SAA-C03 Practice Test 26 — 15 Questions

Question 1

A web application for a IoT ingestion API is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy? The design must avoid adding custom operational scripts.

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). By associating an AWS WAF web ACL with the Application Load Balancer, you can filter and monitor HTTP(S) requests based on rules that match malicious patterns, with no custom scripts or operational overhead. This is the most efficient and managed solution for the stated requirements.

Answer

Network ACLs on the public subnets

Answer

Security groups on the application instances

Answer

AWS Shield Advanced only

Question 2

A website serves mostly cacheable images, CSS, and JavaScript from an ALB. Users in Europe and Asia report slower page loads, and the ALB receives far more requests than expected. The team also wants text assets compressed automatically. Which change is the best first step?

Accepted Answer

Place Amazon CloudFront in front of the ALB and enable compression and caching.. CloudFront is the correct first step because it acts as a CDN that caches cacheable content (images, CSS, JS) at edge locations close to users in Europe and Asia, reducing load on the ALB and improving page load times. It also supports automatic compression of text assets (e.g., via gzip or Brotli) without requiring backend changes, directly addressing the team's requirement for compressed text assets. By offloading requests from the ALB, CloudFront reduces the number of requests hitting the origin, solving the 'far more requests than expected' issue.

Answer

Increase the ALB size and add more target instances behind it.

Answer

Use Route 53 latency-based routing to send users to the nearest ALB.

Answer

Replace the ALB with an NLB to reduce latency for web requests.

Question 3

A batch processing job can be interrupted and restarted from checkpoints. The business wants to lower compute cost while still keeping the workload resilient to interruptions. Which two choices are best? Select two.

Accepted Answer

Run the workload on Amazon EC2 Spot Instances.. Amazon EC2 Spot Instances offer significant cost savings (up to 90% compared to On-Demand) and are ideal for fault-tolerant, stateless batch processing jobs that can be interrupted and restarted from checkpoints. The workload's ability to resume from checkpoints makes it resilient to Spot Instance interruptions, aligning perfectly with the business goal of lowering compute costs while maintaining resilience.

Answer

Use a single On-Demand instance in one Availability Zone only.

Answer

Disable automatic replacement so the job is never restarted.

Answer

Keep all intermediate state only in instance memory.

Question 4

A web application runs on an Amazon EC2 Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ALB is configured to use at least two Availability Zones (AZs), but the ASG currently uses subnets in only one AZ. If that AZ becomes unavailable, the application stops serving requests. Which change most directly improves resilience to an AZ outage?

Accepted Answer

Place the ASG across multiple Availability Zones by configuring it with subnets in at least two AZs.. Option B is correct because distributing an Auto Scaling group across multiple Availability Zones (AZs) ensures that if one AZ fails, the remaining AZs continue to serve traffic. The Application Load Balancer (ALB) is already configured for at least two AZs, but the ASG’s single-AZ subnet placement creates a single point of failure. By adding subnets in at least two AZs to the ASG, the application becomes resilient to an AZ outage without any other architectural changes.

Answer

Keep the ASG in one Availability Zone, but reduce ALB health check intervals.

Answer

Switch the load balancer from an ALB to an NLB to remove HTTP health check dependency.

Answer

Add an Amazon SQS queue to buffer requests during failures.

Question 5

A team runs an application on Amazon EC2 that connects to an Aurora database. The database password must rotate automatically every 30 days, and the application should retrieve the current secret at runtime using an IAM role. Which AWS service is the best fit?

Accepted Answer

AWS Secrets Manager with rotation enabled.. AWS Secrets Manager is the best fit because it natively supports automatic rotation of database credentials on a schedule (e.g., every 30 days) and integrates directly with Amazon RDS/Aurora to update the password. The application can retrieve the current secret at runtime using an IAM role attached to the EC2 instance, without hardcoding credentials. Secrets Manager also provides built-in secret rotation with Lambda, ensuring zero downtime during password changes.

Answer

AWS Systems Manager Parameter Store standard parameters.

Answer

AWS KMS, because KMS stores credentials and rotates them automatically.

Answer

Amazon S3 with server-side encryption and versioning.

Question 6

A third-party payroll vendor in another AWS account must assume a role in your account to write a daily settlement file to Amazon S3. You want to prevent confused-deputy attacks and make every assumed session traceable in CloudTrail back to an individual vendor user. Which three trust-policy or session controls should be used? Select three.

Accepted Answer

Specify the exact vendor role ARN as the trusted principal in the role trust policy.. Option A is correct because specifying the exact vendor role ARN as the trusted principal in the trust policy ensures that only that specific role in the vendor's account can assume the role, preventing any other entity from impersonating the vendor. This is a key control to limit the trust boundary and avoid confused-deputy attacks.

Answer

Use a wildcard principal and rely on the S3 bucket policy to narrow access later.

Answer

Give the vendor long-term IAM user credentials in your account for easier auditing.

Question 7

A company is encrypting sensitive S3 data for a order processing API with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals?

Accepted Answer

A key policy that limits key administrators and key users. Option B is correct because a KMS key policy explicitly defines which principals (IAM users, roles, or AWS accounts) are allowed to administer or use the key. By limiting key administrators and key users in the key policy, you prevent unauthorized principals from accidentally invoking KMS operations on the key, even if they have broad IAM permissions. This is a fundamental resource-based control that overrides any IAM policy that would otherwise grant access.

Answer

A larger KMS key rotation period

Answer

S3 Transfer Acceleration

Question 8

A SaaS application is deployed in us-east-1 and us-west-2 behind separate ALBs. The business wants DNS to send new clients to the primary Region when it is healthy and automatically fail over to the secondary Region when the primary endpoint is unhealthy. Which two Route 53 settings are required? Select two.

Accepted Answer

Use a failover routing policy with a primary and secondary record.. A failover routing policy is correct because it allows you to designate one record as primary and another as secondary. Route 53 will route traffic to the primary record as long as it is healthy, and automatically fail over to the secondary record when the primary becomes unhealthy. This directly meets the requirement to send new clients to the primary region when healthy and fail over automatically.

Answer

Use weighted routing with a 50/50 traffic split between both Regions.

Answer

Use latency-based routing so clients always choose the fastest Region.

Answer

Use a geolocation policy without health checks.

Question 9

A trading dashboard uses Aurora MySQL. The company wants fast cross-Region disaster recovery with low RPO. Which architecture should be considered? The design must avoid adding custom operational scripts.

Accepted Answer

Aurora Global Database. Aurora Global Database is the correct choice because it provides a fully managed cross-Region disaster recovery solution with a typical RPO of 1 second or less, using storage-based replication that does not require custom scripts. This meets the low RPO requirement while avoiding operational overhead, as replication is handled automatically by the Aurora storage layer.

Answer

A single-AZ Aurora cluster

Answer

Manual snapshots copied monthly

Answer

An ElastiCache Redis replica

Question 10

Account A hosts an IAM role (RoleInAccountA). The trust policy in Account A correctly allows a specific principal from Account B to call sts:AssumeRole. However, when Account B’s application calls sts:AssumeRole, it receives an AccessDenied error. What is the most likely missing requirement in Account B?

Accepted Answer

Account B’s calling principal must have an identity-based policy that allows sts:AssumeRole on RoleInAccountA’s role ARN.. Option A is correct because for an IAM role in Account A to be assumed by a principal in Account B, two conditions must be met: (1) the trust policy of the role in Account A must grant the sts:AssumeRole permission to the Account B principal, and (2) the calling principal in Account B must have an identity-based policy that explicitly allows sts:AssumeRole on the ARN of RoleInAccountA. Without this identity-based policy in Account B, the request is denied by AWS's explicit deny default, even if the trust policy in Account A is correctly configured.

Answer

Account A must attach an S3 bucket policy statement to allow sts:AssumeRole from Account B.

Answer

Account B must add kms:Decrypt permissions to the caller to satisfy AssumeRole.

Answer

Account B must create an SCP in the organization to allow sts:AssumeRole.

Question 11

A test environment has EC2 instances that are oversized based on CPU, memory, and network utilisation. Which AWS service should identify rightsizing recommendations?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer uses machine learning to analyze historical utilization metrics (CPU, memory, network, and storage) and provides rightsizing recommendations for EC2 instances, including over-provisioned resources. It helps reduce costs by suggesting instance types or sizes that better match actual workload demands.

Answer

AWS DataSync

Answer

AWS Shield

Answer

AWS Artifact

Question 12

A ticket booking system uses Aurora MySQL. The company wants fast cross-Region disaster recovery with low RPO. Which architecture should be considered?

Accepted Answer

Aurora Global Database. Aurora Global Database is designed for cross-Region disaster recovery with a typical RPO of 1 second or less, using storage-based replication that does not impact database performance. This meets the requirement for fast failover and low data loss, unlike manual snapshot-based approaches which have higher RPO and slower recovery.

Answer

A single-AZ Aurora cluster

Answer

An ElastiCache Redis replica

Answer

Manual snapshots copied monthly

Question 13

A trading dashboard runs on EC2 instances behind an Application Load Balancer. The design must tolerate the failure of one Availability Zone. What should the Auto Scaling group configuration include? The team wants the control to be enforceable during normal operations.

Accepted Answer

Subnets in at least two Availability Zones with health checks enabled. Option B is correct because distributing EC2 instances across at least two Availability Zones (AZs) ensures that if one AZ fails, the Auto Scaling group can maintain capacity in the remaining AZ(s). Enabling health checks allows the group to detect instance failures and automatically replace them, providing fault tolerance. This configuration meets the requirement to tolerate a single AZ failure while remaining enforceable during normal operations.

Answer

A single EC2 instance with detailed monitoring

Answer

All instances in one larger subnet

Answer

A Network Load Balancer in one subnet

Question 14

A serverless checkout API has predictable traffic spikes every weekday at 09:00 UTC and low traffic the rest of the day. The team wants to reduce cost while keeping response times fast during the recurring spike. Which two actions should they take? Select two.

Accepted Answer

Use provisioned concurrency for the Lambda function during the expected spike window.. Provisioned concurrency initializes a specified number of Lambda execution environments in advance, ensuring no cold starts during traffic spikes. By scheduling provisioned concurrency to activate only during the 09:00 UTC window, the team keeps response times fast without paying for idle capacity the rest of the day.

Answer

Replace the API with a single always-on EC2 instance.

Answer

Keep provisioned concurrency permanently high all day and all week.

Answer

Disable API Gateway and use direct public internet access to Lambda.

Question 15

A startup has three sandbox accounts and one production account. The CTO wants lower cost and operational overhead while keeping central purchasing and spend visibility. Which two actions are best? Select two.

Accepted Answer

Enable consolidated billing under AWS Organizations so discounts and shared purchasing apply across accounts.. Option A is correct because enabling consolidated billing under AWS Organizations aggregates usage across all accounts, allowing the startup to benefit from volume discounts, Reserved Instance sharing, and Savings Plans across the sandbox and production accounts. This reduces operational overhead by centralizing payment and provides a single view of spend, meeting the CTO's requirements for cost and visibility.

Answer

Move each sandbox to its own payer account to isolate spend from the rest.

Answer

Buy Dedicated Hosts for sandbox workloads to get a lower blended rate.

Answer

Disable AWS Budgets because consolidated billing already solves visibility.