SAA-C03 Practice Test 38 — 15 Questions

Question 1

A company runs a stateful analytics workload on EC2 instances that use EBS volumes. The data must be restorable in another Region after a major outage, with frequent point-in-time recovery. Which approach provides the most suitable replication mechanism for the EBS-backed data?

Accepted Answer

Create scheduled EBS snapshots and copy them to another Region, then restore the volumes from those snapshots during recovery.. Option A is correct because scheduled EBS snapshots provide point-in-time recovery and can be copied to another Region for cross-region disaster recovery. When a major outage occurs, you can restore EBS volumes from those snapshots in the target Region, meeting the requirement for frequent restorable backups. This approach is native to AWS, cost-effective, and supports the stateful analytics workload without architectural changes.

Answer

Enable EBS multi-attach to spread the workload across AZs and replicate snapshots automatically between Regions.

Answer

Use RDS read replicas in another Region and keep the analytics dataset in an RDS instance only.

Answer

Rely on instance store for durability and copy only AMIs across Regions.

Question 2

An event-driven order processing service consumes messages from an Amazon SQS Standard queue. After a deployment, about 1% of messages start failing validation because a required field is missing. The consumer catches the exception and returns control, so the messages are retried. However, those poison messages keep reappearing and repeatedly consuming processing time for hours, delaying handling of valid messages. What is the most resilient way to handle the poison messages while keeping the system available?

Accepted Answer

Configure an SQS redrive policy to send messages to a dead-letter queue (DLQ) after a limited number of receives (maxReceiveCount).. Option B is correct because configuring an SQS redrive policy with a maxReceiveCount (e.g., 3–5) automatically moves messages that repeatedly fail processing to a dead-letter queue (DLQ) after the specified number of receives. This isolates the poison messages, preventing them from consuming visibility timeout and processing resources, while allowing valid messages to be handled without delay. The DLQ can then be analyzed or reprocessed offline, maintaining system availability.

Answer

Set the consumer visibility timeout to a very large value so failing messages are hidden for hours.

Answer

Switch the SQS queue from Standard to FIFO so poison messages do not retry.

Answer

Increase the consumer concurrency indefinitely so the system processes all messages even if some fail validation.

Question 3

An application encrypts data directly with AWS KMS using an encryption context. Your KMS key policy includes a condition that allows kms:Decrypt only when the encryption context contains: "purpose" = "myapp-secrets" After a deployment, decryption fails. CloudTrail shows kms:Decrypt was called, but it was denied by the key policy due to the encryption context condition. What is the best fix?

Accepted Answer

Update the application code to supply the correct encryption context "purpose" = "myapp-secrets" when calling decrypt (and encrypt if rotating).. Option A is correct because the decryption failure is directly caused by the application not supplying the required encryption context in the decrypt call. The KMS key policy condition explicitly requires the encryption context to include 'purpose'='myapp-secrets' for kms:Decrypt. Without this context, the request is denied regardless of IAM permissions. Updating the application code to pass the correct encryption context during both encrypt and decrypt operations resolves the issue.

Answer

Add kms:Decrypt to the IAM role attached to the application without changing the key policy.

Answer

Disable the encryption context condition in the KMS key policy to avoid future failures.

Answer

Rotate the KMS key immediately and re-encrypt all secrets with a different key ID.

Question 4

A internal reporting portal has old unattached EBS volumes and many stale snapshots. Which two actions reduce storage cost without affecting running instances?

Accepted Answer

Delete unattached EBS volumes after verifying they are no longer needed. Option C is correct because unattached EBS volumes incur storage costs without providing any benefit to running instances. Deleting them after verifying they are no longer needed directly reduces these costs without affecting any active EC2 instances.

Answer

Disable CloudTrail logging

Answer

Stop all EC2 instances in the account

Question 5

An application runs on EC2 instances in private subnets in a VPC. There is no NAT gateway. The instances need to download objects from S3 over HTTPS and also call DynamoDB. The security group outbound rules allow TCP 443 to the VPC endpoint addresses. After deployment, the app times out when connecting to S3, but it can reach DynamoDB. Which single change is most likely to restore S3 connectivity?

Accepted Answer

Create a Gateway VPC endpoint for S3 and associate it with the private subnet route tables that contain the instances.. The application is in private subnets without a NAT Gateway, so it cannot reach the internet. A Gateway VPC Endpoint for S3 allows private subnet instances to access S3 over the AWS network without internet connectivity. The security group already allows TCP 443 to the VPC endpoint addresses, so the missing piece is the route table association that directs S3 traffic to the endpoint.

Answer

Replace the security group egress rule to allow all outbound traffic to 0.0.0.0/0 on TCP 443.

Answer

Add an Internet Gateway to the VPC and route the private subnet’s 0.0.0.0/0 to the IGW.

Answer

Switch from network ACLs to security groups by removing the existing NACL allow rules for ephemeral ports.

Question 6

An application uses an Amazon Aurora cluster. The workload becomes read-heavy, but the team cannot change the database schema. They need higher read throughput while keeping writes on the primary. What should they do?

Accepted Answer

Create Aurora read replicas and use the reader endpoint for read traffic. Aurora read replicas are designed to offload read traffic from the primary instance, and the reader endpoint automatically load-balances connections across all replicas. Since the workload is read-heavy and the schema cannot change, adding read replicas directly increases read throughput without modifying the application's database schema. The reader endpoint ensures that read queries are directed to the replicas while writes continue to hit the primary instance.

Answer

Switch the cluster to a single-AZ Aurora configuration to reduce coordination overhead

Answer

Increase DynamoDB capacity units instead of modifying the database layer

Answer

Enable CloudFront caching for database queries to serve results from edge locations

Question 7

An administrator needs the ability to read and update infrastructure for a specific AWS account, but only when using MFA. The security team wants to eliminate long-lived administrator access keys and ensure that even if someone obtains temporary session credentials, actions are only allowed with MFA present.

Which IAM design best meets these requirements?

Accepted Answer

Create an IAM role for administration and use a permissions policy that allows only the required read/write actions. Add a condition to deny all allowed actions unless aws:MultiFactorAuthPresent is true.. Option B is correct because it uses an IAM role with a condition key `aws:MultiFactorAuthPresent` set to `true` to enforce MFA for all API calls made with temporary credentials. This eliminates long-lived access keys and ensures that even if temporary session credentials are compromised, actions are denied unless MFA was used during the session. The policy explicitly denies all allowed actions when MFA is not present, meeting the security team's requirement for MFA on every administrative action.

Answer

Create an IAM user for administrators with AdministratorAccess and require MFA only at the IAM user login.

Answer

Attach policies to an IAM user that allow read/write actions and enable MFA in the account, but do not use condition keys in IAM policies.

Answer

Use a role with the correct actions but enforce MFA only in the application by prompting users for an OTP before every API call.

Question 8

An application runs on EC2 in us-east-1 and frequently reads objects from an S3 bucket that is physically located in us-west-2. The finance team reports unexpectedly high inter-Region data transfer charges because the application retrieves objects for many user requests. A constraint: the bucket in us-west-2 must remain the system of record for compliance, but the application can read from a replica in us-east-1.

What should the solutions architect do to minimize network spend while meeting the compliance constraint?

Accepted Answer

Enable S3 Cross-Region Replication from the us-west-2 source bucket to a destination bucket in us-east-1, and update the app to read from the us-east-1 bucket.. Option A is correct because enabling S3 Cross-Region Replication (CRR) automatically copies objects from the us-west-2 source bucket to a destination bucket in us-east-1, satisfying the compliance requirement that the us-west-2 bucket remains the system of record. By updating the application to read from the us-east-1 replica, all data retrieval traffic stays within the same region, eliminating inter-Region data transfer charges (which are typically $0.02/GB for S3 GET requests across regions). This approach directly addresses the cost issue while preserving the original bucket as the authoritative source.

Answer

Create an interface VPC endpoint for S3 in us-east-1 and keep all object reads pointing to the us-west-2 bucket.

Answer

Use VPC peering between two regions and route all requests to the us-west-2 bucket over the peering link.

Answer

Use Route 53 latency-based routing to send users to a us-west-2 web endpoint and keep the S3 bucket unchanged.

Question 9

An application writes to an Amazon Aurora DB cluster. After a planned Aurora failover, the application experiences several minutes of connection errors.

The logs show the application continues connecting to the specific DB instance endpoint that was the primary before the failover.

What change most directly improves resilience during Aurora failovers?

Accepted Answer

Update the application to use the Aurora cluster writer endpoint for write traffic so it always resolves to the current writer instance.. The Aurora cluster writer endpoint always resolves to the current primary DB instance, even after a failover. By using this endpoint instead of a specific instance endpoint, the application automatically reconnects to the new writer without manual intervention or connection errors.

Answer

Increase Aurora storage autoscaling so failovers are unnecessary.

Answer

Point both reads and writes to the Aurora reader endpoint to keep the DNS name the same.

Answer

Disable Aurora failover capability so the cluster never switches writer instances.

Question 10

A media archive needs low-latency full-text search across product descriptions and filtered attributes. Which managed service is most suitable? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Amazon OpenSearch Service. Amazon OpenSearch Service is the correct choice because it is a managed, AWS-native service that provides low-latency full-text search and supports filtering on structured attributes. It is purpose-built for indexing and searching large volumes of text data, such as product descriptions, with sub-second response times. The architecture review board's preference for a managed AWS-native control is satisfied, as OpenSearch Service handles cluster management, scaling, and backups automatically.

Answer

AWS Config

Answer

Amazon EFS

Answer

Amazon SQS

Question 11

A public API for a image sharing application is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. Option C is correct because API Gateway's JWT authorizer natively validates JSON Web Tokens (JWTs) issued by an external OpenID Connect (OIDC) provider. It verifies the token's signature, expiry, and issuer against the OIDC provider's JWKS endpoint, enabling standards-based authentication without custom Lambda code.

Answer

A VPC endpoint policy

Answer

API keys only

Answer

IAM authorization for all internet users

Question 12

A risk simulation workload in private subnets downloads large amounts of data from S3 through a NAT gateway. NAT data processing charges are high. What should the architect use to reduce cost?

Accepted Answer

Gateway VPC endpoint for Amazon S3. A Gateway VPC endpoint for Amazon S3 allows instances in private subnets to access S3 directly via the AWS network, bypassing the NAT gateway entirely. This eliminates NAT data processing charges (per GB) for S3 traffic, which can be significant for large data downloads. The endpoint is free to use and routes traffic through AWS's private backbone, not the internet.

Answer

A larger NAT gateway

Answer

S3 Object Lambda

Answer

AWS Shield Advanced

Question 13

A company runs a stateless application tier behind an Application Load Balancer. Match each observed scaling pattern on the left to the best Auto Scaling strategy or metric on the right.

Question 14

A media platform serves global users through Amazon CloudFront and an S3 origin. Match each requirement on the left to the CloudFront configuration or behavior on the right.

Question 15

Match each workload to the AWS pricing option that most directly minimizes cost while still meeting the stated flexibility requirements. Use each option once.