SAA-C03 Practice Test 4 — 25 Questions

Question 1

An internal team runs a report-generation job once per day. It typically finishes in a few minutes, and even on its slowest days it still completes in under 15 minutes. The team wants to reduce operational overhead and pay primarily for actual runtime instead of keeping servers running 24/7. Which AWS approach best matches these goals?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Lambda triggered by a schedule (for example, EventBridge) to run the report at the required time.. AWS Lambda is the ideal choice because it is a serverless compute service that runs code only when triggered, aligning with the requirement to pay primarily for actual runtime. By using Amazon EventBridge (CloudWatch Events) to invoke the Lambda function on a daily schedule, the team eliminates the need to provision or manage servers, and the job's typical runtime of a few minutes (under 15 minutes, Lambda's maximum execution timeout) fits perfectly within Lambda's constraints.

Answer

Deploy the job on EC2 instances and keep them running continuously for the daily schedule.

Answer

Run the job in an RDS database using stored procedures scheduled by the database engine.

Answer

Use an Auto Scaling group with a fixed minimum size of one instance and disable scaling.

Question 2

A media processing workflow in private subnets downloads large amounts of data from S3 through a NAT gateway. NAT data processing charges are high. What should the architect use to reduce cost? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Gateway VPC endpoint for Amazon S3. A Gateway VPC endpoint for Amazon S3 allows instances in private subnets to access S3 directly over the AWS network without traversing a NAT gateway, eliminating NAT data processing charges. This is a managed AWS-native control that meets the architecture review board's preference, as it uses AWS PrivateLink and does not require any changes to the S3 bucket or client configuration beyond route table updates.

Answer

S3 Object Lambda

Answer

AWS Shield Advanced

Answer

A larger NAT gateway

Question 3

An e-commerce application uses Aurora MySQL. Writes are modest, but the product-detail page generates many read-only queries and the writer instance CPU is high. The application can tolerate a small amount of replication lag on those reads. What should the team do?

Accepted Answer

Add Aurora read replicas and send read-only traffic to the reader endpoint.. Adding Aurora read replicas and directing read-only traffic to the reader endpoint offloads SELECT queries from the writer instance, reducing its CPU load. Aurora replicas share the same underlying storage volume, so replication lag is minimal (typically <100ms) and acceptable for the product-detail page. This scales read throughput without increasing writer instance size or cost.

Answer

Increase the writer instance size and keep all traffic on the primary.

Answer

Replace Aurora with DynamoDB to eliminate replication lag.

Answer

Enable Multi-AZ failover only, because it increases read throughput automatically.

Question 4

A risk simulation workload generates analytics files that are accessed unpredictably. Some files become hot again months later. The team wants automatic storage cost optimisation without retrieval delays. What should be used? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering automatically moves objects between access tiers (frequent, infrequent, and archive instant access) based on changing access patterns, with no retrieval delays for hot objects and no operational overhead. This matches the unpredictable access pattern where files become hot again months later, as Intelligent-Tiering monitors access at the object level and adjusts storage class without manual intervention or custom scripts.

Answer

Manual monthly review and object copying

Answer

S3 Glacier Flexible Retrieval for all files

Answer

EFS One Zone for analytics files

Question 5

You run a web application on an EC2 Auto Scaling group behind an Application Load Balancer (ALB). During scheduled traffic spikes, new instances launch but customers occasionally see 5xx errors for the first few minutes after scale-out. Operational logs show instances need ~4 minutes to warm up (load caches and initialize dependencies). ALB target health becomes healthy only after this warm-up. Which change most directly improves performance during spikes by reducing the time to serve traffic after scaling?

Accepted Answer

Use an Auto Scaling warm pool so instances are pre-initialized and ready to register quickly when the ASG scales out.. B is correct because a warm pool pre-initializes instances (e.g., loading caches and dependencies) before they are added to the Auto Scaling group. When the ASG scales out, these pre-warmed instances can be quickly moved into service, bypassing the ~4-minute warm-up delay and reducing the window for 5xx errors.

Answer

Configure a larger ALB deregistration delay so that old targets remain longer before termination.

Answer

Increase the number of desired instances immediately without using scaling policies, and then rely on manual reconfiguration.

Answer

Switch from ALB to NLB so instances become reachable sooner without waiting for health checks.

Question 6

Multiple EC2 instances in different Availability Zones need concurrent read/write access to the same shared files. The files are actively modified by several application servers, and low-latency metadata operations matter more than extremely high aggregate throughput. Which two changes should the team make? Select two.

Accepted Answer

Use Amazon EFS instead of EBS or S3 for the shared file system.. Amazon EFS provides a fully managed, POSIX-compliant, shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones (AZs). It supports concurrent read/write access with strong consistency, and its metadata operations are optimized for low latency, making it ideal for workloads where many application servers actively modify the same files. EBS cannot be shared across AZs, and S3 lacks POSIX semantics and low-latency metadata operations.

Answer

Use a single EBS Multi-Attach volume mounted read/write by all instances across AZs.

Answer

Store the files in S3 and mount them directly through the console as a shared network filesystem.

Answer

Place the files on instance store volumes so each server has faster local access.

Question 7

A company uses Amazon RDS for a PostgreSQL database powering a customer-facing application. The application’s availability depends on fast database failover with minimal manual intervention. The RDS instance currently runs as a single-AZ deployment in one DB subnet group. Which change most directly meets the goal?

Accepted Answer

Enable Multi-AZ for the RDS DB instance so AWS manages a standby in another Availability Zone with automatic failover.. Enabling Multi-AZ for the RDS DB instance creates a synchronous standby replica in a different Availability Zone. AWS automatically handles failover to the standby with no manual intervention required, meeting the goal of fast database failover with minimal manual intervention.

Answer

Create a read replica in a different Availability Zone and configure the application to fail over manually.

Answer

Switch the database to use EBS snapshots more frequently and restore in case of failure.

Answer

Pin the DB to a specific instance type with higher CPU credits to prevent CPU-related disconnects.

Question 8

A inventory service exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most? The architecture review board prefers a managed AWS-native control.

Accepted Answer

CloudFront caching with appropriate TTLs. CloudFront caching with appropriate TTLs allows cached responses to be served to users even when the S3 origin is temporarily unavailable. By setting a minimum TTL (e.g., 0 seconds for fresh content, but a higher default or maximum TTL for stale content), CloudFront can continue delivering previously cached pages from edge locations during an S3 outage, ensuring high availability and resilience. This is a managed AWS-native feature that aligns with the architecture review board's preference.

Answer

AWS Backup Vault Lock

Answer

IAM Access Analyzer

Answer

S3 Select

Question 9

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a customer analytics portal. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy? The design must avoid adding custom operational scripts.

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. The bucket policy can use the `aws:sourceVpce` condition key to restrict access exclusively to traffic originating from a specific VPC endpoint ID. This ensures that only requests sent through that VPC endpoint are allowed, meeting the security team's requirement without requiring custom scripts or additional infrastructure.

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A deny statement for all IAM users except the EC2 role

Question 10

Developers for a e-learning platform need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center permission sets allow you to define fine-grained permissions and assign them to users or groups with time-bound access (e.g., using a session duration or approval workflow). Combined with CloudTrail, every API call made during the elevated session is logged for audit, meeting the security team's requirements for approvals, expiry, and audit logging.

Answer

Disable CloudTrail during troubleshooting

Answer

Attach AdministratorAccess permanently to every developer role

Answer

Create shared administrator access keys for the team

Question 11

Based on the exhibit, which storage choice best matches the workload requirements?

Accepted Answer

Use instance store NVMe for the temporary processing workspace.. Instance store NVMe volumes provide temporary, ephemeral block storage directly attached to the EC2 instance, offering extremely low latency and high throughput for temporary processing workspaces. Since the workload requires a temporary workspace where data does not need to persist beyond the instance lifecycle, instance store is the optimal choice because it avoids the cost and overhead of durable storage while delivering the highest performance for scratch data.

Answer

Use io2 EBS volumes because they provide the highest durable block storage performance.

Answer

Use Amazon EFS for the workspace so the temporary files survive instance replacement.

Answer

Use S3 as the working directory and read and write the intermediate files directly there.

Question 12

A web application for a healthcare document service is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy? The design must avoid adding custom operational scripts.

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP/HTTPS requests. It provides managed rules specifically designed to block common attack patterns like SQL injection and cross-site scripting (XSS) without requiring custom scripts or manual rule maintenance, thus meeting the requirement for minimum operational overhead.

Answer

Security groups on the application instances

Answer

Network ACLs on the public subnets

Answer

AWS Shield Advanced only

Question 13

An application stores user-uploaded binaries in S3. Access is unpredictable for the first month, then most objects become cold. The team wants the cheapest approach that avoids manually guessing access patterns. Which two actions are best? Select two.

Accepted Answer

Enable S3 Intelligent-Tiering on the bucket.. A is correct because S3 Intelligent-Tiering automatically moves objects between access tiers based on changing access patterns, eliminating the need to manually guess or configure lifecycle rules. It charges a small monthly monitoring fee per object but avoids the higher cost of keeping cold data in S3 Standard, making it the cheapest hands-off approach for unpredictable access followed by cold storage.

Answer

Keep all objects in S3 Standard because lifecycle transitions add too much management.

Answer

Copy all binaries to Amazon EFS so retrieval is faster.

Answer

Disable versioning because S3 Intelligent-Tiering needs it to work.

Question 14

Based on the exhibit, what is the best change to improve read performance without increasing write latency on the primary database?

Accepted Answer

Create an RDS read replica and direct the reporting queries to the replica endpoint.. Creating an RDS read replica offloads read-heavy reporting queries from the primary database instance, improving read performance without adding any write latency to the primary. The replica operates asynchronously, so writes on the primary are not blocked or delayed by the replica's lag. This is the standard AWS solution for scaling read traffic on RDS.

Answer

Convert the DB instance to Multi-AZ so the primary can serve more reads.

Answer

Increase the primary instance class to a larger size and keep all traffic on one writer.

Answer

Migrate the reporting workload to DynamoDB to gain faster reads.

Question 15

A web application runs on an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ASG is currently attached to subnets in only two Availability Zones (AZs). During a planned maintenance window, one AZ becomes unavailable for about 25 minutes. Monitoring shows that targets in the remaining AZ go healthy, and the ALB/target group health checks report normal. However, users still experience intermittent connection failures and slower responses during the AZ outage. What change will most directly improve resilience against an AZ loss while keeping the same ALB-based design?

Accepted Answer

Extend the ASG to use subnets in three AZs so there is placement redundancy during an AZ outage, while continuing to keep traffic behind the ALB.. B is correct because deploying the ASG across three Availability Zones (AZs) ensures that when one AZ becomes unavailable, the remaining two AZs can handle the full traffic load without overloading the instances. This placement redundancy directly addresses the intermittent connection failures and slower responses, as the ALB can distribute traffic only to healthy targets in the remaining AZs, maintaining capacity and performance. The current two-AZ setup lacks sufficient buffer capacity, causing the single remaining AZ to become overwhelmed during the outage.

Answer

Set the ASG min capacity to 0 so instances can be recreated faster when an AZ recovers.

Answer

Increase the ALB idle timeout to 120 seconds to reduce connection drops.

Answer

Disable health checks on the target group so instances are not deregistered during the maintenance window.

Question 16

A marketing site stores logs in S3. Logs are queried for 30 days, rarely accessed for one year, and then retained for compliance. What should reduce storage cost? The design must avoid adding custom operational scripts.

Accepted Answer

S3 lifecycle policy that transitions objects to lower-cost storage classes over time. S3 Lifecycle policies allow you to automatically transition objects from S3 Standard to lower-cost storage classes like S3 Standard-IA (Infrequent Access) after 30 days, then to S3 Glacier Deep Archive after one year, without custom scripts. This matches the access pattern: frequent queries for 30 days, rare access for a year, then long-term retention for compliance. The policy automates cost reduction by moving data to progressively cheaper storage as access frequency decreases.

Answer

Keep all logs in S3 Standard indefinitely

Answer

Use EBS snapshots for the logs

Answer

Move all logs immediately to S3 Glacier Deep Archive

Question 17

A solutions architect is designing an S3 bucket for a claims portal. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to S3 objects, even if a bucket policy or ACL later grants public access. This setting can be applied at the account or bucket level and ensures that all access is denied to anonymous users, meeting the requirement without custom scripts.

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Answer

Enable S3 Transfer Acceleration

Question 18

Based on the exhibit, a partner account uploads encrypted objects to a central S3 bucket and later reads them back. The S3 permissions are correct, but the requests still fail. What change is required so the partner workload can use the customer-managed KMS key safely?

Accepted Answer

Update the CMK key policy, or add a tightly scoped grant, to allow the partner role the required KMS actions through S3.. When using a customer-managed KMS key (CMK) for SSE-KMS in a cross-account scenario, the key policy must explicitly grant the partner account's IAM role the necessary KMS actions (kms:Decrypt, kms:GenerateDataKey) to allow S3 to perform the encryption/decryption on behalf of the partner. Without this policy update or a tightly scoped grant, the KMS service will deny the request even if S3 bucket policies are correctly configured.

Answer

Replace SSE-KMS with S3 object ACLs so the partner account can bypass KMS authorization.

Answer

Create a new bucket in the partner account and copy the objects there to avoid cross-account encryption.

Answer

Switch the bucket to SSE-S3 so the partner role no longer needs KMS permissions.

Question 19

A risk simulation workload uses CloudWatch Logs heavily. Retaining all debug logs forever is increasing costs. What should be configured?

Accepted Answer

CloudWatch Logs retention policies per log group. CloudWatch Logs retention policies allow you to set per-log-group expiration rules (e.g., 30 days, 90 days) to automatically delete old log events, directly reducing storage costs for debug logs that are no longer needed. This is the most cost-effective and targeted solution for managing log lifecycle without affecting other monitoring or configuration services.

Answer

AWS Config aggregation

Answer

CloudWatch detailed monitoring on all instances

Answer

Route 53 health checks

Question 20

An order system receives events and uses a Lambda function to write each order into a database. During traffic spikes, the database sometimes throttles, and Lambda retries lead to occasional message loss in the event flow. The team wants buffering, automatic retries, and a way to isolate messages that repeatedly fail so they can be inspected later. What design change best meets this need?

Accepted Answer

Use Amazon SQS as a buffer between the event source and Lambda, with an SQS dead-letter queue (DLQ).. B is correct because Amazon SQS acts as a durable buffer between the event source and Lambda, absorbing traffic spikes and providing automatic retries via its visibility timeout mechanism. By attaching a dead-letter queue (DLQ) to the SQS queue, messages that repeatedly fail processing can be isolated for later inspection, preventing data loss and enabling debugging.

Answer

Send events directly from EventBridge to Lambda without any queue to simplify the flow.

Answer

Use SNS fan-out to multiple Lambda functions, but keep no retry logic and no DLQ.

Answer

Store events in an S3 bucket and trigger Lambda immediately after each upload, without using DLQs.