SAA-C03 Multiple Select — 30 Questions

Question 1

A database administrator needs to ensure that an Amazon RDS for MySQL instance can withstand an Availability Zone failure and provide low-latency reads for a reporting application. Which TWO steps should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Multi-AZ deployment for the RDS instance.. Enabling Multi-AZ provides the high availability needed to survive an AZ failure by maintaining a synchronous standby. Creating a Read Replica in a different AZ offloads read traffic from the primary instance, improving performance for the reporting application while also providing an additional layer of data redundancy across the region.

Answer

Use EBS Snapshots to back up the database every 5 minutes.

Answer

Enable Enhanced Monitoring with a 1-second granularity.

Answer

Implement a Network Load Balancer in front of the RDS instance.

Question 2

A large corporation uses AWS Organizations to manage hundreds of accounts. The security team wants to ensure that no account can provision resources in unauthorized regions and that only approved AWS services can be used. Which TWO features should be used to enforce these constraints across the entire organization? (Select TWO.)

Accepted Answer

Service Control Policies (SCPs) applied to the root of the Organization.. Option B is correct because Service Control Policies (SCPs) applied at the organization root set the maximum available permissions for all accounts in the organization, so they can centrally deny access to unapproved AWS services across every member account. Option E is correct because an SCP with a Condition element using the aws:RequestedRegion global condition key can explicitly deny API calls made to regions outside the approved list, enforcing the region restriction organization-wide. Together, SCPs at the root and region-based conditions satisfy both requirements: restricting services and restricting regions for all accounts. Option A is not appropriate because IAM policies in each member account are decentralized, must be maintained per account, and do not act as a guardrail against account administrators granting themselves broader permissions. Option C is incorrect because AWS Resource Access Manager (RAM) shares resources such as subnets or Transit Gateways between accounts; it does not restrict which services or regions can be used. Option D is incorrect because AWS Config rules detect and can remediate noncompliant resources after creation, but they do not prevent provisioning in unauthorized regions the way an SCP deny does.

Answer

IAM Policies attached to each administrative user in every member account.

Answer

AWS Resource Access Manager (RAM) to share authorized services across accounts.

Answer

AWS Config rules to automatically terminate resources in unauthorized regions.

Question 3

A web application is deployed on Amazon EC2 instances within a private subnet. The application must receive traffic from an Application Load Balancer (ALB) in a public subnet and connect to an Amazon RDS MySQL database in a different private subnet. Which TWO steps are required to secure this architecture using security groups?

Accepted Answer

Configure the EC2 security group to allow inbound traffic on port 80/443 from the ALB security group.. Option A is correct because the EC2 instances must accept HTTP/HTTPS traffic from the ALB, and referencing the ALB's security group as the source on ports 80/443 restricts inbound access to only that load balancer rather than the whole internet. Option B is correct because the application tier must reach the RDS MySQL database on its listener port 3306, and using the EC2 security group as the source in the RDS security group's inbound rule limits database access to only those application instances. Option C is wrong because allowing 0.0.0.0/0 on port 80 would expose the instances directly to the internet, defeating the purpose of placing them in a private subnet behind an ALB. Option D is wrong because security groups are stateful, so return traffic for allowed inbound connections is automatically permitted and no outbound rule to the EC2 instances is needed; moreover, RDS does not initiate connections to the instances. Option E is wrong because it reverses the traffic direction: the ALB receives client traffic from the internet, not from the EC2 instances, so the ALB security group should allow inbound 80/443 from the internet (or appropriate clients), not from the EC2 security group.

Answer

Configure the EC2 security group to allow inbound traffic from 0.0.0.0/0 on port 80 to handle web traffic.

Answer

Configure the RDS security group to allow outbound traffic to the EC2 instances on all ports.

Answer

Configure the ALB security group to allow inbound traffic from the EC2 security group on port 80.

Question 4

A company's public-facing application is experiencing a Distributed Denial of Service (DDoS) attack. The application is hosted on EC2 instances behind an Application Load Balancer (ALB). Which TWO AWS services or features can be used to mitigate this attack and protect the application?

Accepted Answer

AWS Shield Advanced for enhanced DDoS detection and mitigation.. Protecting against DDoS attacks requires a multi-layered approach. AWS Shield provides automatic protection for all AWS customers, while Shield Advanced offers enhanced detection and mitigation for sophisticated attacks. AWS WAF complements this by allowing administrators to create rules that block malicious traffic patterns, such as SQL injection or high-volume IP addresses.

Answer

Amazon GuardDuty to identify and block malicious traffic at the VPC level.

Answer

Amazon Inspector to scan EC2 instances for vulnerabilities during the attack.

Answer

AWS PrivateLink to hide the application from the public internet.

Question 5

An architect is designing a secure VPC architecture. Which TWO actions should be taken to ensure the infrastructure is compliant with security best practices regarding network isolation?

Accepted Answer

Use Network ACLs as a stateless firewall for subnet-level traffic control.. Option B is correct because Network ACLs are stateless, subnet-level firewalls that evaluate inbound and outbound rules independently, providing an additional layer of traffic control for network isolation in a VPC. Option D is correct because Security Groups are stateful, instance-level firewalls that automatically allow return traffic for permitted connections, which is a fundamental AWS best practice for controlling access to EC2 instances. Option A is incorrect because placing all EC2 instances in a public subnet exposes them directly to the internet and violates network isolation best practices; instances that don't need public access should reside in private subnets. Option C is incorrect because allowing all traffic from 0.0.0.0/0 on all ports effectively disables firewall protection and is a severe security misconfiguration. Option E is incorrect because disabling VPC Flow Logs removes valuable network traffic visibility needed for monitoring, auditing, and incident response, and cost reduction should not come at the expense of security observability.

Answer

Place all EC2 instances in the public subnet to maximize accessibility.

Answer

Configure Security Groups to allow all traffic (0.0.0.0/0) on all ports.

Answer

Disable VPC Flow Logs to reduce the storage costs in S3.

Question 6

A media streaming company stores high-value video assets in an Amazon S3 bucket. The company requires a resilient storage architecture that protects against accidental deletion, malicious overwrites, and zonal or regional outages. Which combinations of features should a Solutions Architect implement to achieve these requirements? (Choose TWO.)

Accepted Answer

Enable S3 Versioning on the bucket and configure MFA Delete to prevent accidental or malicious deletion of object versions.. Enabling S3 Versioning ensures that previous versions are retained when objects are deleted or overwritten, protecting against accidental data loss. Furthermore, replicating objects to another AWS Region using S3 Cross-Region Replication guarantees durability and availability against catastrophic regional disruptions, satisfying robust disaster recovery best practices for critical media assets.

Answer

Configure Amazon S3 Intelligent-Tiering to automatically move infrequently accessed video assets to lower-cost storage tiers.

Answer

Attach a resource-based bucket policy that explicitly denies all delete object requests from any IAM user except the root account.

Answer

Enable S3 Object Lock in governance mode with a fixed retention period of 30 days for all uploaded video files.

Question 7

An application requires extremely high I/O performance for temporary data processing that can be lost if the instance fails. The architect is considering using EC2 Instance Store. Which TWO statements correctly describe the performance and characteristics of Instance Store volumes?

Accepted Answer

Instance store provides higher I/O performance compared to EBS.. EC2 Instance Store provides high-performance, local block-level storage that is physically attached to the host computer. This makes it ideal for temporary storage of information that changes frequently, such as buffers, caches, and scratch space. Architects must account for its ephemeral nature while leveraging its superior I/O capabilities for high-performance workloads.

Answer

Data is preserved when the instance is stopped and started.

Answer

Volumes can be detached and reattached to different instances.

Answer

Storage capacity can be increased without stopping the instance.

Question 8

A company is running an Amazon RDS for MySQL database that experiences predictable, steady traffic during business hours and very low traffic at night. They want to reduce costs without compromising performance. Which TWO steps should the architect take? (Select TWO.)

Accepted Answer

Purchase Reserved Instances for the RDS DB instances.. Reserved Instances provide significant discounts for steady-state workloads with a long-term commitment. For the variable nature of the workload, migrating to Aurora Serverless v2 allows the database to scale capacity up and down automatically based on demand, ensuring they only pay for the resources consumed during high and low traffic periods.

Answer

Use Multi-AZ deployments for all read-only workloads.

Answer

Switch to an Amazon RDS Custom for MySQL instance.

Answer

Enable Provisioned IOPS (PIOPS) for all storage volumes.

Question 9

An organization is using AWS Control Tower to manage multiple AWS accounts. They need to implement a set of guardrails to ensure that all accounts remain compliant with security best practices. Which THREE components or features are part of a standard AWS Control Tower landing zone implementation?

Accepted Answer

Preventive guardrails implemented using Service Control Policies (SCPs).. Option A is correct because AWS Control Tower preventive guardrails are enforced through Service Control Policies (SCPs) attached to OUs, which restrict what actions member accounts can perform. Option B is correct because detective guardrails in Control Tower are implemented as AWS Config rules (often deployed via conformance packs) that detect and flag noncompliant resources. Option C is correct because a standard Control Tower landing zone provisions a dedicated log archive account for centralized logging and an audit (security tooling) account for security and compliance tooling. Option D is incorrect because Amazon Macie is not enabled by default on all S3 buckets as part of the landing zone; it is an optional data-security service. Option E is incorrect because GuardDuty is not automatically enabled across all accounts by Control Tower itself; it can be integrated via services like AWS Security Hub or delegated administration, but it is not a built-in landing zone component.

Answer

Amazon Macie enabled by default on all S3 buckets in member accounts.

Answer

Amazon GuardDuty for automated threat detection across all accounts.

Question 10

A research institution is running a High Performance Computing (HPC) workload on AWS that requires a POSIX-compliant file system capable of millions of IOPS and sub-millisecond latencies. Which TWO storage options are most appropriate for this use case?

Accepted Answer

Amazon FSx for Lustre.. Amazon FSx for Lustre (A) is correct because it is a POSIX-compliant, high-performance file system purpose-built for HPC, delivering millions of IOPS and sub-millisecond latencies, and it integrates with S3 for data staging. EC2 Instance Store with a clustered file system (D) is correct because instance store volumes are physically attached NVMe SSDs offering the lowest latency and highest IOPS, and a clustered file system (e.g., Lustre, GPFS) can aggregate them across nodes for shared POSIX access. Amazon S3 with S3 Select (B) is object storage, not POSIX-compliant, and cannot meet sub-millisecond latency requirements. Amazon FSx for Windows File Server (C) uses SMB and is designed for Windows workloads, not high-IOPS POSIX HPC. Amazon EFS General Purpose mode (E) is POSIX-compliant but its latency and throughput are far below the millions of IOPS and sub-millisecond requirements of this workload.

Answer

Amazon S3 with S3 Select.

Answer

Amazon FSx for Windows File Server.

Answer

Amazon EFS in General Purpose mode.

Question 11

A company is building a zero-trust architecture for its internal microservices running on Amazon EKS. Which THREE steps should the solutions architect take to ensure secure, least-privilege communication between services? (Select THREE)

Accepted Answer

Assign IAM Roles to individual Kubernetes Service Accounts (IRSA).. Option A is correct because IAM Roles for Service Accounts (IRSA) lets each Kubernetes Service Account assume a distinct IAM role via the EKS OIDC provider, so individual microservices receive only the AWS permissions they need, which is a core least-privilege control in a zero-trust model. Option B is correct because AWS App Mesh enforces mutual TLS (mTLS) between microservices, providing cryptographic identity verification and encrypted service-to-service traffic so that no service is trusted merely by network location. Option C is correct because Security Groups for Pods (using the VPC CNI and ENI trunking) applies EC2 security group rules directly to pod ENIs, enabling fine-grained, least-privilege network segmentation between specific services. Option D is not appropriate because placing all microservices in a single public subnet exposes them to the internet and removes the network segmentation that zero-trust requires. Option E is not appropriate because disabling VPC Flow Logs reduces visibility and auditability of traffic, which is essential for detecting and investigating lateral movement in a zero-trust architecture.

Answer

Place all microservices in a single public subnet to simplify routing.

Answer

Disable VPC Flow Logs to reduce latency between microservices.

Question 12

An architect is designing a secure storage solution for highly sensitive financial data in S3. Which THREE security controls should be implemented? (Select THREE.)

Accepted Answer

Enable S3 Block Public Access at the account level.. Option A is correct because enabling S3 Block Public Access at the account level applies account-wide guardrails that override bucket policies and ACLs, preventing any bucket or object from being made public—an essential baseline for highly sensitive financial data. Option B is correct because AWS KMS with Customer Managed Keys (CMKs) gives the organization control over the key policy, rotation, and grants, providing encryption at rest with auditable key usage via CloudTrail, which is required for regulated financial data. Option C is correct because bucket policies using the aws:SecureTransport condition (e.g., "aws:SecureTransport": "false" with Deny) enforce HTTPS/TLS for all requests, preventing data in transit from being exposed over plain HTTP. Option D is incorrect because granting all users in the organization full access violates least privilege and would allow unauthorized or accidental modification or exfiltration of sensitive data. Option E is incorrect because storing data in a public bucket exposes it to the internet and directly contradicts the requirement for a secure storage solution.

Answer

Allow all users in the organization to have full access.

Answer

Store data in a public bucket for easier access.

Question 13

A security auditor requires that all EC2 instances must be running with specific software versions and that any instance not compliant with these versions must be automatically terminated. Which THREE services should be used to achieve this? (Select THREE.)

Accepted Answer

AWS Systems Manager Inventory.. Combining AWS Systems Manager for inventory and automation, AWS Config for continuous compliance monitoring, and Lambda for remediation provides a fully automated governance framework. This approach ensures that the environment is continuously scanned for drift, and non-compliant resources are immediately addressed without human intervention. This setup is crucial for meeting strict regulatory requirements where automated enforcement of security and operational standards is mandatory across a large-scale AWS environment.

Answer

AWS Trusted Advisor.

Answer

AWS CloudFront.

Question 14

A company is migrating a high-traffic web application to AWS. The application uses an Amazon RDS for MySQL database. The database experience high read pressure during business hours, but write activity remains consistent and low. Which TWO architectural changes will reduce costs while maintaining performance? (Select TWO.)

Accepted Answer

Create RDS Read Replicas and update the application to split read and write traffic.. Offloading read traffic to Read Replicas is more cost-effective than scaling up the primary instance size, as it allows for horizontal scaling of reads. Additionally, using Multi-AZ deployments for the primary instance ensures high availability, while Read Replicas can be placed in different regions or zones to distribute the load without over-provisioning the main database.

Answer

Scale up the primary RDS instance to a larger instance class with more RAM.

Answer

Switch the database to Amazon RDS for SQL Server to take advantage of License Inclusion.

Answer

Enable Multi-AZ for all Read Replicas to ensure high availability.

Question 15

An enterprise organization is planning a centralized logging architecture across hundreds of AWS accounts using AWS CloudTrail and Amazon S3. Security mandates state that all log files delivered to the centralized S3 bucket must be cryptographically verified to ensure they have not been modified or tampered with after delivery. Which TWO actions must a Solutions Architect implement to achieve this mandate? (Choose two.)

Accepted Answer

Enable CloudTrail log file integrity validation on each trail.. Option A is correct because CloudTrail log file integrity validation is the feature that produces a digest file for each delivered log file, containing a digital signature (SHA-256 hash signed with a private key) that allows detection of any modification, deletion, or tampering after delivery. Option E is correct because enabling validation alone only generates the digests; the architect must actually validate them by running AWS CLI commands such as 'aws cloudtrail validate-logs' (or SDK equivalents) against the S3 bucket to cryptographically confirm the log files match their digests. Option B is not correct because S3 Object Lock prevents deletion or overwrite of objects going forward but does not cryptographically prove that a delivered log file's contents are unmodified. Option C is not correct because KMS encryption with key rotation protects data confidentiality and key hygiene, not post-delivery tamper detection. Option D is not correct because S3 Versioning preserves prior object versions but does not itself verify the integrity or authenticity of log file contents.

Answer

Configure S3 Object Lock in compliance mode on the centralized logging bucket.

Answer

Use AWS KMS customer managed keys with automatic key rotation enabled for S3 bucket encryption.

Answer

Enable Amazon S3 Versioning on the centralized logging bucket to preserve previous object iterations.

Question 16

A solutions architect is designing a caching layer for a high-traffic web application that uses a multi-node cluster. The architect needs to ensure high availability and the ability to scale horizontally while supporting complex data types such as sorted sets and lists. Which TWO features of Amazon ElastiCache for Redis support these requirements?

Accepted Answer

Multi-AZ with automatic failover.. Option A (Multi-AZ with automatic failover) is correct because ElastiCache for Redis supports replication groups with a primary node and one or more read replicas across Availability Zones; if the primary fails, ElastiCache automatically promotes a replica, providing the high availability the multi-node cluster requires. Option C (Redis Cluster mode for horizontal scaling) is correct because cluster mode shards data across up to 500 shards (nodes), enabling horizontal scaling of both storage and throughput while still supporting complex Redis data structures such as sorted sets and lists. Option B is not correct because ElastiCache for Redis is fundamentally single-threaded for command execution (multi-threaded I/O exists in some versions, but it is not the feature that delivers HA or horizontal scaling here). Option D is not correct because ElastiCache does not provide automatic data compression at the cache level as a feature for this scenario. Option E is not correct because Redis communicates over TCP, not UDP, and UDP would not provide reliable low-latency writes.

Answer

Support for multi-threaded execution.

Answer

Automatic data compression at the cache level.

Answer

Use of UDP protocol for low-latency writes.

Question 17

A security architect is designing a multi-tier application in a VPC. The requirement is to block all traffic from a specific range of malicious IP addresses (CIDR 192.0.2.0/24) while allowing standard web traffic (HTTPS) from all other sources to the web tier. Which TWO actions should the architect take to implement this? (Select TWO.)

Accepted Answer

Create an inbound rule in the Network ACL to deny traffic from 192.0.2.0/24.. Option A is correct because Network ACLs are stateless, subnet-level firewalls that support explicit deny rules, so an inbound deny rule for 192.0.2.0/24 blocks that malicious CIDR before it can reach any resource in the subnet. Option D is correct because Security Groups are stateful, instance-level firewalls that only support allow rules, so permitting inbound TCP port 443 from 0.0.0.0/0 allows standard HTTPS web traffic from all other sources to the web tier. Together these satisfy both requirements: the NACL denies the malicious range while the Security Group allows HTTPS from everywhere else. Option B is wrong because Security Groups cannot contain deny rules; they are allow-only. Option C is wrong because AWS Shield Standard provides automatic protection against common DDoS attacks and does not let you block a specific CIDR like 192.0.2.0/24. Option E is wrong because route tables control routing, not inbound filtering, and blackholing a destination CIDR would not block inbound traffic from that source to the web tier.

Answer

Add a deny rule to the web tier Security Group for CIDR 192.0.2.0/24.

Answer

Configure AWS Shield Standard to automatically block the 192.0.2.0/24 subnet.

Answer

Update the VPC Route Table to blackhole all traffic destined for 192.0.2.0/24.

Question 18

An organization wants to identify and eliminate waste in their AWS account. They are specifically looking for idle resources that are still incurring charges. Which THREE AWS tools or features can help identify these cost-optimization opportunities?

Accepted Answer

AWS Trusted Advisor.. AWS Trusted Advisor (A) is correct because its Cost Optimization checks specifically flag idle or underutilized resources that still incur charges, such as unassociated Elastic IP addresses, idle load balancers, and underutilized Amazon EC2 instances. AWS Compute Optimizer (B) is correct because it analyzes CloudWatch metrics to generate recommendations for over-provisioned resources, including idle or underutilized EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions, directly surfacing cost-optimization opportunities. AWS Cost Explorer Rightsizing Recommendations (C) is correct because it uses historical utilization data to recommend resizing or terminating idle/underutilized EC2 instances, helping eliminate waste from over-provisioned compute. AWS CloudTrail (D) is not correct because it records API activity for auditing, security, and compliance, not for identifying idle resources or cost waste. Amazon Inspector (E) is not correct because it is a vulnerability management service that scans workloads for security exposures, not a cost-optimization or idle-resource detection tool.

Answer

AWS CloudTrail.

Answer

Amazon Inspector.

Question 19

An organization needs to improve the resilience of its EC2-based application. Which THREE actions should the architect perform? (Select THREE.)

Accepted Answer

Distribute EC2 instances across multiple Availability Zones.. Option A is correct because distributing EC2 instances across multiple Availability Zones ensures the application survives the failure of an entire AZ, since each AZ has independent power, cooling, and networking. Option B is correct because an Auto Scaling group continuously performs health checks and automatically replaces unhealthy instances, restoring capacity without manual intervention. Option D is correct because load balancer health checks detect unhealthy targets and stop routing traffic to them, so users are only sent to functioning instances. Option C is wrong because a single large instance is a single point of failure and does not improve resilience. Option E is wrong because a fixed-capacity Auto Scaling group cannot scale out to absorb load or compensate for lost capacity, so it does not meaningfully improve resilience.

Answer

Use a single large EC2 instance instead of multiple smaller ones.

Answer

Place all instances in a single Auto Scaling group with a fixed capacity.

Question 20

A company needs to store database credentials for an application running on Amazon ECS. The credentials must be encrypted and automatically rotated every 30 days without requiring an application restart. Which TWO AWS services should be used together to achieve this? (Select TWO)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (A) is correct because it is purpose-built to store and encrypt database credentials and natively supports automatic rotation on a schedule such as every 30 days, so the ECS application can retrieve the latest secret without a restart. AWS Lambda (B) is correct because Secrets Manager rotation is implemented by a Lambda rotation function that performs the four-step rotation (createSecret, setSecret, testSecret, finishSecret) against the database. AWS Systems Manager Parameter Store (C) can hold encrypted parameters but does not provide built-in automatic rotation, so it does not meet the 30-day rotation requirement. AWS Key Management Service (D) provides the encryption keys used by Secrets Manager but is not itself a secret store or rotation scheduler, so it is not one of the two services to use together. Amazon DynamoDB (E) is a NoSQL database service and has no role in storing or rotating application credentials.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

Amazon DynamoDB