SAA-C03 Practice Test 4 — 25 Questions

Question 1

A web application stores static files in Amazon S3. Due to regulatory requirements, the company must ensure that the files are replicated to a secondary region. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 Cross-Region Replication on the source bucket.. S3 Cross-Region Replication (CRR) is the most efficient and native way to automatically replicate objects from a source bucket to a destination bucket in a different region. It replicates new objects as they are uploaded and can also replicate existing objects if configured, providing a managed, low-latency replication solution that meets regulatory requirements.

Answer

Use AWS DataSync to copy files periodically.

Answer

Create an EventBridge rule to trigger a Lambda function for every upload.

Answer

Use AWS Storage Gateway to replicate local data to S3.

Question 2

A company has a legacy application that requires a persistent file system shared across multiple EC2 instances. The file system must be highly available and support standard file system protocols. Which solution is most appropriate?

Accepted Answer

Use Amazon EFS with mount targets in multiple Availability Zones.. Amazon EFS provides a fully managed, scalable, and highly available NFS file system that can be mounted simultaneously by multiple EC2 instances across multiple AZs. It is designed to be resilient, automatically replicating data across AZs within a region. This makes it the ideal choice for legacy applications that require shared storage without the management overhead of self-managed storage servers or distributed file systems.

Answer

Mount an Amazon EBS volume to multiple EC2 instances simultaneously.

Answer

Create an S3 bucket and use it as a mounted file system via S3FS.

Answer

Set up a self-managed NFS server on an EC2 instance.

Question 3

Refer to the exhibit. The current IAM policy allows an EC2 instance to read backups. The architect wants to ensure the data is recoverable if the source bucket is compromised by an external actor with write access. What should be done?

Accepted Answer

Enable S3 Object Lock on the bucket.. S3 Object Lock enforces a Write Once Read Many (WORM) model, preventing objects from being deleted or overwritten for a specified retention period — even by users with full administrative permissions. This directly addresses the scenario where an external actor with write access could otherwise overwrite or delete backups, ensuring the data remains recoverable. Object Lock requires versioning to be enabled on the bucket.

Answer

Apply a Bucket Policy to deny s3:PutObject for all users.

Answer

Create a read-only IAM user for the EC2 instance.

Answer

Enable S3 Server-Side Encryption (SSE-S3).

Question 4

An application processes data in bursts, running for 30 seconds every few minutes. The workload is unpredictable. Which compute service offers the most cost-effective solution?

Accepted Answer

AWS Lambda. AWS Lambda is a serverless compute service that bills based on the number of requests and the duration of execution in milliseconds. For short-lived, bursty, and unpredictable workloads, Lambda is more cost-effective than provisioning servers that would sit idle for the majority of the time between processing events.

Answer

Amazon EC2 with Auto Scaling

Answer

AWS Fargate

Answer

Amazon EC2 Spot Instances

Question 5

A company is hosting a sensitive web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The compliance team requires that all data at rest must be encrypted using keys that are rotated annually, and all access to these keys must be logged for auditing purposes. Which solution meets these requirements with the least administrative effort?

Accepted Answer

Encrypt the EC2 EBS volumes using AWS KMS with automatic key rotation enabled.. AWS KMS with automatic key rotation enabled on the EBS encryption key satisfies annual rotation, and KMS logs every key operation to CloudTrail for auditing. EBS encryption at rest is configured at the volume level using a KMS CMK, and enabling rotation is a single checkbox or API call — the least administrative effort. CloudHSM and third-party tools require manual rotation and more operational overhead.

Answer

Use AWS CloudHSM to manage encryption keys and manually rotate them every year.

Answer

Implement a third-party encryption tool on the EC2 instances and store keys in an S3 bucket.

Answer

Use Amazon S3 SSE-S3 to encrypt the EBS volumes and monitor access via VPC Flow Logs.

Question 6

A solutions architect is designing a caching layer for a high-traffic web application that uses a multi-node cluster. The architect needs to ensure high availability and the ability to scale horizontally while supporting complex data types such as sorted sets and lists. Which TWO features of Amazon ElastiCache for Redis support these requirements?

Accepted Answer

Multi-AZ with automatic failover.. Option A (Multi-AZ with automatic failover) is correct because ElastiCache for Redis supports replication groups with a primary node and one or more read replicas across Availability Zones; if the primary fails, ElastiCache automatically promotes a replica, providing the high availability the multi-node cluster requires. Option C (Redis Cluster mode for horizontal scaling) is correct because cluster mode shards data across up to 500 shards (nodes), enabling horizontal scaling of both storage and throughput while still supporting complex Redis data structures such as sorted sets and lists. Option B is not correct because ElastiCache for Redis is fundamentally single-threaded for command execution (multi-threaded I/O exists in some versions, but it is not the feature that delivers HA or horizontal scaling here). Option D is not correct because ElastiCache does not provide automatic data compression at the cache level as a feature for this scenario. Option E is not correct because Redis communicates over TCP, not UDP, and UDP would not provide reliable low-latency writes.

Answer

Support for multi-threaded execution.

Answer

Automatic data compression at the cache level.

Answer

Use of UDP protocol for low-latency writes.

Question 7

An application is experiencing intermittent performance issues due to high IOPS demand. The application currently uses a standard General Purpose SSD (gp2) volume. Which action will provide the best performance improvement?

Accepted Answer

Change the volume type to Provisioned IOPS SSD (io1/io2).. Provisioned IOPS SSD (io1/io2) volumes are designed for I/O-intensive workloads and allow you to specify a consistent IOPS rate. They provide significantly higher IOPS than gp2 volumes and are the best choice for applications with high IOPS demand. This directly addresses the performance issue.

Answer

Change the volume type to gp3.

Answer

Increase the size of the gp2 volume.

Answer

Switch to Cold HDD (sc1) storage.

Question 8

A large enterprise uses AWS Organizations to manage multiple accounts. The Chief Information Security Officer (CISO) wants to ensure that no account within the organization can create any resources in regions other than 'us-east-1' and 'us-west-2'. What is the most efficient way to enforce this across the entire organization?

Accepted Answer

Apply a Service Control Policy (SCP) to the organization root that denies all actions if the region is not 'us-east-1' or 'us-west-2'.. SCPs are the only AWS Organizations mechanism that centrally enforce permission guardrails across every account in the OU/root, and they apply to all principals including the root user. A deny statement conditioned on aws:RequestedRegion outside us-east-1/us-west-2 blocks resource creation in unauthorized regions before the API call succeeds. Attaching it at the organization root propagates the restriction to every member account with a single policy, which is the most efficient approach.

Answer

Create an IAM Group in the management account with a region-restrictive policy and add all users to it.

Answer

Use AWS Config rules in each account to monitor resource creation and delete any resource found in unauthorized regions.

Answer

Configure a VPC Endpoint for all services and restrict access to specific regions using VPC Endpoint policies.

Question 9

A company's security team identifies that its public-facing web application is being targeted by SQL injection and cross-site scripting (XSS) attacks. The application is running on EC2 instances behind an Application Load Balancer (ALB). Which service should the solutions architect implement to protect the application from these specific web-based attacks?

Accepted Answer

AWS WAF. AWS WAF is purpose-built to inspect HTTP/HTTPS requests at Layer 7 and block application-layer exploits such as SQL injection and cross-site scripting. It integrates natively with ALB, CloudFront, and API Gateway, and provides managed rule groups (e.g., AWSManagedRulesSQLiRuleSet, AWSManagedRulesCommonRuleSet) that detect these exact attack patterns. Because the workload sits behind an ALB, WAF can be attached directly to the load balancer to filter malicious requests before they reach the EC2 instances.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 10

Refer to the exhibit. An application needs to store highly durable data in S3. The architect wants to ensure data is protected against accidental deletion while maintaining cost-effective storage. What should be done?

Accepted Answer

Enable S3 Versioning on the bucket and use Lifecycle policies to manage older versions.. S3 Versioning preserves every prior version of an object, so an accidental overwrite or delete does not destroy the underlying data — the previous version remains retrievable. Pairing Versioning with Lifecycle policies lets you transition or expire noncurrent versions after a set number of days, which controls the cost of retaining all those versions. Together they deliver durability against accidental deletion while keeping storage spend predictable.

Answer

Enable S3 Cross-Region Replication for all objects.

Answer

Modify the IAM policy to include s3:DeleteObject in the Deny statement.

Answer

Use S3 Intelligent-Tiering for all objects to reduce storage costs.

Question 11

A security architect is designing a multi-tier application in a VPC. The requirement is to block all traffic from a specific range of malicious IP addresses (CIDR 192.0.2.0/24) while allowing standard web traffic (HTTPS) from all other sources to the web tier. Which TWO actions should the architect take to implement this? (Select TWO.)

Accepted Answer

Create an inbound rule in the Network ACL to deny traffic from 192.0.2.0/24.. Option A is correct because Network ACLs are stateless, subnet-level firewalls that support explicit deny rules, so an inbound deny rule for 192.0.2.0/24 blocks that malicious CIDR before it can reach any resource in the subnet. Option D is correct because Security Groups are stateful, instance-level firewalls that only support allow rules, so permitting inbound TCP port 443 from 0.0.0.0/0 allows standard HTTPS web traffic from all other sources to the web tier. Together these satisfy both requirements: the NACL denies the malicious range while the Security Group allows HTTPS from everywhere else. Option B is wrong because Security Groups cannot contain deny rules; they are allow-only. Option C is wrong because AWS Shield Standard provides automatic protection against common DDoS attacks and does not let you block a specific CIDR like 192.0.2.0/24. Option E is wrong because route tables control routing, not inbound filtering, and blackholing a destination CIDR would not block inbound traffic from that source to the web tier.

Answer

Add a deny rule to the web tier Security Group for CIDR 192.0.2.0/24.

Answer

Configure AWS Shield Standard to automatically block the 192.0.2.0/24 subnet.

Answer

Update the VPC Route Table to blackhole all traffic destined for 192.0.2.0/24.

Question 12

A solutions architect is designing a mission-critical web application running on Amazon EC2 instances behind an Application Load Balancer. The application must remain highly available even during an Availability Zone outage. Which deployment strategy meets this requirement with optimal resilience?

Accepted Answer

Distribute EC2 instances across multiple Availability Zones within a single AWS Region using an Auto Scaling group.. Distributing EC2 instances across multiple Availability Zones within a single Region using an Auto Scaling group provides high availability against an AZ outage while maintaining low-latency intra-Region communication. If one AZ fails, the ASG can launch replacement instances in surviving AZs, and the ALB routes traffic only to healthy targets. This is the standard AWS-recommended HA pattern.

Answer

Deploy all EC2 instances in a single Availability Zone and configure an AWS Auto Scaling group with a maximum capacity of one.

Answer

Provision EC2 instances in multiple AWS Regions and use Route 53 with a latency routing policy.

Answer

Use a single EC2 instance of a larger size to handle peak traffic loads without scaling.

Question 13

Refer to the exhibit. A company has applied the following bucket policy to an S3 bucket named 'finance-reports'. A user is attempting to download a file from this bucket from the IP address 203.0.113.15 using an authenticated session without MFA. What will be the result of this request?

Accepted Answer

The request will be denied because both conditions must be true for the policy to grant access.. S3 bucket policy conditions are evaluated with AND logic by default — all conditions in a single Condition block must be true for the statement to apply. Since the request comes from an allowed IP but lacks MFA authentication, the Bool condition (aws:MultiFactorAuthPresent = true) fails, so the policy does not grant access and the request is denied.

Answer

The request will be allowed because the IP address is within the allowed range.

Answer

The request will be allowed because the 'Bool' condition is only evaluated if MFA is configured.

Answer

The request will be denied because S3 bucket policies require an explicit 'Deny' statement to block traffic.

Question 14

A company is concerned about unauthorized access and potential data exfiltration within their AWS environment. They need a service that can continuously monitor VPC Flow Logs, AWS CloudTrail management events, and DNS logs to identify suspicious activities using machine learning. Which solution should the architect recommend for centralized threat detection?

Accepted Answer

Enable Amazon GuardDuty and integrate it with AWS Organizations for cross-account visibility.. Amazon GuardDuty is a threat detection service that continuously monitors VPC Flow Logs, AWS CloudTrail management events, and DNS logs using machine learning and threat intelligence to identify suspicious activities. Integrating it with AWS Organizations enables centralized threat detection across all accounts, matching the requirement for cross-account visibility.

Answer

Configure AWS Inspector to perform network reachability assessments on all EC2 instances.

Answer

Deploy AWS Shield Advanced to protect all public-facing endpoints from DDoS attacks.

Answer

Use AWS Config to monitor changes in security group rules and VPC configurations.

Question 15

An organization needs to perform continuous security assessments of its Amazon EC2 instances to identify software vulnerabilities and unintended network exposure. Which service should they use to automate these assessments and provide a centralized view of the findings?

Accepted Answer

Amazon Inspector to automatically discover and scan EC2 instances for vulnerabilities.. Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. It is particularly effective for EC2 instances as it can scan both the operating system and the installed applications, providing detailed findings and remediation advice to improve the security posture.

Answer

AWS Trusted Advisor to check for security groups that allow unrestricted access.

Answer

AWS CloudTrail to monitor and log all API calls made to the EC2 instances.

Answer

VPC Flow Logs to analyze traffic patterns and identify potential security threats.

Question 16

A company has a high-performance database running on Amazon RDS for MySQL. The workload is read-heavy and experiences latency during peak hours. Which solution will improve read performance with minimal architectural changes?

Accepted Answer

Create one or more RDS Read Replicas and update the application connection string.. Creating an RDS Read Replica allows the application to offload read-only traffic from the primary database instance. By routing read queries to the replica, the primary instance can focus solely on write operations. This architecture is a standard practice for scaling read-heavy workloads in relational databases, ensuring lower latency and better resource utilization without requiring significant code modifications or complex database sharding.

Answer

Enable Multi-AZ deployment for the existing RDS instance.

Answer

Increase the instance size to a larger DB instance class.

Answer

Migrate the database to Amazon DynamoDB.

Question 17

An organization wants to identify and eliminate waste in their AWS account. They are specifically looking for idle resources that are still incurring charges. Which THREE AWS tools or features can help identify these cost-optimization opportunities?

Accepted Answer

AWS Trusted Advisor.. AWS Trusted Advisor (A) is correct because its Cost Optimization checks specifically flag idle or underutilized resources that still incur charges, such as unassociated Elastic IP addresses, idle load balancers, and underutilized Amazon EC2 instances. AWS Compute Optimizer (B) is correct because it analyzes CloudWatch metrics to generate recommendations for over-provisioned resources, including idle or underutilized EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions, directly surfacing cost-optimization opportunities. AWS Cost Explorer Rightsizing Recommendations (C) is correct because it uses historical utilization data to recommend resizing or terminating idle/underutilized EC2 instances, helping eliminate waste from over-provisioned compute. AWS CloudTrail (D) is not correct because it records API activity for auditing, security, and compliance, not for identifying idle resources or cost waste. Amazon Inspector (E) is not correct because it is a vulnerability management service that scans workloads for security exposures, not a cost-optimization or idle-resource detection tool.

Answer

AWS CloudTrail.

Answer

Amazon Inspector.

Question 18

An organization needs to improve the resilience of its EC2-based application. Which THREE actions should the architect perform? (Select THREE.)

Accepted Answer

Distribute EC2 instances across multiple Availability Zones.. Option A is correct because distributing EC2 instances across multiple Availability Zones ensures the application survives the failure of an entire AZ, since each AZ has independent power, cooling, and networking. Option B is correct because an Auto Scaling group continuously performs health checks and automatically replaces unhealthy instances, restoring capacity without manual intervention. Option D is correct because load balancer health checks detect unhealthy targets and stop routing traffic to them, so users are only sent to functioning instances. Option C is wrong because a single large instance is a single point of failure and does not improve resilience. Option E is wrong because a fixed-capacity Auto Scaling group cannot scale out to absorb load or compensate for lost capacity, so it does not meaningfully improve resilience.

Answer

Use a single large EC2 instance instead of multiple smaller ones.

Answer

Place all instances in a single Auto Scaling group with a fixed capacity.

Question 19

A company needs to store database credentials for an application running on Amazon ECS. The credentials must be encrypted and automatically rotated every 30 days without requiring an application restart. Which TWO AWS services should be used together to achieve this? (Select TWO)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (A) is correct because it is purpose-built to store and encrypt database credentials and natively supports automatic rotation on a schedule such as every 30 days, so the ECS application can retrieve the latest secret without a restart. AWS Lambda (B) is correct because Secrets Manager rotation is implemented by a Lambda rotation function that performs the four-step rotation (createSecret, setSecret, testSecret, finishSecret) against the database. AWS Systems Manager Parameter Store (C) can hold encrypted parameters but does not provide built-in automatic rotation, so it does not meet the 30-day rotation requirement. AWS Key Management Service (D) provides the encryption keys used by Secrets Manager but is not itself a secret store or rotation scheduler, so it is not one of the two services to use together. Amazon DynamoDB (E) is a NoSQL database service and has no role in storing or rotating application credentials.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

Amazon DynamoDB

Question 20

A company is designing a mission-critical database architecture using Amazon RDS. Which TWO steps should the architect take to ensure high availability and data durability? (Select TWO.)

Accepted Answer

Enable Multi-AZ deployment for the RDS instance.. Option A is correct because an RDS Multi-AZ deployment maintains a synchronous standby replica in a different Availability Zone, and RDS automatically fails over to that standby if the primary instance or its AZ fails, which directly provides high availability for a mission-critical database. Option C is correct because enabling automated backups with a defined retention period gives point-in-time recovery (PITR) to any second within the retention window (up to 35 days), which ensures data durability and recoverability from corruption or accidental deletion. Option B is not appropriate because a Read Replica in the same AZ is asynchronous, does not provide automatic failover, and would not survive an AZ-level outage. Option D is incorrect because gp2 is just one storage option and choosing it does not by itself deliver high availability or durability. Option E is incorrect because disabling deletion protection increases the risk of accidental data loss rather than protecting the database.

Answer

Configure a Read Replica in the same Availability Zone.

Answer

Set the storage type to General Purpose SSD (gp2) only.

Answer

Disable the deletion protection feature for all instances.