complexity.

Option A can also secure an endpoint with IAM, but it proposes using a Lambda authorizer, which is typically used for custom authorizers (JWT/OAuth/Cognito/external identity). For IAM authentication in API Gateway, you generally use IAM authorization on the method, not an authorizer function. Also, API Gateway REST APIs introduce additional service configuration and per-request costs when a simpler managed option exists that meets the requirements.

Options C and D are not appropriate. Lambda@Edge and CloudFront Functions run at CloudFront edge locations with different programming and deployment models; they are designed for CDN request/response manipulation, not as the primary mechanism to expose a regional Lambda microservice endpoint with IAM authentication. CloudFront Functions in particular is for lightweight JavaScript at the edge and does not provide a native “AWS_IAM authentication type” for invoking an origin Lambda as a microservice endpoint.

Therefore, B is the cleanest and most secure fit: a native HTTPS endpoint backed by Lambda, protected with IAM-based SigV4 authentication.