SAA-C03 Practice Test 28 — 15 Questions

Question 1

A company runs a SaaS application with highly unpredictable database load — it may receive zero queries for hours, then spike to thousands of queries per second briefly. The company wants to minimize database costs while handling all load levels without manual scaling. Which solution is MOST cost-effective?

Accepted Answer

Amazon Aurora Serverless v2 — scales automatically from minimum capacity during idle to maximum during spikes. Amazon Aurora Serverless v2 automatically scales database capacity based on actual load. It scales from a minimum of 0.5 ACUs during quiet periods to up to 128 ACUs during spikes within seconds. You pay only for the ACUs consumed — idle periods cost near-minimum.

Aurora Provisioned requires pre-provisioning capacity for peak load, incurring full instance costs regardless of actual utilization. Even with Auto Scaling, the primary instance has a minimum provisioned capacity that runs at full cost during idle periods.

Answer

Amazon Aurora Provisioned with Auto Scaling to add and remove read replicas

Answer

Amazon RDS MySQL with scheduled stop/start to save costs during predictable off-hours

Answer

Amazon DynamoDB with on-demand capacity mode — scales to any traffic level with no minimum cost

Question 2

A company uses AWS Organizations and wants to prevent any account in the organization from launching resources in regions other than us-east-1 and eu-west-1. This restriction must apply even if an administrator in a member account grants full IAM permissions. Which approach should a solutions architect use?

Accepted Answer

Create an SCP with a Deny on all actions for regions outside us-east-1 and eu-west-1, attached to the Organization root. Service Control Policies (SCPs) in AWS Organizations provide a guardrail that applies to all principals in member accounts — including IAM users, roles, and even the account root. SCPs restrict the maximum permissions that can be granted within an account.

An SCP with Deny on all actions for all regions except us-east-1 and eu-west-1, attached to the organization root, prevents any account from launching resources in other regions regardless of account-level IAM permissions. IAM policies in member accounts cannot override SCPs.

Answer

Create IAM policies with Deny for disallowed regions and attach them to all IAM users and roles in each account

Answer

Enable AWS Config rules to detect resources launched in disallowed regions and trigger auto-remediation to delete them

Answer

Use AWS Control Tower guardrails to enforce region restriction for all accounts

Question 3

A company runs a production MySQL database on Amazon RDS in us-east-1. A read replica exists in us-west-2 for disaster recovery. The primary region experiences a complete outage. Which of the following describes the correct procedure to restore database service using the cross-region read replica?

Accepted Answer

Manually promote the us-west-2 read replica to a standalone DB instance and update application endpoints. Cross-region RDS read replicas support manual promotion to a standalone database instance. When the primary region fails, the replica must be manually promoted — this makes it an independent writable instance in us-west-2.

Key points: Promotion is NOT automatic (unlike RDS Multi-AZ failover). Promotion breaks the replication link — the replica becomes autonomous. After promotion, application connection strings must be updated to the new endpoint. Any replication lag at the time of the outage represents potential data loss (RPO > 0).

Answer

Wait for AWS to automatically fail over the read replica to become the new primary

Answer

Restore the primary database from the most recent automated snapshot in us-west-2

Answer

Create a new RDS instance in us-west-2 and manually restore data from application logs

Question 4

A company uses Amazon SQS and AWS Lambda to process orders. Lambda typically completes in 4 minutes, but complex orders can take up to 12 minutes. The team reports that some orders are being processed more than once. Which is the MOST likely cause and the recommended fix?

Accepted Answer

Increase the SQS queue visibility timeout to exceed the maximum Lambda processing time. SQS visibility timeout defines how long a message is hidden from other consumers after it is received. If a Lambda function takes longer than the visibility timeout to process a message, the message becomes visible again and another Lambda invocation picks it up — causing duplicate processing.

The default SQS visibility timeout is 30 seconds. If processing takes 12 minutes but visibility timeout is 30 seconds, messages reappear and are processed again. The fix is to increase the visibility timeout to exceed the maximum processing time — at least 13-15 minutes.

Answer

Enable SQS FIFO queue to prevent duplicate message delivery

Answer

Reduce the Lambda function timeout to 4 minutes to match typical processing time

Answer

Enable SQS long polling to reduce the frequency of message retrieval

Question 5

A company hosts a web application on EC2 instances behind an Application Load Balancer (ALB) in us-east-1. A static failover site is hosted in an S3 bucket with static website hosting enabled. The company needs automatic DNS failover to the S3 bucket if the primary ALB becomes unhealthy. Which Route 53 configuration achieves this?

Accepted Answer

Configure Route 53 Failover routing with a health check on the ALB as PRIMARY and the S3 bucket website endpoint as SECONDARY. Route 53 Failover routing uses health checks to route traffic to a primary resource and automatically switch to a secondary when the primary health check fails.

Configuration: Create a Route 53 health check targeting the ALB endpoint. Create a PRIMARY alias A record pointing to the ALB with the health check associated. Create a SECONDARY alias A record pointing to the S3 static website endpoint. When the ALB health check fails, Route 53 returns the S3 endpoint automatically.

Answer

Configure Route 53 Weighted routing with 100% weight on the ALB and 0% on the S3 bucket

Answer

Configure Route 53 Latency routing with records in both regions to route to the healthiest endpoint

Answer

Configure Route 53 Geolocation routing with North American users directed to the ALB and all others to S3

Question 6

A company needs to implement session management for a web application. Sessions must persist across multiple EC2 instances, survive EC2 failures, and be accessible with sub-millisecond latency. Sessions must also be sortable by last-access time to expire the oldest sessions first. Which caching solution should a solutions architect recommend?

Accepted Answer

Amazon ElastiCache for Redis with sessions stored as sorted sets. Amazon ElastiCache for Redis satisfies all requirements: multi-instance session sharing (sessions stored externally), sub-millisecond latency, survival of EC2 failures (stored outside instances), and sorted sets (ZSET data structure) for ordering sessions by last-access score.

Memcached supports only simple key-value pairs — it cannot perform sorted set operations to order sessions by last-access time. Memcached also lacks replication, meaning a node failure loses all cached sessions.

Answer

Amazon ElastiCache for Memcached with session data stored as key-value pairs

Answer

Amazon DynamoDB with TTL enabled for session expiration

Answer

ElastiCache for Redis with sticky sessions enabled on the Application Load Balancer

Question 7

A company needs to replicate a DynamoDB table to three AWS regions so that users in each region can read and write to a local copy with the lowest possible latency. Changes must propagate to all regions within seconds. Which solution should a solutions architect implement?

Accepted Answer

Configure DynamoDB Global Tables with replica tables in each of the three regions. DynamoDB Global Tables provide multi-region, multi-active (multi-master) replication. Each region maintains a full replica of the table, and applications can read and write to any region with local latency. Changes propagate to all other regions typically within one second.

DynamoDB Streams + Lambda is the underlying mechanism that Global Tables uses internally, but building a custom replication pipeline adds significant operational complexity. Global Tables is the managed, purpose-built solution requiring no custom code.

Answer

Enable DynamoDB Streams and use Lambda functions to replicate changes to tables in the other two regions

Answer

Create DynamoDB read replicas in each region and use the primary table for all writes

Answer

Use Amazon S3 cross-region replication to back up DynamoDB exports to each region

Question 8

An event-ingestion application writes telemetry to DynamoDB with partition key tenantId and sort key eventTime. During a promotion, one tenant generates 10 times the normal traffic. Dashboards repeatedly query the most recent items for that tenant, and they can tolerate slightly stale data. Which changes would most effectively reduce throttling and improve responsiveness? Select three.

Accepted Answer

Introduce a sharded partition key for the hot tenant and query the small shard set when reading recent data.. Option A is correct because introducing a sharded partition key (e.g., tenantId#shardId) for the hot tenant spreads its write traffic across multiple physical partitions, reducing throttling. When querying recent data, the dashboard can read from a small, fixed set of shards (e.g., 10 shards) and merge results, which is efficient and tolerates the slight staleness. This pattern directly addresses the hot partition issue without requiring application-level aggregation.

Answer

Increase only the sort-key cardinality while leaving the partition key unchanged.

Answer

Move the table to the Standard-IA table class because throttling is usually caused by storage class selection.

Question 9

Account A hosts an IAM role that Account B developers must assume for a limited task. You want to require MFA for anyone assuming the role. Which trust policy condition most directly enforces that requirement for sts:AssumeRole?

Accepted Answer

Add a statement condition requiring "Bool": {"aws:MultiFactorAuthPresent": "true"} in the role trust policy.. Option A is correct because the `aws:MultiFactorAuthPresent` condition key in the role trust policy directly checks whether the caller authenticated with a valid MFA device before calling `sts:AssumeRole`. When set to "true" with a Bool condition, it enforces that the session must have been established after MFA verification, which is the most direct and standard way to require MFA for role assumption.

Answer

Add a condition requiring "StringEquals": {"aws:PrincipalOrgID": "o-example"} without any MFA condition.

Answer

Add a statement that denies sts:AssumeRole when the requested role session name contains the text "dev".

Answer

Require HTTPS by setting a condition on "aws:SecureTransport": "true" in the trust policy.

Question 10

Account A has an IAM role named FinanceDataRole that is assumed by a principal in Account B. The role’s trust policy includes a condition requiring sts:ExternalId to equal "Fin-2026-Q2". A developer in Account B calls AssumeRole but receives an error: AccessDenied: ExternalId mismatch. The security team requires that you do not remove the ExternalId condition. What is the correct remediation?

Accepted Answer

Update the AssumeRole call in Account B to include sts:ExternalId="Fin-2026-Q2" exactly as required.. The error 'AccessDenied: ExternalId mismatch' occurs because the AssumeRole API call from Account B does not include the required sts:ExternalId parameter. The trust policy on the FinanceDataRole explicitly requires this parameter to match 'Fin-2026-Q2' as a security measure to prevent the confused deputy problem. Option B is correct because the developer must pass the exact ExternalId value in the AssumeRole request to satisfy the condition and successfully assume the role.

Answer

Add kms:Decrypt to the developer’s IAM policy so KMS can validate the ExternalId during AssumeRole.

Answer

Increase the role’s MaxSessionDuration to reduce authentication failures.

Answer

Remove the ExternalId condition from the trust policy to allow all AssumeRole requests.

Question 11

A web application for a mobile banking backend is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy?

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). By associating an AWS WAF web ACL with the Application Load Balancer, you can filter and monitor HTTP(S) requests based on rules that block these attack patterns, all without managing any infrastructure. This provides the required protection with minimal operational overhead because AWS WAF is a fully managed service that integrates directly with ALB.

Answer

Security groups on the application instances

Answer

Network ACLs on the public subnets

Answer

AWS Shield Advanced only

Question 12

A team runs an EC2-based service and ships logs to Amazon CloudWatch Logs. They enabled long log retention and turned on detailed monitoring to improve troubleshooting. Their monthly CloudWatch costs have grown unexpectedly. Compliance requires that the logs remain available in CloudWatch Logs (for querying and audits) for 90 days, and alerts/alarms do not require detailed EC2 monitoring. What change best reduces cost while meeting requirements?

Accepted Answer

Set the CloudWatch Logs retention to 90 days and disable detailed EC2 monitoring (use standard monitoring) for the instances. Option B reduces costs by setting CloudWatch Logs retention to exactly 90 days (meeting compliance) and disabling detailed monitoring (which incurs per-minute metrics charges) in favor of standard 5-minute monitoring. This directly addresses the two main cost drivers—long retention and detailed EC2 monitoring—while preserving the required 90-day log availability for queries and audits.

Answer

Keep the current long retention and detailed monitoring; reduce the log volume by sampling 10% of events

Answer

Move all logs to S3 immediately and delete the CloudWatch log groups to reduce costs

Answer

Increase CloudWatch alarm thresholds to reduce the number of metric datapoints

Question 13

An API team runs an AWS Lambda function behind an Application Load Balancer (ALB). During predictable hourly traffic spikes, p95 response latency increases due to occasional cold starts. The team wants stable latency during those spikes without permanently overprovisioning resources for all functions. Which configuration is the most appropriate way to reduce cold starts for this Lambda function?

Accepted Answer

Publish a version of the function and configure provisioned concurrency on an alias, using autoscaling for the alias.. Provisioned concurrency initializes a specified number of execution environments in advance, keeping them warm and ready to handle requests without cold start latency. By configuring provisioned concurrency on an alias with autoscaling, the team can dynamically adjust the number of pre-warmed environments to match predictable traffic spikes, avoiding permanent overprovisioning while ensuring stable p95 latency.

Answer

Increase the function memory size and rely on faster initialization to reduce cold starts.

Answer

Set reserved concurrency equal to the expected peak requests per second for the function.

Answer

Use an event source mapping with a higher batch size so Lambda triggers earlier and keeps the runtime warm.

Question 14

A team stores application logs in Amazon S3. They need access to the logs only occasionally for troubleshooting (infrequent access), and they want to reduce storage cost automatically over time without manually moving objects. What should they implement?

Accepted Answer

An S3 lifecycle policy that transitions objects to a lower-cost storage class after a set number of days. Option A is correct because an S3 lifecycle policy can automatically transition objects from S3 Standard to lower-cost storage classes (e.g., S3 Standard-IA, S3 One Zone-IA, or S3 Glacier Instant Retrieval) after a specified number of days. This meets the requirement of reducing storage costs over time for infrequently accessed logs without manual intervention, as the policy automates the movement based on object age.

Answer

An S3 lifecycle policy that deletes objects after 1 day to eliminate storage costs

Answer

An S3 lifecycle policy that keeps all objects in S3 Standard and only applies compression at read time

Answer

A policy that changes bucket encryption from SSE-S3 to SSE-KMS to reduce storage cost

Question 15

A analytics dashboard uses an Application Load Balancer in one Region. Global users need lower network latency to the application without caching dynamic responses. What should be considered? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to route traffic from edge locations to the optimal regional endpoint, reducing latency and jitter for global users. It does not cache content, making it ideal for dynamic responses that cannot be cached. The service requires no custom scripts, as it integrates directly with the Application Load Balancer via a static IP address or DNS name.

Answer

S3 Cross-Region Replication

Answer

AWS Backup cross-Region copy

Answer

CloudFront only with long TTLs