SAA-C03 Practice Test 2 — 30 Questions

Question 1

A company hosts a web application on EC2 instances behind an Application Load Balancer (ALB). The application has spikes in traffic. What should be configured to ensure performance and cost efficiency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement Auto Scaling with target tracking policies.. Target tracking scaling policies automatically adjust the number of EC2 instances based on a specified metric (e.g., average CPU utilization or request count per target), maintaining performance during spikes while scaling in during low demand to optimize cost. This is the most efficient and responsive approach for variable workloads behind an ALB.

Answer

Use a fixed size Auto Scaling group at maximum capacity.

Answer

Configure the ALB to handle all scaling automatically.

Answer

Use reserved instances to handle all peak traffic.

Question 2

Refer to the exhibit. A solutions architect reviewed an AWS CloudFormation template used to deploy an Auto Scaling group for a production web application. During an AWS Availability Zone outage in us-east-1, users experienced partial application downtime even though the Auto Scaling group reported instances running. Why is this architecture failing resiliency best practices?

Accepted Answer

The Auto Scaling group defines Availability Zones directly instead of referencing subnets across multiple zones.. For an Auto Scaling group to survive an Availability Zone outage, it must launch instances across multiple subnets in different AZs. When the ASG specifies Availability Zones directly (or uses a single subnet), all instances land in one AZ, so an AZ failure takes down the entire fleet even though the ASG still reports 'running' instances in the failed zone. Referencing subnets across multiple AZs lets the ASG rebalance and launch replacements in healthy zones.

Answer

The Launch Template version is hardcoded to version 1 instead of using $Latest or $Default.

Answer

The MinSize and DesiredCapacity are set too low to handle sudden spikes in traffic during an outage.

Answer

The Auto Scaling group is missing a health check type configuration set to ELB instead of EC2.

Question 3

A company wants to improve the security of its Amazon RDS for PostgreSQL database. They want to eliminate the need for storing database passwords in application code and simplify the management of database access for their EC2-based applications. Which solution should they implement?

Accepted Answer

Configure the RDS instance to use IAM Database Authentication and assign a role to the EC2 instances.. IAM Database Authentication for RDS for PostgreSQL lets EC2 instances (or other AWS principals) authenticate to the database using short-lived authentication tokens generated from their IAM role credentials, so no static database password is ever stored in application code. The EC2 instance assumes an IAM role, and the RDS instance is configured to allow IAM authentication; the application then calls generate-db-auth-token (or the SDK equivalent) to obtain a 15-minute token used as the password. This eliminates password storage and centralizes access management through IAM policies, satisfying both the security and simplification goals.

Answer

Use AWS Secrets Manager to store the RDS credentials and retrieve them at runtime.

Answer

Enable SSL/TLS encryption for all database connections to protect the password in transit.

Answer

Store the database password in a private S3 bucket and allow the EC2 instances to read the file.

Question 4

A company has a multi-region application and wants to provide users with a single entry point that automatically routes traffic to the closest healthy endpoint. The solution must support non-HTTP protocols and provide static IP addresses. Which service should be used?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to improve the availability and performance of applications. It provides static IP addresses that act as a fixed entry point and can route traffic to endpoints in multiple regions using any TCP or UDP protocol, ensuring optimal performance.

Answer

Amazon CloudFront

Answer

Application Load Balancer (ALB)

Answer

Amazon Route 53 with Multivalue Answer routing.

Question 5

A media streaming company stores high-value video assets in an Amazon S3 bucket. The company requires a resilient storage architecture that protects against accidental deletion, malicious overwrites, and zonal or regional outages. Which combinations of features should a Solutions Architect implement to achieve these requirements? (Choose TWO.)

Accepted Answer

Enable S3 Versioning on the bucket and configure MFA Delete to prevent accidental or malicious deletion of object versions.. Enabling S3 Versioning ensures that previous versions are retained when objects are deleted or overwritten, protecting against accidental data loss. Furthermore, replicating objects to another AWS Region using S3 Cross-Region Replication guarantees durability and availability against catastrophic regional disruptions, satisfying robust disaster recovery best practices for critical media assets.

Answer

Configure Amazon S3 Intelligent-Tiering to automatically move infrequently accessed video assets to lower-cost storage tiers.

Answer

Attach a resource-based bucket policy that explicitly denies all delete object requests from any IAM user except the root account.

Answer

Enable S3 Object Lock in governance mode with a fixed retention period of 30 days for all uploaded video files.

Question 6

A financial services company is hosting a critical web application on Amazon EC2 instances behind an Application Load Balancer. The application must remain available even if an entire AWS Region experiences a major outage. The database tier uses Amazon Aurora Global Databases. Which solution provides the most resilient multi-Region architecture with automated failover?

Accepted Answer

Deploy the application stack across two AWS Regions, use Amazon Route 53 with active-passive failover and automated health checks, and configure Amazon Aurora Global Databases with cross-region replication.. Deploying Route 53 with active-passive failover and automated health checks combined with a secondary Region ensures automatic traffic rerouting during a regional disaster. Aurora Global Databases minimize replication lag and permit fast promotion of the secondary region database, maintaining data consistency and business continuity for critical financial applications requiring minimal recovery time objectives.

Answer

Configure an Application Load Balancer in a single Region with EC2 instances distributed across multiple Availability Zones, and back the application with a standard Aurora MySQL database instance.

Answer

Use Amazon Route 53 with weighted routing policies to distribute traffic between two AWS Regions, and configure standard cross-region database replication using Amazon RDS snapshots taken every hour.

Answer

Set up an AWS Global Accelerator standard accelerator with endpoint groups in two AWS Regions, and use Amazon DynamoDB global tables with local secondary indexes for data storage.

Question 7

An organization needs to issue and manage SSL/TLS certificates for its internal microservices, which are not accessible from the public internet. They want to avoid the overhead of managing their own PKI infrastructure. Which service should they use?

Accepted Answer

AWS Certificate Manager (ACM) Private Certificate Authority (PCA).. AWS Certificate Manager (ACM) Private Certificate Authority (PCA) is a managed private CA service that helps you easily and securely manage the lifecycle of your private certificates. It eliminates the need for organizations to maintain their own complex and costly internal PKI while still providing the security of private certificates.

Answer

AWS Certificate Manager (ACM) to request public certificates for the services.

Answer

AWS CloudHSM to store and manage the private keys for the certificates.

Answer

Amazon Inspector to audit the certificates used by the microservices.

Question 8

A company is launching a high-profile marketing campaign and expects a significant increase in traffic. They are concerned about potential Distributed Denial of Service (DDoS) attacks targeting their Application Load Balancer. Which AWS service provides advanced protection and includes 24/7 access to the AWS Shield Response Team (SRT)?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides expanded DDoS protection for web applications. Unlike the free Standard tier, it includes additional mitigation capabilities, 24/7 access to the Shield Response Team, and financial protection against bill spikes caused by DDoS attacks, making it ideal for high-profile applications.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

AWS Global Accelerator

Question 9

A healthcare company must store patient records in Amazon S3 for a minimum of 7 years to meet regulatory requirements. During this period, the records must not be deleted or modified by any user, including the root user. Which S3 feature should be used to enforce this?

Accepted Answer

S3 Object Lock in Compliance mode. S3 Object Lock provides Write-Once-Read-Many (WORM) protection. When configured in Compliance mode, an object version cannot be deleted or overwritten by any user, including the root user, for the duration of the retention period. This is the only way to satisfy strict regulatory requirements for data immutability.

Answer

S3 Versioning with MFA Delete

Answer

S3 Object Lock in Governance mode

Answer

S3 Lifecycle policy with an expiration of 7 years

Question 10

Refer to the exhibit. An IAM policy is applied to an IAM user to grant access to an S3 bucket. However, the user is still receiving an 'Access Denied' error when attempting to list the objects in the bucket. What is the cause of this error?

Accepted Answer

The policy is missing the s3:ListBucket permission.. The provided policy grants the 's3:GetObject' permission, which allows the user to read specific objects within the bucket, but it does not grant 's3:ListBucket'. The ListBucket permission is required to view the contents of the bucket. Since the user lacks this permission, the operation fails with an Access Denied error despite having access to individual objects. This is a common permissions oversight in IAM policy management.

Answer

The user does not have an IAM role attached.

Answer

The bucket policy is explicitly denying access.

Answer

The S3 bucket is encrypted with a KMS key.

Question 11

An AWS Lambda function processing data from an S3 bucket is experiencing performance issues due to 'cold starts' during sudden bursts of traffic. The company needs to ensure that the function responds with consistent low latency at all times. Which feature should be configured?

Accepted Answer

Enable Provisioned Concurrency for the function.. Provisioned Concurrency is the recommended solution for reducing cold start latency in AWS Lambda. It keeps a specified number of execution environments initialized and ready to respond immediately to incoming requests. This is critical for high-performance applications where unpredictable spikes in traffic could otherwise lead to unacceptable delays.

Answer

Increase the Lambda function's memory allocation.

Answer

Use an Amazon SQS queue to buffer requests to Lambda.

Answer

Deploy the Lambda function in multiple Availability Zones.

Question 12

An application requires extremely high I/O performance for temporary data processing that can be lost if the instance fails. The architect is considering using EC2 Instance Store. Which TWO statements correctly describe the performance and characteristics of Instance Store volumes?

Accepted Answer

Instance store provides higher I/O performance compared to EBS.. EC2 Instance Store provides high-performance, local block-level storage that is physically attached to the host computer. This makes it ideal for temporary storage of information that changes frequently, such as buffers, caches, and scratch space. Architects must account for its ephemeral nature while leveraging its superior I/O capabilities for high-performance workloads.

Answer

Data is preserved when the instance is stopped and started.

Answer

Volumes can be detached and reattached to different instances.

Answer

Storage capacity can be increased without stopping the instance.

Question 13

A company is migrating a high-performance database to Amazon RDS for MySQL. The workload involves intensive read operations, causing significant latency during peak traffic. Which solution provides the most effective performance improvement with minimal architectural changes?

Accepted Answer

Create one or more RDS Read Replicas.. Amazon RDS Read Replicas are designed specifically for read-heavy workloads. By offloading SELECT queries to one or more replicas, the primary instance can focus solely on write operations. This architecture improves throughput and reduces latency without requiring application-level logic changes beyond updating the database connection string. This approach is standard for scaling RDS instances horizontally to meet fluctuating demand while maintaining data consistency.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Upgrade the RDS instance to a larger instance class.

Answer

Move the database to Amazon DynamoDB.

Question 14

A data analysis team needs to perform complex SQL queries on petabytes of data stored in S3. Which service provides the best performance for this analytical workload?

Accepted Answer

Amazon Redshift Spectrum.. Amazon Athena is a serverless, interactive query service that makes it easy to analyze data in S3 using standard SQL. For large analytical workloads, Amazon Redshift Spectrum allows you to query data directly from S3, providing even higher performance for petabyte-scale data by leveraging the Redshift massively parallel processing engine, which is optimized for complex join and aggregation operations across massive datasets.

Answer

Amazon RDS.

Answer

Amazon DynamoDB.

Answer

AWS Glue.

Question 15

A company is running an Amazon RDS for MySQL database that experiences predictable, steady traffic during business hours and very low traffic at night. They want to reduce costs without compromising performance. Which TWO steps should the architect take? (Select TWO.)

Accepted Answer

Purchase Reserved Instances for the RDS DB instances.. Reserved Instances provide significant discounts for steady-state workloads with a long-term commitment. For the variable nature of the workload, migrating to Aurora Serverless v2 allows the database to scale capacity up and down automatically based on demand, ensuring they only pay for the resources consumed during high and low traffic periods.

Answer

Use Multi-AZ deployments for all read-only workloads.

Answer

Switch to an Amazon RDS Custom for MySQL instance.

Answer

Enable Provisioned IOPS (PIOPS) for all storage volumes.

Question 16

A solutions architect is designing a system for batch processing of large image files. The process can be interrupted and resumed later without loss of data. The workload is expected to run for several hours each night. Which EC2 instance purchasing option will provide the lowest cost?

Accepted Answer

Spot Instances. Spot Instances offer the deepest discounts (up to 90%) on EC2 capacity. They are ideal for fault-tolerant, flexible, and interruptible workloads like batch processing. Since the application can handle interruptions and resume progress, the risk of AWS reclaiming the capacity is offset by the massive cost savings compared to On-Demand or Reserved Instances.

Answer

On-Demand Instances

Answer

Dedicated Hosts

Answer

Reserved Instances

Question 17

Refer to the exhibit. A company wants to optimize the performance and security of data transfers between their EC2 instances and an S3 bucket named 'my-app-data'. Which architectural benefit is primarily achieved by implementing the policy shown in the exhibit?

Accepted Answer

It ensures traffic remains on the private AWS network, reducing latency.. The policy shown is a VPC endpoint policy (or an S3 bucket policy restricting access to a VPC endpoint), which forces traffic between EC2 and S3 to traverse the AWS private backbone via a Gateway or Interface VPC Endpoint instead of the public internet. This keeps traffic on the private AWS network, reducing latency, avoiding NAT gateway data-processing charges, and improving security posture.

Answer

It enables S3 Transfer Acceleration for faster global uploads.

Answer

It provides cross-region replication for high availability of data.

Answer

It allows public access to the bucket for faster content delivery.

Question 18

A company is running a large-scale batch processing job that can be interrupted and resumed without loss of data. The job runs for several hours every weekend. Which instance purchasing option will provide the highest cost savings?

Accepted Answer

Spot Instances. Spot Instances offer up to 90% discounts compared to On-Demand pricing by using AWS's spare EC2 capacity. Because the batch job is interruptible and can resume without data loss, it perfectly matches the Spot use case — workloads that tolerate the two-minute interruption notice when AWS reclaims capacity. This makes Spot the most cost-effective choice for fault-tolerant, flexible workloads.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Hosts

Question 19

An organization is using AWS Control Tower to manage multiple AWS accounts. They need to implement a set of guardrails to ensure that all accounts remain compliant with security best practices. Which THREE components or features are part of a standard AWS Control Tower landing zone implementation?

Accepted Answer

Preventive guardrails implemented using Service Control Policies (SCPs).. Option A is correct because AWS Control Tower preventive guardrails are enforced through Service Control Policies (SCPs) attached to OUs, which restrict what actions member accounts can perform. Option B is correct because detective guardrails in Control Tower are implemented as AWS Config rules (often deployed via conformance packs) that detect and flag noncompliant resources. Option C is correct because a standard Control Tower landing zone provisions a dedicated log archive account for centralized logging and an audit (security tooling) account for security and compliance tooling. Option D is incorrect because Amazon Macie is not enabled by default on all S3 buckets as part of the landing zone; it is an optional data-security service. Option E is incorrect because GuardDuty is not automatically enabled across all accounts by Control Tower itself; it can be integrated via services like AWS Security Hub or delegated administration, but it is not a built-in landing zone component.

Answer

Amazon Macie enabled by default on all S3 buckets in member accounts.

Answer

Amazon GuardDuty for automated threat detection across all accounts.

Question 20

A company is developing a mobile application that allows users to sign in using their social media accounts (e.g., Google or Facebook). After signing in, the application needs to obtain temporary AWS credentials to upload photos directly to an Amazon S3 bucket. Which service should the architect use?

Accepted Answer

Amazon Cognito. Amazon Cognito provides identity pools that directly support social identity providers (Google, Facebook, Amazon, Apple) and exchange the resulting tokens for temporary, scoped AWS credentials via STS. This is the managed, recommended way to implement web identity federation for mobile apps without building the token-exchange flow yourself. Cognito user pools handle authentication, and identity pools handle AWS credential vending.

Answer

AWS IAM User with static access keys

Answer

AWS Directory Service

Answer

AWS Security Token Service (STS) with a manual web identity federation implementation