SAA-C03 Practice Test 29 — 15 Questions

Question 1

A test environment stores logs in S3. Logs are queried for 30 days, rarely accessed for one year, and then retained for compliance. What should reduce storage cost? The architecture review board prefers a managed AWS-native control.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

S3 lifecycle policy that transitions objects to lower-cost storage classes over time. S3 Lifecycle policies allow you to automate the transition of objects from S3 Standard to lower-cost storage classes like S3 Standard-IA (after 30 days) and then to S3 Glacier Deep Archive (after one year) for long-term compliance. This matches the access pattern of frequent queries for 30 days, rare access for a year, and then retention-only, minimizing storage costs without manual intervention.

Answer

Keep all logs in S3 Standard indefinitely

Answer

Move all logs immediately to S3 Glacier Deep Archive

Answer

Use EBS snapshots for the logs

Question 2

A healthcare document service uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend?

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS with an EC2 instance role is correct because it allows the EC2 instance to assume an IAM role and obtain a short-lived authentication token (valid for 15 minutes) to connect to the PostgreSQL database, eliminating the need to store any credentials on the instance. This approach meets both requirements: no credentials stored on EC2 and the use of short-lived credentials. The token is generated using the AWS CLI or SDK with the IAM role's temporary security credentials, and the RDS instance must be configured to accept IAM authentication.

Answer

Embed the database password in the AMI

Answer

Store the database password in user data

Answer

Use a security group rule that allows only application instances

Question 3

A Lambda function for a claims portal needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, automatically rotating, and managing secrets like database passwords. It supports automatic rotation every 30 days via a built-in Lambda rotation function, and it avoids storing the password in environment variables, which are visible in the Lambda console and logs.

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

An encrypted object in Amazon S3

Answer

A KMS-encrypted Lambda environment variable

Question 4

A ticket booking system uses Aurora MySQL. The company wants fast cross-Region disaster recovery with low RPO. Which architecture should be considered? The team wants the control to be enforceable during normal operations.

Accepted Answer

Aurora Global Database. Aurora Global Database is designed for cross-Region disaster recovery with a typical RPO of 1 second or less, using storage-based replication that does not impact database performance. It provides fast failover to a secondary Region and allows the primary Region to enforce write control during normal operations, meeting the low RPO and enforceable control requirements.

Answer

A single-AZ Aurora cluster

Answer

An ElastiCache Redis replica

Answer

Manual snapshots copied monthly

Question 5

A risk simulation workload in private subnets downloads large amounts of data from S3 through a NAT gateway. NAT data processing charges are high. What should the architect use to reduce cost? The design must avoid adding custom operational scripts.

Accepted Answer

Gateway VPC endpoint for Amazon S3. A Gateway VPC Endpoint for Amazon S3 allows instances in private subnets to access S3 directly over the AWS network without traversing a NAT gateway, eliminating NAT data processing charges. This is the most cost-effective and operationally simple solution because it requires no custom scripts and no changes to routing beyond adding the endpoint.

Answer

A larger NAT gateway

Answer

S3 Object Lambda

Answer

AWS Shield Advanced

Question 6

A marketing site runs on x86 EC2 instances and uses open-source software with no architecture-specific licensing restriction. What should be evaluated to reduce compute cost? The architecture review board prefers a managed AWS-native control.

Accepted Answer

AWS Graviton-based instances after performance testing. AWS Graviton-based instances use ARM-based custom processors that offer up to 40% better price-performance compared to comparable x86 instances for many workloads. Since the marketing site runs open-source software with no architecture-specific licensing restrictions, migrating to Graviton after performance testing can significantly reduce compute costs while leveraging a managed AWS-native control (e.g., EC2 Auto Scaling groups with Graviton instance types).

Answer

Cross-Region data replication for all data

Answer

io2 Block Express volumes for all instances

Answer

Dedicated Hosts by default

Question 7

A read-heavy document portal repeatedly queries the same product catalogue data from DynamoDB with millisecond latency requirements. Which service can reduce read latency and table load?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, in-memory cache for Amazon DynamoDB that delivers up to 10x read performance improvement by caching frequently accessed data. For a read-heavy workload querying the same product catalogue data, DAX reduces read latency to microseconds and offloads read requests from the DynamoDB table, lowering consumed read capacity units and table load.

Answer

Amazon Kinesis Data Firehose

Answer

S3 Transfer Acceleration

Answer

AWS Glue Data Catalog

Question 8

A production log archive runs continuously on EC2 with predictable usage for the next three years. The team wants a discount while retaining some instance-family flexibility. What should they buy?

Accepted Answer

Compute Savings Plan. The Compute Savings Plan (C) is correct because it offers a discount (up to 66%) in exchange for a commitment to a consistent amount of compute usage (measured in $/hour) for a 1- or 3-year term, while allowing flexibility to change instance families, sizes, OS, tenancy, and even regions within EC2, Fargate, and Lambda. This matches the requirement of predictable usage for three years with instance-family flexibility, unlike Reserved Instances which lock to a specific instance family.

Answer

S3 Intelligent-Tiering

Answer

Dedicated Instances

Answer

Spot Instances only

Question 9

A company hosts static images, CSS, and JavaScript files in an Amazon S3 bucket. Users around the world report slow page loads, and the origin receives many repeated requests for the same files. What should the team use to improve performance?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content (images, CSS, JavaScript) at edge locations worldwide. By serving cached copies from the edge closest to each user, CloudFront reduces latency, offloads repeated requests from the origin S3 bucket, and improves page load times for a global audience.

Answer

AWS Direct Connect

Answer

Amazon Route 53 health checks

Answer

Amazon EFS

Question 10

A ticket booking system stores uploaded documents in S3. The business requires a copy in another AWS Region for disaster recovery. What should be configured?

Accepted Answer

S3 Cross-Region Replication with versioning enabled. S3 Cross-Region Replication (CRR) with versioning enabled automatically copies objects from a source bucket in one AWS Region to a destination bucket in another Region, meeting the disaster recovery requirement for a geographically separate copy. Versioning must be enabled on both buckets to support replication of all object versions, ensuring consistency and recoverability. This is the native S3 feature designed for cross-region data redundancy without custom scripting or third-party tools.

Answer

S3 lifecycle transition to Glacier Flexible Retrieval

Answer

An EBS snapshot schedule

Answer

A CloudFront distribution

Question 11

A read-heavy document portal repeatedly queries the same product catalogue data from DynamoDB with millisecond latency requirements. Which service can reduce read latency and table load? The architecture review board prefers a managed AWS-native control.

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB that delivers up to 10x read performance improvement, reducing read latency to microseconds for repeated queries. It offloads read traffic from the DynamoDB table, lowering consumed read capacity units and table load, making it ideal for read-heavy workloads with millisecond latency requirements. As a fully managed, AWS-native service, DAX aligns with the architecture review board's preference for managed controls.

Answer

Amazon Kinesis Data Firehose

Answer

S3 Transfer Acceleration

Answer

AWS Glue Data Catalog

Question 12

A Lambda function for a order processing API needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing and automatically rotating database credentials. It natively supports rotation every 30 days via a built-in Lambda rotation function, without requiring any custom operational scripts. This meets the requirement to avoid storing the password in environment variables and to automate rotation.

Answer

An encrypted object in Amazon S3

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

A KMS-encrypted Lambda environment variable

Question 13

A trading dashboard uses Aurora MySQL. The company wants fast cross-Region disaster recovery with low RPO. Which architecture should be considered? The design must avoid adding custom operational scripts.

Accepted Answer

Aurora Global Database. Aurora Global Database is the correct choice because it provides a fully managed cross-Region disaster recovery solution with a typical RPO of 1 second or less, using storage-based replication that does not require custom scripts. This meets the low RPO requirement while avoiding operational overhead, as replication is handled automatically by the Aurora storage layer.

Answer

A single-AZ Aurora cluster

Answer

Manual snapshots copied monthly

Answer

An ElastiCache Redis replica

Question 14

A patient portal must use shared file storage across Linux EC2 instances in multiple Availability Zones. The storage must remain available during an AZ failure. Which service should be used? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Amazon EFS with mount targets in multiple Availability Zones. Amazon EFS provides a fully managed, shared POSIX-compliant file system that can be mounted concurrently across multiple Linux EC2 instances. By creating mount targets in multiple Availability Zones, the file system remains accessible even if one AZ fails, meeting the high-availability requirement. This aligns with the architecture review board's preference for a managed AWS-native control.

Answer

Instance store volumes

Answer

An EBS volume attached to all instances

Answer

S3 mounted as a POSIX file system without a file gateway

Question 15

A test environment stores logs in S3. Logs are queried for 30 days, rarely accessed for one year, and then retained for compliance. What should reduce storage cost?

Accepted Answer

S3 lifecycle policy that transitions objects to lower-cost storage classes over time. An S3 Lifecycle policy automates the transition of objects from S3 Standard (for frequent access) to S3 Standard-IA (infrequent access) after 30 days, then to S3 Glacier Deep Archive (for long-term retention) after one year, minimizing storage costs while maintaining data accessibility as needed.

Answer

Keep all logs in S3 Standard indefinitely

Answer

Move all logs immediately to S3 Glacier Deep Archive

Answer

Use EBS snapshots for the logs