SAA-C03 Practice Test 36 — 15 Questions

Question 1

A risk simulation workload generates analytics files that are accessed unpredictably. Some files become hot again months later. The team wants automatic storage cost optimisation without retrieval delays. What should be used? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering automatically moves objects between access tiers (frequent, infrequent, and archive instant access) based on changing access patterns, with no retrieval delays for hot objects and no operational overhead. This matches the unpredictable access pattern where files become hot again months later, as Intelligent-Tiering monitors access at the object level and adjusts storage class without manual intervention or custom scripts.

Answer

Manual monthly review and object copying

Answer

S3 Glacier Flexible Retrieval for all files

Answer

EFS One Zone for analytics files

Question 2

Based on the exhibit, a workload in Account B must assume a role in Account A. Security requires that only the specific role arn:aws:iam::444455556666:role/PipelineExecRole can assume it, and only when the caller supplies the external ID acct-b-prod-7788. Which change best satisfies the requirement with the least privilege?

Accepted Answer

Replace the principal with arn:aws:iam::444455556666:role/PipelineExecRole and add a StringEquals condition on sts:ExternalId = acct-b-prod-7788.. It explicitly restricts the trust policy principal to the specific IAM role ARN `arn:aws:iam::444455556666:role/PipelineExecRole` and adds a `StringEquals` condition on `sts:ExternalId` set to `acct-b-prod-7788`. This satisfies the security requirement by ensuring only that exact role can assume the role in Account A, and only when the correct external ID is provided, following the principle of least privilege.

Answer

Keep the root principal and add an aws:PrincipalTag condition in the trust policy to require the tag acct-b-prod-7788.

Answer

Attach a permission boundary to the role in Account A so that only PipelineExecRole can use it.

Answer

Add an SCP in Account B that allows sts:AssumeRole only for PipelineExecRole.

Question 3

A payments service receives payment orders by consuming messages from an Amazon SQS Standard queue. The downstream processor occasionally exceeds its processing timeout. As a result, some messages reappear in the queue and may be processed more than once.

The team wants to prevent duplicate side effects (for example, double-charging) and also ensure poison messages do not repeatedly consume processing capacity.

What approach best satisfies both goals?

Accepted Answer

Implement idempotent processing (for example, store processed payment IDs in DynamoDB) and configure an SQS dead-letter queue (DLQ) using a redrive policy with an appropriate maxReceiveCount.. It addresses both requirements: idempotent processing (e.g., storing processed payment IDs in DynamoDB) ensures that even if a message is processed more than once, duplicate side effects like double-charging are prevented. Configuring an SQS dead-letter queue (DLQ) with a redrive policy and an appropriate maxReceiveCount (e.g., 3 or 5) automatically moves messages that exceed the maximum number of receives to the DLQ, preventing poison messages from repeatedly consuming processing capacity.

Answer

Rely only on increasing the SQS visibility timeout so duplicates rarely occur, without adding idempotency checks or a DLQ.

Answer

Switch to a FIFO queue and delete messages immediately upon receipt to avoid duplicates.

Answer

Move the workload to SNS and use synchronous HTTP endpoints so the sender retries until the receiver confirms success.

Question 4

A team serves static assets from an S3 origin through CloudFront. Cache hit ratio is low. Analytics show that requests include an Authorization header (even though the assets are public) and the cache key currently varies on that header, causing CloudFront to treat the same asset as different cache entries. What is the best change to improve cache hit ratio without breaking access controls?

Accepted Answer

Modify the CloudFront cache policy so the cache key does not include the Authorization header.. The low cache hit ratio is caused by the Authorization header being included in the CloudFront cache key, which creates separate cache entries for the same object even though the assets are public. By modifying the cache policy to exclude the Authorization header, CloudFront will treat all requests for the same asset as identical, dramatically improving the cache hit ratio without affecting access controls because the assets are already public.

Answer

Keep Authorization in the CloudFront cache key, but increase the origin response minimum TTL to 1 day.

Answer

Switch the S3 origin from the current bucket to a website endpoint to enable automatic caching headers.

Answer

Enable CloudFront to forward all headers to S3 so origin can decide caching behavior per request.

Question 5

Based on the exhibit, a CI pipeline assumes a shared deployment role in Account A. The role can access several artifact prefixes, but this pipeline must only upload to teamA/prod/ and decrypt using a single KMS key for this execution. Changing the shared role would affect other pipelines. Which approach should the pipeline use?

Accepted Answer

Pass an inline session policy in the AssumeRole request that further restricts the temporary credentials to teamA/prod/ and the approved KMS key.. An inline session policy passed in the AssumeRole request allows you to further restrict the temporary credentials' permissions without modifying the shared role itself. This ensures the pipeline can only upload to teamA/prod/ and decrypt using the specified KMS key, while other pipelines using the same role remain unaffected.

Answer

Attach a permission boundary to the pipeline's assumed session so the temporary credentials cannot exceed the shared role permissions.

Answer

Add an SCP to Account A that forces all roles to use the same S3 prefix and key whenever they are assumed.

Answer

Change the role trust policy to allow only the teamA/prod/ prefix and the key ARN because trust policies can scope S3 object paths directly.

Question 6

Based on the exhibit, users must access private PDF reports only through CloudFront. Direct requests to the S3 object URL must fail, and the bucket should not be publicly readable. Which solution is the best fit?

Accepted Answer

Enable CloudFront Origin Access Control for the distribution and update the bucket policy to allow only the CloudFront distribution principal with its SourceArn.. CloudFront Origin Access Control (OAC) allows you to restrict access to an S3 bucket so that only the specific CloudFront distribution can retrieve objects. By updating the bucket policy to allow the CloudFront distribution principal with its SourceArn, you ensure that direct requests to the S3 object URL are denied, while CloudFront-signed URLs or cookies can still control user access. This meets the requirement of blocking direct S3 access while keeping the bucket private.

Answer

Keep the bucket public and require signed URLs at CloudFront, because signed URLs automatically block all direct S3 requests.

Answer

Add an S3 access point and allow the CloudFront distribution to use it without changing the bucket policy.

Answer

Attach AWS WAF to the distribution and block requests that do not include a signed cookie.

Question 7

A retail analytics table stores events in Amazon DynamoDB with partition key tenantId and sort key eventTime. During a promotion, one tenant generates most writes and repeatedly polls the same latest-status items, causing throttling on a single partition key and high latency on reads. The business can tolerate read results that are a few seconds stale. Which two changes will most effectively reduce throttling and latency? Select two.

Accepted Answer

Introduce write sharding by adding a bounded random suffix to the hot tenant partition key and fan out reads across the shards.. Write sharding distributes the hot tenant's writes across multiple partitions by appending a bounded random suffix to the partition key, preventing a single partition from throttling. Reads then fan out across all shards and aggregate results, which is acceptable since the business tolerates a few seconds of staleness. This directly addresses the single-partition bottleneck without changing the overall data model.

Answer

Keep the same key design and increase only the table’s provisioned RCUs and WCUs.

Answer

Replace the table reads with a Scan operation to distribute the load across all partitions.

Answer

Move the table to another Availability Zone so the hot tenant uses a different storage node.

Question 8

A development team expects their EC2 utilization to average about 40% of capacity across the next year. They want to lower costs but need flexibility to change instance families and sizes as requirements evolve (for example, moving from compute-optimized to memory-optimized instances). Which AWS purchasing commitment best meets the goal of reducing cost while keeping flexibility?

Accepted Answer

Compute Savings Plans, sized to the expected average usage, because they provide savings across instance families and usage types.. Compute Savings Plans offer the best balance of cost reduction and flexibility for this scenario. They provide up to 66% savings in exchange for a commitment to a consistent amount of compute usage (measured in $/hour), but unlike Reserved Instances, they automatically apply to any EC2 instance family, size, OS, or region (within a given AWS region). This allows the team to switch from compute-optimized to memory-optimized instances as needs evolve without losing the discount, directly meeting the requirement for flexibility while lowering costs.

Answer

All Upfront EC2 Instance Reserved Instances for a single instance family to maximize discount.

Answer

Spot Instances for the entire workload so they can avoid commitments entirely.

Answer

On-Demand Instances with increased Auto Scaling to match the peak month only.

Question 9

A third-party payroll vendor in another AWS account must assume a role in your account to write a daily settlement file to Amazon S3. You want to prevent confused-deputy attacks and make every assumed session traceable in CloudTrail back to an individual vendor user. Which three trust-policy or session controls should be used? Select three.

Accepted Answer

Specify the exact vendor role ARN as the trusted principal in the role trust policy.. Specifying the exact vendor role ARN as the trusted principal in the trust policy ensures that only that specific role in the vendor's account can assume the role, preventing any other entity from impersonating the vendor. This is a key control to limit the trust boundary and avoid confused-deputy attacks.

Answer

Use a wildcard principal and rely on the S3 bucket policy to narrow access later.

Answer

Give the vendor long-term IAM user credentials in your account for easier auditing.

Question 10

A startup runs a public-facing web application on Amazon EC2 instances in a VPC. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to block traffic from specific countries. Which AWS service should a solutions architect use?

Accepted Answer

AWS WAF with a web ACL attached to the Application Load Balancer, using managed rule groups and a geo match rule.. AWS WAF is the service that inspects HTTP requests for web exploits and can apply geo match conditions. Attaching a web ACL to the Application Load Balancer lets WAF evaluate each request against managed rule groups for SQL injection and cross-site scripting and against a geo match rule that blocks specified countries.

Answer

A network ACL on the public subnet that denies traffic from specific country IP ranges.

Answer

Amazon GuardDuty with S3 protection and a threat intelligence feed.

Answer

AWS Shield Advanced with a web ACL attached to the Application Load Balancer.

Question 11

An application uses an Amazon RDS Multi-AZ DB instance. During a failover test, connections fail until the application is restarted, even though the database comes back online. Which two changes should the team make to improve resilience during failover? Select two.

Accepted Answer

Use the RDS endpoint name instead of hard-coding the current instance IP or hostname in the application.. The RDS endpoint is a DNS name that automatically resolves to the current writer instance's IP address. During a failover, the DNS record is updated to point to the new primary, so using the endpoint instead of a hard-coded IP or hostname allows the application to reconnect without manual intervention. Option D is correct because adding retry logic with exponential backoff handles transient failures during DNS resolution and connection establishment, which are common during the brief period when the DNS TTL has not yet expired after a failover.

Answer

Cache and reconnect to the current writer IP address to avoid DNS lookups during failover.

Answer

Switch to a read replica and let it promote manually after every outage.

Answer

Disable connection pooling so each request opens a fresh socket during normal operation.

Question 12

A distributed analytics engine runs 12 EC2 instances in one Availability Zone. The nodes exchange thousands of tiny messages per second and must keep jitter as low as possible. The current design launches the instances across multiple placement groups and uses general-purpose burstable instances. Which two changes will most directly lower east-west network latency and variability? Select two.

Accepted Answer

Move all instances into a cluster placement group.. A cluster placement group provides a low-latency, high-bandwidth network connection by placing instances in a single Availability Zone within the same logical rack or cluster. This minimizes the physical distance and network hops between instances, directly reducing east-west latency and jitter for the thousands of tiny messages per second.

Answer

Spread the instances across three Availability Zones for better fault tolerance.

Answer

Front the nodes with an Application Load Balancer to balance the internal messages.

Answer

Store the messages on EBS volumes so the nodes avoid network communication.

Question 13

Match each database availability event to the AWS failover behavior that best describes it.

Accepted Answer

Multi-AZ RDS primary failure: Fails over automatically to standby. Multi-AZ RDS automatically fails over to standby; read replicas require manual redirect; Aurora uses replicas for failover; without replicas, Aurora recovers in-place.

Answer

Multi-AZ RDS primary failure: Requires manual promotion of a read replica

Answer

RDS primary failure with read replicas: Automatically fails over to an Aurora replica

Question 14

A company has a steady, predictable workload that must run continuously (24/7) in a single AWS Region. The team wants the lowest cost option available for this steady usage, but also expects they may choose different EC2 instance families in the future (without re-buying compute discounts). Which AWS purchase option best meets these goals?

Accepted Answer

Compute Savings Plans, committed for a 1- to 3-year term in the Region. Compute Savings Plans offer the lowest cost for steady, predictable workloads while providing instance family flexibility within a Region. Unlike Reserved Instances, they automatically apply discounts to any EC2 instance family (and even Fargate/Lambda) in the chosen Region, so the company can switch instance families in the future without losing the discount. A 1- or 3-year commitment yields significant savings (up to 66%) compared to On-Demand, making it the optimal choice for this scenario.

Answer

On-Demand Instances only, because they automatically adjust to future needs

Answer

Standard Reserved Instances tied to a single instance type and Availability Zone

Answer

EC2 Spot Instances, because they are always cheaper than savings programs

Question 15

An S3 bucket uses a customer-managed KMS key as the default for SSE-KMS encryption. A service role will upload objects using s3:PutObject. Assuming the role already has permission to write to the bucket, which KMS permission is most directly required for the role to let S3 encrypt the object during upload?

Accepted Answer

kms:GenerateDataKey (and optionally kms:DescribeKey). When S3 uses SSE-KMS with a customer-managed KMS key, the service calls KMS to generate a data key for encrypting the object. The s3:PutObject operation requires the caller to have kms:GenerateDataKey permission on the KMS key so that S3 can obtain the plaintext and encrypted versions of the data key. Optionally, kms:DescribeKey may be needed for S3 to verify the key exists, but kms:GenerateDataKey is the most directly required permission.

Answer

kms:Decrypt only

Answer

kms:CreateAlias and kms:UpdateAlias only

Answer

kms:ScheduleKeyDeletion and kms:CancelKeyDeletion only