SAA-C03 Practice Test 19 — 15 Questions

Question 1

A Lambda-based travel booking site has unpredictable traffic spikes and users see latency caused by cold starts. The function must respond consistently during expected campaign windows. What should be configured? The architecture review board prefers a managed AWS-native control.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provisioned concurrency during campaign windows. Provisioned concurrency initializes a specified number of execution environments in advance, eliminating cold starts for those instances. During campaign windows, this ensures consistent latency by keeping the function warm and ready to handle spikes without the delay of initializing new environments. It is a managed AWS-native control that directly addresses the unpredictable traffic pattern described.

Answer

A larger deployment package

Answer

CloudTrail data events

Answer

Reserved concurrency only

Question 2

A media company stores original video masters in an Amazon S3 bucket in the us-east-1 Region. Compliance requires that a readable copy of every object exist in the eu-west-1 Region within 15 minutes of upload, and that the objects in eu-west-1 be usable directly by an application there. No transformations are required. Which S3 feature should the solutions architect enable?

Accepted Answer

S3 Cross-Region Replication (CRR) with S3 Versioning enabled on both the source and destination buckets. Cross-Region Replication is the purpose-built S3 capability for maintaining an automatically updated, readable object copy in a different Region, and its asynchronous replication latency generally falls well inside a 15-minute window. Versioning on both buckets is a prerequisite, so the architect must enable it as part of the design. The other choices either keep data in one Region, move data only between storage classes, or route requests without creating a second copy.

Answer

S3 Multi-Region Access Points with an active-passive routing configuration

Answer

S3 Same-Region Replication (SRR) between the us-east-1 bucket and a second bucket in us-east-1

Answer

S3 Lifecycle policies that transition objects to S3 Glacier Instant Retrieval in eu-west-1 after 15 minutes

Question 3

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a financial reporting platform. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy? The design must avoid adding custom operational scripts.

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. The bucket policy can use the `aws:sourceVpce` condition key to restrict access to requests originating from a specific VPC endpoint. This ensures that only traffic routed through that endpoint can access the S3 bucket, meeting the security team's requirement without custom scripts.

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A deny statement for all IAM users except the EC2 role

Question 4

A team wants to run containerized services with AWS-managed orchestration and autoscaling. They do NOT require Kubernetes compatibility. Which AWS service choice is most appropriate to meet these goals?

Accepted Answer

Amazon ECS. Amazon ECS is the most appropriate choice because it provides AWS-managed container orchestration and autoscaling without requiring Kubernetes compatibility. ECS integrates natively with AWS services like Application Auto Scaling and CloudWatch to automatically scale container tasks based on metrics such as CPU or memory utilization, meeting the team's requirements directly.

Answer

Amazon EKS

Answer

An EC2 Auto Scaling group only

Answer

Amazon SQS as the compute layer

Question 5

A batch analytics job runs for several hours each night and can be interrupted and restarted. Which EC2 purchasing option should minimize cost? The design must avoid adding custom operational scripts.

Accepted Answer

Spot Instances. Spot Instances are ideal for fault-tolerant, interruptible batch workloads because they offer significant cost savings (up to 90% off On-Demand pricing) by using spare EC2 capacity. Since the job can be interrupted and restarted, it can handle Spot Instance reclaimations without requiring custom operational scripts—AWS handles the interruption notification and automatic instance termination, and the job's restart logic can be built into the application or orchestration layer (e.g., AWS Batch).

Answer

On-Demand Instances only

Answer

Dedicated Hosts

Answer

Provisioned IOPS volumes

Question 6

A regional web application for a content publishing system must fail over automatically to a secondary Region if the primary endpoint becomes unhealthy. Which two services or features are required? The design must avoid adding custom operational scripts.

Accepted Answer

Route 53 failover routing with health checks. Option B is correct because Route 53 failover routing with health checks automatically redirects DNS queries to the secondary endpoint when the primary health check is deemed unhealthy, providing the required automatic failover without custom scripts. Option D is correct because a deployed standby application stack in the secondary Region is necessary to actually serve traffic after failover; DNS redirection alone cannot run the application. Option A is incorrect because AWS Organizations service control policies govern permissions and guardrails, not traffic failover or health-based routing. Option C is incorrect because S3 Transfer Acceleration only speeds up uploads to S3 buckets and does not provide regional failover or health checking.

Answer

AWS Organizations service control policies

Answer

S3 Transfer Acceleration

Question 7

Based on the exhibit, an application runs on Amazon Aurora MySQL. The writer instance is frequently near 85% CPU while the reader instance is under 20% CPU. Application traces show that most of the database traffic is read-only SELECT queries, but the code currently sends all queries to the writer endpoint. What should the solutions architect recommend to improve performance with the smallest functional change?

Accepted Answer

Point read-only database traffic to the Aurora reader endpoint and keep writes on the writer endpoint.. The Aurora reader endpoint distributes read-only traffic across all available reader instances, offloading the writer instance and reducing its CPU utilization. Since the application traces show most traffic is read-only SELECT queries, this change requires only modifying the connection string for reads while keeping writes on the writer endpoint, making it the smallest functional change.

Answer

Increase the writer instance size and keep all traffic on the writer endpoint.

Answer

Convert the cluster to a Multi-AZ RDS PostgreSQL deployment to get automatic failover and better read performance.

Answer

Enable cross-Region read replicas so SELECT queries are routed to a remote Region for improved performance.

Question 8

A web application for a IoT ingestion API is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy?

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP/HTTPS requests. It provides managed rules specifically designed to block common attack patterns like SQL injection and cross-site scripting (XSS) with minimal operational overhead, as AWS manages the rule updates and scaling. This makes it the ideal choice for protecting the IoT ingestion API without requiring custom code or manual configuration.

Answer

Network ACLs on the public subnets

Answer

Security groups on the application instances

Answer

AWS Shield Advanced only

Question 9

An ECS service runs on EC2 instances and is fronted by an ALB. The ALB spans two Availability Zones, and the ECS service desired count is 2 tasks. The underlying EC2 capacity uses an Auto Scaling group (ASG) with min size set to 1, and the ASG also spans only one subnet in practice. What is the most effective change to meet the requirement that the service continues during a single-AZ instance loss?

Accepted Answer

Increase ASG min size to at least 2 and ensure the ASG uses subnets in at least two Availability Zones.. The current architecture has a single point of failure because the Auto Scaling group (ASG) spans only one subnet (one Availability Zone). If that AZ fails, all EC2 instances are lost, and the ECS service cannot run any tasks. Increasing the ASG min size to at least 2 and configuring it to use subnets in at least two AZs ensures that EC2 instances are distributed across AZs, allowing the ECS service to maintain at least one task in the surviving AZ during a single-AZ failure.

Answer

Set the ECS deployment configuration to maximum percent 100 so tasks replace instances faster during rollouts.

Answer

Enable ALB connection draining longer than expected so existing connections survive longer during an AZ event.

Answer

Reduce task memory reservations to pack both tasks onto a single EC2 instance.

Question 10

A developer accidentally deletes important rows in an RDS database. The mistake is discovered 45 minutes later. The database has automated backups enabled with a retention period of 7 days. What is the best way to restore the database to a point just before the deletion?

Accepted Answer

Use point-in-time restore (PITR) to restore the database to a specific timestamp before the deletion, based on automated backups.. Point-in-time restore (PITR) allows you to restore an RDS DB instance to any second within the automated backup retention period (here, 7 days). Since the deletion occurred 45 minutes ago, you can specify a timestamp just before the deletion, and RDS will replay the transaction logs to bring the database to that exact state. This is the most precise and efficient recovery method for accidental data modifications.

Answer

Restore the latest manual snapshot and then run SQL scripts to revert the deletion.

Answer

Promote an existing read replica to be the primary and then copy the missing rows from logs.

Answer

Recreate the instance using the most recent CloudWatch metric alarm snapshot of storage metrics.

Question 11

Based on the exhibit, a partner account uploads encrypted objects to a central S3 bucket and later reads them back. The S3 permissions are correct, but the requests still fail. What change is required so the partner workload can use the customer-managed KMS key safely?

Accepted Answer

Update the CMK key policy, or add a tightly scoped grant, to allow the partner role the required KMS actions through S3.. When using a customer-managed KMS key (CMK) for SSE-KMS in a cross-account scenario, the key policy must explicitly grant the partner account's IAM role the necessary KMS actions (kms:Decrypt, kms:GenerateDataKey) to allow S3 to perform the encryption/decryption on behalf of the partner. Without this policy update or a tightly scoped grant, S3 cannot authorize the KMS operation even if the S3 bucket policy permits the upload/read.

Answer

Replace SSE-KMS with S3 object ACLs so the partner account can bypass KMS authorization.

Answer

Create a new bucket in the partner account and copy the objects there to avoid cross-account encryption.

Answer

Switch the bucket to SSE-S3 so the partner role no longer needs KMS permissions.

Question 12

A claims portal uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend? The design must avoid adding custom operational scripts.

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS PostgreSQL allows EC2 instances to authenticate using short-lived credentials (tokens) obtained via the IAM instance profile role, eliminating the need to store long-term credentials on the instance. The EC2 instance assumes an IAM role, which grants permission to generate an authentication token (valid for 15 minutes) using the AWS CLI or SDK, and that token is used as the password for the database connection. This approach satisfies the requirements of no stored credentials, short-lived authentication, and no custom operational scripts.

Answer

Store the database password in user data

Answer

Embed the database password in the AMI

Answer

Use a security group rule that allows only application instances

Question 13

A payments API uses an RDS MySQL database and must remain available during an Availability Zone failure with minimal application changes. What should the architect enable?

Accepted Answer

Multi-AZ deployment for the RDS DB instance. Multi-AZ deployment for RDS MySQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of an AZ failure, Amazon RDS automatically fails over to the standby, providing high availability with minimal application changes (the application only needs to reconnect to the same endpoint). This meets the requirement for availability during an AZ outage without requiring code modifications.

Answer

S3 Cross-Region Replication

Answer

Read replicas only

Answer

EBS snapshots every hour

Question 14

A media processing workflow in private subnets downloads large amounts of data from S3 through a NAT gateway. NAT data processing charges are high. What should the architect use to reduce cost?

Accepted Answer

Gateway VPC endpoint for Amazon S3. A Gateway VPC endpoint for Amazon S3 allows instances in private subnets to access S3 directly via the AWS network without traversing a NAT gateway, eliminating NAT data processing charges. This is the most cost-effective solution because NAT gateway costs are incurred per GB of data processed, and using a gateway endpoint avoids those charges entirely.

Answer

S3 Object Lambda

Answer

AWS Shield Advanced

Answer

A larger NAT gateway

Question 15

A web service runs on an Auto Scaling group (ASG). The team updates configuration (AMIs, environment variables) in a Launch Template and wants new instances created during scale-out to use the latest Launch Template version. What should the architect do?

Accepted Answer

Set the ASG to use the latest Launch Template version and optionally start an instance refresh for existing instances.. The ASG can be configured to use the latest version of a Launch Template by specifying the `$Latest` version alias. This ensures that any new instances launched during scale-out automatically use the most recent template configuration (e.g., updated AMI, environment variables). Additionally, an Instance Refresh can be triggered to roll the update across existing instances, aligning them with the same latest template version without manual intervention.

Answer

Leave the ASG attached to the previous Launch Template version so scale-out is stable.

Answer

Manually SSH into each new instance and reconfigure it after it launches.

Answer

Move the configuration changes into a security group rule so the ASG updates them automatically.