SAA-C03 Practice Test 41 — 15 Questions

Question 1

An application in Account B (IAM role arn:aws:iam::account-b:role/app-read) reads objects from an S3 bucket in Account A. The bucket uses SSE-KMS with a customer-managed KMS key in Account A. Object reads consistently fail with an error that includes "AccessDenied" and "kms:Decrypt".

The IAM permissions in Account B for kms:Decrypt are correct, but the requests still fail.

Which change will most directly fix the failure?

Accepted Answer

Modify the KMS key policy in Account A to allow kms:Decrypt for the Account B role arn:aws:iam::account-b:role/app-read, using the appropriate cross-account conditions (for example, allowing the use via S3 and the expected encryption context for the bucket).. When using SSE-KMS with a customer-managed KMS key in a cross-account scenario, the KMS key policy must explicitly grant the external IAM role (arn:aws:iam::account-b:role/app-read) permission to perform kms:Decrypt. Even if the IAM role in Account B has the correct kms:Decrypt permission, the KMS key policy in Account A acts as a resource-based policy that must also allow the cross-account principal. Without this, the KMS service denies the decrypt request, resulting in the 'AccessDenied' error.

Answer

Add kms:Decrypt to the KMS key policy in Account A for the Account B role arn:aws:iam::account-b:role/app-read, and remove kms:Decrypt from the role policy in Account B.

Answer

Update the IAM role in Account B to use the s3:GetObject permission only, and rely on S3 to authorize KMS decrypt automatically.

Answer

Switch the S3 bucket encryption from SSE-KMS to SSE-S3, keeping all existing IAM and KMS configuration unchanged.

Question 2

A company runs a web application on Amazon EC2 instances in multiple Availability Zones. The application uses an Application Load Balancer and an Auto Scaling group. The company wants to reduce cost while maintaining high availability. The workload is steady and predictable, and the instances run continuously. Which two actions will reduce cost? (Choose two.)

Accepted Answer

Right-size the instances based on CloudWatch metrics to eliminate over-provisioned capacity.. For a steady, continuously running workload, the two most effective cost levers are purchasing commitments and right-sizing. Compute Savings Plans reduce the effective rate for the baseline usage, and right-sizing removes capacity that is not needed. High-availability features and load balancer choices should be preserved unless they are proven to be the primary cost driver.

Answer

Move the application to a single Availability Zone to reduce data transfer charges.

Answer

Enable termination protection on all instances to prevent accidental deletion.

Answer

Replace the Application Load Balancer with a Network Load Balancer to reduce hourly charges.

Question 3

A high-volume telemetry pipeline writes streaming click events that must be processed by multiple independent consumers. Which service is most appropriate?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is the most appropriate service because it is designed for real-time streaming data ingestion and processing. It can capture and store terabytes of data per hour from hundreds of thousands of sources, such as click events, and allows multiple independent consumers to read and process the same stream concurrently using the Kinesis Client Library (KCL) or enhanced fan-out with dedicated throughput.

Answer

AWS DataSync

Answer

Amazon EBS

Answer

Amazon Route 53

Question 4

A claims workflow uses Amazon SQS. Poison messages are repeatedly failing and blocking useful retries. What should the architect configure? The architecture review board prefers a managed AWS-native control.

Accepted Answer

A dead-letter queue with an appropriate maxReceiveCount. A dead-letter queue (DLQ) with an appropriate maxReceiveCount allows messages that repeatedly fail processing to be moved out of the source queue after a specified number of receive attempts. This prevents poison messages from blocking useful retries and is a fully managed AWS-native pattern. The architecture review board's preference for a managed solution is satisfied because SQS DLQs are a built-in feature requiring no custom code.

Answer

A FIFO queue without a redrive policy

Answer

Short polling instead of long polling

Answer

A larger message retention period only

Question 5

Match the disaster recovery strategy to the recovery posture it best fits for a Regional outage.

Accepted Answer

Backup & Restore: RPO hours, RTO 24+ hours. These pairs match disaster recovery strategies to their recovery postures, aligning with AWS DR strategies where RTO and RPO define the recovery objectives.

Answer

Backup & Restore: RPO seconds, RTO minutes

Answer

Multi-Site Active/Active: RPO hours, RTO 24+ hours

Question 6

A healthcare company stores patient records in an Amazon DynamoDB table. The table must be recoverable to any point within the last 35 days, and the data must remain available if an entire AWS Region becomes unavailable. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Enable point-in-time recovery on the DynamoDB table.. Point-in-time recovery provides continuous backups that allow restoration to any second within the last 35 days, meeting the recovery requirement. DynamoDB global tables replicate the table across multiple AWS Regions and support automatic failover, meeting the Region-level availability requirement. Together, these two features address both dimensions of the scenario.

Answer

Enable DynamoDB Streams and archive the stream to an Amazon S3 bucket.

Answer

Configure on-demand backup and restore with a daily backup schedule.

Answer

Enable DynamoDB Accelerator (DAX) for the table.

Question 7

A web application uses an Amazon Aurora DB cluster for a read-heavy workload. The team wants to increase read throughput without changing the database schema or rewriting application data access patterns. Which two changes should they make? Select two.

Accepted Answer

Add Aurora Replicas to scale out read traffic across multiple database instances.. Adding Aurora Replicas (Option A) directly increases read throughput by distributing read-only queries across multiple database instances, which is ideal for a read-heavy workload. Sending read queries to the Aurora reader endpoint (Option B) ensures that these queries are load-balanced across all available replicas, offloading the writer instance and improving overall performance without requiring schema or application changes.

Answer

Point all queries to the writer endpoint so Aurora can balance reads and writes internally.

Answer

Enable Multi-AZ standby for the cluster to increase the number of read-only connections.

Answer

Move the database to a single larger instance class instead of adding replicas.

Question 8

A company is designing a disaster recovery plan for a critical application hosted on AWS. The application runs on EC2 instances with data stored in Amazon EBS volumes and Amazon S3. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. Which three strategies would help meet these objectives? (Choose three.)

Accepted Answer

Replicate critical data to S3 in the disaster recovery region using S3 Cross-Region Replication (CRR).. AWS Backup can create hourly snapshots of EBS volumes and copy them to a different AWS Region, meeting the 1-hour RPO by ensuring backups are taken every hour. S3 Cross-Region Replication (CRR) asynchronously replicates objects to a bucket in another region, keeping data synchronized within minutes and supporting the RPO. Amazon Route 53 with a failover routing policy and health checks can automatically redirect traffic to the DR region within seconds to minutes, enabling the 15-minute RTO by quickly failing over to pre-prepared infrastructure.

Answer

Set up an AWS Direct Connect link between the primary and DR regions for faster data transfer.

Answer

Pre-provision EC2 instances in the disaster recovery region and keep them running 24/7.

Answer

Store Amazon Machine Images (AMIs) in the source region and use AWS Lambda to copy them after a disaster.

Question 9

A batch process uploads artifacts to an Amazon S3 bucket using multipart uploads. The bucket policy contains a statement that explicitly denies PutObject and CreateMultipartUpload unless the request uses server-side encryption with AWS KMS (SSE-KMS) and includes these request headers/parameters: x-amz-server-side-encryption=aws:kms and x-amz-server-side-encryption-aws-kms-key-id set to a specific CMK. After the process was updated, uploads intermittently fail with AccessDenied errors. Which change is the best way to make uploads succeed while still meeting the bucket policy's encryption requirement?

Accepted Answer

Update the uploader so the CreateMultipartUpload request includes SSE-KMS with the required CMK key ID; any separate PutObject uploads should include the same headers.. The bucket policy explicitly denies `PutObject` and `CreateMultipartUpload` unless the request includes both `x-amz-server-side-encryption=aws:kms` and the specific `x-amz-server-side-encryption-aws-kms-key-id` header. The intermittent failures occur because the batch process's `CreateMultipartUpload` request (which initiates the multipart upload) is missing these required headers, causing the explicit Deny to trigger. By ensuring that the `CreateMultipartUpload` request includes SSE-KMS with the correct CMK key ID, and that any subsequent `PutObject` parts also include the same headers, the uploads will satisfy the bucket policy and succeed.

Answer

Update the IAM role policy to add s3:PutObject permissions for the bucket prefix.

Answer

Remove the bucket policy's explicit Deny statement so the IAM permissions control access.

Answer

Switch to client-side encryption (SSE-C) because it also encrypts data at rest in S3.

Question 10

Based on the exhibit, a workload in private subnets must reach only Amazon S3 and AWS Secrets Manager. The team wants to eliminate internet exposure for those calls and reduce NAT gateway charges. What change should be made?

Accepted Answer

Create an S3 gateway endpoint and a Secrets Manager interface endpoint with private DNS, then remove NAT dependency for those service calls.. VPC Gateway Endpoints (for S3) and Interface Endpoints (for Secrets Manager) allow private subnet instances to access these services over the AWS network without traversing the internet or a NAT gateway. Enabling private DNS on the interface endpoint ensures that the default Secrets Manager DNS name resolves to the endpoint's private IP, eliminating the need for a NAT gateway for those calls and reducing costs.

Answer

Move the instances into a public subnet and restrict inbound access with security groups.

Answer

Add a NAT instance and disable the managed NAT gateway to lower cost.

Answer

Use VPC peering to a shared services VPC and route all AWS service traffic through that VPC.

Question 11

A healthcare analytics team runs a containerized reporting service on Amazon ECS with the Fargate launch type in a single Availability Zone. The service must remain available if one Availability Zone fails, and it must scale automatically based on CPU utilization. The tasks are stateless and write output to Amazon S3. Which configuration should a solutions architect implement?

Accepted Answer

Create an ECS service with a task count of two, place the tasks in subnets in two Availability Zones, register them with a target group behind an Application Load Balancer, and attach a target-tracking scaling policy based on ECSServiceAverageCPUUtilization.. Resilience against an Availability Zone failure requires task capacity in more than one zone, and an Application Load Balancer with health checks directs traffic only to healthy tasks. Because the tasks are stateless and store output in S3, no shared state must be replicated. Application Auto Scaling with a target-tracking policy on ECSServiceAverageCPUUtilization then adjusts task count to match demand without manual intervention.

Answer

Configure the ECS service with two tasks in the same subnet of one Availability Zone and add a Network Load Balancer with cross-zone load balancing enabled.

Answer

Use the EC2 launch type with an Auto Scaling group spanning two Availability Zones and a scheduled scaling policy that adds instances at peak hours.

Answer

Deploy the ECS service with a task count of one and enable deployment circuit breaker with rollback so that a failed task is automatically replaced.

Question 12

Based on the exhibit, a company wants EC2 instances in private subnets to access Amazon S3 without using a NAT gateway, and bucket access must be allowed only when requests come through the approved VPC endpoint. Which design is the most appropriate?

Accepted Answer

Use the S3 gateway VPC endpoint and keep the bucket policy that denies requests unless aws:SourceVpce matches the approved endpoint.. An S3 gateway VPC endpoint allows EC2 instances in private subnets to access S3 without traversing the internet or requiring a NAT gateway. By adding a bucket policy condition that denies access unless `aws:SourceVpce` matches the approved VPC endpoint ID, you ensure that only requests originating from that specific endpoint are allowed, meeting the security requirement.

Answer

Use an interface VPC endpoint for S3 only, because gateway endpoints cannot be used with bucket policies.

Answer

Add a NAT gateway and remove the bucket policy condition because the NAT route will automatically secure the S3 traffic.

Answer

Move the bucket policy restriction to a security group attached to the S3 bucket so only the VPC endpoint can reach it.

Question 13

A serverless API built with AWS Lambda serves latency-sensitive requests. The team observes intermittent slow responses during traffic ramp-ups and expects some users to hit the API immediately after a period of inactivity. Which configuration best reduces cold-start latency during these ramp-ups?

Accepted Answer

Enable Lambda provisioned concurrency on a published alias used by the API, and set a minimum provisioned concurrency greater than zero.. Lambda provisioned concurrency keeps a specified number of execution environments initialized and ready to respond immediately, eliminating cold starts for those invocations. By setting a minimum provisioned concurrency greater than zero on the alias used by API Gateway, the function remains warm even after periods of inactivity, ensuring consistent low latency during traffic ramp-ups.

Answer

Increase the Lambda function’s memory setting; cold starts will always be eliminated regardless of traffic patterns.

Answer

Switch the Lambda runtime to a newer language version and remove any VPC configuration so the function never cold starts.

Answer

Set an API Gateway stage variable to "warm" the function at request time, which forces immediate initialization.

Question 14

An orders service publishes payment instructions to an Amazon SQS Standard queue. The downstream processor sometimes times out after it has already applied the payment, but before it can delete the message from the queue. As a result, the same payment instruction can be processed more than once. The team wants the strongest way to prevent duplicate side effects while keeping the system decoupled. What should they implement?

Accepted Answer

Make the downstream processor idempotent by recording processed payment instruction IDs in a durable datastore and ignoring repeats.. Making the downstream processor idempotent ensures that duplicate payment instructions are safely ignored, even if the same message is delivered more than once. This approach provides the strongest guarantee against duplicate side effects without requiring changes to the queue type or increasing visibility timeouts, and it keeps the system fully decoupled.

Answer

Keep the queue as SQS Standard but increase the visibility timeout so duplicates are less likely to reappear during timeouts.

Answer

Change the queue to an SQS FIFO queue and use a stable deduplication ID derived from the payment instruction ID.

Answer

Use an ALB health check to restart the downstream processor when timeouts occur.

Question 15

A warehouse integration service must use shared file storage across Linux EC2 instances in multiple Availability Zones. The storage must remain available during an AZ failure. Which service should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Amazon EFS with mount targets in multiple Availability Zones. Amazon EFS provides a fully managed, POSIX-compliant NFSv4.1 shared file system that can be mounted concurrently across multiple Linux EC2 instances. By deploying mount targets in multiple Availability Zones, the file system remains accessible even if one AZ fails, satisfying the high-availability requirement without any custom scripts.

Answer

S3 mounted as a POSIX file system without a file gateway

Answer

Instance store volumes

Answer

An EBS volume attached to all instances