SAA-C03 Practice Test 30 — 15 Questions

Question 1

A solutions architect is designing an S3 bucket for a IoT ingestion API. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or object ACLs. This setting, when enabled at the account or bucket level, ensures that even if a developer later attaches an overly permissive bucket policy, the public access is blocked. It meets the requirement of avoiding custom operational scripts by being a native, configurable S3 feature.

Answer

Enable S3 Transfer Acceleration

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Question 2

A solutions architect is designing a high-performance architecture for a read-heavy web application backed by Amazon RDS for MySQL. The database is currently a single db.r6g.4xlarge instance that is CPU-bound during peak hours, and the application performs many repeated identical read queries. The architect must improve read scalability and reduce load on the primary instance. (Choose two.)

Accepted Answer

Add an Amazon ElastiCache for Redis cluster in front of the database and cache the results of repeated queries.. Read replicas add horizontal read capacity by serving queries from separate instances, while an ElastiCache for Redis cluster absorbs repeated identical reads in memory before they reach the database. Together they reduce the CPU load on the primary from both directions: fewer queries arrive, and the ones that do can be served by replicas instead of the writer.

Answer

Enable RDS Performance Insights and set up a longer retention period for the performance history.

Answer

Convert the instance to a larger db.r6g.16xlarge size to increase memory and CPU.

Answer

Enable Multi-AZ with a standby instance and point read queries at the standby endpoint.

Question 3

A financial services company runs a three-tier web application on AWS. The application tier consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer. Security policy requires that the EC2 instances never receive public IP addresses and that all outbound internet traffic from the application tier be routed through a NAT gateway. The company also wants to ensure that only the load balancer can initiate connections to the application instances on port 443. Which combination of VPC configuration and security group rules should a solutions architect implement to meet these requirements?

Accepted Answer

Place the EC2 instances in private subnets. Configure the instances' security group to allow inbound TCP 443 from the load balancer's security group, and configure the load balancer's security group to allow inbound TCP 443 from 0.0.0.0/0. Route 0.0.0.0/0 through a NAT gateway in a public subnet.. The requirement to keep instances off the public internet while allowing outbound access is met by private subnets plus a NAT gateway in a public subnet. Restricting inbound port 443 to the load balancer's security group as the source enforces that only the ALB can initiate connections to the application tier, which is the tightest and most maintainable control for this scenario.

Answer

Place the EC2 instances in private subnets. Configure the instances' security group to allow inbound TCP 443 from 0.0.0.0/0, and route 0.0.0.0/0 through a NAT gateway in a public subnet.

Answer

Place the EC2 instances in private subnets. Configure the instances' security group to allow inbound TCP 443 from the load balancer's security group, and attach an internet gateway directly to the private subnets to provide outbound access.

Answer

Place the EC2 instances in public subnets with an internet gateway. Configure the instances' security group to allow inbound TCP 443 from the load balancer's IP addresses, and route 0.0.0.0/0 through the internet gateway.

Question 4

A financial analytics platform runs an Amazon Aurora MySQL cluster with one writer and two readers. During month-end reporting, read traffic spikes and the application sometimes receives TooManyConnections errors on the reader endpoint. The architect wants to absorb bursts without changing application code and must keep failover behaviour intact. Which change meets these requirements?

Accepted Answer

Add an Amazon RDS Proxy in front of the Aurora cluster and point the application at the proxy endpoint. Amazon RDS Proxy sits between the application and Aurora, maintaining a warm pool of database connections that are shared across many client connections. This absorbs connection bursts and prevents TooManyConnections errors without application changes beyond updating the endpoint. Because RDS Proxy is failover-aware, it automatically routes to the new writer during a failover, preserving the resilience behaviour the architect requires.

Answer

Increase the aurora_max_connections parameter on the cluster parameter group and reboot the readers

Answer

Replace the reader endpoint with a Network Load Balancer that distributes TCP connections across the Aurora readers

Answer

Convert the readers to Aurora Replicas in a second Region and use a global database secondary cluster

Question 5

A payments API uses Amazon SQS. Poison messages are repeatedly failing and blocking useful retries. What should the architect configure?

Accepted Answer

A dead-letter queue with an appropriate maxReceiveCount. B is correct because a dead-letter queue (DLQ) with an appropriate maxReceiveCount allows the payments API to isolate poison messages after a specified number of failed processing attempts. This prevents repeated failures from blocking useful retries, as the problematic messages are moved to the DLQ for manual inspection or separate handling, while the main queue continues processing valid messages.

Answer

A FIFO queue without a redrive policy

Answer

A larger message retention period only

Answer

Short polling instead of long polling

Question 6

A read-heavy media archive repeatedly queries the same product catalogue data from DynamoDB with millisecond latency requirements. Which service can reduce read latency and table load? The architecture review board prefers a managed AWS-native control.

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB that delivers microsecond read latency, directly addressing the millisecond requirement. By caching frequently accessed product catalogue data, DAX offloads read requests from the DynamoDB table, reducing table load and read capacity unit consumption. As a fully managed, AWS-native service, it aligns with the architecture review board's preference for managed controls.

Answer

Amazon Kinesis Data Firehose

Answer

AWS Glue Data Catalog

Answer

S3 Transfer Acceleration

Question 7

A trading dashboard runs on EC2 instances behind an Application Load Balancer. The design must tolerate the failure of one Availability Zone. What should the Auto Scaling group configuration include? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Subnets in at least two Availability Zones with health checks enabled. Distributing EC2 instances across at least two Availability Zones (AZs) ensures that the application remains available if one AZ fails. The Auto Scaling group must include subnets in multiple AZs and use health checks (e.g., ELB health checks) to automatically replace unhealthy instances. This configuration meets the requirement for fault tolerance and aligns with AWS-managed best practices for high availability.

Answer

A single EC2 instance with detailed monitoring

Answer

All instances in one larger subnet

Answer

A Network Load Balancer in one subnet

Question 8

A payments API uses Amazon SQS. Poison messages are repeatedly failing and blocking useful retries. What should the architect configure? The design must avoid adding custom operational scripts.

Accepted Answer

A dead-letter queue with an appropriate maxReceiveCount. A dead-letter queue (DLQ) with an appropriate maxReceiveCount allows messages that repeatedly fail processing to be moved out of the source queue after a specified number of receive attempts. This prevents poison messages from blocking retries and consuming processing resources, without requiring custom operational scripts.

Answer

A FIFO queue without a redrive policy

Answer

A larger message retention period only

Answer

Short polling instead of long polling

Question 9

A inventory service uses Lambda functions that call an unreliable third-party API. Failed events must be retained for later investigation after retries are exhausted. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

A Lambda dead-letter queue or failure destination. A Lambda dead-letter queue (DLQ) or failure destination allows you to capture events that have exhausted all retry attempts from an asynchronous invocation. When the Lambda function fails after the maximum retries (default 3), the event is sent to the configured SQS queue or SNS topic for later investigation, without requiring custom scripts or manual polling.

Answer

Lambda reserved concurrency set to zero

Answer

A larger deployment package

Answer

CloudFront error pages

Question 10

A solutions architect is designing an S3 bucket for a IoT ingestion API. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or object ACLs. When enabled at the account or bucket level, it blocks all public access settings, ensuring that even if a developer later adds an overly broad bucket policy, the objects remain inaccessible to anonymous users. This is essential for compliance with healthcare regulations like HIPAA, where data must never be publicly exposed.

Answer

Enable server access logging on the bucket

Answer

Enable S3 Transfer Acceleration

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Question 11

A trading dashboard stores uploaded documents in S3. The business requires a copy in another AWS Region for disaster recovery. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

S3 Cross-Region Replication with versioning enabled. S3 Cross-Region Replication (CRR) is the correct AWS-native managed solution for automatically replicating objects from a source S3 bucket in one region to a destination bucket in another region, meeting the disaster recovery requirement. Versioning must be enabled on both source and destination buckets for CRR to function, as replication relies on version IDs to track and copy objects. This provides asynchronous, automatic replication without custom scripting or third-party tools.

Answer

An EBS snapshot schedule

Answer

S3 lifecycle transition to Glacier Flexible Retrieval

Answer

A CloudFront distribution

Question 12

A media company hosts a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to rate-limit requests from specific IP addresses that exhibit abusive behavior. Which combination of AWS services should a solutions architect recommend?

Accepted Answer

AWS WAF attached to the Application Load Balancer with managed rule groups and rate-based rules.. AWS WAF is the managed application-layer firewall that attaches to Application Load Balancers, Amazon CloudFront, and API Gateway. Managed rule groups provide prebuilt protections against SQL injection, XSS, and other OWASP threats, while rate-based rules track request counts per IP and block offenders automatically. This directly addresses both the exploit protection and the abusive IP rate-limiting requirements with a single integrated service.

Answer

AWS Shield Advanced with automatic application layer DDoS mitigation enabled on the ALB.

Answer

Amazon GuardDuty with suppression rules configured for the EC2 instances and ALB.

Answer

AWS Network Firewall deployed in a subnet in front of the ALB with stateful rules for HTTP inspection.

Question 13

A high-volume telemetry pipeline writes streaming click events that must be processed by multiple independent consumers. Which service is most appropriate? The design must avoid adding custom operational scripts.

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is designed for real-time streaming of high-volume data, such as click events, and allows multiple independent consumers to process the same stream concurrently via enhanced fan-out or shared throughput. It provides durable, ordered data retention and integrates with AWS Lambda, Kinesis Data Analytics, and Kinesis Data Firehose without requiring custom operational scripts.

Answer

AWS DataSync

Answer

Amazon EBS

Answer

Amazon Route 53

Question 14

A SaaS application is deployed in us-east-1 and us-west-2 behind separate ALBs. The business wants DNS to send new clients to the primary Region when it is healthy and automatically fail over to the secondary Region when the primary endpoint is unhealthy. Which two Route 53 settings are required? Select two.

Accepted Answer

Use a failover routing policy with a primary and secondary record.. A failover routing policy is correct because it allows you to designate one record as primary and another as secondary. Route 53 will route traffic to the primary record as long as it is healthy, and automatically fail over to the secondary record when the primary is unhealthy. This directly meets the requirement to send new clients to the primary region when healthy and fail over to the secondary region.

Answer

Use weighted routing with a 50/50 traffic split between both Regions.

Answer

Use latency-based routing so clients always choose the fastest Region.

Answer

Use a geolocation policy without health checks.

Question 15

A claims workflow uses Amazon SQS. Poison messages are repeatedly failing and blocking useful retries. What should the architect configure? The team wants the control to be enforceable during normal operations.

Accepted Answer

A dead-letter queue with an appropriate maxReceiveCount. A dead-letter queue (DLQ) with an appropriate maxReceiveCount is the correct solution because it automatically moves messages that have failed processing a specified number of times to a separate queue, preventing them from blocking subsequent retries. This enforces control during normal operations by isolating poison messages without manual intervention, allowing the main queue to continue processing valid messages.

Answer

A FIFO queue without a redrive policy

Answer

Short polling instead of long polling

Answer

A larger message retention period only