SAA-C03 Practice Test 44 — 15 Questions

Question 1

A company runs a stateful web application on a fleet of Amazon EC2 instances in an Auto Scaling group. The application stores session state locally on each instance. During an Availability Zone failure, the Auto Scaling group replaces the unhealthy instances in a different AZ, but users lose their sessions and must log in again. The company wants to make the application resilient to AZ failures without requiring users to re-authenticate. Which solution should a solutions architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store session state in an Amazon ElastiCache for Redis cluster with Multi-AZ enabled, and configure the application to use it.. Externalizing session state to a Multi-AZ ElastiCache for Redis cluster removes the dependency on local instance storage. When an instance is replaced after an AZ failure, the new instance can retrieve the session from Redis, so users stay logged in. This decouples state from compute and provides automatic failover, meeting the resilience requirement.

Answer

Use Amazon S3 to store session data and configure the application to read and write session files directly to an S3 bucket.

Answer

Configure the Auto Scaling group to launch instances in only one Availability Zone and use a larger instance type to handle the load.

Answer

Enable sticky sessions on the Application Load Balancer and increase the Auto Scaling group's desired capacity.

Question 2

A company runs a stateless API on Amazon EC2 instances in a single Availability Zone behind an Application Load Balancer. The ALB currently has a listener on port 80 only. The company wants the API to remain available if the single Availability Zone fails. What should the solutions architect do to meet this requirement with the LEAST operational overhead?

Accepted Answer

Create an Amazon Machine Image (AMI) of the instances and configure an Auto Scaling group across at least two Availability Zones, registering the instances with the existing ALB target group.. Running the stateless API in an Auto Scaling group that spans at least two Availability Zones lets the group replace instances in a surviving zone when one zone becomes unavailable. The existing ALB and target group can be reused, so the change adds zone redundancy with the least operational overhead.

Answer

Enable cross-zone load balancing on the ALB and increase the desired capacity of the existing instances in the single Availability Zone.

Answer

Create a second ALB in another Availability Zone and use Amazon Route 53 failover routing with health checks to switch traffic when the primary zone fails.

Answer

Move the API to an Amazon S3 static website endpoint and serve the traffic through Amazon CloudFront with origin failover.

Question 3

A genomics company stores 400 TB of compressed reference data in Amazon S3. Researchers in an on-premises lab must run high-throughput reads of this data over a 10 Gbps AWS Direct Connect connection. The team observes that reads are slower than expected and wants to maximize throughput per S3 request while minimizing request costs. Which S3 feature should they implement?

Accepted Answer

S3 byte-range fetches using parallel GET requests against the same object.. Large-object throughput in S3 scales with concurrent connections, so issuing parallel byte-range GETs against each object saturates the Direct Connect link far better than a single sequential GET. Transfer Acceleration targets internet paths, replication moves copies without changing read mechanics, and Intelligent-Tiering is a cost tool rather than a throughput tool.

Answer

S3 Cross-Region Replication to a bucket in the lab's nearest Region.

Answer

S3 Transfer Acceleration on the bucket, because it speeds up long-distance transfers.

Answer

S3 Intelligent-Tiering to automatically move frequently accessed data to a faster tier.

Question 4

A company runs an internal API on Amazon EC2 instances in a private subnet. The API must call AWS Systems Manager Parameter Store to read configuration values. The security team wants to avoid long-lived credentials on the instances and avoid routing traffic over the public internet. Which combination of steps should be taken?

Accepted Answer

Attach an IAM role to the instances and create an interface VPC endpoint for Systems Manager.. Temporary credentials come from an IAM role attached to the instances, eliminating static access keys. Private access to Parameter Store is provided by an interface VPC endpoint, which uses AWS PrivateLink to keep traffic within the AWS network. Combining the role and the interface endpoint satisfies both the credential hygiene and the no-public-internet constraints.

Answer

Attach an IAM role to the instances and route Parameter Store calls through a NAT gateway.

Answer

Use an EC2 instance profile with a gateway VPC endpoint for Systems Manager.

Answer

Store IAM user access keys in AWS Secrets Manager and retrieve them from the instance at boot.

Question 5

A company is deploying a new web application on AWS. The application will serve static content (HTML, CSS, JavaScript, images) and dynamic API requests. The company expects a global user base and wants to minimize latency for all users. The static content is stored in an Amazon S3 bucket, and the dynamic APIs are hosted on Amazon EC2 instances behind an Application Load Balancer. Which service should the company use to accelerate both static and dynamic content delivery?

Accepted Answer

Amazon CloudFront with the S3 bucket and ALB as origins. Amazon CloudFront is a global content delivery network that caches static content at edge locations and can also forward dynamic requests to an Application Load Balancer origin. By using CloudFront with both the S3 bucket and the ALB as origins, the company can accelerate delivery of static and dynamic content for a global user base, reducing latency and improving performance.

Answer

Amazon Route 53 with latency-based routing to multiple Regions

Answer

AWS Global Accelerator

Answer

AWS Direct Connect with a public virtual interface

Question 6

A company runs a stateless web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences predictable traffic patterns: low traffic at night and high traffic during business hours. The company wants to optimize costs without compromising availability. Which two actions should be taken? (Choose two.)

Accepted Answer

Configure an Auto Scaling group with scheduled scaling to match the predictable traffic patterns.. Scheduled scaling aligns capacity with predictable traffic, scaling out during business hours and in at night to reduce costs. Purchasing Reserved Instances or Savings Plans for the baseline covers the continuously running capacity at a discount. Together, these actions optimize cost while maintaining availability. Other options either risk availability, add cost, or do not address the predictable pattern effectively.

Answer

Use a Network Load Balancer instead of an Application Load Balancer to reduce costs.

Answer

Enable detailed monitoring for the EC2 instances to improve scaling responsiveness.

Answer

Use Spot Instances for all instances in the Auto Scaling group to reduce compute costs.

Question 7

A company runs a stateful workload on Amazon EC2 instances in an Auto Scaling group. The workload writes session data to the instance store and to an Amazon EBS volume attached at launch. The company wants the workload to survive an Availability Zone failure without losing session data. What should the solutions architect do?

Accepted Answer

Move session data to Amazon ElastiCache for Redis with Multi-AZ enabled, and configure the Auto Scaling group to span multiple Availability Zones.. Session data must be moved off instance-bound storage to a multi-AZ data store. ElastiCache for Redis with Multi-AZ automatically fails over to a replica in another zone, and an Auto Scaling group spanning multiple zones can launch replacement instances that reconnect to the session store.

Answer

Create an Amazon EBS snapshot schedule for the attached volumes and restore the snapshots in another Availability Zone after a failure.

Answer

Attach an additional EBS volume to each instance and configure RAID 0 across the two volumes for higher durability.

Answer

Enable termination protection on the instances and configure the Auto Scaling group to use a single Availability Zone.

Question 8

A company runs a containerized API on Amazon ECS with AWS Fargate. Traffic is highly variable: it peaks during business hours and drops to near zero overnight. The team wants to pay only for what they use while keeping the API responsive during peaks. Which approach BEST optimizes cost for this workload?

Accepted Answer

Configure Application Auto Scaling on the ECS service using target tracking on a metric such as average CPU or requests per task, with a minimum task count of one.. Variable traffic that peaks in the day and falls to near zero at night is the classic case for elastic horizontal scaling. Application Auto Scaling with target tracking grows and shrinks the ECS task count to follow demand, and because Fargate charges per task-second, scaling in overnight removes the cost of idle capacity. A low minimum keeps the API warm and responsive for the first requests of the day.

Answer

Run the tasks on Fargate Spot capacity and configure the service to scale out on demand.

Answer

Migrate the workload to a single large EC2 instance running the containers with a 3-year Reserved Instance.

Answer

Provision a fixed task count sized for the highest observed peak and leave it running continuously.

Question 9

A gaming company uses Amazon DynamoDB to store player session data. The table has a partition key of PlayerID and a sort key of SessionStartTime. The company needs to retrieve all sessions for a specific player within a date range, sorted by session start time. The table is large and the company wants to minimize read latency. Which approach should they use?

Accepted Answer

Perform a Query operation on the table using the partition key and a condition on the sort key.. The table's primary key already supports the required access pattern: partition key PlayerID and sort key SessionStartTime. A Query operation with a condition on the sort key retrieves exactly the items needed, sorted by session start time, with minimal latency. Scans, GSIs, and DAX do not provide a more efficient solution for this specific query.

Answer

Use DynamoDB Accelerator (DAX) to cache the results of a Scan operation.

Answer

Perform a Scan operation with a FilterExpression on PlayerID and SessionStartTime.

Answer

Create a global secondary index with PlayerID as the partition key and SessionStartTime as the sort key, then Query the index.

Question 10

A company runs a batch processing job on Amazon EC2 instances that takes approximately 4 hours to complete. The job can be interrupted and resumed from a checkpoint. The company wants to minimize the cost of running this job. Which pricing model should they use?

Accepted Answer

Spot Instances. Spot Instances are the most cost-effective choice for interruptible batch jobs that can checkpoint and resume. They leverage spare EC2 capacity at steep discounts, and the job's design tolerates interruptions. Reserved and On-Demand pricing do not offer the same savings for this use case, and Dedicated Hosts are overkill. Thus, Spot Instances align with both the workload characteristics and the cost objective.

Answer

Dedicated Hosts

Answer

Reserved Instances

Answer

On-Demand Instances

Question 11

A company has a steady-state workload on Amazon EC2 that runs 24/7 for the next 3 years. They want to achieve the maximum possible discount and are willing to make a upfront payment. Which purchasing option should they choose?

Accepted Answer

Reserved Instances with All Upfront payment. Reserved Instances with All Upfront payment offer the maximum discount for a 3-year commitment on a steady-state workload. This option provides significant savings over On-Demand and is more reliable than Spot. Dedicated Hosts are not cost-optimized for general workloads. Therefore, All Upfront Reserved Instances are the best choice for maximum discount.

Answer

On-Demand Instances

Answer

Spot Instances

Answer

Dedicated Hosts with All Upfront payment

Question 12

A company stores application logs in an Amazon S3 bucket and wants to protect them from accidental or malicious deletion for a fixed retention period. Legal requires that no user, including the AWS account root user, be able to delete or overwrite the log objects for 365 days, and that the protection be verifiable. Which solution should a solutions architect recommend?

Accepted Answer

Enable S3 Object Lock on the bucket in compliance mode with a 365-day retention period, and apply the retention settings to the log objects.. S3 Object Lock in compliance mode makes object versions immutable for the specified retention period and no identity, including the root user, can shorten or remove the retention. Governance mode is weaker because a privileged principal can bypass it, and versioning or lifecycle rules alone do not block deletion.

Answer

Enable S3 Object Lock on the bucket in governance mode with a 365-day retention period, and grant the security team s3:BypassGovernanceRetention.

Answer

Configure an S3 Lifecycle rule that transitions the log objects to S3 Glacier Deep Archive after 30 days and expires them after 365 days.

Answer

Enable S3 Versioning on the bucket and add a bucket policy that denies s3:DeleteObject for all principals except the account root user.

Question 13

A company runs a three-tier web application on AWS. The database tier uses Amazon Aurora MySQL, and the application tier runs on Amazon EC2 instances behind an Application Load Balancer. A security audit reveals that the database credentials are stored in plaintext in a configuration file on the EC2 instances, and the same credentials have been in use for over a year. The security team must eliminate hardcoded credentials and ensure automatic rotation of the database password every 30 days without modifying application code to handle rotation events. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Store the database credentials in AWS Secrets Manager and enable automatic rotation using a Lambda rotation function. Grant the EC2 instance role permission to call secretsmanager:GetSecretValue.. AWS Secrets Manager is designed for this exact use case: it stores database credentials securely and provides managed rotation for Amazon Aurora MySQL without custom code. The EC2 instance role grants access to the secret, and the application retrieves it at runtime. This removes hardcoded credentials and automates password rotation every 30 days, meeting the requirements with minimal operational effort.

Answer

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter and configure automatic rotation using a custom Lambda function that updates the parameter.

Answer

Store the database credentials in an encrypted Amazon S3 object and use an AWS Lambda function triggered by Amazon EventBridge to rotate the password and update the object every 30 days.

Answer

Use IAM database authentication for Aurora MySQL so that the EC2 instances authenticate using their IAM role, eliminating the need for a database password.

Question 14

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be accessible only to users from a specific IP range, and the company wants to protect against common web exploits such as SQL injection and cross-site scripting. The company also wants to monitor and rate-limit requests from specific IP addresses. Which solution should a solutions architect implement?

Accepted Answer

Configure an AWS WAF web ACL with rules for IP matching, SQL injection, and cross-site scripting, and associate it with the ALB. Use rate-based rules to limit requests from specific IPs.. AWS WAF integrated with the ALB provides the required protections: IP matching to restrict access to a specific IP range, managed rules for SQL injection and cross-site scripting, and rate-based rules to limit requests from specific IPs. This solution directly addresses all requirements without unnecessary components.

Answer

Deploy AWS Firewall Manager to create a security policy that includes AWS WAF rules for IP matching and rate limiting, and apply it to the ALB.

Answer

Configure an Amazon CloudFront distribution in front of the ALB, use AWS WAF with the CloudFront distribution, and set up geo-restriction to allow only specific IPs.

Answer

Use security groups on the ALB to allow traffic only from the specific IP range, and enable AWS Shield Advanced for protection against web exploits.

Question 15

A company runs a containerized application on Amazon ECS on AWS Fargate. The application must read from an Amazon DynamoDB table and write logs to Amazon CloudWatch Logs. Security policy requires that the application use only temporary credentials and that each task have the least privilege needed. What should the company configure?

Accepted Answer

Attach a task IAM role to the ECS task definition that grants DynamoDB read access and CloudWatch Logs write access.. An ECS task IAM role delivers temporary credentials to the application inside the container and scopes permissions to the specific needs of the task. This satisfies the temporary-credential policy and enforces least privilege. The task execution role serves the ECS agent, not the application, and Fargate has no customer-visible instance profile to attach.

Answer

Attach an EC2 instance profile to the underlying Fargate host so containers inherit its permissions.

Answer

Use the ECS task execution role to grant the application access to DynamoDB and CloudWatch Logs.

Answer

Store IAM user credentials in AWS Secrets Manager and inject them into the container as environment variables.