SAA-C03 Practice Test 39 — 15 Questions

Question 1

Based on the exhibit, a media rendering job runs on a single EC2 instance and writes a large working set of metadata to block storage. The workload performs sustained random reads and writes and must keep latency consistently low for the entire run. The instance may be stopped and started between jobs, and the data must persist. Which storage choice best meets the requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provisioned IOPS SSD EBS volume (io2).. The workload requires sustained low-latency random reads and writes to block storage, and the data must persist across instance stop/start cycles. Provisioned IOPS SSD EBS volumes (io2) are block-level storage designed for high-performance, low-latency workloads with consistent IOPS, and they persist independently of the EC2 instance lifecycle.

Answer

Amazon S3 with multipart uploads because it provides durable object storage and high throughput.

Answer

Amazon EFS because it can be mounted by EC2 and supports persistent file access.

Answer

Amazon FSx for Windows File Server because it offers durable storage and low latency.

Question 2

A test environment has EC2 instances that are oversized based on CPU, memory, and network utilisation. Which AWS service should identify rightsizing recommendations? The architecture review board prefers a managed AWS-native control.

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is a managed service that uses machine learning to analyze historical utilization metrics (CPU, memory, network, and storage) and provides rightsizing recommendations for EC2 instances. It identifies over-provisioned resources and suggests instance types that better match workload requirements, directly addressing the oversized EC2 instances in the test environment.

Answer

AWS DataSync

Answer

AWS Shield

Answer

AWS Artifact

Question 3

An EC2 workload runs in one region on a single instance type. For the last month, CloudWatch metrics show average CPU utilization of 12% and no sustained memory pressure. The team wants to reduce cost while maintaining the current performance level. What is the best first step?

Accepted Answer

Use AWS Compute Optimizer to get recommendations for instance type and size changes.. AWS Compute Optimizer analyzes historical utilization metrics (CPU, memory, I/O) and provides actionable recommendations for right-sizing instances. Given the average CPU utilization of only 12% and no memory pressure, Compute Optimizer will likely recommend a smaller instance type or family that matches the workload's actual resource needs, reducing cost without affecting performance.

Answer

Increase the instance size to reduce the risk of performance regression.

Answer

Switch to Spot Instances immediately to reduce cost regardless of utilization.

Answer

Disable detailed monitoring to lower CloudWatch charges.

Question 4

A company is designing a multi-Region disaster recovery (DR) strategy for a stateless web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS for MySQL database as its data store. The architecture must provide rapid failover with the lowest possible Recovery Point Objective (RPO) and Recovery Time Objective (RTO). Which of the following design choices will help achieve these objectives? (Choose four.)

Accepted Answer

Deploy the application and ALB in an active-active configuration across two AWS Regions using Amazon Route 53 latency-based routing.. An active-passive failover strategy with Route 53 failover routing policy is correct because it provides rapid failover by directing traffic to the secondary Region only when health checks fail in the primary, minimizing RTO. Cross-Region read replicas with automatic failover are correct because they allow promoting a read replica to a primary in the secondary Region with low RPO (typically seconds) and automated failover, reducing RTO. Active-active configuration with latency-based routing is correct because it distributes traffic across both Regions, enabling immediate failover without DNS propagation delays, achieving very low RTO. Storing static assets and application state in S3 with cross-Region replication and CloudFront is correct because it ensures data durability and low-latency access, supporting rapid recovery with minimal RPO.

Answer

Set up Amazon RDS Multi-AZ deployment to enable automatic failover to a standby replica in a different Availability Zone within the primary Region.

Answer

Use an Amazon RDS for MySQL single-AZ deployment in the primary Region and take daily snapshots copied to the secondary Region.

Question 5

Based on the exhibit, the application should continue serving requests if one Availability Zone fails. Which change best improves resilience with the least operational complexity?

Accepted Answer

Add at least one subnet from a second Availability Zone to both the ALB and the Auto Scaling group.. Adding subnets from a second Availability Zone to both the ALB and the Auto Scaling group distributes the application across multiple AZs. This ensures that if one AZ fails, the ALB can route traffic to healthy targets in the remaining AZ, and the Auto Scaling group can maintain capacity by launching instances in the surviving AZ. This approach directly addresses the requirement to continue serving requests during an AZ failure with minimal operational complexity.

Answer

Increase the desired capacity in AZ-a so more instances can absorb the failure of that same Availability Zone.

Answer

Disable health checks so the ALB stops removing targets during brief infrastructure issues.

Answer

Move the application to a single larger instance type so the fleet has fewer moving parts.

Question 6

Developers for a e-learning platform need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center permission sets allow you to define fine-grained permissions and assign them to users or groups with time-bound access (e.g., using a session duration or approval workflow). Combined with CloudTrail, every API call made during the elevated session is logged for audit, meeting the security team's requirements for approvals, expiry, and audit logging.

Answer

Disable CloudTrail during troubleshooting

Answer

Attach AdministratorAccess permanently to every developer role

Answer

Create shared administrator access keys for the team

Question 7

A security operations team wants continuous compliance checks for AWS resources. They need to know when an EBS volume becomes unencrypted or when a security group starts allowing SSH from 0.0.0.0/0. Which AWS service should they use?

Accepted Answer

AWS Config, because it evaluates resource configuration against compliance rules.. AWS Config is the correct service because it continuously monitors and evaluates the configuration of AWS resources against desired compliance rules. It can detect when an EBS volume is unencrypted or when a security group rule allows SSH (port 22) from 0.0.0.0/0, and trigger notifications or remediation actions via AWS Config rules.

Answer

AWS CloudTrail, because it records every API call made in the account.

Answer

Amazon GuardDuty, because it automatically encrypts noncompliant resources.

Answer

Amazon Macie, because it manages encryption settings for all AWS resources.

Question 8

A media company runs a fleet of EC2 instances using Auto Scaling across multiple instance families (for example, m-series and c-series) in a single region. The business wants to commit to steady usage for one year to reduce cost, but the application team must retain flexibility to switch instance families and scale up/down as demand changes. They need the cost-reduction approach that best matches this flexibility. Which option is the best fit?

Accepted Answer

Purchase Compute Savings Plans so the commitment applies regardless of instance family changes within the selected scope.. Compute Savings Plans provide the most flexibility because they apply to any EC2 instance family (including m-series and c-series) within a region, automatically adjusting to instance family changes and scaling. This matches the requirement to commit to steady usage for one year while retaining the ability to switch families and scale up/down, offering up to 66% savings over On-Demand without locking the application to a specific instance type.

Answer

Purchase Standard Reserved Instances tied to a specific instance family and region, so the application can only run on the selected family.

Answer

Purchase Spot Instances for all capacity and disable On-Demand fallback to guarantee the lowest cost.

Answer

Rely only on On-Demand and reduce cost by using a CloudFront-only approach for all dynamic content.

Question 9

A team wants to remove a bastion host used for administrative access to EC2 instances in private subnets. The instances should be reachable only for occasional troubleshooting by engineers who authenticate with AWS SSO. What is the best secure alternative within AWS, assuming the instances already have an instance profile attached?

Accepted Answer

Use AWS Systems Manager Session Manager, enabling the required SSM permissions in the instance profile and restricting access to engineers via IAM.. AWS Systems Manager Session Manager provides secure, auditable, agent-based access to EC2 instances without requiring a bastion host, public IPs, or open inbound ports. Since the instances already have an instance profile, you only need to add the required SSM permissions (e.g., AmazonSSMManagedInstanceCore) to that profile and use IAM policies to restrict Session Manager access to engineers authenticated via AWS SSO. This eliminates the bastion host while maintaining secure, on-demand troubleshooting access.

Answer

Keep the bastion host but move it into a private subnet; engineers can connect by using a corporate VPN into the VPC.

Answer

Attach a public IP to each private instance so engineers can SSH directly and use security groups to restrict access.

Answer

Create a security group rule that allows engineers’ source IP addresses to reach instances over RDP on port 3389.

Question 10

An Aurora PostgreSQL cluster is experiencing high read latency because 85% of traffic consists of read-only queries. The write workload must stay on the writer instance, and the team wants to offload reads without changing the application’s core query patterns. What is the best architectural option?

Accepted Answer

Add Aurora reader instances (read replicas) and route read queries to the reader endpoint while keeping writes on the writer endpoint.. Adding Aurora reader instances (read replicas) and routing read queries to the reader endpoint offloads read traffic from the writer instance without altering application query patterns. Aurora reader endpoints automatically distribute read-only connections across all replicas, reducing latency on the writer while keeping writes on the writer instance. This directly addresses the 85% read-heavy workload without requiring application changes.

Answer

Increase the writer instance size so it can handle more reads and writes simultaneously.

Answer

Enable Multi-AZ failover only and rely on the standby to serve reads in normal operation.

Answer

Move the read workload to ElastiCache Redis while keeping DynamoDB as the SQL data source.

Question 11

A retail platform needs disaster recovery across AWS Regions. The business requirement is: RTO up to 6 hours, RPO up to 1 hour, and they want the ability to start serving quickly during a Region outage but do not want to run full production capacity continuously. Which DR strategy best fits these requirements?

Accepted Answer

Warm standby, keeping a reduced but ready-to-scale environment in the secondary Region.. Warm standby is the correct strategy because it maintains a scaled-down but fully functional copy of the production environment in the secondary Region, which can be scaled up within the 6-hour RTO. The RPO of 1 hour is met by continuous replication (e.g., Amazon RDS cross-Region read replicas or DynamoDB global tables), and the reduced footprint avoids the cost of full production capacity while still enabling rapid failover.

Answer

Backup and restore only, with no continuously running infrastructure in the secondary Region.

Answer

Pilot light, keeping only the minimum resources needed to bootstrap the environment.

Answer

Multi-site active-active, serving production traffic from both Regions at all times.

Question 12

A read-heavy document portal repeatedly queries the same product catalogue data from DynamoDB with millisecond latency requirements. Which service can reduce read latency and table load? The design must avoid adding custom operational scripts.

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB that delivers microsecond read latency, reducing the number of read requests hitting the underlying table. It requires no custom scripts—just a DAX cluster endpoint—and automatically caches frequently accessed items, making it ideal for a read-heavy document portal with millisecond latency requirements.

Answer

Amazon Kinesis Data Firehose

Answer

S3 Transfer Acceleration

Answer

AWS Glue Data Catalog

Question 13

A DynamoDB table uses this schema: partition key = customerId, sort key = timestamp. During a marketing campaign, one customer generates extremely high read traffic and the application sees ProvisionedThroughputExceeded errors even though the table’s total capacity is sufficient. What change most directly improves read distribution across partitions?

Accepted Answer

Add a salt component to the partition key by changing it to customerId#salt, where salt is derived from a hash of requestId so a single customer’s requests are spread across many partitions; keep the sort key as timestamp.. Adding a salt to the partition key (e.g., customerId#hash(requestId)) distributes the read-heavy customer's data across multiple physical partitions. This prevents a single hot partition from throttling requests, even when the table's total provisioned capacity is sufficient. DynamoDB's partition key determines the internal hash used for data placement, so increasing partition key cardinality directly improves read distribution.

Answer

Increase the table’s provisioned read capacity units while keeping partition key = customerId.

Answer

Remove the sort key and use timestamp as the partition key to increase cardinality.

Answer

Switch to on-demand capacity and rely on DynamoDB to automatically distribute reads across partitions.

Question 14

Your team serves static JavaScript and CSS files from an S3 origin through CloudFront. After a release, the CloudFront cache hit ratio dropped because clients keep re-downloading the same assets. What is the best next change to improve caching performance?

Accepted Answer

Update origin responses to include long-lived Cache-Control headers (for example, max-age) so CloudFront can cache objects. Setting long-lived Cache-Control headers (e.g., max-age=31536000) on static assets tells CloudFront to cache them at edge locations for an extended period. This reduces the number of requests forwarded to the S3 origin, improving the cache hit ratio and preventing clients from re-downloading unchanged assets on every visit.

Answer

Switch the S3 bucket to S3 Glacier so objects are not frequently accessed

Answer

Disable CloudFront compression to reduce CPU usage at the edge

Answer

Set CloudFront to forward all query strings to the origin to ensure the latest assets are returned

Question 15

Your team hosts a private web app on an S3 bucket and serves it through CloudFront using a modern Origin Access Control (OAC). After deployment, users receive HTTP 403 from CloudFront with the S3 origin error "AccessDenied".

Which S3 bucket policy change best aligns with CloudFront OAC so the distribution can fetch objects privately?

Accepted Answer

Allow the CloudFront service principal cloudfront.amazonaws.com to perform s3:GetObject, and scope access with a condition on AWS:SourceArn matching your CloudFront distribution ARN.. CloudFront Origin Access Control (OAC) requires an explicit S3 bucket policy that allows the CloudFront service principal (`cloudfront.amazonaws.com`) to perform `s3:GetObject`, and the recommended best practice is to scope the permission using a condition on `AWS:SourceArn` matching the specific CloudFront distribution ARN. This ensures that only requests originating from that distribution can access the bucket objects, preventing unauthorized access from other sources.

Answer

Allow only the S3 bucket owner account to perform s3:GetObject without any condition, so CloudFront can inherit access automatically.

Answer

Add a policy statement that denies s3:GetObject when the request does not include the header CloudFront-Viewer-Country.

Answer

Grant s3:GetObject permission to an Origin Access Identity (OAI) canonical user ID even though you are using Origin Access Control (OAC).