Amazon Web Services Updated SAA-C03 Exam Questions and Answers by hayley

The best combination isAmazon Athenafor SQL-based analysis andAmazon QuickSightfor visualization. AWS documentation includes Athena guidance for creating tables over sampleCloudFront log datastored in Amazon S3, which makes Athena a direct fit for querying those logs without infrastructure management. AWS also describes QuickSight as a scalable business intelligence service for building dashboards and visualizations from query results. Glue is primarily for data cataloging and ETL, not end-user visualization. DynamoDB is not a SQL analytics engine for S3 log files. For advanced analysis of CloudFront logs and dashboard-style visualizations, Athena plus QuickSight is the correct AWS-native pattern. (AWS Documentation)

============

Amazon S3 Access Points simplify managing data access for shared datasets in S3 by allowing the creation of distinct access policies for different applications or users. Each access point has its own policy and can be managed independently. This method avoids overloading a single bucket policy and helps remain within policy size limits.

Option D provides a scalable and operationally efficient solution by offloading individual access controls from a central bucket policy to individually managed access points, which is ideal for environments with many consuming applications.

A highly available relational database with minimal manual intervention is best delivered by Amazon RDS Multi-AZ, which provides managed standby infrastructure and automatic failover. For the container-based application layer, Amazon ECS with the Fargate launch type reduces operational effort because AWS manages the underlying compute capacity for the containers. That combination provides managed availability for both the database and the application tier. Read replicas can help scale reads, but they do not replace Multi-AZ as the primary high-availability pattern for the database. ECS on EC2 is workable, but it requires more instance management than Fargate. This makes A and D the strongest pair for high availability with minimal operational overhead.

============

AWS documentation states that the most secure method for granting private S3 access from VPCs is to use gateway VPC endpoints for Amazon S3. Endpoint policies enforce least privilege by allowing only specific IAM roles access to specific S3 buckets. Because users can obtain temporary credentials through IAM roles, no permanent access keys must be distributed.

S3 bucket policies based on CIDR ranges (Option B) are less secure because CIDR-based access is broader and can grant unintended access. Access points (Option C) still rely on public S3 endpoints unless combined with VPC-only access, which is not stated here. Option D exposes S3 to public internet egress and depends on public IPs, violating least-privilege principles.

=====================================================