SAA-C03 Practice Test 45 — 15 Questions

Question 1

A retail company is deploying a read-heavy product catalog on Amazon Aurora MySQL. The primary instance is heavily loaded with read traffic, and the team wants to offload reads to Aurora Replicas while keeping the application resilient to replica failures. The application connects using a single endpoint. Which two actions should the team take to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Aurora Auto Scaling for the cluster so that Aurora Replicas are added or removed based on read workload.. Aurora separates the writer endpoint from the reader endpoint, and the reader endpoint automatically distributes connections across all Aurora Replicas. Pairing that endpoint with Aurora Auto Scaling lets the cluster add or remove replicas based on read demand, so the application gains both read offloading and resilience without custom failover logic. Direct instance endpoints, caching, and multi-master do not fulfill the specific goal of routing reads through replicas.

Answer

Configure the application to connect directly to each Aurora Replica by its individual instance endpoint and round-robin between them in code.

Answer

Create an Amazon ElastiCache for Memcached cluster and cache all product catalog queries there.

Answer

Convert the Aurora cluster to a multi-master cluster so that all instances accept writes and reads.

Question 2

A financial services company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application writes to an Amazon RDS for MySQL database. The company needs a recovery point objective (RPO) of 1 second and a recovery time objective (RTO) of 1 minute for the database in the event of a Regional disaster. Which solution meets these requirements?

Accepted Answer

Use an Amazon Aurora global database with a secondary Region, and perform a managed planned failover or unplanned failover to the secondary Region.. Amazon Aurora global database is designed for cross-Region disaster recovery with low latency replication and fast failover. Replication typically completes in under one second, satisfying the RPO. A managed failover promotes the secondary Region to primary in under a minute, satisfying the RTO. This is the appropriate choice for a MySQL-compatible workload with stringent recovery requirements.

Answer

Configure an RDS for MySQL read replica in a second Region and promote it during a disaster.

Answer

Enable automated backups on the RDS for MySQL instance and copy the backups to a second Region using a cross-Region snapshot copy.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate data from the primary RDS instance to a second Region, and switch the application to the replica during a disaster.

Question 3

A company stores sensitive documents in an Amazon S3 bucket and must ensure that every object is encrypted at rest with keys that the company can audit and rotate. The security team also wants to detect and automatically respond if anyone attempts to disable encryption on the bucket. Which approach best satisfies these goals?

Accepted Answer

Enable default encryption with SSE-KMS using a customer managed key, block public access, and use AWS CloudTrail with an Amazon EventBridge rule and AWS Lambda to remediate unauthorized changes.. The requirements combine key control with automated detection and response. Customer managed KMS keys provide auditable, rotatable encryption, while CloudTrail captures the configuration API calls and EventBridge plus Lambda turn those events into automatic remediation. Block Public Access is a useful hardening step but is not the mechanism that detects an encryption change.

Answer

Enable default encryption with SSE-S3 and turn on S3 server access logging to a separate bucket.

Answer

Enable default encryption with SSE-KMS using an AWS managed key and enable S3 Block Public Access at the account level.

Answer

Require client-side encryption before upload and enable versioning on the bucket to preserve prior object states.

Question 4

A company runs a microservices application on Amazon ECS with AWS Fargate. The application experiences variable traffic throughout the day, with peak hours during business hours and minimal traffic at night. The company wants to optimize costs without affecting performance. Which action should they take?

Accepted Answer

Configure ECS Service Auto Scaling to adjust the number of tasks based on demand.. ECS Service Auto Scaling dynamically adjusts task count based on demand, ensuring the application scales with traffic while minimizing costs during idle periods. This is the most direct and effective cost optimization for variable workloads on Fargate. Other options either do not apply to Fargate or do not provide automatic elasticity, risking higher costs or performance issues.

Answer

Purchase Reserved Instances for Fargate tasks.

Answer

Migrate the application to Amazon EC2 instances with Spot Instances.

Answer

Use a larger Fargate task size to reduce the number of tasks.

Question 5

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application must be reachable only from a specific corporate CIDR range, and the instances must not be directly reachable from the internet. Which combination of security group configurations meets these requirements?

Accepted Answer

Allow inbound HTTP and HTTPS from the corporate CIDR range on the load balancer security group, and allow inbound HTTP from the load balancer security group on the instance security group.. The load balancer security group should allow only the corporate CIDR range on the listener ports, and the instance security group should allow traffic only from the load balancer security group. Referencing a security group as a source is the cleanest way to allow traffic from the load balancer without hardcoding its IP addresses, and it prevents direct client access to the instances.

Answer

Allow inbound HTTP and HTTPS from 0.0.0.0/0 on the load balancer security group, and allow inbound HTTP from the load balancer security group on the instance security group.

Answer

Allow inbound HTTP and HTTPS from the corporate CIDR range on the instance security group, and allow outbound traffic to the load balancer security group.

Answer

Allow inbound HTTP and HTTPS from the corporate CIDR range on both the load balancer security group and the instance security group.

Question 6

A company stores 500 TB of archival data in Amazon S3. The data is accessed only once a year for compliance audits. The company wants the most cost-effective storage solution that still allows retrieval within 48 hours. Which S3 storage class should they use?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the most cost-effective storage class for long-term retention of data that is rarely accessed and can tolerate retrieval times of 12 hours or more. The 48-hour retrieval requirement is satisfied, and the annual access pattern aligns with its design. Other classes either cost more or do not offer the same savings for archival data.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 One Zone-IA

Question 7

A solutions architect must store application configuration data in AWS Systems Manager Parameter Store. Compliance requires that the values be encrypted with a key the company controls and can rotate on demand, and that only a specific IAM role used by the application can decrypt them. Which configuration meets these requirements?

Accepted Answer

Create SecureString parameters using a customer managed KMS key, grant the application role ssm:GetParameter and kms:Decrypt on that key, and restrict the key policy to the application role.. Meeting the requirements needs two things at once: a customer managed KMS key so the company controls rotation and the key policy, and the right pair of permissions so the application can both read the parameter and decrypt it. SecureString is the only parameter type that encrypts values with KMS, and scoping the key policy to the application role enforces least privilege.

Answer

Create SecureString parameters using the default aws/ssm key, and grant the application role ssm:GetParameter.

Answer

Create SecureString parameters using a customer managed KMS key, and grant the application role only kms:Decrypt on that key.

Answer

Create String parameters using a customer managed KMS key, and grant the application role ssm:GetParameter and kms:Decrypt on that key.

Question 8

A company runs a real-time bidding platform on Amazon EC2 instances that must respond within milliseconds. The workload is highly variable, with unpredictable spikes during business hours. The company wants to minimize costs while ensuring the application always has enough capacity to handle sudden traffic surges. Which pricing model should they use?

Accepted Answer

Use On-Demand Instances with an Auto Scaling group.. For unpredictable, latency-sensitive workloads, On-Demand Instances combined with Auto Scaling provide the necessary elasticity and cost control. You pay only for what you use, and Auto Scaling ensures capacity matches demand. Reserved or Savings Plans are better for steady-state usage, while Spot Instances introduce interruption risk. Dedicated Hosts are cost-prohibitive and inflexible for this scenario.

Answer

Use a Savings Plan with a 3-year term to cover all compute usage.

Answer

Purchase a 1-year All Upfront Reserved Instance for the baseline capacity and use Spot Instances for spikes.

Answer

Use Dedicated Hosts to ensure performance and reduce costs.

Question 9

A company runs a batch processing job on Amazon EC2 that takes about 4 hours to complete. The job can be interrupted and resumed from checkpoints. The company wants to minimize compute costs. Which pricing model is MOST cost-effective?

Accepted Answer

Spot Instances. Spot Instances are the most cost-effective for batch jobs that can be interrupted and resumed. They offer deep discounts compared to On-Demand and do not require long-term commitments like Reserved Instances. Since the job checkpoints, interruptions are manageable. This aligns with the AWS Well-Architected Framework's cost optimization pillar.

Answer

On-Demand Instances

Answer

Dedicated Hosts

Answer

Reserved Instances

Question 10

A company has a steady-state workload running on Amazon EC2 instances that must run 24/7 for the next 3 years. The workload uses a consistent instance family and size across multiple Availability Zones. The company wants to achieve the maximum possible discount and is willing to make an upfront payment. Which purchasing option should a solutions architect recommend?

Accepted Answer

Standard Reserved Instances (3-year, All Upfront). Standard Reserved Instances provide the largest discount for steady-state workloads with a known instance family and size, especially with a 3-year All Upfront payment. They also offer a capacity reservation within an Availability Zone. Convertible RIs and Compute Savings Plans offer flexibility at the cost of a lower discount. On-Demand is the most expensive. Thus, Standard RIs meet the requirement for maximum discount.

Answer

On-Demand Instances

Answer

Convertible Reserved Instances (3-year, All Upfront)

Answer

Compute Savings Plans (3-year, All Upfront)

Question 11

A healthcare company runs a critical patient-records API on Amazon EC2 instances behind an Application Load Balancer in a single AWS Region. The compliance team mandates that the API remain available even if an entire AWS Region becomes unavailable. The company wants a cost-effective solution that avoids running full production capacity in a second Region at all times. Which approach BEST meets these requirements?

Accepted Answer

Deploy the API in a second Region with a minimal warm standby environment, and use Amazon Route 53 failover routing with health checks to shift traffic when the primary Region fails.. A warm standby in a second Region with Route 53 failover routing provides cross-Region resilience while controlling cost. The standby runs at reduced capacity and can be scaled up during a Regional failure. Health checks trigger automatic DNS failover, so clients reach the surviving Region without manual intervention. This design directly addresses the need to survive a full Region outage without duplicating full production capacity at all times.

Answer

Create an Amazon CloudFront distribution with the existing ALB as the origin, and enable origin failover to a second ALB in another Region.

Answer

Take regular Amazon EBS snapshots of the EC2 instances and copy them to a second Region, then restore the instances manually if the primary Region fails.

Answer

Enable Multi-AZ deployment for the EC2 instances and the Application Load Balancer, and rely on the existing single-Region architecture to survive a Regional failure.

Question 12

A company runs a two-tier web application on Amazon EC2 instances in a public subnet. The EC2 instances must access an Amazon Aurora MySQL DB cluster in private subnets. A security engineer must ensure that only the web tier can reach the database on port 3306, and that no other resources in the VPC can connect. Which combination of security group configuration and subnet placement should the engineer implement?

Accepted Answer

Attach a security group to the Aurora cluster that allows inbound TCP 3306 from the security group attached to the EC2 instances, and place the Aurora cluster in private subnets.. The secure pattern is to keep the database in private subnets and use a security group inbound rule that references the web tier's security group as the source. Security group references are evaluated dynamically, so only instances carrying that group can open a connection on the database port, and private subnet placement prevents any inbound path from the internet.

Answer

Attach a security group to the Aurora cluster that allows inbound TCP 3306 from the CIDR block of the public subnet, and place the Aurora cluster in private subnets.

Answer

Attach a security group to the Aurora cluster that allows inbound TCP 3306 from the security group attached to the EC2 instances, and place the Aurora cluster in the same public subnet as the EC2 instances.

Answer

Attach a network ACL to the private subnets that allows inbound TCP 3306 from the public subnet CIDR block, and rely on the default security group for the Aurora cluster.

Question 13

A financial analytics firm runs a nightly batch job on a fleet of Amazon EC2 instances that read millions of small JSON objects from an Amazon S3 bucket and write aggregated results to another S3 bucket. The job currently takes over six hours and the team wants to reduce this time without modifying the application code. The S3 buckets are in the same AWS Region as the EC2 instances. Which action will most effectively improve the performance of the batch job?

Accepted Answer

Increase the number of EC2 instances and ensure the S3 keys are distributed across multiple prefixes.. The batch job's performance is constrained by the rate at which it can read and write objects to S3. S3 scales horizontally, but the achievable request rate depends on the number of distinct key prefixes and the level of concurrency. By adding more EC2 instances and distributing keys across multiple prefixes, the job can parallelize requests and fully utilize S3's scalability, dramatically reducing the six-hour runtime without modifying application logic.

Answer

Switch the batch job to use S3 Select to retrieve only the necessary fields from each JSON object.

Answer

Configure the EC2 instances to use S3 Transfer Acceleration for all requests.

Answer

Enable S3 Cross-Region Replication to a bucket in a different Region and redirect the job to the replica.

Question 14

A company is building a serverless application that processes messages from an Amazon SQS queue using AWS Lambda. The application must not lose messages and must handle occasional downstream failures gracefully. The Lambda function sometimes fails due to a transient error in a downstream service. The company wants to ensure that failed messages are retried and eventually processed, but also wants to avoid infinite retries that could block the queue. What should the company do?

Accepted Answer

Configure a dead-letter queue (DLQ) on the source SQS queue and set the maximumReceiveCount to a reasonable value.. Using a dead-letter queue on the source SQS queue with a maximumReceiveCount ensures that messages are retried a limited number of times and then moved to a DLQ for separate handling. This prevents poison messages from blocking the queue and allows for later analysis or reprocessing, meeting the requirement to avoid infinite retries while not losing messages.

Answer

Increase the Lambda function's timeout and memory allocation to reduce the chance of transient errors.

Answer

Set the SQS queue's visibility timeout to a very high value so that messages are not retried until the downstream service recovers.

Answer

Configure the Lambda function to write failed messages to an Amazon S3 bucket and delete them from the queue.

Question 15

A healthcare company runs a patient portal on Amazon EC2 instances behind an Application Load Balancer across two Availability Zones. A new compliance rule requires that if an entire Availability Zone fails, the portal must remain available with no manual intervention. The EC2 instances are stateless and store no session data. Which design change should the architect implement to meet this requirement?

Accepted Answer

Enable an Auto Scaling group that spans both Availability Zones and configure the load balancer health checks to deregister unhealthy instances.. High availability across Availability Zones requires compute capacity that can be automatically replaced when an AZ fails. An Auto Scaling group spanning multiple AZs, combined with load balancer health checks, ensures that unhealthy instances are removed and new instances are launched in a surviving AZ without human action.

Answer

Convert the EC2 instances to a single larger instance type and enable detailed monitoring in Amazon CloudWatch.

Answer

Configure the Application Load Balancer to use cross-zone load balancing and attach an Elastic IP address to each EC2 instance.

Answer

Place the EC2 instances in a single Availability Zone and create an Amazon EBS snapshot schedule every hour.