SAA-C03 Practice Test 35 — 15 Questions

Question 1

Based on the exhibit, the database must fail over automatically if the primary Availability Zone goes down. Which solution should the architect choose?

Accepted Answer

Convert the database to a Multi-AZ RDS deployment.. Option B is correct because a Multi-AZ RDS deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, without requiring manual intervention or changes to the application connection string.

Answer

Create a read replica in the same Availability Zone as the primary database.

Answer

Increase the backup retention period to 35 days.

Answer

Move the database to an EC2 instance with an attached EBS volume.

Question 2

Based on the exhibit, which AWS feature should the team use to minimize network latency between EC2 instances that exchange messages very frequently?

Accepted Answer

Use a cluster placement group to place instances close together.. A cluster placement group is the correct choice because it groups EC2 instances within a single Availability Zone with low-latency, high-bandwidth networking, achieving single-digit millisecond latency between instances. This is ideal for applications that exchange messages very frequently, as it minimizes network hops and maximizes throughput.

Answer

Use a spread placement group to maximize instance separation across hardware.

Answer

Use a partition placement group to distribute instances across many partitions.

Answer

Use multiple Auto Scaling groups to spread traffic across more subnets.

Question 3

An orders service publishes payment instructions to an Amazon SQS Standard queue. The downstream processor sometimes times out after it has already applied the payment, but before it can delete the message from the queue. As a result, the same payment instruction can be processed more than once. The team wants the strongest way to prevent duplicate side effects while keeping the system decoupled. What should they implement?

Accepted Answer

Make the downstream processor idempotent by recording processed payment instruction IDs in a durable datastore and ignoring repeats.. Option C is correct because making the downstream processor idempotent ensures that duplicate payment instructions are safely ignored, even if the same message is delivered more than once. This approach provides the strongest guarantee against duplicate side effects without requiring changes to the queue type or increasing visibility timeouts, and it keeps the system fully decoupled.

Answer

Keep the queue as SQS Standard but increase the visibility timeout so duplicates are less likely to reappear during timeouts.

Answer

Change the queue to an SQS FIFO queue and use a stable deduplication ID derived from the payment instruction ID.

Answer

Use an ALB health check to restart the downstream processor when timeouts occur.

Question 4

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a financial reporting platform. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy? The design must avoid adding custom operational scripts.

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. Option D is correct because the bucket policy can use the `aws:sourceVpce` condition key to restrict access to requests originating from a specific VPC endpoint. This ensures that only traffic routed through that endpoint can access the S3 bucket, meeting the security team's requirement without custom scripts.

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A deny statement for all IAM users except the EC2 role

Question 5

A test environment stores logs in S3. Logs are queried for 30 days, rarely accessed for one year, and then retained for compliance. What should reduce storage cost? The architecture review board prefers a managed AWS-native control.

Accepted Answer

S3 lifecycle policy that transitions objects to lower-cost storage classes over time. Option C is correct because S3 Lifecycle policies allow you to automate the transition of objects from S3 Standard to lower-cost storage classes like S3 Standard-IA (after 30 days) and then to S3 Glacier Deep Archive (after one year) for long-term compliance. This matches the access pattern of frequent queries for 30 days, rare access for a year, and then retention-only, minimizing storage costs without manual intervention.

Answer

Keep all logs in S3 Standard indefinitely

Answer

Move all logs immediately to S3 Glacier Deep Archive

Answer

Use EBS snapshots for the logs

Question 6

An order processing workflow uses Amazon SQS as the decoupling layer between a producer and a consumer Lambda function. The consumer intermittently fails due to a downstream dependency. The team has observed that certain “poison” messages keep being retried repeatedly and prevent other messages from being processed efficiently. Which SQS configuration most directly addresses this issue?

Accepted Answer

Configure a redrive policy with a dead-letter queue (DLQ) and set an appropriate visibility timeout greater than the maximum processing time.. Option C is correct because configuring a redrive policy with a dead-letter queue (DLQ) allows messages that exceed a specified maximum receive count to be moved to the DLQ, isolating poison messages. Setting the visibility timeout greater than the maximum processing time ensures the consumer has enough time to process each message before it becomes visible again, preventing premature retries. This directly addresses the issue of poison messages blocking the queue and degrading throughput.

Answer

Set the SQS queue’s retention period to 10 years and rely on application retries to eventually succeed.

Answer

Increase visibility timeout to a very large value and avoid dead-letter queues to keep ordering stable.

Answer

Switch the queue to FIFO and remove retries in the Lambda event source mapping entirely.

Question 7

Based on the exhibit, which change will most improve the CloudFront cache hit ratio for the static assets while still serving the same files to all users?

Accepted Answer

Create a custom cache policy that includes only the v query string and excludes cookies.. The CloudFront cache hit ratio for static assets is reduced when query strings and cookies are forwarded to the origin, because each unique combination creates a separate cache entry. By creating a custom cache policy that includes only the 'v' query string (used for versioning) and excludes cookies, CloudFront can cache a single object for all users regardless of other query parameters or cookie values, maximizing cache hits while still serving the same file.

Answer

Enable Origin Shield and keep the current cache behavior unchanged.

Answer

Move the static assets to individual presigned URLs for each viewer.

Answer

Increase the CloudFront default TTL to 24 hours while continuing to forward all cookies and query strings.

Question 8

An orders service publishes payment instructions to an Amazon SQS Standard queue. A downstream consumer sometimes times out and retries the work, causing the consumer to process the same instruction more than once. Operationally, the team must ensure that duplicate processing does not create duplicate charges. The queue type cannot be changed. What is the most resilient application-side approach?

Accepted Answer

Implement idempotent processing using a persistent deduplication key (for example, paymentInstructionId) so repeated messages are ignored or safely merged.. Option B is correct because implementing idempotent processing with a persistent deduplication key (e.g., paymentInstructionId) ensures that even if SQS Standard delivers the same message multiple times due to consumer timeouts and retries, the downstream logic will detect and ignore or safely merge duplicate charges. This is the most resilient application-side approach as it does not rely on queue configuration changes and works within the constraints of SQS Standard's at-least-once delivery model.

Answer

Rely on SQS Standard to provide exactly-once delivery for each message, since the consumer uses retries.

Answer

Increase the queue’s visibility timeout to 24 hours so messages never reappear even if the consumer times out.

Answer

Delete and recreate the queue with a different name whenever duplicates are detected in production.

Question 9

Based on the exhibit, which design change is the best way to reduce the observed read latency for this DynamoDB-backed service?

Accepted Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table and send repeated read traffic through it.. Adding a DynamoDB Accelerator (DAX) cluster in front of the table reduces read latency by providing an in-memory cache that serves repeated read requests with microsecond response times, bypassing the need to read from the underlying DynamoDB table's SSD storage. This directly addresses the observed latency issue for frequently accessed data, as DAX is optimized for read-heavy workloads and supports eventual and strong consistency reads.

Answer

Increase the on-demand table limits so DynamoDB can automatically absorb more traffic.

Answer

Create a global secondary index on tenantId to distribute the load across more partitions.

Answer

Move the dashboard data into S3 and use Lambda functions to read it on demand.

Question 10

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The security team requires the decision to be auditable.

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) allow private subnets to access Systems Manager Parameter Store without traversing the internet, using private IP addresses within the VPC. This meets the requirement for private, auditable access because all traffic stays within the AWS network and can be logged via VPC Flow Logs.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 11

Based on the exhibit, a distributed analytics workload runs on 12 EC2 instances in one Availability Zone. The nodes exchange thousands of small messages per second and require the lowest possible intra-cluster latency and jitter. Which EC2 placement strategy is the best fit?

Accepted Answer

Cluster placement group, because it places instances physically close together in one Availability Zone.. A cluster placement group is the best choice because it places all 12 EC2 instances in a single Availability Zone within the same high-bandwidth, low-latency logical segment of the network. This minimizes the physical distance and network hops between nodes, achieving the lowest possible intra-cluster latency and jitter required for the thousands of small messages exchanged per second.

Answer

Spread placement group, because it places each instance on distinct underlying hardware.

Answer

Partition placement group, because it isolates nodes across rack partitions.

Answer

Move the workload behind an Application Load Balancer so node-to-node traffic is balanced more efficiently.

Question 12

Your order-processing system uses EventBridge rules to send events to a Lambda function that updates order status. Over the last week, some events fail with a transient database timeout, and the Lambda retries intermittently but then the events are lost (no alerts after failures). You want at-least-once processing, bounded retries, and a way to inspect unprocessable events for later reprocessing.

Which architecture change best meets these requirements?

Accepted Answer

Send EventBridge events to an SQS queue, configure a redrive policy to move messages to a dead-letter queue (DLQ) after a defined receive count, and make the Lambda processing idempotent.. Option A is correct because it introduces an SQS queue between EventBridge and Lambda, which provides at-least-once processing through message visibility timeouts and retries. The redrive policy moves messages to a dead-letter queue (DLQ) after a defined receive count, ensuring bounded retries and preserving unprocessable events for later inspection and reprocessing. Making the Lambda idempotent prevents duplicate side effects from at-least-once delivery.

Answer

Invoke Lambda directly from EventBridge in asynchronous mode, and increase the Lambda timeout to reduce failures.

Answer

Use SNS topics with Lambda subscriptions, but remove all retry and DLQ configuration to minimize duplicate events.

Answer

Store failed events only in CloudWatch logs, and have operators manually copy log entries back into the database for reprocessing.

Question 13

Based on the exhibit, which storage choice best matches the workload requirements?

Accepted Answer

Use instance store NVMe for the temporary processing workspace.. Instance store NVMe volumes provide temporary, ephemeral block storage directly attached to the EC2 instance, offering extremely low latency and high throughput for temporary processing workspaces. Since the workload requires a temporary workspace where data does not need to persist beyond the instance lifecycle, instance store is the optimal choice because it avoids the cost and overhead of durable storage while delivering the highest performance for scratch data.

Answer

Use io2 EBS volumes because they provide the highest durable block storage performance.

Answer

Use Amazon EFS for the workspace so the temporary files survive instance replacement.

Answer

Use S3 as the working directory and read and write the intermediate files directly there.

Question 14

Developers for a e-learning platform need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center permission sets allow you to define fine-grained permissions and assign them to users or groups with time-bound access (e.g., using a session duration or approval workflow). Combined with CloudTrail, every API call made during the elevated session is logged for audit, meeting the security team's requirements for approvals, expiry, and audit logging.

Answer

Disable CloudTrail during troubleshooting

Answer

Attach AdministratorAccess permanently to every developer role

Answer

Create shared administrator access keys for the team

Question 15

A payments API requires point-in-time recovery and accidental-delete protection for a DynamoDB table. Which two settings should the architect enable? The design must avoid adding custom operational scripts.

Accepted Answer

Deletion protection or tightly controlled delete permissions. Deletion protection (option A) prevents accidental deletion of the DynamoDB table itself, which is critical for the accidental-delete protection requirement. Point-in-time recovery (option B) enables restoring the table to any point within the last 35 days, satisfying the point-in-time recovery requirement. Both features are native DynamoDB capabilities that require no custom scripts.

Answer

Global secondary indexes

Answer

DAX

SAA-C03 Practice Test 35 — 15 Questions

Exhibit

SAA-C03 Practice Test 35 — 15 Questions

Exhibit