SAA-C03 Practice Test 2 — 25 Questions

Question 1

A solutions architect is designing an S3 bucket for a order processing API. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or ACLs. By enabling this setting at the account or bucket level, the architect ensures that even if a developer later adds an overly broad bucket policy, the objects remain inaccessible to anonymous users. This is the only option that guarantees no public access can be inadvertently granted.

Answer

Enable server access logging on the bucket

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable S3 Transfer Acceleration

Question 2

Developers for a B2B file exchange site need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center (formerly AWS SSO) enables time-bound permission sets that grant temporary elevated access with automatic expiry, satisfying the security team's requirements for approvals and audit logging via AWS CloudTrail. This approach follows the principle of least privilege by providing just-in-time access rather than permanent permissions, and all actions are recorded in CloudTrail for compliance.

Answer

Attach AdministratorAccess permanently to every developer role

Answer

Create shared administrator access keys for the team

Answer

Disable CloudTrail during troubleshooting

Question 3

A microservice runs in private subnets with no NAT gateway. It must retrieve a secret from AWS Secrets Manager. Security requires that traffic to Secrets Manager stays within AWS’s private network (no public internet egress). The IAM role already grants secretsmanager:GetSecretValue for the needed secret. What is the best network setup to meet the requirement?

Accepted Answer

Create an Interface VPC Endpoint for Secrets Manager (com.amazonaws.<region>.secretsmanager) and allow it via the endpoint security group; optionally enable private DNS.. An Interface VPC Endpoint (AWS PrivateLink) for Secrets Manager allows the microservice to access the secret privately without traversing the public internet. Since the subnet has no NAT Gateway and no public IP, this is the only way to keep traffic within the AWS network. Enabling private DNS ensures the standard Secrets Manager endpoint resolves to the private IP of the endpoint, eliminating the need for route table changes.

Answer

Create an S3 Gateway VPC endpoint and use it for Secrets Manager requests because both services use HTTPS.

Answer

Assign a public IP address to the tasks so they can call Secrets Manager over the internet without NAT.

Answer

Change the route table to send all 0.0.0.0/0 traffic directly to an Internet Gateway.

Question 4

A worker service consumes messages from an Amazon SQS queue. Some messages are malformed and always fail validation. The worker retries, but it keeps reprocessing the same bad messages and consumes processing capacity that should be used for valid work. What is the best solution to prevent “poison messages” from blocking progress?

Accepted Answer

Configure a Dead-Letter Queue (DLQ) and set a redrive policy so messages move to the DLQ after a maximum number of receives.. A Dead-Letter Queue (DLQ) with a redrive policy is the standard AWS mechanism for handling poison messages. By setting a maximum receive count (e.g., 5), the SQS queue automatically moves messages that fail processing repeatedly to the DLQ, isolating them from the main queue. This prevents the worker from wasting capacity on invalid messages and allows the main queue to continue processing valid work without interruption.

Answer

Increase the visibility timeout so the worker gets fewer retries per hour.

Answer

Disable SQS retries by deleting messages immediately on any processing error.

Answer

Create a second worker that polls the queue less frequently until the malformed message is processed successfully.

Question 5

A SaaS company uses an S3 bucket for database backups created daily. Backups are rarely restored; the company’s documented RTO is 24 hours, and the compliance policy requires backups be kept for 90 days. The team currently stores all backups in S3 Standard, which is costly.

Which single lifecycle policy change is most cost-optimized while still meeting the 24-hour RTO and 90-day retention?

Accepted Answer

Add a lifecycle rule to transition backups older than 1 day to S3 Glacier Flexible Retrieval, and keep them until day 90.. S3 Glacier Flexible Retrieval provides retrieval times from minutes to hours, which meets the 24-hour RTO, and offers significant cost savings over S3 Standard for data that is rarely accessed. Transitioning backups older than 1 day to this storage class reduces costs while retaining them for the required 90-day compliance period.

Answer

Add a lifecycle rule to transition backups older than 1 day to S3 Glacier Instant Retrieval, and keep them until day 90.

Answer

Add a lifecycle rule to transition backups older than 1 day to S3 Glacier Deep Archive, and keep them until day 90 with no restore configuration.

Answer

Add a lifecycle rule to transition backups older than 1 day to S3 One Zone-IA, and delete them after 7 days.

Question 6

An events service publishes critical notifications using Amazon SNS. Three independent downstream systems (A, B, and C) subscribe to the topic. Downstream system B sometimes fails to process certain messages (for example, it times out or returns an error while handling the message), and you want: 1) failures in B to be isolated so A and C keep processing unaffected, and 2) messages that B cannot successfully process after retries to be sent to a DLQ for B. Which design best meets these requirements?

Accepted Answer

For each downstream system, create its own SQS queue, subscribe each SQS queue to the SNS topic, and configure a redrive policy with a DLQ for each SQS queue.. It creates a dedicated SQS queue for each downstream system, which isolates failures: if system B fails, its SQS queue will accumulate messages while systems A and C continue processing from their own queues. Each SQS queue can have a redrive policy that moves messages to a per-queue DLQ after the configured maximum retries are exhausted, satisfying the requirement for a B-specific DLQ without affecting the other subscribers.

Answer

Subscribe each downstream directly with HTTPS endpoints and configure a single SNS dead-letter queue (DLQ) for the topic.

Answer

Use one shared SQS queue for all three downstream systems and configure a single DLQ only when all three downstream systems fail.

Answer

Use EventBridge rules to invoke A, B, and C synchronously with retries enabled, and send failures to a common DLQ.

Question 7

A healthcare document service stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of immutable audit logs for seven years, as compliance mode enforces a strict write-once-read-many (WORM) model that cannot be bypassed.

Answer

S3 server access logging

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Question 8

A media company serves versioned JavaScript and CSS files from Amazon S3 through CloudFront. After each release, the cache hit ratio drops sharply because the same distribution also fronts a personalized API path, and the current cache policy forwards cookies, all query strings, and several headers to every origin request. The static assets already use content-hashed filenames. Which two changes will most directly improve cache hit ratio for the static assets without changing the application behavior? Select two.

Accepted Answer

Create a dedicated cache behavior for the static asset path that excludes cookies, query strings, and unneeded headers from the cache key.. Creating a dedicated cache behavior for the static asset path (e.g., /static/*) allows you to configure a cache policy that excludes cookies, query strings, and unneeded headers from the cache key. Since the static assets use content-hashed filenames, they are immutable and do not vary by user-specific attributes. By removing these variables from the cache key, CloudFront can serve the same cached object to all users, drastically improving the cache hit ratio.

Answer

Increase the size of the S3 bucket’s underlying storage to absorb more origin traffic.

Answer

Add Lambda@Edge logic to append a timestamp to every asset request so updates are always fetched immediately.

Answer

Disable compression so CloudFront can treat each object as a separate cache entry.

Question 9

A startup runs a 24/7 web tier on Amazon EC2 with a stable baseline of 8 instances and a nightly analytics batch job that can resume from checkpoints if interrupted. The company wants to minimize monthly compute cost without hurting the always-on web tier. Which two actions should it take? Select two.

Accepted Answer

Buy a Compute Savings Plan for the steady web tier baseline.. A Compute Savings Plan offers the largest discount (up to 66%) in exchange for a 1- or 3-year hourly spend commitment, and it automatically applies to any EC2 instance family, size, or region. For the stable 8-instance web tier that runs 24/7, this plan provides significant cost savings while maintaining full flexibility to change instance types or even move to containers or Lambda, without affecting the always-on requirement.

Answer

Buy Standard Reserved Instances only for the nightly analytics batch job.

Answer

Move the entire workload to On-Demand Instances for maximum flexibility.

Answer

Use Dedicated Hosts for the batch job so the fleet is isolated.

Question 10

An S3 bucket stores user-uploaded images. Access patterns are unpredictable: some objects are never read again, while others are occasionally retrieved months later. The team wants to reduce storage cost without having to manually track access frequency or run periodic analyses. Which S3 storage and lifecycle approach is the best fit?

Accepted Answer

Enable S3 Intelligent-Tiering so objects can automatically move between access tiers based on observed access patterns.. S3 Intelligent-Tiering is the best fit because it automatically moves objects between access tiers (frequent, infrequent, archive instant, archive) based on changing access patterns, eliminating the need for manual tracking or lifecycle rules. This optimizes storage costs for unpredictable access patterns without requiring you to define fixed time-based transitions or perform periodic analyses.

Answer

Use S3 Glacier Instant Retrieval for all objects immediately to minimize storage cost.

Answer

Create a lifecycle rule that transitions objects to Standard-IA after a fixed 30 days, regardless of access.

Answer

Keep all objects in S3 Standard and reduce costs by enabling server access logging compression.

Question 11

An order-processing worker consumes messages from Amazon SQS. Occasionally, the worker times out after successfully creating a payment record but before deleting the message, which causes duplicate charges during retries. Some messages also fail validation repeatedly because required fields are missing. Which two changes should the team make? Select two.

Accepted Answer

Make the payment step idempotent using a unique transaction identifier.. Making the payment step idempotent using a unique transaction identifier ensures that if the same message is processed multiple times due to a timeout, the payment is only charged once. This is a common pattern for handling at-least-once delivery semantics in Amazon SQS, where the worker must be designed to handle duplicate messages safely.

Answer

Reduce the visibility timeout so failed messages return to the queue faster.

Answer

Run only one long-lived worker instance so the queue can never be processed twice.

Answer

Switch from a standard queue to a FIFO queue and remove all other changes.

Question 12

An event ingestion service writes to a DynamoDB table where the partition key is tenantId and the sort key is eventTime. During a campaign, one tenant generates a disproportionate share of traffic, causing write throttling and increased latency for that tenant’s writes. You can change the data model and application queries, but you must still efficiently retrieve events for a tenant for the last 10 minutes. Which change best improves write throughput by reducing hot partitions?

Accepted Answer

Add a shard attribute to the partition key (partition key = tenantId#shard, where shard is randomly selected from a fixed range). Query all shards for the tenant for eventTime values in the last 10 minutes, then merge results in the application.. It distributes writes for a hot tenant across multiple partitions by appending a random shard suffix to the tenantId partition key. This eliminates a single hot partition, allowing DynamoDB to scale write capacity horizontally. The application can then query all shards for the last 10 minutes and merge results, satisfying the retrieval requirement.

Answer

Keep tenantId as the partition key and rely on DynamoDB adaptive capacity to automatically remove all throttling.

Answer

Change the sort key to eventTimeBucket (for example, eventTime rounded to 1-minute buckets) while keeping the partition key as tenantId.

Answer

Enable DAX and use it for write operations so throttled writes are served from cache instead of reaching DynamoDB.

Question 13

Based on the exhibit, an automation pipeline in several member accounts creates IAM roles for application deployments. Security says no future role may exceed the approved boundary arn:aws:iam::123456789012:policy/DeployBoundary, even if someone later attaches AdministratorAccess. What should you implement to enforce this across the organization?

Accepted Answer

Create an SCP that denies iam:CreateRole unless iam:PermissionsBoundary equals arn:aws:iam::123456789012:policy/DeployBoundary, and also deny removing that boundary from created roles.. It uses an SCP to enforce that any IAM role creation must include the specific permissions boundary `arn:aws:iam::123456789012:policy/DeployBoundary`, and also prevents removal or modification of that boundary from existing roles. This ensures that even if an attacker or administrator later attaches a policy like AdministratorAccess, the effective permissions are still limited by the boundary, meeting the security requirement across all member accounts in the organization.

Answer

Attach DeployBoundary to the automation role only, because that automatically forces every created role to inherit the same boundary.

Answer

Create an SCP that denies iam:CreateRole and iam:PutRolePermissionsBoundary unless aws:RequestTag equals DeployBoundary.

Answer

Use AWS Access Analyzer to automatically attach the approved boundary whenever a role is created without one.

Question 14

A team wants detective controls to investigate suspected exfiltration from an S3 bucket. They need to know when objects are accessed (GetObject) and also when new encrypted objects are written.

They already enabled AWS CloudTrail for management events, but their investigation shows no visibility into object-level reads/writes in the logs they review.

Which CloudTrail configuration change most directly provides the missing object-level visibility?

Accepted Answer

Enable CloudTrail data events for the specific S3 bucket so that GetObject and PutObject operations are logged at the object level.. CloudTrail management events do not include object-level operations like GetObject or PutObject. By enabling CloudTrail data events for the specific S3 bucket, you capture object-level read (GetObject) and write (PutObject) API calls, including those for encrypted objects, providing the missing visibility for detective controls.

Answer

Enable AWS Config delivery to a separate bucket and create a rule to detect noncompliant S3 policies; this will automatically generate GetObject logs.

Answer

Turn on VPC Flow Logs for the VPC hosting the S3 gateway endpoint, because network logs show S3 object read and write details.

Answer

Add an S3 bucket policy that denies all GetObject requests unless the caller uses TLS; the denial events will create investigation logs automatically.

Question 15

A company stores user uploads in an S3 bucket. Objects are accessed rarely after upload, but when an object is accessed, it must be retrievable quickly (minutes to a few hours). Objects must be retained for at least 18 months. The team wants to reduce storage cost while meeting these requirements. Which lifecycle configuration best fits these requirements?

Accepted Answer

After 30 days, transition objects to S3 Glacier Instant Retrieval, and after 18 months, expire (delete) the objects.. It transitions objects to S3 Glacier Instant Retrieval after 30 days, which provides millisecond retrieval for rarely accessed data, meeting the quick retrieval requirement. The 18-month expiration ensures compliance with the retention policy while minimizing storage costs compared to keeping data in S3 Standard.

Answer

Keep all objects in S3 Standard permanently to avoid lifecycle transition fees.

Answer

After 30 days, transition objects to S3 Intelligent-Tiering, and set expiration to 12 months.

Answer

After 30 days, transition objects to S3 Glacier Deep Archive, and set expiration to 18 months.

Question 16

You have an S3 bucket that stores customer-specific private files. You want to serve these files through CloudFront, where clients must use signed cookies (or signed URLs) to access the content. In addition, you need to block common web exploits and rate-limit suspicious traffic at the edge. Which design best meets these requirements?

Accepted Answer

Keep the S3 bucket private, configure CloudFront with Origin Access Control so only CloudFront can access the origin, require signed cookies/URLs for viewers, and associate an AWS WAF web ACL with CloudFront for blocking and rate limiting.. It combines a private S3 bucket with Origin Access Control (OAC) to ensure only CloudFront can access the origin, enforces signed cookies/URLs for viewer authentication, and uses AWS WAF at the edge to block common web exploits and rate-limit suspicious traffic. This layered approach provides both authorization (via signed requests) and security filtering (via WAF) at the CloudFront edge, meeting all requirements.

Answer

Enable public read access on the S3 bucket and rely on WAF alone for authorization because WAF can validate signatures.

Answer

Configure CloudFront with signed URLs but do not change the S3 bucket access settings; leaving public access enabled is acceptable since CloudFront can filter traffic.

Answer

Use WAF at CloudFront but omit signed cookies/URLs because rate limiting and exploit blocking already provide access control for private files.

Question 17

A mobile app reads the same product catalog items repeatedly throughout the day. The DynamoDB table is already properly keyed, but read latency is still a problem during sales events. The team can tolerate eventually consistent reads and wants the least disruptive change. What should they add?

Accepted Answer

Enable DynamoDB Accelerator to cache frequently accessed items in memory.. DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that reduces read latency for frequently accessed items by orders of magnitude, from single-digit milliseconds to microseconds. Since the team can tolerate eventually consistent reads, DAX is ideal because it caches read results and serves them without additional DynamoDB read capacity consumption, making it the least disruptive change — no schema changes or application rewrites are required.

Answer

Add a global secondary index for every frequently viewed product attribute.

Answer

Switch the table to on-demand capacity mode to reduce latency.

Answer

Move the catalog to Aurora and use a read replica for every region.

Question 18

A marketing team uses CloudFront with an S3 origin to serve a single-page web app. After a release, CloudFront cache hit ratio dropped sharply. The app requests the same static JS and CSS assets, but each request includes a unique tracking query parameter (for example, ?utm_source=campaign123, campaign456, etc.). You want CloudFront to cache those assets efficiently even when the tracking query parameter changes. What should you do?

Accepted Answer

Update the CloudFront cache policy so the cache key ignores the tracking query parameter, while still using the path and other essential headers.. CloudFront's cache key determines whether a request is served from the cache or forwarded to the origin. By configuring a cache policy that ignores the tracking query parameter (e.g., utm_source), CloudFront treats all requests for the same asset path as identical, regardless of the unique tracking parameter. This allows the same JS and CSS files to be cached once and served for all campaign variations, restoring the cache hit ratio.

Answer

Create a cache policy that forwards the query string to the origin and varies the cache key by all query parameters.

Answer

Enable S3 origin access control and keep the existing default cache policy, because origin access changes caching behavior automatically.

Answer

Set the CloudFront Time-to-Live (TTL) to 0 seconds to ensure the origin always serves the latest asset content.

Question 19

An application uses Amazon Aurora MySQL. CloudWatch shows the writer instance near 85% CPU while the only reader instance averages 15% CPU. Trace logs show that all SELECT statements still target the writer endpoint. The workload is read-heavy, and the application already tolerates eventual consistency for reads. Which two changes will best increase total read throughput without a schema redesign? Select two.

Accepted Answer

Point read-only queries to the Aurora reader endpoint instead of the writer endpoint.. The Aurora reader endpoint is designed to distribute read-only connections across all available Aurora Replicas, offloading SELECT queries from the writer instance. Currently, all SELECT statements target the writer endpoint, causing the writer's CPU to be at 85% while the reader instance is underutilized at 15%. By redirecting read traffic to the reader endpoint, the writer's CPU load decreases, and the existing reader instance can handle more read throughput without any schema changes.

Answer

Convert the cluster to a single-AZ RDS MySQL instance to reduce replication overhead.

Answer

Replace the writer endpoint with the instance endpoint of the primary node to speed up SELECT queries.

Answer

Add Amazon ElastiCache and move all database writes into the cache layer.

Question 20

A media company uploads raw video thumbnails to an S3 bucket every hour. The application needs these thumbnails for active browsing for the first 7 days. After day 7, access becomes rare. Requirements: - Objects must remain available in S3 for at least 180 days total. - After day 7, the team can tolerate retrieval latency in the range of minutes to hours. - They want to minimize storage cost while keeping the ability to read objects (no application changes required). Which storage strategy is the most cost-optimized fit?

Accepted Answer

Use a lifecycle rule to transition objects to S3 Glacier Flexible Retrieval after day 7 and expire them after day 180.. S3 Glacier Flexible Retrieval provides retrieval times from minutes to hours, which matches the tolerance for rare access after day 7, and offers the lowest storage cost among the options for data that is rarely accessed. A lifecycle rule transitions objects from S3 Standard (used for the first 7 days of active browsing) to Glacier Flexible Retrieval on day 7, then expires them after day 180, meeting the 180-day retention requirement without application changes.

Answer

Use a bucket-level lifecycle rule to transition objects to S3 Standard-IA on day 7 and then expire them after day 180.

Answer

Keep all objects in S3 Standard for 180 days, and enable S3 Intelligent-Tiering only if the bucket’s access frequency is above a threshold.

Answer

Use a lifecycle rule to transition objects to S3 Glacier Instant Retrieval after day 7 and expire them after day 180.