SAA-C03 Practice Test 20 — 15 Questions

Question 1

A logistics company runs an order-tracking service that exposes a REST API. The service must remain available during a single Availability Zone failure and must keep read latency low for a globally distributed user base. The data store must support automatic multi-AZ replication without the team managing database servers. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon DynamoDB with global tables and on-demand capacity mode.. DynamoDB is a fully managed, multi-AZ key-value store, so a single Availability Zone failure does not interrupt service and no database servers are managed. Global tables replicate data across Regions so users read from a nearby replica with low latency, and on-demand capacity removes the need to provision throughput, meeting both resilience and performance goals.

Answer

Amazon RDS for MySQL with a read replica in a second Availability Zone.

Answer

Amazon ElastiCache for Redis with a cluster mode disabled replication group in one Availability Zone.

Answer

Amazon RDS for PostgreSQL with Multi-AZ DB instance deployment and a cross-Region read replica.

Question 2

A mobile banking backend must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control?

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. Service Control Policies (SCPs) are a preventive control that can deny the ec2:CreateVolume action when the encrypted condition is false. This ensures that only encrypted EBS volumes can be created, enforcing encryption at the point of request before any volume is provisioned. SCPs operate at the AWS Organizations level, making them the strongest preventive mechanism for account-wide enforcement.

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Answer

Enable VPC Flow Logs

Answer

Tag encrypted volumes after creation

Question 3

A high-frequency trading analytics service runs on several EC2 instances in the same Availability Zone. The application exchanges small messages between nodes and is sensitive to microsecond-level network latency. Which design best meets the requirement?

Accepted Answer

Place the instances in a cluster placement group in one Availability Zone.. A cluster placement group is designed for low-latency, high-throughput scenarios by placing instances in a single Availability Zone with non-blocking, fully bisectioned bandwidth and microsecond-level latency. This meets the requirement for microsecond-sensitive inter-node communication in high-frequency trading.

Answer

Place the instances in a spread placement group across multiple Availability Zones.

Answer

Place the instances in a partition placement group within one Availability Zone.

Answer

Deploy the instances behind an Application Load Balancer in multiple Availability Zones.

Question 4

A partner company needs read-only access to reports in an S3 bucket for a B2B file exchange site. The partner has its own AWS account. What is the most secure scalable access pattern? The design must avoid adding custom operational scripts.

Accepted Answer

Create a bucket policy that grants the partner role least-privilege access to the required prefix. It uses a bucket policy with a principal ARN for the partner's AWS account, granting read-only access to a specific prefix. This is secure (no public exposure), scalable (no per-user credentials to manage), and avoids custom scripts by leveraging native AWS IAM and S3 policy evaluation. The partner can use their own IAM roles to access the bucket without sharing long-term access keys.

Answer

Make the objects public and rely on difficult-to-guess object names

Answer

Create an IAM user in the company account and share the access keys

Answer

Copy the objects to a public website bucket

Question 5

Based on the exhibit, an administrator accidentally deleted data from Amazon RDS for PostgreSQL about 90 minutes ago. Which recovery approach best restores the database to the exact required point in time?

Accepted Answer

Restore the database to the specified point in time into a new DB instance.. Amazon RDS for PostgreSQL supports Point-in-Time Recovery (PITR), which allows you to restore a DB instance to any second within the backup retention period, up to the last five minutes. Since the deletion occurred approximately 90 minutes ago, you can restore to that exact point in time by specifying the timestamp, and RDS will create a new DB instance from automated backups and transaction logs. This is the only option that recovers the exact state before the accidental deletion.

Answer

Restore the latest automated snapshot back onto the existing DB instance.

Answer

Create a read replica and promote it after the deletion is noticed.

Answer

Enable Multi-AZ so the database can automatically undo application mistakes.

Question 6

A company wants to protect a critical application from a full Region outage. The secondary Region should keep only a small amount of infrastructure running most of the time to control cost. Which disaster recovery strategy fits best?

Accepted Answer

Pilot light. The pilot light strategy is correct because it keeps a minimal core of infrastructure (e.g., a small database, a few EC2 instances) running in the secondary Region, while the bulk of the application remains dormant. In a full Region outage, the pilot light can be rapidly scaled up to full production capacity, meeting the requirement of low ongoing cost with the ability to recover from a complete Region failure.

Answer

Active-active

Answer

Single-AZ deployment

Answer

Blue/green deployment

Question 7

A static marketing site is served through CloudFront from an S3 origin. After a product update, customers report a drop in CloudFront cache hit ratio and the CloudFront bill increases because the origin is receiving many more requests for the same JS/CSS assets. Asset URLs are versioned, but requests now include an Authorization header even though these assets are public. Which CloudFront change most directly improves the cache hit ratio for these assets?

Accepted Answer

Configure the CloudFront cache policy so Authorization is not included in the cache key, and use an origin request policy that does not forward Authorization to the S3 origin for this behavior. The drop in cache hit ratio is caused by the Authorization header being included in the cache key, which makes CloudFront treat each request as unique even when the asset URL is the same. By configuring the cache policy to exclude Authorization from the cache key and using an origin request policy that does not forward it to S3, CloudFront can serve cached responses for all users regardless of their Authorization header, restoring the cache hit ratio.

Answer

Increase the origin's max connections to handle more origin fetches

Answer

Set CloudFront minimum TTL to 0 seconds so caches expire faster and origin fetches start again

Answer

Disable CloudFront compression because Authorization headers are not cacheable when compression is enabled

Question 8

A workload runs in private subnets. It must access AWS services such as Amazon S3, but the company wants to avoid using a NAT Gateway to reduce outbound networking costs. What is the best solution?

Accepted Answer

Create VPC endpoints for the required AWS services and route traffic to them. VPC endpoints (Gateway Endpoints for S3 and DynamoDB, or Interface Endpoints for other services) allow instances in private subnets to access AWS services privately without traversing the internet or a NAT Gateway. This eliminates NAT Gateway data processing and hourly charges, directly reducing outbound networking costs while keeping traffic within the AWS network.

Answer

Attach Elastic IP addresses to instances in private subnets

Answer

Install a NAT Gateway in every subnet to minimize routing hops

Answer

Open outbound internet access with a security group rule to reach service endpoints directly

Question 9

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a image sharing application. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy?

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. The `aws:sourceVpce` condition key in an S3 bucket policy allows you to restrict access so that only traffic originating from a specific VPC endpoint (VPCe) is permitted. This enforces the security team's requirement that all S3 access must come through that endpoint, ensuring that requests from other paths (e.g., NAT gateway, internet gateway) are denied. The condition is evaluated at the S3 service side, not at the instance level, making it a direct and secure way to enforce the policy.

Answer

A deny statement for all IAM users except the EC2 role

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Question 10

A telemetry pipeline uses an Application Load Balancer in one Region. Global users need lower network latency to the application without caching dynamic responses. What should be considered? The architecture review board prefers a managed AWS-native control.

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it uses the AWS global network and Anycast IP addresses to route user traffic to the optimal Application Load Balancer endpoint, reducing latency for global users without caching dynamic responses. Unlike CloudFront, Global Accelerator does not cache content; it simply optimizes the network path, making it ideal for dynamic or real-time applications where caching is not acceptable. It is a managed AWS-native service that aligns with the architecture review board's preference.

Answer

S3 Cross-Region Replication

Answer

CloudFront only with long TTLs

Answer

AWS Backup cross-Region copy

Question 11

A Lambda function for a order processing API needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is designed to securely store, retrieve, and automatically rotate database credentials on a schedule. It natively supports rotation every 30 days via a built-in Lambda rotation function, and it avoids storing the password in environment variables, meeting both security and compliance requirements.

Answer

An encrypted object in Amazon S3

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

A KMS-encrypted Lambda environment variable

Question 12

An internal API is hosted in two AWS Regions behind Route 53. Under normal conditions, clients should use the primary region. If the primary endpoint becomes unhealthy, traffic must automatically switch to the secondary region. Which Route 53 setup best meets this requirement?

Accepted Answer

Use failover routing policy: create two alias records for the same name (primary and failover) and associate health checks with the primary record.. Route 53 failover routing policy is designed for active-passive failover scenarios. By creating two alias records (primary and secondary) for the same DNS name and associating a health check with the primary record, Route 53 automatically directs traffic to the secondary region if the primary health check fails. This meets the requirement of automatic failover without manual intervention.

Answer

Use latency-based routing with one record per region and no health checks.

Answer

Use weighted routing and manually change the weights during incidents.

Answer

Create a single alias record only for the primary region and rely on client-side DNS retries.

Question 13

Based on the exhibit, an application repeatedly reads the same DynamoDB items with extremely low latency requirements. The business can tolerate data that is a few seconds stale. Which architecture change best improves read performance?

Accepted Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table.. Adding a DynamoDB Accelerator (DAX) cluster provides an in-memory cache that can reduce read latencies to microseconds for frequently accessed items, while still allowing for eventual consistency and tolerating a few seconds of staleness. DAX is specifically designed for this use case, handling cache hits without any application code changes and offloading read traffic from the DynamoDB table.

Answer

Increase the table's sort key cardinality while keeping the same read pattern.

Answer

Switch the table to provisioned mode with auto scaling disabled.

Answer

Move the session data to Amazon EFS so the application can read it from shared files.

Question 14

A media processing company runs a stateless thumbnail-generation fleet on Amazon EC2 instances behind an Application Load Balancer. The instances store no local state, and the team wants the fleet to survive the loss of an entire Availability Zone without manual intervention. The fleet must also scale out automatically based on CPU. Which combination of AWS services should the solutions architect use to meet these requirements with the LEAST operational overhead?

Accepted Answer

An Auto Scaling group configured across multiple Availability Zones with a health check against the load balancer, plus an Application Load Balancer with cross-zone load balancing enabled.. Resilience against an Availability Zone failure for a stateless fleet is achieved by distributing capacity across multiple Availability Zones and letting the Auto Scaling group replace unhealthy instances using load balancer health checks. A single multi-AZ Auto Scaling group behind one Application Load Balancer with cross-zone load balancing delivers this with minimal operational effort, while still supporting CPU-based scaling.

Answer

Two independent Auto Scaling groups in separate Availability Zones, each attached to its own Application Load Balancer, with Route 53 failover routing between them.

Answer

A single Auto Scaling group pinned to one Availability Zone, with a Network Load Balancer in front and an Amazon Route 53 latency record.

Answer

An Amazon ECS cluster on AWS Fargate with tasks placed in one Availability Zone and an Application Load Balancer using sticky sessions.

Question 15

A company stores millions of objects in Amazon S3. Access patterns are completely unpredictable — some objects are frequently accessed, others rarely. Objects range from 4 KB to 50 MB. The company wants to minimize storage costs automatically without managing lifecycle rules. Which storage class should a solutions architect recommend?

Accepted Answer

S3 Intelligent-Tiering — it automatically moves objects between tiers based on access patterns. S3 Intelligent-Tiering monitors access patterns and automatically moves objects between access tiers — Frequent Access, Infrequent Access, and optional Archive tiers — based on actual usage. It requires no management or lifecycle rules.

Important: Intelligent-Tiering charges a small monitoring fee per object per month. For objects under 128 KB, this fee may exceed the storage savings. With objects ranging from 4 KB to 50 MB and unpredictable access patterns, Intelligent-Tiering is the recommended answer — AWS explicitly recommends it for unknown access patterns where object size averages above 128 KB.

Answer

S3 Standard — it is the default and handles all access patterns equally

Answer

S3 Standard-IA — it automatically detects infrequent access and reduces cost

Answer

S3 One Zone-IA — it is the cheapest option with fast retrieval