SAA-C03 Practice Test 2 — 30 Questions

Question 1

A worker service consumes messages from an Amazon SQS queue. Some messages are malformed and always fail validation. The worker retries, but it keeps reprocessing the same bad messages and consumes processing capacity that should be used for valid work. What is the best solution to prevent “poison messages” from blocking progress?

Accepted Answer

Configure a Dead-Letter Queue (DLQ) and set a redrive policy so messages move to the DLQ after a maximum number of receives.. A Dead-Letter Queue (DLQ) with a redrive policy is the standard AWS mechanism for handling poison messages. By setting a maximum receive count (e.g., 5), the SQS queue automatically moves messages that fail processing repeatedly to the DLQ, isolating them from the main queue. This prevents the worker from wasting capacity on invalid messages and allows the main queue to continue processing valid work without interruption.

Answer

Increase the visibility timeout so the worker gets fewer retries per hour.

Answer

Disable SQS retries by deleting messages immediately on any processing error.

Answer

Create a second worker that polls the queue less frequently until the malformed message is processed successfully.

Question 2

A test environment has EC2 instances that are oversized based on CPU, memory, and network utilisation. Which AWS service should identify rightsizing recommendations? The architecture review board prefers a managed AWS-native control.

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is a managed service that uses machine learning to analyze historical utilization metrics (CPU, memory, network, and storage) and provides rightsizing recommendations for EC2 instances. It identifies over-provisioned resources and suggests instance types that better match workload requirements, directly addressing the oversized EC2 instances in the test environment.

Answer

AWS DataSync

Answer

AWS Shield

Answer

AWS Artifact

Question 3

A company runs its customer-facing web app on EC2 behind an Application Load Balancer. The database is Amazon RDS for PostgreSQL. The requirement is that if a single Availability Zone fails, the database must automatically fail over within the same AWS Region with minimal application changes. Which database setup best meets this requirement?

Accepted Answer

Deploy the RDS PostgreSQL instance as Multi-AZ with automatic failover enabled.. Option B is correct because RDS Multi-AZ with automatic failover provides synchronous replication to a standby instance in a different Availability Zone. If the primary AZ fails, RDS automatically flips the DNS CNAME to the standby, resulting in minimal application changes (only a brief connection interruption). This meets the requirement for automatic failover within the same region without manual intervention.

Answer

Use an RDS single-AZ instance and periodically restore from automated backups if needed.

Answer

Create a read replica in a different AZ and use it only when the primary fails.

Answer

Use RDS with Multi-AZ disabled, but increase storage IOPS to prevent failover.

Question 4

A web application runs on an EC2 Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ASG spans three Availability Zones. After a deployment, new instances frequently fail the ALB target group health checks with HTTP 5xx responses and are quickly terminated by the ASG. What change most improves resiliency during deployments with minimal downtime by preventing premature removal of instances that are still starting?

Accepted Answer

Use a longer ASG health check grace period and deploy new instances using controlled replacement (for example, rolling instance refresh) so existing healthy instances continue serving while new ones warm up.. Option B is correct because increasing the ASG health check grace period gives new instances more time to complete their startup and pass the ALB health checks before the ASG marks them unhealthy. A rolling instance refresh replaces instances in a controlled manner, ensuring that existing healthy instances continue serving traffic while new instances warm up, minimizing downtime and preventing premature termination.

Answer

Reduce the ASG health check grace period to 0 seconds so issues are detected faster.

Answer

Restrict the ASG to a single Availability Zone so health check evaluation is simpler.

Answer

Disable ALB health checks so the ASG does not terminate instances on HTTP 5xx responses.

Question 5

A telemetry pipeline uses an Application Load Balancer in one Region. Global users need lower network latency to the application without caching dynamic responses. What should be considered?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the Anycast IP address concept to route traffic through the AWS global network to the optimal endpoint, reducing latency and jitter for global users. It does not cache content, making it ideal for dynamic responses that cannot be cached, and it integrates directly with an Application Load Balancer in a single Region.

Answer

S3 Cross-Region Replication

Answer

CloudFront only with long TTLs

Answer

AWS Backup cross-Region copy

Question 6

A inventory service exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most? The architecture review board prefers a managed AWS-native control.

Accepted Answer

CloudFront caching with appropriate TTLs. CloudFront caching with appropriate TTLs allows cached responses to be served to users even when the S3 origin is temporarily unavailable. By setting a minimum TTL (e.g., 0 seconds for fresh content, but a higher default or maximum TTL for stale content), CloudFront can continue delivering previously cached pages from edge locations during an S3 outage, ensuring high availability and resilience. This is a managed AWS-native feature that aligns with the architecture review board's preference.

Answer

AWS Backup Vault Lock

Answer

IAM Access Analyzer

Answer

S3 Select

Question 7

A ticket booking system stores uploaded documents in S3. The business requires a copy in another AWS Region for disaster recovery. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Cross-Region Replication with versioning enabled. S3 Cross-Region Replication (CRR) automatically replicates objects from a source bucket in one AWS Region to a destination bucket in another Region, providing a disaster recovery copy without custom scripts. Enabling versioning on both buckets is a prerequisite for CRR, ensuring that all object versions are replicated and that the destination bucket can maintain a complete history of changes.

Answer

S3 lifecycle transition to Glacier Flexible Retrieval

Answer

An EBS snapshot schedule

Answer

A CloudFront distribution

Question 8

A site serves static assets (JS/CSS) through CloudFront from an S3 origin. After a recent frontend change, CloudFront shows a cache hit ratio below 20%. In CloudFront access logs, requests to the same asset URL path differ by a query parameter named rnd (a random value appended by the app on every request). The origin content is identical regardless of rnd. What is the best CloudFront configuration change to restore effective caching?

Accepted Answer

Create a custom CloudFront Cache Policy that does not include the rnd query parameter in the cache key (whitelist only required parameters, or forward no query strings).. The rnd query parameter makes each request appear unique to CloudFront, causing a cache miss for every request even though the underlying content is identical. By creating a custom cache policy that either forwards no query strings or whitelists only required parameters, CloudFront will ignore the rnd parameter when computing the cache key, allowing it to serve cached responses and dramatically improve the cache hit ratio.

Answer

Increase the origin response Cache-Control max-age header on S3 so CloudFront caches longer even with different rnd values.

Answer

Disable compression on CloudFront so the response body is identical byte-for-byte and cache hits improve.

Answer

Switch the origin from S3 to an ALB so CloudFront can cache based on ALB target health checks instead of the query string.

Question 9

A video platform uses Amazon Aurora. The workload has many short-lived database connections from Lambda functions, causing connection storms. What should be added? The architecture review board prefers a managed AWS-native control.

Accepted Answer

RDS Proxy. RDS Proxy is the correct choice because it manages a pool of reusable database connections, allowing Lambda functions to share and reuse connections rather than opening and closing them with each invocation. This eliminates connection storms by buffering short-lived connections from Lambda and reducing the load on the Aurora database, all as a fully managed AWS-native service.

Answer

S3 Select

Answer

An internet gateway

Answer

A larger Route 53 hosted zone

Question 10

A web API runs on an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). During traffic spikes, users experience request timeouts even though CPU stays below 40%. After investigation, you find the ASG often has too few healthy targets to handle the current request rate. Which change will best improve responsiveness during spikes?

Accepted Answer

Create a target tracking scaling policy using an ALB metric such as RequestCountPerTarget or TargetResponseTime.. Option B is correct because the issue is that the ASG has too few healthy targets to handle the request rate, even though CPU is low. A target tracking scaling policy based on RequestCountPerTarget or TargetResponseTime directly aligns scaling with the ALB's view of demand, ensuring the ASG adds instances when request rates spike, regardless of CPU utilization. This addresses the root cause—insufficient capacity to serve incoming requests—rather than relying on a metric (CPU) that does not reflect the bottleneck.

Answer

Keep the ASG scaling policy based on CPU utilization, but increase the ASG min capacity by 50%.

Answer

Enable EC2 detailed monitoring for one-minute granularity and keep CPU scaling.

Answer

Switch to scaling based on the ASG network out bytes metric only, ignoring ALB response metrics.

Question 11

A payments API uses an RDS MySQL database and must remain available during an Availability Zone failure with minimal application changes. What should the architect enable? The team wants the control to be enforceable during normal operations.

Accepted Answer

Multi-AZ deployment for the RDS DB instance. Multi-AZ deployment for RDS MySQL automatically provisions and synchronously replicates a standby instance in a different Availability Zone. In the event of an AZ failure, Amazon RDS automatically fails over to the standby, providing high availability with minimal application changes (the application only needs to reconnect using the same endpoint). This meets the requirement of remaining available during an AZ failure while being enforceable during normal operations.

Answer

S3 Cross-Region Replication

Answer

Read replicas only

Answer

EBS snapshots every hour

Question 12

A team runs a latency-sensitive service on EC2 and needs consistent, low-latency block storage for a database. The application requires predictable performance and should be fast for random reads/writes. Which EBS volume type is the best choice?

Accepted Answer

EBS gp3 (general purpose SSD). B is correct because gp3 is a general-purpose SSD volume that provides consistent, low-latency performance for random read/write operations, making it ideal for latency-sensitive database workloads. It offers a baseline of 3,000 IOPS and 125 MB/s throughput, with the ability to independently scale up to 16,000 IOPS and 1,000 MB/s, ensuring predictable performance without the burst-bucket limitations of gp2.

Answer

EBS st1 (throughput optimized HDD)

Answer

EBS sc1 (cold HDD)

Answer

EBS magnetic (legacy magnetic)

Question 13

A startup runs a mix of workloads using both EC2 instances and AWS Lambda functions. Over the next 12 months, the team expects the overall level of compute usage to be fairly steady, but they may change EC2 instance types for performance tuning and they may add or remove Lambda functions. They want the lowest-cost commitment that will discount *both* EC2 and Lambda usage without requiring them to commit to a specific EC2 instance family (or a fixed instance type). Which AWS option best meets this requirement?

Accepted Answer

Purchase a Compute Savings Plan with a 1-year term for the expected average hourly spend across both EC2 and Lambda.. B is correct because a Compute Savings Plan offers the lowest cost commitment that covers both EC2 and Lambda usage, with flexibility to change instance families, sizes, regions (within the same AWS organization), and even switch between EC2 and Fargate. It applies a consistent hourly discount to compute usage up to the committed amount, regardless of instance type or compute service, meeting the startup's need for a steady workload with potential changes.

Answer

Purchase an EC2 Instance Reserved Instance for the current instance family only, and rely on On-Demand pricing for Lambda and any future EC2 types.

Answer

Purchase a Standard Reserved Instance for a specific Region and use it only to reduce network egress/transfer charges.

Answer

Use EC2 Spot for EC2 workloads and keep Lambda on-demand, because Spot will automatically discount Lambda too.

Question 14

A video processing pipeline runs batch jobs that are safe to interrupt and restart. The jobs checkpoint progress to durable storage every few minutes, and the team can automatically resubmit from the last checkpoint. They want to minimize compute cost while accepting that capacity can be interrupted. Which launch configuration for the processing workers is the best cost-optimized choice?

Accepted Answer

Launch the worker nodes as Spot Instances, and configure the job resubmission logic to restart from checkpoints upon interruption.. Spot Instances offer significant cost savings (up to 90% compared to On-Demand) and are ideal for fault-tolerant, interruptible workloads. Since the pipeline checkpoints progress to durable storage and can automatically resume from the last checkpoint, using Spot Instances minimizes compute cost while accepting interruptions.

Answer

Launch the worker nodes as On-Demand Instances with no interruption handling so the pipeline never needs resubmission.

Answer

Launch the worker nodes as Reserved Instances to guarantee capacity and reduce cost, ignoring interruptions.

Answer

Use Savings Plans and also set the job scheduler to never start new jobs unless previous jobs finish without interruption.

Question 15

A web application runs on an Amazon EC2 Auto Scaling group behind an Application Load Balancer (ALB). After each deployment, new instances take about 2 minutes to download artifacts and become ready to accept requests on the target port. In the last deployment, the ALB started marking targets unhealthy before the app was ready, and the Auto Scaling group then replaced those instances repeatedly, causing a prolonged outage. Which change best improves resilience during instance start-up without reducing actual availability once the application is healthy?

Accepted Answer

Increase the Auto Scaling group’s health check grace period so it exceeds the ~2-minute initialization time.. The Auto Scaling group's health check grace period allows instances to initialize without being marked unhealthy by the ELB health checks. By setting this grace period to exceed the ~2-minute artifact download time, the ASG will not replace instances that are still starting up, preventing the cascade of terminations and redeployments that caused the outage. This directly addresses the root cause—premature health check failures—without changing the health check configuration or reducing availability once the app is ready.

Answer

Add more subnets across additional Availability Zones to distribute the same instances more widely.

Answer

Switch the load balancer target type from instance targets to IP targets to avoid health check failures.

Answer

Reduce the ALB health check interval so unhealthy targets are removed faster.

Question 16

Based on the exhibit, which change best reduces latency during peak traffic without overprovisioning the fleet?

Accepted Answer

Change the Auto Scaling policy to target tracking on ALB RequestCountPerTarget.. Option B is correct because using a target tracking scaling policy on ALB RequestCountPerTarget dynamically adjusts the fleet size based on the actual number of requests each instance receives. This ensures that during peak traffic, additional instances are added only when needed, reducing latency by distributing the load without overprovisioning. It directly addresses the goal of minimizing latency during spikes while maintaining cost efficiency.

Answer

Replace the instances with a larger instance family so each server has more headroom.

Answer

Use scheduled scaling to add instances only during the business hours peak window.

Answer

Replace the ALB with a Network Load Balancer to reduce request latency.

Question 17

A web application for a healthcare document service is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy?

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that can be associated with an Application Load Balancer to filter and monitor HTTP/HTTPS requests. It includes managed rule sets specifically designed to block common web exploits like SQL injection and cross-site scripting (XSS) with minimal operational overhead, as AWS manages the rule updates.

Answer

Security groups on the application instances

Answer

Network ACLs on the public subnets

Answer

AWS Shield Advanced only

Question 18

A service runs in private subnets. It must call AWS APIs (for example, S3 and Secrets Manager). The team currently sends all outbound traffic through a NAT Gateway, and NAT charges have become a major cost driver. The workload must not traverse the public internet. What change most directly reduces NAT Gateway cost while maintaining private connectivity to those AWS services?

Accepted Answer

Replace the NAT Gateway route with VPC endpoints: use a Gateway VPC endpoint for S3 and an Interface VPC endpoint for Secrets Manager.. Option B is correct because VPC endpoints allow private connectivity to AWS services without traversing the internet or a NAT Gateway. A Gateway VPC endpoint for S3 uses route table entries to reach S3 privately, and an Interface VPC endpoint for Secrets Manager uses an elastic network interface with a private IP. This eliminates NAT Gateway data processing charges entirely while keeping traffic within the AWS network.

Answer

Continue using the NAT Gateway but reduce CloudWatch log retention to 1 day.

Answer

Launch a bastion host in a public subnet and force private instances to use SSH tunneling for API calls.

Answer

Switch to public subnets and attach security groups with the same rules to limit inbound access.

Question 19

A inventory service exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most? The team wants the control to be enforceable during normal operations.

Accepted Answer

CloudFront caching with appropriate TTLs. CloudFront caching with appropriate TTLs allows the distribution to serve stale or cached content from edge locations even when the S3 origin is temporarily unavailable. By setting a minimum TTL (e.g., 0 seconds) and a default/max TTL (e.g., 86400 seconds), CloudFront can continue to respond to user requests with previously cached objects during an origin outage, ensuring high availability. This feature is enforceable during normal operations because the TTL settings are configured in the CloudFront distribution behavior and are always active, not just during failures.

Answer

AWS Backup Vault Lock

Answer

IAM Access Analyzer

Answer

S3 Select

Question 20

An EC2 workload runs in one region on a single instance type. For the last month, CloudWatch metrics show average CPU utilization of 12% and no sustained memory pressure. The team wants to reduce cost while maintaining the current performance level. What is the best first step?

Accepted Answer

Use AWS Compute Optimizer to get recommendations for instance type and size changes.. AWS Compute Optimizer analyzes historical utilization metrics (CPU, memory, I/O) and provides actionable recommendations for right-sizing instances. Given the average CPU utilization of only 12% and no memory pressure, Compute Optimizer will likely recommend a smaller instance type or family that matches the workload's actual resource needs, reducing cost without affecting performance.

Answer

Increase the instance size to reduce the risk of performance regression.

Answer

Switch to Spot Instances immediately to reduce cost regardless of utilization.

Answer

Disable detailed monitoring to lower CloudWatch charges.