SAA-C03 Practice Test 36 — 15 Questions

Question 1

Your CI system assumes an IAM role RoleForDeploy using STS AssumeRole and includes a session tag called Project=blue. The role’s permissions policy uses an ABAC condition like aws:PrincipalTag/Project to allow access only to resources tagged with the same project.

AssumeRole succeeds, but deployments fail with AccessDenied. CloudTrail shows the role was assumed, yet the effective session does not contain the Project tag.

Which change most directly fixes this issue?

Accepted Answer

Add permissions for sts:TagSession to the IAM role so the CI pipeline is allowed to pass the Project session tag during AssumeRole.. Option A is correct because when an IAM role is assumed with STS AssumeRole and session tags are included, the calling principal must have explicit permission to pass those tags via the `sts:TagSession` action. Without this permission, the session tags are silently dropped, even though the AssumeRole call succeeds. Adding `sts:TagSession` to the role's permissions allows the CI pipeline to pass the `Project=blue` tag, making the ABAC condition on `aws:PrincipalTag/Project` evaluate correctly and granting access to tagged resources.

Answer

Remove the ABAC condition using aws:PrincipalTag/Project so the policy ignores session tags.

Answer

Move the aws:PrincipalTag/Project condition into the trust policy so it applies during the AssumeRole call.

Answer

Add kms:Decrypt permission to the CI role because missing tags are typically caused by KMS authorization failures.

Question 2

Your media processing pipeline writes original uploads to an S3 bucket and later generates derivative files. An operator accidentally deletes a subset of original uploads in production. You need to (1) restore the deleted objects with minimal data loss and (2) protect against both regional disasters and future operator mistakes. The company requires recovery even if objects are deleted and later overwritten.

What is the most effective change to meet these requirements?

Accepted Answer

Enable S3 versioning on the bucket and configure cross-Region replication so previous versions are available after regional loss and accidental deletion.. Option A is correct because enabling S3 Versioning preserves all object versions, including deleted markers and overwritten objects, allowing recovery from accidental deletions. Cross-Region Replication (CRR) replicates both current and previous versions to a secondary region, providing protection against regional disasters. This combination ensures that even if objects are deleted and later overwritten, the original versions remain recoverable in both the source and destination buckets.

Answer

Move all objects to S3 Glacier Instant Retrieval and apply a lifecycle policy to keep only the latest object copy.

Answer

Use S3 server-side encryption with KMS keys and rely on access logs to manually recover the deleted objects.

Answer

Enable S3 bucket policies that deny DeleteObject, but do not enable versioning or replication.

Question 3

A service processes customer payments from a message queue. Because the queue provides at-least-once delivery, the same payment message can be delivered more than once if the consumer times out before committing its state. Currently, the service sometimes charges the customer twice.

Which design change most directly prevents duplicate charges while still allowing safe retries?

Accepted Answer

Make the payment processing idempotent by recording an idempotency key for each payment and ensuring repeated deliveries do not apply the charge twice.. Option B is correct because making payment processing idempotent using an idempotency key ensures that even if the same message is delivered multiple times due to at-least-once delivery semantics, the charge is applied only once. The consumer records a unique key (e.g., payment ID) in a durable store (like DynamoDB or Redis) and checks it before processing; if the key already exists, the charge is skipped. This directly prevents duplicate charges while still allowing safe retries, as the consumer can safely reprocess messages without side effects.

Answer

Delete the message from the queue immediately after receive to prevent redelivery.

Answer

Increase the queue visibility timeout to a very large value so messages rarely reappear.

Answer

Switch to a single-threaded consumer with one worker so messages are processed in order.

Question 4

A analytics dashboard uses RDS MySQL and receives many read-only reporting queries that slow down the primary database. What should the architect add? The architecture review board prefers a managed AWS-native control.

Accepted Answer

RDS read replica and route reporting queries to it. B is correct because an RDS read replica is a fully managed, native AWS solution that offloads read-heavy reporting queries from the primary RDS MySQL instance. The read replica asynchronously replicates data using the MySQL binlog, allowing reporting traffic to be routed to it without impacting the primary database's write performance. This directly addresses the slowdown caused by many read-only queries while satisfying the architecture review board's preference for a managed AWS-native control.

Answer

S3 lifecycle policy

Answer

Multi-AZ standby and route reads to the standby

Answer

A larger NAT gateway

Question 5

A backend API uses an AWS Lambda function behind API Gateway. The first requests after every weekly deployment experience cold starts, causing p95 latency spikes for a few minutes. Which configuration most directly prevents those cold starts for the published version?

Accepted Answer

Use Lambda provisioned concurrency for the version via an alias. Provisioned concurrency initializes a specified number of Lambda execution environments ahead of time, so that when the published version is invoked via an alias, there are no cold starts. This directly addresses the latency spikes caused by cold starts after a deployment, as the function is kept warm and ready to handle requests immediately.

Answer

Increase the Lambda memory size only, without changing how Lambda is invoked

Answer

Enable dead-letter queues (DLQ) to retry failed cold starts

Answer

Attach a CloudFront distribution to cache API Gateway responses for 5 minutes

Question 6

Arrange the steps for a cross-region Amazon S3 replication configuration.

Question 7

A mobile app reads the same product details many times per minute from Amazon DynamoDB. The table design is already correct, but repeated reads are still causing noticeable latency. Which service should the team add to improve read performance?

Accepted Answer

Amazon DAX. Amazon DAX (DynamoDB Accelerator) is an in-memory cache specifically designed for DynamoDB. It reduces read latency from single-digit milliseconds to microseconds by caching frequently accessed items, which directly addresses the repeated read pattern described in the question.

Answer

Amazon EFS

Answer

AWS Lambda

Answer

Amazon SNS

Question 8

Arrange the steps to create an encrypted Amazon EBS volume from scratch in the correct order.

Question 9

Order the steps for setting up a VPC with public and private subnets using a NAT gateway.

Question 10

Arrange the steps to migrate an on-premises database to Amazon RDS using AWS DMS.

Question 11

Order the steps for setting up an Application Load Balancer with an EC2 target group.

Question 12

Order the steps to create a static website using Amazon S3 and CloudFront.

Question 13

Arrange the steps to troubleshoot an EC2 instance that is unreachable via SSH.

Question 14

Order the steps to set up an Amazon CloudFront distribution with an S3 origin.

Question 15

Arrange the steps to implement a disaster recovery plan using AWS Elastic Disaster Recovery (DRS).