SAA-C03 Practice Test 14 — 15 Questions

Question 1

A media company stores raw project files in Amazon S3. Files are accessed heavily for the first 60 days, occasionally for legal review during the next six months, and must be retained for 7 years. Retrieval for the oldest files can take hours. Which three actions should the architect recommend? Select three.

Accepted Answer

Transition objects to S3 Standard-IA after 60 days.. Option A is correct because S3 Standard-IA is designed for data accessed less frequently but requires rapid access when needed. After 60 days of heavy access, transitioning to Standard-IA reduces storage costs while maintaining low-latency retrieval for occasional legal reviews.

Answer

Store the same files in EBS snapshots instead of S3 to lower archive costs.

Answer

Replicate the bucket to another Region to reduce storage charges.

Question 2

A mobile game backend uses Amazon Aurora. The workload has many short-lived database connections from Lambda functions, causing connection storms. What should be added? The design must avoid adding custom operational scripts.

Accepted Answer

RDS Proxy. RDS Proxy is the correct choice because it pools and shares database connections, reducing the overhead of establishing new connections for each Lambda invocation. This prevents connection storms by maintaining a persistent pool of connections to Aurora, which is ideal for short-lived, high-frequency connections from serverless functions like Lambda.

Answer

An internet gateway

Answer

S3 Select

Answer

A larger Route 53 hosted zone

Question 3

A mobile banking backend uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend?

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS with an EC2 instance role is the correct approach because it eliminates the need to store credentials on the instance. The EC2 instance assumes an IAM role, which obtains a short-lived (15-minute default) authentication token using the AWS CLI's `generate-db-auth-token` command. This token is used as the password for the PostgreSQL connection, ensuring credentials are never stored and automatically rotated.

Answer

Store the database password in user data

Answer

Use a security group rule that allows only application instances

Answer

Embed the database password in the AMI

Question 4

A trading analytics system deploys multiple EC2 instances that exchange very frequent, low-latency, east-west messages. The application team wants the instances to be placed to minimize network latency and variability. Which AWS feature should they use?

Accepted Answer

EC2 Placement Groups with the "cluster" strategy. The cluster placement group is the correct choice because it places instances into a low-latency, high-bandwidth group within a single Availability Zone, which minimizes network latency and variability for east-west traffic. This strategy is specifically designed for applications that require very frequent, low-latency communication between instances, such as trading analytics systems.

Answer

EC2 Placement Groups with the "spread" strategy

Answer

Auto Scaling cooldown adjustments only

Answer

Switching the instances to a larger instance size without any placement group

Question 5

A read-heavy document portal repeatedly queries the same product catalogue data from DynamoDB with millisecond latency requirements. Which service can reduce read latency and table load? The architecture review board prefers a managed AWS-native control.

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB that delivers up to 10x read performance improvement, reducing read latency to microseconds for repeated queries. It offloads read traffic from the DynamoDB table, lowering consumed read capacity units and table load, making it ideal for read-heavy workloads with millisecond latency requirements. As a fully managed, AWS-native service, DAX aligns with the architecture review board's preference for managed controls.

Answer

Amazon Kinesis Data Firehose

Answer

S3 Transfer Acceleration

Answer

AWS Glue Data Catalog

Question 6

A team serves static content (JavaScript, CSS, images) from S3 through CloudFront. After a recent release, CloudFront reports a low cache hit ratio and the S3 origin receives a much higher request rate. The site still works, but billing shows higher origin and data transfer costs. Which change is most likely to improve cache hit ratio and reduce origin load?

Accepted Answer

Configure a CloudFront cache policy (or update HTTP cache-control headers) to increase TTLs for versioned static assets and enable compression for text assets.. Option A is correct because increasing TTLs for versioned static assets via a CloudFront cache policy or HTTP Cache-Control headers ensures that CloudFront caches these immutable objects for longer periods, reducing the number of requests forwarded to the S3 origin. Enabling compression for text assets reduces the data transferred from origin to edge, further lowering origin load and costs. This directly addresses the low cache hit ratio and high origin request rate described in the scenario.

Answer

Disable CloudFront access logging so fewer requests are recorded and billing decreases automatically.

Answer

Set the distribution’s origin to use S3 Transfer Acceleration to reduce the number of requests hitting S3.

Answer

Force CloudFront to forward query strings to the origin for all static content so the latest versions are always fetched.

Question 7

A retail company lets developers deploy ECS services but they must never be able to modify IAM. The team currently uses an IAM user per developer with an admin-like policy, and several access keys have been leaked. You are asked to redesign access so that: (1) developers authenticate with temporary credentials, (2) they can create/update ECS services and related autoscaling resources, and (3) IAM changes are impossible even if a developer tries to attach new policies.

Which design best meets all requirements?

Accepted Answer

Use an IAM role that developers assume for deployments; attach least-privilege policies for ECS and Auto Scaling; and attach a permission boundary that does not allow iam:* actions, so additional inline or managed policies cannot grant IAM permissions.. Option B is correct because it uses an IAM role with temporary credentials (via AWS STS AssumeRole), satisfying the requirement to avoid long-lived access keys. The least-privilege policies for ECS and Auto Scaling grant only the necessary permissions, while the permission boundary explicitly denies iam:* actions, preventing developers from escalating privileges by attaching new policies. This combination ensures developers can deploy ECS services but cannot modify IAM in any way.

Answer

Create an IAM user for each developer and keep the existing broad permissions, rotating keys every 90 days.

Answer

Attach a policy that allows ecs:* and autoscaling:* and rely on developers to self-review that no IAM statements are added to their roles.

Answer

Create a single shared IAM role with full administrator permissions so developers can troubleshoot faster when deployments fail.

Question 8

Account B has an IAM role that includes kms:Decrypt for a specific KMS key ARN in account A. However, when the role tries to read an S3 object encrypted with that CMK, the application fails with AccessDenied: not authorized to perform kms:Decrypt. CloudTrail shows the KMS API call is denied by key policy. What is the most secure and correct fix?

Accepted Answer

Update the KMS key policy in account A to allow the account B role principal to use kms:Decrypt on the key.. Option B is correct because cross-account access to a customer managed KMS key (CMK) requires the key policy to explicitly grant the external IAM role principal the necessary permissions (e.g., kms:Decrypt). Even if the IAM role in Account B has an IAM policy allowing kms:Decrypt, the KMS key policy in Account A acts as a resource-based policy that must also allow the action; without this, the request is denied by the key policy, as shown in CloudTrail.

Answer

Update the IAM role in account B to include kms:Encrypt and kms:GenerateDataKey; then kms:Decrypt will start working automatically.

Answer

Disable key policy for the CMK by switching to S3-managed encryption, because KMS key policies are always enforced regardless of grants.

Answer

Create an SCP in account A that allows kms:Decrypt for all accounts, avoiding changes to the key policy.

Question 9

A read-heavy document portal repeatedly queries the same product catalogue data from DynamoDB with millisecond latency requirements. Which service can reduce read latency and table load?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, in-memory cache for Amazon DynamoDB that delivers up to 10x read performance improvement by caching frequently accessed data. For a read-heavy workload querying the same product catalogue data, DAX reduces read latency to microseconds and offloads read requests from the DynamoDB table, lowering consumed read capacity units and table load.

Answer

Amazon Kinesis Data Firehose

Answer

S3 Transfer Acceleration

Answer

AWS Glue Data Catalog

Question 10

A research team runs a latency-sensitive distributed training job on Amazon EC2. They deploy 80 identical nodes that exchange small messages frequently and need low network jitter. The job must run entirely within one Availability Zone. Which placement group strategy should a solutions architect use to maximize intra-cluster network performance?

Accepted Answer

Use a cluster placement group to keep all instances in close proximity within the same Availability Zone.. A cluster placement group is the correct choice because it places all 80 EC2 instances in close physical proximity within a single Availability Zone, ensuring low-latency, high-bandwidth network connections with minimal jitter. This placement group type is specifically designed for tightly coupled, latency-sensitive workloads like distributed training that require frequent, small message exchanges, as it leverages non-blocking, high-throughput networking between instances.

Answer

Use a spread placement group to distribute instances across distinct hardware to reduce jitter.

Answer

Use a partition placement group and place each node into its own partition for uniform latency.

Answer

Do not use a placement group; rely on the default EC2 scheduling to balance latency and availability.

Question 11

A production Amazon RDS database must continue serving the application if the primary DB instance fails. The application should reconnect automatically without hard-coding a new IP address. Which two actions should you take? Select two.

Accepted Answer

Create an RDS Multi-AZ deployment for the database.. A is correct because an RDS Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary DB instance fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, without requiring manual intervention. This ensures high availability and continuity for the production database.

Answer

Disable automated backups to reduce the time needed for failover.

Answer

Use a single-AZ deployment so the standby is not split across Zones.

Answer

Replace the database with an Amazon S3 bucket and store rows as objects.

Question 12

A patient portal receives bursts of orders that sometimes overwhelm a downstream fulfilment service. The architecture must absorb spikes and retry processing without losing requests. Which service should be placed between the web tier and fulfilment workers?

Accepted Answer

Amazon SQS queue. Amazon SQS is the correct choice because it acts as a durable, highly available message buffer between the web tier and the fulfilment workers. It decouples the components, allowing the web tier to enqueue requests immediately without waiting for the downstream service, and the workers can poll and process messages at their own pace. SQS automatically retains messages for up to 14 days and supports retries via a dead-letter queue, ensuring no requests are lost even during spikes.

Answer

AWS WAF

Answer

Amazon CloudFront

Answer

Amazon Route 53 weighted routing

Question 13

A media processing workflow generates analytics files that are accessed unpredictably. Some files become hot again months later. The team wants automatic storage cost optimisation without retrieval delays. What should be used? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering automatically moves objects between access tiers (frequent, infrequent, and archive instant access) based on changing access patterns, with no retrieval delays for hot objects and no operational overhead. This matches the unpredictable access pattern where files become hot again months later, as the service monitors access and adjusts storage class without custom scripts.

Answer

Manual monthly review and object copying

Answer

S3 Glacier Flexible Retrieval for all files

Answer

EFS One Zone for analytics files

Question 14

A media processing pipeline runs batch jobs overnight. The jobs are stateless, can be restarted from checkpoints, and can tolerate interruptions. The team wants to minimize compute cost. Which EC2 approach is the best fit?

Accepted Answer

Use Spot Instances and design the jobs to handle interruptions by checkpointing and retrying.. Spot Instances offer significant cost savings (up to 90% off On-Demand) but can be reclaimed by AWS with a 2-minute interruption notice. Since the batch jobs are stateless, checkpointable, and interruption-tolerant, they are an ideal workload for Spot Instances. Designing the jobs to save progress to a durable checkpoint (e.g., Amazon S3) and automatically retry on interruption ensures resilience while minimizing compute cost.

Answer

Use On-Demand instances to guarantee uninterrupted capacity.

Answer

Use a 1-year Reserved Instance for the current instance type and lock the fleet to it.

Answer

Use Savings Plans but still treat interruptions as failures that require manual intervention.

Question 15

A media platform runs a CPU-heavy thumbnail generation workload on an EC2 Auto Scaling group using t3.large instances. During peak traffic, p95 processing time increases significantly even though average CPU remains around 40–50%. CloudWatch also shows CPU credit depletion behavior. Which change will most directly improve performance predictability for this workload?

Accepted Answer

Change the Auto Scaling group instance type to a compute-optimized family (for example, c7i) to provide steady CPU performance.. The t3.large instances rely on CPU credits for burst performance, and when credits are exhausted, CPU performance is throttled to the baseline (e.g., 30% for t3.large). This causes unpredictable processing times during peak traffic, even if average CPU is moderate. Switching to a compute-optimized family like c7i provides dedicated, consistent CPU performance without credit-based throttling, directly improving predictability for CPU-heavy thumbnail generation.

Answer

Increase the t3.large maximum CPU credits and keep the Auto Scaling group using the same burstable instance type.

Answer

Add a placement group to the existing t3.large instances so they are packed close together for lower latency between nodes.

Answer

Switch the workload to run on Lambda with the same logic so invocations automatically scale without instance selection changes.