SAA-C03 Practice Test 40 — 15 Questions

Question 1

A service role has an IAM policy granting kms:Decrypt for a specific AWS KMS key. The application still fails to decrypt with an AccessDenied error. What change most directly fixes this when the KMS key policy is missing the role’s permissions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the KMS key policy to allow kms:Decrypt for the service role principal (or the assumed-role principal identity that the KMS key evaluates).. The AccessDenied error occurs because the KMS key policy does not grant the service role (or its assumed-role principal) permission to call kms:Decrypt. Even if the IAM policy attached to the role allows kms:Decrypt, KMS requires that the key policy explicitly authorize the principal (or the role’s assumed-role session) when the key policy is the sole authorization mechanism. Updating the key policy to include the service role principal (or the assumed-role ARN) with kms:Decrypt directly resolves the missing permission.

Answer

Add an IAM policy statement allowing s3:GetObject for the bucket that stores the encrypted data.

Answer

Enable a CloudFront distribution for the KMS key alias.

Answer

Create a VPC gateway endpoint for KMS to route decryption requests privately.

Question 2

Company A runs an internal app in account A. The app needs to upload objects to an S3 bucket in account B. When the app calls S3, it receives AccessDenied for s3:PutObject. The team already created an IAM role in account B named UploadRole with a policy allowing s3:PutObject. They did not yet set up any trust relationship. Which change most directly fixes the access problem with least privilege?

Accepted Answer

Update the trust policy on UploadRole (account B) to allow sts:AssumeRole from the app’s IAM role or principal in account A.. The app in account A needs to assume the UploadRole in account B to gain s3:PutObject permissions. Without a trust policy on UploadRole that allows sts:AssumeRole from the app's IAM principal in account A, the role cannot be assumed, resulting in AccessDenied. Updating the trust policy directly establishes the cross-account trust relationship with least privilege, as it grants only the necessary assume-role capability.

Answer

Create IAM user access keys in account A and attach the UploadRole policy directly to those keys.

Answer

Add s3:PutObject permissions to the bucket policy in account B for all principals in account A.

Answer

Attach an SCP (service control policy) in AWS Organizations to deny sts:AssumeRole unless the caller uses an MFA device.

Question 3

A healthcare company runs a batch ingestion pipeline on Amazon EC2 instances that read messages from an Amazon SQS queue and write results to Amazon DynamoDB. The pipeline must be resilient so that a single instance failure does not stop processing and no messages are lost. Which two architectural changes should a solutions architect make to meet these requirements? (Choose two.)

Accepted Answer

Move the ingestion workers into an Auto Scaling group across multiple Availability Zones with a launch template, so failed instances are replaced automatically.. Resilience here has two parts: redundant compute that self-heals, and queue semantics that return unprocessed messages to the queue. A multi-AZ Auto Scaling group replaces failed workers, while a visibility timeout longer than processing time plus delete-after-success ensures a message is reprocessed rather than lost if an instance dies mid-flight.

Answer

Increase the number of EC2 instances manually to five and place them all in the same Availability Zone for low latency.

Answer

Convert the SQS queue to a FIFO queue with content-based deduplication enabled to guarantee no message loss.

Answer

Enable DynamoDB Accelerator (DAX) on the target table to cache writes so failed instances do not lose data.

Question 4

A marketing site runs on x86 EC2 instances and uses open-source software with no architecture-specific licensing restriction. What should be evaluated to reduce compute cost?

Accepted Answer

AWS Graviton-based instances after performance testing. AWS Graviton-based instances (ARM architecture) offer up to 40% better price-performance compared to comparable x86 instances for many workloads. Since the marketing site uses open-source software with no architecture-specific licensing restrictions, migrating to Graviton after performance testing can significantly reduce compute costs without sacrificing performance.

Answer

Cross-Region data replication for all data

Answer

io2 Block Express volumes for all instances

Answer

Dedicated Hosts by default

Question 5

A analytics dashboard uses RDS MySQL and receives many read-only reporting queries that slow down the primary database. What should the architect add? The team wants the control to be enforceable during normal operations.

Accepted Answer

RDS read replica and route reporting queries to it. B is correct because an RDS read replica is designed to offload read-heavy workloads from the primary database instance. By routing reporting queries to the read replica, the primary database is freed from processing these read-only requests, improving overall performance. This solution is enforceable during normal operations as the read replica is always available for reads, unlike a Multi-AZ standby which is not accessible for reads.

Answer

S3 lifecycle policy

Answer

Multi-AZ standby and route reads to the standby

Answer

A larger NAT gateway

Question 6

A dev sandbox currently uses two NAT gateways in each of three Availability Zones, but only one private subnet per AZ needs outbound internet access. What should the architect review first? The design must avoid adding custom operational scripts.

Accepted Answer

Whether one NAT gateway per AZ is sufficient for the required private subnets. The question asks what the architect should review first to optimize costs while maintaining functionality. Using two NAT gateways per AZ when only one private subnet per AZ needs outbound internet access is redundant; a single NAT gateway per AZ can handle the traffic for all private subnets in that AZ. The design must avoid custom operational scripts, so the simplest review is to check if one NAT gateway per AZ is sufficient, which would reduce costs without breaking connectivity.

Answer

Disabling route tables

Answer

Replacing every NAT gateway with an internet gateway attached to private subnets

Answer

Moving all workloads to public subnets

Question 7

An order-processing service consumes messages from an Amazon SQS Standard queue using a custom worker. During traffic spikes, the worker occasionally times out after performing some work but before acknowledging the message, so SQS redelivers it and it may be processed again.

You also observe that a small set of “poison” messages always fail validation.

What change most directly improves resilience by (1) preventing poison messages from retrying indefinitely and (2) avoiding duplicate side effects caused by legitimate retries?

Accepted Answer

Configure a dead-letter queue (DLQ) with a redrive policy that moves messages after maxReceiveCount, and implement idempotent processing in the consumer using an idempotency key.. A dead-letter queue (DLQ) with a maxReceiveCount redrive policy directly addresses the poison message problem by moving messages that repeatedly fail validation out of the main queue after a set number of retries, preventing indefinite retries. Implementing idempotent processing using an idempotency key ensures that even if a legitimate message is redelivered due to a visibility timeout, the consumer can detect and skip duplicate side effects, thus solving both requirements most directly.

Answer

Increase the SQS visibility timeout and, when validation fails, call DeleteMessage in the consumer to remove the message immediately.

Answer

Move to SNS topics with subscriptions and rely on SNS to provide exactly-once delivery to eliminate duplicates automatically.

Answer

Change the queue to FIFO and enable content-based deduplication, leaving the consumer logic unchanged.

Question 8

A company hosts a customer analytics portal on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use?

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows secure, auditable shell access to EC2 instances without opening inbound SSH (port 22) or RDP (port 3389) ports to the internet. It uses the AWS Systems Manager agent on the instance, which initiates an outbound connection to the AWS Systems Manager service over HTTPS (port 443), and the required IAM instance role grants permissions for this communication. This eliminates the need for a bastion host or public IP addresses, meeting the security requirement of no open inbound ports.

Answer

An internet gateway attached to the private subnet

Answer

A public Elastic IP address on each instance

Answer

A bastion host with SSH open to 0.0.0.0/0

Question 9

A content publishing system exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most?

Accepted Answer

CloudFront caching with appropriate TTLs. CloudFront caches responses from the S3 origin based on configured TTLs (Cache-Control or Expires headers). If the S3 origin experiences a short outage, CloudFront can still serve cached content to users until the TTL expires, maintaining availability. This is the most direct way to ensure users receive pages during transient origin failures.

Answer

IAM Access Analyzer

Answer

AWS Backup Vault Lock

Answer

S3 Select

Question 10

Based on the exhibit, which change will most improve the CloudFront cache hit ratio for the static assets while still serving the same files to all users?

Accepted Answer

Create a custom cache policy that includes only the v query string and excludes cookies.. The CloudFront cache hit ratio for static assets is reduced when query strings and cookies are forwarded to the origin, because each unique combination creates a separate cache entry. By creating a custom cache policy that includes only the 'v' query string (used for versioning) and excludes cookies, CloudFront can cache a single object for all users regardless of other query parameters or cookie values, maximizing cache hits while still serving the same file.

Answer

Enable Origin Shield and keep the current cache behavior unchanged.

Answer

Move the static assets to individual presigned URLs for each viewer.

Answer

Increase the CloudFront default TTL to 24 hours while continuing to forward all cookies and query strings.

Question 11

A team wants to delegate IAM management to developers, but must ensure developers can never grant themselves permissions beyond a specific limit. Which AWS mechanism best matches this requirement?

Accepted Answer

Use an IAM permission boundary on roles/users that developers create, so the developers’ effective permissions are capped by the boundary policy.. IAM permission boundaries are the correct mechanism because they allow a developer to create IAM roles or users, but explicitly cap the maximum permissions those entities can have. The boundary policy acts as a ceiling, so even if a developer attaches a permissive managed policy, the effective permissions are the intersection of the boundary and the attached policy. This directly enforces the requirement that developers cannot grant themselves permissions beyond a specific limit.

Answer

Rely only on their IAM managed policies and instruct developers to self-check against internal guidelines.

Answer

Use a service control policy (SCP) that applies only to the developers’ IAM users in the account.

Answer

Use a KMS key policy to restrict IAM actions, because IAM actions can be controlled with KMS.

Question 12

A partner company needs read-only access to reports in an S3 bucket for a B2B file exchange site. The partner has its own AWS account. What is the most secure scalable access pattern?

Accepted Answer

Create a bucket policy that grants the partner role least-privilege access to the required prefix. It uses a resource-based bucket policy that grants the partner's IAM role (from their own AWS account) least-privilege read-only access to a specific prefix. This avoids sharing long-term credentials, follows the principle of cross-account access using IAM roles and bucket policies, and is fully scalable without managing external users.

Answer

Make the objects public and rely on difficult-to-guess object names

Answer

Create an IAM user in the company account and share the access keys

Answer

Copy the objects to a public website bucket

Question 13

A containerized service on Amazon ECS connects to a database with a password that must never be stored in plaintext or hardcoded in the image. The application reads the password at startup and occasionally reconnects later, so it needs to retrieve the current secret when needed. Which three actions should the architect take? Select three.

Accepted Answer

Store the database password in AWS Secrets Manager.. Option A is correct because AWS Secrets Manager is purpose-built to store sensitive values like database passwords encrypted at rest with KMS, so the password is never kept in plaintext or baked into the image. Option B is correct because the application must call the Secrets Manager API (e.g., GetSecretValue) at runtime each time it needs the credential, which also lets it pick up rotated values on later reconnects. Option C is correct because the ECS task role should be granted least-privilege IAM permissions scoped to just that secret's ARN (secretsmanager:GetSecretValue), so only the task can read it and nothing broader is exposed. Option D is wrong because a plain environment variable stores the password in cleartext and manual updates are error-prone and insecure. Option E is wrong because embedding the password in code and using long-lived IAM user access keys violates the requirement to avoid hardcoding and least-privilege credential management.

Answer

Store the password in a plain environment variable and update it manually during maintenance windows.

Answer

Use an IAM user access key inside the container so the database password can be embedded in code.

Question 14

Your company currently uses an Application Load Balancer (ALB) in front of a service that receives a large number of TCP and UDP packets (including UDP-based telemetry). During load tests, you need to support both TCP and UDP traffic at high throughput while keeping stable IP endpoints for a downstream firewall allowlist. Which change best meets these requirements?

Accepted Answer

Switch to a Network Load Balancer (NLB) configured for TCP/UDP, and use Elastic IPs to provide stable endpoint IP addresses for allowlisting.. A Network Load Balancer (NLB) operates at Layer 4 and can handle both TCP and UDP traffic natively, unlike an ALB which only supports HTTP/HTTPS and cannot forward UDP packets. By assigning Elastic IPs to the NLB, you provide stable, static IP endpoints that can be added to a downstream firewall allowlist, meeting both the protocol and throughput requirements.

Answer

Keep the ALB and add an AWS WAF Web ACL to improve throughput and add static IP support.

Answer

Replace the ALB with an API Gateway REST API to support UDP because API Gateway can forward UDP packets.

Answer

Use an Auto Scaling group with multiple EC2 instances and no load balancer to avoid any networking bottlenecks.

Question 15

A product catalog system uses a relational database for orders and a simple key-value profile store for shopping carts. Traffic is unpredictable, and the company wants to avoid paying for large idle database instances. Which two choices are best? Select two.

Accepted Answer

Use Aurora Serverless v2 for the relational order system.. A is correct because Aurora Serverless v2 automatically scales database capacity in fine-grained ACUs up and down based on actual load, so the relational order system only consumes (and bills for) the capacity it needs during unpredictable traffic, avoiding large idle provisioned instances. B is correct because DynamoDB on-demand capacity mode charges per request and instantly accommodates unpredictable traffic spikes without provisioning or managing capacity, which fits the key-value shopping-cart profile store. C is wrong because large provisioned RDS instances plus read replicas still pay for idle capacity and read replicas do not address write-side traffic variability. D is wrong because DynamoDB provisioned capacity with a fixed minimum requires capacity planning and either throttles or wastes money under unpredictable traffic. E is wrong because replacing the relational order system with a wide-column store does not reduce SQL licensing (Aurora is not licensed per-core like commercial engines) and abandons the relational model the orders workload requires.

Answer

Keep both workloads on large provisioned RDS instances and add read replicas for the cart store.

Answer

Use DynamoDB provisioned capacity with a fixed minimum despite the unpredictable traffic.

Answer

Replace the relational order system with a wide-column table to reduce SQL licensing.