SAA-C03 Timed Practice Test 1 — 10 Questions

Question 1

A company wants to ensure that its internal applications can access Amazon S3 without the traffic ever leaving the AWS network or passing through the public internet. What should they implement to achieve this securely?

10 minute time limit — choose an answer to begin.

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and update the route tables.. A VPC Gateway Endpoint for Amazon S3 provides a private, logical connection between a VPC and S3 that keeps traffic on the AWS backbone and never traverses the public internet. Updating route tables to direct S3-bound traffic to the gateway endpoint ensures instances in private subnets reach S3 privately.

Answer

Configure a NAT Gateway in a public subnet to route S3 traffic.

Answer

Use an AWS Direct Connect connection between the VPC and S3.

Answer

Set up a VPN connection between the private subnet and the S3 service.

Question 2

A global e-commerce site uses an Amazon RDS for MySQL database. Users in different regions are complaining about slow page load times when browsing product catalogs. How can the architect improve read performance for global users with minimal changes to the application?

Accepted Answer

Create Read Replicas in different AWS Regions.. Cross-region read replicas allow you to serve read traffic from a location physically closer to your users, reducing latency. This architectural pattern is essential for high-performing global applications where the primary database is located in a single region but the user base is distributed worldwide.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Upgrade the RDS instance to a larger instance class.

Answer

Enable Enhanced Monitoring with a 1-second granularity.

Question 3

A research firm is running a tightly coupled High Performance Computing (HPC) workload on AWS using EC2 instances. The firm needs to minimize network latency and maximize inter-node communication speed. Which network enhancement should the architect recommend?

Accepted Answer

Deploy the instances using an Elastic Fabric Adapter (EFA).. Elastic Fabric Adapter (EFA) is a network interface for Amazon EC2 instances that enables customers to run applications requiring high levels of inter-node communications at scale. It uses a custom protocol to provide lower and more consistent latency than traditional TCP/IP stacks used in standard networking.

Answer

Enable Enhanced Networking with the Elastic Network Adapter (ENA).

Answer

Use a Spread Placement Group for the EC2 instances.

Answer

Implement AWS Global Accelerator for the cluster.

Question 4

A company is hosting a web application on EC2 instances behind an Application Load Balancer. The security team requires that all data in transit between the client and the ALB be encrypted using TLS. Which service should the architect use to manage the SSL/TLS certificates for the ALB?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the managed service designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services like Application Load Balancers, CloudFront, and API Gateway. ACM handles certificate renewal automatically and integrates natively with ALB listeners, making it the correct choice for managing TLS certificates for the ALB.

Answer

AWS Secrets Manager

Answer

AWS Key Management Service (KMS)

Answer

IAM Server Certificate Upload

Question 5

A developer needs to access an Amazon RDS database from an EC2 instance within a private subnet. The database must only accept traffic from the instance. Which security configuration is most appropriate?

Accepted Answer

Configure the RDS security group to allow inbound traffic from the EC2 instance security group ID.. Configuring the RDS Security Group to allow inbound traffic on the database port exclusively from the security group ID associated with the EC2 instance follows the principle of least privilege. This stateful configuration ensures that only authorized resources can communicate with the database, significantly reducing the attack surface. By referencing the security group ID instead of an IP address, the architecture remains resilient to dynamic IP changes.

Answer

Configure the RDS security group to allow inbound traffic from 0.0.0.0/0 on the database port.

Answer

Configure the RDS security group to allow inbound traffic from the database's own IP address.

Answer

Configure the RDS security group to allow inbound traffic from the private IP of the EC2 instance.

Question 6

A company is hosting a multi-tier web application on AWS using Amazon EC2 instances in a private subnet behind an Application Load Balancer (ALB). The security team requires that all incoming web traffic is encrypted in transit from the client to the ALB and from the ALB to the backend EC2 instances. Which combination of configurations meets these requirements?

Accepted Answer

Configure an HTTPS listener on the ALB using an ACM certificate and configure the backend instances to accept HTTPS traffic.. To encrypt traffic from client to ALB, an HTTPS listener with an ACM certificate is required. To encrypt traffic from ALB to backend EC2 instances, the backend must accept HTTPS (TLS) traffic, which means the ALB target group protocol must be HTTPS and the instances must have certificates installed and be listening on the HTTPS port. Option C is the only one that satisfies both requirements.

Answer

Configure an HTTP listener on the ALB and configure the backend instances to accept HTTP traffic on port 80.

Answer

Configure an HTTPS listener on the ALB and route traffic to the backend instances using HTTP on port 80.

Answer

Configure a TCP listener on the ALB and install self-signed certificates directly on the target EC2 instances.

Question 7

A company has several VPCs in the same region that need to access an Amazon S3 bucket for data logging. Currently, data is transferred over the public internet, incurring data transfer charges. What is the most cost-effective way to allow the VPCs to access S3?

Accepted Answer

Create an S3 Gateway Endpoint in each VPC.. S3 Gateway Endpoints are the most cost-effective solution because they are provided at no additional cost and do not incur hourly charges or data processing fees. They allow traffic to stay within the AWS network, eliminating data transfer out charges to the public internet while maintaining high security and performance.

Answer

Deploy a NAT Gateway in each VPC.

Answer

Create an S3 Interface Endpoint (PrivateLink) in each VPC.

Answer

Establish a AWS Direct Connect connection to S3.

Question 8

A solutions architect is designing a batch processing workload that runs for 4 hours every night. The workload can be interrupted and resumed without data loss. Cost optimization is a primary requirement for this deployment.

Accepted Answer

Configure an Auto Scaling group using Amazon EC2 Spot Instances with an appropriate instance diversification strategy.. Spot Instances offer up to 90% discount compared to On-Demand and are ideal for interruptible, resumable batch workloads. Using an Auto Scaling group with instance diversification across multiple instance types and Availability Zones increases the chance of acquiring and retaining Spot capacity, and the workload can tolerate interruptions without data loss. This directly satisfies the cost optimization requirement while maintaining availability.

Answer

Use Amazon EC2 Reserved Instances to cover the nightly batch processing requirements over a one-year term.

Answer

Provision Amazon EC2 On-Demand Instances and terminate them manually through an AWS Lambda script after completion.

Answer

Purchase Amazon EC2 Dedicated Hosts to run the nightly batch processing instances securely and predictably.

Question 9

An application running on Amazon Aurora MySQL experiences significant performance degradation during peak hours due to a surge in read-only traffic. The database currently uses a single primary instance and one replica. What is the most effective way to scale the database for these spikes while maintaining high performance?

Accepted Answer

Configure Aurora Auto Scaling for the Aurora Replicas.. Aurora Auto Scaling automatically adds and removes Aurora Replicas based on metrics like CPU utilization or the number of connections, scaling read capacity in response to demand spikes without manual intervention. This is the most effective solution because it handles peak-hour surges dynamically while maintaining high availability across Availability Zones. Manual scaling (Option A) is reactive and slow, and vertical scaling of the primary (Option C) does not address read traffic distribution.

Answer

Manually add more Aurora Replicas during peak hours.

Answer

Increase the instance size of the primary Aurora instance.

Answer

Use Amazon SQS to buffer incoming read requests.

Question 10

A security engineer needs to block a specific range of malicious IP addresses from accessing an entire subnet within a VPC. The solution must ensure that the traffic is rejected before it reaches any EC2 instances. Which AWS feature should be used to implement this restriction?

Accepted Answer

Network Access Control Lists (NACLs). Network ACLs are stateless, subnet-level firewalls that evaluate traffic before it reaches any EC2 instance, making them the correct tool to block a malicious IP range at the subnet boundary. Because NACLs support explicit deny rules with CIDR ranges, they can reject the traffic before it hits the instances.

Answer

Security Groups

Answer

AWS WAF

Answer

AWS Shield Standard