SAA-C03 Practice Test 9 — 10 Questions

Question 1

A solutions architect is designing a caching layer for a high-traffic web application that uses a multi-node cluster. The architect needs to ensure high availability and the ability to scale horizontally while supporting complex data types such as sorted sets and lists. Which TWO features of Amazon ElastiCache for Redis support these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Multi-AZ with automatic failover.. Option A (Multi-AZ with automatic failover) is correct because ElastiCache for Redis supports replication groups with a primary node and one or more read replicas across Availability Zones; if the primary fails, ElastiCache automatically promotes a replica, providing the high availability the multi-node cluster requires. Option C (Redis Cluster mode for horizontal scaling) is correct because cluster mode shards data across up to 500 shards (nodes), enabling horizontal scaling of both storage and throughput while still supporting complex Redis data structures such as sorted sets and lists. Option B is not correct because ElastiCache for Redis is fundamentally single-threaded for command execution (multi-threaded I/O exists in some versions, but it is not the feature that delivers HA or horizontal scaling here). Option D is not correct because ElastiCache does not provide automatic data compression at the cache level as a feature for this scenario. Option E is not correct because Redis communicates over TCP, not UDP, and UDP would not provide reliable low-latency writes.

Answer

Support for multi-threaded execution.

Answer

Automatic data compression at the cache level.

Answer

Use of UDP protocol for low-latency writes.

Question 2

An application is experiencing intermittent performance issues due to high IOPS demand. The application currently uses a standard General Purpose SSD (gp2) volume. Which action will provide the best performance improvement?

Accepted Answer

Change the volume type to Provisioned IOPS SSD (io1/io2).. Provisioned IOPS SSD (io1/io2) volumes are designed for I/O-intensive workloads and allow you to specify a consistent IOPS rate. They provide significantly higher IOPS than gp2 volumes and are the best choice for applications with high IOPS demand. This directly addresses the performance issue.

Answer

Change the volume type to gp3.

Answer

Increase the size of the gp2 volume.

Answer

Switch to Cold HDD (sc1) storage.

Question 3

A large enterprise uses AWS Organizations to manage multiple accounts. The Chief Information Security Officer (CISO) wants to ensure that no account within the organization can create any resources in regions other than 'us-east-1' and 'us-west-2'. What is the most efficient way to enforce this across the entire organization?

Accepted Answer

Apply a Service Control Policy (SCP) to the organization root that denies all actions if the region is not 'us-east-1' or 'us-west-2'.. SCPs are the only AWS Organizations mechanism that centrally enforce permission guardrails across every account in the OU/root, and they apply to all principals including the root user. A deny statement conditioned on aws:RequestedRegion outside us-east-1/us-west-2 blocks resource creation in unauthorized regions before the API call succeeds. Attaching it at the organization root propagates the restriction to every member account with a single policy, which is the most efficient approach.

Answer

Create an IAM Group in the management account with a region-restrictive policy and add all users to it.

Answer

Use AWS Config rules in each account to monitor resource creation and delete any resource found in unauthorized regions.

Answer

Configure a VPC Endpoint for all services and restrict access to specific regions using VPC Endpoint policies.

Question 4

A company's security team identifies that its public-facing web application is being targeted by SQL injection and cross-site scripting (XSS) attacks. The application is running on EC2 instances behind an Application Load Balancer (ALB). Which service should the solutions architect implement to protect the application from these specific web-based attacks?

Accepted Answer

AWS WAF. AWS WAF is purpose-built to inspect HTTP/HTTPS requests at Layer 7 and block application-layer exploits such as SQL injection and cross-site scripting. It integrates natively with ALB, CloudFront, and API Gateway, and provides managed rule groups (e.g., AWSManagedRulesSQLiRuleSet, AWSManagedRulesCommonRuleSet) that detect these exact attack patterns. Because the workload sits behind an ALB, WAF can be attached directly to the load balancer to filter malicious requests before they reach the EC2 instances.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 5

Refer to the exhibit. An application needs to store highly durable data in S3. The architect wants to ensure data is protected against accidental deletion while maintaining cost-effective storage. What should be done?

Accepted Answer

Enable S3 Versioning on the bucket and use Lifecycle policies to manage older versions.. S3 Versioning preserves every prior version of an object, so an accidental overwrite or delete does not destroy the underlying data — the previous version remains retrievable. Pairing Versioning with Lifecycle policies lets you transition or expire noncurrent versions after a set number of days, which controls the cost of retaining all those versions. Together they deliver durability against accidental deletion while keeping storage spend predictable.

Answer

Enable S3 Cross-Region Replication for all objects.

Answer

Modify the IAM policy to include s3:DeleteObject in the Deny statement.

Answer

Use S3 Intelligent-Tiering for all objects to reduce storage costs.

Question 6

A security architect is designing a multi-tier application in a VPC. The requirement is to block all traffic from a specific range of malicious IP addresses (CIDR 192.0.2.0/24) while allowing standard web traffic (HTTPS) from all other sources to the web tier. Which TWO actions should the architect take to implement this? (Select TWO.)

Accepted Answer

Create an inbound rule in the Network ACL to deny traffic from 192.0.2.0/24.. Option A is correct because Network ACLs are stateless, subnet-level firewalls that support explicit deny rules, so an inbound deny rule for 192.0.2.0/24 blocks that malicious CIDR before it can reach any resource in the subnet. Option D is correct because Security Groups are stateful, instance-level firewalls that only support allow rules, so permitting inbound TCP port 443 from 0.0.0.0/0 allows standard HTTPS web traffic from all other sources to the web tier. Together these satisfy both requirements: the NACL denies the malicious range while the Security Group allows HTTPS from everywhere else. Option B is wrong because Security Groups cannot contain deny rules; they are allow-only. Option C is wrong because AWS Shield Standard provides automatic protection against common DDoS attacks and does not let you block a specific CIDR like 192.0.2.0/24. Option E is wrong because route tables control routing, not inbound filtering, and blackholing a destination CIDR would not block inbound traffic from that source to the web tier.

Answer

Add a deny rule to the web tier Security Group for CIDR 192.0.2.0/24.

Answer

Configure AWS Shield Standard to automatically block the 192.0.2.0/24 subnet.

Answer

Update the VPC Route Table to blackhole all traffic destined for 192.0.2.0/24.

Question 7

A solutions architect is designing a mission-critical web application running on Amazon EC2 instances behind an Application Load Balancer. The application must remain highly available even during an Availability Zone outage. Which deployment strategy meets this requirement with optimal resilience?

Accepted Answer

Distribute EC2 instances across multiple Availability Zones within a single AWS Region using an Auto Scaling group.. Distributing EC2 instances across multiple Availability Zones within a single Region using an Auto Scaling group provides high availability against an AZ outage while maintaining low-latency intra-Region communication. If one AZ fails, the ASG can launch replacement instances in surviving AZs, and the ALB routes traffic only to healthy targets. This is the standard AWS-recommended HA pattern.

Answer

Deploy all EC2 instances in a single Availability Zone and configure an AWS Auto Scaling group with a maximum capacity of one.

Answer

Provision EC2 instances in multiple AWS Regions and use Route 53 with a latency routing policy.

Answer

Use a single EC2 instance of a larger size to handle peak traffic loads without scaling.

Question 8

Refer to the exhibit. A company has applied the following bucket policy to an S3 bucket named 'finance-reports'. A user is attempting to download a file from this bucket from the IP address 203.0.113.15 using an authenticated session without MFA. What will be the result of this request?

Accepted Answer

The request will be denied because both conditions must be true for the policy to grant access.. S3 bucket policy conditions are evaluated with AND logic by default — all conditions in a single Condition block must be true for the statement to apply. Since the request comes from an allowed IP but lacks MFA authentication, the Bool condition (aws:MultiFactorAuthPresent = true) fails, so the policy does not grant access and the request is denied.

Answer

The request will be allowed because the IP address is within the allowed range.

Answer

The request will be allowed because the 'Bool' condition is only evaluated if MFA is configured.

Answer

The request will be denied because S3 bucket policies require an explicit 'Deny' statement to block traffic.

Question 9

A company is concerned about unauthorized access and potential data exfiltration within their AWS environment. They need a service that can continuously monitor VPC Flow Logs, AWS CloudTrail management events, and DNS logs to identify suspicious activities using machine learning. Which solution should the architect recommend for centralized threat detection?

Accepted Answer

Enable Amazon GuardDuty and integrate it with AWS Organizations for cross-account visibility.. Amazon GuardDuty is a threat detection service that continuously monitors VPC Flow Logs, AWS CloudTrail management events, and DNS logs using machine learning and threat intelligence to identify suspicious activities. Integrating it with AWS Organizations enables centralized threat detection across all accounts, matching the requirement for cross-account visibility.

Answer

Configure AWS Inspector to perform network reachability assessments on all EC2 instances.

Answer

Deploy AWS Shield Advanced to protect all public-facing endpoints from DDoS attacks.

Answer

Use AWS Config to monitor changes in security group rules and VPC configurations.

Question 10

An organization needs to perform continuous security assessments of its Amazon EC2 instances to identify software vulnerabilities and unintended network exposure. Which service should they use to automate these assessments and provide a centralized view of the findings?

Accepted Answer

Amazon Inspector to automatically discover and scan EC2 instances for vulnerabilities.. Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. It is particularly effective for EC2 instances as it can scan both the operating system and the installed applications, providing detailed findings and remediation advice to improve the security posture.

Answer

AWS Trusted Advisor to check for security groups that allow unrestricted access.

Answer

AWS CloudTrail to monitor and log all API calls made to the EC2 instances.

Answer

VPC Flow Logs to analyze traffic patterns and identify potential security threats.