SAA-C03 Practice Questions 1 — 50 Questions

Question 1

A company wants to ensure that its internal applications can access Amazon S3 without the traffic ever leaving the AWS network or passing through the public internet. What should they implement to achieve this securely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and update the route tables.. A VPC Gateway Endpoint for Amazon S3 provides a private, logical connection between a VPC and S3 that keeps traffic on the AWS backbone and never traverses the public internet. Updating route tables to direct S3-bound traffic to the gateway endpoint ensures instances in private subnets reach S3 privately.

Answer

Configure a NAT Gateway in a public subnet to route S3 traffic.

Answer

Use an AWS Direct Connect connection between the VPC and S3.

Answer

Set up a VPN connection between the private subnet and the S3 service.

Question 2

A global e-commerce site uses an Amazon RDS for MySQL database. Users in different regions are complaining about slow page load times when browsing product catalogs. How can the architect improve read performance for global users with minimal changes to the application?

Accepted Answer

Create Read Replicas in different AWS Regions.. Cross-region read replicas allow you to serve read traffic from a location physically closer to your users, reducing latency. This architectural pattern is essential for high-performing global applications where the primary database is located in a single region but the user base is distributed worldwide.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Upgrade the RDS instance to a larger instance class.

Answer

Enable Enhanced Monitoring with a 1-second granularity.

Question 3

A research firm is running a tightly coupled High Performance Computing (HPC) workload on AWS using EC2 instances. The firm needs to minimize network latency and maximize inter-node communication speed. Which network enhancement should the architect recommend?

Accepted Answer

Deploy the instances using an Elastic Fabric Adapter (EFA).. Elastic Fabric Adapter (EFA) is a network interface for Amazon EC2 instances that enables customers to run applications requiring high levels of inter-node communications at scale. It uses a custom protocol to provide lower and more consistent latency than traditional TCP/IP stacks used in standard networking.

Answer

Enable Enhanced Networking with the Elastic Network Adapter (ENA).

Answer

Use a Spread Placement Group for the EC2 instances.

Answer

Implement AWS Global Accelerator for the cluster.

Question 4

A company is hosting a web application on EC2 instances behind an Application Load Balancer. The security team requires that all data in transit between the client and the ALB be encrypted using TLS. Which service should the architect use to manage the SSL/TLS certificates for the ALB?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the managed service designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services like Application Load Balancers, CloudFront, and API Gateway. ACM handles certificate renewal automatically and integrates natively with ALB listeners, making it the correct choice for managing TLS certificates for the ALB.

Answer

AWS Secrets Manager

Answer

AWS Key Management Service (KMS)

Answer

IAM Server Certificate Upload

Question 5

A developer needs to access an Amazon RDS database from an EC2 instance within a private subnet. The database must only accept traffic from the instance. Which security configuration is most appropriate?

Accepted Answer

Configure the RDS security group to allow inbound traffic from the EC2 instance security group ID.. Configuring the RDS Security Group to allow inbound traffic on the database port exclusively from the security group ID associated with the EC2 instance follows the principle of least privilege. This stateful configuration ensures that only authorized resources can communicate with the database, significantly reducing the attack surface. By referencing the security group ID instead of an IP address, the architecture remains resilient to dynamic IP changes.

Answer

Configure the RDS security group to allow inbound traffic from 0.0.0.0/0 on the database port.

Answer

Configure the RDS security group to allow inbound traffic from the database's own IP address.

Answer

Configure the RDS security group to allow inbound traffic from the private IP of the EC2 instance.

Question 6

A company is hosting a multi-tier web application on AWS using Amazon EC2 instances in a private subnet behind an Application Load Balancer (ALB). The security team requires that all incoming web traffic is encrypted in transit from the client to the ALB and from the ALB to the backend EC2 instances. Which combination of configurations meets these requirements?

Accepted Answer

Configure an HTTPS listener on the ALB using an ACM certificate and configure the backend instances to accept HTTPS traffic.. To encrypt traffic from client to ALB, an HTTPS listener with an ACM certificate is required. To encrypt traffic from ALB to backend EC2 instances, the backend must accept HTTPS (TLS) traffic, which means the ALB target group protocol must be HTTPS and the instances must have certificates installed and be listening on the HTTPS port. Option C is the only one that satisfies both requirements.

Answer

Configure an HTTP listener on the ALB and configure the backend instances to accept HTTP traffic on port 80.

Answer

Configure an HTTPS listener on the ALB and route traffic to the backend instances using HTTP on port 80.

Answer

Configure a TCP listener on the ALB and install self-signed certificates directly on the target EC2 instances.

Question 7

A company has several VPCs in the same region that need to access an Amazon S3 bucket for data logging. Currently, data is transferred over the public internet, incurring data transfer charges. What is the most cost-effective way to allow the VPCs to access S3?

Accepted Answer

Create an S3 Gateway Endpoint in each VPC.. S3 Gateway Endpoints are the most cost-effective solution because they are provided at no additional cost and do not incur hourly charges or data processing fees. They allow traffic to stay within the AWS network, eliminating data transfer out charges to the public internet while maintaining high security and performance.

Answer

Deploy a NAT Gateway in each VPC.

Answer

Create an S3 Interface Endpoint (PrivateLink) in each VPC.

Answer

Establish a AWS Direct Connect connection to S3.

Question 8

A solutions architect is designing a batch processing workload that runs for 4 hours every night. The workload can be interrupted and resumed without data loss. Cost optimization is a primary requirement for this deployment.

Accepted Answer

Configure an Auto Scaling group using Amazon EC2 Spot Instances with an appropriate instance diversification strategy.. Spot Instances offer up to 90% discount compared to On-Demand and are ideal for interruptible, resumable batch workloads. Using an Auto Scaling group with instance diversification across multiple instance types and Availability Zones increases the chance of acquiring and retaining Spot capacity, and the workload can tolerate interruptions without data loss. This directly satisfies the cost optimization requirement while maintaining availability.

Answer

Use Amazon EC2 Reserved Instances to cover the nightly batch processing requirements over a one-year term.

Answer

Provision Amazon EC2 On-Demand Instances and terminate them manually through an AWS Lambda script after completion.

Answer

Purchase Amazon EC2 Dedicated Hosts to run the nightly batch processing instances securely and predictably.

Question 9

An application running on Amazon Aurora MySQL experiences significant performance degradation during peak hours due to a surge in read-only traffic. The database currently uses a single primary instance and one replica. What is the most effective way to scale the database for these spikes while maintaining high performance?

Accepted Answer

Configure Aurora Auto Scaling for the Aurora Replicas.. Aurora Auto Scaling automatically adds and removes Aurora Replicas based on metrics like CPU utilization or the number of connections, scaling read capacity in response to demand spikes without manual intervention. This is the most effective solution because it handles peak-hour surges dynamically while maintaining high availability across Availability Zones. Manual scaling (Option A) is reactive and slow, and vertical scaling of the primary (Option C) does not address read traffic distribution.

Answer

Manually add more Aurora Replicas during peak hours.

Answer

Increase the instance size of the primary Aurora instance.

Answer

Use Amazon SQS to buffer incoming read requests.

Question 10

A security engineer needs to block a specific range of malicious IP addresses from accessing an entire subnet within a VPC. The solution must ensure that the traffic is rejected before it reaches any EC2 instances. Which AWS feature should be used to implement this restriction?

Accepted Answer

Network Access Control Lists (NACLs). Network ACLs are stateless, subnet-level firewalls that evaluate traffic before it reaches any EC2 instance, making them the correct tool to block a malicious IP range at the subnet boundary. Because NACLs support explicit deny rules with CIDR ranges, they can reject the traffic before it hits the instances.

Answer

Security Groups

Answer

AWS WAF

Answer

AWS Shield Standard

Question 11

A database administrator needs to ensure that an Amazon RDS for MySQL instance can withstand an Availability Zone failure and provide low-latency reads for a reporting application. Which TWO steps should be taken?

Accepted Answer

Enable Multi-AZ deployment for the RDS instance.. Enabling Multi-AZ provides the high availability needed to survive an AZ failure by maintaining a synchronous standby. Creating a Read Replica in a different AZ offloads read traffic from the primary instance, improving performance for the reporting application while also providing an additional layer of data redundancy across the region.

Answer

Use EBS Snapshots to back up the database every 5 minutes.

Answer

Enable Enhanced Monitoring with a 1-second granularity.

Answer

Implement a Network Load Balancer in front of the RDS instance.

Question 12

A global gaming company wants to reduce latency for its players who are distributed worldwide. The application uses UDP-based traffic and requires a static entry point to simplify firewall management. Which service should the architect recommend to optimize the network path?

Accepted Answer

AWS Global Accelerator.. AWS Global Accelerator uses the AWS global network to route traffic to the optimal regional endpoint based on health and proximity. Unlike CloudFront, which is primarily for HTTP/S content, Global Accelerator supports non-HTTP protocols like UDP. It provides static IP addresses that act as a fixed entry point, improving performance by keeping traffic on the AWS backbone.

Answer

Amazon CloudFront.

Answer

Amazon Route 53 with Geolocation routing.

Answer

AWS Direct Connect.

Question 13

A global e-commerce enterprise runs its checkout workflow using AWS Lambda functions integrated with Amazon API Gateway. During flash sales, traffic spikes cause downstream payment APIs to timeout, leading to lost transactions and frustrated customers. The solutions architect needs to redesign the architecture to decouple the frontend from the payment processor and ensure no transaction requests are lost. What should the architect do?

Accepted Answer

Integrate an Amazon SQS FIFO queue between API Gateway and the downstream payment processing Lambda functions.. Integrating an Amazon SQS FIFO queue between API Gateway and the payment Lambda decouples the frontend from the downstream payment processor, buffering requests during traffic spikes so no transaction is lost. FIFO queues preserve order and provide exactly-once processing, which is critical for payment transactions. The Lambda functions can then poll the queue at a controlled rate, preventing downstream timeouts.

Answer

Configure API Gateway to cache responses using an Amazon ElastiCache Redis cluster deployed in multi-AZ mode.

Answer

Increase the timeout and memory allocation of the API Gateway integration and the AWS Lambda functions.

Answer

Use AWS Step Functions with standard workflows to execute the payment processing steps sequentially.

Question 14

A company is concerned that its database credentials, currently stored as environment variables in AWS Lambda, are not being rotated regularly. Which AWS service should the company use to securely store and automatically rotate these credentials?

Accepted Answer

AWS Secrets Manager with its built-in rotation feature for Amazon RDS.. AWS Secrets Manager is purpose-built for storing secrets and provides native, automatic rotation using Lambda rotation functions, including built-in templates for Amazon RDS, Aurora, Redshift, and DocumentDB credentials. It integrates with RDS so the database password and the secret are rotated together without application downtime. This directly satisfies the requirement to store credentials securely and rotate them automatically.

Answer

AWS Systems Manager Parameter Store with SecureString parameters.

Answer

AWS Key Management Service (KMS) to encrypt the environment variables.

Answer

AWS Identity and Access Management (IAM) roles for the Lambda function.

Question 15

A large corporation uses AWS Organizations to manage hundreds of accounts. The security team wants to ensure that no account can provision resources in unauthorized regions and that only approved AWS services can be used. Which TWO features should be used to enforce these constraints across the entire organization? (Select TWO.)

Accepted Answer

Service Control Policies (SCPs) applied to the root of the Organization.. Option B is correct because Service Control Policies (SCPs) applied at the organization root set the maximum available permissions for all accounts in the organization, so they can centrally deny access to unapproved AWS services across every member account. Option E is correct because an SCP with a Condition element using the aws:RequestedRegion global condition key can explicitly deny API calls made to regions outside the approved list, enforcing the region restriction organization-wide. Together, SCPs at the root and region-based conditions satisfy both requirements: restricting services and restricting regions for all accounts. Option A is not appropriate because IAM policies in each member account are decentralized, must be maintained per account, and do not act as a guardrail against account administrators granting themselves broader permissions. Option C is incorrect because AWS Resource Access Manager (RAM) shares resources such as subnets or Transit Gateways between accounts; it does not restrict which services or regions can be used. Option D is incorrect because AWS Config rules detect and can remediate noncompliant resources after creation, but they do not prevent provisioning in unauthorized regions the way an SCP deny does.

Answer

IAM Policies attached to each administrative user in every member account.

Answer

AWS Resource Access Manager (RAM) to share authorized services across accounts.

Answer

AWS Config rules to automatically terminate resources in unauthorized regions.

Question 16

A web application is deployed on Amazon EC2 instances within a private subnet. The application must receive traffic from an Application Load Balancer (ALB) in a public subnet and connect to an Amazon RDS MySQL database in a different private subnet. Which TWO steps are required to secure this architecture using security groups?

Accepted Answer

Configure the EC2 security group to allow inbound traffic on port 80/443 from the ALB security group.. Option A is correct because the EC2 instances must accept HTTP/HTTPS traffic from the ALB, and referencing the ALB's security group as the source on ports 80/443 restricts inbound access to only that load balancer rather than the whole internet. Option B is correct because the application tier must reach the RDS MySQL database on its listener port 3306, and using the EC2 security group as the source in the RDS security group's inbound rule limits database access to only those application instances. Option C is wrong because allowing 0.0.0.0/0 on port 80 would expose the instances directly to the internet, defeating the purpose of placing them in a private subnet behind an ALB. Option D is wrong because security groups are stateful, so return traffic for allowed inbound connections is automatically permitted and no outbound rule to the EC2 instances is needed; moreover, RDS does not initiate connections to the instances. Option E is wrong because it reverses the traffic direction: the ALB receives client traffic from the internet, not from the EC2 instances, so the ALB security group should allow inbound 80/443 from the internet (or appropriate clients), not from the EC2 security group.

Answer

Configure the EC2 security group to allow inbound traffic from 0.0.0.0/0 on port 80 to handle web traffic.

Answer

Configure the RDS security group to allow outbound traffic to the EC2 instances on all ports.

Answer

Configure the ALB security group to allow inbound traffic from the EC2 security group on port 80.

Question 17

A developer needs to access an S3 bucket from an EC2 instance. For security best practices, the developer must avoid hardcoding long-term credentials on the instance. What is the most secure method to provide the necessary permissions?

Accepted Answer

Attach an IAM role to the EC2 instance with an S3 access policy.. Attaching an IAM role to the EC2 instance lets the instance obtain temporary, automatically rotated credentials via the Instance Metadata Service (IMDS), eliminating hardcoded long-term keys. The role's policy grants least-privilege S3 access, which is the AWS-recommended best practice for instance-to-service authentication.

Answer

Create an IAM user with S3 access and store the access key and secret key in a local configuration file.

Answer

Configure the S3 bucket policy to allow public read access to the specific EC2 instance's public IP address.

Answer

Modify the instance security group to allow all traffic to and from the S3 endpoint.

Question 18

A company is migrating a compute-intensive web application to AWS. The application requires high CPU performance and needs to scale automatically based on demand. Which EC2 instance family and scaling feature should the architect choose to ensure optimal performance?

Accepted Answer

C-family instances with a dynamic scaling policy.. C-family instances are compute-optimized, delivering the highest CPU performance per dollar for compute-intensive workloads, which matches the application's requirement. Pairing them with a dynamic scaling policy (target tracking or step scaling) lets the Auto Scaling group respond automatically to real-time demand changes. Together they satisfy both the performance and elasticity requirements.

Answer

T-family instances with a standard Auto Scaling group.

Answer

R-family instances with a scheduled scaling policy.

Answer

M-family instances with manual scaling adjustments.

Question 19

Refer to the exhibit. A solutions architect reviews the following IAM policy applied to a user. What is the effect of this policy when the user attempts to access an object in the bucket from an IP address of 198.51.100.5?

Accepted Answer

Access is denied because the source IP address is not within the 203.0.113.0/24 range.. The policy includes a condition that restricts access to the IP range 203.0.113.0/24. Since the user's IP address (198.51.100.5) is outside this range, the condition evaluates to false, and the Allow statement does not apply. Therefore, the request is implicitly denied because there is no other Allow statement that grants access.

Answer

Access is allowed because the policy grants s3:GetObject permissions to the bucket.

Answer

Access is allowed because there is no explicit Deny statement in the policy.

Answer

Access is denied because the policy does not include permissions for the s3:ListBucket action.

Question 20

A company's public-facing application is experiencing a Distributed Denial of Service (DDoS) attack. The application is hosted on EC2 instances behind an Application Load Balancer (ALB). Which TWO AWS services or features can be used to mitigate this attack and protect the application?

Accepted Answer

AWS Shield Advanced for enhanced DDoS detection and mitigation.. Protecting against DDoS attacks requires a multi-layered approach. AWS Shield provides automatic protection for all AWS customers, while Shield Advanced offers enhanced detection and mitigation for sophisticated attacks. AWS WAF complements this by allowing administrators to create rules that block malicious traffic patterns, such as SQL injection or high-volume IP addresses.

Answer

Amazon GuardDuty to identify and block malicious traffic at the VPC level.

Answer

Amazon Inspector to scan EC2 instances for vulnerabilities during the attack.

Answer

AWS PrivateLink to hide the application from the public internet.