SAA-C03 Practice Test 20 — 15 Questions

Question 1

An ECS service runs on EC2 capacity. During peak traffic, tasks frequently wait for available container instances. The team wants faster scale-out for the underlying EC2 capacity when tasks increase. What is the best first architectural step?

Accepted Answer

Use an ECS capacity provider (or Auto Scaling integration) to scale the EC2 instances based on ECS demand.. Option B is correct because an ECS capacity provider (or Auto Scaling integration) directly links ECS task-level demand to EC2 instance scaling. When tasks are pending due to insufficient container instances, the capacity provider triggers a scale-out event on the Auto Scaling group, adding EC2 instances to accommodate the workload. This is the most efficient architectural step to reduce placement delays during peak traffic.

Answer

Tune the container health check settings so tasks stop failing and stay running.

Answer

Pin all tasks to a single Availability Zone to reduce placement overhead.

Answer

Switch the tasks to run only on Fargate so EC2 scaling is no longer relevant.

Question 2

An e-commerce application uses Aurora MySQL. Writes are modest, but the product-detail page generates many read-only queries and the writer instance CPU is high. The application can tolerate a small amount of replication lag on those reads. What should the team do?

Accepted Answer

Add Aurora read replicas and send read-only traffic to the reader endpoint.. Adding Aurora read replicas and directing read-only traffic to the reader endpoint offloads SELECT queries from the writer instance, reducing its CPU load. Aurora replicas share the same underlying storage volume, so replication lag is minimal (typically <100ms) and acceptable for the product-detail page. This scales read throughput without increasing writer instance size or cost.

Answer

Increase the writer instance size and keep all traffic on the primary.

Answer

Replace Aurora with DynamoDB to eliminate replication lag.

Answer

Enable Multi-AZ failover only, because it increases read throughput automatically.

Question 3

Based on the exhibit, an application runs in private subnets without a NAT gateway and must retrieve a secret from AWS Secrets Manager. Security requires the traffic to stay on the AWS network and not traverse the public internet. What is the best solution?

Accepted Answer

Create an interface VPC endpoint for Secrets Manager and enable private DNS for the endpoint.. Option B is correct because an interface VPC endpoint for Secrets Manager allows the application in the private subnet to securely access Secrets Manager over the AWS network using private IP addresses, without needing a NAT gateway or internet gateway. Enabling private DNS ensures that the default Secrets Manager DNS name resolves to the endpoint's private IP addresses, keeping all traffic within the AWS backbone and satisfying the security requirement.

Answer

Add a NAT gateway to the private subnet route table and keep using the public Secrets Manager endpoint.

Answer

Create a gateway VPC endpoint for Secrets Manager and point the route table to it.

Answer

Use VPC peering to connect the application subnet to another VPC that already has internet access.

Question 4

An internal team runs a report-generation job once per day. It typically finishes in a few minutes, and even on its slowest days it still completes in under 15 minutes. The team wants to reduce operational overhead and pay primarily for actual runtime instead of keeping servers running 24/7. Which AWS approach best matches these goals?

Accepted Answer

Use AWS Lambda triggered by a schedule (for example, EventBridge) to run the report at the required time.. AWS Lambda, triggered by Amazon EventBridge (CloudWatch Events), is ideal for short-lived, infrequent jobs like this daily report. It eliminates idle server costs by running only when invoked, and the 15-minute execution timeout comfortably covers the job's maximum runtime. This serverless approach directly reduces operational overhead and aligns with a pay-per-use cost model.

Answer

Deploy the job on EC2 instances and keep them running continuously for the daily schedule.

Answer

Run the job in an RDS database using stored procedures scheduled by the database engine.

Answer

Use an Auto Scaling group with a fixed minimum size of one instance and disable scaling.

Question 5

An engineering team runs application servers in private subnets. The instances must download patches and software packages from Amazon S3, but the company does not want the traffic to traverse the internet or a NAT gateway. Which design should they use?

Accepted Answer

Use an Amazon S3 gateway VPC endpoint in the route tables for the private subnets.. Option B is correct because an S3 Gateway VPC endpoint allows instances in private subnets to access Amazon S3 without traversing the internet or a NAT gateway. The endpoint uses AWS’s internal network and is added to the route table of the private subnets, directing S3 traffic through the endpoint prefix list. This design meets the requirement of keeping traffic off the internet while providing secure, low-latency access to S3.

Answer

Add an internet gateway to the VPC and route private subnet traffic through it.

Answer

Use a security group rule that allows outbound traffic to the S3 public IP range.

Answer

Create a VPC peering connection to the S3 service VPC.

Question 6

Based on the exhibit, the business needs Regional disaster recovery with an RTO of 45 minutes and an RPO of 15 minutes. The solution should keep cost lower than running two fully active production environments. Which DR strategy is the best fit?

Accepted Answer

Warm standby, because a scaled-down but fully functional copy can take traffic quickly while keeping costs below full duplication.. Warm standby is the best fit because it maintains a scaled-down but fully functional copy of the production environment in the recovery Region, which can be quickly scaled up to handle production traffic. This meets the RTO of 45 minutes and RPO of 15 minutes by keeping the standby environment ready with replicated data (e.g., using Amazon RDS Multi-AZ or cross-Region read replicas with synchronous replication), while costing less than two fully active environments since the standby runs on smaller instances or fewer resources until failover.

Answer

Backup and restore only, because the existing daily backups are already in another Region.

Answer

Pilot light, because the recovery Region only needs minimal resources and can be scaled after a disaster.

Answer

Active-active, because it minimizes RTO by keeping both Regions fully live all the time.

Question 7

Based on the exhibit, a company wants EC2 instances in private subnets to access Amazon S3 without using a NAT gateway, and bucket access must be allowed only when requests come through the approved VPC endpoint. Which design is the most appropriate?

Accepted Answer

Use the S3 gateway VPC endpoint and keep the bucket policy that denies requests unless aws:SourceVpce matches the approved endpoint.. Option A is correct because an S3 gateway VPC endpoint allows EC2 instances in private subnets to access S3 without traversing the internet or requiring a NAT gateway. By adding a bucket policy condition that denies access unless `aws:SourceVpce` matches the approved VPC endpoint ID, you ensure that only requests originating from that specific endpoint are allowed, meeting the security requirement.

Answer

Use an interface VPC endpoint for S3 only, because gateway endpoints cannot be used with bucket policies.

Answer

Add a NAT gateway and remove the bucket policy condition because the NAT route will automatically secure the S3 traffic.

Answer

Move the bucket policy restriction to a security group attached to the S3 bucket so only the VPC endpoint can reach it.

Question 8

Based on the exhibit, an application repeatedly reads the same DynamoDB items with extremely low latency requirements. The business can tolerate data that is a few seconds stale. Which architecture change best improves read performance?

Accepted Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table.. Adding a DynamoDB Accelerator (DAX) cluster provides an in-memory cache that can reduce read latencies to microseconds for frequently accessed items, while still allowing for eventual consistency and tolerating a few seconds of staleness. DAX is specifically designed for this use case, handling cache hits without any application code changes and offloading read traffic from the DynamoDB table.

Answer

Increase the table's sort key cardinality while keeping the same read pattern.

Answer

Switch the table to provisioned mode with auto scaling disabled.

Answer

Move the session data to Amazon EFS so the application can read it from shared files.

Question 9

An order-quote Lambda function is invoked directly by API Gateway. Traffic is predictable during the business day, and the first request after scaling from zero causes unacceptable latency. The team wants to keep the current architecture and reduce cold-start impact. Which configuration should they use?

Accepted Answer

Enable provisioned concurrency for the Lambda function.. Provisioned concurrency initializes a specified number of execution environments in advance, so when the first request arrives after scaling from zero, it is served by a pre-warmed instance instead of incurring a cold start. This directly addresses the unacceptable latency without changing the architecture or requiring code modifications.

Answer

Increase the function timeout so the first invocation has more time to finish.

Answer

Set reserved concurrency to a fixed number and leave the rest unchanged.

Answer

Increase the memory size only to eliminate cold starts.

Question 10

An internal web application must require encrypted client connections. The company currently has an ALB listener on port 80 (HTTP), and users can access the application over plain HTTP. What is the best change to ensure all client traffic uses HTTPS?

Accepted Answer

Configure an HTTPS (port 443) listener using an ACM certificate and update the port 80 listener to redirect to HTTPS (or to block plain HTTP requests).. Option A is correct because it uses an HTTPS listener on port 443 with an ACM certificate to enforce encrypted client connections, and redirecting HTTP (port 80) traffic to HTTPS ensures all traffic is encrypted in transit. This is the standard AWS best practice for enforcing HTTPS on an ALB, as it directly controls the listener behavior at the load balancer level without requiring application changes.

Answer

Enable S3 default encryption so HTTP requests are automatically encrypted in transit.

Answer

Set the application to encrypt data only after it is received by the ALB.

Answer

Rely on WAF alone to encrypt HTTP traffic.

Question 11

Based on the exhibit, the company wants DNS traffic to fail over automatically from the primary Region to a secondary Region when the primary endpoint is unhealthy. Which Route 53 change is best?

Accepted Answer

Create Route 53 failover records with health checks for the primary and secondary ALBs.. Route 53 failover routing with health checks is the only option that automatically directs DNS traffic away from an unhealthy primary endpoint to a healthy secondary endpoint. When the health check for the primary ALB fails, Route 53 returns the secondary ALB's IP address in DNS responses, providing automatic failover across regions. Simple, weighted, and geolocation routing do not natively support automatic failover based on endpoint health.

Answer

Keep simple routing and lower the TTL to 10 seconds.

Answer

Use weighted routing with equal weights for both ALBs.

Answer

Use geolocation routing so users in each continent reach a closer ALB.

Question 12

Based on the exhibit, a media company serves versioned JavaScript and CSS files from an Amazon S3 origin through CloudFront. After a frontend release, the cache hit ratio dropped sharply even though the file names are versioned. The application team says the browser requests include the same Authorization header on every asset request because the frontend and API share one domain. What should the solutions architect do to improve CloudFront cache hit ratio without changing the application authentication model for the API?

Accepted Answer

Create a CloudFront cache policy that excludes Authorization, cookies, and unnecessary query strings from the cache key.. The sharp drop in cache hit ratio is caused by the Authorization header being included in the cache key, which makes each request unique even though the file names are versioned. By creating a CloudFront cache policy that excludes the Authorization header (and unnecessary cookies/query strings) from the cache key, CloudFront can serve cached responses to requests with different Authorization headers, restoring the cache hit ratio without altering the application's authentication model for the API.

Answer

Enable S3 Transfer Acceleration on the bucket so CloudFront fetches objects faster from the origin.

Answer

Switch the origin from S3 to an Application Load Balancer so CloudFront can cache dynamic responses more effectively.

Answer

Configure CloudFront to forward every viewer header to the origin so the origin can decide whether the content is cacheable.

Question 13

Based on the exhibit, the database must continue serving if the current Availability Zone fails. What should you change?

Accepted Answer

Modify the DB instance to use a Multi-AZ deployment.. Option B is correct because Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, ensuring database availability without manual intervention. This meets the requirement of continuing service during an AZ failure.

Answer

Create a read replica in another Availability Zone and promote it manually if needed.

Answer

Increase the automated backup retention period to 30 days.

Answer

Resize the DB instance to a larger class.

Question 14

Based on the exhibit, a central deployment role in Account A is assumed by several CI/CD pipelines from Account B. The role must remain reusable, but the team wants the TeamA pipeline to upload artifacts only to s3://artifact-bucket/teamA/prod/ without creating a separate IAM role. What is the best approach?

Accepted Answer

Pass an STS session policy when TeamA assumes the role to further restrict the temporary credentials to the teamA/prod prefix.. Option D is correct because when the TeamA pipeline assumes the central IAM role in Account A, it can pass an STS session policy that further restricts the temporary credentials to only allow actions on the s3://artifact-bucket/teamA/prod/ prefix. This approach keeps the role reusable for other pipelines while enforcing a narrower permission scope at the session level, without requiring a separate IAM role.

Answer

Use an IAM user in Account B and hard-code the narrower S3 path in its access key policy.

Answer

Add a bucket ACL that grants write access only to the TeamA pipeline session name.

Answer

Attach a permissions boundary to the central role so every pipeline session inherits the narrower prefix automatically.

Question 15

Based on the exhibit, users must access private PDF reports only through CloudFront. Direct requests to the S3 object URL must fail, and the bucket should not be publicly readable. Which solution is the best fit?

Accepted Answer

Enable CloudFront Origin Access Control for the distribution and update the bucket policy to allow only the CloudFront distribution principal with its SourceArn.. Option A is correct because CloudFront Origin Access Control (OAC) allows you to restrict access to an S3 bucket so that only the specific CloudFront distribution can retrieve objects. By updating the bucket policy to allow the CloudFront distribution principal with its SourceArn, you ensure that direct requests to the S3 object URL are denied, while CloudFront-signed URLs or cookies can still control user access. This meets the requirement of blocking direct S3 access while keeping the bucket private.

Answer

Keep the bucket public and require signed URLs at CloudFront, because signed URLs automatically block all direct S3 requests.

Answer

Add an S3 access point and allow the CloudFront distribution to use it without changing the bucket policy.

Answer

Attach AWS WAF to the distribution and block requests that do not include a signed cookie.