SAA-C03 Practice Test 43 — 15 Questions

Question 1

A company runs an order system on EC2 with a self-managed PostgreSQL database, a self-managed RabbitMQ broker, and a shared file server for attachments. The team wants to reduce patching, backups, and cluster administration while keeping the architecture simple and using managed services where possible. Which three changes should they make? Select three.

Accepted Answer

Replace the database with Amazon RDS for PostgreSQL.. Amazon RDS for PostgreSQL is a managed database service that automates patching, backups, and replication, eliminating the need for self-managing PostgreSQL on EC2. This directly reduces the operational overhead of cluster administration and aligns with the goal of using managed services.

Answer

Keep the database on EC2 and add more EBS volumes.

Answer

Move RabbitMQ to Dedicated Hosts for better isolation.

Question 2

A analytics dashboard uses an Application Load Balancer in one Region. Global users need lower network latency to the application without caching dynamic responses. What should be considered? The architecture review board prefers a managed AWS-native control.

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to route traffic from edge locations to the Application Load Balancer, reducing internet latency and jitter. It does not cache responses, making it ideal for dynamic content where caching is not desired. This managed service provides static IP addresses and improves performance without modifying the application.

Answer

S3 Cross-Region Replication

Answer

AWS Backup cross-Region copy

Answer

CloudFront only with long TTLs

Question 3

A CI/CD system creates an IAM role (CICDRole) used for deployments. Your organization uses IAM permission boundaries to prevent developers from granting themselves higher privileges. After an incident, you discover that CICDRole can perform unintended IAM actions because the role’s identity policy includes broad permissions. Which change most directly ensures permission boundaries continue to restrict CICDRole regardless of what is later added to the role’s identity policies?

Accepted Answer

Ensure CICDRole is created with the required permissions boundary ARN, and verify that the boundary policy does not allow the unintended IAM actions.. Option B is correct because IAM permission boundaries define the maximum permissions that an IAM role can have, regardless of what is later added to its identity-based policies. By ensuring CICDRole is created with a permission boundary that explicitly denies the unintended IAM actions, even if broad permissions are added to the role's identity policy, the boundary will override and restrict those actions. This directly addresses the requirement to prevent privilege escalation through policy modifications.

Answer

Remove the permission boundary from CICDRole so that only the identity policy controls access.

Answer

Add an identity-policy deny for iam:CreatePolicy and iam:UpdateRole on all resources.

Answer

Rely on CloudTrail alerts to stop deployments from performing IAM changes after the fact.

Question 4

A read-heavy media archive repeatedly queries the same product catalogue data from DynamoDB with millisecond latency requirements. Which service can reduce read latency and table load? The architecture review board prefers a managed AWS-native control.

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB that delivers microsecond read latency, directly addressing the millisecond requirement. By caching frequently accessed product catalogue data, DAX offloads read requests from the DynamoDB table, reducing table load and read capacity unit consumption. As a fully managed, AWS-native service, it aligns with the architecture review board's preference for managed controls.

Answer

Amazon Kinesis Data Firehose

Answer

AWS Glue Data Catalog

Answer

S3 Transfer Acceleration

Question 5

A production internal reporting portal runs continuously on EC2 with predictable usage for the next three years. The team wants a discount while retaining some instance-family flexibility. What should they buy?

Accepted Answer

Compute Savings Plan. A Compute Savings Plan offers the lowest prices on EC2 usage (up to 66% off On-Demand) in exchange for a 1- or 3-year commitment, and it automatically applies to any EC2 instance family in any region, giving the flexibility the team needs. Since the workload runs continuously with predictable usage for three years, this plan is ideal for reducing costs while retaining the ability to change instance families if needed.

Answer

Spot Instances only

Answer

Dedicated Instances

Answer

S3 Intelligent-Tiering

Question 6

A central security account stores encrypted log files in S3 using a customer managed AWS KMS key. A partner account already has S3 bucket access through an assumed role and now must also be able to encrypt and decrypt objects that use the same KMS key. Which two actions are required? Select two.

Accepted Answer

Update the KMS key policy to allow the partner role or account to use the key.. Option A is correct because the KMS key policy must explicitly grant the partner account or its assumed role permission to use the key for cryptographic operations. Without this cross-account policy statement, the partner account cannot access the key even if it has IAM permissions, as KMS key policies are the primary access control mechanism for cross-account usage.

Answer

Enable automatic key rotation to solve the cross-account access requirement.

Answer

Replace the CMK with the AWS managed key alias/aws/s3.

Answer

Export the KMS key material and share it with the partner account.

Question 7

A latency-sensitive mobile game backend uploads large files to S3 from users around the world. Which two features can improve upload performance? The team wants the control to be enforceable during normal operations.

Accepted Answer

S3 multipart upload. S3 multipart upload is correct because it allows large files to be uploaded in parallel parts, significantly reducing the impact of network latency and improving throughput. This is ideal for a latency-sensitive mobile game backend where users worldwide upload large files, as it enables faster uploads by splitting the file into smaller chunks that can be uploaded concurrently.

Answer

S3 Object Lock

Answer

S3 Inventory

Question 8

A claims portal must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control? The design must avoid adding custom operational scripts.

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. Option C is correct because an SCP (Service Control Policy) at the AWS Organizations level can deny the ec2:CreateVolume API call when the encryption condition (aws:RequestTag/Encrypted or ec2:Encrypted) is false. This is a preventive control that blocks the creation of unencrypted volumes before they exist, and it requires no custom operational scripts, aligning with the design constraint.

Answer

Tag encrypted volumes after creation

Answer

Enable VPC Flow Logs

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Question 9

A backend service in AWS uses an IAM role to upload large files to an S3 bucket using multipart upload. The upload typically succeeds, but it intermittently fails during cleanup with this error: "AccessDenied: User is not authorized to perform: s3:AbortMultipartUpload" The role identity policy currently allows only: - s3:PutObject on arn:aws:s3:::my-bucket/uploads/* - s3:ListBucket on arn:aws:s3:::my-bucket with a prefix condition What is the best least-privilege change to fix the cleanup failure?

Accepted Answer

Add s3:AbortMultipartUpload for arn:aws:s3:::my-bucket/uploads/*.. The error occurs because the IAM role lacks permission to abort multipart uploads. Multipart uploads in S3 require s3:AbortMultipartUpload to clean up incomplete upload parts after a failure or interruption. Option A grants this permission on the specific uploads/* prefix, which is the least-privilege fix because it scopes the action to the exact path where the service uploads files.

Answer

Add s3:AbortMultipartUpload for arn:aws:s3:::my-bucket/*.

Answer

Add s3:ListBucket for arn:aws:s3:::my-bucket/uploads/* so the service can find parts to abort.

Answer

Add kms:Decrypt permissions for the KMS key used to encrypt objects in the bucket.

Question 10

A development team stores application logs in CloudWatch Logs and has enabled detailed EC2 monitoring on every instance. Auditors only require 90 days of logs, and operations only needs 5-minute instance metrics. Which three changes would most directly reduce recurring monitoring costs while still meeting those requirements? Select three.

Accepted Answer

Set CloudWatch Logs retention to 90 days.. Option A is correct because setting CloudWatch Logs retention to 90 days ensures logs are automatically deleted after the required period, eliminating storage costs for older data. By default, logs never expire, which would incur ongoing charges for data beyond the audit requirement. This directly reduces recurring costs by limiting the log data stored.

Answer

Keep CloudWatch Logs retention set to Never Expire.

Answer

Enable high-resolution custom metrics for every request.

Question 11

An S3 bucket stores application logs. After 30 days, the team rarely accesses the logs, but compliance requires keeping them for 18 months. Which setup most directly reduces storage cost while maintaining compliance?

Accepted Answer

Configure an S3 Lifecycle policy to transition objects to a colder storage class after 30 days and expire (delete) them after 18 months.. Option A is correct because S3 Lifecycle policies allow you to automatically transition objects to cheaper storage classes (e.g., S3 Standard-IA or S3 Glacier Deep Archive) after 30 days, reducing storage costs for rarely accessed logs. The policy also sets an expiration action to delete objects after 18 months, meeting the compliance requirement without manual intervention.

Answer

Enable S3 Versioning and rely on deleting old versions after 30 days to reduce storage costs while keeping the latest data.

Answer

Move the bucket to a different AWS region farther from the users to reduce the likelihood of accidental reads and thereby lower storage costs.

Answer

Switch all objects to S3 Glacier Instant Retrieval immediately, regardless of object age, to minimize storage charges.

Question 12

A platform team wants application developers to create IAM roles for their ECS tasks, but security must guarantee that no role created by those developers can ever exceed a predefined permission set. The developers also should not be able to attach broader permissions to themselves later. What should the team implement?

Accepted Answer

Use an IAM permission boundary on the developer principals and require created roles to include the boundary.. Option B is correct because IAM permission boundaries allow the platform team to define a maximum set of permissions that any role created by the developers can have. By attaching a permission boundary to the developers' IAM user or role, and requiring that any new role they create includes that boundary, the developers cannot grant permissions beyond the boundary—even if they attach a broader policy. This ensures that no role can ever exceed the predefined permission set, and developers cannot escalate their own privileges later.

Answer

Attach a customer-managed IAM policy to the developers and let them create roles freely.

Answer

Create a service-linked role for ECS and let developers reuse it for all workloads.

Answer

Add an S3 bucket policy that only allows tagged roles to be created.

Question 13

Based on the exhibit, a web application runs on an Amazon EC2 Auto Scaling group behind an Application Load Balancer. During traffic surges, the average CPU utilization stays below 35%, but request latency increases sharply and the ALB access logs show far more requests per target than expected. Which change is the best way to improve scaling behavior?

Accepted Answer

Configure target tracking scaling on ALB RequestCountPerTarget for the Auto Scaling group.. Option C is correct because the issue is that request latency increases sharply and the ALB logs show far more requests per target than expected, indicating that the Auto Scaling group is not scaling based on the actual load per instance. By configuring target tracking scaling on ALB RequestCountPerTarget, the Auto Scaling group will launch new instances when the average number of requests per target exceeds a defined threshold, directly addressing the root cause of high request volume per instance. This approach ensures scaling is driven by the actual workload distribution rather than CPU utilization, which remains low due to the application being I/O-bound or network-bound.

Answer

Lower the CPU target tracking threshold so the Auto Scaling group launches more instances sooner.

Answer

Replace the Application Load Balancer with a Network Load Balancer to reduce request latency.

Answer

Increase the ALB idle timeout so requests can wait longer before timing out.

Question 14

A backend service uses an IAM role to read files from an S3 bucket. It must only read objects under s3://prod-reporting/incoming/ but currently receives AccessDenied (403) on GetObject for that prefix.

The role already has this statement:
- Action: s3:ListBucket
- Resource: arn:aws:s3:::prod-reporting

Which policy statement would most directly follow least privilege to allow only the required reads under the incoming prefix?

Accepted Answer

Allow reads with a prefix-scoped statement: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"].. Option B is correct because it grants only the s3:GetObject permission on the specific prefix path arn:aws:s3:::prod-reporting/incoming/*, which directly allows reading objects under that prefix while adhering to least privilege. The existing s3:ListBucket permission already enables listing the bucket, so only the missing read action needs to be added.

Answer

Allow only listing and reading with a single statement: Action = ["s3:*"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"].

Answer

Allow all S3 reads at the account level: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::*"].

Answer

Allow bucket listing with a condition that forces the prefix: Action = ["s3:ListBucket"], Resource = ["arn:aws:s3:::prod-reporting"], Condition = {"StringLike": {"s3:prefix": "incoming/*"}}.

Question 15

A CI/CD pipeline needs to deploy to your production environment. Security requires that the pipeline uses temporary credentials (not long-lived access keys) and only has permissions to read a specific set of parameters from AWS Systems Manager Parameter Store and write application logs to CloudWatch Logs. What is the best AWS approach?

Accepted Answer

Create an IAM role in the production account, grant least-privilege policies, and let the CI assume it using STS AssumeRole.. Option B is correct because it uses an IAM role with least-privilege policies that the CI/CD pipeline can assume via AWS STS AssumeRole, providing temporary credentials that automatically expire. This avoids long-lived access keys and meets the security requirement of using temporary credentials. The role can be scoped to allow only reading specific parameters from Systems Manager Parameter Store and writing logs to CloudWatch Logs, adhering to the principle of least privilege.

Answer

Create an IAM user for the pipeline and store access keys in the CI system.

Answer

Attach the required permissions to an IAM group and add the pipeline’s principal to that group directly.

Answer

Use AWS KMS to encrypt the pipeline’s access keys and store the ciphertext in the CI system.