SAA-C03 Practice Test 34 — 15 Questions

Question 1

A solutions architect is designing a high-performance architecture for a real-time analytics application. The application ingests a continuous stream of data from thousands of IoT devices. The data must be processed in near real-time, and the results must be stored in a durable, scalable data store for later analysis. The architect needs to choose AWS services that can handle the ingestion and processing of the stream. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon Kinesis Data Streams to ingest the data.. Amazon Kinesis Data Streams provides a scalable, durable ingestion layer for real-time streaming data, capable of handling thousands of IoT devices. AWS Lambda can be integrated as a consumer to process records in near real-time, automatically scaling with the stream. Together, they form a serverless pipeline that ingests and processes data with low latency, and can write results to a durable store like S3 or DynamoDB.

Answer

Use AWS Glue to process the stream in real time.

Answer

Use Amazon Redshift to ingest the data directly from the devices.

Answer

Use Amazon SQS FIFO queues to ingest the data.

Question 2

A logistics company runs workloads in a VPC with private subnets that have no internet gateway route. Instances in these subnets must retrieve secrets from AWS Secrets Manager and download patches from an Amazon S3 bucket owned by the company. The security team requires that this traffic never traverse the public internet. (Choose two.)

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and associate it with the private subnets' route tables.. Private connectivity to AWS services uses VPC endpoints. Secrets Manager requires an interface endpoint because it is accessed over its API through PrivateLink, while S3 supports a gateway endpoint that adds a route to the subnet route tables. Together these endpoints keep both secret retrieval and patch downloads inside the AWS network without an internet gateway or NAT gateway.

Answer

Create a VPC peering connection between the private subnets' VPC and the S3 service VPC in the same region.

Answer

Deploy a NAT gateway in a public subnet and route the private subnets' traffic to it.

Answer

Attach an internet gateway to the VPC and add a route for 0.0.0.0/0 to the private subnets' route tables.

Question 3

A CI/CD pipeline needs to deploy to your production environment. Security requires that the pipeline uses temporary credentials (not long-lived access keys) and only has permissions to read a specific set of parameters from AWS Systems Manager Parameter Store and write application logs to CloudWatch Logs. What is the best AWS approach?

Accepted Answer

Create an IAM role in the production account, grant least-privilege policies, and let the CI assume it using STS AssumeRole.. It uses an IAM role with least-privilege policies that the CI/CD pipeline can assume via AWS STS AssumeRole, providing temporary credentials that automatically expire. This avoids long-lived access keys and meets the security requirement of using temporary credentials. The role can be scoped to allow only reading specific parameters from Systems Manager Parameter Store and writing logs to CloudWatch Logs, adhering to the principle of least privilege.

Answer

Create an IAM user for the pipeline and store access keys in the CI system.

Answer

Attach the required permissions to an IAM group and add the pipeline’s principal to that group directly.

Answer

Use AWS KMS to encrypt the pipeline’s access keys and store the ciphertext in the CI system.

Question 4

A company runs an application in private subnets (no inbound internet). The application must access Amazon S3 and AWS Secrets Manager endpoints without routing through the public internet and without exposing the instances to NAT gateways due to cost. Security requirements also state that only the required VPC traffic should be allowed to reach AWS services.

Which architecture best satisfies these requirements?

Accepted Answer

Add a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager; keep instances in private subnets and configure security group rules attached to the endpoints to allow inbound traffic only from the application subnets.. It uses a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager, both of which allow private subnet instances to access these AWS services without traversing the public internet or requiring a NAT gateway. The security group rules attached to the interface endpoint restrict inbound traffic to only the application subnets, satisfying the security requirement of allowing only required VPC traffic. This architecture avoids NAT gateway costs and keeps instances isolated from inbound internet traffic.

Answer

Place instances in private subnets but use NAT gateways so traffic to S3 and Secrets Manager goes through the internet; restrict security groups to instance-to-instance only.

Answer

Use public subnets with instances that have no security group rules; rely on AWS services to reject unauthorized traffic.

Answer

Create an S3 bucket policy that allows requests from the application instances’ private IP addresses and enable public access to Secrets Manager via the default service endpoint.

Question 5

An e-commerce application uses Aurora MySQL. Writes are modest, but the product-detail page generates many read-only queries and the writer instance CPU is high. The application can tolerate a small amount of replication lag on those reads. What should the team do?

Accepted Answer

Add Aurora read replicas and send read-only traffic to the reader endpoint.. Adding Aurora read replicas and directing read-only traffic to the reader endpoint offloads SELECT queries from the writer instance, reducing its CPU load. Aurora replicas share the same underlying storage volume, so replication lag is minimal (typically <100ms) and acceptable for the product-detail page. This scales read throughput without increasing writer instance size or cost.

Answer

Increase the writer instance size and keep all traffic on the primary.

Answer

Replace Aurora with DynamoDB to eliminate replication lag.

Answer

Enable Multi-AZ failover only, because it increases read throughput automatically.

Question 6

A team serves static web assets (JS, CSS, images) from an Amazon S3 origin through CloudFront. Recently, the S3 origin has received a high number of requests for the same files, increasing origin data transfer costs. CloudFront access logs show many cache misses, and each request includes a unique query string used only for tracking (for example, ?utm=...). The application does not require query-string-specific content. What CloudFront change will most directly reduce origin fetches and cost?

Accepted Answer

Update the CloudFront cache policy to exclude query strings from the cache key so that requests differing only by tracking query parameters reuse the same cached object.. CloudFront's cache policy controls which parts of a request (including query strings) are included in the cache key. By excluding the tracking query strings (e.g., `?utm=...`) from the cache key, CloudFront will treat all requests for the same file as identical, serving the cached object regardless of the query string. This directly reduces the number of origin fetches (cache misses) and lowers S3 data transfer costs, as the application does not require query-string-specific content.

Answer

Lower the minimum TTL and set Cache-Control headers to no-store to force CloudFront to revalidate more often.

Answer

Enable Origin Shield to ensure all origin fetches go through a single regional shield with no other configuration changes.

Answer

Switch the S3 origin from S3 to a different storage class optimized for request rates, keeping the cache key the same.

Question 7

A media company stores its video uploads in an Amazon S3 bucket. The security team wants to ensure that any objects uploaded to the bucket are encrypted at rest using keys managed in AWS Key Management Service (AWS KMS) and that the encryption key is rotated annually. Which solution should a solutions architect recommend?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-KMS with a customer managed key configured for annual rotation.. Using SSE-KMS with a customer managed key satisfies both the encryption at rest requirement and the annual key rotation requirement. S3 default encryption automatically applies the chosen encryption method to all new objects, ensuring consistent protection without relying on upload headers. This approach provides the necessary control over the encryption keys.

Answer

Configure a bucket policy that denies uploads unless the request includes the x-amz-server-side-encryption header with the value AES256.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Use S3 server access logs to verify that objects are encrypted with a KMS key.

Question 8

A company runs a customer portal on an Amazon Aurora PostgreSQL cluster. The application currently connects directly to the writer instance endpoint and keeps long-lived connections open. During a maintenance failover, writes fail until clients are restarted. The team wants the application to reconnect to the correct Aurora endpoint automatically and reduce user-visible write interruptions.

Which change is most likely to achieve this?

Accepted Answer

Use the Aurora cluster endpoint for write traffic, use the reader endpoint for read-only traffic, and implement connection retry or reconnect logic on failover.. The Aurora cluster endpoint automatically points to the current writer instance, so using it for write traffic ensures that after a failover, new writes are directed to the new writer without needing to change the connection string. Implementing connection retry or reconnect logic in the application is essential because the existing long-lived connections will be broken during failover; the application must detect the failure and re-establish connections to the cluster endpoint to resume writes seamlessly.

Answer

Keep using the original writer instance endpoint so the database host name never changes during failover.

Answer

Convert the Aurora cluster to Single-AZ so there is only one database node to connect to.

Answer

Place Route 53 in front of the database and manually update DNS records whenever failover occurs.

Question 9

A healthcare analytics firm stores protected health information in an Amazon S3 bucket encrypted with SSE-KMS using a customer managed key. The firm's security team wants to ensure that only a specific IAM role used by an analytics application can decrypt objects, while other principals in the same account with broad S3 permissions cannot. The key policy currently grants kms:* to the account root. Which change should a solutions architect make to enforce the restriction?

Accepted Answer

Edit the KMS key policy to remove kms:Decrypt from the account root statement and add a statement that allows kms:Decrypt only to the analytics application's IAM role, then remove any identity-based policies that grant kms:Decrypt to other principals.. For SSE-KMS objects, reading an object requires permission to both the S3 object and the KMS key. The KMS key policy is the authoritative control that can limit kms:Decrypt to the analytics application's role. Removing broad decrypt grants from the root statement and from other identity-based policies ensures that other principals with S3 permissions cannot decrypt the protected health information.

Answer

Enable S3 Block Public Access on the bucket and require requests to use TLS by adding a bucket policy condition aws:SecureTransport.

Answer

Add an S3 bucket policy that denies s3:GetObject to all principals except the analytics application's IAM role.

Answer

Change the bucket's default encryption from SSE-KMS to SSE-S3 so that AWS manages the keys and only the bucket owner can read objects.

Question 10

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to deploy a web application that must be accessible from the internet. The application will run on Amazon EC2 instances in an Auto Scaling group. The security team requires that the instances be in private subnets and that inbound traffic from the internet be allowed only on ports 80 and 443. They also want to use an Application Load Balancer (ALB) for load balancing and SSL termination. Which architecture meets these requirements?

Accepted Answer

Deploy the ALB in public subnets, the EC2 instances in private subnets, and configure the ALB security group to allow inbound 80/443 from 0.0.0.0/0. Configure the EC2 security group to allow inbound traffic only from the ALB security group.. The correct architecture uses public subnets for the ALB and private subnets for the EC2 instances. The ALB security group allows inbound internet traffic on 80/443, while the EC2 security group allows inbound only from the ALB. This design ensures the instances are not directly accessible from the internet and meets the load balancing and SSL termination requirements.

Answer

Deploy the ALB in public subnets, the EC2 instances in private subnets, and configure the ALB security group to allow inbound 80/443 from the VPC CIDR. Configure the EC2 security group to allow inbound traffic from the ALB security group.

Answer

Deploy the ALB in public subnets, the EC2 instances in public subnets, and configure both security groups to allow inbound 80/443 from 0.0.0.0/0. Configure the EC2 instances to use an Elastic IP address.

Answer

Deploy the ALB in private subnets, the EC2 instances in public subnets, and configure the ALB security group to allow inbound 80/443 from 0.0.0.0/0. Configure the EC2 security group to allow inbound traffic only from the ALB security group.

Question 11

A media processing workflow generates analytics files that are accessed unpredictably. Some files become hot again months later. The team wants automatic storage cost optimisation without retrieval delays. What should be used?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering automatically moves objects between access tiers (frequent, infrequent, and archive instant access) based on changing access patterns, with no retrieval delays for hot objects. This is ideal for unpredictable access where some files become hot again months later, as it optimizes storage costs without manual intervention or retrieval latency.

Answer

Manual monthly review and object copying

Answer

S3 Glacier Flexible Retrieval for all files

Answer

EFS One Zone for analytics files

Question 12

You run a web application on an EC2 Auto Scaling group behind an Application Load Balancer (ALB). During scheduled traffic spikes, new instances launch but customers occasionally see 5xx errors for the first few minutes after scale-out. Operational logs show instances need ~4 minutes to warm up (load caches and initialize dependencies). ALB target health becomes healthy only after this warm-up. Which change most directly improves performance during spikes by reducing the time to serve traffic after scaling?

Accepted Answer

Use an Auto Scaling warm pool so instances are pre-initialized and ready to register quickly when the ASG scales out.. B is correct because a warm pool pre-initializes instances (e.g., loading caches and dependencies) before they are added to the Auto Scaling group. When the ASG scales out, these pre-warmed instances can be quickly moved into service, bypassing the ~4-minute warm-up delay and reducing the window for 5xx errors.

Answer

Configure a larger ALB deregistration delay so that old targets remain longer before termination.

Answer

Increase the number of desired instances immediately without using scaling policies, and then rely on manual reconfiguration.

Answer

Switch from ALB to NLB so instances become reachable sooner without waiting for health checks.

Question 13

A marketing site serves versioned JavaScript and CSS files from Amazon S3 through CloudFront. The origin bill is rising because CloudFront keeps fetching the same files too often, and the application never changes a file at the same URL once it is published. Which two changes should you make? Select two.

Accepted Answer

Set long-lived Cache-Control headers, such as a high max-age and immutable policy, on the versioned assets.. Setting long-lived Cache-Control headers (e.g., `max-age=31536000` and `immutable`) on versioned assets tells CloudFront and browsers to cache the files aggressively. Since the application never changes a file at the same URL, this eliminates redundant origin fetches, directly reducing the origin bill.

Answer

Move the static assets to an EC2 web server behind an Application Load Balancer.

Answer

Disable CloudFront caching so every request always reaches the origin.

Answer

Add more viewer-facing headers to the cache key so each browser variation gets a unique cached object.

Question 14

A web application for a healthcare document service is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy? The design must avoid adding custom operational scripts.

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP/HTTPS requests. It provides managed rules specifically designed to block common attack patterns like SQL injection and cross-site scripting (XSS) without requiring custom scripts or manual rule maintenance, thus meeting the requirement for minimum operational overhead.

Answer

Security groups on the application instances

Answer

Network ACLs on the public subnets

Answer

AWS Shield Advanced only

Question 15

A fleet of test servers is rebuilt every week from AMIs. EBS volumes are often left behind after termination, and the team creates daily snapshots of every volume even when nothing changes. Which three actions most reduce storage cost while preserving recovery options? Select three.

Accepted Answer

Use gp3 for new EBS volumes instead of gp2 when similar performance is enough.. Option A is correct because gp3 volumes are billed at a lower per-GB price than gp2 and let you provision IOPS and throughput independently of capacity, so workloads with similar performance needs cost less without sacrificing recovery capability. Option B is correct because Amazon Data Lifecycle Manager automates snapshot creation and, crucially, retention/deletion policies, which stops the accumulation of stale daily snapshots that drive storage cost. Option C is correct because the EBS Snapshot Archive tier stores rarely restored snapshots at a substantially lower price (up to ~75% cheaper) while still preserving them as a recovery option. Option D is wrong because leaving unattached EBS volumes after termination incurs ongoing per-GB charges and directly increases cost rather than reducing it. Option E is wrong because raising provisioned IOPS increases cost and does not address the leftover volumes or redundant snapshots, and IOPS provisioning does not meaningfully speed snapshot restore.

Answer

Keep unattached volumes around for troubleshooting after instance termination.

Answer

Raise provisioned IOPS on every volume so snapshot restore time feels faster.