SAA-C03 Practice Test 22 — 15 Questions

Question 1

A company runs a critical application on Amazon EC2 instances in a single Availability Zone. The application writes data to an Amazon RDS for MySQL DB instance that is not Multi-AZ. The company wants to improve the resilience of the database tier so that it can survive an Availability Zone failure with minimal downtime and no data loss. The application uses the database endpoint from the RDS console. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Convert the DB instance to a Multi-AZ deployment and update the application to use the same endpoint.. Multi-AZ deployments for Amazon RDS provide a synchronous standby replica in a different Availability Zone. In the event of an AZ failure, RDS automatically fails over to the standby, and the application continues to use the same endpoint. Because replication is synchronous, there is no data loss. This meets the requirements of minimal downtime and no data loss without application changes.

Answer

Create a read replica in another Availability Zone and manually promote it if the primary fails.

Answer

Enable automated backups with a retention period of 35 days and copy the backups to another Region.

Answer

Migrate the database to Amazon DynamoDB with global tables and update the application to use the DynamoDB endpoint.

Question 2

A company needs to store application logs in a durable and highly available manner. The logs are written continuously by multiple EC2 instances and are accessed infrequently for compliance audits. The company wants a solution that provides 99.999999999% (11 9's) durability and automatically replicates data across multiple Availability Zones. Which AWS service should the company use?

Accepted Answer

Amazon S3 with the STANDARD storage class.. Amazon S3 Standard is designed for 99.999999999% durability and automatically replicates data across multiple Availability Zones within a Region. It supports concurrent writes from multiple EC2 instances and is a cost-effective solution for storing and retrieving logs. This meets the durability and availability requirements.

Answer

Amazon EC2 instance store volumes.

Answer

Amazon Elastic Block Store (Amazon EBS) volumes attached to each EC2 instance.

Answer

Amazon RDS for MySQL with a Multi-AZ deployment.

Question 3

A financial analytics team runs a nightly Monte Carlo simulation on a cluster of Amazon EC2 instances. The simulation writes checkpoint files to an Amazon EBS volume, and the job can be safely restarted from the last checkpoint if interrupted. The team needs the lowest possible compute cost and can tolerate interruptions. The job must run every night and finish within a 6-hour window. Which solution meets these requirements MOST cost-effectively?

Accepted Answer

Use Spot Instances with a persistent request and checkpointing to EBS.. Spot Instances are the most cost-effective choice for fault-tolerant, interruptible workloads, offering steep discounts over On-Demand. Because the simulation can resume from checkpoints, Spot interruptions are acceptable. A persistent Spot request helps maintain capacity to complete the job within the nightly window, while checkpointing to EBS preserves progress. Other purchasing options either cost more or do not suit the interruptible pattern.

Answer

Use On-Demand EC2 instances with a placement group for low-latency networking.

Answer

Use Dedicated Hosts to ensure physical isolation for the simulation.

Answer

Purchase a 1-year Standard Reserved Instance for each instance in the cluster.

Question 4

A media company stores 50 TB of finalized video masters in Amazon S3 that must be retained for seven years for regulatory compliance. The files are accessed only during occasional legal audits, roughly once every two years, and retrieval latency of several hours is acceptable. The company wants the LOWEST possible storage cost while preserving durability. Which storage class should they choose?

Accepted Answer

S3 Glacier Deep Archive. Data accessed less than once per year and tolerant of hours-long retrieval belongs in S3 Glacier Deep Archive, which offers the lowest per-GB storage price in S3 while retaining eleven nines of durability. Glacier Flexible Retrieval and the IA classes cost more per GB and target more frequent access patterns, so they would increase seven-year spend without adding value.

Answer

S3 Glacier Flexible Retrieval

Answer

S3 Standard-Infrequent Access

Answer

S3 One Zone-IA

Question 5

Based on the exhibit, which Amazon EFS performance mode is the best fit for this workload?

Accepted Answer

Use General Purpose performance mode for low-latency access.. The General Purpose performance mode is the best fit for this workload because it provides the lowest latency for file operations, which is critical for latency-sensitive applications such as web serving, content management, and development environments. EFS General Purpose mode is optimized for workloads where consistent low-latency access is required, making it the default and recommended choice for most use cases.

Answer

Use Max I/O performance mode to optimize for the highest possible latency tolerance.

Answer

Use One Zone storage class to increase metadata speed.

Answer

Use Provisioned Throughput mode because it is the only performance mode available.

Question 6

A startup runs a stateless web tier on Amazon EC2 instances in an Auto Scaling group that spans three Availability Zones. The team wants the application to keep serving requests even if one instance becomes unresponsive, without operator involvement. What should the solutions architect configure?

Accepted Answer

An Application Load Balancer with health checks that route traffic only to healthy targets.. Health-checked load balancing is the mechanism that detects an unresponsive instance and removes it from the traffic path automatically. Because the tier is stateless and already spans three Availability Zones, the Application Load Balancer can shift requests to remaining healthy instances while the Auto Scaling group replaces the failed one.

Answer

A Network Load Balancer configured with a single target group and no health checks.

Answer

An Elastic IP address associated with each EC2 instance in the Auto Scaling group.

Answer

An Auto Scaling group with a scheduled scaling policy that adds instances every morning.

Question 7

A startup runs a web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to encrypt data in transit between clients and the load balancer using a certificate managed by AWS, with minimal operational overhead. Which solution meets these requirements?

Accepted Answer

Request a public certificate in AWS Certificate Manager (ACM), validate it via DNS, and attach it to an HTTPS listener on the Application Load Balancer.. AWS Certificate Manager (ACM) issues free public certificates that can be automatically renewed when DNS validation is used, and it integrates directly with Application Load Balancers. Attaching an ACM certificate to an HTTPS listener encrypts client traffic with minimal operational effort, satisfying the requirement.

Answer

Import a self-signed certificate into AWS Certificate Manager (ACM) and attach it to the load balancer's HTTPS listener.

Answer

Use an Amazon-issued certificate from IAM and attach it to the load balancer's HTTPS listener.

Answer

Generate a certificate using AWS KMS, store it in AWS Secrets Manager, and configure the load balancer to retrieve it at runtime.

Question 8

CloudWatch metrics show your EC2 instances have average CPU utilization around 10% with stable performance over several weeks. The application does not require additional headroom right now. What is the most effective cost-optimization action?

Accepted Answer

Right-size the instances to a smaller size that matches the observed utilization. Right-sizing EC2 instances to match observed utilization is the most effective cost-optimization action because the current instances are over-provisioned (average CPU at 10%). By selecting a smaller instance type that aligns with the actual workload, you reduce hourly costs without impacting performance, as the application has stable behavior and no need for headroom.

Answer

Increase the Auto Scaling desired capacity to add more instances

Answer

Switch to Spot Instances immediately even though interruptions would impact users

Answer

Disable detailed monitoring to reduce CPU usage from the monitoring agent

Question 9

A retailer runs a reporting-heavy relational app on Amazon RDS MySQL. Peak dashboard traffic lasts only three hours each day, but the database is sized for the peak all day. The business wants lower cost without rewriting the application. Which three actions are best? Select three.

Accepted Answer

Right-size the writer based on actual utilization instead of peak guesses.. Option A is correct because right-sizing the writer instance to match actual CPU, memory, and IOPS utilization rather than peak-day guesses directly reduces the largest cost component of an RDS MySQL deployment without changing the application. Option B is correct because adding read replicas and routing dashboard (read-only) queries to them offloads the writer, letting the writer be smaller and cheaper while still serving peak reporting traffic. Option C is correct because evaluating Aurora MySQL is a valid cost-optimization step: Aurora's distributed storage and replica model can be cheaper for replica-heavy read workloads, and it remains MySQL-compatible so no application rewrite is needed. Option D is wrong because DynamoDB is a NoSQL service that would require rewriting the relational application, which the business explicitly wants to avoid. Option E is wrong because permanently increasing provisioned IOPS raises, not lowers, the monthly bill.

Answer

Migrate to DynamoDB immediately because every relational workload is more expensive.

Answer

Increase provisioned IOPS permanently so the monthly bill drops.

Question 10

A genomics company stores about 400 TB of compressed research data in Amazon S3 and runs a nightly analysis job on a fleet of EC2 instances in the same Region. The job reads the entire dataset every night, and the team wants to reduce the time the fleet spends waiting on storage without changing the data format or the S3 bucket. Which change best improves read throughput for the fleet?

Accepted Answer

Configure the S3 requests to use byte-range fetches and issue many concurrent GET requests across the dataset.. S3 performance scales horizontally with concurrent requests, so a fleet reading 400 TB should issue many parallel, byte-range GETs spread across the key space rather than a few large sequential reads. That pattern uses the aggregate bandwidth of all instances and reduces time spent waiting on storage, while leaving the data format and bucket unchanged as required.

Answer

Change the storage class of the dataset to S3 Glacier Instant Retrieval for faster reads.

Answer

Mount the bucket with a file gateway and read the dataset as files over NFS.

Answer

Enable S3 Transfer Acceleration and read the dataset through the accelerated endpoint.

Question 11

A high-volume analytics dashboard writes streaming click events that must be processed by multiple independent consumers. Which service is most appropriate?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is the most appropriate service because it is designed for real-time streaming data ingestion and can be consumed by multiple independent consumers in parallel. Each shard within a Kinesis stream supports up to 5 read transactions per second and a total data read rate of 2 MB per second, allowing multiple consumer applications to process the same stream of click events concurrently without interfering with each other.

Answer

Amazon Route 53

Answer

Amazon EBS

Answer

AWS DataSync

Question 12

A test environment stores logs in S3. Logs are queried for 30 days, rarely accessed for one year, and then retained for compliance. What should reduce storage cost? The design must avoid adding custom operational scripts.

Accepted Answer

S3 lifecycle policy that transitions objects to lower-cost storage classes over time. S3 lifecycle policies automate the transition of objects between storage classes based on age, allowing logs to move from S3 Standard (for frequent querying) to S3 Standard-IA or S3 One Zone-IA (for rare access), and eventually to S3 Glacier Deep Archive (for long-term compliance retention). This reduces storage cost without custom scripts, aligning with the requirement to avoid operational overhead.

Answer

Keep all logs in S3 Standard indefinitely

Answer

Move all logs immediately to S3 Glacier Deep Archive

Answer

Use EBS snapshots for the logs

Question 13

A CI/CD system creates an IAM role (CICDRole) used for deployments. Your organization uses IAM permission boundaries to prevent developers from granting themselves higher privileges. After an incident, you discover that CICDRole can perform unintended IAM actions because the role’s identity policy includes broad permissions. Which change most directly ensures permission boundaries continue to restrict CICDRole regardless of what is later added to the role’s identity policies?

Accepted Answer

Ensure CICDRole is created with the required permissions boundary ARN, and verify that the boundary policy does not allow the unintended IAM actions.. IAM permission boundaries define the maximum permissions that an IAM role can have, regardless of what is later added to its identity-based policies. By ensuring CICDRole is created with a permission boundary that explicitly denies the unintended IAM actions, even if broad permissions are added to the role's identity policy, the boundary will override and restrict those actions. This directly addresses the requirement to prevent privilege escalation through policy modifications.

Answer

Remove the permission boundary from CICDRole so that only the identity policy controls access.

Answer

Add an identity-policy deny for iam:CreatePolicy and iam:UpdateRole on all resources.

Answer

Rely on CloudTrail alerts to stop deployments from performing IAM changes after the fact.

Question 14

An S3 bucket in account A uses default server-side encryption with an AWS KMS customer-managed key (CMK) in account A. A team created an IAM role in account B that is allowed by IAM policy to perform s3:GetObject on the bucket. When the account B role tries to read objects, it fails with: AccessDeniedException: 'User is not authorized to perform kms:Decrypt'. Which change is most likely to fix the issue?

Accepted Answer

Update the CMK key policy in account A to allow the account B role principal to call kms:Decrypt (and kms:DescribeKey if needed).. When an S3 bucket uses SSE-KMS with a customer-managed key (CMK) in account A, the account B role must have explicit kms:Decrypt permission on that CMK. The key policy in account A controls access to the CMK, so adding the account B role principal to the key policy with kms:Decrypt (and kms:DescribeKey if needed) is required. Without this, even if the S3 bucket policy and IAM role allow s3:GetObject, the KMS decrypt call will fail.

Answer

Add kms:Decrypt permissions to the identity policy in account B only, without modifying the CMK key policy in account A.

Answer

Disable SSE-KMS on the S3 bucket so objects use SSE-S3 instead, eliminating the need for KMS permissions.

Answer

Attach a broad permissions boundary to the account B role allowing all kms:* actions to override the key policy.

Question 15

A Multi-AZ Amazon RDS database experiences incorrect writes at 10:15 UTC due to a buggy release. The team detects the problem at 10:25 UTC. They want to restore the data to a known-good point around 10:15 UTC, and validate the recovered data, without taking the current production instance offline during the recovery process. What is the most appropriate AWS action?

Accepted Answer

Perform a point-in-time restore (PITR) to a new DB instance using a restore time around 10:15 UTC, then test the restored instance before cutting over.. Amazon RDS point-in-time recovery (PITR) allows you to restore a DB instance to any second within the backup retention period, creating a new, independent DB instance. This lets you validate the recovered data without affecting the current production instance, which remains online and serving traffic. The team can then cut over to the restored instance after confirming it is clean.

Answer

Immediately reboot the RDS instance and rely on the reboot to roll back the bad writes.

Answer

Create a new Read Replica from the current primary and use it as the recovered database after applying reverse migrations.

Answer

Temporarily disable Multi-AZ to speed up storage rollback, then re-enable Multi-AZ.