SAA-C03 Practice Test 12 — 15 Questions

Question 1

Refer to the exhibit. A junior cloud financial analyst needs to monitor and optimize costs across the organization's AWS account. The analyst requires the ability to view historical cost data and check how effectively Reserved Instances and Savings Plans are being used. Which AWS service is the analyst most likely using with this IAM policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides historical cost and usage data, forecasting, and — critically — Reserved Instance (RI) and Savings Plans utilization and coverage reports. The IAM policy granting access to Cost Explorer APIs (ce:GetCostAndUsage, ce:GetReservationUtilization, ce:GetSavingsPlansUtilization) confirms this is the service in use.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Compute Optimizer

Question 2

A company is designing a global application. They need to replicate 1 TB of data monthly between two AWS Regions. What is the most cost-effective way to minimize data transfer costs?

Accepted Answer

Compress the data before transferring it between regions.. Compressing data before transferring it between regions reduces the volume of data transferred, thereby lowering data transfer costs. AWS charges for data transfer out from a region, so reducing the number of bytes transferred directly reduces costs. Compression is a simple and effective method to minimize data transfer costs for large datasets.

Answer

Use AWS Direct Connect to link the two regions together.

Answer

Use an Amazon CloudFront distribution to cache data between regions.

Answer

Deploy a VPC Peering connection between the two regions.

Question 3

Refer to the exhibit. A security audit identifies that data is being transmitted to an S3 bucket named 'corporate-data' without encryption in transit. Which behavior does this bucket policy enforce to address this concern?

Accepted Answer

It denies any S3 action if the request does not use an encrypted connection (HTTPS).. The bucket policy denies any S3 action if the request does not use an encrypted connection (HTTPS). This is enforced by a condition like aws:SecureTransport: false, which blocks HTTP requests. This directly addresses the concern of data in transit being unencrypted.

Answer

It ensures that all objects stored in the bucket are encrypted using AES-256 server-side encryption.

Answer

It logs all access attempts to the bucket to identify users who are not using SSL.

Answer

It automatically redirects all HTTP requests to HTTPS for the specified S3 bucket.

Question 4

An architect is designing a system that must be resilient against AWS regional failure. Which AWS service is best suited to manage global DNS traffic and provide health-based routing?

Accepted Answer

Amazon Route 53.. Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service. It provides health checks and routing policies, such as failover, latency-based, and geolocation routing. By using health checks, Route 53 can detect the failure of an endpoint in one region and automatically route traffic to a healthy endpoint in another, fulfilling the requirement for regional resilience.

Answer

Elastic Load Balancing (ELB).

Answer

AWS Direct Connect.

Answer

Amazon CloudFront.

Question 5

An application uses Amazon DynamoDB. To ensure the application remains resilient to regional outages, what is the best approach?

Accepted Answer

Use DynamoDB Global Tables.. DynamoDB Global Tables provide multi-region, active-active replication with automatic conflict resolution, ensuring the application can read and write to the table in any region and remain resilient to regional outages. This is the only option that offers automatic, low-latency replication across regions without manual intervention.

Answer

Enable DynamoDB backups in the same region.

Answer

Use AWS Database Migration Service to sync data.

Answer

Manually replicate data to another region every hour.

Question 6

A web application hosted on EC2 instances needs to access a DynamoDB table. What is the most secure way to provide the application with the necessary permissions?

Accepted Answer

Attach an IAM role to the EC2 instance profile.. Attaching an IAM role to the EC2 instance profile provides temporary, automatically rotated credentials to the application via the instance metadata service, eliminating the need to store long-term keys. This is the AWS-recommended, most secure way to grant EC2-hosted applications access to DynamoDB.

Answer

Store IAM access keys in a configuration file on the EC2 instance.

Answer

Assign the EC2 instance a public IP address.

Answer

Use the root user credentials for the application.

Question 7

A company is building a mobile application that needs to authenticate users and allow them to upload photos directly to an Amazon S3 bucket. Which TWO Amazon Cognito components should be used to provide a secure and scalable solution?

Accepted Answer

Amazon Cognito User Pools to manage user registration and sign-in.. Option A is correct because Amazon Cognito User Pools provide a scalable, managed user directory that handles registration, sign-in, and token issuance (ID, access, and refresh tokens) for the mobile app's authentication layer. Option B is correct because Cognito Identity Pools exchange the User Pool token for temporary, scoped AWS credentials via AWS STS, allowing the app to upload photos directly to S3 without embedding long-term keys. Together they implement the standard authentication-plus-authorization pattern for mobile apps accessing AWS services. Option C (Cognito Sync) is a legacy data-synchronization service, not an authentication or credential-vending mechanism, and is not needed here. Option D (IAM Users per app user) is an anti-pattern for mobile apps because it requires distributing long-term credentials and does not scale. Option E (AWS Directory Service) is for integrating existing AD/ LDAP directories and does not provide the mobile-native sign-up/sign-in or temporary credential flow required.

Answer

Amazon Cognito Sync to synchronize user data across multiple devices.

Answer

IAM Users for each mobile application user to control S3 access.

Answer

AWS Directory Service to integrate with an on-premises Active Directory.

Question 8

A legacy application uses a monolithic architecture with a high-performance compute requirement. The application is CPU-bound and requires consistent sub-millisecond latency between compute nodes. Which EC2 feature should the architect use?

Accepted Answer

Cluster Placement Groups.. Cluster Placement Groups provide high-density, low-latency, and high-throughput networking for compute-intensive applications. By placing instances in a single Availability Zone and a low-latency network cluster, the architect ensures that inter-node communication is as fast as possible. This is essential for HPC (High-Performance Computing) workloads where network jitter and latency can significantly degrade application performance. It allows the instances to participate in a low-latency, high-bandwidth network fabric within the AWS data center.

Answer

Spread Placement Groups.

Answer

Auto Scaling groups across multiple Availability Zones.

Answer

Dedicated Hosts with physical CPU pinning.

Question 9

A solutions architect is tasked with reducing the cost of Amazon EBS volumes across a large AWS environment. Which THREE strategies will lead to lower EBS costs? (Select THREE.)

Accepted Answer

Migrate gp2 volumes to gp3 volumes.. Option B is correct because gp3 volumes decouple storage capacity from provisioned IOPS and throughput, and gp3 is priced lower per GB than gp2 (about $0.08/GB-month vs $0.10/GB-month in us-east-1), so migrating gp2 to gp3 reduces cost while often improving baseline performance. Option C is correct because unattached (available) EBS volumes still incur full storage charges, so identifying and deleting them with tools like the EBS console, DescribeVolumes, or Trusted Advisor eliminates that waste. Option E is correct because EBS snapshots are billed at $0.05/GB-month for standard snapshot storage, so deleting snapshots no longer needed for recovery directly removes ongoing charges. Option A is not correct because io2 Block Express is a high-performance, higher-priced volume type, so converting gp2 to it would increase cost, not lower it. Option D is not correct because EBS has no bulk-pricing tier; increasing volume size increases the per-GB charge proportionally and raises cost.

Answer

Convert all gp2 volumes to io2 Block Express.

Answer

Increase the size of all volumes to take advantage of bulk pricing.

Question 10

An application uses a monolithic architecture on EC2 instances. The company wants to improve resilience against regional failures. Which TWO actions should the architect take to achieve this? (Select TWO.)

Accepted Answer

Configure Amazon Route 53 with failover routing policies to a secondary region.. Option B is correct because Route 53 failover routing policies with health checks automatically redirect traffic to a secondary region when the primary region becomes unhealthy, directly providing regional failover capability. Option C is correct because Aurora Global Database replicates data across regions with typical latency under one second, enabling a secondary region to serve reads and support fast promotion during a regional failure, which is essential for cross-region resilience of a stateful monolith. Option A is not correct because deploying across multiple Availability Zones within a single region only protects against AZ-level failures, not regional failures. Option D is not correct because Direct Connect is a dedicated network link between on-premises and AWS (or between regions via Direct Connect Gateway) and does not by itself provide application failover or resilience. Option E is not correct because increasing the minimum EC2 instance count in an Auto Scaling group only adds capacity within a single region and does nothing for regional failure resilience.

Answer

Deploy the application to multiple Availability Zones within a single region.

Answer

Use an AWS Direct Connect connection to link the two regions.

Answer

Increase the minimum number of EC2 instances in the Auto Scaling group.

Question 11

Refer to the exhibit. This bucket policy grants access to a specific account. A user in that account still cannot access the object. What is the most likely reason?

Accepted Answer

The user in the target account lacks IAM permissions.. The bucket policy grants cross-account access to the account, but for a user in that account to actually access the S3 object, the user must also have IAM permissions that allow the action (e.g., s3:GetObject). AWS evaluates both the bucket policy and the user's IAM policy; access is granted only if both allow it (unless an explicit deny exists). Since the bucket policy is correct, the missing piece is the user's IAM policy.

Answer

The bucket policy needs to use 'Effect': 'Deny'.

Answer

The bucket policy must include 'Principal': '*'.

Answer

The resource ARN is incorrectly formatted.

Question 12

A media company experiences unpredictable traffic spikes on its web application. The architect needs to ensure the application remains responsive while optimizing for performance. Which TWO strategies should be implemented? (Select TWO.)

Accepted Answer

Configure a Target Tracking Scaling Policy for the Auto Scaling group.. Option A is correct because a Target Tracking Scaling Policy for the Auto Scaling group automatically adjusts capacity to maintain a specified metric (such as average CPU utilization or ALB request count per target) at a target value, which directly handles unpredictable traffic spikes while keeping the application responsive. Option C is correct because deploying Amazon CloudFront in front of the Application Load Balancer caches static and cacheable content at edge locations, reduces latency for global users, and offloads traffic from the origin, improving performance during spikes. Option B is not appropriate because a Simple Scaling Policy with a large cooldown period reacts slowly and can leave the application under-provisioned during sudden spikes. Option D is irrelevant because provisioning io2 IOPS on EC2 root volumes addresses storage throughput, not web traffic responsiveness. Option E is not suitable because manual vertical scaling is slow, requires downtime or restarts, and cannot respond to unpredictable spikes in real time.

Answer

Use a Simple Scaling Policy with a large cooldown period.

Answer

Provision IOPS (io2) for all EC2 root volumes.

Answer

Implement vertical scaling by increasing instance sizes manually.

Question 13

A company runs a mission-critical web application on EC2. The database is on RDS. How should the architect ensure the fastest possible recovery time objective (RTO) if the primary database instance fails?

Accepted Answer

Enable RDS Multi-AZ deployment.. RDS Multi-AZ deployment provides synchronous replication to a standby instance in a different Availability Zone (AZ) within the same region. If the primary instance fails, RDS automatically performs a failover to the standby, updating the DNS record to point to the new primary. This process typically happens in under 60 seconds, which is the most effective native way to achieve a low RTO for RDS.

Answer

Configure an RDS Read Replica in a different region and promote it if the primary fails.

Answer

Take hourly automated snapshots and restore from the latest snapshot upon failure.

Answer

Back up the database to S3 and use a standby EC2 instance to run a database engine.

Question 14

A globally distributed application needs to provide low-latency access to static content for users around the world. Which AWS service is best suited for this requirement?

Accepted Answer

Amazon CloudFront.. Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations worldwide, dramatically reducing latency for geographically distributed users. It integrates natively with S3 origins and supports cache behaviors, signed URLs, and Lambda@Edge for dynamic customization. This makes it the purpose-built service for low-latency global static content delivery.

Answer

Amazon S3 Cross-Region Replication.

Answer

AWS Global Accelerator.

Answer

Amazon Route 53 Geolocation Routing.

Question 15

A mission-critical application requires a recovery time objective (RTO) of near-zero. Which disaster recovery strategy should the architect implement?

Accepted Answer

Multi-Site Active-Active.. The explanation is accurate, but the question requires a defined exam trap and common trap note to help students avoid pitfalls.

Answer

Backup and Restore.

Answer

Pilot Light.

Answer

Warm Standby.