SAA-C03 Practice Test 42 — 15 Questions

Question 1

An application serves static images through Amazon CloudFront. The team observes higher-than-expected origin fetches, which increases origin bandwidth costs. Which change most directly improves CloudFront cache reuse to reduce origin requests for the static content?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set appropriate Cache-Control headers (or origin cache settings) so CloudFront caches responses longer. Setting appropriate Cache-Control headers (e.g., max-age or s-maxage) or configuring origin cache settings tells CloudFront how long to keep objects in its edge cache before revalidating with the origin. By extending the cache duration, CloudFront serves more requests from its cache, reducing the number of origin fetches and lowering bandwidth costs.

Answer

Disable caching for the distribution so every request goes back to the origin

Answer

Configure CloudFront to forward all request headers and query strings to the origin

Answer

Move the S3 bucket to a different AWS Region, without changing CloudFront caching behavior

Question 2

A claims workflow requires point-in-time recovery and accidental-delete protection for a DynamoDB table. Which two settings should the architect enable? The design must avoid adding custom operational scripts.

Accepted Answer

Point-in-time recovery. Point-in-time recovery (PITR) for DynamoDB enables continuous backups with 35-day granularity, allowing restoration to any second within that window. This directly satisfies the point-in-time recovery requirement without custom scripts, as it is a native AWS feature.

Answer

DAX

Answer

Global secondary indexes

Question 3

A company runs a stateless web application on Amazon EC2 instances behind an Application Load Balancer. Traffic has grown, and the operations team notices that individual instances are often underutilized while others are saturated because traffic is not evenly distributed. The team wants the load balancer to distribute requests more evenly across healthy targets. Which action should the team take?

Accepted Answer

Configure the target group to use the least outstanding requests routing algorithm.. Even distribution of HTTP requests depends on the target group's routing algorithm. Least outstanding requests routes each new request to the target with the fewest active requests, which smooths out variance in request processing time. Round-robin alone can pile requests onto a slow target, so the least outstanding requests option is the right lever for a stateless workload.

Answer

Increase the idle timeout on the Application Load Balancer.

Answer

Change the load balancer from Application Load Balancer to Network Load Balancer.

Answer

Enable sticky sessions (session affinity) on the target group.

Question 4

A media company serves on-demand video to viewers worldwide from an Amazon S3 bucket in us-east-1. Viewers in Asia and Europe report slow start times because the first byte takes several seconds to arrive. The videos are already stored as objects and must remain in the us-east-1 bucket as the origin. Which solution improves global read performance with the LEAST operational effort?

Accepted Answer

Create an Amazon CloudFront distribution with the S3 bucket as the origin and serve objects through the distribution.. CloudFront is the managed content delivery layer for S3 origins: it caches objects at edge locations close to viewers and retrieves uncached content over the AWS backbone, cutting first-byte latency for globally distributed users. It needs no data duplication and no application rewrite, so it satisfies both the performance goal and the least-effort requirement while keeping the origin bucket in us-east-1.

Answer

Enable S3 Cross-Region Replication to replicate objects into buckets in ap-southeast-1 and eu-west-1, then point each region's viewers at its local bucket.

Answer

Move the bucket to an S3 Multi-Region Access Point and configure the application to read through the access point.

Answer

Enable S3 Transfer Acceleration on the bucket and rewrite the application to upload and download through the accelerated endpoint.

Question 5

A solutions architect is designing an S3 bucket for a mobile banking backend. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or ACLs. This setting can be applied at the account or bucket level and ensures that even if a developer later adds an overly broad bucket policy, the objects remain inaccessible to anonymous users. It is the only mechanism that enforces a hard block on public access at the S3 service level.

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable S3 Transfer Acceleration

Answer

Enable server access logging on the bucket

Question 6

A media startup stores user-uploaded video files in an Amazon S3 bucket in the us-east-1 Region. The compliance team requires that the data remain recoverable if an entire AWS Region becomes unavailable, and that recovery can be performed by pointing applications at a different endpoint. Cost should be minimized while still meeting the requirement. Which solution should a solutions architect recommend?

Accepted Answer

Enable S3 Cross-Region Replication to a bucket in a second Region and configure the application to use the replica bucket endpoint during a regional failure.. Protecting S3 data against a full regional outage requires a copy in a different Region, which Cross-Region Replication provides asynchronously and cost-effectively. Versioning, lifecycle transitions, and Transfer Acceleration all operate within the source Region and therefore cannot deliver recovery when that Region is lost.

Answer

Configure an S3 Lifecycle rule to transition objects to S3 Glacier Deep Archive after 30 days for regional durability.

Answer

Enable S3 Transfer Acceleration on the bucket so uploads and downloads are faster during a regional event.

Answer

Enable S3 Versioning on the existing bucket and rely on version history to restore objects if the Region fails.

Question 7

A platform team lets application teams create IAM roles in member accounts through Infrastructure as Code. Security says every new role must stay within a centrally approved permission ceiling, even if someone later attaches broader managed policies or inline policies. Which control should be used to enforce that maximum permission set?

Accepted Answer

Attach a permissions boundary to each role so the role can never exceed the approved ceiling.. A permissions boundary is an AWS IAM feature that sets the maximum permissions an IAM role can have. When attached to a role, any policy that grants permissions beyond the boundary is effectively ignored, ensuring the role cannot exceed the approved permission ceiling even if broader managed or inline policies are later attached. This directly enforces the security requirement without restricting the application teams' ability to create roles via Infrastructure as Code.

Answer

Use an AWS Organizations service control policy to grant the role all needed permissions directly.

Answer

Use a resource-based policy on Amazon S3 to restrict the permissions that IAM roles can receive.

Answer

Require temporary STS session policies whenever the role is assumed.

Question 8

A image sharing application uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly?

Accepted Answer

Configure Origin Access Control for the S3 origin. Option C is correct because Origin Access Control (OAC) is the mechanism that lets CloudFront sign requests to the S3 origin using SigV4, so the bucket can reject any request that does not come through the distribution. Option D is correct because an S3 bucket policy that grants access only to the CloudFront distribution's service principal (or to the distribution ARN via the OAC) enforces at the bucket level that direct requests from users are denied. Together, OAC plus a restrictive bucket policy prevent users from bypassing CloudFront and hitting the S3 bucket directly. Option A is not correct because CloudFront standard logging only records requests for auditing and does not block direct access to the origin. Option B is not correct because enabling S3 static website hosting actually makes the bucket more directly reachable via the website endpoint and does not restrict bypassing CloudFront.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 9

A team runs an EC2-based API on a single Auto Scaling group (ASG). Over the last month, they observed: - Average CPU utilization is ~15%. - p95 latency is stable and within the performance target. - The attached EBS volumes are gp3, provisioned with high baseline IOPS/throughput “just to be safe,” but CloudWatch shows consistently low utilization of those provisioned IOPS/throughput limits. They want to reduce monthly cost while maintaining current performance. Which action is the best cost-optimized choice?

Accepted Answer

Right-size both the compute and the gp3 volumes: reduce the EC2 instance size (via the ASG launch template/desired capacity configuration) and update gp3 IOPS/throughput settings to match observed utilization while keeping p95 latency targets.. The workload is over-provisioned in both compute and storage. Average CPU is only 15%, so a smaller instance size can handle the load without affecting p95 latency. The gp3 volumes have high baseline IOPS/throughput that are never used, so reducing them to match actual utilization directly lowers costs without performance risk.

Answer

Stop resizing EBS and only scale out the ASG during peak traffic, because changing EBS performance settings risks latency spikes.

Answer

Switch the instances to EC2 Spot immediately, because Spot always lowers costs without adding operational risk or affecting performance.

Answer

Move the workload to a larger instance class and keep the gp3 settings unchanged to avoid operational tuning work.

Question 10

A inventory service uses Lambda functions that call an unreliable third-party API. Failed events must be retained for later investigation after retries are exhausted. What should be configured?

Accepted Answer

A Lambda dead-letter queue or failure destination. Lambda dead-letter queues (DLQs) or failure destinations are the correct mechanism to retain failed events after all retries are exhausted. When a Lambda function fails to process an event (e.g., from an asynchronous invocation), the service automatically retries twice. If those retries fail, the event can be sent to an SQS queue or SNS topic (DLQ) or to a specified destination (failure destination) for later investigation. This ensures no data loss and provides a durable storage for post-mortem analysis.

Answer

Lambda reserved concurrency set to zero

Answer

A larger deployment package

Answer

CloudFront error pages

Question 11

A batch analytics job currently uses two NAT gateways in each of three Availability Zones, but only one private subnet per AZ needs outbound internet access. What should the architect review first? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Whether one NAT gateway per AZ is sufficient for the required private subnets. The architecture currently uses two NAT gateways per AZ, but only one private subnet per AZ requires outbound internet access. Since a single NAT gateway in an AZ can serve all private subnets in that AZ via the route table, the first step is to verify whether one NAT gateway per AZ is sufficient for the required throughput and availability. This aligns with cost optimization by eliminating unnecessary NAT gateway hourly charges and data processing fees.

Answer

Replacing every NAT gateway with an internet gateway attached to private subnets

Answer

Disabling route tables

Answer

Moving all workloads to public subnets

Question 12

Your media processing pipeline writes original uploads to an S3 bucket and later generates derivative files. An operator accidentally deletes a subset of original uploads in production. You need to (1) restore the deleted objects with minimal data loss and (2) protect against both regional disasters and future operator mistakes. The company requires recovery even if objects are deleted and later overwritten.

What is the most effective change to meet these requirements?

Accepted Answer

Enable S3 versioning on the bucket and configure cross-Region replication so previous versions are available after regional loss and accidental deletion.. Enabling S3 Versioning preserves all object versions, including overwrites and deletions (which become delete markers), allowing you to restore deleted objects by removing the delete marker. Cross-Region Replication (CRR) replicates both current and previous versions to a secondary Region, protecting against regional disasters. Together, they ensure recovery even if objects are deleted and later overwritten, meeting all requirements.

Answer

Move all objects to S3 Glacier Instant Retrieval and apply a lifecycle policy to keep only the latest object copy.

Answer

Use S3 server-side encryption with KMS keys and rely on access logs to manually recover the deleted objects.

Answer

Enable S3 bucket policies that deny DeleteObject, but do not enable versioning or replication.

Question 13

A data lake stores raw files in a single Amazon S3 bucket that is shared by three internal analytics teams. Each team should access only its own prefix, and the company wants to eliminate ACL management because objects come from multiple producers. Which three changes should the architect make? Select three.

Accepted Answer

Create a separate S3 access point for each team and scope it to that team’s prefix.. Option A is correct because S3 access points provide a dedicated endpoint per team, and each access point can be scoped with a policy limited to that team's prefix, giving clean per-team isolation without duplicating buckets. Option C is correct because setting Object Ownership to Bucket owner enforced disables ACLs entirely, so the bucket owner automatically owns every object and ACL management is eliminated, which matches the requirement that objects come from multiple producers. Option D is correct because bucket policies and access point policies are the IAM-based mechanism that restricts each team to its allowed principals and prefixes once ACLs are disabled. Option B is wrong because leaving ACLs enabled keeps the ACL management burden the company wants to remove. Option E is wrong because making the bucket public exposes the data and application-layer authorization does not replace S3-level access control.

Answer

Leave ACLs enabled so each producer can grant permissions directly on uploaded objects.

Answer

Make the bucket public and rely on application-layer authorization for data protection.

Question 14

A containerized service fleet running on EC2 instances needs to share user-uploaded files and access them with low latency. The workload is bursty: sometimes dozens of instances concurrently read the same directory for short periods, and then traffic drops. Which Amazon EFS configuration best matches these performance needs?

Accepted Answer

Use Amazon EFS General Purpose performance mode and Throughput mode set to Bursting.. The workload is bursty with concurrent reads of the same directory, which favors the General Purpose performance mode for its strong consistency and lower latency per operation. The Bursting Throughput mode is ideal for bursty traffic as it allows the file system to accumulate burst credits during idle periods and consume them during high-demand spikes, matching the described pattern without incurring additional costs.

Answer

Use Amazon EFS Max I/O performance mode with Throughput mode set to Provisioned.

Answer

Use Amazon EFS General Purpose performance mode with Throughput mode set to Provisioned.

Answer

Use Amazon EFS Max I/O performance mode with Throughput mode set to Bursting.

Question 15

A legacy market-data service runs on EC2 and exposes a custom TCP protocol. Clients must connect over TCP with very low latency, and the team wants static IP addresses at the load-balancing layer. Which AWS service is the best fit?

Accepted Answer

Network Load Balancer, because it supports TCP, static IPs, and very low latency.. The Network Load Balancer (NLB) operates at Layer 4, supports TCP traffic natively, provides static IP addresses per Availability Zone, and delivers very low latency by processing packets without inspecting application-layer headers. This makes it the ideal choice for a legacy market-data service that requires a custom TCP protocol and fixed IPs at the load-balancing layer.

Answer

Application Load Balancer, because it provides advanced routing for all protocols.

Answer

Amazon API Gateway, because it can front any network protocol with throttling.

Answer

Amazon CloudFront, because it can route traffic to EC2 instances at the edge.