SAA-C03 Practice Test 10 — 10 Questions

Question 1

A high-frequency trading analytics service runs on several EC2 instances in the same Availability Zone. The application exchanges small messages between nodes and is sensitive to microsecond-level network latency. Which design best meets the requirement?

Accepted Answer

Place the instances in a cluster placement group in one Availability Zone.. A cluster placement group is designed for low-latency, high-throughput scenarios by placing instances in a single Availability Zone with non-blocking, fully bisectioned bandwidth and microsecond-level latency. This meets the requirement for microsecond-sensitive inter-node communication in high-frequency trading.

Answer

Place the instances in a spread placement group across multiple Availability Zones.

Answer

Place the instances in a partition placement group within one Availability Zone.

Answer

Deploy the instances behind an Application Load Balancer in multiple Availability Zones.

Question 2

A CPU-bound batch rendering service runs on EC2. The application is Linux-based, compatible with ARM64, and the team wants the best throughput per dollar without changing the workload's architecture. Which two instance-family choices should the team consider first? Select two.

Accepted Answer

A compute-optimized family, because it is designed for workloads that spend most of their time on CPU.. Option A is correct because compute-optimized families (e.g., C5, C6g) are designed for workloads that spend most of their time on CPU, such as batch rendering. Option B is correct because Graviton-based instances (e.g., C6g, M6g) use ARM64 architecture, which is compatible with the workload and often delivers better price-performance for compute-intensive tasks, maximizing throughput per dollar without architectural changes.

Answer

A memory-optimized family, because extra RAM always increases compute throughput.

Answer

A storage-optimized family, because local storage bandwidth is the main factor for rendering performance.

Answer

A burstable family, because CPU credits make sustained rendering faster during long runs.

Question 3

A company serves private images stored in S3 through Amazon CloudFront. Only authenticated users should be able to access each image, and access should expire after 1 hour. Which CloudFront feature best meets this requirement?

Accepted Answer

Signed URLs or signed cookies with an expiration time of 1 hour. Signed URLs or signed cookies allow CloudFront to grant temporary access to private content by embedding authentication information (policy, signature, key pair ID) directly in the request. By setting an expiration time of 1 hour in the policy statement, access automatically becomes invalid after that period, meeting both the authentication and expiry requirements without exposing the S3 bucket publicly.

Answer

A WAF rule that blocks requests without valid JWTs, without using signed URLs

Answer

Turning on S3 bucket public access block, without any CloudFront viewer authentication

Answer

Enabling CloudFront geo restriction to allow only one country

Question 4

A company uses Amazon RDS for a PostgreSQL database powering a customer-facing application. The application’s availability depends on fast database failover with minimal manual intervention. The RDS instance currently runs as a single-AZ deployment in one DB subnet group. Which change most directly meets the goal?

Accepted Answer

Enable Multi-AZ for the RDS DB instance so AWS manages a standby in another Availability Zone with automatic failover.. Enabling Multi-AZ for the RDS DB instance creates a synchronous standby replica in a different Availability Zone. AWS automatically handles failover to the standby with no manual intervention required, which directly meets the goal of fast database failover with minimal manual intervention.

Answer

Create a read replica in a different Availability Zone and configure the application to fail over manually.

Answer

Switch the database to use EBS snapshots more frequently and restore in case of failure.

Answer

Pin the DB to a specific instance type with higher CPU credits to prevent CPU-related disconnects.

Question 5

A company uses Amazon RDS with automated backups enabled (retention period: 7 days). At 10:30 UTC, a bad release corrupts specific rows in a production table. The team detects the issue at 11:10 UTC. They need to revert the database state to what it was from 10:00–10:30 UTC, recover quickly, and minimize risk to the currently running workload. What is the best option?

Accepted Answer

Perform a point-in-time restore to a new DB instance using a timestamp before the corruption (for example, a time within 10:00–10:30 UTC).. Amazon RDS automated backups enable point-in-time recovery (PITR) to any second within the retention window. By restoring to a timestamp between 10:00 and 10:30 UTC, you recover the database to a state before the corruption occurred, without affecting the current production instance. This minimizes risk to the running workload because the restore creates a new DB instance, leaving the original untouched until you are ready to switch.

Answer

Reboot the DB instance and rely on the corrupted data being overwritten by storage-level changes.

Answer

Restore only the most recent automated backup snapshot, even if it is after the corruption timestamp.

Answer

Create a read replica of the current DB instance and overwrite the corrupted table using SELECT queries from the replica.

Question 6

A company runs a stateful analytics workload on EC2 instances that use EBS volumes. The data must be restorable in another Region after a major outage, with frequent point-in-time recovery. Which approach provides the most suitable replication mechanism for the EBS-backed data?

Accepted Answer

Create scheduled EBS snapshots and copy them to another Region, then restore the volumes from those snapshots during recovery.. Scheduled EBS snapshots provide point-in-time backups of EBS volumes, which can be copied to another Region using the cross-Region snapshot copy feature. During recovery, you restore volumes from those snapshots in the target Region, ensuring the data is restorable after a major outage. This approach meets the requirements for frequent point-in-time recovery and cross-Region durability.

Answer

Enable EBS multi-attach to spread the workload across AZs and replicate snapshots automatically between Regions.

Answer

Use RDS read replicas in another Region and keep the analytics dataset in an RDS instance only.

Answer

Rely on instance store for durability and copy only AMIs across Regions.

Question 7

A customer portal uses Amazon Aurora MySQL. The application currently sends all SELECT queries to the writer instance endpoint. During traffic spikes, read latency increases, and the team wants the cluster to survive a writer failover without manual endpoint changes for the application. Which changes should the team make? Select three.

Accepted Answer

Replace the hard-coded DB instance endpoint with the Aurora reader endpoint for read traffic.. Option A is correct because the Aurora reader endpoint automatically distributes read-only connections across all available Aurora Replicas, including the writer instance if it is configured to accept reads. This eliminates the need for manual endpoint changes during a failover, as the reader endpoint remains constant while the underlying instances change.

Answer

Keep sending all traffic to the writer endpoint because it always has the freshest data.

Answer

Replace Aurora with a single larger RDS instance and continue using the same read pattern.

Question 8

A claims portal uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend?

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS with an EC2 instance role allows the application to obtain a short-lived authentication token (valid for 15 minutes) using the AWS CLI or SDK, without storing any credentials on the instance. The EC2 instance role provides the necessary permissions to generate the token, which is then used instead of a static password, meeting both security requirements.

Answer

Store the database password in user data

Answer

Embed the database password in the AMI

Answer

Use a security group rule that allows only application instances

Question 9

A internal reporting portal serves infrequently accessed user documents that must be available immediately when requested. Which S3 storage class is likely the best cost fit?

Accepted Answer

S3 Standard-IA or S3 One Zone-IA depending on resilience requirements. S3 Standard-IA or S3 One Zone-IA is the best cost fit because the data is infrequently accessed but must be available immediately when requested. These storage classes offer low-latency retrieval (milliseconds) at a lower storage cost than S3 Standard, with the trade-off of a retrieval fee. The choice between Standard-IA and One Zone-IA depends on whether the application requires resilience against Availability Zone failures.

Answer

Instance store volumes

Answer

S3 Glacier Deep Archive

Answer

S3 Standard for all objects

Question 10

A customer-managed KMS key (CMK) encrypts SQS messages. A consumer service uses an IAM role that includes kms:Decrypt permission for that CMK. After a security change, the consumer fails with: "AccessDeniedException: kms:Decrypt is not allowed" CloudTrail indicates the KMS request is reaching KMS, but the CMK key policy no longer includes the consumer role (or its principal). What is the best fix?

Accepted Answer

Update the CMK key policy to allow the consumer role principal to perform kms:Decrypt on the CMK.. Option A is correct because the error indicates that the KMS key policy explicitly denies the consumer role's kms:Decrypt request. Since KMS key policies are the primary access control for CMKs, adding the consumer role principal with kms:Decrypt permission resolves the issue. The CloudTrail log confirms the request reaches KMS, so the problem is solely the missing key policy statement.

Answer

Update only the consumer role identity policy because identity policies always override key policies.

Answer

Enable default encryption on SQS so that KMS permissions are no longer required.

Answer

Create an S3 bucket policy statement allowing kms:Decrypt because the messages are stored in S3.