SAA-C03 Practice Test 2 — 10 Questions

Question 1

A database administrator needs to ensure that an Amazon RDS for MySQL instance can withstand an Availability Zone failure and provide low-latency reads for a reporting application. Which TWO steps should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Multi-AZ deployment for the RDS instance.. Enabling Multi-AZ provides the high availability needed to survive an AZ failure by maintaining a synchronous standby. Creating a Read Replica in a different AZ offloads read traffic from the primary instance, improving performance for the reporting application while also providing an additional layer of data redundancy across the region.

Answer

Use EBS Snapshots to back up the database every 5 minutes.

Answer

Enable Enhanced Monitoring with a 1-second granularity.

Answer

Implement a Network Load Balancer in front of the RDS instance.

Question 2

A global gaming company wants to reduce latency for its players who are distributed worldwide. The application uses UDP-based traffic and requires a static entry point to simplify firewall management. Which service should the architect recommend to optimize the network path?

Accepted Answer

AWS Global Accelerator.. AWS Global Accelerator uses the AWS global network to route traffic to the optimal regional endpoint based on health and proximity. Unlike CloudFront, which is primarily for HTTP/S content, Global Accelerator supports non-HTTP protocols like UDP. It provides static IP addresses that act as a fixed entry point, improving performance by keeping traffic on the AWS backbone.

Answer

Amazon CloudFront.

Answer

Amazon Route 53 with Geolocation routing.

Answer

AWS Direct Connect.

Question 3

A global e-commerce enterprise runs its checkout workflow using AWS Lambda functions integrated with Amazon API Gateway. During flash sales, traffic spikes cause downstream payment APIs to timeout, leading to lost transactions and frustrated customers. The solutions architect needs to redesign the architecture to decouple the frontend from the payment processor and ensure no transaction requests are lost. What should the architect do?

Accepted Answer

Integrate an Amazon SQS FIFO queue between API Gateway and the downstream payment processing Lambda functions.. Integrating an Amazon SQS FIFO queue between API Gateway and the payment Lambda decouples the frontend from the downstream payment processor, buffering requests during traffic spikes so no transaction is lost. FIFO queues preserve order and provide exactly-once processing, which is critical for payment transactions. The Lambda functions can then poll the queue at a controlled rate, preventing downstream timeouts.

Answer

Configure API Gateway to cache responses using an Amazon ElastiCache Redis cluster deployed in multi-AZ mode.

Answer

Increase the timeout and memory allocation of the API Gateway integration and the AWS Lambda functions.

Answer

Use AWS Step Functions with standard workflows to execute the payment processing steps sequentially.

Question 4

A company is concerned that its database credentials, currently stored as environment variables in AWS Lambda, are not being rotated regularly. Which AWS service should the company use to securely store and automatically rotate these credentials?

Accepted Answer

AWS Secrets Manager with its built-in rotation feature for Amazon RDS.. AWS Secrets Manager is purpose-built for storing secrets and provides native, automatic rotation using Lambda rotation functions, including built-in templates for Amazon RDS, Aurora, Redshift, and DocumentDB credentials. It integrates with RDS so the database password and the secret are rotated together without application downtime. This directly satisfies the requirement to store credentials securely and rotate them automatically.

Answer

AWS Systems Manager Parameter Store with SecureString parameters.

Answer

AWS Key Management Service (KMS) to encrypt the environment variables.

Answer

AWS Identity and Access Management (IAM) roles for the Lambda function.

Question 5

A large corporation uses AWS Organizations to manage hundreds of accounts. The security team wants to ensure that no account can provision resources in unauthorized regions and that only approved AWS services can be used. Which TWO features should be used to enforce these constraints across the entire organization? (Select TWO.)

Accepted Answer

Service Control Policies (SCPs) applied to the root of the Organization.. Option B is correct because Service Control Policies (SCPs) applied at the organization root set the maximum available permissions for all accounts in the organization, so they can centrally deny access to unapproved AWS services across every member account. Option E is correct because an SCP with a Condition element using the aws:RequestedRegion global condition key can explicitly deny API calls made to regions outside the approved list, enforcing the region restriction organization-wide. Together, SCPs at the root and region-based conditions satisfy both requirements: restricting services and restricting regions for all accounts. Option A is not appropriate because IAM policies in each member account are decentralized, must be maintained per account, and do not act as a guardrail against account administrators granting themselves broader permissions. Option C is incorrect because AWS Resource Access Manager (RAM) shares resources such as subnets or Transit Gateways between accounts; it does not restrict which services or regions can be used. Option D is incorrect because AWS Config rules detect and can remediate noncompliant resources after creation, but they do not prevent provisioning in unauthorized regions the way an SCP deny does.

Answer

IAM Policies attached to each administrative user in every member account.

Answer

AWS Resource Access Manager (RAM) to share authorized services across accounts.

Answer

AWS Config rules to automatically terminate resources in unauthorized regions.

Question 6

A web application is deployed on Amazon EC2 instances within a private subnet. The application must receive traffic from an Application Load Balancer (ALB) in a public subnet and connect to an Amazon RDS MySQL database in a different private subnet. Which TWO steps are required to secure this architecture using security groups?

Accepted Answer

Configure the EC2 security group to allow inbound traffic on port 80/443 from the ALB security group.. Option A is correct because the EC2 instances must accept HTTP/HTTPS traffic from the ALB, and referencing the ALB's security group as the source on ports 80/443 restricts inbound access to only that load balancer rather than the whole internet. Option B is correct because the application tier must reach the RDS MySQL database on its listener port 3306, and using the EC2 security group as the source in the RDS security group's inbound rule limits database access to only those application instances. Option C is wrong because allowing 0.0.0.0/0 on port 80 would expose the instances directly to the internet, defeating the purpose of placing them in a private subnet behind an ALB. Option D is wrong because security groups are stateful, so return traffic for allowed inbound connections is automatically permitted and no outbound rule to the EC2 instances is needed; moreover, RDS does not initiate connections to the instances. Option E is wrong because it reverses the traffic direction: the ALB receives client traffic from the internet, not from the EC2 instances, so the ALB security group should allow inbound 80/443 from the internet (or appropriate clients), not from the EC2 security group.

Answer

Configure the EC2 security group to allow inbound traffic from 0.0.0.0/0 on port 80 to handle web traffic.

Answer

Configure the RDS security group to allow outbound traffic to the EC2 instances on all ports.

Answer

Configure the ALB security group to allow inbound traffic from the EC2 security group on port 80.

Question 7

A developer needs to access an S3 bucket from an EC2 instance. For security best practices, the developer must avoid hardcoding long-term credentials on the instance. What is the most secure method to provide the necessary permissions?

Accepted Answer

Attach an IAM role to the EC2 instance with an S3 access policy.. Attaching an IAM role to the EC2 instance lets the instance obtain temporary, automatically rotated credentials via the Instance Metadata Service (IMDS), eliminating hardcoded long-term keys. The role's policy grants least-privilege S3 access, which is the AWS-recommended best practice for instance-to-service authentication.

Answer

Create an IAM user with S3 access and store the access key and secret key in a local configuration file.

Answer

Configure the S3 bucket policy to allow public read access to the specific EC2 instance's public IP address.

Answer

Modify the instance security group to allow all traffic to and from the S3 endpoint.

Question 8

A company is migrating a compute-intensive web application to AWS. The application requires high CPU performance and needs to scale automatically based on demand. Which EC2 instance family and scaling feature should the architect choose to ensure optimal performance?

Accepted Answer

C-family instances with a dynamic scaling policy.. C-family instances are compute-optimized, delivering the highest CPU performance per dollar for compute-intensive workloads, which matches the application's requirement. Pairing them with a dynamic scaling policy (target tracking or step scaling) lets the Auto Scaling group respond automatically to real-time demand changes. Together they satisfy both the performance and elasticity requirements.

Answer

T-family instances with a standard Auto Scaling group.

Answer

R-family instances with a scheduled scaling policy.

Answer

M-family instances with manual scaling adjustments.

Question 9

Refer to the exhibit. A solutions architect reviews the following IAM policy applied to a user. What is the effect of this policy when the user attempts to access an object in the bucket from an IP address of 198.51.100.5?

Accepted Answer

Access is denied because the source IP address is not within the 203.0.113.0/24 range.. The policy includes a condition that restricts access to the IP range 203.0.113.0/24. Since the user's IP address (198.51.100.5) is outside this range, the condition evaluates to false, and the Allow statement does not apply. Therefore, the request is implicitly denied because there is no other Allow statement that grants access.

Answer

Access is allowed because the policy grants s3:GetObject permissions to the bucket.

Answer

Access is allowed because there is no explicit Deny statement in the policy.

Answer

Access is denied because the policy does not include permissions for the s3:ListBucket action.

Question 10

A company's public-facing application is experiencing a Distributed Denial of Service (DDoS) attack. The application is hosted on EC2 instances behind an Application Load Balancer (ALB). Which TWO AWS services or features can be used to mitigate this attack and protect the application?

Accepted Answer

AWS Shield Advanced for enhanced DDoS detection and mitigation.. Protecting against DDoS attacks requires a multi-layered approach. AWS Shield provides automatic protection for all AWS customers, while Shield Advanced offers enhanced detection and mitigation for sophisticated attacks. AWS WAF complements this by allowing administrators to create rules that block malicious traffic patterns, such as SQL injection or high-volume IP addresses.

Answer

Amazon GuardDuty to identify and block malicious traffic at the VPC level.

Answer

Amazon Inspector to scan EC2 instances for vulnerabilities during the attack.

Answer

AWS PrivateLink to hide the application from the public internet.