SAA-C03 Practice Exam 2 — 20 Questions

Question 1

Account 3000 owns a customer-managed KMS key (key-K). A data processing team in account 4000 needs to decrypt data encrypted with key-K. The role in account 4000 already has an identity policy allowing kms:Decrypt on key-K. Despite this, decrypt requests fail with an AccessDenied error referencing KMS. What is the most likely missing authorization step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update key-K’s key policy in account 3000 to allow kms:Decrypt for the specific role principal in account 4000.. KMS key policies are resource-based policies that must explicitly grant cross-account access. Even though the role in account 4000 has an identity-based policy allowing kms:Decrypt, the key policy in account 3000 (the key owner) must also include a statement that permits the specific role principal from account 4000 to perform kms:Decrypt on key-K. Without this, the KMS service will deny the request due to the lack of a valid authorization path.

Answer

Update the S3 bucket policy to allow kms:Decrypt for account 4000 principals on key-K.

Answer

Enable AWS managed key rotation on key-K and remove the existing key policy.

Answer

Switch the access from a role to an IAM user because KMS only supports user principals.

Question 2

An organization hosts the same public API in two AWS Regions. Normal traffic should go to the primary Region. If the primary endpoint becomes unhealthy, Route 53 should automatically route users to the secondary Region. What is the best Route 53 configuration approach?

Accepted Answer

Use Route 53 failover routing with health checks that mark the primary as unhealthy and fail over to the secondary.. Route 53 failover routing is designed for active-passive configurations where traffic is directed to a primary resource unless a health check marks it as unhealthy, at which point all traffic automatically shifts to the secondary resource. This directly matches the requirement of routing normal traffic to the primary Region and failing over to the secondary Region only when the primary endpoint becomes unhealthy.

Answer

Use simple routing with one record that contains both regions as weighted targets.

Answer

Use weighted routing and set the secondary Region weight to 0 until needed.

Answer

Use latency-based routing so requests go to the region with the lowest latency, regardless of health.

Question 3

A patient portal must use shared file storage across Linux EC2 instances in multiple Availability Zones. The storage must remain available during an AZ failure. Which service should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Amazon EFS with mount targets in multiple Availability Zones. Amazon EFS provides a fully managed, scalable, and shared file system that can be mounted concurrently on multiple Linux EC2 instances across different Availability Zones. By creating mount targets in each AZ, the file system remains accessible even if one AZ fails, meeting the high availability requirement without custom scripts.

Answer

Instance store volumes

Answer

An EBS volume attached to all instances

Answer

S3 mounted as a POSIX file system without a file gateway

Question 4

Based on the exhibit, the web application must remain available even if one Availability Zone fails. What is the best change to improve resilience with the least redesign?

Accepted Answer

Add subnet-b1 in a different Availability Zone to the Auto Scaling group.. Adding subnet-b1 in a different Availability Zone to the Auto Scaling group ensures that EC2 instances are launched across two Availability Zones. If one zone fails, the ALB can route traffic to healthy instances in the other zone, maintaining application availability. This change requires minimal redesign because it only modifies the Auto Scaling group's subnet configuration without altering the load balancer or compute architecture.

Answer

Increase DesiredCapacity to 4 while keeping all instances in subnet-a1.

Answer

Replace the Application Load Balancer with a Network Load Balancer.

Answer

Enable EBS encryption on the launch template volumes.

Question 5

A dev sandbox runs for several hours each night and can be interrupted and restarted. Which EC2 purchasing option should minimize cost?

Accepted Answer

Spot Instances. Spot Instances can be interrupted and restarted, making them ideal for fault-tolerant workloads like a nightly dev sandbox. They offer significant cost savings (up to 90% off On-Demand) because they use spare AWS EC2 capacity, which aligns perfectly with the scenario's tolerance for interruption.

Answer

On-Demand Instances only

Answer

Dedicated Hosts

Answer

Provisioned IOPS volumes

Question 6

Several EC2 instances in different Availability Zones need to read and write the same shared file system. The file storage should stay available if one AZ has a problem. Which service should the team choose?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It is designed for high availability and durability by storing data redundantly across multiple AZs within a region, ensuring continued access even if one AZ fails.

Answer

Amazon EBS

Answer

Amazon S3 only

Answer

Instance store

Question 7

A team needs a relational database solution that can automatically fail over to a standby instance if the primary database becomes unavailable. They want the standby to be located in a different Availability Zone. Which RDS/Aurora configuration best satisfies this requirement?

Accepted Answer

Multi-AZ deployment with an automatically managed standby in a different Availability Zone and automatic failover.. A Multi-AZ RDS deployment automatically provisions and maintains a standby instance in a different Availability Zone, and the failover is handled automatically by AWS without manual intervention. This meets the requirement for automatic failover to a standby in a different AZ, which is the core purpose of Multi-AZ deployments.

Answer

Single-AZ DB deployment and rely on manual snapshot restore during failures.

Answer

Enable read replicas only, and promote a replica manually when the primary fails.

Answer

Enable point-in-time recovery (PITR) without configuring any Multi-AZ standby.

Question 8

Your web application runs on EC2 instances behind an Application Load Balancer (ALB). During traffic spikes, p95 response time increases, but average CPU utilization remains below 40%. The current Auto Scaling policy scales based on average CPU%. What should you change to improve performance during spikes?

Accepted Answer

Scale on a request-driven metric such as ALB RequestCount per target (or target-group request rate). The p95 response time is increasing during traffic spikes while CPU utilization remains low, indicating that the bottleneck is not compute capacity but rather request handling or connection overhead. By scaling on ALB RequestCountPerTarget, you directly target the metric causing latency—each target's request load—rather than an indirect metric like CPU. This ensures that new instances are launched precisely when individual targets are overwhelmed by requests, reducing queueing delays and improving response times.

Answer

Keep scaling on CPU% to avoid over-scaling

Answer

Disable scaling and manually increase capacity during business hours

Answer

Scale only when network packet drops fall below a threshold

Question 9

An event-driven order processing service consumes messages from an Amazon SQS Standard queue. After a deployment, about 1% of messages start failing validation because a required field is missing. The consumer catches the exception and returns control, so the messages are retried. However, those poison messages keep reappearing and repeatedly consuming processing time for hours, delaying handling of valid messages. What is the most resilient way to handle the poison messages while keeping the system available?

Accepted Answer

Configure an SQS redrive policy to send messages to a dead-letter queue (DLQ) after a limited number of receives (maxReceiveCount).. Configuring an SQS redrive policy with a maxReceiveCount (e.g., 3–5) automatically moves messages that repeatedly fail processing to a dead-letter queue (DLQ) after the specified number of receives. This isolates the poison messages, preventing them from consuming visibility timeout and processing resources, while allowing valid messages to be handled without delay. The DLQ can then be analyzed or reprocessed offline, maintaining system availability.

Answer

Set the consumer visibility timeout to a very large value so failing messages are hidden for hours.

Answer

Switch the SQS queue from Standard to FIFO so poison messages do not retry.

Answer

Increase the consumer concurrency indefinitely so the system processes all messages even if some fail validation.

Question 10

An Auto Scaling group behind an Application Load Balancer frequently replaces new EC2 instances. The application needs ~6 minutes to warm up after instance launch. However, the ALB target group health checks start immediately and mark the targets unhealthy until the application is ready. Because the targets become unhealthy early, the Auto Scaling group then terminates the instances and launches replacements, creating a repeated unhealthy/termination loop.

What configuration change will most directly improve recovery by preventing premature ASG termination while the application is warming up?

Accepted Answer

Set a health check grace period on the Auto Scaling group that exceeds the application startup/warm-up time.. The health check grace period on an Auto Scaling group (ASG) allows a newly launched EC2 instance to bypass health check failures for a specified duration. By setting this grace period to exceed the application's ~6-minute warm-up time, the ASG will not prematurely terminate the instance based on ALB health check results. This directly breaks the unhealthy/termination loop while the application initializes.

Answer

Increase the Auto Scaling group's desired capacity to a higher number than required.

Answer

Disable ALB target group health checks so instances are considered healthy as soon as they register.

Answer

Change the Auto Scaling health check type from ELB to EC2 so the ALB will no longer determine instance health.

Question 11

You use Amazon CloudFront in front of a private content S3 origin. To mitigate an OWASP Top 10 issue, you created a WAF web ACL and associated it to the CloudFront distribution, but attacks are still reaching the origin.

CloudWatch logs show the web ACL rules never match for the CloudFront requests.

What is the most likely configuration mistake?

Accepted Answer

The WAF web ACL intended for CloudFront must be created in the us-east-1 (N. Virginia) region (CloudFront scope), even if the rest of the stack is in another region.. When using AWS WAF with CloudFront, the web ACL must be created in the US East (N. Virginia) region (us-east-1) because CloudFront is a global service that only supports WAF web ACLs with a global scope, which are always defined in us-east-1. If the web ACL is created in any other region, it will be a regional web ACL and cannot be associated with a CloudFront distribution, causing the rules to never be evaluated against incoming requests. This explains why CloudWatch logs show no rule matches—the web ACL is effectively not attached to the CloudFront distribution.

Answer

WAF rules only evaluate requests after they reach the origin, so the absence of matches means the origin is blocking traffic first.

Answer

For CloudFront, you must use a regional WAF endpoint and cannot use a global web ACL.

Answer

WAF web ACL rules never apply to signed URLs or signed cookies, so the web ACL is bypassed by design.

Question 12

A claims portal stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. C is correct because S3 Object Lock in compliance mode enforces a write-once-read-many (WORM) model that prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance team's requirement that logs cannot be altered or removed for seven years, as compliance mode provides the highest level of protection and cannot be bypassed or shortened.

Answer

S3 server access logging

Answer

S3 versioning only

Answer

S3 lifecycle expiration after seven years

Question 13

A retail analytics app uses Amazon RDS for PostgreSQL. Read traffic is growing, and the database CPU spikes mainly due to SELECT-heavy workloads. Writes are less frequent, and the app can tolerate eventually consistent reads for the reports. What is the most appropriate AWS-native way to improve read performance with minimal application changes?

Accepted Answer

Create an RDS read replica and point the reporting queries to the replica endpoint.. Creating an RDS read replica is the most appropriate AWS-native solution because it offloads SELECT-heavy workloads from the primary database instance to a read-only copy, reducing CPU spikes on the primary. The application can tolerate eventually consistent reads for reports, which is exactly the consistency model of RDS read replicas (typically sub-second replication lag). This requires minimal application changes—only updating the reporting queries to point to the replica endpoint—and fully leverages PostgreSQL's built-in replication capabilities.

Answer

Switch the cluster to DynamoDB without redesigning the data model.

Answer

Enable S3 event notifications to trigger a Lambda function after each write to the database.

Answer

Replace the RDS instance class with a smaller size to reduce cost and improve performance.

Question 14

A team accidentally updates critical rows in an Amazon RDS for PostgreSQL database. Automated backups are enabled. They need to recover the data to the exact state as of 90 minutes ago.

They also cannot risk interrupting the current production database instance while investigators validate the restored data.

Which recovery strategy best meets these constraints?

Accepted Answer

Use point-in-time recovery (PITR) to restore to a new RDS DB instance as of 90 minutes ago, then validate and cut over after approval.. Point-in-time recovery (PITR) for Amazon RDS allows you to restore a DB instance to any second within the backup retention period, using automated backups and transaction logs. By restoring to a new RDS instance as of 90 minutes ago, you create an isolated copy for validation without affecting the production database. This meets both the recovery point objective (RPO) of 90 minutes and the constraint of no interruption to the current production instance.

Answer

Restore a manual snapshot and overwrite the existing production DB instance so the data matches exactly 90 minutes ago.

Answer

Wait for the next automated backup window and then restart the current DB instance to roll back changes automatically.

Answer

Use cross-region read replicas to rewind changes and promote the replica to become the writer immediately.

Question 15

You want to protect an Application Load Balancer (ALB) from common web exploits using AWS WAF. The application is not using CloudFront. Which AWS WAF deployment scope should you choose so the WAF rules apply to the ALB?

Accepted Answer

Use AWS WAF regional scope (associate the web ACL with the ALB resource). AWS WAF offers two deployment scopes: regional and CloudFront (global). Since the application is using an Application Load Balancer (ALB) without CloudFront, you must choose the regional scope. This allows you to associate the web ACL directly with the ALB resource, enabling AWS WAF to inspect HTTP/HTTPS requests for common web exploits like SQL injection and cross-site scripting (XSS) at the regional endpoint.

Answer

Use AWS WAF CloudFront (global) scope and associate the web ACL with the ALB

Answer

Use AWS Shield Advanced and rely on it to inspect payloads for SQL injection and XSS

Answer

Use security groups only, because they can detect SQL injection patterns in HTTP requests

Question 16

A mobile banking backend uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend? The design must avoid adding custom operational scripts.

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS allows EC2 instances to authenticate to PostgreSQL using a short-lived token generated via the IAM instance profile, eliminating the need to store credentials on the instance. The token is obtained by calling the RDS generate_db_auth_token API with the instance's IAM role, and it is valid for 15 minutes by default. This approach satisfies the requirement for short-lived credentials and avoids custom operational scripts.

Answer

Store the database password in user data

Answer

Use a security group rule that allows only application instances

Answer

Embed the database password in the AMI

Question 17

A team runs an application on Amazon EC2 that connects to an Aurora database. The database password must rotate automatically every 30 days, and the application should retrieve the current secret at runtime using an IAM role. Which AWS service is the best fit?

Accepted Answer

AWS Secrets Manager with rotation enabled.. AWS Secrets Manager is the best fit because it natively supports automatic rotation of database credentials on a schedule (e.g., every 30 days) and integrates directly with Amazon RDS/Aurora to update the password. The application can retrieve the current secret at runtime using an IAM role attached to the EC2 instance, without hardcoding credentials. Secrets Manager also provides built-in secret rotation with Lambda, ensuring zero downtime during password changes.

Answer

AWS Systems Manager Parameter Store standard parameters.

Answer

AWS KMS, because KMS stores credentials and rotates them automatically.

Answer

Amazon S3 with server-side encryption and versioning.

Question 18

Based on the exhibit, the company wants to lower CloudWatch and EC2 monitoring costs. Auditors require logs to be retained for 90 days, but operations only uses detailed per-instance metrics during rare troubleshooting events. Which change best reduces recurring cost while preserving the required visibility?

Accepted Answer

Set CloudWatch Logs retention to 90 days for all log groups, and switch EC2 monitoring from detailed to basic except during incidents.. It directly addresses the two cost drivers: CloudWatch Logs storage costs are minimized by setting a 90-day retention policy (matching the audit requirement), and EC2 detailed monitoring (1-minute metrics) is replaced with basic monitoring (5-minute metrics) during normal operations, with the ability to switch back to detailed only when needed for troubleshooting. This preserves the required log retention and the ability to obtain high-resolution metrics on demand, while eliminating the recurring cost of storing logs indefinitely and paying for detailed monitoring on every instance.

Answer

Disable CloudWatch Logs entirely and rely on application local files for 90 days.

Answer

Increase the number of CloudWatch alarms so that metrics are collected less expensively.

Answer

Export all logs to Amazon S3 immediately and keep detailed monitoring enabled on every instance.

Question 19

A service performs many repeated read requests for the same DynamoDB items. The reads are latency-sensitive, but the application can tolerate slightly stale data. Which AWS service is the best fit to reduce read latency?

Accepted Answer

Amazon DAX (DynamoDB Accelerator). Amazon DAX (DynamoDB Accelerator) is an in-memory cache specifically designed for DynamoDB. It reduces read latency from single-digit milliseconds to microseconds by caching frequently accessed items, and it supports eventually consistent reads, which aligns with the application's tolerance for slightly stale data. DAX handles repeated read requests without additional DynamoDB read capacity unit consumption, making it the optimal choice for this latency-sensitive workload.

Answer

Amazon S3 Select

Answer

Amazon SQS FIFO queue

Answer

AWS Lambda provisioned concurrency

Question 20

An application encrypts data directly with AWS KMS using an encryption context. Your KMS key policy includes a condition that allows kms:Decrypt only when the encryption context contains: "purpose" = "myapp-secrets" After a deployment, decryption fails. CloudTrail shows kms:Decrypt was called, but it was denied by the key policy due to the encryption context condition. What is the best fix?

Accepted Answer

Update the application code to supply the correct encryption context "purpose" = "myapp-secrets" when calling decrypt (and encrypt if rotating).. The decryption failure is directly caused by the application not supplying the required encryption context in the decrypt call. The KMS key policy condition explicitly requires the encryption context to include 'purpose'='myapp-secrets' for kms:Decrypt. Without this context, the request is denied regardless of IAM permissions. Updating the application code to pass the correct encryption context during both encrypt and decrypt operations resolves the issue.

Answer

Add kms:Decrypt to the IAM role attached to the application without changing the key policy.

Answer

Disable the encryption context condition in the KMS key policy to avoid future failures.

Answer

Rotate the KMS key immediately and re-encrypt all secrets with a different key ID.