SAA-C03 Practice Test 2 — 25 Questions

Question 1

A web application uses an Amazon Aurora DB cluster for a read-heavy workload. The team wants to increase read throughput without changing the database schema or rewriting application data access patterns. Which two changes should they make? Select two.

Accepted Answer

Add Aurora Replicas to scale out read traffic across multiple database instances.. Adding Aurora Replicas (Option A) directly increases read throughput by distributing read-only queries across multiple database instances, which is ideal for a read-heavy workload. Sending read queries to the Aurora reader endpoint (Option B) ensures that these queries are load-balanced across all available replicas, offloading the writer instance and improving overall performance without requiring schema or application changes.

Answer

Point all queries to the writer endpoint so Aurora can balance reads and writes internally.

Answer

Enable Multi-AZ standby for the cluster to increase the number of read-only connections.

Answer

Move the database to a single larger instance class instead of adding replicas.

Question 2

A startup runs a 24/7 web tier on Amazon EC2 with a stable baseline of 8 instances and a nightly analytics batch job that can resume from checkpoints if interrupted. The company wants to minimize monthly compute cost without hurting the always-on web tier. Which two actions should it take? Select two.

Accepted Answer

Buy a Compute Savings Plan for the steady web tier baseline.. A Compute Savings Plan offers the largest discount (up to 66%) in exchange for a 1- or 3-year hourly spend commitment, and it automatically applies to any EC2 instance family, size, or region. For the stable 8-instance web tier that runs 24/7, this plan provides significant cost savings while maintaining full flexibility to change instance types or even move to containers or Lambda, without affecting the always-on requirement.

Answer

Buy Standard Reserved Instances only for the nightly analytics batch job.

Answer

Move the entire workload to On-Demand Instances for maximum flexibility.

Answer

Use Dedicated Hosts for the batch job so the fleet is isolated.

Question 3

Your application runs in private subnets with no NAT gateway. It needs to call AWS Secrets Manager to retrieve secrets. For private connectivity without internet egress, which VPC endpoint type should you create for AWS Secrets Manager?

Accepted Answer

An Interface VPC endpoint (AWS PrivateLink) for secretsmanager in your Region. An Interface VPC endpoint (AWS PrivateLink) creates an elastic network interface in your subnet with a private IP address, allowing your instances to communicate with AWS Secrets Manager over the AWS network without traversing the internet. Since your application runs in private subnets with no NAT gateway, this is the only supported endpoint type for Secrets Manager, as Gateway endpoints are only available for S3 and DynamoDB.

Answer

A Gateway VPC endpoint for secretsmanager

Answer

A NAT gateway in the private subnet route table

Answer

A VPC peering connection to the AWS public network hosting Secrets Manager

Question 4

A company hosts a image sharing application on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows secure shell access to EC2 instances without opening inbound ports (SSH 22 or RDP 3389) to the internet. It uses the AWS Systems Manager agent and an IAM instance role to establish a bidirectional connection via the AWS API, eliminating the need for a bastion host or public IP. This meets the requirement of avoiding custom operational scripts because Session Manager is a fully managed service with no additional configuration beyond the agent and role.

Answer

An internet gateway attached to the private subnet

Answer

A public Elastic IP address on each instance

Answer

A bastion host with SSH open to 0.0.0.0/0

Question 5

A team needs to distribute TCP traffic (not HTTP) across multiple services. The services must see the original client source IP for auditing. Which AWS load balancer is the best fit?

Accepted Answer

Network Load Balancer (NLB) using TCP listeners. A Network Load Balancer (NLB) is the best fit because it operates at Layer 4 (TCP/UDP) and preserves the original client source IP address by default, which is required for auditing. It can distribute raw TCP traffic across multiple services without inspecting application-layer headers, making it ideal for non-HTTP TCP workloads.

Answer

Application Load Balancer (ALB) using HTTP/HTTPS listeners with host-based routing

Answer

Classic Load Balancer (CLB) configured for TCP health checks only

Answer

API Gateway with a VPC Link to forward raw TCP traffic

Question 6

A worker service consumes messages from an Amazon SQS queue. Some messages are malformed and always fail validation. The worker retries, but it keeps reprocessing the same bad messages and consumes processing capacity that should be used for valid work. What is the best solution to prevent “poison messages” from blocking progress?

Accepted Answer

Configure a Dead-Letter Queue (DLQ) and set a redrive policy so messages move to the DLQ after a maximum number of receives.. A Dead-Letter Queue (DLQ) with a redrive policy is the standard AWS mechanism for handling poison messages. By setting a maximum receive count (e.g., 5), the SQS queue automatically moves messages that fail processing repeatedly to the DLQ, isolating them from the main queue. This prevents the worker from wasting capacity on invalid messages and allows the main queue to continue processing valid work without interruption.

Answer

Increase the visibility timeout so the worker gets fewer retries per hour.

Answer

Disable SQS retries by deleting messages immediately on any processing error.

Answer

Create a second worker that polls the queue less frequently until the malformed message is processed successfully.

Question 7

A test environment has EC2 instances that are oversized based on CPU, memory, and network utilisation. Which AWS service should identify rightsizing recommendations? The architecture review board prefers a managed AWS-native control.

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is a managed service that uses machine learning to analyze historical utilization metrics (CPU, memory, network, and storage) and provides rightsizing recommendations for EC2 instances. It identifies over-provisioned resources and suggests instance types that better match workload requirements, directly addressing the oversized EC2 instances in the test environment.

Answer

AWS DataSync

Answer

AWS Shield

Answer

AWS Artifact

Question 8

A company runs its customer-facing web app on EC2 behind an Application Load Balancer. The database is Amazon RDS for PostgreSQL. The requirement is that if a single Availability Zone fails, the database must automatically fail over within the same AWS Region with minimal application changes. Which database setup best meets this requirement?

Accepted Answer

Deploy the RDS PostgreSQL instance as Multi-AZ with automatic failover enabled.. Option B is correct because RDS Multi-AZ with automatic failover provides synchronous replication to a standby instance in a different Availability Zone. If the primary AZ fails, RDS automatically flips the DNS CNAME to the standby, resulting in minimal application changes (only a brief connection interruption). This meets the requirement for automatic failover within the same region without manual intervention.

Answer

Use an RDS single-AZ instance and periodically restore from automated backups if needed.

Answer

Create a read replica in a different AZ and use it only when the primary fails.

Answer

Use RDS with Multi-AZ disabled, but increase storage IOPS to prevent failover.

Question 9

A web application runs on an EC2 Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ASG spans three Availability Zones. After a deployment, new instances frequently fail the ALB target group health checks with HTTP 5xx responses and are quickly terminated by the ASG. What change most improves resiliency during deployments with minimal downtime by preventing premature removal of instances that are still starting?

Accepted Answer

Use a longer ASG health check grace period and deploy new instances using controlled replacement (for example, rolling instance refresh) so existing healthy instances continue serving while new ones warm up.. Option B is correct because increasing the ASG health check grace period gives new instances more time to complete their startup and pass the ALB health checks before the ASG marks them unhealthy. A rolling instance refresh replaces instances in a controlled manner, ensuring that existing healthy instances continue serving traffic while new instances warm up, minimizing downtime and preventing premature termination.

Answer

Reduce the ASG health check grace period to 0 seconds so issues are detected faster.

Answer

Restrict the ASG to a single Availability Zone so health check evaluation is simpler.

Answer

Disable ALB health checks so the ASG does not terminate instances on HTTP 5xx responses.

Question 10

A telemetry pipeline uses an Application Load Balancer in one Region. Global users need lower network latency to the application without caching dynamic responses. What should be considered?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the Anycast IP address concept to route traffic through the AWS global network to the optimal endpoint, reducing latency and jitter for global users. It does not cache content, making it ideal for dynamic responses that cannot be cached, and it integrates directly with an Application Load Balancer in a single Region.

Answer

S3 Cross-Region Replication

Answer

CloudFront only with long TTLs

Answer

AWS Backup cross-Region copy

Question 11

A inventory service exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most? The architecture review board prefers a managed AWS-native control.

Accepted Answer

CloudFront caching with appropriate TTLs. CloudFront caching with appropriate TTLs allows cached responses to be served to users even when the S3 origin is temporarily unavailable. By setting a minimum TTL (e.g., 0 seconds for fresh content, but a higher default or maximum TTL for stale content), CloudFront can continue delivering previously cached pages from edge locations during an S3 outage, ensuring high availability and resilience. This is a managed AWS-native feature that aligns with the architecture review board's preference.

Answer

AWS Backup Vault Lock

Answer

IAM Access Analyzer

Answer

S3 Select

Question 12

A ticket booking system stores uploaded documents in S3. The business requires a copy in another AWS Region for disaster recovery. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Cross-Region Replication with versioning enabled. S3 Cross-Region Replication (CRR) automatically replicates objects from a source bucket in one AWS Region to a destination bucket in another Region, providing a disaster recovery copy without custom scripts. Enabling versioning on both buckets is a prerequisite for CRR, ensuring that all object versions are replicated and that the destination bucket can maintain a complete history of changes.

Answer

S3 lifecycle transition to Glacier Flexible Retrieval

Answer

An EBS snapshot schedule

Answer

A CloudFront distribution

Question 13

A site serves static assets (JS/CSS) through CloudFront from an S3 origin. After a recent frontend change, CloudFront shows a cache hit ratio below 20%. In CloudFront access logs, requests to the same asset URL path differ by a query parameter named rnd (a random value appended by the app on every request). The origin content is identical regardless of rnd. What is the best CloudFront configuration change to restore effective caching?

Accepted Answer

Create a custom CloudFront Cache Policy that does not include the rnd query parameter in the cache key (whitelist only required parameters, or forward no query strings).. The rnd query parameter makes each request appear unique to CloudFront, causing a cache miss for every request even though the underlying content is identical. By creating a custom cache policy that either forwards no query strings or whitelists only required parameters, CloudFront will ignore the rnd parameter when computing the cache key, allowing it to serve cached responses and dramatically improve the cache hit ratio.

Answer

Increase the origin response Cache-Control max-age header on S3 so CloudFront caches longer even with different rnd values.

Answer

Disable compression on CloudFront so the response body is identical byte-for-byte and cache hits improve.

Answer

Switch the origin from S3 to an ALB so CloudFront can cache based on ALB target health checks instead of the query string.

Question 14

A video platform uses Amazon Aurora. The workload has many short-lived database connections from Lambda functions, causing connection storms. What should be added? The architecture review board prefers a managed AWS-native control.

Accepted Answer

RDS Proxy. RDS Proxy is the correct choice because it manages a pool of reusable database connections, allowing Lambda functions to share and reuse connections rather than opening and closing them with each invocation. This eliminates connection storms by buffering short-lived connections from Lambda and reducing the load on the Aurora database, all as a fully managed AWS-native service.

Answer

S3 Select

Answer

An internet gateway

Answer

A larger Route 53 hosted zone

Question 15

A web API runs on an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). During traffic spikes, users experience request timeouts even though CPU stays below 40%. After investigation, you find the ASG often has too few healthy targets to handle the current request rate. Which change will best improve responsiveness during spikes?

Accepted Answer

Create a target tracking scaling policy using an ALB metric such as RequestCountPerTarget or TargetResponseTime.. Option B is correct because the issue is that the ASG has too few healthy targets to handle the request rate, even though CPU is low. A target tracking scaling policy based on RequestCountPerTarget or TargetResponseTime directly aligns scaling with the ALB's view of demand, ensuring the ASG adds instances when request rates spike, regardless of CPU utilization. This addresses the root cause—insufficient capacity to serve incoming requests—rather than relying on a metric (CPU) that does not reflect the bottleneck.

Answer

Keep the ASG scaling policy based on CPU utilization, but increase the ASG min capacity by 50%.

Answer

Enable EC2 detailed monitoring for one-minute granularity and keep CPU scaling.

Answer

Switch to scaling based on the ASG network out bytes metric only, ignoring ALB response metrics.

Question 16

A payments API uses an RDS MySQL database and must remain available during an Availability Zone failure with minimal application changes. What should the architect enable? The team wants the control to be enforceable during normal operations.

Accepted Answer

Multi-AZ deployment for the RDS DB instance. Multi-AZ deployment for RDS MySQL automatically provisions and synchronously replicates a standby instance in a different Availability Zone. In the event of an AZ failure, Amazon RDS automatically fails over to the standby, providing high availability with minimal application changes (the application only needs to reconnect using the same endpoint). This meets the requirement of remaining available during an AZ failure while being enforceable during normal operations.

Answer

S3 Cross-Region Replication

Answer

Read replicas only

Answer

EBS snapshots every hour

Question 17

A team runs a latency-sensitive service on EC2 and needs consistent, low-latency block storage for a database. The application requires predictable performance and should be fast for random reads/writes. Which EBS volume type is the best choice?

Accepted Answer

EBS gp3 (general purpose SSD). B is correct because gp3 is a general-purpose SSD volume that provides consistent, low-latency performance for random read/write operations, making it ideal for latency-sensitive database workloads. It offers a baseline of 3,000 IOPS and 125 MB/s throughput, with the ability to independently scale up to 16,000 IOPS and 1,000 MB/s, ensuring predictable performance without the burst-bucket limitations of gp2.

Answer

EBS st1 (throughput optimized HDD)

Answer

EBS sc1 (cold HDD)

Answer

EBS magnetic (legacy magnetic)

Question 18

A startup runs a mix of workloads using both EC2 instances and AWS Lambda functions. Over the next 12 months, the team expects the overall level of compute usage to be fairly steady, but they may change EC2 instance types for performance tuning and they may add or remove Lambda functions. They want the lowest-cost commitment that will discount *both* EC2 and Lambda usage without requiring them to commit to a specific EC2 instance family (or a fixed instance type). Which AWS option best meets this requirement?

Accepted Answer

Purchase a Compute Savings Plan with a 1-year term for the expected average hourly spend across both EC2 and Lambda.. B is correct because a Compute Savings Plan offers the lowest cost commitment that covers both EC2 and Lambda usage, with flexibility to change instance families, sizes, regions (within the same AWS organization), and even switch between EC2 and Fargate. It applies a consistent hourly discount to compute usage up to the committed amount, regardless of instance type or compute service, meeting the startup's need for a steady workload with potential changes.

Answer

Purchase an EC2 Instance Reserved Instance for the current instance family only, and rely on On-Demand pricing for Lambda and any future EC2 types.

Answer

Purchase a Standard Reserved Instance for a specific Region and use it only to reduce network egress/transfer charges.

Answer

Use EC2 Spot for EC2 workloads and keep Lambda on-demand, because Spot will automatically discount Lambda too.

Question 19

A video processing pipeline runs batch jobs that are safe to interrupt and restart. The jobs checkpoint progress to durable storage every few minutes, and the team can automatically resubmit from the last checkpoint. They want to minimize compute cost while accepting that capacity can be interrupted. Which launch configuration for the processing workers is the best cost-optimized choice?

Accepted Answer

Launch the worker nodes as Spot Instances, and configure the job resubmission logic to restart from checkpoints upon interruption.. Spot Instances offer significant cost savings (up to 90% compared to On-Demand) and are ideal for fault-tolerant, interruptible workloads. Since the pipeline checkpoints progress to durable storage and can automatically resume from the last checkpoint, using Spot Instances minimizes compute cost while accepting interruptions.

Answer

Launch the worker nodes as On-Demand Instances with no interruption handling so the pipeline never needs resubmission.

Answer

Launch the worker nodes as Reserved Instances to guarantee capacity and reduce cost, ignoring interruptions.

Answer

Use Savings Plans and also set the job scheduler to never start new jobs unless previous jobs finish without interruption.

Question 20

A web application runs on an Amazon EC2 Auto Scaling group behind an Application Load Balancer (ALB). After each deployment, new instances take about 2 minutes to download artifacts and become ready to accept requests on the target port. In the last deployment, the ALB started marking targets unhealthy before the app was ready, and the Auto Scaling group then replaced those instances repeatedly, causing a prolonged outage. Which change best improves resilience during instance start-up without reducing actual availability once the application is healthy?

Accepted Answer

Increase the Auto Scaling group’s health check grace period so it exceeds the ~2-minute initialization time.. The Auto Scaling group's health check grace period allows instances to initialize without being marked unhealthy by the ELB health checks. By setting this grace period to exceed the ~2-minute artifact download time, the ASG will not replace instances that are still starting up, preventing the cascade of terminations and redeployments that caused the outage. This directly addresses the root cause—premature health check failures—without changing the health check configuration or reducing availability once the app is ready.

Answer

Add more subnets across additional Availability Zones to distribute the same instances more widely.

Answer

Switch the load balancer target type from instance targets to IP targets to avoid health check failures.

Answer

Reduce the ALB health check interval so unhealthy targets are removed faster.