SAA-C03 Practice Test 32 — 15 Questions

Question 1

A Lambda function for a order processing API needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing and automatically rotating database credentials. It natively supports rotation every 30 days via a built-in Lambda rotation function, without requiring any custom operational scripts. This meets the requirement to avoid storing the password in environment variables and to automate rotation.

Answer

An encrypted object in Amazon S3

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

A KMS-encrypted Lambda environment variable

Question 2

A internal reporting portal serves infrequently accessed user documents that must be available immediately when requested. Which S3 storage class is likely the best cost fit? The architecture review board prefers a managed AWS-native control.

Accepted Answer

S3 Standard-IA or S3 One Zone-IA depending on resilience requirements. S3 Standard-IA or S3 One Zone-IA is the best cost fit because the data is infrequently accessed but requires immediate availability when requested. These storage classes offer lower storage costs than S3 Standard while providing millisecond first-byte latency, meeting the 'immediately available' requirement. The choice between Standard-IA and One Zone-IA depends on the resilience needs (e.g., multi-AZ vs. single-AZ durability).

Answer

Instance store volumes

Answer

S3 Glacier Deep Archive

Answer

S3 Standard for all objects

Question 3

A company stores customer invoices in an Amazon S3 bucket. The application must keep the bucket private, ACLs should not be used, and customers should receive temporary download links for individual invoices. Which three changes should the architect make? Select three.

Accepted Answer

Enable S3 Block Public Access on both the bucket and the AWS account.. Option A is correct because enabling S3 Block Public Access at both the bucket and account level ensures that no public access is granted to the bucket or its objects, which aligns with the requirement to keep the bucket private. This setting overrides any other permissions that might inadvertently allow public access, providing a strong security baseline.

Answer

Continue using object ACLs so each customer invoice can be made public briefly.

Answer

Move the bucket to another AWS Region to isolate it from the internet.

Question 4

A global application experiences frequent writes and must survive a full Regional outage with near-zero data loss. The product team also requires that users can continue to write during the incident using the closest Region. Which approach is most aligned with these requirements?

Accepted Answer

Use an active/active design with multi-Region data replication (for example, global tables for the write-heavy datastore) and route traffic to multiple Regions based on health and latency.. Option A is correct because an active/active design with multi-Region data replication, such as DynamoDB global tables, allows writes to occur in any Region and replicates data asynchronously across Regions with sub-second latency. This ensures near-zero data loss (RPO of seconds) and continuous write availability during a full Regional outage, while Route 53 latency-based routing directs users to the closest healthy Region.

Answer

Use warm standby with periodic backups of the primary write datastore every 24 hours.

Answer

Use pilot light where the secondary Region runs only infrastructure templates and starts data replication only after detecting failure.

Answer

Use a single-writer model in one Region and deploy read-only replicas in the other Region for continuity.

Question 5

A latency-sensitive video platform uploads large files to S3 from users around the world. Which two features can improve upload performance? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Transfer Acceleration. S3 Transfer Acceleration (B) uses AWS edge locations to route uploads over optimized network paths, reducing latency for users far from the destination bucket. S3 Multipart Upload (C) allows parallel uploads of file parts, improving throughput and resilience for large files. Both features enhance upload performance without requiring custom scripts.

Answer

S3 Object Lock

Answer

S3 Inventory

Question 6

A latency-sensitive mobile game backend uploads large files to S3 from users around the world. Which two features can improve upload performance? The architecture review board prefers a managed AWS-native control.

Accepted Answer

S3 multipart upload. B is correct because S3 multipart upload allows a large file to be broken into smaller parts and uploaded in parallel, which significantly reduces the impact of network latency and improves throughput. This is especially beneficial for latency-sensitive applications where upload speed is critical.

Answer

S3 Object Lock

Answer

S3 Inventory

Question 7

A media company runs a 24/7 recommendation engine on EC2 in one AWS Region. The workload is interruption-intolerant, and the team expects steady usage but may change instance families and sizes during planned optimizations. Compared to the current On-Demand setup, they want the lowest cost while avoiding the rigidity of locking to a specific instance type.

What should the solutions architect recommend?

Accepted Answer

Purchase a Compute Savings Plan for the expected steady hourly usage in that Region.. A Compute Savings Plan offers the lowest cost for steady-state usage without locking to a specific instance type, providing up to 66% discount over On-Demand while allowing flexibility to change instance families, sizes, OS, or tenancy within a Region. This matches the requirement for cost savings with instance flexibility during planned optimizations.

Answer

Switch the instances to Spot Instances and use interruption handling because it is the largest discount.

Answer

Purchase a Standard Reserved Instance tied to a single specific instance type for the next 3 years.

Answer

Keep On-Demand and rely on Auto Scaling to reduce capacity when utilization is low.

Question 8

A mobile banking backend uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend? The design must avoid adding custom operational scripts.

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS allows EC2 instances to authenticate to PostgreSQL using a short-lived token generated via the IAM instance profile, eliminating the need to store credentials on the instance. The token is obtained by calling the RDS generate_db_auth_token API with the instance's IAM role, and it is valid for 15 minutes by default. This approach satisfies the requirement for short-lived credentials and avoids custom operational scripts.

Answer

Store the database password in user data

Answer

Use a security group rule that allows only application instances

Answer

Embed the database password in the AMI

Question 9

A media company serves versioned JavaScript and CSS files from an Amazon S3 origin through CloudFront. After each release, origin requests spike even though the files are public. Browser requests include a tracking cookie, an Authorization header, and a cache-busting query string that the site no longer needs. Which three changes will most improve the CloudFront cache hit ratio without exposing private content? Select three.

Accepted Answer

Rename each static asset with a content hash or release version in the filename before publishing.. Option A is correct because renaming static assets with a content hash or version in the filename ensures that each new release creates a unique object key in S3. This allows CloudFront to treat the new file as a distinct object, avoiding cache invalidation issues and enabling long-term caching of the old version. Without this, even with cache-busting query strings, CloudFront might still serve stale content or require frequent invalidations, reducing the cache hit ratio.

Answer

Enable CloudFront compression and configure the origin to return Cache-Control: no-store for all files.

Answer

Forward all viewer headers to the origin so CloudFront can personalize every request.

Question 10

A team runs an Amazon NLB in a VPC with targets registered in multiple Availability Zones (AZs). Their bill shows high inter-AZ data transfer charges. They want to reduce unnecessary cross-AZ traffic costs while still maintaining healthy targets per AZ. What change is most likely to reduce inter-AZ charges?

Accepted Answer

Disable cross-zone load balancing on the NLB so each client is routed to targets in the same AZ when possible.. Option A is correct because disabling cross-zone load balancing on an NLB ensures that each client is routed only to targets within the same Availability Zone as the NLB node that receives the traffic. This eliminates inter-AZ data transfer charges because traffic never leaves the AZ boundary, while still maintaining healthy targets per AZ as each AZ independently handles its own client requests.

Answer

Enable cross-zone load balancing so all targets receive traffic from every AZ.

Answer

Move the NLB to a different Region so traffic is always kept local.

Answer

Replace the NLB with a NAT gateway to reduce data charges between AZs.

Question 11

A regional web application for a inventory service must fail over automatically to a secondary Region if the primary endpoint becomes unhealthy. Which two services or features are required? The design must avoid adding custom operational scripts.

Accepted Answer

Route 53 failover routing with health checks. Route 53 failover routing with health checks (Option A) is required because it automatically evaluates the health of the primary endpoint and, upon detecting failure, updates DNS resolution to direct traffic to the secondary Region. This is the native AWS mechanism for DNS-based failover without custom scripts, relying on Route 53 health checkers to assess endpoint health via HTTP/HTTPS/TCP or calculated health checks.

Answer

S3 Transfer Acceleration

Answer

AWS Organizations service control policies

Question 12

A ticket booking system stores uploaded documents in S3. The business requires a copy in another AWS Region for disaster recovery. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

S3 Cross-Region Replication with versioning enabled. S3 Cross-Region Replication (CRR) is a fully managed AWS-native feature that automatically replicates objects from a source S3 bucket in one AWS Region to a destination bucket in another Region, meeting the disaster recovery requirement for a geographically separate copy. Enabling versioning on both buckets is mandatory for CRR to function, as it tracks object versions and ensures consistency during replication.

Answer

S3 lifecycle transition to Glacier Flexible Retrieval

Answer

An EBS snapshot schedule

Answer

A CloudFront distribution

Question 13

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a B2B file exchange site. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy?

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. The correct answer is A because the bucket policy must include a condition that matches `aws:sourceVpce` to the specific VPC endpoint ID. This ensures that only traffic originating from that VPC endpoint (e.g., `vpce-12345678`) is allowed to access the S3 bucket, meeting the security team's requirement. Without this condition, any traffic from the private subnet that routes through the endpoint would be allowed, but the policy explicitly restricts access to only that endpoint.

Answer

A deny statement for all IAM users except the EC2 role

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A security group rule that allows HTTPS to S3

Question 14

A media archive requires consistent high IOPS for a transactional database on EC2. Which EBS volume type is most suitable? The team wants the control to be enforceable during normal operations.

Accepted Answer

Provisioned IOPS SSD such as io2. The io2 Provisioned IOPS SSD volume type is designed for latency-sensitive transactional database workloads that require consistent high IOPS. It allows you to specify a guaranteed IOPS rate (up to 256,000 IOPS for io2 Block Express) and provides 99.999% durability, making it ideal for enforcing performance control during normal operations.

Answer

st1 Throughput Optimized HDD

Answer

Instance store only

Answer

sc1 Cold HDD

Question 15

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The team wants the control to be enforceable during normal operations.

Accepted Answer

Interface VPC endpoint for Systems Manager. An Interface VPC endpoint (AWS PrivateLink) for Systems Manager allows the private subnets to securely access Systems Manager Parameter Store without traversing the internet, using private IP addresses within the VPC. This ensures traffic stays within the AWS network and is enforceable via VPC endpoint policies and security groups.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone