SAA-C03 Timed Practice Test 3 — 10 Questions

Question 1

Refer to the exhibit. A company is using this S3 bucket policy to secure high-performance data accessed by an analytics fleet on EC2. Users report that despite having the correct IAM permissions, they are receiving 403 Forbidden errors when trying to download data. What is the most likely cause of this performance and access issue?

10 minute time limit — choose an answer to begin.

Accepted Answer

The EC2 instances are not using the specified VPC Endpoint to access S3.. The bucket policy shown in the exhibit restricts access to requests originating from a specific VPC Endpoint (aws:sourceVpce condition). If the EC2 instances are not routing S3 traffic through that endpoint — for example, they are using the public S3 endpoint or a different endpoint — the policy denies the request and S3 returns 403 Forbidden even though the IAM role has s3:GetObject. The fix is to ensure the instances use the specified VPC Endpoint (via route table entries or endpoint policies).

Answer

The S3 bucket is in a different region than the EC2 instances.

Answer

The IAM role assigned to the EC2 instances lacks S3:GetObject permissions.

Answer

The S3 bucket has Object Lock enabled, preventing data retrieval.

Question 2

An architect is designing a secure VPC architecture. Which TWO actions should be taken to ensure the infrastructure is compliant with security best practices regarding network isolation?

Accepted Answer

Use Network ACLs as a stateless firewall for subnet-level traffic control.. Option B is correct because Network ACLs are stateless, subnet-level firewalls that evaluate inbound and outbound rules independently, providing an additional layer of traffic control for network isolation in a VPC. Option D is correct because Security Groups are stateful, instance-level firewalls that automatically allow return traffic for permitted connections, which is a fundamental AWS best practice for controlling access to EC2 instances. Option A is incorrect because placing all EC2 instances in a public subnet exposes them directly to the internet and violates network isolation best practices; instances that don't need public access should reside in private subnets. Option C is incorrect because allowing all traffic from 0.0.0.0/0 on all ports effectively disables firewall protection and is a severe security misconfiguration. Option E is incorrect because disabling VPC Flow Logs removes valuable network traffic visibility needed for monitoring, auditing, and incident response, and cost reduction should not come at the expense of security observability.

Answer

Place all EC2 instances in the public subnet to maximize accessibility.

Answer

Configure Security Groups to allow all traffic (0.0.0.0/0) on all ports.

Answer

Disable VPC Flow Logs to reduce the storage costs in S3.

Question 3

A data analytics company stores massive amounts of data in Amazon S3. They need a way to automatically identify and flag sensitive data, such as Personally Identifiable Information (PII) or financial records, to ensure it is not being mishandled. Which AWS service is designed for this task?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service. It uses machine learning and pattern matching to automatically discover and protect sensitive data in Amazon S3. Macie provides a dashboard and findings that alert the security team to PII, helping them maintain data privacy compliance.

Answer

Amazon GuardDuty

Answer

AWS Glue

Answer

Amazon Inspector

Question 4

A startup is launching a new application with a microservices architecture. One specific service is an API that is only called a few dozen times per day. The execution time is always under 10 seconds. Which compute service would be the most cost-effective for this microservice?

Accepted Answer

AWS Lambda.. AWS Lambda is the most cost-effective choice because it charges only for the compute time consumed per invocation, with no charge when the function is idle. An API called a few dozen times per day with sub-10-second execution fits well within Lambda's 15-minute limit and free tier. There is no need to pay for a continuously running instance or container, making Lambda far cheaper than EC2, Fargate, or Lightsail for this sporadic workload.

Answer

Amazon EC2 T3-micro instances.

Answer

Amazon ECS on AWS Fargate.

Answer

Amazon Lightsail.

Question 5

A global gaming company needs to provide low-latency access to user profile data for players in North America, Europe, and Asia. The data is stored in an Amazon Aurora MySQL database. The application requires that reads be as local as possible, while writes are infrequent and can tolerate some propagation delay. Which solution offers the best performance?

Accepted Answer

Set up Aurora Global Database with secondary clusters in each required region.. Aurora Global Database is purpose-built for this exact scenario: it replicates data from a primary Aurora cluster to secondary clusters in other regions with typical latency under one second, and the secondary clusters serve low-latency local reads. Because writes are infrequent and can tolerate propagation delay, the asynchronous replication model is acceptable, and each region's application can read from its local secondary cluster endpoint. This delivers the lowest read latency across North America, Europe, and Asia while keeping the source of truth in a single primary region.

Answer

Deploy a single Aurora cluster and use CloudFront to cache database queries.

Answer

Use Cross-Region Read Replicas for standard RDS MySQL instances.

Answer

Implement a DynamoDB Global Table with DAX in every region.

Question 6

A company needs a Disaster Recovery (DR) strategy with an RTO of 30 minutes and an RPO of 15 minutes. They want to minimize costs while having a scaled-down version of their core environment always running in a second region. Which DR strategy should they use?

Accepted Answer

Warm Standby.. A Warm Standby DR strategy involves running a functional but scaled-down version of the application in a separate region. This allows for a very low Recovery Time Objective (RTO) because the core infrastructure is already live. Data is replicated frequently to meet the Recovery Point Objective (RPO) of 15 minutes, providing a balance between cost and speed.

Answer

Backup and Restore.

Answer

Pilot Light.

Answer

Multi-site Active-Active.

Question 7

A developer is using an EC2 instance to process images. The images are stored in an S3 bucket. The developer notices that the network transfer between S3 and the EC2 instance is the bottleneck. How can the developer resolve this?

Accepted Answer

Use an Amazon S3 Gateway Endpoint.. An Amazon S3 Gateway Endpoint allows EC2 instances in a VPC to access S3 without traversing the public internet or a NAT gateway. Traffic stays within the AWS network, which can reduce latency and improve throughput, resolving the network bottleneck. It also eliminates data transfer costs associated with NAT gateways.

Answer

Increase the EC2 instance size.

Answer

Enable S3 Transfer Acceleration.

Answer

Use CloudFront to cache the images.

Question 8

Refer to the exhibit. The web application is showing high latency and 503 errors. The database CPU usage is low. What is the most likely cause and solution?

Accepted Answer

Implement Amazon RDS Proxy for connection pooling.. The symptoms — high latency, 503 errors, low database CPU — point to connection exhaustion rather than compute saturation. Each application instance opening its own database connections can exhaust the RDS max_connections limit, causing new connections to be refused and 503s to surface at the web tier. Amazon RDS Proxy pools and multiplexes connections, allowing many application connections to share a smaller set of database connections, which resolves the bottleneck without scaling the database.

Answer

Increase the RDS instance size to handle more connections.

Answer

Enable Multi-AZ failover to distribute the load.

Answer

Add more read replicas to the RDS cluster.

Question 9

A company wants to ensure that no developer can create an Amazon S3 bucket in any AWS region except for us-east-1 and us-west-2 across their entire AWS Organization. Which solution provides the most efficient and centralized way to enforce this across all member accounts?

Accepted Answer

Attach a Service Control Policy (SCP) to the organization root that denies s3:CreateBucket if the region is not us-east-1 or us-west-2.. A Service Control Policy (SCP) attached to the organization root applies to all member accounts and can deny s3:CreateBucket when the requested region is not us-east-1 or us-west-2. SCPs are the centralized, efficient way to enforce guardrails across an AWS Organization, affecting all principals without per-account changes.

Answer

Apply an IAM policy to every developer user in each account that denies s3:CreateBucket in restricted regions.

Answer

Configure an S3 bucket policy on all existing buckets to prevent the creation of new buckets in other regions.

Answer

Enable AWS Config in all accounts and create a custom rule to delete any bucket created in a restricted region.

Question 10

An application has been migrated to AWS, but the performance is inconsistent. The architect finds that the application uses a legacy database driver that requires persistent connections, which is exhausting database connections. What is the best way to handle this?

Accepted Answer

Use Amazon RDS Proxy.. Amazon RDS Proxy sits between the application and the database, pooling and reusing persistent connections so that many application connections map to a small number of database connections. This directly addresses the legacy driver's persistent-connection behavior that is exhausting the database's connection limit, without requiring application changes.

Answer

Increase the max_connections parameter.

Answer

Implement a local database connection pooler.

Answer

Migrate to Amazon Aurora Serverless.