SAA-C03 Practice Test 6 — 10 Questions

Question 1

A research institution is running a High Performance Computing (HPC) workload on AWS that requires a POSIX-compliant file system capable of millions of IOPS and sub-millisecond latencies. Which TWO storage options are most appropriate for this use case?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon FSx for Lustre.. Amazon FSx for Lustre (A) is correct because it is a POSIX-compliant, high-performance file system purpose-built for HPC, delivering millions of IOPS and sub-millisecond latencies, and it integrates with S3 for data staging. EC2 Instance Store with a clustered file system (D) is correct because instance store volumes are physically attached NVMe SSDs offering the lowest latency and highest IOPS, and a clustered file system (e.g., Lustre, GPFS) can aggregate them across nodes for shared POSIX access. Amazon S3 with S3 Select (B) is object storage, not POSIX-compliant, and cannot meet sub-millisecond latency requirements. Amazon FSx for Windows File Server (C) uses SMB and is designed for Windows workloads, not high-IOPS POSIX HPC. Amazon EFS General Purpose mode (E) is POSIX-compliant but its latency and throughput are far below the millions of IOPS and sub-millisecond requirements of this workload.

Answer

Amazon S3 with S3 Select.

Answer

Amazon FSx for Windows File Server.

Answer

Amazon EFS in General Purpose mode.

Question 2

An application is deployed across two AWS Regions to ensure resilience. The architect needs to direct users to the healthy region with the lowest latency. If the primary region fails, traffic should fail over automatically. Which Route 53 routing policy should be implemented?

Accepted Answer

Latency routing policy with health checks.. Latency-based routing with health checks directs each user to the AWS Region that provides the lowest latency while the health check removes an unhealthy region's records from DNS responses, achieving automatic failover. This satisfies both requirements: lowest-latency selection under normal conditions and automatic redirection when the primary region fails.

Answer

Simple routing policy.

Answer

Failover routing policy.

Answer

Weighted routing policy.

Question 3

A company is using Amazon DynamoDB to store real-time session data. The application requires response times in the sub-millisecond range for frequently accessed keys. The current DynamoDB latency is around 10-15 milliseconds. What should the architect implement to meet the performance goal?

Accepted Answer

Implement Amazon DynamoDB Accelerator (DAX).. DynamoDB Accelerator (DAX) is an in-memory cache purpose-built for DynamoDB that delivers microsecond response times for eventually consistent reads — well within the sub-millisecond requirement. DAX sits in front of the table as a write-through cache, so frequently accessed keys are served from RAM rather than from DynamoDB's SSD-backed storage, eliminating the 10-15 ms round trip. It requires only a minor application change (swap the DynamoDB client for the DAX client) and is the standard AWS answer for 'sub-millisecond DynamoDB reads.'

Answer

Enable DynamoDB Streams and use Lambda to update ElastiCache.

Answer

Increase the Provisioned Read Capacity Units (RCUs) for the table.

Answer

Use Global Tables to replicate data closer to the application nodes.

Question 4

A company is building a zero-trust architecture for its internal microservices running on Amazon EKS. Which THREE steps should the solutions architect take to ensure secure, least-privilege communication between services? (Select THREE)

Accepted Answer

Assign IAM Roles to individual Kubernetes Service Accounts (IRSA).. Option A is correct because IAM Roles for Service Accounts (IRSA) lets each Kubernetes Service Account assume a distinct IAM role via the EKS OIDC provider, so individual microservices receive only the AWS permissions they need, which is a core least-privilege control in a zero-trust model. Option B is correct because AWS App Mesh enforces mutual TLS (mTLS) between microservices, providing cryptographic identity verification and encrypted service-to-service traffic so that no service is trusted merely by network location. Option C is correct because Security Groups for Pods (using the VPC CNI and ENI trunking) applies EC2 security group rules directly to pod ENIs, enabling fine-grained, least-privilege network segmentation between specific services. Option D is not appropriate because placing all microservices in a single public subnet exposes them to the internet and removes the network segmentation that zero-trust requires. Option E is not appropriate because disabling VPC Flow Logs reduces visibility and auditability of traffic, which is essential for detecting and investigating lateral movement in a zero-trust architecture.

Answer

Place all microservices in a single public subnet to simplify routing.

Answer

Disable VPC Flow Logs to reduce latency between microservices.

Question 5

An application consists of a web tier and an application tier. The web tier must be accessible from the internet, but the application tier must remain private. How should the architect configure the network for maximum resilience?

Accepted Answer

Deploy web and app tiers across multiple subnets in multiple AZs, with app tiers in private subnets.. For maximum resilience, the web and application tiers should be deployed across multiple subnets in multiple Availability Zones, with the web tier in public subnets (accessible from the internet) and the application tier in private subnets (not directly accessible). This design ensures high availability and fault tolerance, and follows the principle of least privilege by isolating the private tier.

Answer

Deploy all tiers in a single public subnet in one AZ.

Answer

Put everything in a public subnet and use Security Groups for isolation.

Answer

Use a single private subnet for both tiers and a NAT Gateway in the same subnet.

Question 6

An architect is designing a secure storage solution for highly sensitive financial data in S3. Which THREE security controls should be implemented? (Select THREE.)

Accepted Answer

Enable S3 Block Public Access at the account level.. Option A is correct because enabling S3 Block Public Access at the account level applies account-wide guardrails that override bucket policies and ACLs, preventing any bucket or object from being made public—an essential baseline for highly sensitive financial data. Option B is correct because AWS KMS with Customer Managed Keys (CMKs) gives the organization control over the key policy, rotation, and grants, providing encryption at rest with auditable key usage via CloudTrail, which is required for regulated financial data. Option C is correct because bucket policies using the aws:SecureTransport condition (e.g., "aws:SecureTransport": "false" with Deny) enforce HTTPS/TLS for all requests, preventing data in transit from being exposed over plain HTTP. Option D is incorrect because granting all users in the organization full access violates least privilege and would allow unauthorized or accidental modification or exfiltration of sensitive data. Option E is incorrect because storing data in a public bucket exposes it to the internet and directly contradicts the requirement for a secure storage solution.

Answer

Allow all users in the organization to have full access.

Answer

Store data in a public bucket for easier access.

Question 7

A security auditor requires that all EC2 instances must be running with specific software versions and that any instance not compliant with these versions must be automatically terminated. Which THREE services should be used to achieve this? (Select THREE.)

Accepted Answer

AWS Systems Manager Inventory.. Combining AWS Systems Manager for inventory and automation, AWS Config for continuous compliance monitoring, and Lambda for remediation provides a fully automated governance framework. This approach ensures that the environment is continuously scanned for drift, and non-compliant resources are immediately addressed without human intervention. This setup is crucial for meeting strict regulatory requirements where automated enforcement of security and operational standards is mandatory across a large-scale AWS environment.

Answer

AWS Trusted Advisor.

Answer

AWS CloudFront.

Question 8

A company is using AWS Direct Connect to connect their on-premises data center to AWS. What is the most resilient way to connect?

Accepted Answer

Use two Direct Connect connections in different locations.. To achieve high resiliency and maximum redundancy with AWS Direct Connect, a company should establish at least two Direct Connect connections in different AWS locations (or use AWS Direct Connect resiliency recommendations which include multiple connections across multiple locations). Option B provides geographical redundancy, eliminating single points of failure.

Answer

Use a single 10 Gbps Direct Connect connection.

Answer

Use a single VPN connection over the internet.

Answer

Configure the connection to use only the AWS public IP space.

Question 9

A company wants to implement a service that continuously monitors for malicious activity and unauthorized behavior across its AWS accounts, such as cryptocurrency mining or unusual API calls. Which AWS service should they use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It specifically detects findings like cryptocurrency mining, unusual API calls, and compromised instances, which matches the requirement exactly.

Answer

Amazon Macie

Answer

AWS Config

Answer

AWS CloudTrail

Question 10

Refer to the exhibit. An S3 bucket contains millions of small log files. The requirements state that data must be moved to a cheaper storage class after 30 days. The exhibit shows a lifecycle policy. Why might this configuration be sub-optimal for cost?

Accepted Answer

Monitoring fees for Intelligent-Tiering may outweigh savings for millions of small files.. S3 Intelligent-Tiering charges a per-object monitoring and automation fee (currently $0.0025 per 1,000 objects per month) on top of storage costs. With millions of small log files, this monitoring overhead can easily exceed the storage savings from automatic tier transitions, making it economically sub-optimal compared to a simple lifecycle transition rule to Standard-IA or Glacier.

Answer

Intelligent-Tiering is only supported for objects larger than 128 KB.

Answer

The lifecycle rule should use S3 Glacier Deep Archive instead of Intelligent-Tiering.

Answer

The prefix filter is too broad and will include active logs.