SAA-C03 Practice Test 13 — 15 Questions

Question 1

A company uses an Amazon Aurora DB cluster in a Multi-AZ configuration. During a planned failover of the writer instance, the database endpoints in the application are updated incorrectly. After failover, reads work but writes fail with connection errors and timeouts for several minutes. The team currently uses the instance endpoint for the writer. What should they change to improve write resilience during failovers?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Aurora cluster writer endpoint for all write operations.. The Aurora cluster writer endpoint always points to the current primary (writer) instance, even after a failover. By using this endpoint instead of a static instance endpoint, the application automatically resolves to the new writer without manual updates, eliminating connection errors and timeouts during failover transitions.

Answer

Continue using the instance endpoint, but increase application retry count so the writer changes are handled more quickly.

Answer

Use a read replica endpoint for writes because it is typically stable across failovers.

Answer

Disable Multi-AZ failover so the writer instance never changes and writes remain consistent.

Question 2

A stateless web application runs on Amazon EC2 instances across two Availability Zones. The team wants unhealthy instances to be removed automatically and replaced without manual action. What is the best solution?

Accepted Answer

Use an Application Load Balancer with an Auto Scaling group and configure health checks.. An Application Load Balancer (ALB) with an Auto Scaling group provides automated health checks and instance replacement. The ALB performs HTTP/HTTPS health checks against the instances, and when an instance fails the health check, the Auto Scaling group automatically terminates the unhealthy instance and launches a new one to maintain the desired capacity. This ensures the stateless web application remains available across both Availability Zones without manual intervention.

Answer

Place the instances in a single subnet and increase the instance size.

Answer

Use a network ACL to detect failed instances and restart them.

Answer

Store the web servers on EBS volumes so the data survives failures.

Question 3

A web application for a IoT ingestion API is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy? The design must avoid adding custom operational scripts.

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). By associating an AWS WAF web ACL with the Application Load Balancer, you can filter and monitor HTTP(S) requests based on rules that match malicious patterns, with no custom scripts or operational overhead. This is the most efficient and managed solution for the stated requirements.

Answer

Network ACLs on the public subnets

Answer

Security groups on the application instances

Answer

AWS Shield Advanced only

Question 4

A media processing workflow in private subnets downloads large amounts of data from S3 through a NAT gateway. NAT data processing charges are high. What should the architect use to reduce cost? The design must avoid adding custom operational scripts.

Accepted Answer

Gateway VPC endpoint for Amazon S3. A Gateway VPC endpoint for Amazon S3 allows instances in private subnets to access S3 directly over the AWS network without traversing a NAT gateway. This eliminates NAT data processing charges because traffic stays within the AWS backbone, reducing costs significantly for large data downloads.

Answer

S3 Object Lambda

Answer

AWS Shield Advanced

Answer

A larger NAT gateway

Question 5

A document portal requires consistent high IOPS for a transactional database on EC2. Which EBS volume type is most suitable? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Provisioned IOPS SSD such as io2. The scenario requires consistent high IOPS for a transactional database, which demands low-latency, predictable performance. Provisioned IOPS SSD (io2) is the only EBS volume type that allows you to specify a guaranteed IOPS rate independent of volume size, making it ideal for latency-sensitive transactional workloads. It is also a managed AWS-native service, satisfying the architecture review board's preference.

Answer

sc1 Cold HDD

Answer

Instance store only

Answer

st1 Throughput Optimized HDD

Question 6

A public API for a B2B file exchange site is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. API Gateway's JWT authorizer natively validates JSON Web Tokens issued by an external OpenID Connect (OIDC) provider. It verifies the token's signature, expiry, and issuer against the OIDC provider's JWKS endpoint without requiring custom Lambda code, making it the simplest and most secure choice for standards-based token authentication.

Answer

API keys only

Answer

IAM authorization for all internet users

Answer

A VPC endpoint policy

Question 7

An order processing workflow uses Amazon SQS as the decoupling layer between a producer and a consumer Lambda function. The consumer intermittently fails due to a downstream dependency. The team has observed that certain “poison” messages keep being retried repeatedly and prevent other messages from being processed efficiently. Which SQS configuration most directly addresses this issue?

Accepted Answer

Configure a redrive policy with a dead-letter queue (DLQ) and set an appropriate visibility timeout greater than the maximum processing time.. Configuring a redrive policy with a dead-letter queue (DLQ) allows messages that repeatedly fail processing to be moved out of the main queue after a specified number of receive attempts. Setting an appropriate visibility timeout greater than the maximum processing time ensures that messages are not made visible again before the consumer finishes processing, preventing premature retries. This directly isolates poison messages so they no longer block the processing of other messages in the queue.

Answer

Set the SQS queue’s retention period to 10 years and rely on application retries to eventually succeed.

Answer

Increase visibility timeout to a very large value and avoid dead-letter queues to keep ordering stable.

Answer

Switch the queue to FIFO and remove retries in the Lambda event source mapping entirely.

Question 8

Your application runs in private subnets with no NAT gateway. It needs to call AWS Secrets Manager to retrieve secrets. For private connectivity without internet egress, which VPC endpoint type should you create for AWS Secrets Manager?

Accepted Answer

An Interface VPC endpoint (AWS PrivateLink) for secretsmanager in your Region. An Interface VPC endpoint (AWS PrivateLink) creates an elastic network interface in your subnet with a private IP address, allowing your instances to communicate with AWS Secrets Manager over the AWS network without traversing the internet. Since your application runs in private subnets with no NAT gateway, this is the only supported endpoint type for Secrets Manager, as Gateway endpoints are only available for S3 and DynamoDB.

Answer

A Gateway VPC endpoint for secretsmanager

Answer

A NAT gateway in the private subnet route table

Answer

A VPC peering connection to the AWS public network hosting Secrets Manager

Question 9

A dev sandbox has unpredictable DynamoDB traffic with long idle periods and occasional spikes. Which capacity mode should minimize operational overhead and avoid paying for idle provisioned capacity?

Accepted Answer

DynamoDB on-demand capacity mode. DynamoDB on-demand capacity mode (Option C) is ideal for unpredictable workloads with long idle periods and occasional spikes because it automatically scales to handle traffic without requiring any capacity planning. You pay only for the reads and writes you actually perform, eliminating the cost of idle provisioned capacity and the operational overhead of managing scaling.

Answer

Reserved capacity for maximum daily traffic

Answer

Provisioned capacity set for peak traffic

Answer

Global tables in every Region

Question 10

A system processes events from Amazon SQS and sometimes sees duplicate messages due to retries. The business requirement is that each payment must be charged at most once. What design choice best addresses this resiliency requirement?

Accepted Answer

Implement idempotent processing using a deduplication key (for example, paymentId) and record completed charges so duplicates are safely ignored.. Implementing idempotent processing with a deduplication key (e.g., paymentId) ensures that even if duplicate messages arrive from SQS (due to retries or at-least-once delivery), the consumer can check a record of completed charges and safely ignore duplicates. This satisfies the business requirement of charging each payment at most once without relying on SQS’s best-effort deduplication or message ordering.

Answer

Assume duplicates never occur because the consumer deletes messages immediately after receiving them.

Answer

Increase the SQS visibility timeout until duplicates never happen.

Answer

Use SNS topics instead of SQS so retries are disabled by default.

Question 11

A latency-sensitive API is implemented with AWS Lambda. The team enabled provisioned concurrency to avoid cold starts, setting provisioned concurrency to 50 because marketing campaigns occasionally cause spikes. However, during most weekdays the API receives little traffic (near zero), and the team is seeing high monthly Lambda costs from idle provisioned capacity. What is the best cost-optimized strategy that still meets the requirement of fast initial responses during traffic spikes?

Accepted Answer

Use Application Auto Scaling scheduled actions to increase provisioned concurrency on the Lambda alias before campaign windows and reduce it to a minimal baseline afterward.. It uses Application Auto Scaling scheduled actions to dynamically adjust provisioned concurrency, scaling up to 50 before marketing campaigns and reducing to a minimal baseline (e.g., 1-5) during low-traffic weekdays. This eliminates idle capacity costs while ensuring fast initial responses during spikes, as provisioned concurrency keeps Lambda environments warm and ready to handle requests without cold starts.

Answer

Increase provisioned concurrency to 100 so that cold starts never occur, regardless of traffic patterns.

Answer

Turn provisioned concurrency off permanently and rely on retries at the client side to mask cold starts.

Answer

Replace Lambda with a single always-on EC2 instance sized for peak demand to eliminate cold starts.

Question 12

A company hosts a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB and the Auto Scaling group are currently deployed in only one Availability Zone (AZ). The business wants the application to keep running if that AZ has an outage. What is the best change?

Accepted Answer

Deploy the ALB and the Auto Scaling group across at least two Availability Zones so healthy targets remain.. Deploying the ALB and Auto Scaling group across at least two Availability Zones (AZs) ensures that if one AZ fails, the ALB can route traffic to healthy EC2 instances in the remaining AZ(s). This is the fundamental AWS best practice for high availability: an ALB is a regional service that requires targets in multiple AZs to survive an AZ outage, and the Auto Scaling group must also span those AZs to maintain capacity. Without multi-AZ deployment, a single AZ failure makes the entire application unavailable regardless of instance health checks.

Answer

Increase the desired capacity in the existing Availability Zone to handle all traffic during an outage.

Answer

Enable longer ALB health check intervals so failing instances are detected more slowly.

Answer

Switch from the ALB to an Internet Gateway so instances can fail over to the public internet.

Question 13

Account A has an IAM role named FinanceDataRole that is assumed by a principal in Account B. The role’s trust policy includes a condition requiring sts:ExternalId to equal "Fin-2026-Q2". A developer in Account B calls AssumeRole but receives an error: AccessDenied: ExternalId mismatch. The security team requires that you do not remove the ExternalId condition. What is the correct remediation?

Accepted Answer

Update the AssumeRole call in Account B to include sts:ExternalId="Fin-2026-Q2" exactly as required.. The error 'AccessDenied: ExternalId mismatch' occurs because the AssumeRole API call from Account B does not include the required sts:ExternalId parameter. The trust policy on the FinanceDataRole explicitly requires this parameter to match 'Fin-2026-Q2' as a security measure to prevent the confused deputy problem. Option B is correct because the developer must pass the exact ExternalId value in the AssumeRole request to satisfy the condition and successfully assume the role.

Answer

Add kms:Decrypt to the developer’s IAM policy so KMS can validate the ExternalId during AssumeRole.

Answer

Increase the role’s MaxSessionDuration to reduce authentication failures.

Answer

Remove the ExternalId condition from the trust policy to allow all AssumeRole requests.

Question 14

A company has a primary application in us-east-1 and a standby environment in us-west-2. Users should go to the primary site while it is healthy and automatically switch to the standby site if the primary fails. Which Route 53 routing policy should they use?

Accepted Answer

Failover routing with health checks. Failover routing with health checks is the correct choice because it allows you to configure an active-passive failover pattern where Route 53 directs traffic to the primary resource (us-east-1) as long as it passes a health check. If the health check fails, Route 53 automatically routes traffic to the secondary resource (us-west-2), ensuring high availability without manual intervention.

Answer

Weighted routing

Answer

Geolocation routing

Answer

Latency-based routing

Question 15

Account A hosts a role named AppReadRole. Account B needs to access it using STS AssumeRole. Account A’s role trust policy includes this condition: - StringEquals: { "sts:ExternalId": "b-7f9a" } When Account B runs: aws sts assume-role --role-arn arn:aws:iam::111111111111:role/AppReadRole --role-session-name test the call fails with: "AccessDenied: ExternalId mismatch". What should Account B change?

Accepted Answer

Provide the correct --external-id value (b-7f9a) in the AssumeRole call.. The error 'AccessDenied: ExternalId mismatch' occurs because the trust policy on Account A's role requires an `sts:ExternalId` condition with the value `b-7f9a`, but Account B's `aws sts assume-role` command did not include the `--external-id` parameter. By providing the correct `--external-id b-7f9a` in the call, Account B satisfies the condition, allowing the role assumption to succeed. This is a standard security mechanism to prevent the confused deputy problem.

Answer

Add kms:Decrypt permissions to Account B’s IAM user because trust policy failures are KMS related.

Answer

Remove the ExternalId condition from the trust policy so any caller can assume the role.

Answer

Use AssumeRoleWithSAML instead of AssumeRole so ExternalId is not required.