SAA-C03 Practice Test 3 — 25 Questions

Question 1

A research institution is running a High Performance Computing (HPC) workload on AWS that requires a POSIX-compliant file system capable of millions of IOPS and sub-millisecond latencies. Which TWO storage options are most appropriate for this use case?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon FSx for Lustre.. Amazon FSx for Lustre (A) is correct because it is a POSIX-compliant, high-performance file system purpose-built for HPC, delivering millions of IOPS and sub-millisecond latencies, and it integrates with S3 for data staging. EC2 Instance Store with a clustered file system (D) is correct because instance store volumes are physically attached NVMe SSDs offering the lowest latency and highest IOPS, and a clustered file system (e.g., Lustre, GPFS) can aggregate them across nodes for shared POSIX access. Amazon S3 with S3 Select (B) is object storage, not POSIX-compliant, and cannot meet sub-millisecond latency requirements. Amazon FSx for Windows File Server (C) uses SMB and is designed for Windows workloads, not high-IOPS POSIX HPC. Amazon EFS General Purpose mode (E) is POSIX-compliant but its latency and throughput are far below the millions of IOPS and sub-millisecond requirements of this workload.

Answer

Amazon S3 with S3 Select.

Answer

Amazon FSx for Windows File Server.

Answer

Amazon EFS in General Purpose mode.

Question 2

An application is deployed across two AWS Regions to ensure resilience. The architect needs to direct users to the healthy region with the lowest latency. If the primary region fails, traffic should fail over automatically. Which Route 53 routing policy should be implemented?

Accepted Answer

Latency routing policy with health checks.. Latency-based routing with health checks directs each user to the AWS Region that provides the lowest latency while the health check removes an unhealthy region's records from DNS responses, achieving automatic failover. This satisfies both requirements: lowest-latency selection under normal conditions and automatic redirection when the primary region fails.

Answer

Simple routing policy.

Answer

Failover routing policy.

Answer

Weighted routing policy.

Question 3

A company is using Amazon DynamoDB to store real-time session data. The application requires response times in the sub-millisecond range for frequently accessed keys. The current DynamoDB latency is around 10-15 milliseconds. What should the architect implement to meet the performance goal?

Accepted Answer

Implement Amazon DynamoDB Accelerator (DAX).. DynamoDB Accelerator (DAX) is an in-memory cache purpose-built for DynamoDB that delivers microsecond response times for eventually consistent reads — well within the sub-millisecond requirement. DAX sits in front of the table as a write-through cache, so frequently accessed keys are served from RAM rather than from DynamoDB's SSD-backed storage, eliminating the 10-15 ms round trip. It requires only a minor application change (swap the DynamoDB client for the DAX client) and is the standard AWS answer for 'sub-millisecond DynamoDB reads.'

Answer

Enable DynamoDB Streams and use Lambda to update ElastiCache.

Answer

Increase the Provisioned Read Capacity Units (RCUs) for the table.

Answer

Use Global Tables to replicate data closer to the application nodes.

Question 4

A company is building a zero-trust architecture for its internal microservices running on Amazon EKS. Which THREE steps should the solutions architect take to ensure secure, least-privilege communication between services? (Select THREE)

Accepted Answer

Assign IAM Roles to individual Kubernetes Service Accounts (IRSA).. Option A is correct because IAM Roles for Service Accounts (IRSA) lets each Kubernetes Service Account assume a distinct IAM role via the EKS OIDC provider, so individual microservices receive only the AWS permissions they need, which is a core least-privilege control in a zero-trust model. Option B is correct because AWS App Mesh enforces mutual TLS (mTLS) between microservices, providing cryptographic identity verification and encrypted service-to-service traffic so that no service is trusted merely by network location. Option C is correct because Security Groups for Pods (using the VPC CNI and ENI trunking) applies EC2 security group rules directly to pod ENIs, enabling fine-grained, least-privilege network segmentation between specific services. Option D is not appropriate because placing all microservices in a single public subnet exposes them to the internet and removes the network segmentation that zero-trust requires. Option E is not appropriate because disabling VPC Flow Logs reduces visibility and auditability of traffic, which is essential for detecting and investigating lateral movement in a zero-trust architecture.

Answer

Place all microservices in a single public subnet to simplify routing.

Answer

Disable VPC Flow Logs to reduce latency between microservices.

Question 5

An application consists of a web tier and an application tier. The web tier must be accessible from the internet, but the application tier must remain private. How should the architect configure the network for maximum resilience?

Accepted Answer

Deploy web and app tiers across multiple subnets in multiple AZs, with app tiers in private subnets.. For maximum resilience, the web and application tiers should be deployed across multiple subnets in multiple Availability Zones, with the web tier in public subnets (accessible from the internet) and the application tier in private subnets (not directly accessible). This design ensures high availability and fault tolerance, and follows the principle of least privilege by isolating the private tier.

Answer

Deploy all tiers in a single public subnet in one AZ.

Answer

Put everything in a public subnet and use Security Groups for isolation.

Answer

Use a single private subnet for both tiers and a NAT Gateway in the same subnet.

Question 6

An architect is designing a secure storage solution for highly sensitive financial data in S3. Which THREE security controls should be implemented? (Select THREE.)

Accepted Answer

Enable S3 Block Public Access at the account level.. Option A is correct because enabling S3 Block Public Access at the account level applies account-wide guardrails that override bucket policies and ACLs, preventing any bucket or object from being made public—an essential baseline for highly sensitive financial data. Option B is correct because AWS KMS with Customer Managed Keys (CMKs) gives the organization control over the key policy, rotation, and grants, providing encryption at rest with auditable key usage via CloudTrail, which is required for regulated financial data. Option C is correct because bucket policies using the aws:SecureTransport condition (e.g., "aws:SecureTransport": "false" with Deny) enforce HTTPS/TLS for all requests, preventing data in transit from being exposed over plain HTTP. Option D is incorrect because granting all users in the organization full access violates least privilege and would allow unauthorized or accidental modification or exfiltration of sensitive data. Option E is incorrect because storing data in a public bucket exposes it to the internet and directly contradicts the requirement for a secure storage solution.

Answer

Allow all users in the organization to have full access.

Answer

Store data in a public bucket for easier access.

Question 7

A security auditor requires that all EC2 instances must be running with specific software versions and that any instance not compliant with these versions must be automatically terminated. Which THREE services should be used to achieve this? (Select THREE.)

Accepted Answer

AWS Systems Manager Inventory.. Combining AWS Systems Manager for inventory and automation, AWS Config for continuous compliance monitoring, and Lambda for remediation provides a fully automated governance framework. This approach ensures that the environment is continuously scanned for drift, and non-compliant resources are immediately addressed without human intervention. This setup is crucial for meeting strict regulatory requirements where automated enforcement of security and operational standards is mandatory across a large-scale AWS environment.

Answer

AWS Trusted Advisor.

Answer

AWS CloudFront.

Question 8

A company is using AWS Direct Connect to connect their on-premises data center to AWS. What is the most resilient way to connect?

Accepted Answer

Use two Direct Connect connections in different locations.. To achieve high resiliency and maximum redundancy with AWS Direct Connect, a company should establish at least two Direct Connect connections in different AWS locations (or use AWS Direct Connect resiliency recommendations which include multiple connections across multiple locations). Option B provides geographical redundancy, eliminating single points of failure.

Answer

Use a single 10 Gbps Direct Connect connection.

Answer

Use a single VPN connection over the internet.

Answer

Configure the connection to use only the AWS public IP space.

Question 9

A company wants to implement a service that continuously monitors for malicious activity and unauthorized behavior across its AWS accounts, such as cryptocurrency mining or unusual API calls. Which AWS service should they use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It specifically detects findings like cryptocurrency mining, unusual API calls, and compromised instances, which matches the requirement exactly.

Answer

Amazon Macie

Answer

AWS Config

Answer

AWS CloudTrail

Question 10

Refer to the exhibit. An S3 bucket contains millions of small log files. The requirements state that data must be moved to a cheaper storage class after 30 days. The exhibit shows a lifecycle policy. Why might this configuration be sub-optimal for cost?

Accepted Answer

Monitoring fees for Intelligent-Tiering may outweigh savings for millions of small files.. S3 Intelligent-Tiering charges a per-object monitoring and automation fee (currently $0.0025 per 1,000 objects per month) on top of storage costs. With millions of small log files, this monitoring overhead can easily exceed the storage savings from automatic tier transitions, making it economically sub-optimal compared to a simple lifecycle transition rule to Standard-IA or Glacier.

Answer

Intelligent-Tiering is only supported for objects larger than 128 KB.

Answer

The lifecycle rule should use S3 Glacier Deep Archive instead of Intelligent-Tiering.

Answer

The prefix filter is too broad and will include active logs.

Question 11

A company is migrating a high-traffic web application to AWS. The application uses an Amazon RDS for MySQL database. The database experience high read pressure during business hours, but write activity remains consistent and low. Which TWO architectural changes will reduce costs while maintaining performance? (Select TWO.)

Accepted Answer

Create RDS Read Replicas and update the application to split read and write traffic.. Offloading read traffic to Read Replicas is more cost-effective than scaling up the primary instance size, as it allows for horizontal scaling of reads. Additionally, using Multi-AZ deployments for the primary instance ensures high availability, while Read Replicas can be placed in different regions or zones to distribute the load without over-provisioning the main database.

Answer

Scale up the primary RDS instance to a larger instance class with more RAM.

Answer

Switch the database to Amazon RDS for SQL Server to take advantage of License Inclusion.

Answer

Enable Multi-AZ for all Read Replicas to ensure high availability.

Question 12

An enterprise organization is planning a centralized logging architecture across hundreds of AWS accounts using AWS CloudTrail and Amazon S3. Security mandates state that all log files delivered to the centralized S3 bucket must be cryptographically verified to ensure they have not been modified or tampered with after delivery. Which TWO actions must a Solutions Architect implement to achieve this mandate? (Choose two.)

Accepted Answer

Enable CloudTrail log file integrity validation on each trail.. Option A is correct because CloudTrail log file integrity validation is the feature that produces a digest file for each delivered log file, containing a digital signature (SHA-256 hash signed with a private key) that allows detection of any modification, deletion, or tampering after delivery. Option E is correct because enabling validation alone only generates the digests; the architect must actually validate them by running AWS CLI commands such as 'aws cloudtrail validate-logs' (or SDK equivalents) against the S3 bucket to cryptographically confirm the log files match their digests. Option B is not correct because S3 Object Lock prevents deletion or overwrite of objects going forward but does not cryptographically prove that a delivered log file's contents are unmodified. Option C is not correct because KMS encryption with key rotation protects data confidentiality and key hygiene, not post-delivery tamper detection. Option D is not correct because S3 Versioning preserves prior object versions but does not itself verify the integrity or authenticity of log file contents.

Answer

Configure S3 Object Lock in compliance mode on the centralized logging bucket.

Answer

Use AWS KMS customer managed keys with automatic key rotation enabled for S3 bucket encryption.

Answer

Enable Amazon S3 Versioning on the centralized logging bucket to preserve previous object iterations.

Question 13

A media company stores millions of small image files in an Amazon S3 bucket. The application frequently requests these images, and the company is experiencing high latency during peak hours. The current architecture uses a single prefix for all objects. How should the architect modify the S3 structure to improve performance?

Accepted Answer

Implement a random or hashed prefix naming convention.. S3 automatically partitions request load by prefix, and a single prefix concentrates all GET requests on one partition, creating a hotspot. Introducing random or hashed prefixes (e.g., a hash of the object key as the first characters) spreads requests across many partitions, allowing S3 to scale request throughput and reduce latency during peak hours. This is the standard fix for high-request-rate workloads on small objects.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use S3 Intelligent-Tiering to move files to higher performance tiers.

Answer

Increase the size of the EC2 instances accessing the S3 bucket.

Question 14

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in the local memory of the EC2 instances. Users report losing their sessions when the Auto Scaling group scales in or replaces unhealthy instances. Which solution ensures session persistence while maintaining high availability?

Accepted Answer

Move the session state to an Amazon ElastiCache for Redis cluster.. Storing session state in ElastiCache for Redis externalizes it from the EC2 instances, so any instance in the Auto Scaling group can serve any user's request regardless of scale-in or instance replacement. Redis provides low-latency, highly available shared state with replication and Multi-AZ failover, ensuring session persistence and high availability simultaneously.

Answer

Configure the Application Load Balancer to use stickiness with a duration-based cookie.

Answer

Store the session state in an Amazon S3 bucket with versioning enabled.

Answer

Replicate the session data across all EC2 instances using a broadcast script.

Question 15

A solutions architect is designing a mission-critical web application that runs on Amazon EC2 instances behind an Application Load Balancer. The application must remain available even if an entire AWS Region experiences a catastrophic failure. The RPO must be near zero, and the RTO must be less than 15 minutes. Which disaster recovery strategy should the architect implement?

Accepted Answer

Configure a multi-site active-active deployment spanning two AWS Regions with continuous data replication and Route 53 health checks.. A multi-site active-active deployment spanning two AWS Regions with continuous data replication and Route 53 health checks provides near-zero RPO and sub-15-minute RTO by allowing both regions to serve traffic simultaneously. If one region fails, Route 53 automatically redirects traffic to the healthy region, ensuring continuous availability.

Answer

Implement a backup and restore strategy using automated daily Amazon EBS snapshots copied to a secondary AWS Region.

Answer

Deploy a pilot light strategy by maintaining a minimal footprint of core database and configuration services in a secondary Region.

Answer

Set up a warm standby architecture running a scaled-down version of the entire application stack in a secondary Region.

Question 16

A solutions architect is designing an application that stores user-uploaded images in Amazon S3. The images are accessed frequently for the first 30 days, then rarely accessed thereafter. Which storage class transition strategy is the most cost-effective?

Accepted Answer

Transition objects to S3 Standard-IA after 30 days.. S3 Standard-IA is the correct choice because the access pattern is well understood: objects are accessed frequently for exactly 30 days, then rarely. Standard-IA costs roughly 40% less than S3 Standard for storage while still providing millisecond retrieval, so a lifecycle rule transitioning objects at day 30 minimizes cost without sacrificing availability. Because the pattern is predictable, Intelligent-Tiering's per-object monitoring fee is unnecessary overhead.

Answer

Store all images in S3 Intelligent-Tiering from the start.

Answer

Transition objects to S3 Glacier Deep Archive after 30 days.

Answer

Manually move images to S3 One Zone-IA after 30 days.

Question 17

A company hosts a monolithic application on EC2. They want to move to a microservices architecture to improve fault isolation. Which approach is best?

Accepted Answer

Decompose the monolith into independent services using containers.. Decomposing the monolith into independent services running in containers gives each service its own lifecycle, scaling, and failure domain, which is exactly what improves fault isolation. Containers package each service with its dependencies and can be orchestrated by ECS or EKS for resilience.

Answer

Increase the size of the existing EC2 instances.

Answer

Use a load balancer to split traffic between two monolithic instances.

Answer

Move the entire application code to a single Lambda function.

Question 18

A company is migrating a legacy application to AWS. The application requires a relational database with very infrequent and unpredictable usage—sometimes it is not used for days, and then it sees a burst of activity for an hour. Which database configuration is most cost-effective?

Accepted Answer

Amazon Aurora Serverless.. Amazon Aurora Serverless is designed for workloads with intermittent, unpredictable, or infrequent usage. It automatically starts up, shuts down, and scales capacity based on application demand, so you only pay for the database capacity consumed during active periods. For an application that is idle for days and then bursts for an hour, this eliminates the cost of provisioning a always-on instance, making it the most cost-effective relational database configuration.

Answer

Amazon RDS for MySQL on a T3-medium instance.

Answer

Amazon Aurora with a Reserved Instance.

Answer

Amazon RDS with Multi-AZ enabled.

Question 19

A high-traffic application uses an Application Load Balancer (ALB) and an Auto Scaling group (ASG). During peak hours, some EC2 instances fail, but the ASG does not replace them immediately because the instances are still in a 'running' state despite the application being unresponsive. How should the architect fix this?

Accepted Answer

Change the ASG health check type from EC2 to ELB.. By default, an Auto Scaling group uses EC2 health checks, which only detect instance-level failures (e.g., stopped or terminated instances) and not application-level unresponsiveness. Changing the health check type to ELB makes the ASG rely on the load balancer's health checks, which actively probe the application on each instance; if an instance fails the ELB health check, the ASG marks it unhealthy and replaces it. This directly resolves the issue of running-but-unresponsive instances.

Answer

Increase the ASG health check grace period to 600 seconds.

Answer

Create a CloudWatch alarm for high CPU usage to trigger replacement.

Answer

Configure a Lambda function to manually terminate unresponsive instances.

Question 20

A financial services company needs to store millions of small records for 7 years to meet regulatory requirements. The records are rarely accessed after the first 30 days. The company wants to minimize storage costs while maintaining the ability to retrieve any record within a few minutes if an audit occurs. Which solution is best?

Accepted Answer

Amazon S3 Glacier Instant Retrieval.. S3 Glacier Instant Retrieval is designed for long-lived, rarely accessed data that still requires millisecond retrieval, making it ideal for regulatory archives where audits need quick access. It offers lower storage costs than S3 Standard-IA while maintaining instant retrieval, and it supports lifecycle transitions after 30 days. This matches the requirement to retrieve any record within a few minutes (instant retrieval is far faster) at minimal cost.

Answer

Amazon S3 Standard-IA.

Answer

Amazon S3 Glacier Flexible Retrieval.

Answer

Amazon S3 Glacier Deep Archive.