SAA-C03 Practice Test 33 — 15 Questions

Question 1

A solutions architect is designing a highly available and resilient architecture for a critical internal application that processes financial transactions. The application runs on Amazon EC2 instances inside an Auto Scaling group. The database layer uses an Amazon Aurora MySQL cluster. The company requires that if an entire AWS Availability Zone (AZ) fails, the application must remain operational with minimal impact and automatically recover without manual intervention. Which combination of architectural decisions will meet these requirements? (Choose four.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an Application Load Balancer (ALB) to distribute traffic across EC2 instances in multiple Availability Zones.. Configuring the Auto Scaling group to span at least three Availability Zones ensures that if one AZ fails, the remaining AZs have sufficient capacity to handle the load, and the Auto Scaling group can automatically launch new instances in the healthy AZs. Deploying the Aurora cluster with at least one Aurora Replica in a different AZ than the primary instance provides automatic failover to a replica in under 30 seconds, ensuring database resilience without manual intervention. Using an Application Load Balancer (ALB) to distribute traffic across EC2 instances in multiple AZs allows the ALB to automatically route traffic away from failed AZs and only to healthy targets, maintaining application availability. Setting up an Amazon RDS Proxy manages database connections by pooling and reusing them, which reduces the load on the database during failover and improves resilience by providing seamless connection handling across AZ failures.

Answer

Deploy the Aurora cluster with a single DB instance to reduce complexity and cost.

Answer

Place the EC2 instances in a single Availability Zone to ensure data locality with the primary database.

Question 2

A company is migrating its on-premises workloads to AWS and wants to optimize costs. Which three strategies should the company implement to achieve a cost-optimized architecture? (Choose three.)

Accepted Answer

Use Spot Instances for fault-tolerant, flexible workloads to achieve significant cost savings.. Reserved Instances or Savings Plans provide significant discounts (up to 72%) over On-Demand pricing for predictable workloads by committing to a specific usage term (1 or 3 years). This directly reduces compute costs for steady-state applications, making it a core cost-optimization strategy.

Answer

Deploy all resources in a single Availability Zone to minimize data transfer costs.

Answer

Provision additional EC2 instances to handle peak load at all times, ensuring maximum performance.

Answer

Store all data in Amazon S3 Standard storage class to avoid any data retrieval costs.

Question 3

A distributed system needs extremely low network latency between a set of EC2 instances running the same workload. The team wants the instances to be placed as close together as AWS allows to reduce round-trip time. Which placement strategy should the architect use?

Accepted Answer

Use a Cluster placement group for the instances that must communicate frequently over low latency.. A Cluster placement group is the correct choice because it places instances in a single Availability Zone within the same rack or logical cluster, providing the lowest possible network latency and maximum throughput (up to 10 Gbps for single-flow traffic) between instances. This is ideal for tightly coupled, latency-sensitive workloads like HPC or real-time distributed systems.

Answer

Use a Spread placement group across multiple Availability Zones to maximize fault tolerance.

Answer

Use the default placement strategy without specifying a placement group.

Answer

Use a placement group of type Partition to ensure independent failure of each instance.

Question 4

A mobile game backend uses Amazon Aurora. The workload has many short-lived database connections from Lambda functions, causing connection storms. What should be added? The design must avoid adding custom operational scripts.

Accepted Answer

RDS Proxy. RDS Proxy is the correct choice because it pools and shares database connections, reducing the overhead of establishing new connections for each Lambda invocation. This prevents connection storms by maintaining a persistent pool of connections to Aurora, which is ideal for short-lived, high-frequency connections from serverless functions like Lambda.

Answer

An internet gateway

Answer

S3 Select

Answer

A larger Route 53 hosted zone

Question 5

Order the steps to create a static website using Amazon S3 and CloudFront.

Accepted Answer

Create S3 bucket and enable static website hosting, then upload website files, then create CloudFront distribution, then configure CloudFront distribution (e.g., custom domain, SSL), then update DNS to point to CloudFront.. S3 bucket with hosting, upload files, CloudFront distribution, configure CloudFront, then DNS.

Answer

Upload website files to S3, then create S3 bucket and enable static website hosting, then create CloudFront distribution, then configure CloudFront, then update DNS.

Answer

Create S3 bucket and enable static website hosting, then create CloudFront distribution, then upload website files, then configure CloudFront, then update DNS.

Answer

Create S3 bucket and enable static website hosting, then upload website files, then create CloudFront distribution, then update DNS, then configure CloudFront.

Question 6

A batch analytics job has unpredictable DynamoDB traffic with long idle periods and occasional spikes. Which capacity mode should minimize operational overhead and avoid paying for idle provisioned capacity?

Accepted Answer

DynamoDB on-demand capacity mode. DynamoDB on-demand capacity mode automatically scales to handle unpredictable traffic spikes and idle periods, charging only for the reads and writes you perform. This eliminates the need to provision capacity for peak traffic, avoiding costs during long idle periods and reducing operational overhead from capacity management.

Answer

Reserved capacity for maximum daily traffic

Answer

Provisioned capacity set for peak traffic

Answer

Global tables in every Region

Question 7

A team stores application logs in Amazon S3. They need access to the logs only occasionally for troubleshooting (infrequent access), and they want to reduce storage cost automatically over time without manually moving objects. What should they implement?

Accepted Answer

An S3 lifecycle policy that transitions objects to a lower-cost storage class after a set number of days. An S3 lifecycle policy can automatically transition objects from S3 Standard to lower-cost storage classes (e.g., S3 Standard-IA, S3 One Zone-IA, or S3 Glacier Instant Retrieval) after a specified number of days. This meets the requirement of reducing storage costs over time for infrequently accessed logs without manual intervention, as the policy automates the movement based on object age.

Answer

An S3 lifecycle policy that deletes objects after 1 day to eliminate storage costs

Answer

An S3 lifecycle policy that keeps all objects in S3 Standard and only applies compression at read time

Answer

A policy that changes bucket encryption from SSE-S3 to SSE-KMS to reduce storage cost

Question 8

A document portal requires consistent high IOPS for a transactional database on EC2. Which EBS volume type is most suitable?

Accepted Answer

Provisioned IOPS SSD such as io2. Provisioned IOPS SSD (io2) is the correct choice because it delivers consistent, high IOPS performance required for transactional databases running on EC2. io2 volumes offer a 99.999% durability and can sustain up to 256,000 IOPS per volume, making them ideal for latency-sensitive workloads like OLTP databases.

Answer

sc1 Cold HDD

Answer

Instance store only

Answer

st1 Throughput Optimized HDD

Question 9

A backup process restores a 2 TB production database from an EBS snapshot onto a new volume. During the first hours after restore, the application sees slow reads whenever previously unused blocks are accessed. What is the best way to avoid this performance issue in future restores?

Accepted Answer

Enable Fast Snapshot Restore on the snapshots used for recovery.. When an EBS volume is restored from a snapshot, it is lazily loaded from Amazon S3 in the background. Accessing data blocks that have not yet been loaded triggers a read penalty because the volume must fetch them from S3 before serving the I/O. Enabling Fast Snapshot Restore (FSR) pre-warms the snapshot data so that restored volumes have full performance immediately, eliminating the slow reads on first access.

Answer

Increase the volume size to give the database more free space.

Answer

Move the database files to Amazon EFS after the restore completes.

Answer

Use magnetic standard volumes because they avoid snapshot hydration delays.

Question 10

A trading platform ingests market data events at very high volume and must deliver them with the lowest possible latency to multiple independent consumer applications. Each consumer must read the full stream independently, and ordering must be preserved per instrument symbol. Which solution meets these requirements?

Accepted Answer

Create an Amazon Kinesis Data Streams stream with a partition key of the instrument symbol, and have each consumer use the Kinesis Client Library.. Kinesis Data Streams is built for high-throughput, low-latency event ingestion where many applications read the same stream independently. Partitioning by instrument symbol guarantees that all events for a given symbol land on one shard and are read in order, and the Kinesis Client Library gives each consumer application its own checkpointed position without affecting the others.

Answer

Create an Amazon SQS FIFO queue with a message group ID of the instrument symbol, and have each consumer application use a separate queue.

Answer

Use AWS Database Migration Service with a change data capture task to replicate events into an Amazon Aurora cluster that each consumer queries.

Answer

Create an Amazon SNS topic and subscribe each consumer application with an Amazon SQS standard queue endpoint.

Question 11

An application runs on EC2 instances in private subnets behind an Application Load Balancer (ALB). Security groups allow inbound HTTPS (443) from the ALB’s security group to the instance security group, and outbound from instances is set to allow ephemeral ports.

Despite this, clients see connection timeouts. After reviewing network ACLs, you find the NACL associated with the instance subnet has an inbound allow for destination port 443, but it does not have a corresponding outbound allow for ephemeral ports.

What is the most likely reason the traffic fails, and what should be updated?

Accepted Answer

NACLs are stateless, so you must update the NACL to allow the return (outbound) ephemeral port range; security groups alone cannot override a blocked NACL.. Network ACLs are stateless, meaning they do not automatically allow return traffic. Even though the security group allows inbound HTTPS from the ALB, the NACL blocks the response traffic because it lacks an outbound rule for ephemeral ports (typically 1024-65535). Since NACLs are evaluated before security groups, a missing outbound allow rule causes the connection to time out.

Answer

NACLs are stateful and automatically track connections; the fix is to add a new inbound rule to the security group for client source ports.

Answer

The issue is caused by ALB health checks; configure a new target group health check on port 80 so traffic can be routed.

Answer

Because instances are in private subnets, add a NAT gateway so return traffic can reach the internet over dynamic routing.

Question 12

A media company stores daily financial exports in Amazon S3. The files must be protected against accidental overwrite or deletion, and the business also wants a second copy in another Region for recovery after a regional outage. Which two actions should the architect take? Select two.

Accepted Answer

Enable bucket versioning on the S3 bucket.. Option A is correct because enabling S3 bucket versioning preserves every prior version of an object, so an accidental overwrite creates a new version and an accidental delete only adds a delete marker, allowing the original data to be restored rather than lost. Option D is correct because S3 Cross-Region Replication (CRR) automatically copies objects to a bucket in a second AWS Region, providing the required second copy for recovery from a regional outage; versioning must be enabled on both source and destination buckets for replication to work. Option B is not relevant because S3 Transfer Acceleration only speeds up uploads over long distances using edge locations, and does not protect data or create a second copy. Option C is not appropriate because lifecycle policies to Glacier change storage class and cost, not immutability, and do not provide cross-Region recovery. Option E is not relevant because S3 Block Public Access only prevents public exposure and does not protect against overwrite, deletion, or regional failure.

Answer

Turn on S3 Transfer Acceleration for the bucket.

Answer

Use only lifecycle policies to move objects to Glacier.

Answer

Enable S3 Block Public Access on the bucket.

Question 13

A financial services company stores sensitive customer statements in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using keys that the company manages and rotates on its own schedule. The company also needs an audit trail of every time a key was used to encrypt or decrypt data. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS).. SSE-KMS with customer managed keys gives the company ownership of the key material lifecycle, including rotation, and integrates with AWS CloudTrail so every Encrypt and Decrypt call is logged. This combination directly addresses both the control and audit requirements. Other S3 encryption options either do not allow customer-managed rotation or do not produce a usable key usage audit trail.

Answer

Enable default encryption on the bucket using Amazon S3 managed keys and enable versioning.

Answer

Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3).

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Question 14

A travel booking site uses EC2 instances behind an ALB. CPU is consistently high during peak traffic, and request latency rises. What should be configured?

Accepted Answer

Auto Scaling policy based on an appropriate CloudWatch metric. An Auto Scaling policy based on a CloudWatch metric like CPUUtilization or request latency directly addresses the root cause: rising CPU and latency under peak traffic. By automatically adding EC2 instances when the metric breaches a threshold, the ALB can distribute load across more resources, reducing CPU per instance and improving response times. This is the standard AWS solution for dynamic scaling to maintain performance.

Answer

A VPC endpoint for CloudWatch only

Answer

S3 Object Lock

Answer

Disable health checks

Question 15

A trading dashboard stores uploaded documents in S3. The business requires a copy in another AWS Region for disaster recovery. What should be configured?

Accepted Answer

S3 Cross-Region Replication with versioning enabled. S3 Cross-Region Replication (CRR) with versioning enabled automatically replicates objects to a destination bucket in a different AWS Region, providing a durable, low-latency disaster recovery copy. Versioning must be enabled on both source and destination buckets to track object changes and ensure consistency during replication. This meets the requirement for a cross-region copy without manual intervention.

Answer

An EBS snapshot schedule

Answer

S3 lifecycle transition to Glacier Flexible Retrieval

Answer

A CloudFront distribution