SAA-C03 Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. An application running on EC2 needs to store backups in an S3 bucket. The administrator applied the policy in the exhibit, but the EC2 instance cannot upload objects. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The resource ARN must include the bucket name without the wildcards.. The s3:PutObject action is an object-level permission that requires the resource ARN to include a wildcard suffix (e.g., arn:aws:s3:::bucket-name/*) to specify the objects within the bucket. If the ARN only specifies the bucket itself (arn:aws:s3:::bucket-name), the put operation will be denied.

Answer

The policy is missing the s3:ListBucket permission.

Answer

The policy is missing a Deny statement to prevent unauthorized access.

Answer

The action s3:PutObject is not supported for S3 buckets.

Question 2

A research firm is running a tightly coupled High Performance Computing (HPC) workload on AWS using EC2 instances. The firm needs to minimize network latency and maximize inter-node communication speed. Which network enhancement should the architect recommend?

Accepted Answer

Deploy the instances using an Elastic Fabric Adapter (EFA).. Elastic Fabric Adapter (EFA) is a network interface for Amazon EC2 instances that enables customers to run applications requiring high levels of inter-node communications at scale. It uses a custom protocol to provide lower and more consistent latency than traditional TCP/IP stacks used in standard networking.

Answer

Enable Enhanced Networking with the Elastic Network Adapter (ENA).

Answer

Use a Spread Placement Group for the EC2 instances.

Answer

Implement AWS Global Accelerator for the cluster.

Question 3

A global gaming company wants to reduce latency for its players who are distributed worldwide. The application uses UDP-based traffic and requires a static entry point to simplify firewall management. Which service should the architect recommend to optimize the network path?

Accepted Answer

AWS Global Accelerator.. AWS Global Accelerator uses the AWS global network to route traffic to the optimal regional endpoint based on health and proximity. Unlike CloudFront, which is primarily for HTTP/S content, Global Accelerator supports non-HTTP protocols like UDP. It provides static IP addresses that act as a fixed entry point, improving performance by keeping traffic on the AWS backbone.

Answer

Amazon CloudFront.

Answer

Amazon Route 53 with Geolocation routing.

Answer

AWS Direct Connect.

Question 4

A large corporation uses AWS Organizations to manage hundreds of accounts. The security team wants to ensure that no account can provision resources in unauthorized regions and that only approved AWS services can be used. Which TWO features should be used to enforce these constraints across the entire organization? (Select TWO.)

Accepted Answer

Service Control Policies (SCPs) applied to the root of the Organization.. Option B is correct because Service Control Policies (SCPs) applied at the organization root set the maximum available permissions for all accounts in the organization, so they can centrally deny access to unapproved AWS services across every member account. Option E is correct because an SCP with a Condition element using the aws:RequestedRegion global condition key can explicitly deny API calls made to regions outside the approved list, enforcing the region restriction organization-wide. Together, SCPs at the root and region-based conditions satisfy both requirements: restricting services and restricting regions for all accounts. Option A is not appropriate because IAM policies in each member account are decentralized, must be maintained per account, and do not act as a guardrail against account administrators granting themselves broader permissions. Option C is incorrect because AWS Resource Access Manager (RAM) shares resources such as subnets or Transit Gateways between accounts; it does not restrict which services or regions can be used. Option D is incorrect because AWS Config rules detect and can remediate noncompliant resources after creation, but they do not prevent provisioning in unauthorized regions the way an SCP deny does.

Answer

IAM Policies attached to each administrative user in every member account.

Answer

AWS Resource Access Manager (RAM) to share authorized services across accounts.

Answer

AWS Config rules to automatically terminate resources in unauthorized regions.

Question 5

A company's public-facing application is experiencing a Distributed Denial of Service (DDoS) attack. The application is hosted on EC2 instances behind an Application Load Balancer (ALB). Which TWO AWS services or features can be used to mitigate this attack and protect the application?

Accepted Answer

AWS Shield Advanced for enhanced DDoS detection and mitigation.. Protecting against DDoS attacks requires a multi-layered approach. AWS Shield provides automatic protection for all AWS customers, while Shield Advanced offers enhanced detection and mitigation for sophisticated attacks. AWS WAF complements this by allowing administrators to create rules that block malicious traffic patterns, such as SQL injection or high-volume IP addresses.

Answer

Amazon GuardDuty to identify and block malicious traffic at the VPC level.

Answer

Amazon Inspector to scan EC2 instances for vulnerabilities during the attack.

Answer

AWS PrivateLink to hide the application from the public internet.

Question 6

Refer to the exhibit. A company is using this S3 bucket policy to secure high-performance data accessed by an analytics fleet on EC2. Users report that despite having the correct IAM permissions, they are receiving 403 Forbidden errors when trying to download data. What is the most likely cause of this performance and access issue?

Accepted Answer

The EC2 instances are not using the specified VPC Endpoint to access S3.. The bucket policy shown in the exhibit restricts access to requests originating from a specific VPC Endpoint (aws:sourceVpce condition). If the EC2 instances are not routing S3 traffic through that endpoint — for example, they are using the public S3 endpoint or a different endpoint — the policy denies the request and S3 returns 403 Forbidden even though the IAM role has s3:GetObject. The fix is to ensure the instances use the specified VPC Endpoint (via route table entries or endpoint policies).

Answer

The S3 bucket is in a different region than the EC2 instances.

Answer

The IAM role assigned to the EC2 instances lacks S3:GetObject permissions.

Answer

The S3 bucket has Object Lock enabled, preventing data retrieval.

Question 7

A company is deploying a global gaming application that uses a custom UDP-based protocol. The application requires low latency and high availability for players worldwide. Which TWO AWS services or features should be used to optimize the network performance and global reach for this application?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator (A) is correct because it provides static anycast IP addresses that route player traffic over the AWS global backbone to the nearest healthy endpoint, reducing latency and jitter for UDP-based traffic while improving availability through health checks and automatic failover. Amazon Route 53 with latency-based routing (D) is correct because it directs each player to the AWS Region with the lowest latency, supporting global reach and high availability for the custom UDP protocol. Amazon CloudFront (B) is not appropriate here because it is a CDN optimized for HTTP/HTTPS caching, not custom UDP protocols. AWS Transit Gateway (C) is a regional VPC-to-VPC and on-premises routing hub, not a global latency optimization service. Application Load Balancer (E) operates at Layer 7 for HTTP/HTTPS and does not support custom UDP protocols, so it cannot meet the requirement.

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Answer

Application Load Balancer (ALB) with cross-zone load balancing

Question 8

A global gaming company needs to provide low-latency access to user profile data for players in North America, Europe, and Asia. The data is stored in an Amazon Aurora MySQL database. The application requires that reads be as local as possible, while writes are infrequent and can tolerate some propagation delay. Which solution offers the best performance?

Accepted Answer

Set up Aurora Global Database with secondary clusters in each required region.. Aurora Global Database is purpose-built for this exact scenario: it replicates data from a primary Aurora cluster to secondary clusters in other regions with typical latency under one second, and the secondary clusters serve low-latency local reads. Because writes are infrequent and can tolerate propagation delay, the asynchronous replication model is acceptable, and each region's application can read from its local secondary cluster endpoint. This delivers the lowest read latency across North America, Europe, and Asia while keeping the source of truth in a single primary region.

Answer

Deploy a single Aurora cluster and use CloudFront to cache database queries.

Answer

Use Cross-Region Read Replicas for standard RDS MySQL instances.

Answer

Implement a DynamoDB Global Table with DAX in every region.

Question 9

A company needs a Disaster Recovery (DR) strategy with an RTO of 30 minutes and an RPO of 15 minutes. They want to minimize costs while having a scaled-down version of their core environment always running in a second region. Which DR strategy should they use?

Accepted Answer

Warm Standby.. A Warm Standby DR strategy involves running a functional but scaled-down version of the application in a separate region. This allows for a very low Recovery Time Objective (RTO) because the core infrastructure is already live. Data is replicated frequently to meet the Recovery Point Objective (RPO) of 15 minutes, providing a balance between cost and speed.

Answer

Backup and Restore.

Answer

Pilot Light.

Answer

Multi-site Active-Active.

Question 10

Refer to the exhibit. The web application is showing high latency and 503 errors. The database CPU usage is low. What is the most likely cause and solution?

Accepted Answer

Implement Amazon RDS Proxy for connection pooling.. The symptoms — high latency, 503 errors, low database CPU — point to connection exhaustion rather than compute saturation. Each application instance opening its own database connections can exhaust the RDS max_connections limit, causing new connections to be refused and 503s to surface at the web tier. Amazon RDS Proxy pools and multiplexes connections, allowing many application connections to share a smaller set of database connections, which resolves the bottleneck without scaling the database.

Answer

Increase the RDS instance size to handle more connections.

Answer

Enable Multi-AZ failover to distribute the load.

Answer

Add more read replicas to the RDS cluster.

Question 11

An application has been migrated to AWS, but the performance is inconsistent. The architect finds that the application uses a legacy database driver that requires persistent connections, which is exhausting database connections. What is the best way to handle this?

Accepted Answer

Use Amazon RDS Proxy.. Amazon RDS Proxy sits between the application and the database, pooling and reusing persistent connections so that many application connections map to a small number of database connections. This directly addresses the legacy driver's persistent-connection behavior that is exhausting the database's connection limit, without requiring application changes.

Answer

Increase the max_connections parameter.

Answer

Implement a local database connection pooler.

Answer

Migrate to Amazon Aurora Serverless.

Question 12

Refer to the exhibit. A solutions architect reviewed an AWS CloudFormation template used to deploy an Auto Scaling group for a production web application. During an AWS Availability Zone outage in us-east-1, users experienced partial application downtime even though the Auto Scaling group reported instances running. Why is this architecture failing resiliency best practices?

Accepted Answer

The Auto Scaling group defines Availability Zones directly instead of referencing subnets across multiple zones.. For an Auto Scaling group to survive an Availability Zone outage, it must launch instances across multiple subnets in different AZs. When the ASG specifies Availability Zones directly (or uses a single subnet), all instances land in one AZ, so an AZ failure takes down the entire fleet even though the ASG still reports 'running' instances in the failed zone. Referencing subnets across multiple AZs lets the ASG rebalance and launch replacements in healthy zones.

Answer

The Launch Template version is hardcoded to version 1 instead of using $Latest or $Default.

Answer

The MinSize and DesiredCapacity are set too low to handle sudden spikes in traffic during an outage.

Answer

The Auto Scaling group is missing a health check type configuration set to ELB instead of EC2.

Question 13

A media streaming company stores high-value video assets in an Amazon S3 bucket. The company requires a resilient storage architecture that protects against accidental deletion, malicious overwrites, and zonal or regional outages. Which combinations of features should a Solutions Architect implement to achieve these requirements? (Choose TWO.)

Accepted Answer

Enable S3 Versioning on the bucket and configure MFA Delete to prevent accidental or malicious deletion of object versions.. Enabling S3 Versioning ensures that previous versions are retained when objects are deleted or overwritten, protecting against accidental data loss. Furthermore, replicating objects to another AWS Region using S3 Cross-Region Replication guarantees durability and availability against catastrophic regional disruptions, satisfying robust disaster recovery best practices for critical media assets.

Answer

Configure Amazon S3 Intelligent-Tiering to automatically move infrequently accessed video assets to lower-cost storage tiers.

Answer

Attach a resource-based bucket policy that explicitly denies all delete object requests from any IAM user except the root account.

Answer

Enable S3 Object Lock in governance mode with a fixed retention period of 30 days for all uploaded video files.

Question 14

A company is running an Amazon RDS for MySQL database that experiences predictable, steady traffic during business hours and very low traffic at night. They want to reduce costs without compromising performance. Which TWO steps should the architect take? (Select TWO.)

Accepted Answer

Purchase Reserved Instances for the RDS DB instances.. Reserved Instances provide significant discounts for steady-state workloads with a long-term commitment. For the variable nature of the workload, migrating to Aurora Serverless v2 allows the database to scale capacity up and down automatically based on demand, ensuring they only pay for the resources consumed during high and low traffic periods.

Answer

Use Multi-AZ deployments for all read-only workloads.

Answer

Switch to an Amazon RDS Custom for MySQL instance.

Answer

Enable Provisioned IOPS (PIOPS) for all storage volumes.

Question 15

Refer to the exhibit. A company wants to optimize the performance and security of data transfers between their EC2 instances and an S3 bucket named 'my-app-data'. Which architectural benefit is primarily achieved by implementing the policy shown in the exhibit?

Accepted Answer

It ensures traffic remains on the private AWS network, reducing latency.. The policy shown is a VPC endpoint policy (or an S3 bucket policy restricting access to a VPC endpoint), which forces traffic between EC2 and S3 to traverse the AWS private backbone via a Gateway or Interface VPC Endpoint instead of the public internet. This keeps traffic on the private AWS network, reducing latency, avoiding NAT gateway data-processing charges, and improving security posture.

Answer

It enables S3 Transfer Acceleration for faster global uploads.

Answer

It provides cross-region replication for high availability of data.

Answer

It allows public access to the bucket for faster content delivery.

Question 16

A company wants to secure its S3 data. The security policy requires that all objects be encrypted at rest and that the company retains full control over the rotation of the encryption keys. Which TWO of the following should the architect choose to satisfy these requirements?

Accepted Answer

Use AWS KMS with Customer Managed Keys (SSE-KMS).. Option B (SSE-KMS with Customer Managed Keys) is correct because customer managed keys in AWS KMS give the company control over key rotation, either through automatic annual rotation or manual rotation, while still encrypting all objects at rest with a KMS key. Option E (a Key Policy for the KMS CMK) is correct because the key policy is the primary access control mechanism for a customer managed key, defining which principals can use and manage the key, which is essential to retaining full control over the encryption keys. Option A (SSE-S3) is incorrect because Amazon S3 managed keys are rotated automatically by AWS and the customer has no control over rotation. Option C (aws:SecureTransport bucket policy) is incorrect because it only enforces encryption in transit via TLS, not encryption at rest or key rotation control. Option D (versioning) is incorrect because versioning preserves object versions for durability and recovery, not historical key state or key rotation control.

Answer

Enable Amazon S3 Managed Keys (SSE-S3).

Answer

Configure S3 Bucket Policies to enforce the 'aws:SecureTransport' condition.

Answer

Enable versioning on the S3 bucket to ensure historical key state preservation.

Question 17

An organization is using AWS Control Tower to manage multiple AWS accounts. They need to implement a set of guardrails to ensure that all accounts remain compliant with security best practices. Which THREE components or features are part of a standard AWS Control Tower landing zone implementation?

Accepted Answer

Preventive guardrails implemented using Service Control Policies (SCPs).. Option A is correct because AWS Control Tower preventive guardrails are enforced through Service Control Policies (SCPs) attached to OUs, which restrict what actions member accounts can perform. Option B is correct because detective guardrails in Control Tower are implemented as AWS Config rules (often deployed via conformance packs) that detect and flag noncompliant resources. Option C is correct because a standard Control Tower landing zone provisions a dedicated log archive account for centralized logging and an audit (security tooling) account for security and compliance tooling. Option D is incorrect because Amazon Macie is not enabled by default on all S3 buckets as part of the landing zone; it is an optional data-security service. Option E is incorrect because GuardDuty is not automatically enabled across all accounts by Control Tower itself; it can be integrated via services like AWS Security Hub or delegated administration, but it is not a built-in landing zone component.

Answer

Amazon Macie enabled by default on all S3 buckets in member accounts.

Answer

Amazon GuardDuty for automated threat detection across all accounts.

Question 18

A company wants to ensure high availability for their application. Which THREE of these services are inherently regional in their high-availability configuration?

Accepted Answer

Amazon S3.. Amazon S3 (A) is inherently regional in its high-availability design because it automatically replicates objects across multiple Availability Zones within a single AWS Region, providing 99.999999999% durability without any cross-region configuration. Amazon RDS (C) achieves high availability regionally through Multi-AZ deployments, which synchronously replicate data to a standby instance in a different Availability Zone within the same Region. Amazon DynamoDB (D) is also inherently regional, as it automatically replicates table data across three Availability Zones within a Region by default, delivering built-in high availability. Amazon EC2 (B) is not inherently regional for HA because an individual instance runs in a single Availability Zone; regional resilience requires the customer to architect across multiple AZs using load balancers and Auto Scaling. Amazon EBS (E) is not inherently regional either, since an EBS volume is tied to a single Availability Zone and only achieves AZ-level redundancy through snapshots or replication that the customer must configure.

Answer

Amazon EC2.

Answer

Amazon EBS.

Question 19

A company is migrating a monolithic application to microservices. The services are experiencing performance issues due to excessive inter-service communication overhead. Which architecture pattern should they adopt to improve performance?

Answer

Use an Amazon API Gateway.

Answer

Increase the number of instances for every service.

Answer

Switch to a synchronous REST API structure.

Answer

Move all services back to a single instance.

Question 20

Refer to the exhibit. An IAM user has the following policy attached. The user attempts to download a file named 'config.json' located in the 'secrets' folder of the 'app-logs' S3 bucket. What will be the result of this action?

Accepted Answer

Access is denied because an explicit deny overrides any allow statement.. The prompt references an exhibit with an IAM user policy, but no exhibit or policy text is provided in the stem. Therefore, the question cannot be properly validated.

Answer

Access is allowed because the first statement grants GetObject permissions for the whole bucket.

Answer

Access is denied because the policy does not include the s3:PutObject permission.

Answer

Access is allowed because the ListBucket action permits viewing all objects in the bucket.