SAA-C03 Practice Test 42 — 15 Questions

Question 1

An internal web application is exposed through an Application Load Balancer (ALB). The ALB currently has only an HTTP listener on port 80. Security requires that all client traffic be encrypted in transit. What is the best next step?

Accepted Answer

Configure an ALB HTTPS listener on port 443 using an ACM certificate, and redirect HTTP (80) to HTTPS (443).. Option B is correct because the requirement to encrypt all client traffic in transit is met by adding an HTTPS listener on port 443 using an ACM certificate, which enables TLS encryption. Additionally, configuring a redirect from HTTP (port 80) to HTTPS (port 443) ensures that any client attempting to connect over unencrypted HTTP is automatically upgraded to HTTPS, enforcing encryption for all traffic.

Answer

Enable S3 bucket encryption for application files, since it ensures encryption in transit.

Answer

Turn on default encryption for CloudFront origin access, which automatically encrypts all ALB traffic.

Answer

Add KMS permissions to the ALB role so TLS is enabled automatically.

Question 2

A content publishing system uses Lambda functions that call an unreliable third-party API. Failed events must be retained for later investigation after retries are exhausted. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

A Lambda dead-letter queue or failure destination. A Lambda dead-letter queue (DLQ) or failure destination is the correct solution because it captures events that have exhausted all retry attempts from an asynchronous Lambda invocation. This allows failed events to be retained in an Amazon SQS queue or SNS topic for later investigation, without requiring custom operational scripts. The DLQ or failure destination integrates directly with Lambda's built-in retry behavior, ensuring that only events that fail after the configured number of retries are sent to the destination.

Answer

Lambda reserved concurrency set to zero

Answer

A larger deployment package

Answer

CloudFront error pages

Question 3

A company is encrypting sensitive S3 data for a mobile banking backend with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals?

Accepted Answer

A key policy that limits key administrators and key users. Option B is correct because a KMS key policy explicitly defines which principals (IAM users, roles, AWS accounts) can administer or use the key. By limiting key administrators and key users in the key policy, you prevent unauthorized principals from accidentally invoking KMS operations on that key, even if they have broad IAM permissions. This is a direct access control mechanism at the key level.

Answer

A larger KMS key rotation period

Answer

S3 Transfer Acceleration

Question 4

A claims workflow uses Amazon SQS. Poison messages are repeatedly failing and blocking useful retries. What should the architect configure?

Accepted Answer

A dead-letter queue with an appropriate maxReceiveCount. Option C is correct because a dead-letter queue (DLQ) with an appropriate maxReceiveCount allows messages that repeatedly fail processing to be moved out of the source queue after a specified number of receive attempts. This prevents poison messages from blocking the queue and consuming retry capacity, enabling the workflow to continue processing valid messages without interruption.

Answer

A FIFO queue without a redrive policy

Answer

Short polling instead of long polling

Answer

A larger message retention period only

Question 5

An internal rendering job runs on EC2 workers in an Auto Scaling group. Each job writes checkpoints every few minutes to S3 and can resume from the latest checkpoint after an interruption. The queue depth varies sharply, and the team wants the lowest possible compute cost. Which two changes should they make? Select two.

Accepted Answer

Run the worker fleet on EC2 Spot Instances.. Option A is correct because Spot Instances can be interrupted with a two-minute warning, and since the rendering job writes checkpoints to S3 every few minutes and can resume from the latest checkpoint, it is fault-tolerant to interruptions. This allows the team to leverage the significantly lower cost of Spot Instances (up to 90% off On-Demand) while maintaining job completion, achieving the lowest compute cost for variable queue depths.

Answer

Purchase Dedicated Hosts so the fleet keeps physical servers reserved for the workload.

Answer

Run the entire fleet on On-Demand Instances to avoid any interruption risk.

Answer

Move the workers to AWS Outposts to keep compute close to the data.

Question 6

A IoT ingestion API must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control?

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. An SCP (Service Control Policy) is the strongest preventive control because it can deny the ec2:CreateVolume API call when the encrypted condition is false, effectively blocking the creation of any unencrypted EBS volume at the account level before it happens. This is a preventive control that enforces encryption as a mandatory requirement, unlike detective or corrective measures that act after the fact.

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Answer

Enable VPC Flow Logs

Answer

Tag encrypted volumes after creation

Question 7

A trading dashboard uses Aurora MySQL. The company wants fast cross-Region disaster recovery with low RPO. Which architecture should be considered? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Aurora Global Database. Aurora Global Database is the correct choice because it provides a managed, cross-Region disaster recovery solution with a Recovery Point Objective (RPO) of less than 1 second and a Recovery Time Objective (RTO) of typically less than 1 minute. It uses storage-based replication to keep a secondary cluster in another AWS Region up to date with minimal latency, meeting the low RPO requirement without manual intervention.

Answer

A single-AZ Aurora cluster

Answer

Manual snapshots copied monthly

Answer

An ElastiCache Redis replica

Question 8

A inventory service uses Lambda functions that call an unreliable third-party API. Failed events must be retained for later investigation after retries are exhausted. What should be configured?

Accepted Answer

A Lambda dead-letter queue or failure destination. Lambda dead-letter queues (DLQs) or failure destinations are the correct mechanism to retain failed events after all retries are exhausted. When a Lambda function fails to process an event (e.g., from an asynchronous invocation), the service automatically retries twice. If those retries fail, the event can be sent to an SQS queue or SNS topic (DLQ) or to a specified destination (failure destination) for later investigation. This ensures no data loss and provides a durable storage for post-mortem analysis.

Answer

Lambda reserved concurrency set to zero

Answer

A larger deployment package

Answer

CloudFront error pages

Question 9

A Lambda-based retail API has unpredictable traffic spikes and users see latency caused by cold starts. The function must respond consistently during expected campaign windows. What should be configured?

Accepted Answer

Provisioned concurrency during campaign windows. Provisioned concurrency initializes a specified number of execution environments in advance, eliminating cold starts during campaign windows. This ensures consistent latency even under unpredictable traffic spikes, as the function is always warm and ready to handle requests immediately.

Answer

A larger deployment package

Answer

Reserved concurrency only

Answer

CloudTrail data events

Question 10

A IoT ingestion API stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. Option D is correct because S3 Object Lock with compliance mode provides a write-once-read-many (WORM) model that prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of a seven-year immutable audit log, as compliance mode enforces a legal hold that cannot be removed by any entity, including AWS support.

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Answer

S3 server access logging

Question 11

A log archive serves infrequently accessed user documents that must be available immediately when requested. Which S3 storage class is likely the best cost fit?

Accepted Answer

S3 Standard-IA or S3 One Zone-IA depending on resilience requirements. S3 Standard-IA or S3 One Zone-IA is the best cost fit because the workload involves infrequently accessed data that requires immediate retrieval (millisecond latency). Standard-IA offers lower storage cost than S3 Standard while maintaining high durability and low-latency access, and One Zone-IA provides even lower cost for data that can tolerate a single-AZ failure. Both classes meet the 'available immediately' requirement, unlike Glacier tiers which have retrieval delays.

Answer

Instance store volumes

Answer

S3 Standard for all objects

Answer

S3 Glacier Deep Archive

Question 12

A media processing workflow in private subnets downloads large amounts of data from S3 through a NAT gateway. NAT data processing charges are high. What should the architect use to reduce cost? The design must avoid adding custom operational scripts.

Accepted Answer

Gateway VPC endpoint for Amazon S3. A Gateway VPC endpoint for Amazon S3 allows instances in private subnets to access S3 directly over the AWS network without traversing a NAT gateway. This eliminates NAT data processing charges because traffic stays within the AWS backbone, reducing costs significantly for large data downloads.

Answer

S3 Object Lambda

Answer

AWS Shield Advanced

Answer

A larger NAT gateway

Question 13

A company is encrypting sensitive S3 data for a order processing API with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals? The design must avoid adding custom operational scripts.

Accepted Answer

A key policy that limits key administrators and key users. Option B is correct because a KMS key policy explicitly defines which principals (IAM users, roles, or AWS accounts) are allowed to administer or use the key. By restricting key users to only the required application roles, you prevent unauthorized principals from accidentally invoking KMS operations on the key, even if they have broad IAM permissions. This is a fundamental access control that does not require custom scripts.

Answer

A larger KMS key rotation period

Answer

S3 Transfer Acceleration

Question 14

A IoT ingestion API uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend?

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. Option C is correct because IAM database authentication for RDS allows EC2 instances to authenticate to PostgreSQL using short-lived credentials obtained via an IAM instance role, eliminating the need to store long-term credentials on the instance. The EC2 instance assumes the role, retrieves a temporary authentication token (valid for 15 minutes), and uses it to connect to the RDS database, meeting both security requirements.

Answer

Store the database password in user data

Answer

Embed the database password in the AMI

Answer

Use a security group rule that allows only application instances

Question 15

A analytics dashboard uses RDS MySQL and receives many read-only reporting queries that slow down the primary database. What should the architect add?

Accepted Answer

RDS read replica and route reporting queries to it. Adding an RDS read replica offloads read-heavy reporting queries from the primary MySQL instance, preserving write performance. The read replica asynchronously replicates data using MySQL's native binlog replication, and routing reporting queries to its endpoint reduces contention on the primary.

Answer

S3 lifecycle policy

Answer

Multi-AZ standby and route reads to the standby

Answer

A larger NAT gateway