SAA-C03 Practice Test 5 — 25 Questions

Question 1

A company is designing a high-throughput, fault-tolerant payment processing system running on Amazon EC2 instances across multiple Availability Zones. The architecture must withstand the sudden failure of any single AZ without dropping active database transactions or corrupting state. Which TWO design practices should the solutions architect implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy an Amazon Aurora database cluster configured across multiple Availability Zones with an automatic failover replica.. Deploying the EC2 instances across an Auto Scaling group spanning multiple Availability Zones ensures compute capacity automatically rebalances during failures. Utilizing Amazon Aurora Multi-AZ deployments provides high availability and automatic failover for relational databases. Together, these practices protect both the compute and data tiers from localized outages.

Answer

Store application state files on a single Amazon EBS General Purpose SSD attached to the primary EC2 instance.

Answer

Configure an Amazon Route 53 latency-based routing policy to direct user traffic directly to EC2 instances in each zone.

Answer

Pin all payment processing worker threads to a single static EC2 instance to simplify debugging and transaction logging.

Question 2

An application requires a high-throughput, low-latency shared file system for a Linux-based HPC cluster. Which AWS service should be used?

Accepted Answer

Amazon FSx for Lustre.. Amazon FSx for Lustre is a fully managed, high-performance file system optimized for compute-intensive workloads like HPC, machine learning, and media processing. It provides sub-millisecond latencies, millions of IOPS, and hundreds of gigabytes per second of throughput, making it ideal for Linux-based HPC clusters that require a shared, POSIX-compliant file system. Unlike general-purpose file systems, Lustre is designed for parallel access from many compute nodes simultaneously, which is essential for HPC applications.

Answer

Amazon EFS.

Answer

Amazon EBS Provisioned IOPS.

Answer

Amazon S3 with S3 Select.

Question 3

Refer to the exhibit. A security administrator is reviewing a CloudTrail log entry for an 'Access Denied' error. The user 'Alice' is trying to upload a file to an S3 bucket. Alice has an IAM policy that allows 's3:PutObject' on all resources. What is the most likely cause of this error?

Accepted Answer

The S3 bucket has a bucket policy with an explicit Deny for Alice or the action.. In AWS, access is determined by the intersection of all applicable policies. Even if Alice has an IAM policy allowing the action, an 'Access Denied' error can occur if there is an explicit 'Deny' in a Service Control Policy (SCP), a bucket policy, or if there is a Permissions Boundary restricting her actions.

Answer

Alice is not using an encrypted connection (HTTPS) to upload the file.

Answer

The S3 bucket is located in a different region than the IAM user.

Answer

Alice's IAM user is missing the 's3:ListBucket' permission.

Question 4

A company has several AWS accounts and wants to take advantage of Savings Plans to reduce their overall compute spend. They have a mix of EC2 instances, AWS Lambda, and AWS Fargate across multiple regions. Which Savings Plan type will provide the most flexibility and cover all these services?

Accepted Answer

Compute Savings Plans. Compute Savings Plans offer the greatest flexibility, providing up to 66% savings compared to On-Demand prices. They apply automatically to EC2 instance usage regardless of instance family, size, AZ, region, OS, or tenancy, and uniquely, they also cover AWS Fargate and AWS Lambda, making them ideal for modern, heterogeneous architectures.

Answer

EC2 Instance Savings Plans

Answer

SageMaker Savings Plans

Answer

Regional Reserved Instances

Question 5

Refer to the exhibit. An administrator runs a script to identify underutilized EC2 instances. The output shows a production instance that has been running for 30 days. Which action would most effectively reduce costs while maintaining application stability?

Accepted Answer

Change the instance type to a smaller size in the same family, such as m5.large.. The instance is described as underutilized, meaning its CPU and memory usage are low. Changing the instance type to a smaller size in the same family (e.g., from m5.4xlarge to m5.large) reduces cost while maintaining the same architecture and compatibility, and the application should still perform adequately if it was underutilized. This is the most effective cost reduction without compromising stability.

Answer

Convert the instance to a Spot Instance to save up to 90%.

Answer

Switch the instance to a T3 instance type with Unlimited mode enabled.

Answer

Purchase a Compute Savings Plan for the current m5.4xlarge instance.

Question 6

A company is experiencing unauthorized network traffic in their VPC. They need to inspect traffic patterns between subnets to identify the source of the traffic. Which tool should they use?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture information about the IP traffic going to and from network interfaces in the VPC. By analyzing these logs, administrators can identify blocked connections, traffic spikes, or unusual destination patterns. This data is essential for security auditing, troubleshooting connectivity issues, and detecting potential malicious activity within the network perimeter, providing the visibility needed to strengthen security policies and Network ACLs.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS Trusted Advisor.

Question 7

A web application runs on Amazon EC2 instances managed by an Auto Scaling group across three Availability Zones behind an Application Load Balancer. The application performs heavy computations that consume high CPU resources. Users report intermittent 504 Gateway Timeouts during peak hours. The solutions architect notices that newly launched instances take several minutes to bootstrap before they can serve traffic. How should the architect resolve this issue?

Accepted Answer

Implement pre-baked Amazon Machine Images (AMIs) with application code pre-installed and configure an Auto Scaling health check grace period.. Pre-baked AMIs eliminate the lengthy bootstrap process by having the application code and dependencies already installed, so new instances can serve traffic almost immediately. Configuring an appropriate health check grace period ensures the ASG does not terminate instances prematurely during any remaining startup time, while allowing ELB health checks to replace truly unhealthy instances. This combination reduces the window where the ASG is scaling out but new instances are not yet ready, mitigating 504 errors.

Answer

Configure an Amazon SQS queue in front of the EC2 instances to offload computational tasks asynchronously.

Answer

Switch the load balancer from an Application Load Balancer to a Network Load Balancer for faster TCP packet routing.

Answer

Decrease the Auto Scaling group health check grace period to zero so failing instances are replaced immediately.

Question 8

A security team needs to identify and protect sensitive data, such as credit card numbers and passport IDs, that may be stored across hundreds of S3 buckets in multiple AWS accounts. Which service should they use to automate this discovery process?

Accepted Answer

Amazon Macie to scan S3 buckets for personally identifiable information (PII).. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in S3. It provides a centralized view of where sensitive data resides and how it is being accessed or moved, which is critical for compliance.

Answer

Amazon GuardDuty to monitor S3 data plane events for suspicious activity.

Answer

AWS Glue to crawl S3 buckets and catalog the data types found in the files.

Answer

Amazon Inspector to perform deep packet inspection on data uploaded to S3.

Question 9

A solutions architect is reviewing the architecture of a large VPC. Currently, thousands of EC2 instances in private subnets transfer several terabytes of data daily to Amazon S3 through a NAT Gateway. The NAT Gateway costs have become prohibitively high. Which TWO changes will reduce these costs?

Accepted Answer

Create a Gateway VPC Endpoint for Amazon S3.. NAT Gateways charge both an hourly rate and a per-GB data processing fee, which can become expensive for high-volume data transfers. S3 Gateway Endpoints are free and allow traffic to stay within the AWS network, bypassing the NAT Gateway entirely. This significantly reduces data processing costs for S3-bound traffic from private subnets.

Answer

Replace the NAT Gateway with a NAT Instance.

Answer

Move the EC2 instances to public subnets.

Answer

Increase the number of NAT Gateways across all Availability Zones.

Question 10

A video transcoding application runs on EC2 instances. The processing is highly CPU-intensive and can be interrupted if the job is resumed later. Which compute strategy offers the best cost-performance balance?

Accepted Answer

Use Spot Instances for the transcoding tasks.. Spot Instances provide up to a 90% discount over On-Demand pricing. Since the transcoding workload is fault-tolerant and capable of resuming work, it is a perfect candidate for Spot Instances. By using an Auto Scaling group with a mix of Spot and On-Demand instances, the application can achieve high performance at a fraction of the cost, utilizing cheaper capacity while maintaining a safety net of On-Demand instances.

Answer

Use Reserved Instances for the entire workload.

Answer

Use On-Demand instances for all processing tasks.

Answer

Use Dedicated Hosts for the transcoding tasks.

Question 11

A company is migrating a web application to AWS. The application relies on session state. Which approach is the most scalable and performant for managing sessions?

Accepted Answer

Use Amazon ElastiCache (Redis) to store session data.. Amazon ElastiCache for Redis is purpose-built for sub-millisecond, in-memory session storage, so any EC2 instance behind an Auto Scaling group or load balancer can read/write the same session state without shared-disk contention. This decouples session state from individual compute nodes, allowing horizontal scaling and eliminating the need for sticky routing. Redis also supports TTL-based expiration and optional replication/Multi-AZ for durability.

Answer

Store sessions in a local file on the web server.

Answer

Store sessions in a relational database like RDS.

Answer

Use sticky sessions on the Application Load Balancer.

Question 12

An application running on an Amazon EC2 instance needs to securely access data in an Amazon DynamoDB table. What is the most secure way to provide the application with the necessary permissions?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance profile.. IAM roles attached to an EC2 instance profile provide temporary, automatically rotated credentials to the instance via the Instance Metadata Service (IMDS). The application (or AWS SDK) retrieves these credentials without any hardcoded secrets, and permissions are managed centrally through IAM policies. This eliminates the risk of long-term credential leakage and follows AWS best practices for least privilege.

Answer

Store IAM user credentials in a configuration file on the EC2 instance.

Answer

Pass the Access Key and Secret Key as environment variables when starting the application.

Answer

Embed the credentials directly into the application source code.

Question 13

A financial services firm must store transaction logs in Amazon S3 for seven years to meet regulatory requirements. The logs must be protected against any modification or deletion by any user, including the root user, during this period. Which S3 feature should be implemented?

Accepted Answer

Enable S3 Object Lock in compliance mode with a retention period of seven years.. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting an object version for a specified retention period. This meets the requirement of protecting logs from modification or deletion for seven years. Compliance mode is the strictest mode and cannot be overridden, ensuring regulatory compliance.

Answer

Enable S3 Versioning on the bucket to keep a history of all changes made to the logs.

Answer

Use S3 Glacier Deep Archive as the storage class for the logs with a vault lock policy.

Answer

Configure AWS Backup to take daily snapshots of the S3 bucket and store them in a secure vault.

Question 14

A financial application stores data in Amazon Aurora. The architecture must survive a regional outage. Which TWO steps should the architect take to meet this requirement?

Accepted Answer

Create an Aurora Global Database with a secondary region.. Option B is correct because an Aurora Global Database replicates data to a secondary region with typical cross-region replication latency under one second, which is the AWS-recommended design for surviving a full regional outage. Option D is correct because, during a regional failure, the secondary region's Aurora cluster must be promoted (via the managed planned or unplanned failover) to become a standalone read/write primary, restoring write capability in the surviving region. Option A is not sufficient because Aurora Multi-AZ (Aurora Replicas across AZs) only protects against an Availability Zone failure within a single region, not a regional outage. Option C is wrong because RDS snapshots copied to an S3 bucket in the same region are also lost if that region fails, and daily snapshots give a poor RPO. Option E is irrelevant because Performance Insights is a monitoring/performance-tuning feature and provides no disaster-recovery capability.

Answer

Enable Aurora Multi-AZ deployment in the primary region.

Answer

Schedule daily Amazon RDS snapshots and copy them to an S3 bucket in the same region.

Answer

Enable Performance Insights on all Aurora instances.

Question 15

A company is using Amazon EBS volumes for their EC2 instances. The current volumes are General Purpose SSD (gp2). The company wants to reduce costs without losing performance, and in some cases, they need more control over IOPS without increasing storage size. Which TWO steps should they take?

Accepted Answer

Migrate from gp2 volumes to gp3 volumes.. Amazon EBS gp3 volumes offer a 20% lower price per GB than gp2 volumes. Additionally, gp3 allows you to provision IOPS and throughput independently of storage capacity. This means you no longer have to 'over-provision' disk space just to get higher performance, leading to significant cost savings for IO-intensive workloads.

Answer

Use Provisioned IOPS SSD (io2) for all volumes.

Answer

Convert the EBS volumes to Cold HDD (sc1).

Answer

Take frequent snapshots of gp2 volumes and delete the originals.

Question 16

Refer to the exhibit. A junior cloud financial analyst needs to monitor and optimize costs across the organization's AWS account. The analyst requires the ability to view historical cost data and check how effectively Reserved Instances and Savings Plans are being used. Which AWS service is the analyst most likely using with this IAM policy?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides historical cost and usage data, forecasting, and — critically — Reserved Instance (RI) and Savings Plans utilization and coverage reports. The IAM policy granting access to Cost Explorer APIs (ce:GetCostAndUsage, ce:GetReservationUtilization, ce:GetSavingsPlansUtilization) confirms this is the service in use.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Compute Optimizer

Question 17

A company is designing a global application. They need to replicate 1 TB of data monthly between two AWS Regions. What is the most cost-effective way to minimize data transfer costs?

Accepted Answer

Compress the data before transferring it between regions.. Compressing data before transferring it between regions reduces the volume of data transferred, thereby lowering data transfer costs. AWS charges for data transfer out from a region, so reducing the number of bytes transferred directly reduces costs. Compression is a simple and effective method to minimize data transfer costs for large datasets.

Answer

Use AWS Direct Connect to link the two regions together.

Answer

Use an Amazon CloudFront distribution to cache data between regions.

Answer

Deploy a VPC Peering connection between the two regions.

Question 18

Refer to the exhibit. A security audit identifies that data is being transmitted to an S3 bucket named 'corporate-data' without encryption in transit. Which behavior does this bucket policy enforce to address this concern?

Accepted Answer

It denies any S3 action if the request does not use an encrypted connection (HTTPS).. The bucket policy denies any S3 action if the request does not use an encrypted connection (HTTPS). This is enforced by a condition like aws:SecureTransport: false, which blocks HTTP requests. This directly addresses the concern of data in transit being unencrypted.

Answer

It ensures that all objects stored in the bucket are encrypted using AES-256 server-side encryption.

Answer

It logs all access attempts to the bucket to identify users who are not using SSL.

Answer

It automatically redirects all HTTP requests to HTTPS for the specified S3 bucket.

Question 19

An architect is designing a system that must be resilient against AWS regional failure. Which AWS service is best suited to manage global DNS traffic and provide health-based routing?

Accepted Answer

Amazon Route 53.. Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service. It provides health checks and routing policies, such as failover, latency-based, and geolocation routing. By using health checks, Route 53 can detect the failure of an endpoint in one region and automatically route traffic to a healthy endpoint in another, fulfilling the requirement for regional resilience.

Answer

Elastic Load Balancing (ELB).

Answer

AWS Direct Connect.

Answer

Amazon CloudFront.

Question 20

An application uses Amazon DynamoDB. To ensure the application remains resilient to regional outages, what is the best approach?

Accepted Answer

Use DynamoDB Global Tables.. DynamoDB Global Tables provide multi-region, active-active replication with automatic conflict resolution, ensuring the application can read and write to the table in any region and remain resilient to regional outages. This is the only option that offers automatic, low-latency replication across regions without manual intervention.

Answer

Enable DynamoDB backups in the same region.

Answer

Use AWS Database Migration Service to sync data.

Answer

Manually replicate data to another region every hour.