SAA-C03 Practice Test 35 — 15 Questions

Question 1

Multiple EC2 instances in different Availability Zones need concurrent read/write access to the same shared files. The files are actively modified by several application servers, and low-latency metadata operations matter more than extremely high aggregate throughput. Which two changes should the team make? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon EFS instead of EBS or S3 for the shared file system.. Amazon EFS provides a fully managed, POSIX-compliant, shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones (AZs). It supports concurrent read/write access with strong consistency, and its metadata operations are optimized for low latency, making it ideal for workloads where many application servers actively modify the same files. EBS cannot be shared across AZs, and S3 lacks POSIX semantics and low-latency metadata operations.

Answer

Use a single EBS Multi-Attach volume mounted read/write by all instances across AZs.

Answer

Store the files in S3 and mount them directly through the console as a shared network filesystem.

Answer

Place the files on instance store volumes so each server has faster local access.

Question 2

A company runs a stateless containerized web application on Amazon ECS with the Fargate launch type behind an Application Load Balancer. The application must scale out quickly when request latency rises and scale in when traffic drops, and the operations team wants a managed target-tracking approach. Which solution meets these requirements?

Accepted Answer

Configure an Application Auto Scaling target-tracking scaling policy on the ECS service using the ALBRequestCountPerTarget metric.. Application Auto Scaling target tracking on the ECS service is the managed mechanism that adjusts desired task count in response to a metric. ALBRequestCountPerTarget reflects how much work each task is receiving from the load balancer, so it scales out before latency degrades and scales in as traffic falls, and it works natively with the Fargate launch type.

Answer

Use a scheduled scaling action on the ECS service to add tasks at the start of each business day.

Answer

Create an EC2 Auto Scaling group with a target-tracking policy and register the ECS tasks as instances.

Answer

Deploy the application on EC2 instances in an Auto Scaling group and use the ECS-optimized AMI, replacing Fargate.

Question 3

A DynamoDB table for a travel booking site has a partition key based only on the current date. Write throttling occurs during business hours. What is the best design change? The design must avoid adding custom operational scripts.

Accepted Answer

Use a higher-cardinality partition key that distributes writes across partitions. Using a low-cardinality partition key like the current date causes all writes to land on a single partition, leading to throttling. By designing a higher-cardinality key (e.g., combining date with a random suffix or user ID), writes are distributed evenly across partitions, fully utilizing the provisioned write capacity without custom scripts.

Answer

Create a global secondary index with the same date key

Answer

Move the table to S3 Glacier Instant Retrieval

Answer

Reduce the table's write capacity

Question 4

Based on the exhibit, which storage design best supports the application servers' shared working directory requirement?

Accepted Answer

Mount Amazon EFS on every EC2 instance and use it as the shared workspace.. Amazon EFS provides a fully managed, NFS-based shared file system that can be mounted concurrently on multiple EC2 instances across multiple Availability Zones. This directly satisfies the requirement for a shared working directory where all application servers can read and write files simultaneously without additional synchronization overhead.

Answer

Attach one gp3 EBS volume to each instance and synchronize the files with cron jobs.

Answer

Store the artifacts in S3 and have each node read them directly from S3 as a filesystem.

Answer

Use instance store on each instance because it provides the fastest local file access.

Question 5

A warehouse integration service must use shared file storage across Linux EC2 instances in multiple Availability Zones. The storage must remain available during an AZ failure. Which service should be used?

Accepted Answer

Amazon EFS with mount targets in multiple Availability Zones. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple Linux EC2 instances across different Availability Zones. By configuring mount targets in each AZ, the file system remains accessible even if one AZ fails, because the other mount targets continue to serve traffic. This meets the requirement for shared, highly available file storage across AZs.

Answer

S3 mounted as a POSIX file system without a file gateway

Answer

Instance store volumes

Answer

An EBS volume attached to all instances

Question 6

A web application runs on an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ASG is currently attached to subnets in only two Availability Zones (AZs). During a planned maintenance window, one AZ becomes unavailable for about 25 minutes. Monitoring shows that targets in the remaining AZ go healthy, and the ALB/target group health checks report normal. However, users still experience intermittent connection failures and slower responses during the AZ outage. What change will most directly improve resilience against an AZ loss while keeping the same ALB-based design?

Accepted Answer

Extend the ASG to use subnets in three AZs so there is placement redundancy during an AZ outage, while continuing to keep traffic behind the ALB.. B is correct because deploying the ASG across three Availability Zones (AZs) ensures that when one AZ becomes unavailable, the remaining two AZs can handle the full traffic load without overloading the instances. This placement redundancy directly addresses the intermittent connection failures and slower responses, as the ALB can distribute traffic only to healthy targets in the remaining AZs, maintaining capacity and performance. The current two-AZ setup lacks sufficient buffer capacity, causing the single remaining AZ to become overwhelmed during the outage.

Answer

Set the ASG min capacity to 0 so instances can be recreated faster when an AZ recovers.

Answer

Increase the ALB idle timeout to 120 seconds to reduce connection drops.

Answer

Disable health checks on the target group so instances are not deregistered during the maintenance window.

Question 7

A retail API uses EC2 instances behind an ALB. CPU is consistently high during peak traffic, and request latency rises. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

Auto Scaling policy based on an appropriate CloudWatch metric. An Auto Scaling policy based on a CloudWatch metric like CPUUtilization or ALB TargetResponseTime can dynamically add or remove EC2 instances to match demand. This directly addresses the high CPU and rising latency during peak traffic without requiring custom scripts, as the scaling actions are fully managed by AWS. The ALB distributes traffic across the scaled instances, reducing per-instance load and improving response times.

Answer

S3 Object Lock

Answer

A VPC endpoint for CloudWatch only

Answer

Disable health checks

Question 8

A startup runs an API on Amazon EC2. The instance must read items from one DynamoDB table and upload logs to one S3 bucket. Platform engineers also need a way to create new application roles, but those roles must never exceed a predefined set of permissions. Which three actions should the architect take? Select three.

Accepted Answer

Attach an IAM role to the EC2 instance profile and remove long-lived access keys from the server.. Option A is correct because attaching an IAM role to the EC2 instance profile lets the instance obtain temporary credentials from the instance metadata service (IMDS) via AWS STS, eliminating the need for long-lived access keys on the server. Option C is correct because least-privilege policies should scope permissions to the specific resources needed — the exact DynamoDB table ARN and the S3 bucket/prefix ARN — rather than granting broad access. Option E is correct because a permissions boundary sets the maximum permissions an IAM role can have, so even if the platform team creates new application roles, those roles can never exceed the predefined boundary. Option B is wrong because an IAM user with administrator access violates least privilege and embedding IAM user credentials on an instance is an anti-pattern. Option D is wrong because storing long-lived access keys in a configuration file is insecure and rotation does not remove the underlying risk that instance roles solve.

Answer

Give the EC2 instance an IAM user with administrator access for simplicity.

Answer

Store the access keys in the application configuration file and rotate them later.

Question 9

A company hosts a web application on Amazon EC2 instances in a VPC. The application must access an Amazon RDS for MySQL database. The security team requires that database credentials never be stored in application code or on disk, and that credentials be automatically rotated every 30 days. Which solution should a solutions architect implement?

Accepted Answer

Store the credentials in AWS Secrets Manager and configure automatic rotation using the provided RDS rotation Lambda function.. AWS Secrets Manager provides managed storage and native rotation for RDS credentials. The application retrieves the secret at runtime, so no credentials are embedded in code or persisted on disk. The built-in rotation Lambda handles the 30-day schedule automatically, meeting both the security and operational requirements without custom code.

Answer

Store the credentials in an encrypted Amazon S3 object and have the application download and decrypt it at startup.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter and enable automatic rotation with a custom Lambda function.

Answer

Use IAM database authentication for RDS and eliminate the need for a database password entirely.

Question 10

A small e-commerce company hosts its product catalog on a single Amazon EC2 instance in a public subnet. Traffic is steady and predictable, and the instance runs 24/7. The company wants to reduce its monthly compute bill without changing the architecture or risking availability. Which action should a solutions architect recommend?

Accepted Answer

Purchase a one-year Standard Reserved Instance for the instance.. For a steady, always-on instance that will not change family or Region, a Standard Reserved Instance delivers a substantial discount over On-Demand with no architectural change and no availability risk. It is the simplest, lowest-risk way to cut the monthly compute bill for this predictable workload.

Answer

Move the instance to a Spot Instance to take advantage of lower hourly rates.

Answer

Enable detailed monitoring and create a CloudWatch alarm to stop the instance when traffic is low.

Answer

Migrate the workload to a smaller instance type and enable burstable performance.

Question 11

A financial analytics platform runs a stateless API on Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer. The API reads from an Amazon Aurora MySQL cluster that has a single writer instance and one reader instance in a different Availability Zone. During a recent Availability Zone event, the writer instance failed and the API saw several minutes of failed writes. The team wants writes to resume automatically with minimal downtime and no application code changes. What should the solutions architect do?

Accepted Answer

Ensure the Aurora cluster has at least one Aurora Replica in a different Availability Zone and rely on the cluster's automatic failover, which updates the writer endpoint to point at the promoted replica.. Aurora provides automatic failover by promoting an existing Aurora Replica to the writer role and updating the cluster writer endpoint, so applications that connect through that endpoint reconnect without modification. The prerequisite is that a replica exists in a different Availability Zone from the writer, which makes it a viable failover target when the writer's zone is lost.

Answer

Add a second Aurora reader instance in a third Availability Zone and update the application connection string to use the reader endpoint for all queries.

Answer

Create an Aurora Replica in a second Availability Zone and promote it manually to writer using the AWS Management Console when a failure occurs.

Answer

Convert the cluster to an Aurora multi-master cluster so every instance can accept writes, and keep the existing writer endpoint in the connection string.

Question 12

Your AWS Organization uses a Service Control Policy (SCP) that includes a Deny statement for secretsmanager:GetSecretValue for all member accounts in the "Finance" OU when requests are made outside us-east-1. An application role has an IAM policy that allows secretsmanager:GetSecretValue for the required secret in us-west-2. In us-west-2, requests fail with AccessDenied. What is the most appropriate action?

Accepted Answer

Modify the SCP to allow secretsmanager:GetSecretValue in us-west-2 for the Finance OU (if that aligns with policy intent), or move the workload to us-east-1.. SCPs are deny-by-default and act as an outer boundary on all IAM policies in member accounts. Even if the application role's IAM policy allows secretsmanager:GetSecretValue in us-west-2, the SCP's explicit Deny for requests outside us-east-1 overrides that allow. The correct fix is either to modify the SCP to permit the action in us-west-2 (if that aligns with organizational intent) or to relocate the workload to us-east-1, because SCPs cannot be overridden by any IAM policy within the account.

Answer

Update the application role IAM policy to include us-west-2 in the resource ARN.

Answer

Create a permission boundary that removes the deny behavior for the member account.

Answer

Use sts:AssumeRole into another account that is not in the Finance OU to bypass the SCP.

Question 13

A company runs an internal analytics application in a single AWS Region. A solutions architect is reviewing the Amazon RDS for MySQL deployment and finds a Multi-AZ DB instance with a standby in another Availability Zone, used only for failover. The application performs many read-heavy queries against the primary instance, driving up instance size and cost. The team wants to offload read traffic and reduce the primary instance size. Which change should the architect recommend?

Accepted Answer

Add RDS read replicas and direct read-heavy queries to them.. Adding RDS read replicas moves read-heavy queries onto separate instances, relieving the primary and enabling a smaller, cheaper primary instance. The Multi-AZ standby exists only for failover and cannot serve reads, so the architect should introduce read replicas rather than re-architecting the deployment or switching database engines.

Answer

Convert the deployment to a Multi-AZ DB cluster with two readable standbys.

Answer

Migrate the database to Amazon DynamoDB with on-demand capacity.

Answer

Enable RDS Performance Insights and rely on it to reduce query cost.

Question 14

A mobile app reads the same product details many times per minute from Amazon DynamoDB. The table design is already correct, but repeated reads are still causing noticeable latency. Which service should the team add to improve read performance?

Accepted Answer

Amazon DAX. Amazon DAX (DynamoDB Accelerator) is an in-memory cache specifically designed for DynamoDB. It reduces read latency from single-digit milliseconds to microseconds by caching frequently accessed items, which directly addresses the repeated read pattern described in the question.

Answer

Amazon EFS

Answer

AWS Lambda

Answer

Amazon SNS

Question 15

A media company is designing a high-performance architecture to serve video content to users worldwide. The solution must minimize latency for end users and reduce the load on the origin servers. The video files are stored in an Amazon S3 bucket. Which three options should be combined to meet these requirements? (Choose three.)

Accepted Answer

Implement origin shield in CloudFront to reduce the number of requests sent to the S3 origin.. Amazon CloudFront as a CDN with the S3 bucket as the origin minimizes latency by caching video content at edge locations worldwide, serving users from the nearest edge. This reduces load on the origin S3 bucket by handling requests at the edge. Regional Edge Caches further improve cache hit ratios for less popular content by caching it at regional locations, reducing the need to fetch from the origin. Origin shield in CloudFront consolidates requests from multiple edge locations into a single request to the S3 origin, significantly reducing the number of direct requests and lowering origin load.

Answer

Use Amazon ElastiCache for Memcached to cache video metadata at the edge.

Answer

Enable S3 default encryption using AWS KMS to improve data transfer performance.

Answer

Enable S3 Transfer Acceleration on the bucket to speed up uploads.