SAA-C03 Practice Test 25 — 15 Questions

Question 1

A production team accidentally deletes critical rows in an Amazon RDS for PostgreSQL database. The deletion occurred about 6 hours ago. The team wants to recover to a specific point in time with minimal disruption.

Assuming automated backups are enabled, which approach provides the best resilience outcome?

Accepted Answer

Use point-in-time recovery (PITR) to restore a new DB instance to a timestamp shortly before the deletion, then switch application traffic to the restored instance.. Point-in-time recovery (PITR) allows you to restore a new DB instance to any second within the automated backup retention period, which includes transaction logs. By restoring to a timestamp just before the deletion, you recover the lost rows without affecting the current production instance, then switch traffic to the new instance for minimal disruption.

Answer

Restore the current DB instance in place by overwriting it with only the latest automated backup.

Answer

Create a manual snapshot and restore from it only if the snapshot date exactly matches today.

Answer

Perform a database-level rollback using transaction logs from the application server without using RDS restore features.

Question 2

A company stores private customer documents in an S3 bucket. They want only CloudFront to be able to read objects from the bucket (no direct S3 URL access), even if the bucket name and object key are known. Which configuration best meets this requirement?

Accepted Answer

Use CloudFront Origin Access Control (OAC) and update the bucket policy to allow s3:GetObject only when the principal is cloudfront.amazonaws.com and aws:SourceArn equals the CloudFront distribution ARN.. CloudFront Origin Access Control (OAC) allows you to restrict S3 bucket access exclusively to CloudFront. By configuring the bucket policy to allow s3:GetObject only when the principal is cloudfront.amazonaws.com and the aws:SourceArn matches the CloudFront distribution ARN, you ensure that direct S3 URL requests are denied, even if the bucket name and object key are known. This prevents any unauthorized direct access to the S3 bucket.

Answer

Attach an AWS WAF Web ACL to CloudFront and allow public reads on the S3 bucket so WAF can block direct object access.

Answer

Create IAM users with s3:GetObject permissions and share the IAM credentials with customers so they can fetch objects directly from S3.

Answer

Enable S3 static website hosting on the bucket and use the S3 website endpoint as the CloudFront origin so access controls can be enforced at CloudFront.

Question 3

In an AWS Organizations environment, developers create IAM roles using an automation tool. The security team wants to guarantee that even if a developer attaches an overly permissive inline policy, the role cannot exceed a fixed set of allowed actions. The team already uses permission boundaries on each role. The tool’s role-creation API call succeeds, but one developer’s new role can still delete production S3 buckets. What is the most likely reason, and what should be corrected?

Accepted Answer

The boundary policy was not actually attached during role creation, or the automation tool attached the wrong boundary ARN; correct the role-creation request to set the intended PermissionBoundary.. Permission boundaries must be explicitly attached to an IAM role during creation via the `PermissionBoundary` parameter. If the automation tool fails to attach the intended boundary policy or attaches the wrong ARN, the role will have no effective boundary, allowing any inline policy to grant full access. The developer's role could then delete production S3 buckets because the boundary was not enforced.

Answer

Permission boundaries do not affect permissions for resources created with role chaining; enable role chaining instead to apply the boundary.

Answer

KMS key policies override permission boundaries for S3, so deletion permission comes from the KMS policy; restrict the KMS key policy instead.

Answer

Permission boundaries apply only to managed policies, not to inline policies; move the overly permissive permissions to a managed policy type to keep it bounded.

Question 4

A security team needs an audit trail to investigate suspicious API activity across multiple AWS accounts. Which AWS approach best provides centralized visibility into who did what, when, for service API calls?

Accepted Answer

Create an AWS CloudTrail organization trail that delivers logs to a centralized, access-controlled S3 bucket.. AWS CloudTrail organization trail is the correct approach because it captures all management and data events across multiple AWS accounts within an AWS Organizations structure, delivering them to a single, centralized S3 bucket. This provides a unified, immutable audit trail of who performed which API call, when, and from which source IP, enabling the security team to investigate suspicious activity with full visibility. The centralized bucket can be access-controlled with S3 bucket policies and IAM to ensure only authorized personnel can view the logs.

Answer

Enable AWS Config only for EC2 security groups and rely on it for API call auditing.

Answer

Turn on S3 server access logging for every bucket and assume it covers all AWS services.

Answer

Use only Amazon CloudWatch alarms with no logging destination to reduce storage costs.

Question 5

A production Amazon RDS database already has automated backups enabled. At 10:45 UTC, the team discovers that a faulty migration corrupted rows in a table at 10:30 UTC. The business wants the database restored to exactly the state it had at 10:30 UTC with minimal risk. Which two actions should the team take? Select two.

Accepted Answer

Restore the database to a new instance using point-in-time restore for 10:30 UTC.. Amazon RDS Point-in-Time Restore (PITR) allows you to restore a DB instance to any second within the backup retention period, including 10:30 UTC. This uses automated backups and transaction logs to reconstruct the exact database state at that specific time, providing a precise recovery point with minimal data loss.

Answer

Restore the most recent manual snapshot because it will include the 10:30 UTC state.

Answer

Overwrite the existing database instance in place so the application keeps the same storage volume.

Answer

Wait for automated backups to complete again, then replay the migration to restore the missing rows.

Question 6

Your mobile app writes events to a single DynamoDB table with partition key = customerId and sort key = eventTime. During a promotional campaign, one tenant ("ACME") generates far more traffic than others. CloudWatch shows sustained throttling (ProvisionedThroughputExceeded) and elevated p99 latency only for that tenant. The workload pattern cannot be changed to a completely different schema, but you can change how items are partitioned. Which design change is most likely to reduce the hot-partition throttling while keeping efficient reads for ACME?

Accepted Answer

Change the partition key to a salted key such as customerId + shard number, and include the eventTime ordering using the sort key.. Salting the partition key by appending a shard number (e.g., customerId + random digit) distributes ACME's writes across multiple partitions, eliminating the hot partition. The sort key still preserves eventTime ordering, so queries for a specific customer can be parallelized across shards and merged client-side or via a composite sort key pattern, maintaining efficient reads.

Answer

Use the same partition key (customerId), but increase the table’s provisioned capacity for that tenant.

Answer

Switch to on-demand capacity mode and keep the partition key unchanged.

Answer

Enable Global Tables so that reads are served from a nearby replica for ACME.

Question 7

A DynamoDB table for a retail API has a partition key based only on the current date. Write throttling occurs during business hours. What is the best design change?

Accepted Answer

Use a higher-cardinality partition key that distributes writes across partitions. Using a partition key based solely on the current date creates a 'hot partition' because all writes for that day target the same partition, leading to throttling. A higher-cardinality partition key (e.g., combining date with a unique attribute like user ID or order ID) distributes write traffic evenly across multiple partitions, allowing DynamoDB to utilize its full throughput capacity and eliminating throttling.

Answer

Create a global secondary index with the same date key

Answer

Reduce the table's write capacity

Answer

Move the table to S3 Glacier Instant Retrieval

Question 8

An application uses an Amazon Aurora cluster. The workload becomes read-heavy, but the team cannot change the database schema. They need higher read throughput while keeping writes on the primary. What should they do?

Accepted Answer

Create Aurora read replicas and use the reader endpoint for read traffic. Aurora read replicas are designed to offload read traffic from the primary instance, and the reader endpoint automatically load-balances connections across all replicas. Since the workload is read-heavy and the schema cannot change, adding read replicas directly increases read throughput without modifying the application's database schema. The reader endpoint ensures that read queries are directed to the replicas while writes continue to hit the primary instance.

Answer

Switch the cluster to a single-AZ Aurora configuration to reduce coordination overhead

Answer

Increase DynamoDB capacity units instead of modifying the database layer

Answer

Enable CloudFront caching for database queries to serve results from edge locations

Question 9

Your team runs a batch processing workload on EC2 that can tolerate interruptions. If an instance is terminated, the job can restart from checkpoints. To reduce compute costs, what is the most cost-optimized approach?

Accepted Answer

Use EC2 Spot Instances for the batch workers. Spot Instances are ideal for fault-tolerant, interruption-tolerant batch workloads because they offer significant cost savings (up to 90% compared to On-Demand) while allowing the job to resume from checkpoints if terminated. This aligns perfectly with the requirement to reduce compute costs without compromising the ability to restart interrupted jobs.

Answer

Use Dedicated Hosts to ensure capacity for the cheapest instance

Answer

Use On-Demand instances and schedule extra runs to offset interruptions

Answer

Use Reserved Instances only, because they eliminate instance termination events

Question 10

A company runs a REST API on AWS Lambda behind Amazon API Gateway. The API is used by internal clients during a two-hour batch window each night and is completely idle the rest of the day. The team is concerned about the cost of API Gateway and wants to minimize it without changing the API contract for clients. Which change should a solutions architect recommend?

Accepted Answer

Use an HTTP API instead of the REST API so requests are billed at the lower HTTP API rate.. The workload is bursty and idle most of the day, so a per-request pricing model is the right foundation and provisioned or always-on resources should be avoided. Moving from a REST API to an HTTP API lowers the per-request charge while keeping the same client-facing contract, so the nightly batch pays less and the idle hours cost nothing. Caching and provisioned concurrency would both add continuous charges.

Answer

Replace API Gateway and Lambda with an Application Load Balancer forwarding to an Auto Scaling group of EC2 instances.

Answer

Keep the REST API but enable API caching with a one-hour time-to-live.

Answer

Switch the API from a REST API to an HTTP API and configure the Lambda function with provisioned concurrency.

Question 11

An API team runs an AWS Lambda function behind an Application Load Balancer (ALB). During predictable hourly traffic spikes, p95 response latency increases due to occasional cold starts. The team wants stable latency during those spikes without permanently overprovisioning resources for all functions. Which configuration is the most appropriate way to reduce cold starts for this Lambda function?

Accepted Answer

Publish a version of the function and configure provisioned concurrency on an alias, using autoscaling for the alias.. Provisioned concurrency initializes a specified number of execution environments in advance, keeping them warm and ready to handle requests without cold start latency. By configuring provisioned concurrency on an alias with autoscaling, the team can dynamically adjust the number of pre-warmed environments to match predictable traffic spikes, avoiding permanent overprovisioning while ensuring stable p95 latency.

Answer

Increase the function memory size and rely on faster initialization to reduce cold starts.

Answer

Set reserved concurrency equal to the expected peak requests per second for the function.

Answer

Use an event source mapping with a higher batch size so Lambda triggers earlier and keeps the runtime warm.

Question 12

Based on the exhibit, what should the architect recommend to reduce inter-node latency for this workload?

Accepted Answer

Launch the instances in a cluster placement group within the same Availability Zone.. A cluster placement group provides the lowest possible latency and highest packet-per-second performance by ensuring instances are placed in close physical proximity within a single Availability Zone. This is ideal for tightly coupled, high-performance computing workloads that require low inter-node latency.

Answer

Use a spread placement group so each instance is placed on separate hardware.

Answer

Move the instances into different Availability Zones to improve fault tolerance.

Answer

Use a partition placement group to balance traffic across partitions.

Question 13

A production application uses an Amazon RDS Multi-AZ DB instance. During an unplanned failover, the database endpoint remains the same. What change should the application team make to handle the failover reliably?

Accepted Answer

Keep using the same RDS endpoint and implement connection retry logic on failures.. The RDS Multi-AZ DNS endpoint remains unchanged during a failover, automatically pointing to the new writer instance. Implementing connection retry logic with exponential backoff allows the application to handle the brief DNS propagation delay and connection interruption, ensuring reliable recovery without manual intervention.

Answer

Hard-code the new writer instance IP address after failover completes.

Answer

Disable Multi-AZ and rely on manual intervention to switch endpoints.

Answer

Move reads to application-side caching only, and avoid reopening DB connections.

Question 14

A company runs an internet-facing API in two AWS Regions. Route 53 currently uses simple routing to a primary Application Load Balancer (ALB) DNS name. When the primary Region experiences an outage, customers wait a long time because the DNS entry is not changed automatically.

The team wants automatic failover: if the primary Region ALB health check fails for a sustained period, Route 53 should route users to the secondary Region ALB.

Which Route 53 approach best meets this requirement?

Accepted Answer

Use Route 53 failover routing with a PRIMARY and SECONDARY record set for the same name, and attach health checks to the ALBs.. Route 53 failover routing is designed specifically for active-passive failover scenarios. By creating PRIMARY and SECONDARY record sets with the same DNS name and attaching health checks to the ALBs, Route 53 will automatically route traffic to the secondary ALB when the primary ALB health check fails for a sustained period. This meets the requirement for automatic failover without manual intervention.

Answer

Use latency-based routing so Route 53 automatically spreads traffic to both Regions based on measured latency.

Answer

Use weighted routing and configure the secondary ALB to receive 100% traffic when the primary returns HTTP 5xx responses.

Answer

Use geolocation routing and restrict the primary Region record to specific countries only.

Question 15

Based on the exhibit, the web tier becomes unavailable if us-west-2a has an outage. What is the best change to improve resilience with the least redesign?

Accepted Answer

Attach the Application Load Balancer and Auto Scaling group to subnets in a second Availability Zone.. The web tier is currently deployed in a single Availability Zone (us-west-2a), so an outage of that AZ makes the entire tier unavailable. By attaching the Application Load Balancer and Auto Scaling group to subnets in a second Availability Zone, the application can continue serving traffic from the healthy AZ, achieving high availability with minimal architectural changes. This is the standard AWS best practice for multi-AZ resilience.

Answer

Increase the Auto Scaling group desired capacity from 2 to 3 in the same subnet.

Answer

Replace the Application Load Balancer with a Network Load Balancer.

Answer

Increase the health check grace period so instances stay registered longer.