SAA-C03 Practice Test 8 — 10 Questions

Question 1

An enterprise requires all data stored in Amazon S3 to be encrypted at rest. The security team must maintain full control over the encryption keys, including the ability to rotate them annually and define access policies for the keys themselves. Which encryption method meets these requirements with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS).. SSE-KMS with Customer Managed Keys (CMKs) allows the security team to create and manage their own KMS keys, including setting key policies, rotating keys annually, and auditing key usage via CloudTrail. It provides full control over the encryption keys while offloading the encryption/decryption process to S3, minimizing operational overhead.

Answer

Use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) for all buckets.

Answer

Implement client-side encryption using a third-party library before uploading objects.

Answer

Enable Server-Side Encryption with Customer-Provided Keys (SSE-C) for all uploads.

Question 2

Refer to the exhibit. An administrator has applied the provided bucket policy to 'my-secure-bucket'. What is the effect of this policy on access to the bucket?

Accepted Answer

It restricts GetObject access to only those requests originating from the 192.0.2.0/24 CIDR block.. The bucket policy uses a Condition with an IpAddress condition key restricting access to the 192.0.2.0/24 CIDR block, and the Action is s3:GetObject. Therefore only requests originating from that IP range are allowed to retrieve objects; all other requests are denied by default because S3 policies are deny-by-default.

Answer

It allows all users to retrieve objects from the bucket if they are using any IP address.

Answer

It denies access to anyone from the 192.0.2.0/24 range and allows everyone else.

Answer

It grants full administrative access to the bucket for the 192.0.2.0/24 IP range.

Question 3

A company is migrating a web application to AWS and needs to ensure that all data stored in Amazon S3 is encrypted at rest using keys managed by the company. The company must be able to rotate these keys annually and maintain full control over key access policies. Which solution meets these requirements?

Accepted Answer

Use AWS KMS with Customer Managed Keys.. AWS KMS Customer Managed Keys (CMKs) give the company full control over the key policy, allow annual rotation to be enabled, and support auditing via CloudTrail. SSE-S3 uses AWS-owned keys the customer cannot manage or rotate, and AWS Managed Keys have rotation controlled by AWS (every three years) with policies the customer cannot edit. Uploading a raw master key to S3 is not a supported KMS pattern.

Answer

Enable S3 Managed Keys (SSE-S3) for all buckets.

Answer

Use AWS KMS with AWS Managed Keys.

Answer

Upload a master key to AWS via the S3 console.

Question 4

A company hosts a web application on EC2 instances behind an Application Load Balancer. The application stores session state in local memory, causing users to be logged out whenever the load balancer routes requests to different instances. Which solution provides the most resilient, scalable architecture to resolve this?

Accepted Answer

Store session state in Amazon ElastiCache for Redis.. Storing session state in Amazon ElastiCache for Redis externalizes session data so any EC2 instance behind the ALB can serve any request, eliminating the logout problem while providing high availability and scalability. Redis is purpose-built for low-latency session stores and supports replication and failover. This is the AWS-recommended pattern for stateless web tiers.

Answer

Configure the Application Load Balancer to use source IP stickiness.

Answer

Use Amazon EBS multi-attach to share session files across instances.

Answer

Replicate session files using a cron job across all web instances.

Question 5

A company's web application requires a highly available database layer to survive an Availability Zone failure without manual intervention. The database must remain accessible during maintenance windows and ensure zero data loss. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Implement an Amazon RDS Multi-AZ deployment.. Amazon RDS Multi-AZ maintains a synchronous standby replica in a different Availability Zone and automatically fails over during an AZ failure or maintenance event, with zero data loss (RPO=0) and no manual intervention. It meets high availability, maintenance resilience, and zero data loss with minimal operational overhead.

Answer

Configure RDS Read Replicas and manually promote them during an outage.

Answer

Deploy a Single-AZ RDS instance and use AWS Backup for hourly snapshots.

Answer

Host a MySQL database on an Amazon EC2 instance with an EBS volume.

Question 6

A web application stores static files in Amazon S3. Due to regulatory requirements, the company must ensure that the files are replicated to a secondary region. What is the most efficient way to achieve this?

Accepted Answer

Enable S3 Cross-Region Replication on the source bucket.. S3 Cross-Region Replication (CRR) is the most efficient and native way to automatically replicate objects from a source bucket to a destination bucket in a different region. It replicates new objects as they are uploaded and can also replicate existing objects if configured, providing a managed, low-latency replication solution that meets regulatory requirements.

Answer

Use AWS DataSync to copy files periodically.

Answer

Create an EventBridge rule to trigger a Lambda function for every upload.

Answer

Use AWS Storage Gateway to replicate local data to S3.

Question 7

A company has a legacy application that requires a persistent file system shared across multiple EC2 instances. The file system must be highly available and support standard file system protocols. Which solution is most appropriate?

Accepted Answer

Use Amazon EFS with mount targets in multiple Availability Zones.. Amazon EFS provides a fully managed, scalable, and highly available NFS file system that can be mounted simultaneously by multiple EC2 instances across multiple AZs. It is designed to be resilient, automatically replicating data across AZs within a region. This makes it the ideal choice for legacy applications that require shared storage without the management overhead of self-managed storage servers or distributed file systems.

Answer

Mount an Amazon EBS volume to multiple EC2 instances simultaneously.

Answer

Create an S3 bucket and use it as a mounted file system via S3FS.

Answer

Set up a self-managed NFS server on an EC2 instance.

Question 8

Refer to the exhibit. The current IAM policy allows an EC2 instance to read backups. The architect wants to ensure the data is recoverable if the source bucket is compromised by an external actor with write access. What should be done?

Accepted Answer

Enable S3 Object Lock on the bucket.. S3 Object Lock enforces a Write Once Read Many (WORM) model, preventing objects from being deleted or overwritten for a specified retention period — even by users with full administrative permissions. This directly addresses the scenario where an external actor with write access could otherwise overwrite or delete backups, ensuring the data remains recoverable. Object Lock requires versioning to be enabled on the bucket.

Answer

Apply a Bucket Policy to deny s3:PutObject for all users.

Answer

Create a read-only IAM user for the EC2 instance.

Answer

Enable S3 Server-Side Encryption (SSE-S3).

Question 9

An application processes data in bursts, running for 30 seconds every few minutes. The workload is unpredictable. Which compute service offers the most cost-effective solution?

Accepted Answer

AWS Lambda. AWS Lambda is a serverless compute service that bills based on the number of requests and the duration of execution in milliseconds. For short-lived, bursty, and unpredictable workloads, Lambda is more cost-effective than provisioning servers that would sit idle for the majority of the time between processing events.

Answer

Amazon EC2 with Auto Scaling

Answer

AWS Fargate

Answer

Amazon EC2 Spot Instances

Question 10

A company is hosting a sensitive web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The compliance team requires that all data at rest must be encrypted using keys that are rotated annually, and all access to these keys must be logged for auditing purposes. Which solution meets these requirements with the least administrative effort?

Accepted Answer

Encrypt the EC2 EBS volumes using AWS KMS with automatic key rotation enabled.. AWS KMS with automatic key rotation enabled on the EBS encryption key satisfies annual rotation, and KMS logs every key operation to CloudTrail for auditing. EBS encryption at rest is configured at the volume level using a KMS CMK, and enabling rotation is a single checkbox or API call — the least administrative effort. CloudHSM and third-party tools require manual rotation and more operational overhead.

Answer

Use AWS CloudHSM to manage encryption keys and manually rotate them every year.

Answer

Implement a third-party encryption tool on the EC2 instances and store keys in an S3 bucket.

Answer

Use Amazon S3 SSE-S3 to encrypt the EBS volumes and monitor access via VPC Flow Logs.