SAA-C03 Practice Test 22 — 15 Questions

Question 1

Based on the exhibit, a DynamoDB-backed event processing system is throttling during a promotion. The table uses tenantId as the partition key and eventTime as the sort key. One tenant accounts for most of the write traffic, and the application must preserve fast lookups for that tenant without relying on a single hot partition. What change is the best fix?

Accepted Answer

Add a sharding suffix to the partition key, such as tenantId#shardId, and query across the tenant's shards.. Option A is correct because adding a sharding suffix (e.g., tenantId#shardId) to the partition key distributes write traffic for the hot tenant across multiple partitions, eliminating the single-partition bottleneck while preserving fast lookups by querying across all shards for that tenant. DynamoDB's partition key determines physical storage; without sharding, all writes for the hot tenant land on one partition, causing throttling even if the table has sufficient total capacity.

Answer

Enable DynamoDB Streams so the table can process writes more quickly.

Answer

Switch the table to on-demand capacity mode and keep the same key design.

Answer

Add a global secondary index on eventTime and query the index instead of the base table.

Question 2

Based on the exhibit, the company has one shared S3 bucket for many internal teams. Security wants each team to access only its own prefix, ACLs must remain disabled, and the current bucket policy has become too large and error-prone. What is the best redesign?

Accepted Answer

Create one S3 access point per team and attach an access point policy that limits that team to its own prefix.. Option C is correct because S3 Access Points allow you to create separate access points for each team, each with its own policy that restricts access to a specific prefix (e.g., s3://shared-bucket/team-a/). This eliminates the need for a large, error-prone bucket policy while keeping ACLs disabled, as access is managed through IAM policies and access point policies. It also maintains a single shared bucket, simplifying management and cost allocation.

Answer

Re-enable object ACLs and manage access by setting object-level ACLs for each team's prefix.

Answer

Split the bucket into one bucket per team and keep using a single shared bucket policy for all of them.

Answer

Make the bucket public and issue presigned URLs for team access so IAM policies are no longer needed.

Question 3

An order processing workflow uses Amazon SQS as the decoupling layer between a producer and a consumer Lambda function. The consumer intermittently fails due to a downstream dependency. The team has observed that certain “poison” messages keep being retried repeatedly and prevent other messages from being processed efficiently. Which SQS configuration most directly addresses this issue?

Accepted Answer

Configure a redrive policy with a dead-letter queue (DLQ) and set an appropriate visibility timeout greater than the maximum processing time.. Option C is correct because configuring a redrive policy with a dead-letter queue (DLQ) allows messages that repeatedly fail processing to be moved out of the main queue after a specified number of receive attempts. Setting an appropriate visibility timeout greater than the maximum processing time ensures that messages are not made visible again before the consumer finishes processing, preventing premature retries. This directly isolates poison messages so they no longer block the processing of other messages in the queue.

Answer

Set the SQS queue’s retention period to 10 years and rely on application retries to eventually succeed.

Answer

Increase visibility timeout to a very large value and avoid dead-letter queues to keep ordering stable.

Answer

Switch the queue to FIFO and remove retries in the Lambda event source mapping entirely.

Question 4

An Auto Scaling group for a background worker runs EC2 instances continuously. Over the last 30 days, CloudWatch shows sustained CPU utilization around 6% with no memory pressure, and queue processing latency meets all SLAs. The team wants to lower monthly cost with minimal risk. What is the best next action?

Accepted Answer

Perform right sizing by downsizing to a smaller instance family/size and validate SLAs. The current instance type is over-provisioned, as sustained CPU utilization is only 6% with no memory pressure and all SLAs are met. Right-sizing to a smaller instance family or size directly reduces compute cost while maintaining performance, making it the lowest-risk, cost-optimization action. This aligns with the AWS Well-Architected Framework's cost optimization pillar, which recommends matching instance capacity to actual workload requirements.

Answer

Increase the instance size to reduce CPU throttling risk

Answer

Switch the group to Spot Instances to reduce cost without changing instance sizing

Answer

Buy Reserved Instances with a long term commitment before making any sizing changes

Question 5

Based on the exhibit, the company wants to lower CloudWatch and EC2 monitoring costs. Auditors require logs to be retained for 90 days, but operations only uses detailed per-instance metrics during rare troubleshooting events. Which change best reduces recurring cost while preserving the required visibility?

Accepted Answer

Set CloudWatch Logs retention to 90 days for all log groups, and switch EC2 monitoring from detailed to basic except during incidents.. Option C is correct because it directly addresses the two cost drivers: CloudWatch Logs storage costs are minimized by setting a 90-day retention policy (matching the audit requirement), and EC2 detailed monitoring (1-minute metrics) is replaced with basic monitoring (5-minute metrics) during normal operations, with the ability to switch back to detailed only when needed for troubleshooting. This preserves the required log retention and the ability to obtain high-resolution metrics on demand, while eliminating the recurring cost of storing logs indefinitely and paying for detailed monitoring on every instance.

Answer

Disable CloudWatch Logs entirely and rely on application local files for 90 days.

Answer

Increase the number of CloudWatch alarms so that metrics are collected less expensively.

Answer

Export all logs to Amazon S3 immediately and keep detailed monitoring enabled on every instance.

Question 6

Based on the exhibit, some SQS messages fail validation repeatedly and continue consuming worker time. What change best prevents the bad messages from being retried forever?

Accepted Answer

Configure a dead-letter queue and a redrive policy for messages that exceed the retry limit.. A dead-letter queue (DLQ) with a redrive policy allows messages that have been received a maximum number of times (e.g., after the configured retry limit) to be moved to a separate queue for analysis or manual handling. This prevents the same invalid message from being repeatedly processed by workers, freeing up compute resources and avoiding infinite retry loops.

Answer

Increase the visibility timeout so each message has more time to finish processing.

Answer

Replace the queue with an Amazon SNS topic so failed messages will not be retried.

Answer

Increase the number of workers so the queue drains faster during peak load.

Question 7

Your application uses ElastiCache Redis as a cache for user profiles stored in DynamoDB. You must ensure that when a profile is updated, subsequent reads see the latest value quickly. Which cache strategy is generally the best fit for this requirement?

Accepted Answer

Use a cache-aside approach with TTL plus explicit invalidation after writes.. The cache-aside (lazy loading) pattern with TTL plus explicit invalidation ensures that after a write to DynamoDB, the stale Redis entry is removed, forcing the next read to fetch the updated profile from DynamoDB and repopulate the cache. This minimizes the window of inconsistency while keeping cache management simple and efficient for user profile workloads.

Answer

Write to DynamoDB only, and never update or invalidate the Redis cache.

Answer

Cache only for reads, and do not fetch from DynamoDB when a key is missing.

Answer

Rely on eventual consistency of Redis replication to propagate updates to all nodes.

Question 8

An ECS service runs on EC2 instances and is fronted by an ALB. The ALB spans two Availability Zones, and the ECS service desired count is 2 tasks. The underlying EC2 capacity uses an Auto Scaling group (ASG) with min size set to 1, and the ASG also spans only one subnet in practice. What is the most effective change to meet the requirement that the service continues during a single-AZ instance loss?

Accepted Answer

Increase ASG min size to at least 2 and ensure the ASG uses subnets in at least two Availability Zones.. Option B is correct because the current architecture has a single point of failure: the ASG spans only one subnet (one AZ), so if that AZ fails, all EC2 instances are lost, and the ECS service cannot run any tasks. By increasing the ASG min size to at least 2 and ensuring it uses subnets in at least two AZs, the ASG will maintain at least one healthy instance in each AZ, allowing the ECS service to survive a single-AZ outage. This aligns with the AWS Well-Architected Framework's principle of deploying across multiple AZs for high availability.

Answer

Set the ECS deployment configuration to maximum percent 100 so tasks replace instances faster during rollouts.

Answer

Enable ALB connection draining longer than expected so existing connections survive longer during an AZ event.

Answer

Reduce task memory reservations to pack both tasks onto a single EC2 instance.

Question 9

Based on the exhibit, the company runs a self-managed RabbitMQ cluster on EC2 for asynchronous work. The queue only needs durable at-least-once delivery, and the application does not require AMQP-specific features such as exchanges, routing keys, or broker plugins. Which change is the best cost-optimization move?

Accepted Answer

Replace RabbitMQ with Amazon SQS Standard and keep the workers unchanged except for the queue client library.. Option A is correct because Amazon SQS Standard provides at-least-once delivery and durable message storage without requiring AMQP-specific features like exchanges or routing keys. Replacing RabbitMQ with SQS eliminates the operational overhead of managing EC2 instances and RabbitMQ clusters, while SQS's pay-per-request pricing is more cost-effective than running EC2 instances 24/7 for a self-managed queue.

Answer

Replace RabbitMQ with Amazon MQ for RabbitMQ to keep the same protocol and reduce costs.

Answer

Increase the RabbitMQ instance size and add a fourth node for higher availability.

Answer

Move the queue to Amazon DynamoDB and use scans for consumers to detect new messages.

Question 10

An S3 bucket in account A uses default server-side encryption with an AWS KMS customer-managed key (CMK) in account A. A team created an IAM role in account B that is allowed by IAM policy to perform s3:GetObject on the bucket. When the account B role tries to read objects, it fails with: AccessDeniedException: 'User is not authorized to perform kms:Decrypt'. Which change is most likely to fix the issue?

Accepted Answer

Update the CMK key policy in account A to allow the account B role principal to call kms:Decrypt (and kms:DescribeKey if needed).. When an S3 bucket uses SSE-KMS with a customer-managed key (CMK) in account A, the account B role must have explicit kms:Decrypt permission on that CMK. The key policy in account A controls access to the CMK, so adding the account B role principal to the key policy with kms:Decrypt (and kms:DescribeKey if needed) is required. Without this, even if the S3 bucket policy and IAM role allow s3:GetObject, the KMS decrypt call will fail.

Answer

Add kms:Decrypt permissions to the identity policy in account B only, without modifying the CMK key policy in account A.

Answer

Disable SSE-KMS on the S3 bucket so objects use SSE-S3 instead, eliminating the need for KMS permissions.

Answer

Attach a broad permissions boundary to the account B role allowing all kms:* actions to override the key policy.

Question 11

Based on the exhibit, a public API is behind CloudFront. A single client IP is sending bursts of requests that are overwhelming the origin, and the team wants AWS to automatically mitigate the abuse at the edge without changing the application code. What should the team do?

Accepted Answer

Associate an AWS WAF web ACL with CloudFront and add a rate-based rule for the offending IP behavior.. AWS WAF rate-based rules automatically block or rate-limit requests from a client IP when the request rate exceeds a threshold you define. By associating the web ACL with CloudFront, the rule is enforced at the edge before traffic reaches the origin, mitigating abuse without modifying application code.

Answer

Increase the ALB idle timeout to allow the origin to absorb more concurrent requests.

Answer

Add an Amazon Route 53 health check to fail over traffic to another DNS name.

Answer

Enable AWS Shield Advanced and rely on automatic DDoS protection for all request bursts.

Question 12

Multiple EC2 instances in different Availability Zones need concurrent read/write access to the same shared files. The files are actively modified by several application servers, and low-latency metadata operations matter more than extremely high aggregate throughput. Which two changes should the team make? Select two.

Accepted Answer

Use Amazon EFS instead of EBS or S3 for the shared file system.. Amazon EFS provides a fully managed, POSIX-compliant, shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones (AZs). It supports concurrent read/write access with strong consistency, and its metadata operations are optimized for low latency, making it ideal for workloads where many application servers actively modify the same files. EBS cannot be shared across AZs, and S3 lacks POSIX semantics and low-latency metadata operations.

Answer

Use a single EBS Multi-Attach volume mounted read/write by all instances across AZs.

Answer

Store the files in S3 and mount them directly through the console as a shared network filesystem.

Answer

Place the files on instance store volumes so each server has faster local access.

Question 13

Based on the exhibit, duplicate payment charges occasionally occur when the worker times out after the charge is submitted but before the message is deleted. What change best prevents duplicate charges while keeping retry behavior?

Accepted Answer

Make the consumer idempotent by storing a processed payment key and rejecting repeat charges.. Option B is correct because making the consumer idempotent ensures that even if the same message is processed more than once (due to a timeout after the charge is submitted but before the message is deleted), the duplicate charge will be rejected. By storing a processed payment key (e.g., a unique transaction ID) and checking it before processing, the system can safely retry without causing duplicate payments. This approach preserves retry behavior while preventing duplicates, which is the core requirement.

Answer

Switch the queue to FIFO and rely on content-based deduplication to guarantee exactly-once processing.

Answer

Reduce the visibility timeout so the message becomes available again sooner after a timeout.

Answer

Add a dead-letter queue and disable retries so the message is never processed twice.

Question 14

An order-processing service consumes messages from an Amazon SQS Standard queue using a custom worker. During traffic spikes, the worker occasionally times out after performing some work but before acknowledging the message, so SQS redelivers it and it may be processed again.

You also observe that a small set of “poison” messages always fail validation.

What change most directly improves resilience by (1) preventing poison messages from retrying indefinitely and (2) avoiding duplicate side effects caused by legitimate retries?

Accepted Answer

Configure a dead-letter queue (DLQ) with a redrive policy that moves messages after maxReceiveCount, and implement idempotent processing in the consumer using an idempotency key.. Option C is correct because a dead-letter queue (DLQ) with a maxReceiveCount redrive policy directly addresses the poison message problem by moving messages that repeatedly fail validation out of the main queue after a set number of retries, preventing indefinite retries. Implementing idempotent processing using an idempotency key ensures that even if a legitimate message is redelivered due to a visibility timeout, the consumer can detect and skip duplicate side effects, thus solving both requirements most directly.

Answer

Increase the SQS visibility timeout and, when validation fails, call DeleteMessage in the consumer to remove the message immediately.

Answer

Move to SNS topics with subscriptions and rely on SNS to provide exactly-once delivery to eliminate duplicates automatically.

Answer

Change the queue to FIFO and enable content-based deduplication, leaving the consumer logic unchanged.

Question 15

Developers for a B2B file exchange site need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center (formerly AWS SSO) enables time-bound permission sets that grant temporary elevated access with automatic expiry, satisfying the security team's requirements for approvals and audit logging via AWS CloudTrail. This approach follows the principle of least privilege by providing just-in-time access rather than permanent permissions, and all actions are recorded in CloudTrail for compliance.

Answer

Attach AdministratorAccess permanently to every developer role

Answer

Create shared administrator access keys for the team

Answer

Disable CloudTrail during troubleshooting

SAA-C03 Practice Test 22 — 15 Questions

Exhibit

SAA-C03 Practice Test 22 — 15 Questions

Exhibit