SAA-C03 Practice Test 1 — 10 Questions

Question 1

A security analyst needs to let an external vendor (AWS account 555566667777) read data from a set of internal resources in your AWS account. You created an IAM role called VendorReadRole with a policy that allows the required API calls. However, when the vendor tries to access, CloudTrail shows the call fails at AssumeRole with: "Not authorized to perform: sts:AssumeRole".

What is the most appropriate fix?

Accepted Answer

Add an allow statement for the vendor in the role’s trust policy to permit sts:AssumeRole from the vendor account (and include any required ExternalId condition).. The error 'Not authorized to perform: sts:AssumeRole' indicates that the role's trust policy does not grant the external AWS account (555566667777) permission to assume the role. The trust policy must include an Allow statement with the sts:AssumeRole action, specifying the external account as the principal, and optionally an ExternalId condition to prevent the confused deputy problem. This is the required configuration for cross-account IAM role access.

Answer

Attach the same allow policy to the vendor account’s existing IAM user so the user can call sts:AssumeRole directly into your role.

Answer

Replace the AssumeRole call with GetCallerIdentity so the vendor can infer permissions without assuming the role.

Answer

Enable MFA on the vendor’s IAM user and require MFA for your role using condition keys in the permissions policy.

Question 2

An application runs on EC2 instances in private subnets in a VPC. There is no NAT gateway. The instances need to download objects from S3 over HTTPS and also call DynamoDB. The security group outbound rules allow TCP 443 to the VPC endpoint addresses. After deployment, the app times out when connecting to S3, but it can reach DynamoDB. Which single change is most likely to restore S3 connectivity?

Accepted Answer

Create a Gateway VPC endpoint for S3 and associate it with the private subnet route tables that contain the instances.. The application runs in private subnets without a NAT Gateway, so it cannot reach the internet. A Gateway VPC Endpoint for S3 allows private subnet instances to access S3 over the AWS network without internet connectivity. The security group already permits outbound TCP 443 to the endpoint addresses, so the missing piece is the route table association that directs S3 traffic to the endpoint.

Answer

Replace the security group egress rule to allow all outbound traffic to 0.0.0.0/0 on TCP 443.

Answer

Add an Internet Gateway to the VPC and route the private subnet’s 0.0.0.0/0 to the IGW.

Answer

Switch from network ACLs to security groups by removing the existing NACL allow rules for ephemeral ports.

Question 3

A company serves public JavaScript and CSS files from S3 using CloudFront. After a frontend change, customers report a low CloudFront cache hit ratio. Requests now include an Authorization header, but these assets do not require authentication. The CloudFront distribution is configured such that Authorization is included in the cache key. Which change best maximizes cache reuse?

Accepted Answer

Use a CloudFront Cache Policy that excludes Authorization from the cache key. Excluding the Authorization header from the cache key ensures that all users, regardless of their authentication token, receive the same cached object. Since the static assets (JavaScript/CSS) do not require authentication, including Authorization in the cache key creates multiple cache entries for the same file, drastically reducing the cache hit ratio. A CloudFront cache policy that omits Authorization from the cache key maximizes reuse while still allowing the header to be forwarded to the origin if needed.

Answer

Include the Authorization header in the cache key so responses vary correctly

Answer

Disable caching and always fetch from S3

Answer

Forward all headers and cookies to the origin to improve correctness

Question 4

A retail platform needs disaster recovery across AWS Regions. The business requirement is: RTO up to 6 hours, RPO up to 1 hour, and they want the ability to start serving quickly during a Region outage but do not want to run full production capacity continuously. Which DR strategy best fits these requirements?

Accepted Answer

Warm standby, keeping a reduced but ready-to-scale environment in the secondary Region.. Warm standby is the best fit because it maintains a scaled-down but fully functional copy of the production environment in the secondary Region, allowing the RTO of 6 hours and RPO of 1 hour to be met without running full production capacity continuously. During a disaster, the standby environment can be scaled up quickly to serve traffic, balancing cost and recovery speed.

Answer

Backup and restore only, with no continuously running infrastructure in the secondary Region.

Answer

Pilot light, keeping only the minimum resources needed to bootstrap the environment.

Answer

Multi-site active-active, serving production traffic from both Regions at all times.

Question 5

Based on the exhibit, which design change is the best way to reduce the observed read latency for this DynamoDB-backed service?

Accepted Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table and send repeated read traffic through it.. Adding a DynamoDB Accelerator (DAX) cluster in front of the table reduces read latency by providing an in-memory cache for repeated read traffic. DAX delivers microsecond response times for eventually consistent reads, which directly addresses the observed latency issue without requiring application-level caching or table redesign.

Answer

Increase the on-demand table limits so DynamoDB can automatically absorb more traffic.

Answer

Create a global secondary index on tenantId to distribute the load across more partitions.

Answer

Move the dashboard data into S3 and use Lambda functions to read it on demand.

Question 6

A company runs its customer-facing web app on EC2 behind an Application Load Balancer. The database is Amazon RDS for PostgreSQL. The requirement is that if a single Availability Zone fails, the database must automatically fail over within the same AWS Region with minimal application changes. Which database setup best meets this requirement?

Accepted Answer

Deploy the RDS PostgreSQL instance as Multi-AZ with automatic failover enabled.. RDS Multi-AZ for PostgreSQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, with no changes required to the application's connection string (the DNS name remains the same). This meets the requirement for minimal application changes and automatic failover within the same Region.

Answer

Use an RDS single-AZ instance and periodically restore from automated backups if needed.

Answer

Create a read replica in a different AZ and use it only when the primary fails.

Answer

Use RDS with Multi-AZ disabled, but increase storage IOPS to prevent failover.

Question 7

A company keeps daily database backups in an S3 bucket. They may restore from backups during the first 30 days if there is an issue. After 30 days, backups are rarely restored, but must be retained for 2 years. Which lifecycle strategy most cost-effectively meets these requirements?

Accepted Answer

Use an S3 lifecycle policy to keep backups in S3 Standard for 30 days, then transition them to S3 Glacier Deep Archive for the remainder of the 2-year retention period.. It uses an S3 lifecycle policy to store backups in S3 Standard for the first 30 days when restores are likely, then transitions them to S3 Glacier Deep Archive for the remaining retention period. S3 Glacier Deep Archive offers the lowest storage cost for long-term, rarely accessed data, making this the most cost-effective strategy while meeting the 2-year retention requirement.

Answer

Delete backups after 30 days to avoid storage costs, since restores are rare.

Answer

Keep all backups in S3 Standard for the entire 2-year retention period.

Answer

Move backups to S3 Glacier Deep Archive immediately after creation, even for the first 30 days.

Question 8

A media company runs a 24/7 ingestion API on EC2 behind an Application Load Balancer and a nightly transcoding job that can resume from checkpoints. The API fleet runs at roughly 65 percent CPU all day, while the batch workers sit idle most of the time. The company wants to cut compute cost without risking the API. Which two changes should they make? Select two.

Accepted Answer

Purchase a Compute Savings Plan for the always-on API fleet.. A is correct because a Compute Savings Plan offers the largest discount (up to 66%) in exchange for a 1- or 3-year commitment to a consistent amount of compute usage (measured in $/hour), which perfectly matches the always-on API fleet that runs at a steady 65% CPU utilization. This plan applies to any EC2 instance family, region, or compute service (including Fargate and Lambda), giving flexibility while reducing costs for the predictable baseline load.

Answer

Replace the API fleet with Dedicated Hosts to lock in lower rates.

Answer

Buy Standard Reserved Instances for the batch workers and keep them running 24/7.

Answer

Increase the worker Auto Scaling minimum to prevent Spot interruptions.

Question 9

A high-frequency trading analytics service runs on several EC2 instances in the same Availability Zone. The application exchanges small messages between nodes and is sensitive to microsecond-level network latency. Which design best meets the requirement?

Accepted Answer

Place the instances in a cluster placement group in one Availability Zone.. A cluster placement group is designed for low-latency, high-throughput scenarios by placing instances in a single Availability Zone with non-blocking, fully bisectioned bandwidth and microsecond-level latency. This meets the requirement for microsecond-sensitive inter-node communication in high-frequency trading.

Answer

Place the instances in a spread placement group across multiple Availability Zones.

Answer

Place the instances in a partition placement group within one Availability Zone.

Answer

Deploy the instances behind an Application Load Balancer in multiple Availability Zones.

Question 10

Company A runs an internal app in account A. The app needs to upload objects to an S3 bucket in account B. When the app calls S3, it receives AccessDenied for s3:PutObject. The team already created an IAM role in account B named UploadRole with a policy allowing s3:PutObject. They did not yet set up any trust relationship. Which change most directly fixes the access problem with least privilege?

Accepted Answer

Update the trust policy on UploadRole (account B) to allow sts:AssumeRole from the app’s IAM role or principal in account A.. The app in account A needs to assume the UploadRole in account B to gain s3:PutObject permissions. Without a trust policy on UploadRole that allows sts:AssumeRole from the app's IAM principal in account A, the role cannot be assumed, and the S3 PutObject call fails with AccessDenied. Updating the trust policy is the most direct fix and follows least privilege by granting only the necessary cross-account role assumption.

Answer

Create IAM user access keys in account A and attach the UploadRole policy directly to those keys.

Answer

Add s3:PutObject permissions to the bucket policy in account B for all principals in account A.

Answer

Attach an SCP (service control policy) in AWS Organizations to deny sts:AssumeRole unless the caller uses an MFA device.