SAA-C03 Practice Test 19 — 15 Questions

Question 1

An application uses an Amazon Aurora DB cluster. The cluster performs an automatic failover from the writer instance to a standby instance. After failover completes, reads succeed, but all new writes fail with errors indicating the application is connecting to the old writer endpoint. Which change best fixes the resiliency issue after failover?

Accepted Answer

Update the application to use the Aurora cluster writer endpoint (or the cluster endpoint intended for writes) rather than an instance-specific endpoint.. The application is failing writes because it is connecting to the old writer instance's endpoint, which is no longer the writer after failover. The Aurora cluster writer endpoint is a DNS name that always points to the current primary (writer) instance, regardless of failovers. By using the cluster writer endpoint, the application automatically connects to the new writer after failover, eliminating the need to manually update connection strings.

Answer

Enable Multi-AZ on the individual writer instance settings so it can automatically create a new instance during failover.

Answer

Increase the failover timeout for Aurora to 60 minutes to ensure the app finishes reconnecting.

Answer

Switch the cluster to a single-AZ configuration to reduce connection retries after failover.

Question 2

An application runs on EC2 in us-east-1 and frequently reads objects from an S3 bucket that is physically located in us-west-2. The finance team reports unexpectedly high inter-Region data transfer charges because the application retrieves objects for many user requests. A constraint: the bucket in us-west-2 must remain the system of record for compliance, but the application can read from a replica in us-east-1.

What should the solutions architect do to minimize network spend while meeting the compliance constraint?

Accepted Answer

Enable S3 Cross-Region Replication from the us-west-2 source bucket to a destination bucket in us-east-1, and update the app to read from the us-east-1 bucket.. Option A is correct because S3 Cross-Region Replication (CRR) automatically replicates objects from the source bucket in us-west-2 to a destination bucket in us-east-1, satisfying the compliance requirement that the us-west-2 bucket remains the system of record. By updating the application to read from the us-east-1 bucket, all read traffic stays within the same region, eliminating inter-region data transfer charges for object retrievals. This approach directly addresses the cost issue while preserving the original bucket as the authoritative source.

Answer

Create an interface VPC endpoint for S3 in us-east-1 and keep all object reads pointing to the us-west-2 bucket.

Answer

Use VPC peering between two regions and route all requests to the us-west-2 bucket over the peering link.

Answer

Use Route 53 latency-based routing to send users to a us-west-2 web endpoint and keep the S3 bucket unchanged.

Question 3

An application uses DynamoDB to store order status. Reads happen extremely frequently for the same few keys (for example, the most recent orders), and the team wants lower read latency without changing the table’s partition key design. Which AWS service best fits this requirement?

Accepted Answer

Amazon DAX (DynamoDB Accelerator) to cache frequently read items. Amazon DAX (DynamoDB Accelerator) is an in-memory cache that sits between your application and DynamoDB, providing microsecond read latency for frequently accessed items. Because the workload involves extremely frequent reads of the same few keys (hot keys), DAX reduces the load on the DynamoDB table and delivers faster responses without requiring any changes to the partition key design.

Answer

Provision AWS WAF rules to reduce DynamoDB read latency caused by bots

Answer

Enable multi-region writes in DynamoDB Global Tables to speed up reads locally

Answer

Add more read capacity units to DynamoDB and avoid caching entirely

Question 4

An ECS service runs on EC2 instances and is fronted by an ALB. The ALB spans two Availability Zones, and the ECS service desired count is 2 tasks. The underlying EC2 capacity uses an Auto Scaling group (ASG) with min size set to 1, and the ASG also spans only one subnet in practice. What is the most effective change to meet the requirement that the service continues during a single-AZ instance loss?

Accepted Answer

Increase ASG min size to at least 2 and ensure the ASG uses subnets in at least two Availability Zones.. The current architecture has a single point of failure because the Auto Scaling group (ASG) spans only one subnet (one Availability Zone). If that AZ fails, all EC2 instances are lost, and the ECS service cannot run any tasks. Increasing the ASG min size to at least 2 and configuring it to use subnets in at least two AZs ensures that EC2 instances are distributed across AZs, allowing the ECS service to maintain at least one task in the surviving AZ during a single-AZ failure.

Answer

Set the ECS deployment configuration to maximum percent 100 so tasks replace instances faster during rollouts.

Answer

Enable ALB connection draining longer than expected so existing connections survive longer during an AZ event.

Answer

Reduce task memory reservations to pack both tasks onto a single EC2 instance.

Question 5

Developers for a image sharing application need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center (formerly AWS SSO) allows you to define permission sets that grant time-bound, elevated access to production resources. By integrating with CloudTrail, every access request, approval, and action is logged for audit. This meets the security team's requirements for approvals, expiry, and audit logging without compromising security.

Answer

Disable CloudTrail during troubleshooting

Answer

Create shared administrator access keys for the team

Answer

Attach AdministratorAccess permanently to every developer role

Question 6

An application in account A needs to use an encrypted EBS volume whose snapshots were copied from account B. The EBS volume is encrypted with a customer-managed KMS key in account B. After attaching the volume, the instance fails to mount it and logs show KMS access errors (kms:Decrypt) for the instance role. The instance role in account A already has an IAM policy allowing kms:Decrypt on that key ARN, but the mount still fails. What must be updated in account B to allow the mount to succeed?

Accepted Answer

Update the KMS key policy in account B to allow the instance role’s principal from account A to call kms:Decrypt and kms:CreateGrant.. The instance role in account A has an IAM policy allowing kms:Decrypt on the key ARN, but cross-account KMS access requires the key policy in account B to explicitly grant the external principal (the instance role's ARN) the necessary permissions. Without a key policy statement in account B that allows kms:Decrypt and kms:CreateGrant for the instance role, the KMS service will deny the decryption request, even if the IAM policy in account A permits it. The kms:CreateGrant permission is required because attaching an encrypted EBS volume internally creates a grant to allow the EC2 service to use the key on behalf of the instance.

Answer

Enable KMS automatic key rotation for the customer-managed key in account B.

Answer

Attach the key policy as an IAM permissions policy to the instance role in account A only; key policies are not evaluated cross-account.

Answer

Disable encryption on the EBS volume until authorization is fixed, then re-enable encryption after mount.

Question 7

An application serves static images through Amazon CloudFront. The team observes higher-than-expected origin fetches, which increases origin bandwidth costs. Which change most directly improves CloudFront cache reuse to reduce origin requests for the static content?

Accepted Answer

Set appropriate Cache-Control headers (or origin cache settings) so CloudFront caches responses longer. Option A is correct because setting appropriate Cache-Control headers (e.g., max-age or s-maxage) or configuring origin cache settings tells CloudFront how long to keep objects in its edge cache before revalidating with the origin. By extending the cache duration, CloudFront serves more requests from its cache, reducing the number of origin fetches and lowering bandwidth costs.

Answer

Disable caching for the distribution so every request goes back to the origin

Answer

Configure CloudFront to forward all request headers and query strings to the origin

Answer

Move the S3 bucket to a different AWS Region, without changing CloudFront caching behavior

Question 8

An application runs in private subnets and must access Amazon S3, Amazon DynamoDB, and AWS Secrets Manager. The security team wants the traffic to stay on the AWS network and the finance team wants to eliminate NAT Gateway charges. Which three changes should they make? Select three.

Accepted Answer

Create gateway VPC endpoints for S3.. A gateway VPC endpoint for S3 allows instances in private subnets to access S3 over the AWS network without traversing the internet or a NAT gateway. This eliminates NAT Gateway charges and keeps traffic on the AWS backbone, meeting both security and cost requirements.

Answer

Place the instances in public subnets with an internet gateway.

Answer

Keep the NAT Gateway and add a proxy instance for service access.

Question 9

An order lookup API repeatedly reads the same few items from DynamoDB. The application can tolerate slightly stale data for a few seconds, and the team wants the lowest-latency design with minimal application changes. Which two changes should they make? Select two.

Accepted Answer

Put Amazon DynamoDB Accelerator (DAX) in front of the table.. Amazon DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB that provides microsecond read latency, which is ideal for repeated reads of the same few items. Since the application can tolerate slightly stale data, DAX's default write-through caching with a TTL of 5 minutes ensures low latency without requiring application code changes beyond adding the DAX client.

Answer

Switch all access to strongly consistent reads for faster results.

Answer

Increase the item size so fewer requests are needed.

Answer

Replace the table with Amazon EBS volumes mounted on EC2 instances.

Question 10

An application stores user-uploaded binaries in S3. Access is unpredictable for the first month, then most objects become cold. The team wants the cheapest approach that avoids manually guessing access patterns. Which two actions are best? Select two.

Accepted Answer

Enable S3 Intelligent-Tiering on the bucket.. Option A is correct because S3 Intelligent-Tiering automatically moves objects between access tiers (frequent, infrequent, archive instant, and deep archive) based on changing access patterns, without manual lifecycle rules. This is ideal for unpredictable access in the first month followed by cold storage, as it optimizes cost by charging only for the storage tier actually used per object, with a small monthly monitoring fee per object.

Answer

Keep all objects in S3 Standard because lifecycle transitions add too much management.

Answer

Copy all binaries to Amazon EFS so retrieval is faster.

Answer

Disable versioning because S3 Intelligent-Tiering needs it to work.

Question 11

An application team sees that a fleet of EC2 instances averages 15% CPU utilization and has no memory pressure. The service must keep running continuously, but the team wants to lower cost with minimal risk. Which two actions should they take first? Select two.

Accepted Answer

Use Compute Optimizer recommendations to identify a smaller instance type.. AWS Compute Optimizer analyzes historical utilization metrics (CPU, memory, network) and provides rightsizing recommendations. Since the fleet averages only 15% CPU with no memory pressure, downsizing to a smaller instance type reduces cost without impacting performance. This is the first step to identify the optimal instance family and size.

Answer

Move the workload to Dedicated Hosts.

Answer

Add a second NAT Gateway.

Answer

Enable Provisioned Concurrency for the EC2 workload.

Question 12

An orders service currently sends HTTP requests directly to two downstream services (inventory and shipping). During peak load, inventory slows down, causing the orders service to slow as well. The team wants the orders service to remain responsive even when a downstream service is temporarily slow or restarted. Which design change best achieves this resiliency goal?

Accepted Answer

Introduce Amazon SQS as a buffer between orders and downstream services, with consumers processing from the queue.. Option B is correct because introducing Amazon SQS as a buffer decouples the orders service from the downstream inventory and shipping services. The orders service can immediately enqueue messages and respond to the client, while downstream consumers process messages at their own pace. This prevents backpressure from a slow or restarting downstream service from blocking the orders service, achieving the desired resiliency.

Answer

Keep HTTP calls but add longer client timeouts so orders requests wait for slow downstream responses.

Answer

Replace the downstream services with AWS Lambda functions that are invoked synchronously by the orders service.

Answer

Call the downstream services in parallel threads to reduce waiting time during peak load.

Question 13

Based on the exhibit, which EBS volume type should the team use to meet the performance need at lower cost than overprovisioning capacity?

Accepted Answer

Use gp3 and provision the needed IOPS independently of volume size.. The team needs to meet performance requirements at lower cost than overprovisioning capacity. gp3 allows you to provision baseline performance of 3,000 IOPS and 125 MiB/s throughput for any volume size, and you can independently increase IOPS up to 16,000 and throughput up to 1,000 MiB/s without needing to increase volume size. This avoids the cost of overprovisioning large gp2 volumes to achieve higher IOPS, which are tied to volume size (3 IOPS per GiB).

Answer

Use sc1 because it is optimized for infrequent access and large objects.

Answer

Use st1 because it provides high throughput for streaming data.

Answer

Use standard magnetic storage because it is compatible with all EC2 instances.

Question 14

An order service must notify inventory, shipping, and analytics independently when payment succeeds. The shipping service may be slow, but the order service should keep accepting new orders even if one consumer is unavailable. Which two changes best improve resilience? Select two.

Accepted Answer

Publish the event to an Amazon SNS topic and subscribe a separate SQS queue for each downstream service.. Option A is correct because publishing the event to an SNS topic allows the order service to emit a single notification that is then fanned out to multiple SQS queues, one per downstream service. This decouples the order service from the consumers, so even if the shipping service is slow or unavailable, the order service can continue accepting new orders without blocking. Each SQS queue provides independent buffering and retry logic, ensuring resilience against individual consumer failures.

Answer

Have the order service call all downstream services synchronously so failures are visible immediately.

Answer

Use one shared SQS queue for all three consumers so they always process the same message.

Answer

Store the event in a relational database and poll it from every consumer on a fixed schedule.

Question 15

An event consumer sometimes processes the same SQS message more than once due to timeouts and retries. The consumer must ensure the payment is not charged twice. What design choice best addresses this requirement?

Accepted Answer

Make the payment operation idempotent by using an idempotency key and skipping side effects when the key indicates the payment already succeeded.. Option B is correct because making the payment operation idempotent using an idempotency key ensures that even if the same SQS message is processed multiple times due to timeouts and retries, the payment will only be charged once. The consumer checks the idempotency key before executing the payment; if the key indicates the payment already succeeded, the consumer skips the side effect. This pattern directly addresses the requirement of not charging twice without relying on SQS's at-least-once delivery guarantee.

Answer

Assume messages are processed exactly once because SQS uses durable storage.

Answer

Increase the consumer visibility timeout to several days so messages are not redelivered.

Answer

Delete the message immediately even if processing fails validation.