SAA-C03 Practice Test 27 — 15 Questions

Question 1

Based on the exhibit, some SQS messages fail validation repeatedly and continue consuming worker time. What change best prevents the bad messages from being retried forever?

Accepted Answer

Configure a dead-letter queue and a redrive policy for messages that exceed the retry limit.. A dead-letter queue (DLQ) with a redrive policy allows messages that have been received a maximum number of times (e.g., after the configured retry limit) to be moved to a separate queue for analysis or manual handling. This prevents the same invalid message from being repeatedly processed by workers, freeing up compute resources and avoiding infinite retry loops.

Answer

Increase the visibility timeout so each message has more time to finish processing.

Answer

Replace the queue with an Amazon SNS topic so failed messages will not be retried.

Answer

Increase the number of workers so the queue drains faster during peak load.

Question 2

A company stores RDS database credentials in AWS Systems Manager Parameter Store as SecureString parameters. The security team requires that database passwords rotate automatically every 30 days. Which change should a solutions architect recommend?

Accepted Answer

Migrate the credentials to AWS Secrets Manager and enable automatic rotation with a 30-day schedule. AWS Secrets Manager provides native automatic rotation for RDS credentials using a managed Lambda function that rotates the secret on a defined schedule and updates the database password atomically.

Parameter Store SecureString does not support built-in automatic rotation — rotation must be implemented manually with custom automation. Secrets Manager is specifically designed for secrets requiring lifecycle management including rotation, auditing, and fine-grained access control.

Answer

Create a scheduled EventBridge rule to invoke a Lambda function that updates the Parameter Store SecureString value every 30 days

Answer

Enable Parameter Store SecureString automatic rotation in the AWS console

Answer

Configure AWS Config to detect password age and trigger an SNS notification after 30 days

Question 3

An engineering team runs application servers in private subnets. The instances must download patches and software packages from Amazon S3, but the company does not want the traffic to traverse the internet or a NAT gateway. Which design should they use?

Accepted Answer

Use an Amazon S3 gateway VPC endpoint in the route tables for the private subnets.. An S3 Gateway VPC endpoint allows instances in private subnets to access Amazon S3 without traversing the internet or a NAT gateway. The endpoint uses AWS’s internal network and is added to the route table of the private subnets, directing S3 traffic through the endpoint prefix list. This design meets the requirement of keeping traffic off the internet while providing secure, low-latency access to S3.

Answer

Add an internet gateway to the VPC and route private subnet traffic through it.

Answer

Use a security group rule that allows outbound traffic to the S3 public IP range.

Answer

Create a VPC peering connection to the S3 service VPC.

Question 4

Based on the exhibit, the security team wants centralized detection and alerting for both successful and failed attempts to change S3 bucket policies and KMS key policies across multiple accounts. Which approach best meets the requirement?

Accepted Answer

Create an organization CloudTrail trail for management events and add EventBridge rules in the security account to alert on PutBucketPolicy and PutKeyPolicy events, including failed calls.. An organization CloudTrail trail captures management events (including PutBucketPolicy and PutKeyPolicy) across all accounts in the organization, and EventBridge rules in the security account can filter for both successful and failed API calls (using the `errorCode` field) to trigger centralized alerts. This provides the required centralized detection and alerting for policy changes across multiple accounts.

Answer

Enable S3 server access logging on each bucket and archive the logs in the security account.

Answer

Use AWS Config rules only, because Config records every successful and failed API call automatically.

Answer

Enable GuardDuty in every account and use its findings as the main source for policy change notifications.

Question 5

You have EC2 instances in private subnets with no NAT gateway. They must retrieve secrets from AWS Secrets Manager without sending traffic to the public internet. Which VPC endpoint type is the correct choice for connecting to AWS Secrets Manager?

Accepted Answer

Create an Interface VPC endpoint (AWS PrivateLink) for Secrets Manager and associate security groups for the endpoint.. AWS Secrets Manager is accessed via an API endpoint that uses HTTPS. Interface VPC endpoints (AWS PrivateLink) are the correct choice for connecting to services like Secrets Manager because they use elastic network interfaces (ENIs) with private IPs in your VPC, allowing traffic to stay within the AWS network. Gateway endpoints only support S3 and DynamoDB, not Secrets Manager.

Answer

Create a Gateway VPC endpoint for Secrets Manager.

Answer

Use a Transit Gateway attachment to route traffic to the public internet for Secrets Manager.

Answer

Deploy a NAT gateway and allow outbound HTTPS traffic to Secrets Manager.

Question 6

Based on the exhibit, a batch-processing service runs on Amazon EC2. The workload is Linux-based, can run on ARM64, and is CPU-bound during its nightly processing window. The team wants the best throughput per dollar without changing the application logic. Which EC2 instance family should the solutions architect recommend?

Accepted Answer

C7g instances based on AWS Graviton processors. The C7g instances are based on AWS Graviton processors (ARM64 architecture), which offer up to 25% better performance per dollar compared to x86-based instances for CPU-bound workloads. Since the workload is Linux-based, can run on ARM64, and is CPU-bound, the C7g family provides the best throughput per dollar without requiring any application logic changes.

Answer

R7i instances because more memory will improve CPU-bound job throughput.

Answer

M7a instances because general-purpose families are always the safest performance choice.

Answer

T3 instances because burstable instances can handle occasional nighttime spikes at lower cost.

Question 7

A SaaS platform plans to run in two AWS Regions for lower latency. The team wants to enable active-active writes (both regions accept updates) to avoid failover downtime. However, the business requires strong consistency for order status transitions (for example, only one transition from “Paid” to “Shipped” must be allowed).

Which statement is the best architectural choice to meet the consistency requirement?

Accepted Answer

Use active-active writes only when the workload tolerates eventual consistency; for strongly consistent transitions, use a single-writer pattern with failover (active-passive/pilot light).. Active-active writes across AWS Regions cannot guarantee strong consistency due to the inherent latency and lack of synchronous replication between Regions. For order status transitions that require exactly-once semantics (e.g., only one transition from 'Paid' to 'Shipped'), a single-writer pattern (active-passive or pilot light) ensures that only one Region accepts writes at a time, avoiding conflicts and maintaining a single source of truth. AWS services like DynamoDB global tables offer eventual consistency for multi-region writes, while Aurora Global Database provides read replicas with failover but not active-active writes for strong consistency.

Answer

Active-active writes always provide strong consistency because AWS replicates data across Regions automatically and immediately.

Answer

Active-active writes can be used safely by simply enabling retries and expecting the application to resolve conflicts without coordination.

Answer

To ensure strong consistency, run both Regions with different IAM roles and block cross-Region writes at the API layer only.

Question 8

A team serves image files from S3 through CloudFront. During a performance review, they notice that CloudFront cache hit ratio is low and the S3 origin receives many repeated requests for the same images. Request URLs include a volatile query parameter called 'sessionId' that changes for each user, but the image content is identical regardless of 'sessionId'. What configuration change will most effectively increase cache hit ratio?

Accepted Answer

Update the CloudFront cache policy so that 'sessionId' is not included in the cache key (and only stable query parameters are used).. The low cache hit ratio is caused by the volatile 'sessionId' query parameter being included in the CloudFront cache key, which creates a unique cache entry for every user request even though the image content is identical. By updating the cache policy to exclude 'sessionId' from the cache key, CloudFront will treat all requests for the same image as the same cached object, dramatically increasing the cache hit ratio and reducing load on the S3 origin.

Answer

Enable origin request policy to forward all query strings to S3 so responses are always correct for every sessionId.

Answer

Set the CloudFront minimum TTL to 0 seconds so cached objects expire quickly and fetch fresh content more often.

Answer

Disable caching by using CloudFront managed caching disabled so that every request validates with the origin.

Question 9

A data processing application runs on a single EC2 instance and needs persistent block storage with sustained low-latency random read/write performance (high IOPS). Which storage choice is most appropriate?

Accepted Answer

EBS io2 provisioned IOPS SSD. Amazon EBS io2 Provisioned IOPS SSD volumes are designed for I/O-intensive workloads that require sustained, low-latency random read/write performance with high IOPS. They provide consistent performance by allowing you to provision a specific IOPS level (up to 256,000 IOPS per volume) and offer a 99.999% durability guarantee, making them ideal for a single EC2 instance needing persistent block storage.

Answer

Amazon S3 Standard

Answer

Amazon EFS for POSIX file sharing between multiple instances

Answer

EBS Throughput Optimized HDD (st1) storage

Question 10

A Lambda function for a IoT ingestion API needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, automatically rotating, and managing secrets such as database passwords. With rotation enabled, Secrets Manager can automatically rotate the password every 30 days without requiring custom code, and it integrates natively with Lambda via the AWS SDK to retrieve the secret at runtime, avoiding storage in environment variables.

Answer

A KMS-encrypted Lambda environment variable

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

An encrypted object in Amazon S3

Question 11

A serverless checkout API uses AWS Lambda behind API Gateway. Every weekday at 09:00 UTC, marketing triggers a predictable surge. The first few minutes after each surge show cold-start latency, but traffic volume is forecastable and the business wants stable p95 latency. Which two changes should the team implement? Select two.

Accepted Answer

Publish a Lambda version and attach provisioned concurrency to an alias that points to that version.. Provisioned concurrency keeps a specified number of Lambda execution environments initialized and ready to respond immediately, eliminating cold starts for predictable traffic patterns. By publishing a Lambda version and attaching provisioned concurrency to an alias pointing to that version, the team ensures that the surge at 09:00 UTC is handled without cold-start latency, stabilizing p95 latency.

Answer

Increase the Lambda timeout so the function has more time to initialize during the spike.

Answer

Double the memory size during the spike without changing the concurrency model.

Answer

Move the function into more Availability Zones so the platform can spread cold starts across regions.

Question 12

An Aurora PostgreSQL application has an OLTP writer and a reporting dashboard that issues many read-only queries. The writer is healthy, but read latency rises noticeably during reporting windows. Which two changes should you make? Select two.

Accepted Answer

Add Aurora Replicas to scale out the read workload.. Adding Aurora Replicas (Option A) is correct because Aurora Replicas are dedicated read-only instances that share the same underlying storage volume as the writer, allowing you to scale read capacity linearly without impacting write performance. Sending read-only traffic to the reader endpoint (Option B) is correct because the reader endpoint automatically load-balances connections across all available Aurora Replicas, ensuring that dashboard queries are distributed and do not overload a single instance.

Answer

Scale up only the writer instance and keep all queries on it.

Answer

Replace the cluster with a single-AZ RDS instance to reduce replication overhead.

Answer

Move the dashboard to DynamoDB without changing the query model.

Question 13

A media company runs a batch job that processes image thumbnails. The job can be restarted from checkpoints and does not have user-facing SLAs. The batch capacity can tolerate interruptions. Which EC2 purchasing option is the best cost optimization choice?

Accepted Answer

Use EC2 Spot Instances, accepting the possibility of interruptions and using checkpoints to resume.. Spot Instances offer significant cost savings (up to 90% compared to On-Demand) and are ideal for fault-tolerant, stateless, or checkpointable workloads. Since the batch job can restart from checkpoints and tolerates interruptions, Spot Instances provide the best cost optimization without compromising functionality.

Answer

Use On-Demand Instances because interruptions are not allowed for production workloads.

Answer

Purchase Reserved Instances because they provide a discount regardless of the workload timing.

Answer

Buy Savings Plans because they guarantee capacity and remove the risk of interruptions entirely.

Question 14

A company keeps daily database backups in an S3 bucket. They may restore from backups during the first 30 days if there is an issue. After 30 days, backups are rarely restored, but must be retained for 2 years. Which lifecycle strategy most cost-effectively meets these requirements?

Accepted Answer

Use an S3 lifecycle policy to keep backups in S3 Standard for 30 days, then transition them to S3 Glacier Deep Archive for the remainder of the 2-year retention period.. It balances cost and compliance: backups are kept in S3 Standard for the first 30 days when restores are frequent, ensuring low-latency access, then transitioned to S3 Glacier Deep Archive for the remaining retention period. S3 Glacier Deep Archive offers the lowest storage cost (approximately $0.00099/GB/month) for long-term retention, and the lifecycle policy automates the transition without manual intervention. This approach minimizes storage costs while meeting the 2-year retention requirement.

Answer

Delete backups after 30 days to avoid storage costs, since restores are rare.

Answer

Keep all backups in S3 Standard for the entire 2-year retention period.

Answer

Move backups to S3 Glacier Deep Archive immediately after creation, even for the first 30 days.

Question 15

A company serves a public API through a CloudFront distribution. They want to automatically block common web exploits (for example, OWASP Top 10–style threats) without building custom detection logic. Which AWS service configuration best meets the goal?

Accepted Answer

Enable AWS WAF with AWS Managed Rules and associate the web ACL with the CloudFront distribution.. AWS WAF with AWS Managed Rules provides pre-configured rule sets specifically designed to block common web exploits, including OWASP Top 10 threats, without requiring custom detection logic. By associating the web ACL with a CloudFront distribution, the filtering occurs at the edge, protecting the origin from malicious traffic before it reaches the application.

Answer

Enable AWS Shield Advanced only; it fully replaces the need for WAF rule evaluation.

Answer

Attach a security group rule to the ALB to block malicious patterns based on HTTP request bodies.

Answer

Use Security Hub to block requests automatically when it detects suspicious activity.