SAA-C03 Exam Simulation 1 — 100 Questions

Question 1

Your public API is hosted in two regions. You want Route 53 to automatically send traffic to the secondary region when the primary region’s endpoint fails. The primary API health check is returning failure codes, but clients still reach the primary region for several minutes. Which Route 53 configuration most directly addresses this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Route 53 failover routing with a primary record and a secondary record, each associated with its own health check, so Route 53 answers with the healthy region.. Route 53 failover routing with health checks on both primary and secondary records ensures that when the primary health check fails, Route 53 stops returning the primary record's IP and instead returns the secondary record's IP. This directly addresses the observed behavior where clients still reach the primary region for several minutes—likely because the primary record's health check was not configured or associated, or a simple routing policy was used without health check integration, causing stale DNS responses to be served until TTL expires.

Answer

Use a single Alias A record with simple routing and a short TTL so Route 53 quickly changes the IP address.

Answer

Use weighted routing to send a small percentage of traffic to the secondary region, increasing it manually when the primary fails.

Answer

Use latency routing only, letting Route 53 choose the lowest-latency region at query time, without health checks.

Question 2

A team serves static content (JavaScript, CSS, images) from S3 through CloudFront. After a recent release, CloudFront reports a low cache hit ratio and the S3 origin receives a much higher request rate. The site still works, but billing shows higher origin and data transfer costs. Which change is most likely to improve cache hit ratio and reduce origin load?

Accepted Answer

Configure a CloudFront cache policy (or update HTTP cache-control headers) to increase TTLs for versioned static assets and enable compression for text assets.. Increasing TTLs for versioned static assets via a CloudFront cache policy or HTTP Cache-Control headers ensures that CloudFront caches these immutable objects for longer periods, reducing the number of requests forwarded to the S3 origin. Enabling compression for text assets reduces the data transferred from origin to edge, further lowering origin load and costs. This directly addresses the low cache hit ratio and high origin request rate described in the scenario.

Answer

Disable CloudFront access logging so fewer requests are recorded and billing decreases automatically.

Answer

Set the distribution’s origin to use S3 Transfer Acceleration to reduce the number of requests hitting S3.

Answer

Force CloudFront to forward query strings to the origin for all static content so the latest versions are always fetched.

Question 3

A media company stores finalized video masters in an Amazon S3 bucket in the us-east-1 Region. Compliance requires that the objects be recoverable if they are accidentally deleted or overwritten for at least 90 days, and that no user, including administrators, be able to permanently erase them during that period. Which S3 feature should the solutions architect enable?

Accepted Answer

S3 Object Lock in compliance mode with a retention period of 90 days on the bucket.. The requirement is legal-hold-style immutability that even administrators cannot override. S3 Object Lock in compliance mode enforces exactly that: protected object versions cannot be deleted or overwritten by any identity until the retention period lapses, and the retention cannot be shortened. Governance mode and replication both leave a path for privileged users to destroy the data.

Answer

S3 Versioning with a lifecycle rule that transitions noncurrent versions to S3 Glacier Deep Archive after 30 days.

Answer

S3 Object Lock in governance mode with a retention period of 90 days on the bucket.

Answer

S3 Cross-Region Replication to a bucket in another Region with versioning enabled on both buckets.

Question 4

A company serves private images stored in S3 through Amazon CloudFront. Only authenticated users should be able to access each image, and access should expire after 1 hour. Which CloudFront feature best meets this requirement?

Accepted Answer

Signed URLs or signed cookies with an expiration time of 1 hour. Signed URLs or signed cookies allow CloudFront to grant temporary access to private content by embedding authentication information (policy, signature, key pair ID) directly in the request. By setting an expiration time of 1 hour in the policy statement, access automatically becomes invalid after that period, meeting both the authentication and expiry requirements without exposing the S3 bucket publicly.

Answer

A WAF rule that blocks requests without valid JWTs, without using signed URLs

Answer

Turning on S3 bucket public access block, without any CloudFront viewer authentication

Answer

Enabling CloudFront geo restriction to allow only one country

Question 5

A global mobile game backend serves mostly static images and JavaScript files from an S3 origin. Users in distant countries report slow load times. What should improve performance most? The design must avoid adding custom operational scripts.

Accepted Answer

Amazon CloudFront distribution with the S3 bucket as origin. Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for users in distant countries by serving files from the nearest edge. Using the S3 bucket as the origin, CloudFront distributes the content globally without requiring any custom operational scripts, directly addressing the slow load times for static assets.

Answer

RDS read replicas

Answer

A larger S3 bucket

Answer

An EC2 Auto Scaling group in one Region

Question 6

A team runs an Amazon RDS for MySQL database in a single Availability Zone. They want automatic failover with minimal downtime if the primary database instance becomes unavailable. Automated backups are already enabled. Which configuration change best meets the requirement?

Accepted Answer

Enable RDS Multi-AZ so AWS maintains a standby in another Availability Zone for automatic failover.. Enabling Multi-AZ on Amazon RDS for MySQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary instance fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, minimizing downtime without manual intervention. This meets the requirement for automatic failover with minimal downtime.

Answer

Keep the deployment as single-AZ, but increase automated backup retention to 35 days.

Answer

Create a read replica in another Availability Zone, but keep Multi-AZ disabled.

Answer

Rely on restoring from the most recent manual snapshot after an outage.

Question 7

A web application for a healthcare document service is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy?

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that can be associated with an Application Load Balancer to filter and monitor HTTP/HTTPS requests. It includes managed rule sets specifically designed to block common web exploits like SQL injection and cross-site scripting (XSS) with minimal operational overhead, as AWS manages the rule updates.

Answer

Security groups on the application instances

Answer

Network ACLs on the public subnets

Answer

AWS Shield Advanced only

Question 8

A travel booking site uses EC2 instances behind an ALB. CPU is consistently high during peak traffic, and request latency rises. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Auto Scaling policy based on an appropriate CloudWatch metric. An Auto Scaling policy based on an appropriate CloudWatch metric (such as CPUUtilization or request latency) dynamically adds or removes EC2 instances to match demand. This managed AWS-native control directly addresses high CPU and rising latency during peak traffic by scaling out capacity, which is the preferred approach per the architecture review board's requirement for a managed solution.

Answer

A VPC endpoint for CloudWatch only

Answer

S3 Object Lock

Answer

Disable health checks

Question 9

A company needs an Amazon RDS database that automatically fails over to a standby when the primary DB instance becomes unavailable. Which approach best meets the requirement with minimal operational effort?

Accepted Answer

Deploy the DB as a Multi-AZ DB instance so AWS maintains a synchronous standby in another Availability Zone and performs automated failover.. Amazon RDS Multi-AZ automatically provisions and maintains a synchronous standby replica in a different Availability Zone. When the primary DB instance fails, AWS handles the automatic failover to the standby with zero manual intervention, meeting the requirement with minimal operational effort.

Answer

Keep the DB as a single-AZ instance and implement a manual process to promote a standby when needed.

Answer

Enable versioned backups only, and restore the database each time the primary instance becomes unavailable.

Answer

Replicate the database to another region and switch clients to the secondary region using manual DNS changes.

Question 10

A backend service uses an IAM role to read files from an S3 bucket. It must only read objects under s3://prod-reporting/incoming/ but currently receives AccessDenied (403) on GetObject for that prefix.

The role already has this statement:
- Action: s3:ListBucket
- Resource: arn:aws:s3:::prod-reporting

Which policy statement would most directly follow least privilege to allow only the required reads under the incoming prefix?

Accepted Answer

Allow reads with a prefix-scoped statement: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"].. It grants only the s3:GetObject permission on the specific prefix path arn:aws:s3:::prod-reporting/incoming/*, which directly allows reading objects under that prefix while adhering to least privilege. The existing s3:ListBucket permission already enables listing the bucket, so only the missing read action needs to be added.

Answer

Allow only listing and reading with a single statement: Action = ["s3:*"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"].

Answer

Allow all S3 reads at the account level: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::*"].

Answer

Allow bucket listing with a condition that forces the prefix: Action = ["s3:ListBucket"], Resource = ["arn:aws:s3:::prod-reporting"], Condition = {"StringLike": {"s3:prefix": "incoming/*"}}.

Question 11

Based on the exhibit, DNS still sends traffic to the primary Region even though Route 53 health checks show the primary endpoint is unhealthy. What is the best change to make failover work as intended?

Accepted Answer

Use a failover routing policy with a primary record and a secondary record, and attach the health check to the primary record.. A failover routing policy with a health check attached to the primary record is the only configuration that allows Route 53 to automatically stop sending traffic to an unhealthy primary endpoint and redirect it to the secondary endpoint. Without the health check attached to the primary record, Route 53 has no mechanism to detect the failure and will continue routing traffic to the primary Region, even if the health check status shows unhealthy.

Answer

Change both records to weighted routing with a 50/50 split so Route 53 can shift traffic gradually.

Answer

Switch to latency-based routing so users are always directed to the lowest-latency Region.

Answer

Use geolocation routing so clients in one Region are sent to the healthier endpoint.

Question 12

A company runs a stateless web application on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in a relational database, which is becoming a bottleneck during peak hours. The team wants to improve performance and reduce database load while keeping the application stateless. Which solution should a solutions architect recommend?

Accepted Answer

Store session state in an Amazon ElastiCache for Redis cluster and configure the application to read and write sessions to the cluster.. Externalizing session state to an in-memory cache such as ElastiCache for Redis removes the relational database bottleneck and keeps the application stateless. Redis provides sub-millisecond latency, high throughput, and optional persistence, making it ideal for session stores. Sticky sessions or database scaling do not achieve the same performance and scalability benefits.

Answer

Migrate the session table to Amazon DynamoDB with on-demand capacity and update the application to use DynamoDB for session storage.

Answer

Increase the size of the relational database instance and add read replicas, then direct session reads to the replicas and writes to the primary.

Answer

Enable sticky sessions on the Application Load Balancer and store session state in the local memory of each EC2 instance.

Question 13

An application repeatedly reads the same DynamoDB items with very low latency requirements. The application can tolerate slightly stale data (for example, within a few seconds). You want to improve read latency without changing the existing DynamoDB table schema. Which service is the best choice?

Accepted Answer

Amazon DAX. Amazon DAX (DynamoDB Accelerator) is an in-memory cache that sits between your application and DynamoDB, providing microsecond read latency for frequently accessed items. Since the application can tolerate slightly stale data (within seconds), DAX's default TTL-based caching is ideal because it reduces read pressure on DynamoDB while serving cached results with significantly lower latency than direct DynamoDB reads.

Answer

Amazon S3 Transfer Acceleration

Answer

Amazon EFS

Answer

AWS CloudTrail for data plane reads

Question 14

A DynamoDB-backed multi-tenant app experiences throttling. Most write traffic for tenant 'ACME' targets a single logical stream of events (you write items for ACME in near-real time). The table currently uses partition key = tenantId and sort key = eventTimestamp. CloudWatch shows partition-level throttling concentrated in the ACME partition. What design change most directly improves write throughput for the hottest tenant while still enabling efficient queries for recent events for that tenant?

Accepted Answer

Mitigate the hotspot by changing the partition key to include a shard value (for example, tenantId + '#' + shardId) and write using shardId. Query recent events by fanning out across ACME shards and merging results by eventTimestamp.. It directly addresses the partition-level throttling by introducing a shard key (e.g., tenantId + '#' + shardId) as the partition key, which distributes ACME's write load across multiple physical partitions. To query recent events for ACME, the application must fan out queries across all shards and merge results by eventTimestamp, which is efficient because each shard holds a subset of the data and the sort key remains eventTimestamp for ordering.

Answer

Add a Global Secondary Index (GSI) with the same partition key (tenantId) and eventTimestamp, and rely on the GSI to spread load.

Answer

Increase the table’s write capacity (or on-demand baseline) without changing the partition key, because DynamoDB will automatically balance hotspots.

Answer

Switch the sort key to a random value to prevent writes from landing on the same physical partition.

Question 15

Based on the exhibit, a serverless API on AWS Lambda experiences a predictable cold-start penalty every weekday at 09:00 UTC when a marketing campaign begins. The team wants the first requests to stay fast while minimizing extra cost during quiet periods. What is the best approach?

Accepted Answer

Enable provisioned concurrency on the published version and schedule it to scale up shortly before the spike.. Provisioned concurrency pre-warms a specified number of Lambda execution environments so that incoming requests do not incur a cold start. By scheduling the provisioned concurrency to scale up just before the 09:00 UTC spike and scale down afterward, the team eliminates the cold-start penalty during the campaign while minimizing cost during quiet periods. This directly addresses the predictable, time-bound traffic pattern without requiring code changes or over-provisioning.

Answer

Increase the Lambda timeout so cold starts have more time to complete.

Answer

Move the function behind an Application Load Balancer to improve warm-up behavior.

Answer

Increase the function memory to the maximum value and leave concurrency unchanged.

Question 16

A public API for a image sharing application is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. API Gateway's JWT authorizer natively validates JSON Web Tokens (JWTs) issued by an external OpenID Connect (OIDC) provider. It verifies the token's signature, expiry, and issuer against the OIDC provider's JWKS endpoint, enabling standards-based authentication without custom Lambda code.

Answer

A VPC endpoint policy

Answer

API keys only

Answer

IAM authorization for all internet users

Question 17

A company has an Amazon S3 bucket for sensitive reports. They must ensure that any object uploaded with s3:PutObject is encrypted using AWS KMS (SSE-KMS). Which S3 bucket policy approach best enforces this by denying uploads that do not use SSE-KMS?

Accepted Answer

Use a Deny statement for s3:PutObject with a condition that denies requests where s3:x-amz-server-side-encryption is not "aws:kms" (SSE-KMS), for example: Condition { StringNotEquals: { "s3:x-amz-server-side-encryption": "aws:kms" } }. It uses a Deny statement with the condition `StringNotEquals` on the `s3:x-amz-server-side-encryption` request header, which explicitly denies any `s3:PutObject` request that does not include the value `aws:kms` for that header. This ensures that only objects encrypted with SSE-KMS are uploaded, as any request lacking the header or using a different encryption type (e.g., AES256) will be denied. The condition is evaluated at the time of the request, making it an effective enforcement mechanism.

Answer

Use a Deny statement that denies requests when aws:SecureTransport is false.

Answer

Use a Deny statement that checks the specific KMS key ID (s3:x-amz-server-side-encryption-aws-kms-key-id) and denies requests that don’t match a single alias value.

Answer

Use a Deny or Allow statement that limits object keys using s3:prefix (for example, only allow keys under "reports/").

Question 18

A SaaS platform serves an API using two regional deployments: us-east-1 (primary) and us-west-2 (secondary). Each region has its own ALB. The business requires automated DNS-based failover when the primary region becomes unhealthy, and they do not want manual DNS changes during incidents. 

Which Route 53 configuration is the best match?

Accepted Answer

Use Route 53 failover routing with a primary record pointing to the us-east-1 ALB and a secondary record pointing to the us-west-2 ALB, each using health checks.. Route 53 failover routing is designed specifically for active-passive failover scenarios where you have a primary and secondary resource. By associating health checks with each record, Route 53 automatically detects when the primary ALB in us-east-1 becomes unhealthy and routes traffic to the secondary ALB in us-west-2 without manual intervention. This meets the requirement for automated DNS-based failover without manual DNS changes.

Answer

Create a single Route 53 record using weighted routing across both ALBs with weights adjusted manually during an incident.

Answer

Use latency-based routing so Route 53 always selects the fastest region; health checks are unnecessary because client latency reflects availability.

Answer

Use a single A record with a static IP address that points to a NAT gateway, and update that IP during failure events.

Question 19

A retail company runs a stateless web tier on Amazon EC2 instances behind an Application Load Balancer. Traffic is steady during the day but drops to near zero between 01:00 and 06:00, and the team wants to reduce cost without manual intervention. The instances take about four minutes to boot and warm up. Which configuration meets these requirements?

Accepted Answer

Create a scheduled scaling action that reduces the Auto Scaling group's desired capacity at 01:00 and increases it at 06:00.. Scheduled scaling is the right fit when capacity needs follow a known timetable: it changes desired capacity at 01:00 and 06:00 regardless of metric lag, so the group shrinks during the predictable trough and is already expanding before morning traffic arrives. Reactive policies such as target tracking or step scaling would respond only after metrics move, which conflicts with the fixed daily pattern and the four-minute warm-up.

Answer

Enable an Application Load Balancer idle timeout and let the load balancer stop idle targets automatically.

Answer

Attach a step scaling policy that removes instances when the ALB request count per target falls below a threshold.

Answer

Configure a target tracking scaling policy based on average CPU utilization with a target of 50 percent.

Question 20

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The design must avoid adding custom operational scripts.

Accepted Answer

Interface VPC endpoint for Systems Manager. Option A is correct because an Interface VPC endpoint (powered by AWS PrivateLink) for Systems Manager creates elastic network interfaces in the private subnets with private IP addresses, allowing the instances to call the ssmmessages, ec2messages, and ssm endpoints privately without traversing the public internet. Option D is correct because a Gateway VPC endpoint for Amazon S3 adds a route-table target that lets traffic to S3 stay on the AWS private network, so the private application can download objects without an internet or NAT path. Together these two endpoints satisfy the requirement to reach both S3 and Parameter Store privately and require no custom operational scripts. Option B is not appropriate because an Internet gateway provides public internet connectivity and would expose or require public routing, which the scenario explicitly forbids. Option C is not appropriate because a NAT gateway enables outbound internet access (and incurs cost per AZ) rather than keeping traffic private, so it does not meet the no-public-internet requirement.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone