SAA-C03 Practice Test 13 — 15 Questions

Question 1

A line-of-business application runs on EC2 instances 24/7 with predictable usage for the next year. The application will stay in the same Region, and the team does not want to manage capacity interruptions. Which two purchase options can reduce cost compared with pure On-Demand pricing? Select two.

Accepted Answer

Buy Compute Savings Plans for the expected steady usage.. Compute Savings Plans (A) offer a flexible discount (up to 66%) in exchange for a 1- or 3-year commitment to a consistent amount of compute usage (measured in $/hour), automatically applying to any EC2 instance family, region, or even AWS Fargate/Lambda. This reduces cost compared to On-Demand while avoiding capacity interruptions, as the commitment covers the predictable steady-state usage. Standard Reserved Instances (B) provide a similar discount (up to 72%) for a specific instance family in a specific region, also with a 1- or 3-year term, and guarantee capacity for the specified AZ if you choose a zonal reservation, ensuring no interruptions.

Answer

Move the fleet to Spot Instances.

Answer

Use Dedicated Hosts to reserve physical servers for the application.

Answer

Stay entirely on On-Demand Instances because they are already the cheapest option.

Question 2

A media company stores application logs in S3. The logs must be kept for 400 days. They are read heavily for the first 30 days, occasionally for the next 90 days, and almost never after that. Retrieval after the first 3 months can wait a few hours. Which three lifecycle actions should they use to minimize storage cost? Select three.

Accepted Answer

Transition objects to S3 Standard-IA after 30 days.. Option A is correct because after the initial 30-day period of heavy reads, transitioning objects to S3 Standard-IA reduces storage costs while still providing low-latency retrieval for the occasional access needed over the next 90 days. S3 Standard-IA is designed for data accessed infrequently but requires rapid access when needed, making it cost-effective for this usage pattern.

Answer

Keep all objects in S3 Standard for the full retention period.

Answer

Transition objects to S3 One Zone-IA after 30 days.

Question 3

A product catalog system uses a relational database for orders and a simple key-value profile store for shopping carts. Traffic is unpredictable, and the company wants to avoid paying for large idle database instances. Which two choices are best? Select two.

Accepted Answer

Use Aurora Serverless v2 for the relational order system.. Aurora Serverless v2 automatically scales compute and memory capacity based on application demand, making it ideal for unpredictable traffic. It eliminates the need to provision for peak load, reducing costs by scaling to zero when idle. This matches the requirement to avoid paying for large idle database instances.

Answer

Keep both workloads on large provisioned RDS instances and add read replicas for the cart store.

Answer

Use DynamoDB provisioned capacity with a fixed minimum despite the unpredictable traffic.

Answer

Replace the relational order system with a wide-column table to reduce SQL licensing.

Question 4

A new feature stores user events in DynamoDB. Each event must be fetched by user_id and sorted by event_time. The team expects many different users and wants to avoid a single hot partition. Which partition key design is best?

Accepted Answer

Use user_id as the partition key and event_time as the sort key.. Option B is correct because using user_id as the partition key evenly distributes writes across partitions, avoiding hot spots, while event_time as the sort key enables efficient retrieval of events for a specific user in chronological order. DynamoDB's query operation can then fetch all events for a given user_id sorted by event_time without scanning.

Answer

Use a constant partition key value (for example, partition_key='events') and store user_id as an attribute.

Answer

Use event_time as the partition key and user_id as an attribute to query later.

Answer

Use a randomly generated UUID as the partition key and query by user_id using a full table scan.

Question 5

A travel booking site uses EC2 instances behind an ALB. CPU is consistently high during peak traffic, and request latency rises. What should be configured?

Accepted Answer

Auto Scaling policy based on an appropriate CloudWatch metric. An Auto Scaling policy based on a CloudWatch metric like CPUUtilization or request latency directly addresses the root cause: rising CPU and latency under peak traffic. By automatically adding EC2 instances when the metric breaches a threshold, the ALB can distribute load across more resources, reducing CPU per instance and improving response times. This is the standard AWS solution for dynamic scaling to maintain performance.

Answer

A VPC endpoint for CloudWatch only

Answer

S3 Object Lock

Answer

Disable health checks

Question 6

A order processing API must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control?

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. Option C is correct because Service Control Policies (SCPs) are a preventive control that can deny the ec2:CreateVolume API call when the encryption condition (ec2:Encrypted) is false. This ensures that no unencrypted EBS volumes can be created at the account level, regardless of IAM permissions. SCPs operate at the AWS Organizations root, OU, or account level and are evaluated before any IAM policies, making them the strongest preventive mechanism.

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Answer

Enable VPC Flow Logs

Answer

Tag encrypted volumes after creation

Question 7

A marketing site stores logs in S3. Logs are queried for 30 days, rarely accessed for one year, and then retained for compliance. What should reduce storage cost? The design must avoid adding custom operational scripts.

Accepted Answer

S3 lifecycle policy that transitions objects to lower-cost storage classes over time. Option A is correct because S3 Lifecycle policies allow you to automatically transition objects from S3 Standard to lower-cost storage classes like S3 Standard-IA (Infrequent Access) after 30 days, then to S3 Glacier Deep Archive after one year, without custom scripts. This matches the access pattern: frequent queries for 30 days, rare access for a year, then long-term retention for compliance. The policy automates cost reduction by moving data to progressively cheaper storage as access frequency decreases.

Answer

Keep all logs in S3 Standard indefinitely

Answer

Use EBS snapshots for the logs

Answer

Move all logs immediately to S3 Glacier Deep Archive

Question 8

A mobile game backend uses Amazon Aurora. The workload has many short-lived database connections from Lambda functions, causing connection storms. What should be added?

Accepted Answer

RDS Proxy. RDS Proxy is the correct solution because it sits between Lambda functions and the Aurora database, pooling and reusing database connections. This prevents connection storms by reducing the overhead of establishing new connections for each short-lived Lambda invocation, and it also helps manage IAM authentication for Lambda functions without storing database credentials.

Answer

An internet gateway

Answer

S3 Select

Answer

A larger Route 53 hosted zone

Question 9

A patient portal must process every event at least once, but duplicate processing is acceptable if the consumer handles idempotency. Which eventing approach is most suitable?

Accepted Answer

Use Amazon SQS standard queue and design consumers to be idempotent. Amazon SQS standard queues provide at-least-once delivery, meaning each message is delivered at least once but may occasionally be delivered more than once. This aligns with the requirement that every event must be processed at least once, and since duplicate processing is acceptable when consumers are idempotent, the standard queue is the most suitable choice. SQS handles the decoupling and durability of messages without requiring custom infrastructure.

Answer

Use an in-memory queue on one EC2 instance

Answer

Use UDP messages sent directly to workers

Answer

Use CloudFront signed URLs

Question 10

A media platform stores originals in an S3 bucket. The application must: (1) prevent any public access to the bucket, (2) allow authenticated users to upload and download objects using presigned URLs, and (3) enforce that all requests use HTTPS and only touch objects under the user-specific prefix (for example, s3://media-originals/user-123/*). The bucket currently allows uploads but sometimes returns 403 AccessDenied for presigned URLs.

Which change is the best fix while meeting the security requirements?

Accepted Answer

Keep Block Public Access enabled, remove any Allow statement to Principal="*", and use a bucket policy or access point policy that denies non-HTTPS requests and allows PutObject/GetObject only when the object key matches the authenticated user's session tag, such as arn:aws:s3:::media-originals/${aws:PrincipalTag/userId}/*.. Option B is correct because it keeps S3 Block Public Access enabled (preventing any public access), uses a bucket policy or access point policy with a condition key like `aws:PrincipalTag` to restrict `PutObject`/`GetObject` to the user-specific prefix (e.g., `arn:aws:s3:::media-originals/${aws:PrincipalTag/userId}/*`), and denies non-HTTPS requests via a `aws:SecureTransport` condition. This ensures presigned URLs work only for authenticated users with the correct session tag, while enforcing HTTPS and preventing public access.

Answer

Disable S3 Block Public Access and add an ACL that grants READ and WRITE to the bucket owner only.

Answer

Use bucket website hosting and allow public GET requests so presigned URLs are not needed for downloads.

Answer

Use ACLs to grant ObjectOwner full control and rely on the application to generate presigned URLs with longer expirations to avoid 403 errors.

Question 11

A risk simulation workload uses CloudWatch Logs heavily. Retaining all debug logs forever is increasing costs. What should be configured?

Accepted Answer

CloudWatch Logs retention policies per log group. CloudWatch Logs retention policies allow you to set per-log-group expiration rules (e.g., 30 days, 90 days) to automatically delete old log events, directly reducing storage costs for debug logs that are no longer needed. This is the most cost-effective and targeted solution for managing log lifecycle without affecting other monitoring or configuration services.

Answer

AWS Config aggregation

Answer

CloudWatch detailed monitoring on all instances

Answer

Route 53 health checks

Question 12

A ticket booking system runs on EC2 instances behind an Application Load Balancer. The design must tolerate the failure of one Availability Zone. What should the Auto Scaling group configuration include?

Accepted Answer

Subnets in at least two Availability Zones with health checks enabled. Option A is correct because an Auto Scaling group configured with subnets in at least two Availability Zones and health checks enabled ensures that if one AZ fails, EC2 instances in the remaining AZs continue to serve traffic. The Application Load Balancer distributes requests across healthy instances in multiple AZs, and the Auto Scaling group replaces failed instances in the affected AZ, maintaining capacity. This design meets the requirement to tolerate the failure of one Availability Zone.

Answer

All instances in one larger subnet

Answer

A Network Load Balancer in one subnet

Answer

A single EC2 instance with detailed monitoring

Question 13

A multi-tenant event system writes and reads data in DynamoDB. One tenant generates most of the traffic, causing throttling on a single partition key value, and the dashboards repeatedly read the most recent items for that tenant. Which two changes should the team make to improve performance? Select two.

Accepted Answer

Shard the hot tenant’s writes across multiple partition key values so traffic is spread across partitions.. Option A is correct because sharding the hot tenant's writes across multiple partition key values (e.g., by appending a random suffix or a timestamp-based suffix) distributes the write traffic across multiple physical partitions, avoiding throttling on a single partition. This is a common DynamoDB design pattern for mitigating hot keys, as each partition has its own throughput limits (e.g., up to 3,000 RCU or 1,000 WCU for a partition). By spreading writes, the system can achieve higher aggregate throughput without hitting per-partition limits.

Answer

Switch the table to on-demand capacity mode so DynamoDB automatically removes partition limits.

Answer

Use a larger sort key attribute to increase the maximum write throughput for the tenant.

Answer

Move the table to a single larger provisioned throughput setting and keep the same key design.

Question 14

A production Amazon RDS database has automated backups enabled. At 10:00 UTC, an application deploy accidentally overwrote a subset of rows due to a faulty migration. The issue is detected at 10:45 UTC. The team confirms that the required retention window is still available. Which approach offers the most resilient and least disruptive way to recover the affected data close to the time of the event?

Accepted Answer

Use point-in-time recovery to restore the database to a timestamp just before 10:00 UTC, then swap application connectivity to the recovered instance.. Option B is correct because point-in-time recovery (PITR) allows you to restore the RDS instance to any second within the backup retention window, such as just before the faulty migration at 10:00 UTC. This restores a complete, consistent database state, minimizing data loss and avoiding manual row-by-row recovery. Swapping application connectivity to the restored instance is the least disruptive approach, as it avoids complex manual data merging and reduces downtime.

Answer

Perform a snapshot restore and attach the restored instance, then manually copy only the affected rows back into the current database.

Answer

Rely on automated backups to roll forward automatically until the data becomes correct.

Answer

Disable automated backups going forward to prevent future corruption, then reindex the corrupted table.

Question 15

A web application uses Amazon RDS for MySQL in a Multi-AZ deployment. During a planned maintenance event, the team wants to understand which two statements about failover are accurate so they can design connection handling correctly. Which two statements are accurate? Select two.

Accepted Answer

RDS automatically promotes the synchronous standby in the same Region if the primary instance becomes unavailable.. Option A is correct because in a Multi-AZ RDS for MySQL deployment, Amazon RDS automatically maintains a synchronous standby replica in a different Availability Zone. If the primary instance becomes unavailable due to a planned maintenance event or failure, RDS automatically fails over to the standby, promoting it to become the new primary. This failover is transparent to the application when using the same DNS endpoint, as RDS updates the DNS record to point to the new primary.

Answer

The standby instance can serve production read traffic to improve read scaling in standard RDS Multi-AZ.

Answer

The application must permanently change its connection string to a new host after failover completes.

Answer

Multi-AZ provides protection against a full Region outage without any additional design changes.