SAA-C03 Practice Test 28 — 15 Questions

Question 1

A marketing site stores logs in S3. Logs are queried for 30 days, rarely accessed for one year, and then retained for compliance. What should reduce storage cost? The architecture review board prefers a managed AWS-native control.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

S3 lifecycle policy that transitions objects to lower-cost storage classes over time. An S3 Lifecycle policy is a managed AWS-native feature that automatically transitions objects to lower-cost storage classes (e.g., S3 Standard-IA after 30 days, S3 Glacier Instant Retrieval or S3 Glacier Flexible Retrieval after one year) based on age, reducing storage costs while maintaining compliance. This aligns with the access pattern: frequent queries for 30 days, rare access for a year, then long-term retention. It avoids manual intervention and optimizes cost without sacrificing availability or retrieval needs.

Answer

Keep all logs in S3 Standard indefinitely

Answer

Use EBS snapshots for the logs

Answer

Move all logs immediately to S3 Glacier Deep Archive

Question 2

A web application for a order processing API is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy?

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS) attacks. By associating an AWS WAF web ACL with the Application Load Balancer, you can filter and monitor HTTP/HTTPS requests based on customizable rules, providing application-layer protection with minimal operational overhead since AWS manages the underlying infrastructure and rule updates.

Answer

Security groups on the application instances

Answer

Network ACLs on the public subnets

Answer

AWS Shield Advanced only

Question 3

A patient portal receives bursts of orders that sometimes overwhelm a downstream fulfilment service. The architecture must absorb spikes and retry processing without losing requests. Which service should be placed between the web tier and fulfilment workers?

Accepted Answer

Amazon SQS queue. Amazon SQS is the correct choice because it acts as a durable, highly available message buffer between the web tier and the fulfilment workers. It decouples the components, allowing the web tier to enqueue requests immediately without waiting for the downstream service, and the workers can poll and process messages at their own pace. SQS automatically retains messages for up to 14 days and supports retries via a dead-letter queue, ensuring no requests are lost even during spikes.

Answer

AWS WAF

Answer

Amazon CloudFront

Answer

Amazon Route 53 weighted routing

Question 4

A ticket booking system runs on EC2 instances behind an Application Load Balancer. The design must tolerate the failure of one Availability Zone. What should the Auto Scaling group configuration include?

Accepted Answer

Subnets in at least two Availability Zones with health checks enabled. An Auto Scaling group configured with subnets in at least two Availability Zones and health checks enabled ensures that if one AZ fails, EC2 instances in the remaining AZs continue to serve traffic. The Application Load Balancer distributes requests across healthy instances in multiple AZs, and the Auto Scaling group replaces failed instances in the affected AZ, maintaining capacity. This design meets the requirement to tolerate the failure of one Availability Zone.

Answer

All instances in one larger subnet

Answer

A Network Load Balancer in one subnet

Answer

A single EC2 instance with detailed monitoring

Question 5

A warehouse integration service must process every event at least once, but duplicate processing is acceptable if the consumer handles idempotency. Which eventing approach is most suitable? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Use Amazon SQS standard queue and design consumers to be idempotent. Amazon SQS standard queues provide at-least-once delivery, which guarantees that every message is processed at least once, meeting the requirement that every event must be processed. Duplicate processing is acceptable because the consumer can be designed to handle idempotency. This is a managed, AWS-native service that aligns with the architecture review board's preference.

Answer

Use CloudFront signed URLs

Answer

Use UDP messages sent directly to workers

Answer

Use an in-memory queue on one EC2 instance

Question 6

A web application uses an Amazon Aurora DB cluster for a read-heavy workload. The application team needs higher read throughput but cannot change the database schema. They want to avoid blocking writes and are willing to route read traffic separately. What is the most appropriate architecture change?

Accepted Answer

Create Aurora read replicas and route SELECT queries to an Aurora reader endpoint.. Creating Aurora read replicas and routing SELECT queries to the Aurora reader endpoint is the most appropriate architecture change because Aurora's reader endpoint distributes read traffic across up to 15 low-latency read replicas, providing higher aggregate read throughput without blocking writes. This approach requires no schema changes and allows the application to separate read and write traffic, directly addressing the read-heavy workload requirement.

Answer

Scale up the writer instance storage only; read capacity will automatically increase without using a reader endpoint.

Answer

Move the Aurora cluster to Multi-AZ deployment mode only; read scaling is handled automatically without replicas.

Answer

Replace the cluster with a single RDS instance because it offers consistent performance for both reads and writes.

Question 7

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use?

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) enable private connectivity to Systems Manager Parameter Store by creating an elastic network interface in the subnet with a private IP, allowing the application to read parameters without traversing the internet. Gateway VPC endpoints for S3 provide private access to S3 objects via route table entries, using the S3 public IP space but staying within the AWS network, avoiding the need for an internet gateway or NAT gateway.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 8

A global application experiences frequent writes and must survive a full Regional outage with near-zero data loss. The product team also requires that users can continue to write during the incident using the closest Region. Which approach is most aligned with these requirements?

Accepted Answer

Use an active/active design with multi-Region data replication (for example, global tables for the write-heavy datastore) and route traffic to multiple Regions based on health and latency.. An active/active design with multi-Region data replication, such as Amazon DynamoDB global tables, allows writes to occur in any Region and replicates them to all other Regions with near-real-time latency (typically sub-second). This meets the requirement for near-zero data loss during a full Regional outage, as data is asynchronously replicated to multiple Regions, and users can continue writing to the closest healthy Region via Route 53 latency-based or geolocation routing.

Answer

Use warm standby with periodic backups of the primary write datastore every 24 hours.

Answer

Use pilot light where the secondary Region runs only infrastructure templates and starts data replication only after detecting failure.

Answer

Use a single-writer model in one Region and deploy read-only replicas in the other Region for continuity.

Question 9

A media company stores original uploads in an S3 bucket. They must recover from accidental overwrites/deletes and also recover quickly from a full Region outage. The required RPO is about 1 hour. Which configuration best meets these requirements?

Accepted Answer

Enable S3 versioning and configure cross-Region replication to a bucket in another Region.. Enabling S3 versioning protects against accidental overwrites and deletes by preserving all object versions, while cross-Region replication (CRR) asynchronously replicates objects to a bucket in another Region, providing recovery from a full Region outage. With versioning enabled, CRR replicates both current and previous object versions, meeting the ~1-hour RPO (typically within minutes for new objects) and ensuring data durability across Regions.

Answer

Enable an S3 lifecycle policy to transition objects to Glacier after 7 days without enabling versioning.

Answer

Enable S3 cross-Region replication (CRR) but leave the bucket without versioning enabled.

Answer

Rely on frequent EBS snapshots of a temporary cache used during uploads.

Question 10

A batch analytics job currently uses two NAT gateways in each of three Availability Zones, but only one private subnet per AZ needs outbound internet access. What should the architect review first? The design must avoid adding custom operational scripts.

Accepted Answer

Whether one NAT gateway per AZ is sufficient for the required private subnets. The current setup uses two NAT gateways per AZ, which is likely over-provisioned and incurs unnecessary costs. Since only one private subnet per AZ requires outbound internet access, a single NAT gateway per AZ is typically sufficient to handle the traffic, and this is the first cost-optimization step to review before making other changes.

Answer

Replacing every NAT gateway with an internet gateway attached to private subnets

Answer

Disabling route tables

Answer

Moving all workloads to public subnets

Question 11

A production internal reporting portal runs continuously on EC2 with predictable usage for the next three years. The team wants a discount while retaining some instance-family flexibility. What should they buy?

Accepted Answer

Compute Savings Plan. A Compute Savings Plan offers the lowest prices on EC2 usage (up to 66% off On-Demand) in exchange for a 1- or 3-year commitment, and it automatically applies to any EC2 instance family in any region, giving the flexibility the team needs. Since the workload runs continuously with predictable usage for three years, this plan is ideal for reducing costs while retaining the ability to change instance families if needed.

Answer

Spot Instances only

Answer

Dedicated Instances

Answer

S3 Intelligent-Tiering

Question 12

An orders system sends payment instructions to an Amazon SQS queue. The consumer sometimes times out after it has already created the payment record but before it deletes the SQS message. As a result, the same instruction can be processed more than once. Which design best ensures the consumer remains resilient and does not create duplicate payments when the same instruction is delivered multiple times?

Accepted Answer

Use idempotency: store a deterministic payment request identifier in a DynamoDB table and only create a payment when a conditional write indicates it was not processed before.. It implements idempotency using a DynamoDB table with a conditional write. By storing a deterministic payment request identifier (e.g., a hash of the message body) and only creating the payment if the conditional write succeeds (i.e., the identifier does not already exist), the consumer can safely process the same SQS message multiple times without creating duplicate payments. This pattern ensures resilience against the at-least-once delivery semantics of SQS and consumer timeouts that prevent message deletion.

Answer

Assume the consumer will always delete the SQS message in the same execution path, and ignore the timeout case.

Answer

Switch to SQS Standard because it provides exactly-once delivery, so duplicates cannot happen.

Answer

Increase the consumer timeout and reduce the number of retries so that duplicates rarely occur.

Question 13

In AWS Organizations, a Service Control Policy (SCP) denies kms:Decrypt on a production CMK for all principals in the Finance OU. A developer in the Finance OU created/updated an IAM policy that allows secrets access, but the application still fails with AccessDenied due to the SCP. You must enable only the Finance OU to decrypt that specific CMK while keeping the SCP restrictions for other OUs. What is the correct remediation?

Accepted Answer

Modify the SCP so it no longer denies kms:Decrypt for that specific CMK when applied to the Finance OU, while preserving the deny behavior for other OUs.. SCPs are evaluated before IAM policies and cannot be bypassed by IAM permissions. By modifying the SCP to exclude the specific CMK for the Finance OU (e.g., using a Condition key like `kms:ViaService` or a resource-level exception), you remove the explicit deny for that OU while keeping it in place for all other OUs. This ensures the developer's IAM policy can then allow `kms:Decrypt` without being blocked by the SCP.

Answer

Update the developer’s IAM policy to allow kms:Decrypt on the CMK alias ARN so the request bypasses the SCP.

Answer

Add a KMS key policy statement that allows the developer role to decrypt the CMK.

Answer

Attach a permissions boundary that grants kms:Decrypt so the SCP becomes irrelevant.

Question 14

A warehouse integration service receives bursts of orders that sometimes overwhelm a downstream fulfilment service. The architecture must absorb spikes and retry processing without losing requests. Which service should be placed between the web tier and fulfilment workers? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Amazon SQS queue. Amazon SQS is the correct choice because it acts as a fully managed message queue that decouples the web tier from the fulfilment workers, buffering incoming order bursts. It provides at-least-once delivery and allows workers to poll messages at their own pace, ensuring no requests are lost even during spikes. SQS also supports retries via a dead-letter queue (DLQ) for messages that fail processing, meeting the requirement for resilient, managed AWS-native control.

Answer

AWS WAF

Answer

Amazon Route 53 weighted routing

Answer

Amazon CloudFront

Question 15

A dev sandbox has unpredictable DynamoDB traffic with long idle periods and occasional spikes. Which capacity mode should minimize operational overhead and avoid paying for idle provisioned capacity? The design must avoid adding custom operational scripts.

Accepted Answer

DynamoDB on-demand capacity mode. DynamoDB on-demand capacity mode is ideal for unpredictable workloads with long idle periods and occasional spikes because it automatically scales to handle traffic without requiring any capacity planning or provisioning. You pay only for the reads and writes you actually perform, eliminating the cost of idle provisioned capacity and the operational overhead of managing scaling scripts or alarms.

Answer

Reserved capacity for maximum daily traffic

Answer

Provisioned capacity set for peak traffic

Answer

Global tables in every Region