SAA-C03 Practice Test 23 — 15 Questions

Question 1

Based on the exhibit, a faulty deployment corrupted production data at 10:30 UTC and the issue was discovered at 10:55 UTC. The team needs to recover the database to the last good state before the corruption. Which action should they take?

Accepted Answer

Use point-in-time restore to create a new database instance at 10:29 UTC, then switch the application to it.. Option B is correct because Amazon RDS for MySQL (and other engines) supports point-in-time recovery (PITR), which allows you to restore a database to any second within the backup retention period, up to the last five minutes. By restoring to 10:29 UTC (one minute before the corruption at 10:30 UTC), the team can recover the database to its last good state with minimal data loss. After restoring, the application can be pointed to the new instance, avoiding the corrupted data.

Answer

Restore the latest manual snapshot and accept data loss since the snapshot was taken overnight.

Answer

Restart the database instance so the transaction log replays the failed migration cleanly.

Answer

Create a read replica and promote it, because replicas always contain the previous transaction state.

Question 2

Company A must allow workloads in Company B to assume an IAM role in Company A (RoleInA). To mitigate confused-deputy attacks, a Security requirement is to use an External ID. Company A should restrict who can assume RoleInA. Which trust-policy configuration is the best choice?

Accepted Answer

In Company A role trust policy, allow sts:AssumeRole only for principal "arn:aws:iam:::role/" and require a condition where sts:ExternalId equals the expected External ID value.. Option B is correct because it restricts the trust policy to a specific IAM role in Company B (using the principal ARN) and requires the `sts:ExternalId` condition to match a predefined value. This ensures only the intended role in Company B can assume RoleInA, and the External ID prevents a confused-deputy attack by requiring the third party to provide a unique identifier that only the legitimate service knows.

Answer

In Company A role trust policy, allow sts:AssumeRole for principal "arn:aws:iam::<company-b-account-id>:root" with no sts:ExternalId condition.

Answer

In the trust policy, allow iam:PassRole for the Company B principal and include an sts:ExternalId condition.

Answer

In Company A, grant Company B access using an IAM permissions policy attached to RoleInA instead of using a trust policy.

Question 3

You host a public API using Amazon API Gateway in two AWS Regions: us-east-1 (primary) and us-west-2 (secondary). You want Route 53 to send client traffic to the secondary region only when the primary API is unhealthy. Which Route 53 setup best meets this requirement?

Accepted Answer

Use Route 53 failover routing with two ALIAS records (same DNS name) pointing to the API Gateway regional endpoints: one record is configured as PRIMARY with an associated health check, and the other is configured as SECONDARY.. Route 53 failover routing is designed for active-passive setups where traffic is sent to a primary resource unless it is unhealthy, in which case traffic is routed to a secondary resource. By creating two ALIAS records with the same DNS name, one marked PRIMARY with an associated health check and the other marked SECONDARY, Route 53 will automatically fail over to the secondary region when the health check for the primary API Gateway endpoint fails. This directly meets the requirement of sending traffic to the secondary region only when the primary API is unhealthy.

Answer

Use latency-based routing with one routing policy per region, and use CloudWatch alarms to update traffic weights between regions.

Answer

Use weighted routing across both regions and rely on Route 53 health checks to automatically set the secondary to 100% weight when the primary fails.

Answer

Use geolocation routing to map some client geographies to the secondary region and the rest to the primary region.

Question 4

Based on the exhibit, which design change is the best way to reduce the observed read latency for this DynamoDB-backed service?

Accepted Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table and send repeated read traffic through it.. Adding a DynamoDB Accelerator (DAX) cluster in front of the table reduces read latency by providing an in-memory cache for repeated read traffic. DAX delivers microsecond response times for eventually consistent reads, which directly addresses the observed latency issue without requiring application-level caching or table redesign.

Answer

Increase the on-demand table limits so DynamoDB can automatically absorb more traffic.

Answer

Create a global secondary index on tenantId to distribute the load across more partitions.

Answer

Move the dashboard data into S3 and use Lambda functions to read it on demand.

Question 5

CloudWatch metrics show your EC2 instances have average CPU utilization around 10% with stable performance over several weeks. The application does not require additional headroom right now. What is the most effective cost-optimization action?

Accepted Answer

Right-size the instances to a smaller size that matches the observed utilization. Right-sizing EC2 instances to match observed utilization is the most effective cost-optimization action because the current instances are over-provisioned (average CPU at 10%). By selecting a smaller instance type that aligns with the actual workload, you reduce hourly costs without impacting performance, as the application has stable behavior and no need for headroom.

Answer

Increase the Auto Scaling desired capacity to add more instances

Answer

Switch to Spot Instances immediately even though interruptions would impact users

Answer

Disable detailed monitoring to reduce CPU usage from the monitoring agent

Question 6

In AWS Organizations, a Service Control Policy (SCP) denies kms:Decrypt on a production CMK for all principals in the Finance OU. A developer in the Finance OU created/updated an IAM policy that allows secrets access, but the application still fails with AccessDenied due to the SCP. You must enable only the Finance OU to decrypt that specific CMK while keeping the SCP restrictions for other OUs. What is the correct remediation?

Accepted Answer

Modify the SCP so it no longer denies kms:Decrypt for that specific CMK when applied to the Finance OU, while preserving the deny behavior for other OUs.. Option B is correct because SCPs are evaluated before IAM policies and cannot be bypassed by IAM permissions. By modifying the SCP to exclude the specific CMK for the Finance OU (e.g., using a Condition key like `kms:ViaService` or a resource-level exception), you remove the explicit deny for that OU while keeping it in place for all other OUs. This ensures the developer's IAM policy can then allow `kms:Decrypt` without being blocked by the SCP.

Answer

Update the developer’s IAM policy to allow kms:Decrypt on the CMK alias ARN so the request bypasses the SCP.

Answer

Add a KMS key policy statement that allows the developer role to decrypt the CMK.

Answer

Attach a permissions boundary that grants kms:Decrypt so the SCP becomes irrelevant.

Question 7

You must ensure that all requests to an S3 bucket use TLS (HTTPS). Which S3 bucket policy approach best enforces this requirement for S3 access?

Accepted Answer

Use a policy statement that explicitly Denies any action when aws:SecureTransport is false. Option B is correct because the `aws:SecureTransport` condition key evaluates whether the request was sent using TLS. By explicitly denying all S3 actions when `aws:SecureTransport` is false, any HTTP request is rejected, ensuring only HTTPS requests succeed. This approach uses an explicit deny, which overrides any allow, making it the most secure and reliable method to enforce TLS.

Answer

Allow all principals to GetObject when aws:SecureTransport is true

Answer

Deny requests only when the bucket name is not matched exactly in the request

Answer

Require that the requester uses SSE-KMS and reject requests without SSE-KMS configuration

Question 8

Based on the exhibit, which storage choice best matches the workload requirements?

Accepted Answer

Use instance store NVMe for the temporary processing workspace.. Instance store NVMe volumes provide temporary, high-performance block storage directly attached to the EC2 host. For a temporary processing workspace where data does not need to persist beyond the instance lifecycle, instance store offers the lowest latency and highest throughput, making it the best match for the workload requirements.

Answer

Use io2 EBS volumes because they provide the highest durable block storage performance.

Answer

Use Amazon EFS for the workspace so the temporary files survive instance replacement.

Answer

Use S3 as the working directory and read and write the intermediate files directly there.

Question 9

Based on the exhibit, your application runs entirely in private subnets and only needs to reach Amazon S3, Amazon DynamoDB, AWS Secrets Manager, and CloudWatch Logs. The monthly bill is dominated by NAT Gateway charges. Which change most directly reduces cost while preserving private connectivity to these AWS services?

Accepted Answer

Create S3 and DynamoDB gateway endpoints, create interface endpoints for Secrets Manager and CloudWatch Logs, update route tables, and remove the NAT Gateway.. Option D is correct because it replaces the costly NAT Gateway with free VPC Gateway Endpoints for S3 and DynamoDB, and uses AWS PrivateLink interface endpoints for Secrets Manager and CloudWatch Logs. This eliminates all internet-bound data transfer costs while keeping traffic entirely within the AWS network, directly addressing the cost concern without sacrificing private connectivity.

Answer

Replace the NAT Gateway with an Internet Gateway and keep the current private subnet routes unchanged.

Answer

Add a second NAT Gateway in another Availability Zone to reduce cross-AZ data transfer charges.

Answer

Create only interface endpoints for all four services and keep the NAT Gateway for fallback.

Question 10

Multiple teams share one AWS Organization. Finance wants chargeback by project, alerts before overspend, and monthly views by account without manually opening each account. Which three actions best fit? Select three.

Accepted Answer

Enforce cost allocation tags on resources and activate them for billing reports.. Option A is correct because cost allocation tags, when activated for billing reports, allow you to tag resources with project-specific metadata (e.g., 'Project:Alpha'). AWS then includes these tags in the Cost and Usage Reports (CUR) and Cost Explorer, enabling Finance to filter and allocate costs by project without manual account inspection. This directly supports chargeback by project and monthly views by account and tag.

Answer

Put every team in a separate AWS account and ignore tagging.

Answer

Use CloudTrail trails to estimate spend by resource because it records API calls.

Question 11

You run a web application on an EC2 Auto Scaling group behind an Application Load Balancer (ALB). During scheduled traffic spikes, new instances launch but customers occasionally see 5xx errors for the first few minutes after scale-out. Operational logs show instances need ~4 minutes to warm up (load caches and initialize dependencies). ALB target health becomes healthy only after this warm-up. Which change most directly improves performance during spikes by reducing the time to serve traffic after scaling?

Accepted Answer

Use an Auto Scaling warm pool so instances are pre-initialized and ready to register quickly when the ASG scales out.. B is correct because a warm pool pre-initializes instances (e.g., loading caches and dependencies) before they are added to the Auto Scaling group. When the ASG scales out, these pre-warmed instances can be quickly moved into service, bypassing the ~4-minute warm-up delay and reducing the window for 5xx errors.

Answer

Configure a larger ALB deregistration delay so that old targets remain longer before termination.

Answer

Increase the number of desired instances immediately without using scaling policies, and then rely on manual reconfiguration.

Answer

Switch from ALB to NLB so instances become reachable sooner without waiting for health checks.

Question 12

Company A stores encrypted log files in its S3 bucket using SSE-KMS with a customer-managed KMS key. A partner application in Company B uploads objects into Company A's bucket using an IAM role in Company B. Uploads fail with an error indicating KMS access is denied (kms:Encrypt not authorized). Neither the partner IAM policy nor the S3 bucket policy currently mentions KMS.

What is the most secure and correct change to allow cross-account uploads to succeed?

Accepted Answer

In Company A's KMS key policy, allow Company B's partner role principal to use the key for kms:Encrypt, kms:GenerateDataKey, and kms:DescribeKey, and also add a matching IAM policy in Company B that grants the partner role those same KMS actions on Company A's key ARN, constrained to the target S3 bucket context when possible.. Option A is correct because cross-account SSE-KMS uploads require both the KMS key policy in Company A to explicitly grant the partner role principal the necessary KMS actions (kms:Encrypt, kms:GenerateDataKey, kms:DescribeKey) and an IAM policy in Company B that allows the partner role to call those actions on Company A's key ARN. The bucket policy alone cannot authorize KMS operations; KMS key policies act as the primary access control for customer-managed keys, and without the key policy grant, the partner role's IAM permissions are insufficient. Constraining the IAM policy to the target S3 bucket context (using kms:ViaService or kms:EncryptionContext conditions) adds a security best practice by limiting the key's use to only that specific S3 bucket.

Answer

In Company B's IAM policy, allow kms:Encrypt on Company A's KMS key ARN, without changing Company A's key policy.

Answer

Create a new KMS key in Company B and configure Company A's S3 bucket to use that key for SSE-KMS.

Answer

Disable key policy restrictions by setting the KMS key to enabled and removing all policy statements so that encryption automatically works for any principal.

Question 13

You serve private reports stored in an S3 bucket through CloudFront. After a recent change, users report that they can access the S3 object URLs directly (bypassing CloudFront), which violates your design. You want to ensure S3 objects are readable only through CloudFront using Origin Access Control (OAC), even if someone guesses the S3 URL. Which update best enforces this at the S3 bucket level?

Accepted Answer

Add a bucket policy Allow for s3:GetObject only when the principal is cloudfront.amazonaws.com and aws:SourceArn matches your CloudFront distribution ARN, while blocking public access.. Option A is correct because it uses an S3 bucket policy that grants s3:GetObject access only when the principal is cloudfront.amazonaws.com and the aws:SourceArn matches the CloudFront distribution ARN. This ensures that only CloudFront, using Origin Access Control (OAC), can retrieve objects, blocking direct S3 URL access even if the URL is guessed. Blocking public access at the bucket level further prevents any anonymous or public reads.

Answer

Enable an S3 bucket lifecycle policy to transition objects to Glacier, so public S3 URLs become inaccessible.

Answer

Rely only on CloudFront signed URLs validation; do not change the S3 bucket policy.

Answer

Add a WAF rule on CloudFront to block requests that contain "amazonaws.com" in the URL path.

Question 14

Your team hosts a private web app on an S3 bucket and serves it through CloudFront using a modern Origin Access Control (OAC). After deployment, users receive HTTP 403 from CloudFront with the S3 origin error "AccessDenied".

Which S3 bucket policy change best aligns with CloudFront OAC so the distribution can fetch objects privately?

Accepted Answer

Allow the CloudFront service principal cloudfront.amazonaws.com to perform s3:GetObject, and scope access with a condition on AWS:SourceArn matching your CloudFront distribution ARN.. Option A is correct because CloudFront Origin Access Control (OAC) requires an explicit S3 bucket policy that allows the CloudFront service principal (`cloudfront.amazonaws.com`) to perform `s3:GetObject`, and the recommended best practice is to scope the permission using a condition on `AWS:SourceArn` matching the specific CloudFront distribution ARN. This ensures that only requests originating from that distribution can access the bucket objects, preventing unauthorized access from other sources.

Answer

Allow only the S3 bucket owner account to perform s3:GetObject without any condition, so CloudFront can inherit access automatically.

Answer

Add a policy statement that denies s3:GetObject when the request does not include the header CloudFront-Viewer-Country.

Answer

Grant s3:GetObject permission to an Origin Access Identity (OAI) canonical user ID even though you are using Origin Access Control (OAC).

Question 15

Developers for a customer analytics portal need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. Option C is correct because AWS IAM Identity Center (formerly AWS SSO) allows you to define permission sets that grant temporary, time-bound elevated access to production resources. Combined with AWS CloudTrail, every access attempt is logged for audit, meeting the security team's requirements for approvals, expiry, and audit logging. This approach follows the principle of least privilege and ensures that elevated permissions are not permanent.

Answer

Disable CloudTrail during troubleshooting

Answer

Attach AdministratorAccess permanently to every developer role

Answer

Create shared administrator access keys for the team

SAA-C03 Practice Test 23 — 15 Questions

Exhibit

SAA-C03 Practice Test 23 — 15 Questions

Exhibit