SAA-C03 Practice Test 24 — 15 Questions

Question 1

Your team runs a tightly coupled distributed workload (for example, synchronous training nodes) across many EC2 instances placed within a single cluster environment. The instances need low-latency networking to reduce delays at synchronization barriers. Which EC2 placement strategy should you use to improve inter-node latency?

Accepted Answer

Create a placement group with the 'cluster' strategy to place instances close together and reduce network latency.. A cluster placement group is the correct choice because it groups instances in a single Availability Zone with low-latency, high-bandwidth networking, ideal for tightly coupled workloads like synchronous training nodes that require minimal delay at synchronization barriers. This strategy places instances physically close together within the same rack or cluster, reducing network round-trip time and maximizing throughput for inter-node communication.

Answer

Create a placement group with the 'spread' strategy to separate instances across underlying hardware for fault tolerance.

Answer

Use the default placement strategy and rely on Auto Scaling to keep instances from drifting to different locations.

Answer

Avoid placement groups and instead use Amazon S3 for inter-node messaging to minimize direct network traffic between instances.

Question 2

Based on the exhibit, why is the IAM role still receiving AccessDenied even though it has AdministratorAccess attached?

Accepted Answer

The SCP is acting as a maximum permission guardrail, so its explicit deny overrides the IAM allow.. B is correct because Service Control Policies (SCPs) act as a maximum permission guardrail in AWS Organizations. Even if an IAM role has the AdministratorAccess policy attached, an SCP with an explicit deny on the ec2:CreateSnapshot action will override that allow, resulting in an AccessDenied error. SCPs are evaluated after IAM policies, and an explicit deny in an SCP cannot be overridden by any IAM allow.

Answer

AdministratorAccess is always evaluated before SCPs, so the SCP is ignored in production accounts.

Answer

The role needs a session duration of at least 12 hours before SCPs stop applying.

Answer

The account needs an AWS Config rule to approve the snapshot action before IAM can work.

Question 3

You use a customer managed AWS KMS key (CMK) to encrypt objects in an S3 bucket using SSE-KMS. A specific IAM role must be able to decrypt objects. Where should you grant kms:Decrypt permissions so that the role can decrypt data encrypted with that CMK?

Accepted Answer

In the KMS key policy, allowing kms:Decrypt (and any other required KMS permissions) for the role’s principal ARN.. When using a customer managed KMS key (CMK) with SSE-KMS, the KMS key policy is the primary access control mechanism. To allow a specific IAM role to decrypt objects, you must grant kms:Decrypt (and typically kms:DescribeKey) in the key policy for that role's principal ARN. Without this explicit permission in the key policy, the role will be denied decryption even if it has s3:GetObject permissions, because KMS enforces its own authorization.

Answer

Only in the S3 bucket policy by granting s3:GetObject, because S3 bucket policy controls decryption.

Answer

Only in the IAM role identity policy; the KMS key policy does not need changes for SSE-KMS.

Answer

By enabling S3 default encryption; KMS permissions are automatically granted to all IAM roles in the account.

Question 4

Your order-processing system uses EventBridge rules to send events to a Lambda function that updates order status. Over the last week, some events fail with a transient database timeout, and the Lambda retries intermittently but then the events are lost (no alerts after failures). You want at-least-once processing, bounded retries, and a way to inspect unprocessable events for later reprocessing.

Which architecture change best meets these requirements?

Accepted Answer

Send EventBridge events to an SQS queue, configure a redrive policy to move messages to a dead-letter queue (DLQ) after a defined receive count, and make the Lambda processing idempotent.. Option A is correct because it introduces an SQS queue between EventBridge and Lambda, which provides a durable buffer for events. The redrive policy moves events to a dead-letter queue (DLQ) after a defined number of failed processing attempts, ensuring bounded retries and preserving unprocessable events for later inspection and reprocessing. Making the Lambda idempotent guarantees at-least-once processing even if duplicate events occur.

Answer

Invoke Lambda directly from EventBridge in asynchronous mode, and increase the Lambda timeout to reduce failures.

Answer

Use SNS topics with Lambda subscriptions, but remove all retry and DLQ configuration to minimize duplicate events.

Answer

Store failed events only in CloudWatch logs, and have operators manually copy log entries back into the database for reprocessing.

Question 5

Your company hosts an internal API in two AWS Regions. You want Amazon Route 53 to automatically send traffic to the secondary Region if the primary Region’s endpoint becomes unhealthy. Which Route 53 configuration best meets this requirement?

Accepted Answer

Failover routing with a primary record associated with a health check, and a secondary (failover) record associated with its own health check settings.. Failover routing in Route 53 is specifically designed for active-passive configurations where traffic is directed to a primary resource unless a health check indicates it is unhealthy, at which point traffic is automatically routed to the secondary (failover) record. By associating a health check with the primary record, Route 53 can monitor the endpoint's health and perform the failover seamlessly. This directly meets the requirement to send traffic to the secondary Region when the primary endpoint becomes unhealthy.

Answer

Latency-based routing with health checks for both Regions.

Answer

Weighted routing to distribute traffic evenly across both Regions.

Answer

Geolocation routing based on the client’s country to choose a Region.

Question 6

Your web application is deployed in two AWS Regions (Region A and Region B). You want Route 53 to automatically fail over DNS traffic from Region A to Region B when Region A is unhealthy.

The failover decision must be based on health checks that verify whether the application in Region A is reachable.

Which Route 53 routing configuration best meets these requirements?

Accepted Answer

Failover routing using a primary record with an associated health check for Region A and a secondary record for Region B.. Option C is correct because Route 53 failover routing allows you to create a primary record with an associated health check for Region A and a secondary record for Region B. When the health check for Region A fails, Route 53 automatically returns the secondary record's IP address, directing traffic to Region B. This directly meets the requirement for automatic failover based on application reachability.

Answer

Latency-based routing with regional aliases to split traffic based on measured latency.

Answer

Geolocation routing using country-based routing policies.

Answer

Weighted routing with weights set to 100 for Region A and 0 for Region B.

Question 7

Your public API is hosted in two regions. You want Route 53 to automatically send traffic to the secondary region when the primary region’s endpoint fails. The primary API health check is returning failure codes, but clients still reach the primary region for several minutes. Which Route 53 configuration most directly addresses this behavior?

Accepted Answer

Use Route 53 failover routing with a primary record and a secondary record, each associated with its own health check, so Route 53 answers with the healthy region.. Option B is correct because Route 53 failover routing with health checks on both primary and secondary records ensures that when the primary health check fails, Route 53 stops returning the primary record's IP and instead returns the secondary record's IP. This directly addresses the observed behavior where clients still reach the primary region for several minutes—likely because the primary record's health check was not configured or associated, or a simple routing policy was used without health check integration, causing stale DNS responses to be served until TTL expires.

Answer

Use a single Alias A record with simple routing and a short TTL so Route 53 quickly changes the IP address.

Answer

Use weighted routing to send a small percentage of traffic to the secondary region, increasing it manually when the primary fails.

Answer

Use latency routing only, letting Route 53 choose the lowest-latency region at query time, without health checks.

Question 8

You have EC2 instances in private subnets with no NAT gateway. They must retrieve secrets from AWS Secrets Manager without sending traffic to the public internet. Which VPC endpoint type is the correct choice for connecting to AWS Secrets Manager?

Accepted Answer

Create an Interface VPC endpoint (AWS PrivateLink) for Secrets Manager and associate security groups for the endpoint.. AWS Secrets Manager is accessed via an API endpoint that uses HTTPS. Interface VPC endpoints (AWS PrivateLink) are the correct choice for connecting to services like Secrets Manager because they use elastic network interfaces (ENIs) with private IPs in your VPC, allowing traffic to stay within the AWS network. Gateway endpoints only support S3 and DynamoDB, not Secrets Manager.

Answer

Create a Gateway VPC endpoint for Secrets Manager.

Answer

Use a Transit Gateway attachment to route traffic to the public internet for Secrets Manager.

Answer

Deploy a NAT gateway and allow outbound HTTPS traffic to Secrets Manager.

Question 9

Your team hosts versioned static assets (for example, /static/app-<buildHash>.js). Each build hash never changes, but you release new files on new URLs. To maximize cache hit rate and reduce origin load using CloudFront, what should you do when generating HTTP responses for these assets?

Accepted Answer

Set Cache-Control: public, max-age=31536000, immutable for the versioned assets. Option B is correct because setting `Cache-Control: public, max-age=31536000, immutable` tells CloudFront and browsers to cache the versioned asset for one year (31536000 seconds) and never revalidate, since the URL changes with each new build. The `immutable` directive (RFC 8246) signals that the content will never change on that URL, eliminating conditional revalidation requests and maximizing cache hits, which reduces origin load.

Answer

Set Cache-Control: no-cache so CloudFront always revalidates with the origin

Answer

Set Cache-Control: max-age=0 and rely on CloudFront to cache by default

Answer

Disable CloudFront caching and forward all headers and query strings to the origin

Question 10

Your company uses an OIDC identity provider to let users assume an IAM role without long-term AWS credentials. In the IAM role trust policy, which STS action must be allowed to support this type of federation?

Accepted Answer

sts:AssumeRoleWithWebIdentity. Option A is correct because sts:AssumeRoleWithWebIdentity is the STS API action specifically designed for federated users authenticated by an OIDC or SAML identity provider. This action returns temporary security credentials without requiring long-term AWS access keys, enabling the OIDC-based federation described in the question.

Answer

sts:AssumeRole

Answer

sts:GetCallerIdentity

Answer

sts:TagSession

Question 11

Security responders suspect exfiltration from an Amazon S3 bucket that stores sensitive reports encrypted with a customer managed KMS key. They need to identify which IAM principal downloaded each object and whether any principals called KMS Decrypt on the key during the same time window. Which two detective controls should be enabled? Select two.

Accepted Answer

Enable CloudTrail data events for the S3 bucket.. Option A is correct because enabling CloudTrail data events for the S3 bucket captures detailed logs of object-level operations, including GetObject (download) requests. This allows you to identify which IAM principal downloaded each object, including the source IP, user agent, and request time. Without data events, CloudTrail only logs management-level actions (e.g., bucket creation) and misses object-level access.

Answer

Enable S3 Object Lock in compliance mode.

Answer

Turn on default bucket encryption with SSE-KMS.

Answer

Enable MFA Delete on the bucket.

Question 12

Your ecommerce app runs behind an Application Load Balancer (ALB) and uses an RDS database for orders. During an AZ impairment in us-east-1, customers report that checkout takes several minutes to recover. The current design places EC2 instances only in private subnets of AZ-a, while the ALB spans multiple subnets. The RDS DB instance is Multi-AZ. Management wants automatic recovery within the same Region.

Which change best addresses the issue with minimal operational overhead?

Accepted Answer

Move the EC2 instances into Auto Scaling Groups that span private subnets in at least two AZs, keeping the ALB spanning those subnets.. The current design places EC2 instances only in AZ-a, so when that AZ becomes impaired, all compute capacity is lost, causing checkout to fail until the impairment ends or manual intervention occurs. By moving EC2 instances into Auto Scaling Groups spanning at least two AZs, the application gains automatic recovery within the same Region because the ALB can route traffic to healthy instances in the remaining AZs. This change minimizes operational overhead because Auto Scaling automatically replaces failed instances and maintains desired capacity across AZs, while the ALB’s health checks ensure traffic is only sent to healthy targets.

Answer

Switch from RDS Single-AZ to RDS Multi-AZ, keeping the EC2 instances in only AZ-a because failover will still reach them.

Answer

Terminate the ALB and use a Network Load Balancer (NLB) in front of the existing single-AZ EC2 instances.

Answer

Add more EC2 instances in AZ-a and increase the ALB health check thresholds to avoid unnecessary replacements during impairments.

Question 13

Your company has an internal service hosted behind a Network Load Balancer (NLB) in VPC 10.0.0.0/16. A consumer team in a different VPC (10.1.0.0/16) must call the service without using the public internet. You want private connectivity using AWS PrivateLink. Which configuration best enables least-privilege access while keeping the traffic private?

Accepted Answer

Create a VPC endpoint (interface endpoint) in the consumer VPC that points to the service name published by the provider account, and limit allowed clients using the endpoint’s security group rules.. Option B is correct because AWS PrivateLink uses an interface VPC endpoint in the consumer VPC to connect privately to a Network Load Balancer (NLB) in the provider VPC, without traversing the public internet. The endpoint’s security group acts as a least-privilege firewall, allowing only specific clients (by source IP or security group) to access the service. This keeps traffic within the AWS network and avoids exposing the NLB to the internet.

Answer

Expose the NLB with an Internet Gateway route and restrict access using a security group attached to the NLB.

Answer

Create an S3 Gateway endpoint in the consumer VPC and store the service hostname in SSM Parameter Store so clients can resolve privately.

Answer

Use a bastion host in the provider VPC and allow the consumer VPC to SSH to it; from there, the consumer makes HTTP calls to the NLB.

Question 14

Your company allows application teams to create IAM roles. Each team must be prevented from granting permissions beyond a defined per-role baseline, even if they attach overly permissive identity-based policies to the role. Which AWS feature best enforces this ceiling at the IAM role level?

Accepted Answer

Attach a permission boundary to every role that teams create so the boundary limits the role’s maximum effective permissions. Permission boundaries are an AWS IAM feature that sets the maximum permissions that an identity-based policy can grant to an IAM role. When a permission boundary is attached to a role, the effective permissions are the intersection of the boundary and the role's identity-based policy, ensuring that even if a team attaches an overly permissive policy, the role cannot exceed the boundary's defined limits. This directly enforces a per-role ceiling on permissions, making option B the correct choice.

Answer

Use an Organizations service control policy (SCP) to cap the maximum permissions for role creation in each account

Answer

Rely on KMS key policies to restrict permissions because IAM policies cannot override KMS restrictions

Answer

Require multi-factor authentication (MFA) for all role creation requests and deny any request without MFA

Question 15

A Lambda-based travel booking site has unpredictable traffic spikes and users see latency caused by cold starts. The function must respond consistently during expected campaign windows. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Provisioned concurrency during campaign windows. Provisioned concurrency initializes a specified number of execution environments in advance, eliminating cold starts for those instances. During campaign windows, this ensures consistent latency by keeping the function warm and ready to handle spikes without the delay of initializing new environments. It is a managed AWS-native control that directly addresses the unpredictable traffic pattern described.

Answer

A larger deployment package

Answer

CloudTrail data events

Answer

Reserved concurrency only