SAA-C03 Practice Test 26 — 15 Questions

Question 1

A media processing pipeline uses EBS-backed storage for an application that performs sustained random I/O with low latency requirements. During peak processing windows, the team sees increased read latency and occasional timeouts at the application layer. They need predictable, high IOPS performance rather than best-effort throughput. Which EBS configuration choice is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use io1 or io2 EBS volumes configured with a high provisioned IOPS value, and attach them to EBS-optimized instances.. Io1 and io2 volumes are provisioned IOPS SSD volumes designed for sustained, predictable high IOPS performance, which directly addresses the application's need for low-latency random I/O during peak loads. Attaching them to EBS-optimized instances ensures dedicated network bandwidth for EBS traffic, eliminating contention and preventing timeouts.

Answer

Use gp2 volumes and rely on burst credits to handle peak random I/O latency requirements.

Answer

Use standard HDD (st1) volumes, because they provide high throughput and will reduce latency automatically.

Answer

Use S3 instead of EBS for random I/O latency reduction without changing the application.

Question 2

A company hosts a web application on EC2 instances behind an Application Load Balancer (ALB) in us-east-1. A static failover site is hosted in an S3 bucket with static website hosting enabled. The company needs automatic DNS failover to the S3 bucket if the primary ALB becomes unhealthy. Which Route 53 configuration achieves this?

Accepted Answer

Configure Route 53 Failover routing with a health check on the ALB as PRIMARY and the S3 bucket website endpoint as SECONDARY. Route 53 Failover routing uses health checks to route traffic to a primary resource and automatically switch to a secondary when the primary health check fails.

Configuration: Create a Route 53 health check targeting the ALB endpoint. Create a PRIMARY alias A record pointing to the ALB with the health check associated. Create a SECONDARY alias A record pointing to the S3 static website endpoint. When the ALB health check fails, Route 53 returns the S3 endpoint automatically.

Answer

Configure Route 53 Weighted routing with 100% weight on the ALB and 0% on the S3 bucket

Answer

Configure Route 53 Latency routing with records in both regions to route to the healthiest endpoint

Answer

Configure Route 53 Geolocation routing with North American users directed to the ALB and all others to S3

Question 3

An event consumer sometimes processes the same SQS message more than once due to timeouts and retries. The consumer must ensure the payment is not charged twice. What design choice best addresses this requirement?

Accepted Answer

Make the payment operation idempotent by using an idempotency key and skipping side effects when the key indicates the payment already succeeded.. Making the payment operation idempotent using an idempotency key ensures that even if the same SQS message is processed multiple times due to timeouts and retries, the payment will only be charged once. The consumer checks the idempotency key before executing the payment; if the key indicates the payment already succeeded, the consumer skips the side effect. This pattern directly addresses the requirement of not charging twice without relying on SQS's at-least-once delivery guarantee.

Answer

Assume messages are processed exactly once because SQS uses durable storage.

Answer

Increase the consumer visibility timeout to several days so messages are not redelivered.

Answer

Delete the message immediately even if processing fails validation.

Question 4

Your organization hosts an internet-facing application behind an Amazon CloudFront distribution. You want to mitigate common web exploits (for example, SQL injection and XSS) at the edge. Which action is the most appropriate way to do this using AWS services?

Accepted Answer

Create an AWS WAF web ACL using managed rule sets and associate it with the CloudFront distribution.. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). By creating a web ACL with managed rule sets (e.g., the AWS Managed Rules for SQL injection and XSS) and associating it with your CloudFront distribution, you can inspect incoming HTTP/HTTPS requests at the edge and block malicious payloads before they reach your origin. This is the most appropriate and scalable way to mitigate these threats at the edge.

Answer

Add inbound rules to the security group so that only port 443 is open from the internet.

Answer

Enable AWS Shield Advanced to block SQL injection and XSS.

Answer

Restrict IAM permissions for the application’s EC2 instances so that SQL injection payloads cannot be executed.

Question 5

A CPU-bound batch rendering service runs on EC2. The application is Linux-based, compatible with ARM64, and the team wants the best throughput per dollar without changing the workload's architecture. Which two instance-family choices should the team consider first? Select two.

Accepted Answer

A compute-optimized family, because it is designed for workloads that spend most of their time on CPU.. Compute-optimized families (e.g., C5, C6g) are designed for workloads that spend most of their time on CPU, such as batch rendering. Option B is correct because Graviton-based instances (e.g., C6g, M6g) use ARM64 architecture, which is compatible with the workload and often delivers better price-performance for compute-intensive tasks, maximizing throughput per dollar without architectural changes.

Answer

A memory-optimized family, because extra RAM always increases compute throughput.

Answer

A storage-optimized family, because local storage bandwidth is the main factor for rendering performance.

Answer

A burstable family, because CPU credits make sustained rendering faster during long runs.

Question 6

A logistics company runs an order-tracking service on Amazon EC2 instances that write state to an Amazon DynamoDB table. A recent incident showed that a single Availability Zone failure caused the service to lose capacity, and the team also discovered that a developer accidentally deleted a production table. The architect must improve both Availability Zone resilience and protection against accidental table deletion. (Choose two.)

Accepted Answer

Enable DynamoDB point-in-time recovery on the table and attach a resource-based policy that denies the dynamodb:DeleteTable action to non-administrative principals.. Zone resilience for the compute tier comes from running instances across multiple Availability Zones behind a load balancer, so a single zone loss does not remove all capacity. Accidental table deletion is mitigated by enabling point-in-time recovery, which allows restore to a recent point in time, and by restricting who holds the delete-table permission so the mistake is far less likely to recur.

Answer

Create a DynamoDB global secondary index on the partition key used by the tracking queries and project all attributes into the index.

Answer

Enable DynamoDB Streams on the table and write a consumer that copies every change into an Amazon S3 bucket for long-term retention.

Answer

Convert the DynamoDB table to use provisioned capacity mode with auto scaling so that read and write capacity automatically adjusts during traffic spikes.

Question 7

Based on the exhibit, which change best reduces latency during peak traffic without overprovisioning the fleet?

Accepted Answer

Change the Auto Scaling policy to target tracking on ALB RequestCountPerTarget.. Using a target tracking scaling policy on ALB RequestCountPerTarget dynamically adjusts the fleet size based on the actual load per instance, ensuring that capacity scales with demand during peak traffic without manual intervention or overprovisioning. This approach directly addresses latency caused by high request rates per instance by maintaining a target request count, which reduces response time without adding unnecessary instances during off-peak periods.

Answer

Replace the instances with a larger instance family so each server has more headroom.

Answer

Use scheduled scaling to add instances only during the business hours peak window.

Answer

Replace the ALB with a Network Load Balancer to reduce request latency.

Question 8

An application in Account B reads objects from an Amazon S3 bucket in Account A. The bucket uses SSE-KMS with a customer managed key in Account A. The role in Account B already has s3:GetObject, but downloads fail with AccessDenied on decrypt. Which two changes are required for the role to read the object successfully? Select two.

Accepted Answer

Add kms:Decrypt permission in the role's IAM policy for the KMS key.. The role in Account B needs explicit kms:Decrypt permission in its IAM policy to use the KMS key for decrypting the S3 objects. Option C is correct because the KMS key policy in Account A must grant the role from Account B permission to call kms:Decrypt, as the key is customer managed and cross-account access requires both the key policy and the IAM policy to allow the action.

Answer

Add an SCP that grants the role additional permissions for KMS usage.

Answer

Grant the role read access with an S3 bucket ACL.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 9

Based on the exhibit, the database must continue serving if the current Availability Zone fails. What should you change?

Accepted Answer

Modify the DB instance to use a Multi-AZ deployment.. Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, ensuring database availability without manual intervention. This meets the requirement of continuing service during an AZ failure.

Answer

Create a read replica in another Availability Zone and promote it manually if needed.

Answer

Increase the automated backup retention period to 30 days.

Answer

Resize the DB instance to a larger class.

Question 10

A customer-facing application has a relational data model and needs frequent complex queries (joins and aggregations), but it also experiences a significant read-heavy workload. Which design choice best improves read performance while keeping relational features?

Accepted Answer

Add read replicas to an RDS or Aurora cluster and keep the primary for writes.. Adding read replicas to an RDS or Aurora cluster offloads read traffic from the primary instance, improving read performance for complex queries (joins and aggregations) while preserving the relational data model. Aurora automatically scales read replicas and uses a shared storage volume, making this highly efficient for read-heavy workloads.

Answer

Use DynamoDB with a single partition key and avoid indexes to keep writes simple.

Answer

Store the data in S3 and query it directly from the application without a database.

Answer

Switch the database to DynamoDB but keep using the same relational SQL queries and joins.

Question 11

A company uses AWS Organizations and has separate development, test, and production accounts. The security team wants to ensure that no one in the sandbox organizational unit can disable AWS CloudTrail or delete the central audit bucket, even if an account administrator creates permissive IAM policies later. Which control should they use?

Accepted Answer

Use a service control policy on the sandbox organizational unit to deny the prohibited actions.. Service control policies (SCPs) are the correct mechanism because they act as a centralized guardrail at the AWS Organizations level, setting maximum permissions for all accounts in an organizational unit (OU). Even if an account administrator creates permissive IAM policies later, an SCP that explicitly denies disabling CloudTrail or deleting the central audit bucket will override those permissions, ensuring the security team's requirements are enforced across the sandbox OU.

Answer

Attach an identity-based policy in each account that denies CloudTrail changes.

Answer

Create an S3 bucket policy that allows only the audit team role to delete objects.

Answer

Apply a permission boundary to each IAM user in the sandbox accounts.

Question 12

A web application uses an Amazon Aurora DB cluster. The workload is becoming read-heavy, and the application team wants to increase read throughput without changing the database schema. They can adjust the application to route reads differently. What should they do?

Accepted Answer

Add Aurora read replicas and route read queries to the cluster reader endpoint. Adding Aurora read replicas and routing read queries to the cluster reader endpoint is the correct approach because Aurora replicas share the same underlying storage volume as the primary instance, so they can serve read traffic with minimal replication lag. The reader endpoint automatically load-balances connections across all available replicas, increasing aggregate read throughput without requiring any schema changes.

Answer

Switch the cluster to Multi-AZ with a longer failover target clock

Answer

Move all reads to the writer endpoint to reduce connection overhead

Answer

Disable automated backups to reduce storage overhead and speed reads

Question 13

A security analyst needs to let an external vendor (AWS account 555566667777) read data from a set of internal resources in your AWS account. You created an IAM role called VendorReadRole with a policy that allows the required API calls. However, when the vendor tries to access, CloudTrail shows the call fails at AssumeRole with: "Not authorized to perform: sts:AssumeRole".

What is the most appropriate fix?

Accepted Answer

Add an allow statement for the vendor in the role’s trust policy to permit sts:AssumeRole from the vendor account (and include any required ExternalId condition).. The error 'Not authorized to perform: sts:AssumeRole' indicates that the role's trust policy does not grant the external AWS account (555566667777) permission to assume the role. The trust policy must include an Allow statement with the sts:AssumeRole action, specifying the external account as the principal, and optionally an ExternalId condition to prevent the confused deputy problem. Without this trust policy configuration, even if the permissions policy allows the required API calls, the vendor cannot assume the role.

Answer

Attach the same allow policy to the vendor account’s existing IAM user so the user can call sts:AssumeRole directly into your role.

Answer

Replace the AssumeRole call with GetCallerIdentity so the vendor can infer permissions without assuming the role.

Answer

Enable MFA on the vendor’s IAM user and require MFA for your role using condition keys in the permissions policy.

Question 14

An orders service publishes payment instructions to an Amazon SQS queue. After occasional processing timeouts, the downstream consumer sometimes processes the same instruction twice, resulting in duplicate payment attempts. The team currently uses an SQS Standard queue with a visibility timeout of 2 minutes and relies on the consumer to finish before the timeout expires. What approach best improves resilience against duplicate processing?

Accepted Answer

Make the consumer idempotent using the order ID as a deduplication key, and set the visibility timeout longer than the worst-case processing time.. Making the consumer idempotent using the order ID as a deduplication key ensures that even if the same message is processed multiple times, the downstream system will only apply the payment once. Setting the visibility timeout longer than the worst-case processing time prevents the message from becoming visible again before the consumer finishes, eliminating the root cause of duplicate processing in a Standard queue.

Answer

Decrease visibility timeout to 10 seconds so duplicates are less likely to occur.

Answer

Use an EventBridge rule with a fixed retry policy that only retries when the payload matches exactly.

Answer

Enable a dead-letter queue (DLQ) only, without changing the queue type or consumer logic.

Question 15

A website serves versioned JavaScript and CSS files through CloudFront, but origin fetches are still high and the CloudFront bill increased. Developers confirm that URLs include a version in the filename (for example, app.1.4.2.js). What CloudFront behavior/configuration is most likely to reduce origin fetches and associated costs?

Accepted Answer

Set long cache headers (for example, Cache-Control: max-age and immutable) on those versioned assets so CloudFront caches them longer.. Setting long cache headers like `Cache-Control: max-age=31536000, immutable` on versioned assets tells CloudFront to cache these objects at edge locations for an extended period. Since the filename changes with each new version, CloudFront treats each version as a unique object and will not re-fetch the old version from the origin, dramatically reducing origin fetches and associated costs.

Answer

Disable compression to reduce CPU time spent at the edge and therefore reduce total cost.

Answer

Lower the cache policy TTLs so clients always get the newest assets quickly.

Answer

Remove version identifiers from filenames so CloudFront caches fewer unique objects.