SAA-C03 Practice Test 38 — 15 Questions

Question 1

An internal API is deployed in two AWS Regions behind separate Application Load Balancers. The company wants clients to use the primary Region when it is healthy and automatically switch to the secondary Region if the primary health check fails. Which two Route 53 record configurations are required? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a primary failover record that points to the primary ALB and associates a Route 53 health check.. A primary failover record in Amazon Route 53 directs traffic to the primary ALB and is associated with a Route 53 health check. If the health check fails, Route 53 automatically fails over to the secondary failover record, ensuring high availability across Regions.

Answer

Create a weighted record set that sends 50 percent of traffic to each Region.

Answer

Create a latency-based record set so Route 53 always prefers the fastest Region.

Answer

Create a multivalue answer record to return both ALB addresses on each lookup.

Question 2

A nightly video rendering pipeline runs on Linux EC2 instances and is compatible with ARM64. The jobs are CPU-bound, checkpoint frequently, and can resume if interrupted. The business wants the best throughput per dollar for the batch window. Which two changes should the team make? Select two.

Accepted Answer

Use AWS Graviton-based instances for the render workers.. AWS Graviton-based instances use ARM64 architecture, which is explicitly compatible with the video rendering pipeline. They offer up to 40% better price-performance compared to comparable x86 instances for CPU-bound workloads, directly improving throughput per dollar. This makes option A correct for maximizing cost efficiency.

Answer

Use a single large x86 instance with On-Demand pricing to avoid interruptions.

Answer

Replace the batch workers with a Lambda function to eliminate instance management.

Answer

Move the workload to a spread placement group to increase cost efficiency.

Question 3

A media processing workflow uses CloudWatch Logs heavily. Retaining all debug logs forever is increasing costs. What should be configured?

Accepted Answer

CloudWatch Logs retention policies per log group. CloudWatch Logs retention policies per log group allow you to set an expiration time (e.g., 30 days) after which log events are automatically deleted. This directly reduces storage costs by preventing debug logs from accumulating indefinitely, without affecting other monitoring or routing functions.

Answer

Route 53 health checks

Answer

CloudWatch detailed monitoring on all instances

Answer

AWS Config aggregation

Question 4

Based on the exhibit, an Amazon Aurora MySQL application is read-heavy, but the database writer is nearing CPU limits while the reader instance is mostly idle. The application currently sends all queries to the writer endpoint. Which change should you make first to increase read throughput?

Accepted Answer

Change the application to send read-only queries to the Aurora reader endpoint.. The Aurora reader endpoint is specifically designed to distribute read-only traffic across all available reader instances, offloading the writer and increasing read throughput. Since the reader instance is idle, directing read queries to the reader endpoint immediately reduces CPU load on the writer without requiring any architectural changes.

Answer

Keep using the writer endpoint so Aurora can route the reads automatically.

Answer

Convert the cluster to a single-AZ deployment so network hops are reduced.

Answer

Add an Amazon DynamoDB Accelerator (DAX) cluster in front of Aurora.

Question 5

A company runs an application on EC2 instances in private subnets. The instances must access Amazon S3, and the team currently routes all outbound traffic to the internet through a NAT Gateway. Monthly NAT Gateway charges increased significantly, even though the application only needs to call S3 (not access other public internet services). Which change will most directly reduce NAT Gateway charges while keeping S3 access working?

Accepted Answer

Create a gateway VPC endpoint for S3 and update the private route tables so S3 traffic uses the endpoint instead of the NAT Gateway.. A gateway VPC endpoint for S3 allows instances in private subnets to access S3 over the AWS network without traversing the internet. By updating the private route tables to direct S3 traffic to the endpoint, the NAT Gateway is bypassed, eliminating the per-GB data processing charges and hourly NAT Gateway fees for that traffic. This directly reduces costs while maintaining secure, private access to S3.

Answer

Enable S3 Transfer Acceleration on the bucket to reduce the number of S3 calls that go through the NAT Gateway.

Answer

Switch the EC2 instances to public subnets so S3 calls can use direct internet routing without NAT.

Answer

Increase the NAT Gateway TCP idle timeout so fewer connections are billed separately for S3 traffic.

Question 6

A financial services company must store audit logs in S3 for 7 years and ensure that no one — including the AWS account root user — can delete or overwrite the logs during the retention period. Which S3 Object Lock configuration should a solutions architect use?

Accepted Answer

Object Lock in Compliance mode with a 7-year retention period. S3 Object Lock in Compliance mode prevents ALL users — including the root account — from deleting or overwriting objects before the retention period expires. The retention period itself cannot be shortened once set in Compliance mode.

Governance mode also prevents most deletions, but users with s3:BypassGovernanceRetention permission (and the root account) can delete objects or shorten the retention period. For regulatory requirements where not even root can override, Compliance mode is mandatory.

Answer

Object Lock in Governance mode with a 7-year retention period

Answer

S3 Versioning with a lifecycle rule to transition objects to Glacier after 7 years

Answer

A bucket policy with Deny for s3:DeleteObject applied to all principals including root

Question 7

A DynamoDB-backed event processing system experiences throttling during a promotion. All events are written and read using the same partition key value (tenantId = "ACME"). The workload is time-ordered per tenant, and the application can tolerate slight reordering across partitions. Which design change will most directly increase throughput and reduce hot-partition throttling?

Accepted Answer

Change the partition key to include an additional sharding attribute derived from a hash of eventId.. Adding a sharding attribute derived from a hash of eventId allows writes and reads to be distributed across multiple partition keys, breaking the single hot partition caused by using tenantId='ACME' for all operations. DynamoDB's throughput is limited per partition, so distributing the load across many partitions directly reduces throttling without changing the application's tolerance for slight reordering.

Answer

Increase the table's provisioned capacity (read/write units) to handle the promotion peak.

Answer

Enable DAX caching for all reads but keep the same partition key and item layout.

Answer

Switch the table to eventually consistent reads for queries to lower read throttling.

Question 8

An S3 bucket stores application logs. After 30 days, the team rarely accesses the logs, but compliance requires keeping them for 18 months. Which setup most directly reduces storage cost while maintaining compliance?

Accepted Answer

Configure an S3 Lifecycle policy to transition objects to a colder storage class after 30 days and expire (delete) them after 18 months.. S3 Lifecycle policies allow you to automatically transition objects to cheaper storage classes (e.g., S3 Standard-IA or S3 Glacier Deep Archive) after 30 days, reducing storage costs for rarely accessed logs. The policy also sets an expiration action to delete objects after 18 months, meeting the compliance requirement without manual intervention.

Answer

Enable S3 Versioning and rely on deleting old versions after 30 days to reduce storage costs while keeping the latest data.

Answer

Move the bucket to a different AWS region farther from the users to reduce the likelihood of accidental reads and thereby lower storage costs.

Answer

Switch all objects to S3 Glacier Instant Retrieval immediately, regardless of object age, to minimize storage charges.

Question 9

A web application runs on an Amazon EC2 Auto Scaling group behind an Application Load Balancer (ALB). After each deployment, new instances take about 2 minutes to download artifacts and become ready to accept requests on the target port. In the last deployment, the ALB started marking targets unhealthy before the app was ready, and the Auto Scaling group then replaced those instances repeatedly, causing a prolonged outage. Which change best improves resilience during instance start-up without reducing actual availability once the application is healthy?

Accepted Answer

Increase the Auto Scaling group’s health check grace period so it exceeds the ~2-minute initialization time.. The Auto Scaling group's health check grace period allows instances to initialize without being marked unhealthy by the ELB health checks. By setting this grace period to exceed the ~2-minute artifact download time, the ASG will not replace instances that are still starting up, preventing the cascade of terminations and redeployments that caused the outage. This directly addresses the root cause—premature health check failures—without changing the health check configuration or reducing availability once the app is ready.

Answer

Add more subnets across additional Availability Zones to distribute the same instances more widely.

Answer

Switch the load balancer target type from instance targets to IP targets to avoid health check failures.

Answer

Reduce the ALB health check interval so unhealthy targets are removed faster.

Question 10

A game streaming service must use UDP for real-time gameplay traffic. For external firewall allowlisting, the service requires stable, static IP addresses. The TLS handshake must be handled end-to-end by the application servers (the load balancer must not terminate TLS). Which AWS load balancing option best fits these requirements?

Accepted Answer

Use a Network Load Balancer (NLB) with a UDP listener, configure the NLB to use Elastic IP addresses for static IPs, and use TCP listeners for TLS passthrough to the application servers.. A Network Load Balancer (NLB) supports UDP listeners, which are required for real-time gameplay traffic, and can be assigned Elastic IP addresses to provide stable, static IPs for firewall allowlisting. Additionally, NLB supports TCP listeners with TLS passthrough, meaning it forwards the encrypted traffic without terminating the TLS handshake, allowing the application servers to handle end-to-end encryption as required.

Answer

Use an Application Load Balancer (ALB) with UDP listeners and configure TLS passthrough.

Answer

Use Amazon API Gateway with a WebSocket API and keepalive pings to provide UDP-like low-latency delivery.

Answer

Use a Classic Load Balancer and multiplex UDP over TCP to meet the UDP and low-latency requirements.

Question 11

You serve private reports stored in an S3 bucket through CloudFront. After a recent change, users report that they can access the S3 object URLs directly (bypassing CloudFront), which violates your design. You want to ensure S3 objects are readable only through CloudFront using Origin Access Control (OAC), even if someone guesses the S3 URL. Which update best enforces this at the S3 bucket level?

Accepted Answer

Add a bucket policy Allow for s3:GetObject only when the principal is cloudfront.amazonaws.com and aws:SourceArn matches your CloudFront distribution ARN, while blocking public access.. It uses an S3 bucket policy that grants s3:GetObject access only when the principal is cloudfront.amazonaws.com and the aws:SourceArn matches the CloudFront distribution ARN. This ensures that only CloudFront, using Origin Access Control (OAC), can retrieve objects, blocking direct S3 URL access even if the URL is guessed. Blocking public access at the bucket level further prevents any anonymous or public reads.

Answer

Enable an S3 bucket lifecycle policy to transition objects to Glacier, so public S3 URLs become inaccessible.

Answer

Rely only on CloudFront signed URLs validation; do not change the S3 bucket policy.

Answer

Add a WAF rule on CloudFront to block requests that contain "amazonaws.com" in the URL path.

Question 12

A company is deploying a high-performance computing (HPC) cluster with 16 EC2 instances. The workload requires the lowest possible network latency and highest throughput between all nodes for tightly coupled parallel MPI computations. Which EC2 placement group type should a solutions architect recommend?

Accepted Answer

Cluster placement group. Cluster placement groups pack instances physically close together within a single Availability Zone, providing the lowest possible network latency and highest network throughput between instances. They support enhanced networking (SR-IOV) and Elastic Fabric Adapter (EFA) for inter-node MPI communication.

Tightly coupled parallel HPC workloads require all nodes to communicate frequently with minimal latency. Cluster placement groups are specifically designed for this use case. The trade-off is all instances are in one AZ — if the AZ fails, the entire cluster is affected.

Answer

Partition placement group

Answer

Spread placement group

Answer

No placement group — use Auto Scaling across multiple AZs

Question 13

Based on the exhibit, the security team needs to detect and alert on both successful and failed attempts to change S3 bucket policies and KMS key policies across the organization. Which solution best meets that requirement?

Accepted Answer

Enable an organization trail for management events in all regions and create an EventBridge rule that matches PutBucketPolicy and PutKeyPolicy, then send alerts to SNS.. AWS CloudTrail management events capture all API calls that modify S3 bucket policies (PutBucketPolicy) and KMS key policies (PutKeyPolicy). By enabling an organization trail for all regions, you centralize these events across the entire AWS Organization. An Amazon EventBridge rule can then filter for these specific API calls and send alerts via Amazon SNS, meeting the requirement to detect both successful and failed attempts.

Answer

Enable AWS Config in all accounts and use only a periodic compliance evaluation to alert when bucket or key policies drift.

Answer

Use IAM Access Analyzer because it continuously blocks policy changes that would expose the resources publicly.

Answer

Turn on S3 server access logging and KMS key rotation, because both services will capture policy modifications automatically.

Question 14

A media processing workflow generates analytics files that are accessed unpredictably. Some files become hot again months later. The team wants automatic storage cost optimisation without retrieval delays. What should be used? The architecture review board prefers a managed AWS-native control.

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct choice because it automatically moves objects between access tiers (frequent, infrequent, and archive instant retrieval) based on changing access patterns, without any retrieval delays for hot objects. This matches the unpredictable access pattern where files may become hot again months later, and it is a fully managed AWS-native solution that optimizes storage costs automatically.

Answer

Manual monthly review and object copying

Answer

S3 Glacier Flexible Retrieval for all files

Answer

EFS One Zone for analytics files

Question 15

A media platform runs a CPU-heavy thumbnail generation workload on an EC2 Auto Scaling group using t3.large instances. During peak traffic, p95 processing time increases significantly even though average CPU remains around 40–50%. CloudWatch also shows CPU credit depletion behavior. Which change will most directly improve performance predictability for this workload?

Accepted Answer

Change the Auto Scaling group instance type to a compute-optimized family (for example, c7i) to provide steady CPU performance.. The t3.large instances rely on CPU credits for burst performance, and when credits are exhausted, CPU performance is throttled to the baseline (e.g., 30% for t3.large). This causes unpredictable processing times during peak traffic, even if average CPU is moderate. Switching to a compute-optimized family like c7i provides dedicated, consistent CPU performance without credit-based throttling, directly improving predictability for CPU-heavy thumbnail generation.

Answer

Increase the t3.large maximum CPU credits and keep the Auto Scaling group using the same burstable instance type.

Answer

Add a placement group to the existing t3.large instances so they are packed close together for lower latency between nodes.

Answer

Switch the workload to run on Lambda with the same logic so invocations automatically scale without instance selection changes.