SAA-C03 Practice Test 12 — 15 Questions

Question 1

Based on the exhibit, a company stores sensitive PDFs in S3 and serves them through CloudFront. Direct requests to the S3 object URL must fail, but CloudFront should still be able to fetch the files securely. Which solution best satisfies the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure CloudFront Origin Access Control for the S3 origin and update the bucket policy to allow only that distribution.. CloudFront Origin Access Control (OAC) allows CloudFront to authenticate requests to an S3 origin using a specific identity, and the bucket policy can be configured to grant access only to that CloudFront distribution. This ensures that direct S3 object URL requests fail (since they lack the CloudFront signature), while CloudFront can still fetch the files securely using the OAC mechanism.

Answer

Leave the bucket public but require CloudFront signed cookies for all users.

Answer

Use an S3 access point and give it a public policy so CloudFront can reach the objects.

Answer

Use S3 object ACLs to grant read access only to users behind CloudFront.

Question 2

A latency-sensitive API is implemented with AWS Lambda. During traffic ramp-ups, users sometimes experience slow responses due to cold starts. The team wants to ensure fast initialization for a baseline level of concurrent requests. Which AWS feature should they use?

Accepted Answer

Lambda provisioned concurrency. Lambda Provisioned Concurrency keeps a specified number of execution environments initialized and ready to respond immediately, eliminating cold starts for those concurrent requests. This directly addresses the latency-sensitive API requirement during traffic ramp-ups by ensuring fast initialization for a baseline level of concurrency.

Answer

Increase reserved instances for EC2

Answer

Enable S3 event notifications for every request to the API

Answer

Decrease the function timeout to reduce execution variability

Question 3

A video platform uses Amazon Aurora. The workload has many short-lived database connections from Lambda functions, causing connection storms. What should be added? The design must avoid adding custom operational scripts.

Accepted Answer

RDS Proxy. RDS Proxy is the correct choice because it sits between Lambda functions and the Aurora database, pooling and reusing database connections. This prevents connection storms by reducing the overhead of establishing new connections for each short-lived Lambda invocation, without requiring custom scripts or application changes.

Answer

S3 Select

Answer

An internet gateway

Answer

A larger Route 53 hosted zone

Question 4

A analytics dashboard uses an Application Load Balancer in one Region. Global users need lower network latency to the application without caching dynamic responses. What should be considered?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network and Anycast IPs to route traffic to the optimal Regional endpoint, reducing latency for global users without caching dynamic responses. It does not cache content, so dynamic data is always fetched from the origin, meeting the requirement of no caching while improving network performance via the AWS backbone.

Answer

S3 Cross-Region Replication

Answer

AWS Backup cross-Region copy

Answer

CloudFront only with long TTLs

Question 5

A marketing site stores logs in S3. Logs are queried for 30 days, rarely accessed for one year, and then retained for compliance. What should reduce storage cost?

Accepted Answer

S3 lifecycle policy that transitions objects to lower-cost storage classes over time. An S3 Lifecycle policy automates the transition of objects from S3 Standard (frequently accessed) to lower-cost storage classes like S3 Standard-IA (infrequent access) after 30 days, then to S3 Glacier Deep Archive for long-term compliance retention. This matches the access pattern: frequent queries for 30 days, rare access for a year, then archival storage, minimizing cost without manual intervention.

Answer

Keep all logs in S3 Standard indefinitely

Answer

Use EBS snapshots for the logs

Answer

Move all logs immediately to S3 Glacier Deep Archive

Question 6

A content publishing system exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most? The design must avoid adding custom operational scripts.

Accepted Answer

CloudFront caching with appropriate TTLs. CloudFront caches responses from the S3 origin based on configured TTLs (Cache-Control or Expires headers). If the S3 origin experiences a short outage, CloudFront can still serve cached content to users as long as the TTL has not expired, ensuring availability without custom scripts. This is the most direct and resilient feature for this use case.

Answer

IAM Access Analyzer

Answer

AWS Backup Vault Lock

Answer

S3 Select

Question 7

Based on the exhibit, downstream payment timeouts cause EventBridge deliveries to back up and some events are retried until they age out. What change best improves resilience and preserves events during downstream outages?

Accepted Answer

Put an Amazon SQS queue between EventBridge and the consumer, and have workers drain the queue with a DLQ for poison messages.. Introducing an SQS queue between EventBridge and the consumer decouples the event delivery from the downstream payment API. During outages, events are stored durably in SQS and can be processed later without being lost. A Dead Letter Queue (DLQ) captures events that fail repeatedly, preventing poison messages from blocking the queue and ensuring no events age out due to retry exhaustion.

Answer

Increase the Lambda timeout so each invocation can wait longer for the payment API.

Answer

Switch the target to a Lambda function with reserved concurrency of zero during outages.

Answer

Replace EventBridge with CloudWatch Logs subscriptions so the consumer can poll the log stream later.

Question 8

A trading analytics system deploys 10 EC2 instances that exchange very frequent, low-latency messages over the network. The instances must be placed as close together as possible to minimize network hop count and inter-node jitter. Which deployment choice best matches this requirement?

Accepted Answer

Use a cluster placement group so the instances are placed close together to reduce latency and jitter.. A cluster placement group is designed for low-latency, high-throughput scenarios by placing all instances in a single Availability Zone within the same rack or logical cluster, minimizing network hop count and inter-node jitter. This directly meets the requirement for very frequent, low-latency messaging between 10 EC2 instances.

Answer

Use a spread placement group to distribute instances across multiple underlying hardware to improve overall availability.

Answer

Use no placement group and rely on the Auto Scaling group to balance instance placement automatically.

Answer

Use a partition placement group so each instance is assigned to separate failure domains for low variance.

Question 9

Based on the exhibit, what is the best change to improve read performance without increasing write latency on the primary database?

Accepted Answer

Create an RDS read replica and direct the reporting queries to the replica endpoint.. Creating an RDS read replica offloads read-heavy reporting queries from the primary database instance, improving read performance without increasing write latency on the primary. The replica operates asynchronously, so writes on the primary are not blocked or delayed by the reporting workload.

Answer

Convert the DB instance to Multi-AZ so the primary can serve more reads.

Answer

Increase the primary instance class to a larger size and keep all traffic on one writer.

Answer

Migrate the reporting workload to DynamoDB to gain faster reads.

Question 10

An internal worker consumes messages from an Amazon SQS Standard queue. Recently, some messages fail validation in the worker (for example, missing required fields), causing the worker to crash before it can successfully process those messages. Those messages keep getting retried repeatedly, slowing down processing of valid messages. The team wants a resilient mechanism to quarantine bad messages after a limited number of receive attempts. What should they implement?

Accepted Answer

Configure a redrive policy with a Dead-Letter Queue (DLQ) and set maxReceiveCount so poison messages are moved to the DLQ after repeated failures.. Amazon SQS supports configuring a redrive policy with a Dead-Letter Queue (DLQ) that automatically moves messages after a specified number of receive attempts (maxReceiveCount). This isolates poison messages that fail validation and cause crashes, preventing them from being retried indefinitely and slowing down valid message processing. The worker can then focus on valid messages while the DLQ stores the problematic ones for later analysis or manual intervention.

Answer

Increase the SQS visibility timeout to several hours so the worker does not retry too quickly.

Answer

Switch the queue to an SNS topic and subscribe the worker directly, eliminating message retries.

Answer

Enable KMS encryption with a new CMK to ensure validation errors stop occurring.

Question 11

A web application for a claims portal is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy?

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP/HTTPS requests. It provides managed rules specifically designed to block common attack patterns like SQL injection and cross-site scripting (XSS) with minimal operational overhead, as the rules are pre-configured and automatically updated by AWS.

Answer

AWS Shield Advanced only

Answer

Network ACLs on the public subnets

Answer

Security groups on the application instances

Question 12

Your team hosts versioned static assets (for example, /static/app-<buildHash>.js). Each build hash never changes, but you release new files on new URLs. To maximize cache hit rate and reduce origin load using CloudFront, what should you do when generating HTTP responses for these assets?

Accepted Answer

Set Cache-Control: public, max-age=31536000, immutable for the versioned assets. Setting `Cache-Control: public, max-age=31536000, immutable` tells CloudFront and browsers to cache the versioned asset for one year (31536000 seconds) and never revalidate, since the URL changes with each new build. The `immutable` directive (RFC 8246) signals that the content will never change on that URL, eliminating conditional revalidation requests and maximizing cache hits, which reduces origin load.

Answer

Set Cache-Control: no-cache so CloudFront always revalidates with the origin

Answer

Set Cache-Control: max-age=0 and rely on CloudFront to cache by default

Answer

Disable CloudFront caching and forward all headers and query strings to the origin

Question 13

An order-processing system publishes an event whenever a payment succeeds. Three downstream services (inventory, shipping, and analytics) must react independently. Analytics sometimes has high latency, but order processing must not be blocked. What is the best AWS approach to decouple these consumers?

Accepted Answer

Publish payment events to SNS (or EventBridge) and let each downstream service consume independently (for example, via SQS queues or other async targets).. Amazon SNS (or EventBridge) enables asynchronous, fan-out messaging where a single payment-success event is published once and delivered independently to multiple downstream services (inventory, shipping, analytics) via SQS queues or other targets. This decouples the producer from consumer latency—analytics can take its time without blocking order processing—and ensures each consumer processes the event at its own pace, meeting the requirement for independent, non-blocking reactions.

Answer

Have order processing call each service synchronously via HTTPS and retry on failures.

Answer

Store events in a single relational database table and let consumers poll continuously for new rows.

Answer

Send events directly from the producer to each consumer EC2 instance using SSH tunnels.

Question 14

A ticket booking system runs on EC2 instances behind an Application Load Balancer. The design must tolerate the failure of one Availability Zone. What should the Auto Scaling group configuration include? The design must avoid adding custom operational scripts.

Accepted Answer

Subnets in at least two Availability Zones with health checks enabled. Placing subnets in at least two Availability Zones ensures that if one AZ fails, the Auto Scaling group can launch instances in the remaining healthy AZ, maintaining application availability. Health checks integrated with the Application Load Balancer allow the Auto Scaling group to automatically replace unhealthy instances without custom scripts, aligning with the requirement to avoid operational overhead.

Answer

All instances in one larger subnet

Answer

A Network Load Balancer in one subnet

Answer

A single EC2 instance with detailed monitoring

Question 15

A ticket booking system stores uploaded documents in S3. The business requires a copy in another AWS Region for disaster recovery. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

S3 Cross-Region Replication with versioning enabled. S3 Cross-Region Replication (CRR) is a fully managed AWS-native feature that automatically replicates objects from a source S3 bucket in one AWS Region to a destination bucket in another Region, meeting the disaster recovery requirement for a geographically separate copy. Enabling versioning on both buckets is mandatory for CRR to function, as it tracks object versions and ensures consistency during replication.

Answer

S3 lifecycle transition to Glacier Flexible Retrieval

Answer

An EBS snapshot schedule

Answer

A CloudFront distribution