SAA-C03 Practice Test 4 — 25 Questions

Question 1

A Lambda function for a healthcare document service needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it is designed specifically for storing and automatically rotating database credentials. It supports native rotation for Amazon RDS, Redshift, and DocumentDB with a built-in Lambda rotation function, and it can rotate secrets on a schedule (e.g., every 30 days) without storing the password in environment variables. This meets the healthcare document service's requirement for automatic rotation and secure storage.

Answer

A KMS-encrypted Lambda environment variable

Answer

An encrypted object in Amazon S3

Answer

AWS Systems Manager Parameter Store SecureString without automation

Question 2

A trading dashboard runs on EC2 instances behind an Application Load Balancer. The design must tolerate the failure of one Availability Zone. What should the Auto Scaling group configuration include?

Accepted Answer

Subnets in at least two Availability Zones with health checks enabled. Distributing EC2 instances across subnets in at least two Availability Zones ensures that if one AZ fails, the Auto Scaling group can maintain capacity using instances in the remaining AZ(s). Enabling health checks allows the group to detect and replace unhealthy instances, which is essential for fault tolerance. This configuration meets the requirement to tolerate the failure of one Availability Zone.

Answer

A single EC2 instance with detailed monitoring

Answer

All instances in one larger subnet

Answer

A Network Load Balancer in one subnet

Question 3

A static website uses an Amazon S3 bucket as the origin for an Amazon CloudFront distribution. The team accidentally configured the S3 bucket policy to allow s3:GetObject to Principal "*", so objects are accessible via direct S3 URLs. They want to ensure objects are retrievable only through CloudFront. What is the best corrective action?

Accepted Answer

Remove public access from the bucket and update the bucket policy to allow GetObject only from CloudFront using the distribution’s SourceArn (and use CloudFront origin access control or origin access identity).. The S3 bucket policy currently allows s3:GetObject from any principal, making objects publicly accessible via direct S3 URLs. By removing public access and updating the policy to restrict GetObject to only requests that originate from the CloudFront distribution (using either Origin Access Control or Origin Access Identity), objects become retrievable exclusively through CloudFront, preventing direct S3 access.

Answer

Enable S3 static website hosting and disable CloudFront, because website hosting blocks direct object URL access.

Answer

Add a WAF rule that rate-limits requests to the S3 bucket domain to make direct access impractical.

Answer

Turn on S3 object versioning so that attackers cannot read previous objects.

Question 4

A inventory service uses Lambda functions that call an unreliable third-party API. Failed events must be retained for later investigation after retries are exhausted. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

A Lambda dead-letter queue or failure destination. Lambda dead-letter queues (DLQs) or failure destinations are the correct AWS-native mechanism to retain failed events after retries are exhausted. When a Lambda function fails to process an event (e.g., due to an unreliable third-party API), the function can be configured to send the failed event payload to an SQS queue or SNS topic for later investigation. This ensures no data loss and aligns with the requirement for a managed, AWS-native solution.

Answer

Lambda reserved concurrency set to zero

Answer

A larger deployment package

Answer

CloudFront error pages

Question 5

A internal reporting portal serves infrequently accessed user documents that must be available immediately when requested. Which S3 storage class is likely the best cost fit?

Accepted Answer

S3 Standard-IA or S3 One Zone-IA depending on resilience requirements. S3 Standard-IA or S3 One Zone-IA is the best cost fit because the data is infrequently accessed but must be available immediately when requested. These storage classes offer low-latency retrieval (milliseconds) at a lower storage cost than S3 Standard, with the trade-off of a retrieval fee. The choice between Standard-IA and One Zone-IA depends on whether the application requires resilience against Availability Zone failures.

Answer

Instance store volumes

Answer

S3 Glacier Deep Archive

Answer

S3 Standard for all objects

Question 6

A telemetry pipeline uses an Application Load Balancer in one Region. Global users need lower network latency to the application without caching dynamic responses. What should be considered?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the Anycast IP address concept to route traffic through the AWS global network to the optimal endpoint, reducing latency and jitter for global users. It does not cache content, making it ideal for dynamic responses that cannot be cached, and it integrates directly with an Application Load Balancer in a single Region.

Answer

S3 Cross-Region Replication

Answer

CloudFront only with long TTLs

Answer

AWS Backup cross-Region copy

Question 7

Based on the exhibit, the application team wants the database to keep the same connection endpoint during failover and to reconnect automatically after the primary instance becomes unavailable. Which change best meets the requirement?

Accepted Answer

Replace the IP address with the RDS DNS endpoint and add client retry logic that re-resolves DNS after connection loss.. Using the RDS DNS endpoint ensures that the application connects to the current primary instance, even after a failover. When the primary becomes unavailable, RDS promotes a standby (or read replica) to a new primary and updates the DNS record to point to the new instance's IP. By adding client retry logic that re-resolves DNS after a connection loss, the application automatically picks up the new IP and reconnects without manual intervention, meeting both requirements of a stable endpoint and automatic reconnection.

Answer

Keep the IP address and increase the JDBC connection timeout so the application waits longer during failover.

Answer

Create an additional read replica and point the application to it so failover is faster.

Answer

Place a Network Load Balancer in front of the database and use the load balancer target IP to avoid DNS changes.

Question 8

A content publishing system uses Lambda functions that call an unreliable third-party API. Failed events must be retained for later investigation after retries are exhausted. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

A Lambda dead-letter queue or failure destination. Lambda dead-letter queues (DLQs) or failure destinations are the managed AWS-native way to capture events that have exhausted all retry attempts from an asynchronous invocation. When the Lambda function fails after the configured number of retries (default 3), the event is automatically sent to an SQS queue or SNS topic (DLQ) or to a specified destination (e.g., SQS, SNS, EventBridge) for later investigation and reprocessing.

Answer

Lambda reserved concurrency set to zero

Answer

A larger deployment package

Answer

CloudFront error pages

Question 9

Your global users access static images stored in S3. Origin bandwidth costs are higher than expected because CloudFront is not caching effectively. What change most directly reduces origin fetches (and typically lowers data transfer costs) without changing application logic?

Accepted Answer

Configure CloudFront caching by setting appropriate cache-control headers and/or CloudFront cache policy/TTL values for the static objects. The high origin bandwidth costs are caused by CloudFront not caching effectively, meaning too many requests reach the S3 origin. By configuring appropriate Cache-Control headers or a CloudFront cache policy with optimal TTL values, you ensure that CloudFront caches the static images at edge locations for longer periods. This directly reduces the number of origin fetches, lowering data transfer costs without any changes to the application logic.

Answer

Disable CloudFront caching so every request goes back to S3 for the latest image

Answer

Route users directly to the S3 website endpoint to bypass CloudFront

Answer

Turn on a NAT Gateway for the CloudFront origin to reduce bandwidth charges

Question 10

Based on the exhibit, the application tier is not replacing unhealthy instances even though the Auto Scaling group spans two Availability Zones. What change most directly improves automatic recovery when the application process fails?

Accepted Answer

Set the Auto Scaling group health check type to ELB so target group health determines replacement.. Setting the Auto Scaling group health check type to ELB allows the ASG to use the target group's health checks, which monitor application-level health (e.g., HTTP 200 responses). When the application process fails, the ELB marks the instance as unhealthy, and the ASG immediately terminates and replaces it. This directly addresses the issue of unhealthy instances not being replaced, as the default EC2 health check only verifies instance status (e.g., running vs. stopped), not application responsiveness.

Answer

Increase the ASG desired capacity so that extra instances absorb the failed ones.

Answer

Replace the Application Load Balancer with a Network Load Balancer to improve failover speed.

Answer

Increase the HealthCheckGracePeriod to the maximum value so the instances have more time to stabilize.

Question 11

A team runs an EC2-based service and ships logs to Amazon CloudWatch Logs. They enabled long log retention and turned on detailed monitoring to improve troubleshooting. Their monthly CloudWatch costs have grown unexpectedly. Compliance requires that the logs remain available in CloudWatch Logs (for querying and audits) for 90 days, and alerts/alarms do not require detailed EC2 monitoring. What change best reduces cost while meeting requirements?

Accepted Answer

Set the CloudWatch Logs retention to 90 days and disable detailed EC2 monitoring (use standard monitoring) for the instances. Reduces costs by setting CloudWatch Logs retention to exactly 90 days (meeting compliance) and disabling detailed monitoring (which incurs per-minute metrics charges) in favor of standard 5-minute monitoring. This directly addresses the two main cost drivers—long retention and detailed EC2 monitoring—while preserving the required 90-day log availability for queries and audits.

Answer

Keep the current long retention and detailed monitoring; reduce the log volume by sampling 10% of events

Answer

Move all logs to S3 immediately and delete the CloudWatch log groups to reduce costs

Answer

Increase CloudWatch alarm thresholds to reduce the number of metric datapoints

Question 12

A warehouse integration service must use shared file storage across Linux EC2 instances in multiple Availability Zones. The storage must remain available during an AZ failure. Which service should be used? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Amazon EFS with mount targets in multiple Availability Zones. Amazon EFS provides a fully managed, NFS-based shared file system that can be mounted concurrently by multiple Linux EC2 instances across different Availability Zones. By creating mount targets in each AZ, the file system remains accessible even if one AZ fails, as traffic is automatically routed to the surviving mount targets. This meets the requirement for shared, resilient storage with a managed AWS-native control plane.

Answer

S3 mounted as a POSIX file system without a file gateway

Answer

Instance store volumes

Answer

An EBS volume attached to all instances

Question 13

A claims workflow uses an RDS MySQL database and must remain available during an Availability Zone failure with minimal application changes. What should the architect enable? The design must avoid adding custom operational scripts.

Accepted Answer

Multi-AZ deployment for the RDS DB instance. Multi-AZ deployment for RDS MySQL provides automatic failover to a standby replica in a different Availability Zone. This ensures high availability during an AZ failure with minimal application changes, as the DNS endpoint remains the same and failover is handled by AWS without custom scripts.

Answer

S3 Cross-Region Replication

Answer

EBS snapshots every hour

Answer

Read replicas only

Question 14

An orders service publishes payment instructions to an Amazon SQS Standard queue. A downstream consumer sometimes times out or crashes after it has partially completed processing, causing the same instruction to be processed more than once. You must keep the design resilient without attempting to guarantee exactly-once processing. Which approach best handles duplicates safely?

Accepted Answer

Make the consumer idempotent by deriving a deterministic idempotency key from the payment instruction (for example, the instruction ID), persisting the result of successful processing, and skipping re-processing when that key is already marked successful.. Making the consumer idempotent ensures that even if the same payment instruction is processed multiple times due to timeouts or crashes, the system remains consistent. By deriving a deterministic idempotency key (e.g., the instruction ID) and persisting the result of successful processing, the consumer can skip re-processing when the key is already marked as successful. This approach aligns with the requirement to keep the design resilient without guaranteeing exactly-once processing, as it safely handles duplicates at the application level.

Answer

Set the SQS visibility timeout extremely long so the message cannot be retried even after processing failures.

Answer

Switch to an SQS FIFO queue but remove error handling in the consumer so duplicates never occur.

Answer

Send all failed messages to a DLQ and rely on it to deduplicate messages that were already successfully processed.

Question 15

A reporting application in Account B must read files from an S3 bucket in Account A. The bucket contains objects encrypted with a customer managed KMS key in Account A. The application role in Account B already has an identity policy allowing s3:GetObject on the bucket prefix, but requests still fail with AccessDenied. Which two changes are required for the application to read the objects? Select two.

Accepted Answer

Add a bucket policy in Account A that allows the Account B role to perform s3:GetObject on the required prefix.. Cross-account S3 access requires the destination account (Account A) to explicitly grant access via a bucket policy that allows the source account's role (Account B) to perform s3:GetObject on the specified prefix. Without this bucket policy, the S3 service in Account A will deny the request, even if the IAM identity policy in Account B permits the action. Option B is correct because the objects are encrypted with a customer managed KMS key in Account A; the application role in Account B must be added to the KMS key policy with kms:Decrypt permission to decrypt the objects during retrieval. Both the S3 bucket policy and the KMS key policy are required for cross-account encrypted access.

Answer

Attach an IAM policy in Account B that grants s3:* on the bucket and its objects.

Answer

Create an S3 gateway endpoint in Account B so the application can reach the bucket privately.

Answer

Add an SCP in Account A that allows the Account B role to bypass KMS encryption checks.

Question 16

Based on the exhibit, the team must restore an Amazon RDS for PostgreSQL database to the exact state just before a bad delete happened. What is the best recovery approach?

Accepted Answer

Perform a point-in-time restore to 2026-04-27 15:10 UTC into a new DB instance, then cut over after validation.. Point-in-time recovery (PITR) allows you to restore an Amazon RDS for PostgreSQL database to any second within the backup retention period, using automated backups and transaction logs. By restoring to 2026-04-27 15:10 UTC, just before the bad delete occurred, you can recover the exact state without data loss, then cut over after validation.

Answer

Restore the latest automated snapshot and accept data loss from the last backup window.

Answer

Promote a read replica because it will contain the deleted rows and can replace the primary immediately.

Answer

Enable Multi-AZ on the current database and wait for automatic failover to reverse the delete.

Question 17

Based on the exhibit, the team wants to minimize compute cost for a workload with a steady 24/7 baseline and a separate nightly batch job that can be interrupted and resumed from checkpoints. They also expect to change EC2 instance families during the year as performance needs evolve. Which approach is the best fit?

Accepted Answer

Use a Compute Savings Plan to cover the steady baseline and run the nightly batch on Spot Instances.. A Compute Savings Plan covers any EC2 instance family (or even container/Fargate usage) at a discounted rate, making it ideal for the steady 24/7 baseline. The nightly batch job can be interrupted and resumed from checkpoints, which is a perfect use case for Spot Instances, offering up to 90% cost savings. This combination minimizes compute cost while maintaining flexibility to change instance families during the year.

Answer

Buy EC2 Instance Savings Plans for the baseline and run the nightly batch on On-Demand instances.

Answer

Purchase Standard Reserved Instances for all 12 instances and keep the current families fixed.

Answer

Run both tiers entirely on Spot Instances and rely on automatic restarts for the baseline web tier.

Question 18

A patient portal must process every event at least once, but duplicate processing is acceptable if the consumer handles idempotency. Which eventing approach is most suitable?

Accepted Answer

Use Amazon SQS standard queue and design consumers to be idempotent. Amazon SQS standard queues provide at-least-once delivery, meaning each message is delivered at least once but may occasionally be delivered more than once. This aligns with the requirement that every event must be processed at least once, and since duplicate processing is acceptable when consumers are idempotent, the standard queue is the most suitable choice. SQS handles the decoupling and durability of messages without requiring custom infrastructure.

Answer

Use an in-memory queue on one EC2 instance

Answer

Use UDP messages sent directly to workers

Answer

Use CloudFront signed URLs

Question 19

A worker consumes messages from an Amazon SQS queue. Some messages consistently fail validation and are retried until the worker can no longer process them. What is the most appropriate AWS mechanism to handle these poison messages while keeping the queue usable?

Accepted Answer

Send failing messages to an SQS dead-letter queue (DLQ) using a redrive policy based on receive count.. An SQS dead-letter queue (DLQ) with a redrive policy based on receive count allows messages that repeatedly fail processing (poison pills) to be moved out of the main queue after a specified number of retries. This keeps the main queue operational for valid messages and isolates problematic messages for later analysis or manual intervention.

Answer

Enable SQS long polling and increase the maximum message size for the queue.

Answer

Change the queue to a FIFO queue and handle duplicates in the worker code without DLQs.

Answer

Delete the queue and recreate it hourly to clear out any problematic messages.

Question 20

A batch analytics job has unpredictable DynamoDB traffic with long idle periods and occasional spikes. Which capacity mode should minimize operational overhead and avoid paying for idle provisioned capacity? The design must avoid adding custom operational scripts.

Accepted Answer

DynamoDB on-demand capacity mode. DynamoDB on-demand capacity mode automatically scales to handle unpredictable traffic spikes and idle periods without requiring any capacity planning or management. It charges only for the reads and writes you perform, eliminating the cost of idle provisioned capacity and avoiding the need for custom scripts to adjust capacity.

Answer

Reserved capacity for maximum daily traffic

Answer

Provisioned capacity set for peak traffic

Answer

Global tables in every Region