SAA-C03 Practice Test 2 — 10 Questions

Question 1

Based on the exhibit, DNS still sends traffic to the primary Region even though Route 53 health checks show the primary endpoint is unhealthy. What is the best change to make failover work as intended?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a failover routing policy with a primary record and a secondary record, and attach the health check to the primary record.. A failover routing policy with a health check attached to the primary record is the only configuration that allows Route 53 to automatically stop sending traffic to an unhealthy primary endpoint and redirect it to the secondary endpoint. Without the health check attached to the primary record, Route 53 has no mechanism to detect the failure and will continue routing traffic to the primary Region, even if the health check status shows unhealthy.

Answer

Change both records to weighted routing with a 50/50 split so Route 53 can shift traffic gradually.

Answer

Switch to latency-based routing so users are always directed to the lowest-latency Region.

Answer

Use geolocation routing so clients in one Region are sent to the healthier endpoint.

Question 2

A company runs a stateless web application on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in a relational database, which is becoming a bottleneck during peak hours. The team wants to improve performance and reduce database load while keeping the application stateless. Which solution should a solutions architect recommend?

Accepted Answer

Store session state in an Amazon ElastiCache for Redis cluster and configure the application to read and write sessions to the cluster.. Externalizing session state to an in-memory cache such as ElastiCache for Redis removes the relational database bottleneck and keeps the application stateless. Redis provides sub-millisecond latency, high throughput, and optional persistence, making it ideal for session stores. Sticky sessions or database scaling do not achieve the same performance and scalability benefits.

Answer

Migrate the session table to Amazon DynamoDB with on-demand capacity and update the application to use DynamoDB for session storage.

Answer

Increase the size of the relational database instance and add read replicas, then direct session reads to the replicas and writes to the primary.

Answer

Enable sticky sessions on the Application Load Balancer and store session state in the local memory of each EC2 instance.

Question 3

An application repeatedly reads the same DynamoDB items with very low latency requirements. The application can tolerate slightly stale data (for example, within a few seconds). You want to improve read latency without changing the existing DynamoDB table schema. Which service is the best choice?

Accepted Answer

Amazon DAX. Amazon DAX (DynamoDB Accelerator) is an in-memory cache that sits between your application and DynamoDB, providing microsecond read latency for frequently accessed items. Since the application can tolerate slightly stale data (within seconds), DAX's default TTL-based caching is ideal because it reduces read pressure on DynamoDB while serving cached results with significantly lower latency than direct DynamoDB reads.

Answer

Amazon S3 Transfer Acceleration

Answer

Amazon EFS

Answer

AWS CloudTrail for data plane reads

Question 4

A DynamoDB-backed multi-tenant app experiences throttling. Most write traffic for tenant 'ACME' targets a single logical stream of events (you write items for ACME in near-real time). The table currently uses partition key = tenantId and sort key = eventTimestamp. CloudWatch shows partition-level throttling concentrated in the ACME partition. What design change most directly improves write throughput for the hottest tenant while still enabling efficient queries for recent events for that tenant?

Accepted Answer

Mitigate the hotspot by changing the partition key to include a shard value (for example, tenantId + '#' + shardId) and write using shardId. Query recent events by fanning out across ACME shards and merging results by eventTimestamp.. It directly addresses the partition-level throttling by introducing a shard key (e.g., tenantId + '#' + shardId) as the partition key, which distributes ACME's write load across multiple physical partitions. To query recent events for ACME, the application must fan out queries across all shards and merge results by eventTimestamp, which is efficient because each shard holds a subset of the data and the sort key remains eventTimestamp for ordering.

Answer

Add a Global Secondary Index (GSI) with the same partition key (tenantId) and eventTimestamp, and rely on the GSI to spread load.

Answer

Increase the table’s write capacity (or on-demand baseline) without changing the partition key, because DynamoDB will automatically balance hotspots.

Answer

Switch the sort key to a random value to prevent writes from landing on the same physical partition.

Question 5

Based on the exhibit, a serverless API on AWS Lambda experiences a predictable cold-start penalty every weekday at 09:00 UTC when a marketing campaign begins. The team wants the first requests to stay fast while minimizing extra cost during quiet periods. What is the best approach?

Accepted Answer

Enable provisioned concurrency on the published version and schedule it to scale up shortly before the spike.. Provisioned concurrency pre-warms a specified number of Lambda execution environments so that incoming requests do not incur a cold start. By scheduling the provisioned concurrency to scale up just before the 09:00 UTC spike and scale down afterward, the team eliminates the cold-start penalty during the campaign while minimizing cost during quiet periods. This directly addresses the predictable, time-bound traffic pattern without requiring code changes or over-provisioning.

Answer

Increase the Lambda timeout so cold starts have more time to complete.

Answer

Move the function behind an Application Load Balancer to improve warm-up behavior.

Answer

Increase the function memory to the maximum value and leave concurrency unchanged.

Question 6

A public API for a image sharing application is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. API Gateway's JWT authorizer natively validates JSON Web Tokens (JWTs) issued by an external OpenID Connect (OIDC) provider. It verifies the token's signature, expiry, and issuer against the OIDC provider's JWKS endpoint, enabling standards-based authentication without custom Lambda code.

Answer

A VPC endpoint policy

Answer

API keys only

Answer

IAM authorization for all internet users

Question 7

A company has an Amazon S3 bucket for sensitive reports. They must ensure that any object uploaded with s3:PutObject is encrypted using AWS KMS (SSE-KMS). Which S3 bucket policy approach best enforces this by denying uploads that do not use SSE-KMS?

Accepted Answer

Use a Deny statement for s3:PutObject with a condition that denies requests where s3:x-amz-server-side-encryption is not "aws:kms" (SSE-KMS), for example: Condition { StringNotEquals: { "s3:x-amz-server-side-encryption": "aws:kms" } }. It uses a Deny statement with the condition `StringNotEquals` on the `s3:x-amz-server-side-encryption` request header, which explicitly denies any `s3:PutObject` request that does not include the value `aws:kms` for that header. This ensures that only objects encrypted with SSE-KMS are uploaded, as any request lacking the header or using a different encryption type (e.g., AES256) will be denied. The condition is evaluated at the time of the request, making it an effective enforcement mechanism.

Answer

Use a Deny statement that denies requests when aws:SecureTransport is false.

Answer

Use a Deny statement that checks the specific KMS key ID (s3:x-amz-server-side-encryption-aws-kms-key-id) and denies requests that don’t match a single alias value.

Answer

Use a Deny or Allow statement that limits object keys using s3:prefix (for example, only allow keys under "reports/").

Question 8

A SaaS platform serves an API using two regional deployments: us-east-1 (primary) and us-west-2 (secondary). Each region has its own ALB. The business requires automated DNS-based failover when the primary region becomes unhealthy, and they do not want manual DNS changes during incidents. 

Which Route 53 configuration is the best match?

Accepted Answer

Use Route 53 failover routing with a primary record pointing to the us-east-1 ALB and a secondary record pointing to the us-west-2 ALB, each using health checks.. Route 53 failover routing is designed specifically for active-passive failover scenarios where you have a primary and secondary resource. By associating health checks with each record, Route 53 automatically detects when the primary ALB in us-east-1 becomes unhealthy and routes traffic to the secondary ALB in us-west-2 without manual intervention. This meets the requirement for automated DNS-based failover without manual DNS changes.

Answer

Create a single Route 53 record using weighted routing across both ALBs with weights adjusted manually during an incident.

Answer

Use latency-based routing so Route 53 always selects the fastest region; health checks are unnecessary because client latency reflects availability.

Answer

Use a single A record with a static IP address that points to a NAT gateway, and update that IP during failure events.

Question 9

A retail company runs a stateless web tier on Amazon EC2 instances behind an Application Load Balancer. Traffic is steady during the day but drops to near zero between 01:00 and 06:00, and the team wants to reduce cost without manual intervention. The instances take about four minutes to boot and warm up. Which configuration meets these requirements?

Accepted Answer

Create a scheduled scaling action that reduces the Auto Scaling group's desired capacity at 01:00 and increases it at 06:00.. Scheduled scaling is the right fit when capacity needs follow a known timetable: it changes desired capacity at 01:00 and 06:00 regardless of metric lag, so the group shrinks during the predictable trough and is already expanding before morning traffic arrives. Reactive policies such as target tracking or step scaling would respond only after metrics move, which conflicts with the fixed daily pattern and the four-minute warm-up.

Answer

Enable an Application Load Balancer idle timeout and let the load balancer stop idle targets automatically.

Answer

Attach a step scaling policy that removes instances when the ALB request count per target falls below a threshold.

Answer

Configure a target tracking scaling policy based on average CPU utilization with a target of 50 percent.

Question 10

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The design must avoid adding custom operational scripts.

Accepted Answer

Interface VPC endpoint for Systems Manager. Option A is correct because an Interface VPC endpoint (powered by AWS PrivateLink) for Systems Manager creates elastic network interfaces in the private subnets with private IP addresses, allowing the instances to call the ssmmessages, ec2messages, and ssm endpoints privately without traversing the public internet. Option D is correct because a Gateway VPC endpoint for Amazon S3 adds a route-table target that lets traffic to S3 stay on the AWS private network, so the private application can download objects without an internet or NAT path. Together these two endpoints satisfy the requirement to reach both S3 and Parameter Store privately and require no custom operational scripts. Option B is not appropriate because an Internet gateway provides public internet connectivity and would expose or require public routing, which the scenario explicitly forbids. Option C is not appropriate because a NAT gateway enables outbound internet access (and incurs cost per AZ) rather than keeping traffic private, so it does not meet the no-public-internet requirement.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone