SAA-C03 Practice Test 40 — 15 Questions

Question 1

A company is migrating a legacy monolithic application to AWS and wants to improve its resilience by decoupling components. The application currently writes directly to a shared file system and uses synchronous HTTP calls between modules. Which three AWS services should the company use to achieve a more resilient, decoupled architecture? (Choose three.)

Accepted Answer

Amazon SQS for asynchronous message passing between application components.. Amazon SQS is correct because it enables asynchronous message passing between application components, decoupling them so that a failure in one component does not block others. This replaces the synchronous HTTP calls, improving resilience by allowing messages to be buffered and processed independently.

Answer

Amazon EFS as a shared file system to replace the on-premises NAS.

Answer

AWS Direct Connect to provide a dedicated network link for inter-component communication.

Answer

Amazon Elastic Block Store (EBS) with Multi-Attach for shared block storage between components.

Question 2

A company is designing a disaster recovery plan for a critical application hosted on AWS. The application runs on EC2 instances with data stored in Amazon EBS volumes and Amazon S3. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. Which three strategies would help meet these objectives? (Choose three.)

Accepted Answer

Use AWS Backup to create hourly snapshots of EBS volumes and copy them to a different AWS Region.. AWS Backup can create hourly snapshots of EBS volumes and copy them to a different AWS Region, meeting the 1-hour RPO by ensuring backups are taken every hour. S3 Cross-Region Replication (CRR) asynchronously replicates objects to a bucket in another region, keeping data synchronized within minutes and supporting the RPO. Amazon Route 53 with a failover routing policy and health checks can automatically redirect traffic to the DR region within seconds to minutes, enabling the 15-minute RTO by quickly failing over to pre-prepared infrastructure.

Answer

Pre-provision EC2 instances in the disaster recovery region and keep them running 24/7.

Answer

Store Amazon Machine Images (AMIs) in the source region and use AWS Lambda to copy them after a disaster.

Answer

Set up an AWS Direct Connect link between the primary and DR regions for faster data transfer.

Question 3

A company is designing a multi-Region disaster recovery (DR) strategy for a stateless web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS for MySQL database as its data store. The architecture must provide rapid failover with the lowest possible Recovery Point Objective (RPO) and Recovery Time Objective (RTO). Which of the following design choices will help achieve these objectives? (Choose four.)

Accepted Answer

Configure an active-passive failover strategy by deploying the application stack in two AWS Regions and using Amazon Route 53 health checks with a failover routing policy.. An active-passive failover strategy with Route 53 failover routing policy is correct because it provides rapid failover by directing traffic to the secondary Region only when health checks fail in the primary, minimizing RTO. Cross-Region read replicas with automatic failover are correct because they allow promoting a read replica to a primary in the secondary Region with low RPO (typically seconds) and automated failover, reducing RTO. Active-active configuration with latency-based routing is correct because it distributes traffic across both Regions, enabling immediate failover without DNS propagation delays, achieving very low RTO. Storing static assets and application state in S3 with cross-Region replication and CloudFront is correct because it ensures data durability and low-latency access, supporting rapid recovery with minimal RPO.

Answer

Set up Amazon RDS Multi-AZ deployment to enable automatic failover to a standby replica in a different Availability Zone within the primary Region.

Answer

Use an Amazon RDS for MySQL single-AZ deployment in the primary Region and take daily snapshots copied to the secondary Region.

Question 4

A company is running a stateful web application on EC2 instances that processes user uploads. The architecture currently uses a Multi-AZ deployment for high availability. Which three cost-optimization strategies can be applied without sacrificing high availability? (Choose three.)

Accepted Answer

Store uploaded files in Amazon S3 and use S3 Transfer Acceleration for uploads, then remove the local storage from EC2 instances.. Storing uploaded files in Amazon S3 and using S3 Transfer Acceleration for uploads removes the need for local storage on EC2 instances, reducing storage costs and eliminating the cost of managing EBS volumes. This strategy does not affect high availability because S3 is inherently highly available and durable across multiple Availability Zones. Transfer Acceleration optimizes upload speed over the public internet without impacting the availability of the application.

Answer

Replace Multi-AZ EC2 with a single-AZ deployment to reduce data transfer costs.

Answer

Use an Amazon ElastiCache cluster in a single Availability Zone to reduce costs.

Answer

Implement a NAT Gateway in each Availability Zone for outbound traffic to reduce data transfer costs.

Question 5

A image sharing application uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly?

Accepted Answer

Configure Origin Access Control for the S3 origin. Origin Access Control (OAC) is a CloudFront feature that restricts access to an S3 origin by requiring that all requests include a specific signature that only CloudFront can generate. When you configure OAC, CloudFront signs requests to S3 using its own credentials, and the S3 bucket policy is updated to allow access only to the CloudFront distribution's canonical user ID. This ensures that direct requests to the S3 bucket URL are denied, preventing users from bypassing CloudFront.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 6

A company is migrating its on-premises workloads to AWS and wants to optimize costs. Which three strategies should the company implement to achieve a cost-optimized architecture? (Choose three.)

Accepted Answer

Use Reserved Instances or Savings Plans for predictable workloads to reduce costs compared to On-Demand pricing.. Reserved Instances or Savings Plans provide significant discounts (up to 72%) over On-Demand pricing for predictable workloads by committing to a specific usage term (1 or 3 years). This directly reduces compute costs for steady-state applications, making it a core cost-optimization strategy.

Answer

Provision additional EC2 instances to handle peak load at all times, ensuring maximum performance.

Answer

Store all data in Amazon S3 Standard storage class to avoid any data retrieval costs.

Answer

Deploy all resources in a single Availability Zone to minimize data transfer costs.

Question 7

A solutions architect is designing a cost-optimized data storage solution for a large dataset that is accessed infrequently but must be retained for compliance for 7 years. Which three actions should the architect take to minimize costs? (Choose three.)

Accepted Answer

Use Amazon S3 lifecycle policies to transition data from S3 Standard to S3 Glacier Deep Archive after 30 days.. Amazon S3 lifecycle policies allow you to define rules that automatically transition objects to colder storage tiers like S3 Glacier Deep Archive after a specified period. This approach minimizes costs by keeping data in S3 Standard only for the initial 30 days when it might be accessed, then moving it to the lowest-cost storage class for the remaining compliance period. S3 Intelligent-Tiering automatically optimizes costs by monitoring access patterns and moving data between frequent, infrequent, and archive access tiers without manual intervention. S3 Object Lock in compliance mode prevents any user, including the root user, from deleting or overwriting objects during the retention period, ensuring regulatory compliance.

Answer

Store the data in Amazon S3 Glacier Deep Archive immediately after creation.

Answer

Store all data in Amazon EBS gp2 volumes attached to an EC2 instance for low-latency access.

Answer

Replicate all data to a second AWS Region using S3 Cross-Region Replication to ensure durability.

Question 8

A company is using AWS for big data analytics and wants to optimize costs for its data processing pipeline. Which three design choices will help achieve this goal? (Choose three.)

Accepted Answer

Use Amazon S3 for input and output data, and enable S3 Select to reduce the amount of data transferred to processing.. Using Amazon EMR with Spot Instances for task nodes is correct because task nodes are typically used for fault-tolerant, stateless processing in EMR clusters. Spot Instances offer significant cost savings (up to 90% compared to On-Demand) and can be interrupted, but since task nodes can be replaced without affecting job completion, this is a cost-optimized design for big data pipelines. Amazon S3 Select is correct because it allows you to retrieve only a subset of data from an object (e.g., specific columns or rows) using SQL expressions, reducing the amount of data transferred to your processing application and lowering data transfer and processing costs. Using AWS Glue with a scheduled crawler and choosing a lower number of DPUs for smaller jobs is correct because DPUs (Data Processing Units) are the billing unit for AWS Glue jobs; selecting a lower DPU count for jobs that do not require high parallelism directly reduces costs.

Answer

Provision a fixed number of EC2 instances for processing to avoid scaling delays.

Answer

Store all data in Amazon Redshift Spectrum external tables to avoid loading data into Redshift clusters.

Answer

Store all intermediate data on Amazon EBS io2 Block Express volumes for high performance.

Question 9

A company is designing a high-performance web application that serves static and dynamic content to a global user base. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The static assets are stored in an S3 bucket. Which three architecture decisions will improve performance and reduce latency for users? (Choose three.)

Accepted Answer

Use Amazon CloudFront to cache both static and dynamic content at edge locations.. Amazon CloudFront caches both static and dynamic content at edge locations, reducing latency by serving content from locations closer to users. AWS Global Accelerator improves performance by routing traffic over the AWS global network instead of the public internet, reducing jitter and latency. Larger EC2 instance types like c5n or m5n provide higher network bandwidth, which reduces network bottlenecks for high-traffic applications.

Answer

Place the EC2 instances in a single Availability Zone to reduce network latency.

Answer

Enable S3 Transfer Acceleration on the bucket for faster downloads.

Answer

Use an Amazon RDS Multi-AZ database for read replicas to offload read traffic.

Question 10

A company is designing a high-performance database architecture for an e-commerce platform that experiences rapid spikes in read traffic during flash sales. The database must handle millions of reads per second with sub-millisecond latency. The data is key-value in nature, with a small number of attributes per item. Which three options should be included in the architecture? (Choose three.)

Accepted Answer

Amazon DynamoDB as the primary database.. Amazon DynamoDB is a fully managed NoSQL key-value database that delivers single-digit millisecond latency at any scale, making it ideal for high-traffic e-commerce platforms with key-value data. DynamoDB Accelerator (DAX) is an in-memory cache that sits in front of DynamoDB, reducing read latency to microseconds for millions of reads per second. Amazon ElastiCache for Redis with cluster mode enabled provides a distributed in-memory cache that can offload read traffic from the primary database, further reducing latency and handling spikes during flash sales.

Answer

Amazon RDS for MySQL with Multi-AZ and Read Replicas.

Answer

Amazon S3 as a primary data store accessed via Select and Range queries.

Answer

Amazon Redshift with auto-scaling for real-time reads.

Question 11

A fintech company needs a disaster recovery design for a web application in two Regions. The business requires an RPO of 15 minutes and an RTO under 2 hours, but it cannot afford to keep a full production stack running in both Regions all the time. Which two DR strategies best fit the requirement? Select two.

Accepted Answer

Pilot light with critical data and minimal services pre-staged in the secondary Region.. A pilot light strategy is correct because it pre-stages only critical data (e.g., database replication) and minimal core services (e.g., a small EC2 instance or RDS standby) in the secondary Region, which can be scaled up to full production within the RTO of under 2 hours. The RPO of 15 minutes is achievable by using synchronous or near-synchronous replication (e.g., Amazon RDS Multi-AZ cross-Region or DynamoDB global tables) to keep data loss minimal. This approach avoids the cost of a full production stack while meeting the recovery objectives.

Answer

Active-active deployment with full production capacity in both Regions.

Answer

Backup-and-restore only, with no pre-provisioned resources in the secondary Region.

Answer

Single-Region deployment with Multi-AZ only, because that already covers disaster recovery.

Question 12

An application in Account B reads objects from an Amazon S3 bucket in Account A. The bucket uses SSE-KMS with a customer managed key in Account A. The role in Account B already has s3:GetObject, but downloads fail with AccessDenied on decrypt. Which two changes are required for the role to read the object successfully? Select two.

Accepted Answer

Add kms:Decrypt permission in the role's IAM policy for the KMS key.. Option B is correct because the role in Account B needs explicit kms:Decrypt permission in its IAM policy to use the KMS key for decrypting the S3 objects. Option C is correct because the KMS key policy in Account A must grant the role from Account B permission to call kms:Decrypt, as the key is customer managed and cross-account access requires both the key policy and the IAM policy to allow the action.

Answer

Add an SCP that grants the role additional permissions for KMS usage.

Answer

Grant the role read access with an S3 bucket ACL.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 13

A deployment engineer created an IAM role for an automation workflow (AppDeployRole). The role has an attached identity policy that allows iam:CreateRole for specific resource ARNs. However, the role is also created with a permission boundary named DeployBoundary. The DeployBoundary policy currently does not include the iam:CreateRole action. During execution, the automation fails with AccessDenied for iam:CreateRole, even though the attached identity policy allows it. What is the best fix?

Accepted Answer

Update DeployBoundary to allow iam:CreateRole for only the required resource ARNs, following least privilege.. B is correct because when an IAM role has a permission boundary, the boundary defines the maximum permissions the role can have. Even if the identity-based policy allows iam:CreateRole, the effective permissions are the intersection of the identity policy and the permission boundary. Since DeployBoundary does not include iam:CreateRole, the action is denied. Updating the boundary to allow iam:CreateRole for the required resource ARNs, following least privilege, grants the necessary permission while still constraining the role.

Answer

Edit AppDeployRole’s attached identity policy to add iam:CreateRole again; permission boundaries only apply when permissions are missing.

Answer

Remove the permission boundary from the role because permission boundaries are not enforced at runtime.

Answer

Encrypt the deployment artifacts with KMS so IAM denies become KMS authorization failures.

Question 14

An order-processing system publishes an event whenever a payment succeeds. Three downstream services (inventory, shipping, and analytics) must react independently. Analytics sometimes has high latency, but order processing must not be blocked. What is the best AWS approach to decouple these consumers?

Accepted Answer

Publish payment events to SNS (or EventBridge) and let each downstream service consume independently (for example, via SQS queues or other async targets).. Option B is correct because Amazon SNS (or EventBridge) enables asynchronous, fan-out messaging where a single payment-success event is published once and delivered independently to multiple downstream services (inventory, shipping, analytics) via SQS queues or other targets. This decouples the producer from consumer latency—analytics can take its time without blocking order processing—and ensures each consumer processes the event at its own pace, meeting the requirement for independent, non-blocking reactions.

Answer

Have order processing call each service synchronously via HTTPS and retry on failures.

Answer

Store events in a single relational database table and let consumers poll continuously for new rows.

Answer

Send events directly from the producer to each consumer EC2 instance using SSH tunnels.

Question 15

An orders service publishes payment instructions to an Amazon SQS queue. After occasional processing timeouts, the downstream consumer sometimes processes the same instruction twice, resulting in duplicate payment attempts. The team currently uses an SQS Standard queue with a visibility timeout of 2 minutes and relies on the consumer to finish before the timeout expires. What approach best improves resilience against duplicate processing?

Accepted Answer

Make the consumer idempotent using the order ID as a deduplication key, and set the visibility timeout longer than the worst-case processing time.. Option B is correct because making the consumer idempotent using the order ID as a deduplication key ensures that even if the same message is processed multiple times, the downstream system will only apply the payment once. Setting the visibility timeout longer than the worst-case processing time prevents the message from becoming visible again before the consumer finishes, eliminating the root cause of duplicate processing in a Standard queue.

Answer

Decrease visibility timeout to 10 seconds so duplicates are less likely to occur.

Answer

Use an EventBridge rule with a fixed retry policy that only retries when the payload matches exactly.

Answer

Enable a dead-letter queue (DLQ) only, without changing the queue type or consumer logic.