SAA-C03 Practice Test 18 — 15 Questions

Question 1

A media archive needs low-latency full-text search across product descriptions and filtered attributes. Which managed service is most suitable?

Accepted Answer

Amazon OpenSearch Service. Amazon OpenSearch Service is the correct choice because it provides a managed, scalable solution for full-text search and real-time analytics on large volumes of data. It supports low-latency queries across product descriptions and filtered attributes through its inverted index and query DSL, making it ideal for media archive search use cases.

Answer

AWS Config

Answer

Amazon EFS

Answer

Amazon SQS

Question 2

Based on the exhibit, what is the best way to let private EC2 instances reach Amazon S3 and AWS Systems Manager without sending traffic through the internet or a NAT gateway?

Accepted Answer

Create a gateway endpoint for S3 and interface endpoints for Systems Manager, EC2Messages, and SSMMessages.. Gateway endpoints for S3 allow private EC2 instances to access S3 via AWS's private network without traversing the internet or a NAT gateway, using prefix lists and route table entries. Interface endpoints for Systems Manager, EC2Messages, and SSMMessages provide private connectivity to AWS Systems Manager via PrivateLink, enabling secure instance management without public IPs or NAT.

Answer

Add a more permissive security group rule allowing outbound 0.0.0.0/0 on all ports.

Answer

Replace the NAT gateway with a network ACL that allows ephemeral ports to the internet.

Answer

Move the instances to public subnets so they can reach AWS services directly.

Question 3

Based on the exhibit, a serverless checkout API is implemented in AWS Lambda and deployed in one Region. The function has a cold-start time of 700-900 ms on the first request after idle periods. Marketing launches a predictable traffic spike every weekday at 09:00 UTC, and the p95 latency target is under 150 ms during the first five minutes of the spike. What should the solutions architect do to meet the latency target while controlling cost?

Accepted Answer

Configure provisioned concurrency and scale it up before the predictable spike begins.. Provisioned concurrency pre-warms a specified number of execution environments so that the Lambda function has zero cold-start latency when invoked. By scheduling the provisioned concurrency to scale up before the 09:00 UTC spike, the function can serve the first requests within the 150 ms p95 latency target, while the scheduled scaling down after the spike controls cost by releasing unused capacity.

Answer

Increase the Lambda memory size and leave concurrency at the default value.

Answer

Put the Lambda function behind an Application Load Balancer so the load balancer absorbs the initialization delay.

Answer

Set reserved concurrency to the expected peak so Lambda will pre-create execution environments.

Question 4

A company needs to implement session management for a web application. Sessions must persist across multiple EC2 instances, survive EC2 failures, and be accessible with sub-millisecond latency. Sessions must also be sortable by last-access time to expire the oldest sessions first. Which caching solution should a solutions architect recommend?

Accepted Answer

Amazon ElastiCache for Redis with sessions stored as sorted sets. Amazon ElastiCache for Redis satisfies all requirements: multi-instance session sharing (sessions stored externally), sub-millisecond latency, survival of EC2 failures (stored outside instances), and sorted sets (ZSET data structure) for ordering sessions by last-access score.

Memcached supports only simple key-value pairs — it cannot perform sorted set operations to order sessions by last-access time. Memcached also lacks replication, meaning a node failure loses all cached sessions.

Answer

Amazon ElastiCache for Memcached with session data stored as key-value pairs

Answer

Amazon DynamoDB with TTL enabled for session expiration

Answer

ElastiCache for Redis with sticky sessions enabled on the Application Load Balancer

Question 5

A service consumes messages from an SQS queue. Recently, a new message format started failing validation in the consumer. The consumer catches the exception but cannot successfully process those messages without code changes. The team wants failed messages to be isolated for later investigation instead of being retried indefinitely. What should they configure?

Accepted Answer

Configure a dead-letter queue (DLQ) with a redrive policy and set maxReceiveCount so messages move after repeated failed receives.. A dead-letter queue (DLQ) with a redrive policy is the correct solution because it allows messages that repeatedly fail processing to be moved to a separate queue after exceeding the maxReceiveCount. This isolates problematic messages for later investigation without blocking the main queue or causing infinite retries. The consumer catches the exception, so the message is not deleted and is returned to the queue for redelivery; the DLQ ensures that after a configurable number of attempts, the message is redirected instead of being retried indefinitely.

Answer

Set the queue’s retention period to 1 minute and rely on messages expiring naturally.

Answer

Increase the visibility timeout to 7 days so failed messages cannot be retried.

Answer

Publish the same message again to SNS on every failure so a different subscriber might succeed.

Question 6

A production Amazon RDS database has automated backups enabled with sufficient retention. At 10:30 UTC, a release corrupts specific rows. The issue is detected at 10:45 UTC. The team wants to restore the database state to before the corruption with minimal complexity. What should they do?

Accepted Answer

Perform a point-in-time restore (PITR) to a timestamp just before 10:30 UTC and create a restored DB instance/cluster.. Amazon RDS Point-in-Time Restore (PITR) allows you to restore the database to any second within the backup retention period, using automated backups and transaction logs. By restoring to a timestamp just before 10:30 UTC, you can recover the database to a state before the corruption occurred, creating a new DB instance/cluster with minimal complexity and no data loss from the uncorrupted period.

Answer

Change the VPC route tables so the database restarts in a clean state.

Answer

Relaunch the same DB instance in the same Availability Zone and rely on caching to revert the changes.

Answer

Enable a DLQ on the database to store invalid SQL statements until the system is fixed.

Question 7

Developers for a financial reporting platform need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center (formerly AWS SSO) allows you to define permission sets with time-bound access, ensuring that developers receive temporary elevated permissions that automatically expire. Combined with AWS CloudTrail, all API calls made during the troubleshooting session are logged for audit, meeting the security team's requirements for approvals, expiry, and audit logging.

Answer

Disable CloudTrail during troubleshooting

Answer

Create shared administrator access keys for the team

Answer

Attach AdministratorAccess permanently to every developer role

Question 8

A inventory service exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most? The design must avoid adding custom operational scripts.

Accepted Answer

CloudFront caching with appropriate TTLs. CloudFront caches responses at edge locations based on configured TTLs (Cache-Control or Expires headers). If the S3 origin becomes temporarily unavailable, CloudFront can still serve stale or cached content to users, maintaining availability without any custom scripts or failover logic. This directly addresses the requirement to serve cached pages during short S3 outages.

Answer

AWS Backup Vault Lock

Answer

IAM Access Analyzer

Answer

S3 Select

Question 9

A company hosts a financial reporting platform on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use?

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows secure shell access to EC2 instances without opening inbound ports (SSH 22 or RDP 3389) to the internet. It uses the AWS Systems Manager agent on the instance, combined with an IAM instance role that grants permissions to communicate with the Systems Manager API, establishing a bidirectional tunnel over HTTPS (port 443). This satisfies the requirement of no public-facing SSH or RDP ports while enabling administrative connectivity.

Answer

A public Elastic IP address on each instance

Answer

A bastion host with SSH open to 0.0.0.0/0

Answer

An internet gateway attached to the private subnet

Question 10

A video processing pipeline runs batch jobs that are safe to interrupt and restart. The jobs checkpoint progress to durable storage every few minutes, and the team can automatically resubmit from the last checkpoint. They want to minimize compute cost while accepting that capacity can be interrupted. Which launch configuration for the processing workers is the best cost-optimized choice?

Accepted Answer

Launch the worker nodes as Spot Instances, and configure the job resubmission logic to restart from checkpoints upon interruption.. Spot Instances offer significant cost savings (up to 90% compared to On-Demand) and are ideal for fault-tolerant, interruptible workloads. Since the pipeline checkpoints progress to durable storage and can automatically resume from the last checkpoint, using Spot Instances minimizes compute cost while accepting interruptions.

Answer

Launch the worker nodes as On-Demand Instances with no interruption handling so the pipeline never needs resubmission.

Answer

Launch the worker nodes as Reserved Instances to guarantee capacity and reduce cost, ignoring interruptions.

Answer

Use Savings Plans and also set the job scheduler to never start new jobs unless previous jobs finish without interruption.

Question 11

A patient portal receives bursts of orders that sometimes overwhelm a downstream fulfilment service. The architecture must absorb spikes and retry processing without losing requests. Which service should be placed between the web tier and fulfilment workers? The design must avoid adding custom operational scripts.

Accepted Answer

Amazon SQS queue. Amazon SQS is the correct choice because it acts as a durable, fully managed message buffer that decouples the web tier from the fulfilment workers. When bursts of orders arrive, SQS queues the messages and allows workers to poll at their own pace, absorbing spikes without data loss. The built-in retry logic (visibility timeout and dead-letter queue) ensures failed processing attempts are automatically retried, and no custom operational scripts are needed.

Answer

AWS WAF

Answer

Amazon CloudFront

Answer

Amazon Route 53 weighted routing

Question 12

A batch analytics job currently uses two NAT gateways in each of three Availability Zones, but only one private subnet per AZ needs outbound internet access. What should the architect review first?

Accepted Answer

Whether one NAT gateway per AZ is sufficient for the required private subnets. The question asks what the architect should review first. Using two NAT gateways per Availability Zone (AZ) when only one private subnet per AZ needs outbound internet access is likely over-provisioned and costly. The architect should first verify if a single NAT gateway per AZ can handle the traffic load, as NAT gateways are highly available within an AZ and can support up to 45 Gbps of bandwidth. This review directly addresses cost optimization without sacrificing functionality.

Answer

Replacing every NAT gateway with an internet gateway attached to private subnets

Answer

Disabling route tables

Answer

Moving all workloads to public subnets

Question 13

A web application runs on an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). After a new release, instances begin failing ALB health checks with errors like 502 while the application is still starting up. CloudWatch shows that the ASG replaces the instances before they finish initializing, so traffic never reaches healthy targets. Which change most directly prevents premature replacement during startup so traffic can resume as soon as the instances are actually healthy?

Accepted Answer

Increase the Auto Scaling group health check grace period to cover application startup and initialization time.. B is correct because the Auto Scaling group health check grace period allows instances a specified amount of time to initialize before the ASG starts checking their health status. By increasing this grace period to cover the application startup time, the ASG will not prematurely replace instances that are still initializing, allowing them to pass the ALB health checks and begin receiving traffic once they are actually healthy.

Answer

Reduce the ALB health check timeout to 1 second so failures are detected faster.

Answer

Enable connection draining on the ALB target group but set deregistration delay to 0 seconds.

Answer

Switch the ALB target group health checks from HTTP to TCP so the application does not need to return HTTP 200.

Question 14

A company runs a stateless web API on Amazon EC2 behind an Application Load Balancer. The team notices that during business hours, the ALB starts queueing requests and the average request latency rises. They want to scale out quickly and reliably based on demand, not CPU alone. Which Auto Scaling approach best matches this requirement?

Accepted Answer

Use target tracking scaling based on ALB request count per target.. Target tracking scaling based on ALB request count per target directly aligns with the requirement to scale out based on demand (request queuing and latency) rather than CPU alone. This policy automatically adjusts the Auto Scaling group size to maintain a target value for the average number of requests per instance, which is a more reliable indicator of load for a stateless web API than CPU utilization.

Answer

Use a fixed-size Auto Scaling group and increase capacity manually once per hour.

Answer

Scale based only on EC2 instance memory utilization, regardless of load.

Answer

Use step scaling with a single threshold on average network-in bytes.

Question 15

A SaaS company runs a production API on an EC2 Auto Scaling group with steady demand 24/7. The team uses multiple instance types over time (they switch types during tuning) but the overall compute hours are stable. They want a cost reduction without committing to a specific instance type or size. Which AWS pricing option best meets the requirement?

Accepted Answer

Purchase a Compute Savings Plan for the region and commit to a dollar-per-hour amount. B is correct because a Compute Savings Plan provides the flexibility to change instance types, sizes, and even compute services (e.g., EC2, Fargate, Lambda) within a region while still receiving discounted rates (up to 66% vs. on-demand). This matches the requirement of reducing costs without committing to a specific instance type or size, as the plan is based on a dollar-per-hour commitment rather than instance family or tenancy.

Answer

Buy EC2 Spot Instances for the Auto Scaling group to maximize savings

Answer

Purchase Reserved Instances that are limited to a single specific instance type in the Auto Scaling group

Answer

Use on-demand only, and rely on Auto Scaling to reduce cost during low utilization