SAA-C03 Practice Test 2 — 10 Questions

Question 1

A serverless checkout API uses AWS Lambda behind API Gateway. Every weekday at 09:00 UTC, marketing triggers a predictable surge. The first few minutes after each surge show cold-start latency, but traffic volume is forecastable and the business wants stable p95 latency. Which two changes should the team implement? Select two.

Accepted Answer

Publish a Lambda version and attach provisioned concurrency to an alias that points to that version.. Provisioned concurrency keeps a specified number of Lambda execution environments initialized and ready to respond immediately, eliminating cold starts for predictable traffic patterns. By publishing a Lambda version and attaching provisioned concurrency to an alias pointing to that version, the team ensures that the surge at 09:00 UTC is handled without cold-start latency, stabilizing p95 latency.

Answer

Increase the Lambda timeout so the function has more time to initialize during the spike.

Answer

Double the memory size during the spike without changing the concurrency model.

Answer

Move the function into more Availability Zones so the platform can spread cold starts across regions.

Question 2

A system processes events from Amazon SQS and sometimes sees duplicate messages due to retries. The business requirement is that each payment must be charged at most once. What design choice best addresses this resiliency requirement?

Accepted Answer

Implement idempotent processing using a deduplication key (for example, paymentId) and record completed charges so duplicates are safely ignored.. Option B is correct because implementing idempotent processing with a deduplication key (e.g., paymentId) ensures that even if duplicate messages arrive from SQS (due to retries or at-least-once delivery), the consumer can check a record of completed charges and safely ignore duplicates. This satisfies the business requirement of charging each payment at most once without relying on SQS’s best-effort deduplication or message ordering.

Answer

Assume duplicates never occur because the consumer deletes messages immediately after receiving them.

Answer

Increase the SQS visibility timeout until duplicates never happen.

Answer

Use SNS topics instead of SQS so retries are disabled by default.

Question 3

A warehouse integration service must process every event at least once, but duplicate processing is acceptable if the consumer handles idempotency. Which eventing approach is most suitable? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Use Amazon SQS standard queue and design consumers to be idempotent. Amazon SQS standard queues provide at-least-once delivery, which guarantees that every message is processed at least once, meeting the requirement that every event must be processed. Duplicate processing is acceptable because the consumer can be designed to handle idempotency. This is a managed, AWS-native service that aligns with the architecture review board's preference.

Answer

Use CloudFront signed URLs

Answer

Use UDP messages sent directly to workers

Answer

Use an in-memory queue on one EC2 instance

Question 4

A system uses multiple AWS Lambda functions behind different event sources. One Lambda occasionally spikes and causes other Lambdas to be throttled due to shared concurrency limits. Which setting best helps ensure the important Lambda keeps capacity during spikes?

Accepted Answer

Set Reserved Concurrency for the important Lambda function.. Reserved Concurrency guarantees that the important Lambda function always has a set number of concurrent executions available, preventing other functions from consuming the account-level concurrency pool and throttling it during spikes. This setting isolates the function's capacity from shared contention, ensuring its performance remains stable.

Answer

Increase the function timeout so throttling is less likely.

Answer

Enable Provisioned Concurrency for every Lambda in the account.

Answer

Reduce the number of IAM policies attached to the Lambda roles.

Question 5

A workload runs in private subnets and must reach Amazon S3 and AWS Secrets Manager without using the internet or a NAT gateway. The team wants to keep the traffic on AWS private networking and avoid public IPs. Which two changes should the architect make? Select two.

Accepted Answer

Create an S3 gateway VPC endpoint and update the route tables for the private subnets.. Option A is correct because an S3 gateway VPC endpoint allows private subnet instances to access S3 via AWS's private network without needing internet access or a NAT gateway. The endpoint uses route table entries to direct S3 traffic through the gateway, which is a horizontally scaled, redundant component that does not require public IPs.

Answer

Place a NAT gateway in the public subnet so the private instances can reach AWS services.

Answer

Assign public IPv4 addresses to the instances and restrict them with security groups.

Answer

Use VPC peering to the AWS service endpoints instead of VPC endpoints.

Question 6

A solutions architect is designing an S3 bucket for a IoT ingestion API. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. Option C is correct because S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or object ACLs. This setting, when enabled at the account or bucket level, ensures that even if a developer later attaches an overly permissive bucket policy, the public access is blocked. It meets the requirement of avoiding custom operational scripts by being a native, configurable S3 feature.

Answer

Enable S3 Transfer Acceleration

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Question 7

A team wants to delegate IAM management to developers, but must ensure developers can never grant themselves permissions beyond a specific limit. Which AWS mechanism best matches this requirement?

Accepted Answer

Use an IAM permission boundary on roles/users that developers create, so the developers’ effective permissions are capped by the boundary policy.. IAM permission boundaries are the correct mechanism because they allow a developer to create IAM roles or users, but explicitly cap the maximum permissions those entities can have. The boundary policy acts as a ceiling, so even if a developer attaches a permissive managed policy, the effective permissions are the intersection of the boundary and the attached policy. This directly enforces the requirement that developers cannot grant themselves permissions beyond a specific limit.

Answer

Rely only on their IAM managed policies and instruct developers to self-check against internal guidelines.

Answer

Use a service control policy (SCP) that applies only to the developers’ IAM users in the account.

Answer

Use a KMS key policy to restrict IAM actions, because IAM actions can be controlled with KMS.

Question 8

A solutions architect is designing an S3 bucket for a healthcare document service. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. Option D is correct because S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or object ACLs. When enabled at the account or bucket level, it blocks all public access settings, ensuring that even if a developer later adds an overly broad bucket policy, the objects remain inaccessible to anonymous users. This is essential for compliance with healthcare regulations like HIPAA, where data must never be publicly exposed.

Answer

Enable server access logging on the bucket

Answer

Enable S3 Transfer Acceleration

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Question 9

A solutions architect is designing an S3 bucket for a claims portal. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. Option A is correct because S3 Block Public Access provides a definitive override that prevents any public access to S3 objects, even if a bucket policy or ACL later grants public access. This setting can be applied at the account or bucket level and ensures that all access is denied to anonymous users, meeting the requirement without custom scripts.

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Answer

Enable S3 Transfer Acceleration

Question 10

You want to protect an Application Load Balancer (ALB) from common web exploits using AWS WAF. The application is not using CloudFront. Which AWS WAF deployment scope should you choose so the WAF rules apply to the ALB?

Accepted Answer

Use AWS WAF regional scope (associate the web ACL with the ALB resource). AWS WAF offers two deployment scopes: regional and CloudFront (global). Since the application is using an Application Load Balancer (ALB) without CloudFront, you must choose the regional scope. This allows you to associate the web ACL directly with the ALB resource, enabling AWS WAF to inspect HTTP/HTTPS requests for common web exploits like SQL injection and cross-site scripting (XSS) at the regional endpoint.

Answer

Use AWS WAF CloudFront (global) scope and associate the web ACL with the ALB

Answer

Use AWS Shield Advanced and rely on it to inspect payloads for SQL injection and XSS

Answer

Use security groups only, because they can detect SQL injection patterns in HTTP requests