SAA-C03 Practice Test 21 — 15 Questions

Question 1

An orders service currently sends HTTP requests directly to two downstream services (inventory and shipping). During peak load, inventory slows down, causing the orders service to slow as well. The team wants the orders service to remain responsive even when a downstream service is temporarily slow or restarted. Which design change best achieves this resiliency goal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Introduce Amazon SQS as a buffer between orders and downstream services, with consumers processing from the queue.. Introducing Amazon SQS as a buffer decouples the orders service from the downstream inventory and shipping services. The orders service can immediately enqueue messages and respond to the client, while downstream consumers process messages at their own pace. This prevents backpressure from a slow or restarting downstream service from blocking the orders service, achieving the desired resiliency.

Answer

Keep HTTP calls but add longer client timeouts so orders requests wait for slow downstream responses.

Answer

Replace the downstream services with AWS Lambda functions that are invoked synchronously by the orders service.

Answer

Call the downstream services in parallel threads to reduce waiting time during peak load.

Question 2

A Lambda-based retail API has unpredictable traffic spikes and users see latency caused by cold starts. The function must respond consistently during expected campaign windows. What should be configured?

Accepted Answer

Provisioned concurrency during campaign windows. Provisioned concurrency initializes a specified number of execution environments in advance, eliminating cold starts during campaign windows. This ensures consistent latency even under unpredictable traffic spikes, as the function is always warm and ready to handle requests immediately.

Answer

A larger deployment package

Answer

Reserved concurrency only

Answer

CloudTrail data events

Question 3

A media company stores original video masters in an Amazon S3 bucket in the us-east-1 Region. Compliance requires that a readable copy of every object exists in eu-west-1 within 15 minutes of upload, and that objects deleted in the source bucket do not automatically disappear from the destination. Which S3 feature should the solutions architect enable?

Accepted Answer

S3 Cross-Region Replication with S3 Replication Time Control and DeleteMarkerReplication disabled. S3 Cross-Region Replication is the AWS feature that asynchronously copies new and updated objects to a bucket in another Region. S3 Replication Time Control adds an SLA that 99.99% of objects replicate within 15 minutes, matching the compliance window. Disabling DeleteMarkerReplication keeps the destination copy intact when the source object is deleted, which is exactly the retention behaviour the compliance team requires.

Answer

S3 Same-Region Replication into a bucket in us-east-1 with S3 Object Lock in compliance mode

Answer

AWS Backup with a cross-Region backup vault and a daily scheduled backup plan for the bucket

Answer

S3 Transfer Acceleration on the source bucket with a lifecycle rule transitioning objects to S3 Glacier Deep Archive

Question 4

A content publishing system uses Lambda functions that call an unreliable third-party API. Failed events must be retained for later investigation after retries are exhausted. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

A Lambda dead-letter queue or failure destination. A Lambda dead-letter queue (DLQ) or failure destination is the correct solution because it captures events that have exhausted all retry attempts from an asynchronous Lambda invocation. This allows failed events to be retained in an Amazon SQS queue or SNS topic for later investigation, without requiring custom operational scripts. The DLQ or failure destination integrates directly with Lambda's built-in retry behavior, ensuring that only events that fail after the configured number of retries are sent to the destination.

Answer

Lambda reserved concurrency set to zero

Answer

A larger deployment package

Answer

CloudFront error pages

Question 5

Based on the exhibit, the current disaster recovery design misses the RTO target even though the database replica is current. Which deployment model best meets the requirements with the least always-on cost?

Accepted Answer

Warm standby, because a scaled-down application stack stays running in the secondary Region and can take over faster.. Warm standby is the correct choice because it keeps a scaled-down application stack running in the secondary Region, which can be scaled up quickly to handle production traffic. This design meets the RTO target by reducing failover time compared to a pilot light, while avoiding the higher always-on cost of an active-active deployment.

Answer

Pilot light, because only the database needs to be running in the secondary Region.

Answer

Active-active, because both Regions should always serve traffic to guarantee the RTO.

Answer

Backup and restore, because restoring from backups is the least expensive DR model available.

Question 6

A containerized service needs to read exactly one secret value from AWS Secrets Manager. The secret’s ARN is already known, and the secret is encrypted with the AWS-managed KMS key for Secrets Manager, so no separate KMS permissions are needed for this question. The service does not need to list secrets, create secrets, rotate them, or write updates. What is the most least-privilege IAM permission statement to grant the service role?

Accepted Answer

Allow secretsmanager:GetSecretValue on the specific secret ARN only.. The service only needs to read a single secret value, and the least-privilege permission is to allow only the `secretsmanager:GetSecretValue` action on that specific secret's ARN. This grants exactly the required read access without any additional capabilities, adhering to the principle of least privilege. Since the secret is encrypted with the AWS-managed KMS key for Secrets Manager, no separate KMS permissions are needed, as the key policy automatically grants access to the Secrets Manager service.

Answer

Allow secretsmanager:* on all resources in the account.

Answer

Allow secretsmanager:ListSecrets so the service can discover the secret ARN at runtime.

Answer

Allow secretsmanager:PutSecretValue so the service can retrieve and update the secret value.

Question 7

Based on the exhibit, what should the security team implement so developers can create AWS Lambda execution roles, but no developer-created role can ever exceed the approved permission set?

Accepted Answer

Require a permissions boundary on every developer-created role and set the boundary to the approved maximum permissions.. A permissions boundary explicitly defines the maximum permissions that an IAM role can have, and when attached to developer-created roles, it prevents any role from exceeding the approved set of permissions, even if the developer attaches a more permissive policy. This directly addresses the requirement that no developer-created role can ever exceed the approved permission set, as the boundary acts as a hard cap.

Answer

Place the developers in an IAM group with a deny-only managed policy attached.

Answer

Use an AWS Organizations SCP to grant only the approved Lambda permissions directly to the developer roles.

Answer

Create the roles with inline policies only, because inline policies are always safer than managed policies.

Question 8

A financial services firm runs a stateful trading application on EC2 instances in an Auto Scaling group. Each instance maintains an in-memory cache that takes several minutes to rebuild after a restart, and the team wants the application to survive the loss of an Availability Zone with minimal disruption. The application cannot be made stateless in the near term. Which approach should a solutions architect recommend?

Accepted Answer

Configure the Auto Scaling group to span three Availability Zones with a capacity that leaves headroom in each zone, and enable instance warm-up and health check grace periods so that replacement instances are fully initialized before receiving traffic.. For a stateful application that cannot be re-architected immediately, the practical resilience pattern is to run warmed instances in more than two Availability Zones so that a single zone loss leaves sufficient capacity already serving traffic. Warm-up and grace period settings are essential because they stop the Auto Scaling group from killing instances that are still rebuilding their in-memory caches, which would otherwise produce repeated restarts and prolonged unavailability.

Answer

Move the in-memory cache to an Amazon ElastiCache for Redis cluster with Multi-AZ enabled and keep the Auto Scaling group in one Availability Zone.

Answer

Create a second Auto Scaling group in another Availability Zone and use Amazon Route 53 failover routing with health checks to switch traffic when the primary zone fails.

Answer

Enable EC2 Auto Recovery on all instances and configure the Auto Scaling group to use a single Availability Zone with a larger instance type.

Question 9

A company serves public JavaScript and CSS files from S3 using CloudFront. After a frontend change, customers report a low CloudFront cache hit ratio. Requests now include an Authorization header, but these assets do not require authentication. The CloudFront distribution is configured such that Authorization is included in the cache key. Which change best maximizes cache reuse?

Accepted Answer

Use a CloudFront Cache Policy that excludes Authorization from the cache key. Excluding the Authorization header from the cache key ensures that all users, regardless of their authentication token, receive the same cached object. Since the static assets (JavaScript/CSS) do not require authentication, including Authorization in the cache key creates multiple cache entries for the same file, drastically reducing the cache hit ratio. A CloudFront cache policy that omits Authorization from the cache key maximizes reuse while still allowing the header to be forwarded to the origin if needed.

Answer

Include the Authorization header in the cache key so responses vary correctly

Answer

Disable caching and always fetch from S3

Answer

Forward all headers and cookies to the origin to improve correctness

Question 10

A workload runs in private subnets and must reach Amazon S3 and AWS Secrets Manager without using the internet or a NAT gateway. The team wants to keep the traffic on AWS private networking and avoid public IPs. Which two changes should the architect make? Select two.

Accepted Answer

Create an S3 gateway VPC endpoint and update the route tables for the private subnets.. Option A is correct because an S3 gateway VPC endpoint provides private access to Amazon S3 by adding a prefix-list route to the private subnet route tables, so traffic to S3 stays on the AWS network without internet or NAT. Option C is correct because AWS Secrets Manager is accessed through an interface VPC endpoint (AWS PrivateLink), which creates an elastic network interface in the subnet and requires the workload's security group to allow outbound/inbound access to that endpoint on port 443. Option B is wrong because a NAT gateway still routes traffic through the internet and requires a public subnet, which the scenario explicitly excludes. Option D is wrong because assigning public IPv4 addresses exposes the instances to the internet and does not provide private AWS service access. Option E is wrong because VPC peering connects VPCs, not AWS service endpoints, and cannot be used to reach S3 or Secrets Manager privately.

Answer

Place a NAT gateway in the public subnet so the private instances can reach AWS services.

Answer

Assign public IPv4 addresses to the instances and restrict them with security groups.

Answer

Use VPC peering to the AWS service endpoints instead of VPC endpoints.

Question 11

A financial analytics team stores sensitive customer data in an Amazon S3 bucket. The bucket uses SSE-KMS with a customer-managed key. Analysts access objects using an IAM role attached to an EC2 instance in a private subnet. The role has s3:GetObject permission on the bucket. However, analysts report AccessDenied errors when downloading objects. The KMS key policy currently grants full access to the account root user only. What is the most likely cause of the AccessDenied errors?

Accepted Answer

The IAM role lacks the kms:Decrypt permission on the customer-managed KMS key used for SSE-KMS.. Objects encrypted with SSE-KMS using a customer-managed key require the caller to have kms:Decrypt permission on that key. The EC2 role has s3:GetObject but no KMS permissions, and the key policy grants access only to the account root. S3 evaluates both the S3 and KMS permissions when serving the object. Without kms:Decrypt, S3 returns AccessDenied even though the S3 permission is present.

Answer

The S3 bucket is configured with default encryption using SSE-S3, which conflicts with SSE-KMS and causes decryption failures.

Answer

The S3 bucket policy does not explicitly allow the IAM role to perform s3:GetObject.

Answer

The EC2 instance's security group does not allow outbound HTTPS traffic to the AWS KMS endpoint.

Question 12

A company runs a critical two-tier web application on AWS. The web tier consists of Amazon EC2 instances behind an Application Load Balancer (ALB) in a single Availability Zone. The database tier is an Amazon RDS for MySQL DB instance in the same Availability Zone. A recent power outage in that Availability Zone caused a full application outage. The company wants to redesign the architecture to survive an Availability Zone failure with minimal operational overhead. Which solution meets these requirements?

Accepted Answer

Deploy the web tier across two Availability Zones with an ALB, and convert the database to an RDS Multi-AZ DB instance.. The correct design distributes the stateless web tier across multiple Availability Zones and uses an RDS Multi-AZ DB instance for automatic database failover. This eliminates single points of failure at both tiers and requires little ongoing operational effort. Other options either leave the web tier in one AZ or rely on manual recovery for the database, failing the resilience and minimal-overhead goals.

Answer

Use an Application Load Balancer with cross-zone load balancing enabled and enable Multi-AZ on the RDS instance.

Answer

Enable RDS automated backups with a 30-day retention period and create a read replica in a second Availability Zone.

Answer

Place the EC2 instances in an Auto Scaling group spanning two Availability Zones, and take nightly snapshots of the RDS instance to restore in the second AZ.

Question 13

A company is designing a secure architecture for a three-tier web application on AWS. The application runs on Amazon EC2 instances in private subnets, uses an Amazon RDS for MySQL database in private subnets, and is accessed by users over the internet through an Application Load Balancer. The security team requires that the database credentials be stored securely and rotated automatically, and that EC2 instances retrieve credentials without hardcoding them. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Attach an IAM role to the EC2 instances that grants permission to retrieve the secret from AWS Secrets Manager.. AWS Secrets Manager stores and automatically rotates database credentials using a Lambda rotation function. An IAM role attached to the EC2 instances grants permission to retrieve the secret, eliminating hardcoded credentials. Together, these meet the requirements for secure storage, automatic rotation, and secure retrieval. Other options either lack rotation, are not designed for secrets, or require manual intervention.

Answer

Use AWS Systems Manager Parameter Store with SecureString parameters and manually update the credentials every 90 days.

Answer

Store the database credentials in an encrypted Amazon S3 object and grant the EC2 instance role access to read the object.

Answer

Embed the database credentials in the EC2 user data script and encrypt the script with AWS KMS.

Question 14

A media company has an Amazon RDS for MySQL database in a private subnet. A web application on Amazon EC2 instances must connect to the database, and the security team requires that the database credentials be rotated every 30 days without application downtime. Which solution should a solutions architect recommend?

Accepted Answer

Store the credentials in AWS Secrets Manager, enable automatic rotation with a Lambda rotation function, and have the application retrieve the secret at runtime.. Secrets Manager is designed for this use case: it stores the RDS credentials, uses a Lambda rotation function to change the password on a schedule, and updates the secret value atomically. Applications that fetch the secret at runtime receive the current credentials, so rotation happens without downtime or application redeployment.

Answer

Store the credentials in an encrypted Amazon S3 object and have the application download the object on each connection.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter and rotate them with a scheduled Lambda function.

Answer

Use IAM database authentication for Amazon RDS and have the application generate an authentication token with its IAM role.

Question 15

A media company stores video files in an Amazon S3 bucket in the us-east-1 Region. The company wants to ensure that the files are automatically replicated to us-west-2 for disaster recovery, and that replication occurs within 15 minutes of upload. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable S3 Cross-Region Replication (CRR) on the bucket with a replication rule that applies to all objects.. S3 Cross-Region Replication is the managed solution for automatically replicating objects to a bucket in another Region. It is asynchronous but typically completes within minutes, satisfying the 15-minute requirement. It requires versioning and an IAM role, but after setup it runs without ongoing intervention. This provides the lowest operational overhead compared to custom code or scheduled data transfer tasks.

Answer

Configure an AWS Lambda function triggered by S3 event notifications to copy each object to the destination bucket.

Answer

Use AWS DataSync to schedule a recurring task that synchronizes the source bucket to the destination bucket every 15 minutes.

Answer

Enable S3 Same-Region Replication (SRR) to a bucket in us-east-1, then use S3 Batch Operations to copy objects to us-west-2 nightly.