SAA-C03 Practice Test 37 — 15 Questions

Question 1

A system uses multiple AWS Lambda functions behind different event sources. One Lambda occasionally spikes and causes other Lambdas to be throttled due to shared concurrency limits. Which setting best helps ensure the important Lambda keeps capacity during spikes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set Reserved Concurrency for the important Lambda function.. Reserved Concurrency guarantees a set number of concurrent executions for a specific Lambda function, isolating it from the account-level concurrency pool. This ensures that the important function always has capacity available, even when other functions spike and consume the shared pool. Without this setting, all functions compete for the same 1,000 concurrent executions (default regional limit), and a spike in one can throttle others.

Answer

Increase the function timeout so throttling is less likely.

Answer

Enable Provisioned Concurrency for every Lambda in the account.

Answer

Reduce the number of IAM policies attached to the Lambda roles.

Question 2

A partner company needs read-only access to reports in an S3 bucket for a e-learning platform. The partner has its own AWS account. What is the most secure scalable access pattern?

Accepted Answer

Create a bucket policy that grants the partner role least-privilege access to the required prefix. It uses a resource-based bucket policy that grants the partner's AWS account (via its root user or an IAM role) least-privilege read-only access to a specific prefix. This approach avoids sharing long-term credentials, leverages AWS's cross-account trust mechanism, and scales securely without managing additional IAM users.

Answer

Copy the objects to a public website bucket

Answer

Create an IAM user in the company account and share the access keys

Answer

Make the objects public and rely on difficult-to-guess object names

Question 3

A ticket booking system uses Aurora MySQL. The company wants fast cross-Region disaster recovery with low RPO. Which architecture should be considered? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Aurora Global Database. Aurora Global Database is the correct choice because it provides a managed, cross-Region disaster recovery solution with a Recovery Point Objective (RPO) of typically less than 1 second, using storage-based replication that does not impact database performance. This meets the requirement for fast failover and low data loss, while being fully AWS-native and controlled by the architecture review board.

Answer

A single-AZ Aurora cluster

Answer

An ElastiCache Redis replica

Answer

Manual snapshots copied monthly

Question 4

A media processing pipeline runs batch jobs on EC2. The jobs can tolerate interruptions because they checkpoint progress to durable storage and can restart. The total workload is variable week-to-week, and there is no need to guarantee capacity at specific times. To reduce compute cost while maintaining correctness, what EC2 purchase option and approach is the best fit?

Accepted Answer

Use EC2 Spot Instances with interruption handling and restart from checkpoints.. Spot Instances offer up to 90% cost savings compared to On-Demand and are ideal for fault-tolerant, stateless workloads that can checkpoint progress to durable storage. Since the batch jobs can tolerate interruptions and restart from checkpoints, Spot Instances provide the lowest compute cost while maintaining correctness. No other purchase option achieves the same level of cost reduction for this variable, interruption-tolerant workload.

Answer

Use All Upfront Reserved Instances sized for the average weekly workload to minimize cost.

Answer

Use On-Demand Instances and scale only during business hours to reduce idle time.

Answer

Use Savings Plans with a fixed hourly commitment to ensure capacity for the entire year.

Question 5

A test environment has EC2 instances that are oversized based on CPU, memory, and network utilisation. Which AWS service should identify rightsizing recommendations?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer uses machine learning to analyze historical utilization metrics (CPU, memory, network, and storage) and provides rightsizing recommendations for EC2 instances, including over-provisioned resources. It helps reduce costs by suggesting instance types or sizes that better match actual workload demands.

Answer

AWS DataSync

Answer

AWS Shield

Answer

AWS Artifact

Question 6

Account B has an IAM role that includes kms:Decrypt for a specific KMS key ARN in account A. However, when the role tries to read an S3 object encrypted with that CMK, the application fails with AccessDenied: not authorized to perform kms:Decrypt. CloudTrail shows the KMS API call is denied by key policy. What is the most secure and correct fix?

Accepted Answer

Update the KMS key policy in account A to allow the account B role principal to use kms:Decrypt on the key.. Cross-account access to a customer managed KMS key (CMK) requires the key policy to explicitly grant the external IAM role principal the necessary permissions (e.g., kms:Decrypt). Even if the IAM role in Account B has an IAM policy allowing kms:Decrypt, the KMS key policy in Account A acts as a resource-based policy that must also allow the action; without this, the request is denied by the key policy, as shown in CloudTrail.

Answer

Update the IAM role in account B to include kms:Encrypt and kms:GenerateDataKey; then kms:Decrypt will start working automatically.

Answer

Disable key policy for the CMK by switching to S3-managed encryption, because KMS key policies are always enforced regardless of grants.

Answer

Create an SCP in account A that allows kms:Decrypt for all accounts, avoiding changes to the key policy.

Question 7

A company hosts a e-learning platform on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use?

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows secure shell access to EC2 instances without opening inbound ports (SSH/RDP) or using a bastion host. It uses the AWS Systems Manager agent and an IAM instance role to establish a bidirectional connection over HTTPS to the AWS Systems Manager service, eliminating the need for public IP addresses or internet-facing security groups.

Answer

A public Elastic IP address on each instance

Answer

A bastion host with SSH open to 0.0.0.0/0

Answer

An internet gateway attached to the private subnet

Question 8

A regional web application for a inventory service must fail over automatically to a secondary Region if the primary endpoint becomes unhealthy. Which two services or features are required? The design must avoid adding custom operational scripts.

Accepted Answer

Route 53 failover routing with health checks. Route 53 failover routing with health checks (Option A) is required because it automatically evaluates the health of the primary endpoint and, upon detecting failure, updates DNS resolution to direct traffic to the secondary Region. This is the native AWS mechanism for DNS-based failover without custom scripts, relying on Route 53 health checkers to assess endpoint health via HTTP/HTTPS/TCP or calculated health checks.

Answer

S3 Transfer Acceleration

Answer

AWS Organizations service control policies

Question 9

A telemetry pipeline uses RDS MySQL and receives many read-only reporting queries that slow down the primary database. What should the architect add?

Accepted Answer

RDS read replica and route reporting queries to it. RDS Read Replicas are designed specifically to offload read-heavy workloads from the primary database. By creating a read replica and routing the reporting queries to it, the primary database is freed from processing these read-only queries, reducing contention and improving overall performance. This is the most cost-effective and architecturally appropriate solution for read scaling in RDS MySQL.

Answer

Multi-AZ standby and route reads to the standby

Answer

S3 lifecycle policy

Answer

A larger NAT gateway

Question 10

Your team runs a tightly coupled distributed workload (for example, synchronous training nodes) across many EC2 instances placed within a single cluster environment. The instances need low-latency networking to reduce delays at synchronization barriers. Which EC2 placement strategy should you use to improve inter-node latency?

Accepted Answer

Create a placement group with the 'cluster' strategy to place instances close together and reduce network latency.. A cluster placement group is the correct choice because it groups instances in a single Availability Zone with low-latency, high-bandwidth networking, ideal for tightly coupled workloads like synchronous training nodes that require minimal delay at synchronization barriers. This strategy places instances physically close together within the same rack or cluster, reducing network round-trip time and maximizing throughput for inter-node communication.

Answer

Create a placement group with the 'spread' strategy to separate instances across underlying hardware for fault tolerance.

Answer

Use the default placement strategy and rely on Auto Scaling to keep instances from drifting to different locations.

Answer

Avoid placement groups and instead use Amazon S3 for inter-node messaging to minimize direct network traffic between instances.

Question 11

Based on the exhibit, what is the most appropriate fix so the workload in Account A can access the S3 bucket in Account B without using long-lived access keys?

Accepted Answer

Create an IAM role in Account B, trust Account A's AppRole to assume it with STS, and then access the bucket using temporary credentials.. It uses AWS Security Token Service (STS) to allow the workload in Account A to assume an IAM role in Account B, obtaining temporary credentials that grant access to the S3 bucket. This eliminates the need for long-lived access keys and follows the principle of least privilege, as the role can be scoped to specific S3 actions and resources.

Answer

Attach AmazonS3FullAccess to the instance profile role in Account A and keep using the same direct access path.

Answer

Add an SCP to Account A that allows S3 actions against buckets in Account B.

Answer

Enable S3 versioning on the bucket so cross-account requests are automatically trusted.

Question 12

A company hosts a image sharing application on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use?

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows administrators to establish secure shell (SSH) or PowerShell (RDP) sessions to EC2 instances without opening any inbound ports. It uses the SSM Agent and the AWS Systems Manager service, which initiates outbound connections to the AWS cloud over HTTPS (port 443). The required instance role grants permissions for the agent to communicate with Systems Manager, enabling secure, auditable access without public IP addresses or bastion hosts.

Answer

An internet gateway attached to the private subnet

Answer

A public Elastic IP address on each instance

Answer

A bastion host with SSH open to 0.0.0.0/0

Question 13

A company uses AWS Organizations and wants to prevent any account in the organization from launching resources in regions other than us-east-1 and eu-west-1. This restriction must apply even if an administrator in a member account grants full IAM permissions. Which approach should a solutions architect use?

Accepted Answer

Create an SCP with a Deny on all actions for regions outside us-east-1 and eu-west-1, attached to the Organization root. Service Control Policies (SCPs) in AWS Organizations provide a guardrail that applies to all principals in member accounts — including IAM users, roles, and even the account root. SCPs restrict the maximum permissions that can be granted within an account.

An SCP with Deny on all actions for all regions except us-east-1 and eu-west-1, attached to the organization root, prevents any account from launching resources in other regions regardless of account-level IAM permissions. IAM policies in member accounts cannot override SCPs.

Answer

Create IAM policies with Deny for disallowed regions and attach them to all IAM users and roles in each account

Answer

Enable AWS Config rules to detect resources launched in disallowed regions and trigger auto-remediation to delete them

Answer

Use AWS Control Tower guardrails to enforce region restriction for all accounts

Question 14

A microservice runs in private subnets and must read exactly one AWS Secrets Manager secret using its IAM task role: arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/db-pass-AbCdEf Security requires that every Secrets Manager API call comes only through a specific Interface VPC Endpoint (vpce-0a1b2c3d4e5f6g7h), and must not be reachable over any other network path. Which IAM policy change best enforces this requirement?

Accepted Answer

In the task role policy statement for secretsmanager:GetSecretValue on the secret ARN, add a condition that allows the action only when aws:SourceVpce equals vpce-0a1b2c3d4e5f6g7h.. The condition `aws:SourceVpce` in the IAM policy restricts the `secretsmanager:GetSecretValue` API call to originate only from the specified VPC Endpoint (vpce-0a1b2c3d4e5f6g7h). This ensures that the secret can only be accessed via that specific Interface Endpoint, blocking any other network path (e.g., internet, NAT gateway, or other VPC endpoints). The task role is attached to the microservice, so the policy directly enforces the security requirement at the API level.

Answer

Add a condition that allows secretsmanager:GetSecretValue only when aws:SourceIp is within 10.0.0.0/8.

Answer

Require TLS by adding a condition on aws:SecureTransport for the Secrets Manager permission.

Answer

Add a KMS condition using kms:ViaService=secretsmanager.us-east-1.amazonaws.com instead of restricting Secrets Manager directly.

Question 15

Company A must allow workloads in Company B to assume an IAM role in Company A (RoleInA). To mitigate confused-deputy attacks, a Security requirement is to use an External ID. Company A should restrict who can assume RoleInA. Which trust-policy configuration is the best choice?

Accepted Answer

In Company A role trust policy, allow sts:AssumeRole only for principal "arn:aws:iam:::role/" and require a condition where sts:ExternalId equals the expected External ID value.. It restricts the trust policy to a specific IAM role in Company B (using the principal ARN) and requires the `sts:ExternalId` condition to match a predefined value. This ensures only the intended role in Company B can assume RoleInA, and the External ID prevents a confused-deputy attack by requiring the third party to provide a unique identifier that only the legitimate service knows.

Answer

In Company A role trust policy, allow sts:AssumeRole for principal "arn:aws:iam::<company-b-account-id>:root" with no sts:ExternalId condition.

Answer

In the trust policy, allow iam:PassRole for the Company B principal and include an sts:ExternalId condition.

Answer

In Company A, grant Company B access using an IAM permissions policy attached to RoleInA instead of using a trust policy.