SAA-C03 Practice Test 15 — 15 Questions

Question 1

A team runs a latency-sensitive service on EC2 and needs consistent, low-latency block storage for a database. The application requires predictable performance and should be fast for random reads/writes. Which EBS volume type is the best choice?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

EBS gp3 (general purpose SSD). B is correct because gp3 is a general-purpose SSD that provides consistent, low-latency performance for random read/write operations, making it ideal for latency-sensitive databases. It offers a baseline of 3,000 IOPS and 125 MB/s throughput, with the ability to independently scale IOPS up to 16,000 and throughput up to 1,000 MB/s, ensuring predictable performance without the burst-bucket limitations of gp2.

Answer

EBS st1 (throughput optimized HDD)

Answer

EBS sc1 (cold HDD)

Answer

EBS magnetic (legacy magnetic)

Question 2

A company hosts a B2B file exchange site on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows administrators to establish secure shell access to EC2 instances without opening inbound SSH or RDP ports, using the Systems Manager agent and an IAM instance role. This meets the requirement for no internet-exposed ports and avoids custom operational scripts because Session Manager is a fully managed AWS service.

Answer

A bastion host with SSH open to 0.0.0.0/0

Answer

A public Elastic IP address on each instance

Answer

An internet gateway attached to the private subnet

Question 3

An EC2 workload runs in one region on a single instance type. For the last month, CloudWatch metrics show average CPU utilization of 12% and no sustained memory pressure. The team wants to reduce cost while maintaining the current performance level. What is the best first step?

Accepted Answer

Use AWS Compute Optimizer to get recommendations for instance type and size changes.. AWS Compute Optimizer analyzes historical utilization metrics (CPU, memory, I/O) and provides actionable recommendations for right-sizing instances. Given the average CPU utilization of only 12% and no memory pressure, Compute Optimizer will likely recommend a smaller instance type or family that matches the workload's actual resource needs, reducing cost without affecting performance.

Answer

Increase the instance size to reduce the risk of performance regression.

Answer

Switch to Spot Instances immediately to reduce cost regardless of utilization.

Answer

Disable detailed monitoring to lower CloudWatch charges.

Question 4

A company is designing a multi-Region disaster recovery (DR) strategy for a stateless web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS for MySQL database as its data store. The architecture must provide rapid failover with the lowest possible Recovery Point Objective (RPO) and Recovery Time Objective (RTO). Which of the following design choices will help achieve these objectives? (Choose four.)

Accepted Answer

Configure an active-passive failover strategy by deploying the application stack in two AWS Regions and using Amazon Route 53 health checks with a failover routing policy.. An active-passive failover strategy with Route 53 failover routing policy is correct because it provides rapid failover by directing traffic to the secondary Region only when health checks fail in the primary, minimizing RTO. Cross-Region read replicas with automatic failover are correct because they allow promoting a read replica to a primary in the secondary Region with low RPO (typically seconds) and automated failover, reducing RTO. Active-active configuration with latency-based routing is correct because it distributes traffic across both Regions, enabling immediate failover without DNS propagation delays, achieving very low RTO. Storing static assets and application state in S3 with cross-Region replication and CloudFront is correct because it ensures data durability and low-latency access, supporting rapid recovery with minimal RPO.

Answer

Set up Amazon RDS Multi-AZ deployment to enable automatic failover to a standby replica in a different Availability Zone within the primary Region.

Answer

Use an Amazon RDS for MySQL single-AZ deployment in the primary Region and take daily snapshots copied to the secondary Region.

Question 5

Based on the exhibit, the application should continue serving requests if one Availability Zone fails. Which change best improves resilience with the least operational complexity?

Accepted Answer

Add at least one subnet from a second Availability Zone to both the ALB and the Auto Scaling group.. Adding subnets from a second Availability Zone to both the ALB and the Auto Scaling group distributes the application across multiple AZs. This ensures that if one AZ fails, the ALB can route traffic to healthy targets in the remaining AZ, and the Auto Scaling group can maintain capacity by launching instances in the surviving AZ. This approach directly addresses the requirement to continue serving requests during an AZ failure with minimal operational complexity.

Answer

Increase the desired capacity in AZ-a so more instances can absorb the failure of that same Availability Zone.

Answer

Disable health checks so the ALB stops removing targets during brief infrastructure issues.

Answer

Move the application to a single larger instance type so the fleet has fewer moving parts.

Question 6

A line-of-business application runs on EC2 instances 24/7 with predictable usage for the next year. The application will stay in the same Region, and the team does not want to manage capacity interruptions. Which two purchase options can reduce cost compared with pure On-Demand pricing? Select two.

Accepted Answer

Buy Compute Savings Plans for the expected steady usage.. Compute Savings Plans (A) offer a flexible discount (up to 66%) in exchange for a 1- or 3-year commitment to a consistent amount of compute usage (measured in $/hour), automatically applying to any EC2 instance family, region, or even AWS Fargate/Lambda. This reduces cost compared to On-Demand while avoiding capacity interruptions, as the commitment covers the predictable steady-state usage. Standard Reserved Instances (B) provide a similar discount (up to 72%) for a specific instance family in a specific region, also with a 1- or 3-year term, and guarantee capacity for the specified AZ if you choose a zonal reservation, ensuring no interruptions.

Answer

Move the fleet to Spot Instances.

Answer

Use Dedicated Hosts to reserve physical servers for the application.

Answer

Stay entirely on On-Demand Instances because they are already the cheapest option.

Question 7

A travel booking site uses EC2 instances behind an ALB. CPU is consistently high during peak traffic, and request latency rises. What should be configured?

Accepted Answer

Auto Scaling policy based on an appropriate CloudWatch metric. An Auto Scaling policy based on a CloudWatch metric like CPUUtilization or request latency directly addresses the root cause: rising CPU and latency under peak traffic. By automatically adding EC2 instances when the metric breaches a threshold, the ALB can distribute load across more resources, reducing CPU per instance and improving response times. This is the standard AWS solution for dynamic scaling to maintain performance.

Answer

A VPC endpoint for CloudWatch only

Answer

S3 Object Lock

Answer

Disable health checks

Question 8

Based on the exhibit, a workload in private subnets must reach only Amazon S3 and AWS Secrets Manager. The team wants to eliminate internet exposure for those calls and reduce NAT gateway charges. What change should be made?

Accepted Answer

Create an S3 gateway endpoint and a Secrets Manager interface endpoint with private DNS, then remove NAT dependency for those service calls.. VPC Gateway Endpoints for S3 and VPC Interface Endpoints for Secrets Manager allow private subnet instances to access these services over the AWS network without traversing the internet or a NAT gateway. Enabling private DNS on the interface endpoint ensures that standard DNS names resolve to private IPs, eliminating the need for NAT and reducing costs.

Answer

Move the instances into a public subnet and restrict inbound access with security groups.

Answer

Add a NAT instance and disable the managed NAT gateway to lower cost.

Answer

Use VPC peering to a shared services VPC and route all AWS service traffic through that VPC.

Question 9

A media company runs a fleet of EC2 instances using Auto Scaling across multiple instance families (for example, m-series and c-series) in a single region. The business wants to commit to steady usage for one year to reduce cost, but the application team must retain flexibility to switch instance families and scale up/down as demand changes. They need the cost-reduction approach that best matches this flexibility. Which option is the best fit?

Accepted Answer

Purchase Compute Savings Plans so the commitment applies regardless of instance family changes within the selected scope.. Compute Savings Plans provide the most flexibility because they apply to any EC2 instance family (including m-series and c-series) within a region, automatically adjusting to instance family changes and scaling. This matches the requirement to commit to steady usage for one year while retaining the ability to switch families and scale up/down, offering up to 66% savings over On-Demand without locking the application to a specific instance type.

Answer

Purchase Standard Reserved Instances tied to a specific instance family and region, so the application can only run on the selected family.

Answer

Purchase Spot Instances for all capacity and disable On-Demand fallback to guarantee the lowest cost.

Answer

Rely only on On-Demand and reduce cost by using a CloudFront-only approach for all dynamic content.

Question 10

A company stores application logs in an S3 bucket. They retain logs for 180 days. Compliance requires that the logs be immutable once written, but the business only reviews logs about once per month. Currently, the team stores everything in S3 Standard, and their monthly S3 bill is too high. They want to reduce storage cost without changing the requirement to keep logs for 180 days.

Which lifecycle approach best meets the goal?

Accepted Answer

Use a lifecycle policy to transition objects older than 30 days to S3 Standard-IA, and keep them there until day 180.. It transitions logs older than 30 days to S3 Standard-IA, which offers lower storage costs than S3 Standard while still providing low-latency access for monthly reviews. The lifecycle policy keeps the objects in S3 Standard-IA until day 180, meeting the 180-day retention requirement without incurring the higher cost of S3 Standard for the entire period. S3 Standard-IA has a minimum storage duration of 30 days, which is satisfied by the 30-day transition threshold, and the objects remain immutable as S3 Object Lock is not affected by lifecycle transitions.

Answer

Use a lifecycle policy to transition objects older than 30 days to S3 Glacier Deep Archive and delete after 30 days.

Answer

Use a lifecycle policy to transition objects older than 30 days to S3 Intelligent-Tiering with no minimum storage duration.

Answer

Disable lifecycle management and instead lower costs by deleting objects immediately after they are written.

Question 11

An Aurora PostgreSQL cluster is experiencing high read latency because 85% of traffic consists of read-only queries. The write workload must stay on the writer instance, and the team wants to offload reads without changing the application’s core query patterns. What is the best architectural option?

Accepted Answer

Add Aurora reader instances (read replicas) and route read queries to the reader endpoint while keeping writes on the writer endpoint.. Adding Aurora reader instances (read replicas) and routing read queries to the reader endpoint offloads read traffic from the writer instance without altering application query patterns. Aurora reader endpoints automatically distribute read-only connections across all replicas, reducing latency on the writer while keeping writes on the writer instance. This directly addresses the 85% read-heavy workload without requiring application changes.

Answer

Increase the writer instance size so it can handle more reads and writes simultaneously.

Answer

Enable Multi-AZ failover only and rely on the standby to serve reads in normal operation.

Answer

Move the read workload to ElastiCache Redis while keeping DynamoDB as the SQL data source.

Question 12

A Lambda function for a mobile banking backend needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it natively supports automatic rotation of secrets on a configurable schedule (e.g., every 30 days) without requiring custom scripts. It also provides fine-grained access control and integrates directly with Lambda via the AWS SDK, keeping the password out of environment variables and code.

Answer

An encrypted object in Amazon S3

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

A KMS-encrypted Lambda environment variable

Question 13

A web application runs in private subnets with no NAT gateway. It needs to retrieve credentials from AWS Secrets Manager at runtime. After a recent network hardening change, the application logs timeout errors when calling Secrets Manager.

Which change will most directly enable private connectivity to Secrets Manager while keeping the subnets NAT-free?

Accepted Answer

Create an interface VPC endpoint (AWS PrivateLink) for the Secrets Manager service and update the security group rules to allow HTTPS from the application subnets.. An interface VPC endpoint (AWS PrivateLink) for Secrets Manager creates a private, direct connection to the service within the VPC, using Elastic Network Interfaces (ENIs) in the subnets. This allows the application to reach Secrets Manager over HTTPS without traversing the internet, a NAT gateway, or an internet gateway, directly resolving the timeout errors caused by the network hardening change that removed public internet access.

Answer

Add a public DNS entry in the instance /etc/hosts pointing Secrets Manager to the instance’s private IP so requests do not leave the VPC.

Answer

Attach an internet gateway to the private route table so that Secrets Manager traffic can reach public endpoints without NAT.

Answer

Enable S3 VPC endpoint and store the secrets in an S3 bucket instead of Secrets Manager, then retrieve them using S3 gateway endpoints.

Question 14

Your ecommerce app runs behind an Application Load Balancer (ALB) and uses an RDS database for orders. During an AZ impairment in us-east-1, customers report that checkout takes several minutes to recover. The current design places EC2 instances only in private subnets of AZ-a, while the ALB spans multiple subnets. The RDS DB instance is Multi-AZ. Management wants automatic recovery within the same Region.

Which change best addresses the issue with minimal operational overhead?

Accepted Answer

Move the EC2 instances into Auto Scaling Groups that span private subnets in at least two AZs, keeping the ALB spanning those subnets.. The current design has a single point of failure: all EC2 instances are in one Availability Zone (AZ-a). During an AZ impairment, those instances become unreachable, causing the checkout process to fail until the impairment ends or manual intervention occurs. By placing EC2 instances in an Auto Scaling Group spanning at least two AZs, the application can automatically recover by launching new instances in a healthy AZ, while the ALB distributes traffic across the surviving AZs. This minimizes operational overhead as Auto Scaling handles instance replacement automatically.

Answer

Switch from RDS Single-AZ to RDS Multi-AZ, keeping the EC2 instances in only AZ-a because failover will still reach them.

Answer

Terminate the ALB and use a Network Load Balancer (NLB) in front of the existing single-AZ EC2 instances.

Answer

Add more EC2 instances in AZ-a and increase the ALB health check thresholds to avoid unnecessary replacements during impairments.

Question 15

A DynamoDB table uses this schema: partition key = customerId, sort key = timestamp. During a marketing campaign, one customer generates extremely high read traffic and the application sees ProvisionedThroughputExceeded errors even though the table’s total capacity is sufficient. What change most directly improves read distribution across partitions?

Accepted Answer

Add a salt component to the partition key by changing it to customerId#salt, where salt is derived from a hash of requestId so a single customer’s requests are spread across many partitions; keep the sort key as timestamp.. Adding a salt to the partition key (e.g., customerId#hash(requestId)) distributes the read-heavy customer's data across multiple physical partitions. This prevents a single hot partition from throttling requests, even when the table's total provisioned capacity is sufficient. DynamoDB's partition key determines the internal hash used for data placement, so increasing partition key cardinality directly improves read distribution.

Answer

Increase the table’s provisioned read capacity units while keeping partition key = customerId.

Answer

Remove the sort key and use timestamp as the partition key to increase cardinality.

Answer

Switch to on-demand capacity and rely on DynamoDB to automatically distribute reads across partitions.