SAA-C03 Practice Test 3 — 30 Questions

Question 1

A public API is deployed in two AWS Regions: us-east-1 (primary) and us-west-2 (secondary). The team wants Route 53 to automatically route users to the secondary region if the primary API becomes unhealthy. They will use Route 53 health checks that monitor the API’s /status endpoint over HTTPS. Which Route 53 configuration most directly implements this failover behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a primary alias record and a failover alias record (secondary), configure failover routing policy, and attach health checks to both records.. B is correct because the failover routing policy in Route 53 is specifically designed for active-passive failover. By creating a primary alias record and a secondary failover alias record, each with an associated health check, Route 53 will automatically route traffic to the secondary region when the health check for the primary fails. This directly implements the required behavior without relying on latency or geographic proximity.

Answer

Create two latency-based alias records for the same name, each with different health checks; Route 53 will automatically shift to the secondary when primary is unhealthy.

Answer

Use geolocation routing with a health check; when the primary is unhealthy, Route 53 will automatically change the region mapping globally.

Answer

Use simple routing with weighted records and a low health check threshold so traffic quickly moves to the secondary region.

Question 2

A solutions architect is designing an S3 bucket for a claims portal. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or object ACLs. By enabling this setting at the account or bucket level, the architect ensures that even if a developer later adds an overly broad bucket policy, the S3 service will block all public access. This is the only option that directly and permanently prevents public exposure.

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Answer

Enable S3 Transfer Acceleration

Question 3

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) for Systems Manager allow EC2 instances in private subnets to access Parameter Store without traversing the internet. Gateway VPC endpoints for S3 provide a highly available, managed route to S3 via the VPC route table, requiring no NAT or internet gateway. Both are AWS-native, managed services that meet the architecture review board's preference.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 4

Based on the exhibit, what is the most appropriate change to restore application access while keeping encryption at rest with customer-managed KMS controls?

Accepted Answer

Update the KMS key policy or add a grant so AppServerRole can use the key for decrypt and data key operations.. The application is failing because AppServerRole lacks the necessary permissions to use the customer-managed KMS key for decrypting S3 objects. By updating the KMS key policy or adding a grant to allow the role to perform `kms:Decrypt` and `kms:GenerateDataKey` operations, you restore access while maintaining encryption at rest with customer-managed KMS controls.

Answer

Change the bucket to SSE-S3 so the application no longer depends on KMS permissions.

Answer

Move the EC2 instance into the same Availability Zone as the S3 bucket to reduce encryption errors.

Answer

Attach AmazonS3FullAccess to the application role so S3 can bypass KMS authorization.

Question 5

Based on the exhibit, a faulty deployment corrupted production data at 10:30 UTC and the issue was discovered at 10:55 UTC. The team needs to recover the database to the last good state before the corruption. Which action should they take?

Accepted Answer

Use point-in-time restore to create a new database instance at 10:29 UTC, then switch the application to it.. Amazon RDS for MySQL (and other engines) supports point-in-time recovery (PITR), which allows you to restore a database to any second within the backup retention period, up to the last five minutes. By restoring to 10:29 UTC (one minute before the corruption at 10:30 UTC), the team can recover the database to its last good state with minimal data loss. After restoring, the application can be pointed to the new instance, avoiding the corrupted data.

Answer

Restore the latest manual snapshot and accept data loss since the snapshot was taken overnight.

Answer

Restart the database instance so the transaction log replays the failed migration cleanly.

Answer

Create a read replica and promote it, because replicas always contain the previous transaction state.

Question 6

Your application uses ElastiCache Redis as a cache for user profiles stored in DynamoDB. You must ensure that when a profile is updated, subsequent reads see the latest value quickly. Which cache strategy is generally the best fit for this requirement?

Accepted Answer

Use a cache-aside approach with TTL plus explicit invalidation after writes.. A cache-aside (lazy loading) strategy with TTL and explicit invalidation ensures that after a write to DynamoDB, the stale Redis entry is removed, forcing the next read to fetch the fresh profile from DynamoDB and repopulate the cache. This combination minimizes the window of stale reads while maintaining high read performance, which is critical for user profile caches where consistency matters.

Answer

Write to DynamoDB only, and never update or invalidate the Redis cache.

Answer

Cache only for reads, and do not fetch from DynamoDB when a key is missing.

Answer

Rely on eventual consistency of Redis replication to propagate updates to all nodes.

Question 7

A inventory service exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most?

Accepted Answer

CloudFront caching with appropriate TTLs. CloudFront caches responses from the S3 origin based on configured TTLs (Cache-Control or Expires headers). If the S3 origin experiences a short outage, CloudFront can still serve cached pages to users from its edge locations, maintaining availability. This is the most direct way to ensure users receive content during origin failures.

Answer

AWS Backup Vault Lock

Answer

IAM Access Analyzer

Answer

S3 Select

Question 8

A web application for a mobile banking backend is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy?

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). By associating an AWS WAF web ACL with the Application Load Balancer, you can filter and monitor HTTP(S) requests based on rules that block these attack patterns, all without managing any infrastructure. This provides the required protection with minimal operational overhead because AWS WAF is a fully managed service that integrates directly with ALB.

Answer

Security groups on the application instances

Answer

Network ACLs on the public subnets

Answer

AWS Shield Advanced only

Question 9

An application uses DynamoDB to store order status. Reads happen extremely frequently for the same few keys (for example, the most recent orders), and the team wants lower read latency without changing the table’s partition key design. Which AWS service best fits this requirement?

Accepted Answer

Amazon DAX (DynamoDB Accelerator) to cache frequently read items. Amazon DAX (DynamoDB Accelerator) is an in-memory cache that sits between your application and DynamoDB, providing microsecond read latency for frequently accessed items. Because the workload involves extremely frequent reads of the same few keys (hot keys), DAX reduces the load on the DynamoDB table and delivers faster responses without requiring any changes to the partition key design.

Answer

Provision AWS WAF rules to reduce DynamoDB read latency caused by bots

Answer

Enable multi-region writes in DynamoDB Global Tables to speed up reads locally

Answer

Add more read capacity units to DynamoDB and avoid caching entirely

Question 10

A DynamoDB table for a retail API has a partition key based only on the current date. Write throttling occurs during business hours. What is the best design change? The design must avoid adding custom operational scripts.

Accepted Answer

Use a higher-cardinality partition key that distributes writes across partitions. Using only the current date as a partition key creates a 'hot partition' because all writes for the day target a single partition, exceeding its 1,000 WCU limit. A higher-cardinality partition key (e.g., combining date with user ID or order ID) distributes writes evenly across partitions, eliminating throttling without custom scripts.

Answer

Create a global secondary index with the same date key

Answer

Reduce the table's write capacity

Answer

Move the table to S3 Glacier Instant Retrieval

Question 11

A SaaS vendor’s automation account in Account B needs to assume a role in a customer account in Account A to read a specific S3 bucket and publish a deployment status file. The customer is worried about confused deputy attacks because multiple customers use the same vendor software. Which trust-policy design best meets the requirement?

Accepted Answer

Allow only the vendor’s specific IAM principal to assume the role and require a unique sts:ExternalId condition.. The `sts:ExternalId` condition is specifically designed to prevent the confused deputy problem in cross-account role assumptions. By requiring a unique external ID that only the customer knows, the customer ensures that the vendor's automation can only assume the role when acting on behalf of that specific customer, even if multiple customers use the same vendor software.

Answer

Allow the Account B root principal to assume the role if the caller knows the role ARN.

Answer

Attach a permissions boundary to the role so that the vendor cannot exceed the approved permissions.

Answer

Require MFA for the role assumption because it ensures only the vendor’s production automation can use the role.

Question 12

An order system receives events and uses a Lambda function to write each order into a database. During traffic spikes, the database sometimes throttles, and Lambda retries lead to occasional message loss in the event flow. The team wants buffering, automatic retries, and a way to isolate messages that repeatedly fail so they can be inspected later. What design change best meets this need?

Accepted Answer

Use Amazon SQS as a buffer between the event source and Lambda, with an SQS dead-letter queue (DLQ).. Amazon SQS acts as a durable buffer between the event source and Lambda, absorbing traffic spikes and decoupling the producer from the consumer. The SQS dead-letter queue (DLQ) automatically captures messages that exceed the configured maximum retries, allowing the team to inspect and reprocess them later without loss. This design provides the required buffering, automatic retries via the Lambda event source mapping, and isolation of repeatedly failing messages.

Answer

Send events directly from EventBridge to Lambda without any queue to simplify the flow.

Answer

Use SNS fan-out to multiple Lambda functions, but keep no retry logic and no DLQ.

Answer

Store events in an S3 bucket and trigger Lambda immediately after each upload, without using DLQs.

Question 13

A company uses Amazon RDS for a PostgreSQL database powering a customer-facing application. The application’s availability depends on fast database failover with minimal manual intervention. The RDS instance currently runs as a single-AZ deployment in one DB subnet group. Which change most directly meets the goal?

Accepted Answer

Enable Multi-AZ for the RDS DB instance so AWS manages a standby in another Availability Zone with automatic failover.. Enabling Multi-AZ for the RDS DB instance creates a synchronous standby replica in a different Availability Zone. AWS automatically handles failover to the standby with no manual intervention required, which directly meets the goal of fast database failover with minimal manual intervention.

Answer

Create a read replica in a different Availability Zone and configure the application to fail over manually.

Answer

Switch the database to use EBS snapshots more frequently and restore in case of failure.

Answer

Pin the DB to a specific instance type with higher CPU credits to prevent CPU-related disconnects.

Question 14

A public API for a e-learning platform is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. API Gateway supports JWT authorizers that validate JSON Web Tokens (JWTs) issued by an external OpenID Connect (OIDC) provider. This allows the API to authenticate clients using standards-based tokens without managing a custom Lambda authorizer, and it directly integrates with the OIDC issuer's JWKS endpoint to verify token signatures.

Answer

A VPC endpoint policy

Answer

IAM authorization for all internet users

Answer

API keys only

Question 15

An internal service is hosted behind an Application Load Balancer (ALB) with targets spread across two Availability Zones. If the targets in one Availability Zone become unhealthy, the service must continue serving traffic from the healthy AZ. What change most directly improves resilience at the load-balancing layer?

Accepted Answer

Configure target group health checks so the ALB stops sending traffic to unhealthy targets and continues routing to healthy targets in the other Availability Zone.. Configuring target group health checks allows the ALB to automatically detect unhealthy targets and stop sending traffic to them, while continuing to route requests to healthy targets in the other Availability Zone. This directly improves resilience at the load-balancing layer by ensuring traffic is only forwarded to healthy instances, maintaining service availability even when an entire AZ fails.

Answer

Turn off health checks and rely only on instance CPU utilization to route traffic.

Answer

Configure ALB listener rules to route all traffic to a single target group in one Availability Zone.

Answer

Store requests in an SQS queue before routing them to the ALB.

Question 16

A Lambda function for a healthcare document service needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it is designed specifically for storing and automatically rotating database credentials. It supports native rotation for Amazon RDS, Redshift, and DocumentDB with a built-in Lambda rotation function, and it can rotate secrets on a schedule (e.g., every 30 days) without storing the password in environment variables. This meets the healthcare document service's requirement for automatic rotation and secure storage.

Answer

A KMS-encrypted Lambda environment variable

Answer

An encrypted object in Amazon S3

Answer

AWS Systems Manager Parameter Store SecureString without automation

Question 17

A trading dashboard runs on EC2 instances behind an Application Load Balancer. The design must tolerate the failure of one Availability Zone. What should the Auto Scaling group configuration include?

Accepted Answer

Subnets in at least two Availability Zones with health checks enabled. Distributing EC2 instances across subnets in at least two Availability Zones ensures that if one AZ fails, the Auto Scaling group can maintain capacity using instances in the remaining AZ(s). Enabling health checks allows the group to detect and replace unhealthy instances, which is essential for fault tolerance. This configuration meets the requirement to tolerate the failure of one Availability Zone.

Answer

A single EC2 instance with detailed monitoring

Answer

All instances in one larger subnet

Answer

A Network Load Balancer in one subnet

Question 18

A static website uses an Amazon S3 bucket as the origin for an Amazon CloudFront distribution. The team accidentally configured the S3 bucket policy to allow s3:GetObject to Principal "*", so objects are accessible via direct S3 URLs. They want to ensure objects are retrievable only through CloudFront. What is the best corrective action?

Accepted Answer

Remove public access from the bucket and update the bucket policy to allow GetObject only from CloudFront using the distribution’s SourceArn (and use CloudFront origin access control or origin access identity).. The S3 bucket policy currently allows s3:GetObject from any principal, making objects publicly accessible via direct S3 URLs. By removing public access and updating the policy to restrict GetObject to only requests that originate from the CloudFront distribution (using either Origin Access Control or Origin Access Identity), objects become retrievable exclusively through CloudFront, preventing direct S3 access.

Answer

Enable S3 static website hosting and disable CloudFront, because website hosting blocks direct object URL access.

Answer

Add a WAF rule that rate-limits requests to the S3 bucket domain to make direct access impractical.

Answer

Turn on S3 object versioning so that attackers cannot read previous objects.

Question 19

A inventory service uses Lambda functions that call an unreliable third-party API. Failed events must be retained for later investigation after retries are exhausted. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

A Lambda dead-letter queue or failure destination. Lambda dead-letter queues (DLQs) or failure destinations are the correct AWS-native mechanism to retain failed events after retries are exhausted. When a Lambda function fails to process an event (e.g., due to an unreliable third-party API), the function can be configured to send the failed event payload to an SQS queue or SNS topic for later investigation. This ensures no data loss and aligns with the requirement for a managed, AWS-native solution.

Answer

Lambda reserved concurrency set to zero

Answer

A larger deployment package

Answer

CloudFront error pages

Question 20

A internal reporting portal serves infrequently accessed user documents that must be available immediately when requested. Which S3 storage class is likely the best cost fit?

Accepted Answer

S3 Standard-IA or S3 One Zone-IA depending on resilience requirements. S3 Standard-IA or S3 One Zone-IA is the best cost fit because the data is infrequently accessed but must be available immediately when requested. These storage classes offer low-latency retrieval (milliseconds) at a lower storage cost than S3 Standard, with the trade-off of a retrieval fee. The choice between Standard-IA and One Zone-IA depends on whether the application requires resilience against Availability Zone failures.

Answer

Instance store volumes

Answer

S3 Glacier Deep Archive

Answer

S3 Standard for all objects