SAA-C03 Practice Test 2 — 25 Questions

Question 1

A company needs a Disaster Recovery (DR) strategy with an RTO of 30 minutes and an RPO of 15 minutes. They want to minimize costs while having a scaled-down version of their core environment always running in a second region. Which DR strategy should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Warm Standby.. A Warm Standby DR strategy involves running a functional but scaled-down version of the application in a separate region. This allows for a very low Recovery Time Objective (RTO) because the core infrastructure is already live. Data is replicated frequently to meet the Recovery Point Objective (RPO) of 15 minutes, providing a balance between cost and speed.

Answer

Backup and Restore.

Answer

Pilot Light.

Answer

Multi-site Active-Active.

Question 2

A developer is using an EC2 instance to process images. The images are stored in an S3 bucket. The developer notices that the network transfer between S3 and the EC2 instance is the bottleneck. How can the developer resolve this?

Accepted Answer

Use an Amazon S3 Gateway Endpoint.. An Amazon S3 Gateway Endpoint allows EC2 instances in a VPC to access S3 without traversing the public internet or a NAT gateway. Traffic stays within the AWS network, which can reduce latency and improve throughput, resolving the network bottleneck. It also eliminates data transfer costs associated with NAT gateways.

Answer

Increase the EC2 instance size.

Answer

Enable S3 Transfer Acceleration.

Answer

Use CloudFront to cache the images.

Question 3

Refer to the exhibit. The web application is showing high latency and 503 errors. The database CPU usage is low. What is the most likely cause and solution?

Accepted Answer

Implement Amazon RDS Proxy for connection pooling.. The symptoms — high latency, 503 errors, low database CPU — point to connection exhaustion rather than compute saturation. Each application instance opening its own database connections can exhaust the RDS max_connections limit, causing new connections to be refused and 503s to surface at the web tier. Amazon RDS Proxy pools and multiplexes connections, allowing many application connections to share a smaller set of database connections, which resolves the bottleneck without scaling the database.

Answer

Increase the RDS instance size to handle more connections.

Answer

Enable Multi-AZ failover to distribute the load.

Answer

Add more read replicas to the RDS cluster.

Question 4

A company wants to ensure that no developer can create an Amazon S3 bucket in any AWS region except for us-east-1 and us-west-2 across their entire AWS Organization. Which solution provides the most efficient and centralized way to enforce this across all member accounts?

Accepted Answer

Attach a Service Control Policy (SCP) to the organization root that denies s3:CreateBucket if the region is not us-east-1 or us-west-2.. A Service Control Policy (SCP) attached to the organization root applies to all member accounts and can deny s3:CreateBucket when the requested region is not us-east-1 or us-west-2. SCPs are the centralized, efficient way to enforce guardrails across an AWS Organization, affecting all principals without per-account changes.

Answer

Apply an IAM policy to every developer user in each account that denies s3:CreateBucket in restricted regions.

Answer

Configure an S3 bucket policy on all existing buckets to prevent the creation of new buckets in other regions.

Answer

Enable AWS Config in all accounts and create a custom rule to delete any bucket created in a restricted region.

Question 5

An application has been migrated to AWS, but the performance is inconsistent. The architect finds that the application uses a legacy database driver that requires persistent connections, which is exhausting database connections. What is the best way to handle this?

Accepted Answer

Use Amazon RDS Proxy.. Amazon RDS Proxy sits between the application and the database, pooling and reusing persistent connections so that many application connections map to a small number of database connections. This directly addresses the legacy driver's persistent-connection behavior that is exhausting the database's connection limit, without requiring application changes.

Answer

Increase the max_connections parameter.

Answer

Implement a local database connection pooler.

Answer

Migrate to Amazon Aurora Serverless.

Question 6

A company hosts a web application on EC2 instances behind an Application Load Balancer (ALB). The application has spikes in traffic. What should be configured to ensure performance and cost efficiency?

Accepted Answer

Implement Auto Scaling with target tracking policies.. Target tracking scaling policies automatically adjust the number of EC2 instances based on a specified metric (e.g., average CPU utilization or request count per target), maintaining performance during spikes while scaling in during low demand to optimize cost. This is the most efficient and responsive approach for variable workloads behind an ALB.

Answer

Use a fixed size Auto Scaling group at maximum capacity.

Answer

Configure the ALB to handle all scaling automatically.

Answer

Use reserved instances to handle all peak traffic.

Question 7

Refer to the exhibit. A solutions architect reviewed an AWS CloudFormation template used to deploy an Auto Scaling group for a production web application. During an AWS Availability Zone outage in us-east-1, users experienced partial application downtime even though the Auto Scaling group reported instances running. Why is this architecture failing resiliency best practices?

Accepted Answer

The Auto Scaling group defines Availability Zones directly instead of referencing subnets across multiple zones.. For an Auto Scaling group to survive an Availability Zone outage, it must launch instances across multiple subnets in different AZs. When the ASG specifies Availability Zones directly (or uses a single subnet), all instances land in one AZ, so an AZ failure takes down the entire fleet even though the ASG still reports 'running' instances in the failed zone. Referencing subnets across multiple AZs lets the ASG rebalance and launch replacements in healthy zones.

Answer

The Launch Template version is hardcoded to version 1 instead of using $Latest or $Default.

Answer

The MinSize and DesiredCapacity are set too low to handle sudden spikes in traffic during an outage.

Answer

The Auto Scaling group is missing a health check type configuration set to ELB instead of EC2.

Question 8

A company wants to improve the security of its Amazon RDS for PostgreSQL database. They want to eliminate the need for storing database passwords in application code and simplify the management of database access for their EC2-based applications. Which solution should they implement?

Accepted Answer

Configure the RDS instance to use IAM Database Authentication and assign a role to the EC2 instances.. IAM Database Authentication for RDS for PostgreSQL lets EC2 instances (or other AWS principals) authenticate to the database using short-lived authentication tokens generated from their IAM role credentials, so no static database password is ever stored in application code. The EC2 instance assumes an IAM role, and the RDS instance is configured to allow IAM authentication; the application then calls generate-db-auth-token (or the SDK equivalent) to obtain a 15-minute token used as the password. This eliminates password storage and centralizes access management through IAM policies, satisfying both the security and simplification goals.

Answer

Use AWS Secrets Manager to store the RDS credentials and retrieve them at runtime.

Answer

Enable SSL/TLS encryption for all database connections to protect the password in transit.

Answer

Store the database password in a private S3 bucket and allow the EC2 instances to read the file.

Question 9

A company has a multi-region application and wants to provide users with a single entry point that automatically routes traffic to the closest healthy endpoint. The solution must support non-HTTP protocols and provide static IP addresses. Which service should be used?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to improve the availability and performance of applications. It provides static IP addresses that act as a fixed entry point and can route traffic to endpoints in multiple regions using any TCP or UDP protocol, ensuring optimal performance.

Answer

Amazon CloudFront

Answer

Application Load Balancer (ALB)

Answer

Amazon Route 53 with Multivalue Answer routing.

Question 10

A media streaming company stores high-value video assets in an Amazon S3 bucket. The company requires a resilient storage architecture that protects against accidental deletion, malicious overwrites, and zonal or regional outages. Which combinations of features should a Solutions Architect implement to achieve these requirements? (Choose TWO.)

Accepted Answer

Enable S3 Versioning on the bucket and configure MFA Delete to prevent accidental or malicious deletion of object versions.. Enabling S3 Versioning ensures that previous versions are retained when objects are deleted or overwritten, protecting against accidental data loss. Furthermore, replicating objects to another AWS Region using S3 Cross-Region Replication guarantees durability and availability against catastrophic regional disruptions, satisfying robust disaster recovery best practices for critical media assets.

Answer

Configure Amazon S3 Intelligent-Tiering to automatically move infrequently accessed video assets to lower-cost storage tiers.

Answer

Attach a resource-based bucket policy that explicitly denies all delete object requests from any IAM user except the root account.

Answer

Enable S3 Object Lock in governance mode with a fixed retention period of 30 days for all uploaded video files.

Question 11

A financial services company is hosting a critical web application on Amazon EC2 instances behind an Application Load Balancer. The application must remain available even if an entire AWS Region experiences a major outage. The database tier uses Amazon Aurora Global Databases. Which solution provides the most resilient multi-Region architecture with automated failover?

Accepted Answer

Deploy the application stack across two AWS Regions, use Amazon Route 53 with active-passive failover and automated health checks, and configure Amazon Aurora Global Databases with cross-region replication.. Deploying Route 53 with active-passive failover and automated health checks combined with a secondary Region ensures automatic traffic rerouting during a regional disaster. Aurora Global Databases minimize replication lag and permit fast promotion of the secondary region database, maintaining data consistency and business continuity for critical financial applications requiring minimal recovery time objectives.

Answer

Configure an Application Load Balancer in a single Region with EC2 instances distributed across multiple Availability Zones, and back the application with a standard Aurora MySQL database instance.

Answer

Use Amazon Route 53 with weighted routing policies to distribute traffic between two AWS Regions, and configure standard cross-region database replication using Amazon RDS snapshots taken every hour.

Answer

Set up an AWS Global Accelerator standard accelerator with endpoint groups in two AWS Regions, and use Amazon DynamoDB global tables with local secondary indexes for data storage.

Question 12

An organization needs to issue and manage SSL/TLS certificates for its internal microservices, which are not accessible from the public internet. They want to avoid the overhead of managing their own PKI infrastructure. Which service should they use?

Accepted Answer

AWS Certificate Manager (ACM) Private Certificate Authority (PCA).. AWS Certificate Manager (ACM) Private Certificate Authority (PCA) is a managed private CA service that helps you easily and securely manage the lifecycle of your private certificates. It eliminates the need for organizations to maintain their own complex and costly internal PKI while still providing the security of private certificates.

Answer

AWS Certificate Manager (ACM) to request public certificates for the services.

Answer

AWS CloudHSM to store and manage the private keys for the certificates.

Answer

Amazon Inspector to audit the certificates used by the microservices.

Question 13

A company is launching a high-profile marketing campaign and expects a significant increase in traffic. They are concerned about potential Distributed Denial of Service (DDoS) attacks targeting their Application Load Balancer. Which AWS service provides advanced protection and includes 24/7 access to the AWS Shield Response Team (SRT)?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides expanded DDoS protection for web applications. Unlike the free Standard tier, it includes additional mitigation capabilities, 24/7 access to the Shield Response Team, and financial protection against bill spikes caused by DDoS attacks, making it ideal for high-profile applications.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

AWS Global Accelerator

Question 14

A healthcare company must store patient records in Amazon S3 for a minimum of 7 years to meet regulatory requirements. During this period, the records must not be deleted or modified by any user, including the root user. Which S3 feature should be used to enforce this?

Accepted Answer

S3 Object Lock in Compliance mode. S3 Object Lock provides Write-Once-Read-Many (WORM) protection. When configured in Compliance mode, an object version cannot be deleted or overwritten by any user, including the root user, for the duration of the retention period. This is the only way to satisfy strict regulatory requirements for data immutability.

Answer

S3 Versioning with MFA Delete

Answer

S3 Object Lock in Governance mode

Answer

S3 Lifecycle policy with an expiration of 7 years

Question 15

Refer to the exhibit. An IAM policy is applied to an IAM user to grant access to an S3 bucket. However, the user is still receiving an 'Access Denied' error when attempting to list the objects in the bucket. What is the cause of this error?

Accepted Answer

The policy is missing the s3:ListBucket permission.. The provided policy grants the 's3:GetObject' permission, which allows the user to read specific objects within the bucket, but it does not grant 's3:ListBucket'. The ListBucket permission is required to view the contents of the bucket. Since the user lacks this permission, the operation fails with an Access Denied error despite having access to individual objects. This is a common permissions oversight in IAM policy management.

Answer

The user does not have an IAM role attached.

Answer

The bucket policy is explicitly denying access.

Answer

The S3 bucket is encrypted with a KMS key.

Question 16

An AWS Lambda function processing data from an S3 bucket is experiencing performance issues due to 'cold starts' during sudden bursts of traffic. The company needs to ensure that the function responds with consistent low latency at all times. Which feature should be configured?

Accepted Answer

Enable Provisioned Concurrency for the function.. Provisioned Concurrency is the recommended solution for reducing cold start latency in AWS Lambda. It keeps a specified number of execution environments initialized and ready to respond immediately to incoming requests. This is critical for high-performance applications where unpredictable spikes in traffic could otherwise lead to unacceptable delays.

Answer

Increase the Lambda function's memory allocation.

Answer

Use an Amazon SQS queue to buffer requests to Lambda.

Answer

Deploy the Lambda function in multiple Availability Zones.

Question 17

An application requires extremely high I/O performance for temporary data processing that can be lost if the instance fails. The architect is considering using EC2 Instance Store. Which TWO statements correctly describe the performance and characteristics of Instance Store volumes?

Accepted Answer

Instance store provides higher I/O performance compared to EBS.. EC2 Instance Store provides high-performance, local block-level storage that is physically attached to the host computer. This makes it ideal for temporary storage of information that changes frequently, such as buffers, caches, and scratch space. Architects must account for its ephemeral nature while leveraging its superior I/O capabilities for high-performance workloads.

Answer

Data is preserved when the instance is stopped and started.

Answer

Volumes can be detached and reattached to different instances.

Answer

Storage capacity can be increased without stopping the instance.

Question 18

A company is migrating a high-performance database to Amazon RDS for MySQL. The workload involves intensive read operations, causing significant latency during peak traffic. Which solution provides the most effective performance improvement with minimal architectural changes?

Accepted Answer

Create one or more RDS Read Replicas.. Amazon RDS Read Replicas are designed specifically for read-heavy workloads. By offloading SELECT queries to one or more replicas, the primary instance can focus solely on write operations. This architecture improves throughput and reduces latency without requiring application-level logic changes beyond updating the database connection string. This approach is standard for scaling RDS instances horizontally to meet fluctuating demand while maintaining data consistency.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Upgrade the RDS instance to a larger instance class.

Answer

Move the database to Amazon DynamoDB.

Question 19

A data analysis team needs to perform complex SQL queries on petabytes of data stored in S3. Which service provides the best performance for this analytical workload?

Accepted Answer

Amazon Redshift Spectrum.. Amazon Athena is a serverless, interactive query service that makes it easy to analyze data in S3 using standard SQL. For large analytical workloads, Amazon Redshift Spectrum allows you to query data directly from S3, providing even higher performance for petabyte-scale data by leveraging the Redshift massively parallel processing engine, which is optimized for complex join and aggregation operations across massive datasets.

Answer

Amazon RDS.

Answer

Amazon DynamoDB.

Answer

AWS Glue.

Question 20

A company is running an Amazon RDS for MySQL database that experiences predictable, steady traffic during business hours and very low traffic at night. They want to reduce costs without compromising performance. Which TWO steps should the architect take? (Select TWO.)

Accepted Answer

Purchase Reserved Instances for the RDS DB instances.. Reserved Instances provide significant discounts for steady-state workloads with a long-term commitment. For the variable nature of the workload, migrating to Aurora Serverless v2 allows the database to scale capacity up and down automatically based on demand, ensuring they only pay for the resources consumed during high and low traffic periods.

Answer

Use Multi-AZ deployments for all read-only workloads.

Answer

Switch to an Amazon RDS Custom for MySQL instance.

Answer

Enable Provisioned IOPS (PIOPS) for all storage volumes.