SAA-C03 Practice Test 14 — 15 Questions

Question 1

Based on the exhibit, an EC2 application runs in private subnets with no NAT gateway and must retrieve a secret from AWS Secrets Manager. The secret uses a customer managed KMS key. Which change will allow the application to reach the service while keeping traffic off the internet?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an interface VPC endpoint for Secrets Manager and another interface VPC endpoint for KMS, and enable private DNS for both.. It creates interface VPC endpoints for both Secrets Manager and KMS, which allows the EC2 instance in the private subnet to securely access these services over the AWS network without traversing the internet. Enabling private DNS ensures that the standard service endpoints resolve to the private IP addresses of the VPC endpoints, eliminating the need for a NAT gateway or internet gateway.

Answer

Create an S3 gateway endpoint for Secrets Manager and use the existing S3 gateway endpoint for both secret retrieval and KMS decryption.

Answer

Add a NAT gateway in a public subnet and route 0.0.0.0/0 from the private subnets to the NAT gateway.

Answer

Move the application into a public subnet so it can call the public Secrets Manager endpoint directly.

Question 2

Account A hosts an IAM role that Account B developers must assume for a limited task. You want to require MFA for anyone assuming the role. Which trust policy condition most directly enforces that requirement for sts:AssumeRole?

Accepted Answer

Add a statement condition requiring "Bool": {"aws:MultiFactorAuthPresent": "true"} in the role trust policy.. The `aws:MultiFactorAuthPresent` condition key in the role trust policy directly checks whether the caller authenticated with a valid MFA device before calling `sts:AssumeRole`. When set to "true" with a Bool condition, it enforces that the session must have been established after MFA verification, which is the most direct and standard way to require MFA for role assumption.

Answer

Add a condition requiring "StringEquals": {"aws:PrincipalOrgID": "o-example"} without any MFA condition.

Answer

Add a statement that denies sts:AssumeRole when the requested role session name contains the text "dev".

Answer

Require HTTPS by setting a condition on "aws:SecureTransport": "true" in the trust policy.

Question 3

A company runs Amazon RDS for MySQL in a Multi-AZ configuration. If the primary database instance fails, what is the expected behavior?

Accepted Answer

RDS automatically fails over to the standby instance in the same Region and keeps the same endpoint.. Amazon RDS for MySQL in a Multi-AZ configuration automatically synchronously replicates data to a standby instance in a different Availability Zone. When the primary database instance fails, RDS automatically fails over to the standby instance, updating the DNS record for the same CNAME endpoint so that applications can resume operations without manual intervention. This ensures high availability with minimal downtime.

Answer

The database remains unavailable until an administrator manually creates a new instance.

Answer

Traffic is routed to a read replica in another Region for immediate continuity.

Answer

The failed primary continues serving traffic while the standby synchronizes in the background.

Question 4

A static web application uses CloudFront with an S3 origin for assets (JavaScript, CSS, images). After deploying a new frontend build, the CloudFront cache hit ratio dropped significantly because the S3 origin receives many repeated requests for the same assets. The team notices that requests now include the Authorization header in asset requests. Which change is most likely to restore cache efficiency and reduce origin request costs?

Accepted Answer

Update the CloudFront cache policy so that Authorization is excluded from the cache key for static asset paths.. The drop in cache hit ratio is caused by the Authorization header being included in asset requests, which makes each request unique from CloudFront's perspective, preventing cache reuse. By updating the CloudFront cache policy to exclude the Authorization header from the cache key for static asset paths, CloudFront can treat identical asset requests as cache hits, restoring cache efficiency and reducing origin load.

Answer

Keep the Authorization header but increase the cache TTL to 1 year to reduce revalidation frequency.

Answer

Remove CloudFront and serve assets directly from the S3 website endpoint to reduce CloudFront charges.

Answer

Switch the S3 origin from private access to public access so CloudFront can cache assets more effectively.

Question 5

A consumer application reads from an Amazon SQS queue. Some messages have an invalid format and always fail processing. They are retried repeatedly and consume consumer capacity. What is the best way to prevent these "poison pill" messages from blocking normal processing?

Accepted Answer

Configure a dead-letter queue (DLQ) with a redrive policy and a maxReceiveCount.. A dead-letter queue (DLQ) with a redrive policy and a maxReceiveCount allows messages that repeatedly fail processing to be moved to a separate queue after a specified number of receive attempts. This prevents poison pill messages from being retried indefinitely, freeing consumer capacity for valid messages. Amazon SQS automatically redirects messages to the DLQ once the maxReceiveCount threshold is exceeded, ensuring normal processing is not blocked.

Answer

Enable long polling and increase the maximum message retention to 30 days.

Answer

Switch the queue to FIFO and disable retries in the consumer code.

Answer

Delete the main queue and recreate it after every failure.

Question 6

A Lambda function in Account A must upload reports to an S3 bucket in Account B. Security does not want long-lived access keys anywhere, and the access should be easy to revoke from Account B. Which approach is best?

Accepted Answer

Create an IAM role in Account B that Account A can assume through STS, then grant the role S3 permissions.. It uses cross-account IAM roles with AWS Security Token Service (STS) to grant temporary credentials to the Lambda function. This avoids long-lived access keys, and the permissions can be revoked immediately by modifying or deleting the role in Account B, meeting the security requirements.

Answer

Create an IAM user in Account B and store its access keys in Lambda environment variables.

Answer

Attach a security group to the Lambda function that allows outbound traffic to the bucket.

Answer

Use AWS Organizations SCPs to grant the Lambda function permission to write to the bucket.

Question 7

A company serves versioned images from S3 through CloudFront. After a release, CloudFront origin fetches increased sharply and the monthly CloudFront bill went up. They reviewed CloudFront logs and found that many requests include a query string parameter `reqId` that is unique per request (for example, `...?v=2026-04-01&reqId=...`). The team currently forwards all query strings to the cache key. What change is most likely to reduce origin fetches and cost while keeping the versioned images correct?

Accepted Answer

Update the CloudFront cache policy to ignore `reqId` and include only the stable `v` query string parameter in the cache key.. The `reqId` query string parameter is unique per request, which forces CloudFront to treat each request as a distinct cache object when all query strings are forwarded to the cache key. By configuring the cache policy to include only the stable `v` parameter (the version identifier) and ignore `reqId`, CloudFront can serve cached responses for all requests with the same `v` value, drastically reducing origin fetches and lowering costs. This approach preserves correct versioned image delivery because the `v` parameter still differentiates between image versions.

Answer

Lower the CloudFront minimum TTL to 0 seconds so cached objects revalidate more often, reducing origin fetch volume.

Answer

Set the S3 bucket to use compression and enable S3 Transfer Acceleration to reduce origin fetch charges.

Answer

Disable forwarding of the query string to the origin, but keep using the full query string (including `reqId`) in the cache key.

Question 8

A media processing workflow uses CloudWatch Logs heavily. Retaining all debug logs forever is increasing costs. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

CloudWatch Logs retention policies per log group. CloudWatch Logs retention policies allow you to set a time-based expiration (e.g., 30 days) on log groups, automatically deleting old log events. This directly reduces storage costs without requiring custom scripts, as the retention policy is a native CloudWatch Logs feature configured per log group.

Answer

Route 53 health checks

Answer

CloudWatch detailed monitoring on all instances

Answer

AWS Config aggregation

Question 9

A risk simulation workload uses CloudWatch Logs heavily. Retaining all debug logs forever is increasing costs. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

CloudWatch Logs retention policies per log group. CloudWatch Logs retention policies allow you to set per-log-group expiration rules (e.g., 30 days, 90 days) to automatically delete old log events, directly reducing storage costs without custom scripts. Since the workload uses CloudWatch Logs heavily and retains debug logs forever, configuring a retention policy on each log group is the simplest, most cost-effective solution that requires no operational overhead.

Answer

AWS Config aggregation

Answer

CloudWatch detailed monitoring on all instances

Answer

Route 53 health checks

Question 10

A deployment engineer created an IAM role for an automation workflow (AppDeployRole). The role has an attached identity policy that allows iam:CreateRole for specific resource ARNs. However, the role is also created with a permission boundary named DeployBoundary. The DeployBoundary policy currently does not include the iam:CreateRole action. During execution, the automation fails with AccessDenied for iam:CreateRole, even though the attached identity policy allows it. What is the best fix?

Accepted Answer

Update DeployBoundary to allow iam:CreateRole for only the required resource ARNs, following least privilege.. B is correct because when an IAM role has a permission boundary, the boundary defines the maximum permissions the role can have. Even if the identity-based policy allows iam:CreateRole, the effective permissions are the intersection of the identity policy and the permission boundary. Since DeployBoundary does not include iam:CreateRole, the action is denied. Updating the boundary to allow iam:CreateRole for the required resource ARNs, following least privilege, grants the necessary permission while still constraining the role.

Answer

Edit AppDeployRole’s attached identity policy to add iam:CreateRole again; permission boundaries only apply when permissions are missing.

Answer

Remove the permission boundary from the role because permission boundaries are not enforced at runtime.

Answer

Encrypt the deployment artifacts with KMS so IAM denies become KMS authorization failures.

Question 11

You must ensure that all requests to an S3 bucket use TLS (HTTPS). Which S3 bucket policy approach best enforces this requirement for S3 access?

Accepted Answer

Use a policy statement that explicitly Denies any action when aws:SecureTransport is false. The `aws:SecureTransport` condition key evaluates whether the request was sent using TLS. By explicitly denying all S3 actions when `aws:SecureTransport` is false, any HTTP request is rejected, ensuring only HTTPS requests succeed. This approach uses an explicit deny, which overrides any allow, making it the most secure and reliable method to enforce TLS.

Answer

Allow all principals to GetObject when aws:SecureTransport is true

Answer

Deny requests only when the bucket name is not matched exactly in the request

Answer

Require that the requester uses SSE-KMS and reject requests without SSE-KMS configuration

Question 12

Based on the exhibit, the database is manually promoted during an Availability Zone failure and the application outage lasts longer than the target. What change best improves resilience with the least operational intervention?

Accepted Answer

Convert the database to an RDS Multi-AZ deployment so a synchronous standby can fail over automatically.. B is correct because RDS Multi-AZ automatically synchronously replicates data to a standby in a different Availability Zone and triggers an automatic failover with zero manual intervention when an AZ failure occurs. This directly addresses the requirement to improve resilience while minimizing operational effort, as the failover is handled by AWS without any runbook execution or manual promotion.

Answer

Keep the read replica and automate promotion with a runbook after CloudWatch alarms fire.

Answer

Use a cross-Region read replica so promotion happens faster during an AZ failure.

Answer

Increase the application retry count and keep the current database design.

Question 13

An application runs on an EC2 Auto Scaling group. Over the last month, CPU utilization averaged 8% with no sustained memory pressure, and response times are stable. The team wants to lower monthly cost without changing the application. What is the most appropriate next step for cost optimization?

Accepted Answer

Evaluate a smaller EC2 instance type (via the Auto Scaling launch template/configuration) for the group and validate performance metrics after the change.. The application is over-provisioned: CPU utilization averages only 8% with no memory pressure and stable response times. By selecting a smaller EC2 instance type in the Auto Scaling launch template or configuration, you directly reduce the per-instance cost while maintaining adequate performance. This is the most straightforward cost optimization step without modifying the application code or architecture.

Answer

Increase desired capacity to 2x so utilization increases and instances become “more efficient.”

Answer

Disable Auto Scaling so the group never scales down to preserve baseline performance.

Answer

Switch the workload to Spot instances immediately to avoid On-Demand charges, regardless of interruption risk.

Question 14

An application writes to an Amazon Aurora DB cluster. After a planned Aurora failover, the application experiences several minutes of connection errors.

The logs show the application continues connecting to the specific DB instance endpoint that was the primary before the failover.

What change most directly improves resilience during Aurora failovers?

Accepted Answer

Update the application to use the Aurora cluster writer endpoint for write traffic so it always resolves to the current writer instance.. The Aurora cluster writer endpoint always resolves to the current primary DB instance, even after a failover. By using this endpoint instead of a specific instance endpoint, the application automatically reconnects to the new writer without manual intervention or connection errors.

Answer

Increase Aurora storage autoscaling so failovers are unnecessary.

Answer

Point both reads and writes to the Aurora reader endpoint to keep the DNS name the same.

Answer

Disable Aurora failover capability so the cluster never switches writer instances.

Question 15

A production log archive runs continuously on EC2 with predictable usage for the next three years. The team wants a discount while retaining some instance-family flexibility. What should they buy? The design must avoid adding custom operational scripts.

Accepted Answer

Compute Savings Plan. The Compute Savings Plan (C) offers the largest discount (up to 66%) in exchange for a commitment to a consistent amount of compute usage (measured in $/hour) for a 1- or 3-year term, while still allowing flexibility across instance families, sizes, OS, tenancy, and regions. This matches the predictable three-year workload and the requirement for instance-family flexibility without custom scripts.

Answer

S3 Intelligent-Tiering

Answer

Dedicated Instances

Answer

Spot Instances only