SAA-C03 interview questions & answers

Spot is for fault-tolerant, stateless or batch work that can be interrupted — CI runners, big-data processing, rendering — because it is up to ~90% cheaper but can be reclaimed with a two-minute warning. Use On-Demand for short, unpredictable workloads and Reserved/Savings Plans for steady, always-on baseline capacity.

Lambda for short, event-driven functions with no server management and per-millisecond billing; Fargate for containers when you want no node management but need long-running or always-on services; EC2 when you need full control of the OS, GPUs, licensing, or very high steady utilisation where it is cheaper. The deciding factors are run duration, operational overhead you want to own, and cost at your utilisation.

Amazon EFS — it is a managed NFS file system that many instances can mount at once across Availability Zones. EBS is a single-AZ block volume attached to one instance (or a few with io2 Multi-Attach), and S3 is object storage, not a POSIX file system, so neither fits shared-file access cleanly.

Turn on S3 Intelligent-Tiering so objects move between frequent, infrequent and archive tiers automatically, or write lifecycle rules (e.g. to Standard-IA after 30 days, Glacier after 90). Durability is 11 nines by default; enable Versioning and, for compliance, Object Lock. Replicate cross-region only if you need DR or lower read latency elsewhere.

A security group is stateful and attaches to an ENI/instance — return traffic is allowed automatically and it only has allow rules. A network ACL is stateless and attaches to a subnet — you must allow both directions, and it supports explicit deny rules. Security groups are your primary control; NACLs are a coarse subnet-level backstop.

Route their outbound traffic through a NAT Gateway in a public subnet; the NAT has the only route to the internet gateway. Instances get no public IP, so nothing on the internet can initiate a connection to them. For AWS service calls, prefer VPC endpoints so the traffic never leaves the AWS network at all.

Run instances in at least two AZs behind an Application Load Balancer, in an Auto Scaling group that re-launches capacity in the healthy AZ. Use a Multi-AZ RDS database so it fails over automatically, and keep shared state in S3/DynamoDB/ElastiCache rather than on the instances. Health checks plus statelessness let traffic shift with no manual action.

DynamoDB when you need single-digit-millisecond latency at massive, unpredictable scale with a key/value or simple document access pattern and no complex joins — and you can design around its partition key. RDS (or Aurora) when you need relational joins, transactions across tables, and SQL. The question is really: does your access pattern fit a known-key lookup, or do you need ad-hoc relational queries?

A role gives the instance temporary, automatically rotated credentials through the instance metadata service, so there are no long-lived keys to leak, store, or rotate by hand. You attach the role to the instance profile and grant least-privilege permissions. Hard-coded access keys in code or on disk are the most common AWS breach cause.

Open Cost Explorer and group by service and by usage type to find what grew, then check for untagged runaway resources — forgotten large instances, unattached EBS/Elastic IPs, NAT Gateway or cross-AZ data transfer, and S3 request/egress. Set a Budgets alert, apply Savings Plans to the steady baseline, and add cost-allocation tags so the next spike is attributable.