SAA-C03 Practice Exam 4 — 20 Questions

Question 1

A company is migrating a high-traffic web application to AWS. The application uses an Amazon RDS for MySQL database. The database experience high read pressure during business hours, but write activity remains consistent and low. Which TWO architectural changes will reduce costs while maintaining performance? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create RDS Read Replicas and update the application to split read and write traffic.. Offloading read traffic to Read Replicas is more cost-effective than scaling up the primary instance size, as it allows for horizontal scaling of reads. Additionally, using Multi-AZ deployments for the primary instance ensures high availability, while Read Replicas can be placed in different regions or zones to distribute the load without over-provisioning the main database.

Answer

Scale up the primary RDS instance to a larger instance class with more RAM.

Answer

Switch the database to Amazon RDS for SQL Server to take advantage of License Inclusion.

Answer

Enable Multi-AZ for all Read Replicas to ensure high availability.

Question 2

An enterprise organization is planning a centralized logging architecture across hundreds of AWS accounts using AWS CloudTrail and Amazon S3. Security mandates state that all log files delivered to the centralized S3 bucket must be cryptographically verified to ensure they have not been modified or tampered with after delivery. Which TWO actions must a Solutions Architect implement to achieve this mandate? (Choose two.)

Accepted Answer

Enable CloudTrail log file integrity validation on each trail.. Option A is correct because CloudTrail log file integrity validation is the feature that produces a digest file for each delivered log file, containing a digital signature (SHA-256 hash signed with a private key) that allows detection of any modification, deletion, or tampering after delivery. Option E is correct because enabling validation alone only generates the digests; the architect must actually validate them by running AWS CLI commands such as 'aws cloudtrail validate-logs' (or SDK equivalents) against the S3 bucket to cryptographically confirm the log files match their digests. Option B is not correct because S3 Object Lock prevents deletion or overwrite of objects going forward but does not cryptographically prove that a delivered log file's contents are unmodified. Option C is not correct because KMS encryption with key rotation protects data confidentiality and key hygiene, not post-delivery tamper detection. Option D is not correct because S3 Versioning preserves prior object versions but does not itself verify the integrity or authenticity of log file contents.

Answer

Configure S3 Object Lock in compliance mode on the centralized logging bucket.

Answer

Use AWS KMS customer managed keys with automatic key rotation enabled for S3 bucket encryption.

Answer

Enable Amazon S3 Versioning on the centralized logging bucket to preserve previous object iterations.

Question 3

A media company stores millions of small image files in an Amazon S3 bucket. The application frequently requests these images, and the company is experiencing high latency during peak hours. The current architecture uses a single prefix for all objects. How should the architect modify the S3 structure to improve performance?

Accepted Answer

Implement a random or hashed prefix naming convention.. S3 automatically partitions request load by prefix, and a single prefix concentrates all GET requests on one partition, creating a hotspot. Introducing random or hashed prefixes (e.g., a hash of the object key as the first characters) spreads requests across many partitions, allowing S3 to scale request throughput and reduce latency during peak hours. This is the standard fix for high-request-rate workloads on small objects.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use S3 Intelligent-Tiering to move files to higher performance tiers.

Answer

Increase the size of the EC2 instances accessing the S3 bucket.

Question 4

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in the local memory of the EC2 instances. Users report losing their sessions when the Auto Scaling group scales in or replaces unhealthy instances. Which solution ensures session persistence while maintaining high availability?

Accepted Answer

Move the session state to an Amazon ElastiCache for Redis cluster.. Storing session state in ElastiCache for Redis externalizes it from the EC2 instances, so any instance in the Auto Scaling group can serve any user's request regardless of scale-in or instance replacement. Redis provides low-latency, highly available shared state with replication and Multi-AZ failover, ensuring session persistence and high availability simultaneously.

Answer

Configure the Application Load Balancer to use stickiness with a duration-based cookie.

Answer

Store the session state in an Amazon S3 bucket with versioning enabled.

Answer

Replicate the session data across all EC2 instances using a broadcast script.

Question 5

A solutions architect is designing a mission-critical web application that runs on Amazon EC2 instances behind an Application Load Balancer. The application must remain available even if an entire AWS Region experiences a catastrophic failure. The RPO must be near zero, and the RTO must be less than 15 minutes. Which disaster recovery strategy should the architect implement?

Accepted Answer

Configure a multi-site active-active deployment spanning two AWS Regions with continuous data replication and Route 53 health checks.. A multi-site active-active deployment spanning two AWS Regions with continuous data replication and Route 53 health checks provides near-zero RPO and sub-15-minute RTO by allowing both regions to serve traffic simultaneously. If one region fails, Route 53 automatically redirects traffic to the healthy region, ensuring continuous availability.

Answer

Implement a backup and restore strategy using automated daily Amazon EBS snapshots copied to a secondary AWS Region.

Answer

Deploy a pilot light strategy by maintaining a minimal footprint of core database and configuration services in a secondary Region.

Answer

Set up a warm standby architecture running a scaled-down version of the entire application stack in a secondary Region.

Question 6

A solutions architect is designing an application that stores user-uploaded images in Amazon S3. The images are accessed frequently for the first 30 days, then rarely accessed thereafter. Which storage class transition strategy is the most cost-effective?

Accepted Answer

Transition objects to S3 Standard-IA after 30 days.. S3 Standard-IA is the correct choice because the access pattern is well understood: objects are accessed frequently for exactly 30 days, then rarely. Standard-IA costs roughly 40% less than S3 Standard for storage while still providing millisecond retrieval, so a lifecycle rule transitioning objects at day 30 minimizes cost without sacrificing availability. Because the pattern is predictable, Intelligent-Tiering's per-object monitoring fee is unnecessary overhead.

Answer

Store all images in S3 Intelligent-Tiering from the start.

Answer

Transition objects to S3 Glacier Deep Archive after 30 days.

Answer

Manually move images to S3 One Zone-IA after 30 days.

Question 7

A company hosts a monolithic application on EC2. They want to move to a microservices architecture to improve fault isolation. Which approach is best?

Accepted Answer

Decompose the monolith into independent services using containers.. Decomposing the monolith into independent services running in containers gives each service its own lifecycle, scaling, and failure domain, which is exactly what improves fault isolation. Containers package each service with its dependencies and can be orchestrated by ECS or EKS for resilience.

Answer

Increase the size of the existing EC2 instances.

Answer

Use a load balancer to split traffic between two monolithic instances.

Answer

Move the entire application code to a single Lambda function.

Question 8

A company is migrating a legacy application to AWS. The application requires a relational database with very infrequent and unpredictable usage—sometimes it is not used for days, and then it sees a burst of activity for an hour. Which database configuration is most cost-effective?

Accepted Answer

Amazon Aurora Serverless.. Amazon Aurora Serverless is designed for workloads with intermittent, unpredictable, or infrequent usage. It automatically starts up, shuts down, and scales capacity based on application demand, so you only pay for the database capacity consumed during active periods. For an application that is idle for days and then bursts for an hour, this eliminates the cost of provisioning a always-on instance, making it the most cost-effective relational database configuration.

Answer

Amazon RDS for MySQL on a T3-medium instance.

Answer

Amazon Aurora with a Reserved Instance.

Answer

Amazon RDS with Multi-AZ enabled.

Question 9

A high-traffic application uses an Application Load Balancer (ALB) and an Auto Scaling group (ASG). During peak hours, some EC2 instances fail, but the ASG does not replace them immediately because the instances are still in a 'running' state despite the application being unresponsive. How should the architect fix this?

Accepted Answer

Change the ASG health check type from EC2 to ELB.. By default, an Auto Scaling group uses EC2 health checks, which only detect instance-level failures (e.g., stopped or terminated instances) and not application-level unresponsiveness. Changing the health check type to ELB makes the ASG rely on the load balancer's health checks, which actively probe the application on each instance; if an instance fails the ELB health check, the ASG marks it unhealthy and replaces it. This directly resolves the issue of running-but-unresponsive instances.

Answer

Increase the ASG health check grace period to 600 seconds.

Answer

Create a CloudWatch alarm for high CPU usage to trigger replacement.

Answer

Configure a Lambda function to manually terminate unresponsive instances.

Question 10

A financial services company needs to store millions of small records for 7 years to meet regulatory requirements. The records are rarely accessed after the first 30 days. The company wants to minimize storage costs while maintaining the ability to retrieve any record within a few minutes if an audit occurs. Which solution is best?

Accepted Answer

Amazon S3 Glacier Instant Retrieval.. S3 Glacier Instant Retrieval is designed for long-lived, rarely accessed data that still requires millisecond retrieval, making it ideal for regulatory archives where audits need quick access. It offers lower storage costs than S3 Standard-IA while maintaining instant retrieval, and it supports lifecycle transitions after 30 days. This matches the requirement to retrieve any record within a few minutes (instant retrieval is far faster) at minimal cost.

Answer

Amazon S3 Standard-IA.

Answer

Amazon S3 Glacier Flexible Retrieval.

Answer

Amazon S3 Glacier Deep Archive.

Question 11

An enterprise requires all data stored in Amazon S3 to be encrypted at rest. The security team must maintain full control over the encryption keys, including the ability to rotate them annually and define access policies for the keys themselves. Which encryption method meets these requirements with the least operational overhead?

Accepted Answer

Use Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS).. SSE-KMS with Customer Managed Keys (CMKs) allows the security team to create and manage their own KMS keys, including setting key policies, rotating keys annually, and auditing key usage via CloudTrail. It provides full control over the encryption keys while offloading the encryption/decryption process to S3, minimizing operational overhead.

Answer

Use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) for all buckets.

Answer

Implement client-side encryption using a third-party library before uploading objects.

Answer

Enable Server-Side Encryption with Customer-Provided Keys (SSE-C) for all uploads.

Question 12

Refer to the exhibit. An administrator has applied the provided bucket policy to 'my-secure-bucket'. What is the effect of this policy on access to the bucket?

Accepted Answer

It restricts GetObject access to only those requests originating from the 192.0.2.0/24 CIDR block.. The bucket policy uses a Condition with an IpAddress condition key restricting access to the 192.0.2.0/24 CIDR block, and the Action is s3:GetObject. Therefore only requests originating from that IP range are allowed to retrieve objects; all other requests are denied by default because S3 policies are deny-by-default.

Answer

It allows all users to retrieve objects from the bucket if they are using any IP address.

Answer

It denies access to anyone from the 192.0.2.0/24 range and allows everyone else.

Answer

It grants full administrative access to the bucket for the 192.0.2.0/24 IP range.

Question 13

A company is migrating a web application to AWS and needs to ensure that all data stored in Amazon S3 is encrypted at rest using keys managed by the company. The company must be able to rotate these keys annually and maintain full control over key access policies. Which solution meets these requirements?

Accepted Answer

Use AWS KMS with Customer Managed Keys.. AWS KMS Customer Managed Keys (CMKs) give the company full control over the key policy, allow annual rotation to be enabled, and support auditing via CloudTrail. SSE-S3 uses AWS-owned keys the customer cannot manage or rotate, and AWS Managed Keys have rotation controlled by AWS (every three years) with policies the customer cannot edit. Uploading a raw master key to S3 is not a supported KMS pattern.

Answer

Enable S3 Managed Keys (SSE-S3) for all buckets.

Answer

Use AWS KMS with AWS Managed Keys.

Answer

Upload a master key to AWS via the S3 console.

Question 14

A company hosts a web application on EC2 instances behind an Application Load Balancer. The application stores session state in local memory, causing users to be logged out whenever the load balancer routes requests to different instances. Which solution provides the most resilient, scalable architecture to resolve this?

Accepted Answer

Store session state in Amazon ElastiCache for Redis.. Storing session state in Amazon ElastiCache for Redis externalizes session data so any EC2 instance behind the ALB can serve any request, eliminating the logout problem while providing high availability and scalability. Redis is purpose-built for low-latency session stores and supports replication and failover. This is the AWS-recommended pattern for stateless web tiers.

Answer

Configure the Application Load Balancer to use source IP stickiness.

Answer

Use Amazon EBS multi-attach to share session files across instances.

Answer

Replicate session files using a cron job across all web instances.

Question 15

A company's web application requires a highly available database layer to survive an Availability Zone failure without manual intervention. The database must remain accessible during maintenance windows and ensure zero data loss. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Implement an Amazon RDS Multi-AZ deployment.. Amazon RDS Multi-AZ maintains a synchronous standby replica in a different Availability Zone and automatically fails over during an AZ failure or maintenance event, with zero data loss (RPO=0) and no manual intervention. It meets high availability, maintenance resilience, and zero data loss with minimal operational overhead.

Answer

Configure RDS Read Replicas and manually promote them during an outage.

Answer

Deploy a Single-AZ RDS instance and use AWS Backup for hourly snapshots.

Answer

Host a MySQL database on an Amazon EC2 instance with an EBS volume.

Question 16

A web application stores static files in Amazon S3. Due to regulatory requirements, the company must ensure that the files are replicated to a secondary region. What is the most efficient way to achieve this?

Accepted Answer

Enable S3 Cross-Region Replication on the source bucket.. S3 Cross-Region Replication (CRR) is the most efficient and native way to automatically replicate objects from a source bucket to a destination bucket in a different region. It replicates new objects as they are uploaded and can also replicate existing objects if configured, providing a managed, low-latency replication solution that meets regulatory requirements.

Answer

Use AWS DataSync to copy files periodically.

Answer

Create an EventBridge rule to trigger a Lambda function for every upload.

Answer

Use AWS Storage Gateway to replicate local data to S3.

Question 17

A company has a legacy application that requires a persistent file system shared across multiple EC2 instances. The file system must be highly available and support standard file system protocols. Which solution is most appropriate?

Accepted Answer

Use Amazon EFS with mount targets in multiple Availability Zones.. Amazon EFS provides a fully managed, scalable, and highly available NFS file system that can be mounted simultaneously by multiple EC2 instances across multiple AZs. It is designed to be resilient, automatically replicating data across AZs within a region. This makes it the ideal choice for legacy applications that require shared storage without the management overhead of self-managed storage servers or distributed file systems.

Answer

Mount an Amazon EBS volume to multiple EC2 instances simultaneously.

Answer

Create an S3 bucket and use it as a mounted file system via S3FS.

Answer

Set up a self-managed NFS server on an EC2 instance.

Question 18

Refer to the exhibit. The current IAM policy allows an EC2 instance to read backups. The architect wants to ensure the data is recoverable if the source bucket is compromised by an external actor with write access. What should be done?

Accepted Answer

Enable S3 Object Lock on the bucket.. S3 Object Lock enforces a Write Once Read Many (WORM) model, preventing objects from being deleted or overwritten for a specified retention period — even by users with full administrative permissions. This directly addresses the scenario where an external actor with write access could otherwise overwrite or delete backups, ensuring the data remains recoverable. Object Lock requires versioning to be enabled on the bucket.

Answer

Apply a Bucket Policy to deny s3:PutObject for all users.

Answer

Create a read-only IAM user for the EC2 instance.

Answer

Enable S3 Server-Side Encryption (SSE-S3).

Question 19

An application processes data in bursts, running for 30 seconds every few minutes. The workload is unpredictable. Which compute service offers the most cost-effective solution?

Accepted Answer

AWS Lambda. AWS Lambda is a serverless compute service that bills based on the number of requests and the duration of execution in milliseconds. For short-lived, bursty, and unpredictable workloads, Lambda is more cost-effective than provisioning servers that would sit idle for the majority of the time between processing events.

Answer

Amazon EC2 with Auto Scaling

Answer

AWS Fargate

Answer

Amazon EC2 Spot Instances

Question 20

A company is hosting a sensitive web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The compliance team requires that all data at rest must be encrypted using keys that are rotated annually, and all access to these keys must be logged for auditing purposes. Which solution meets these requirements with the least administrative effort?

Accepted Answer

Encrypt the EC2 EBS volumes using AWS KMS with automatic key rotation enabled.. AWS KMS with automatic key rotation enabled on the EBS encryption key satisfies annual rotation, and KMS logs every key operation to CloudTrail for auditing. EBS encryption at rest is configured at the volume level using a KMS CMK, and enabling rotation is a single checkbox or API call — the least administrative effort. CloudHSM and third-party tools require manual rotation and more operational overhead.

Answer

Use AWS CloudHSM to manage encryption keys and manually rotate them every year.

Answer

Implement a third-party encryption tool on the EC2 instances and store keys in an S3 bucket.

Answer

Use Amazon S3 SSE-S3 to encrypt the EBS volumes and monitor access via VPC Flow Logs.