SAA-C03 Practice Test 46 — 15 Questions

Question 1

A retail company runs a read-heavy product catalog on Amazon RDS for MySQL. During flash sales, read replicas lag behind the primary and the application serves stale prices. The team wants to scale read traffic while ensuring the application reads the most current data for price lookups. Which solution should a solutions architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Route price lookups to the primary DB instance and other reads to read replicas.. RDS read replicas use asynchronous replication, so they can lag under write-heavy flash-sale conditions. Price lookups need the latest committed value, so sending them to the primary guarantees freshness, while other reads continue to use replicas for scale. Multi-AZ standbys cannot serve reads, and simply adding replica capacity does not eliminate lag, so routing consistency-sensitive queries to the primary is the correct design.

Answer

Enable Multi-AZ on the RDS for MySQL instance and point all reads to the standby.

Answer

Increase the size of the read replicas and enable automatic scaling of replicas.

Answer

Configure the application to retry reads on a replica until the price matches the primary.

Question 2

A company stores critical documents in an Amazon S3 bucket in the us-east-1 Region. The documents must survive an unlikely loss of the entire us-east-1 Region. The company wants a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 1 hour. What should the solutions architect recommend?

Accepted Answer

Enable S3 Cross-Region Replication (CRR) from the us-east-1 bucket to a bucket in us-west-2 and enable S3 Versioning on both buckets.. S3 Cross-Region Replication copies objects to a bucket in a different Region, and versioning is a prerequisite. Replication is asynchronous but typically completes well within a 15-minute RPO, and the destination bucket can serve as the recovery source within the 1-hour RTO.

Answer

Enable S3 server access logging and store the logs in a separate bucket in us-east-1.

Answer

Configure an S3 Lifecycle rule to transition objects to S3 Glacier Deep Archive after 30 days.

Answer

Enable S3 Transfer Acceleration on the us-east-1 bucket to speed up uploads from global clients.

Question 3

A company stores 500 TB of data in Amazon S3 Standard. The data is accessed frequently for the first 30 days after creation, then access drops to almost zero, but the data must be retained for 10 years for compliance. The company wants to minimize storage costs. Which solution is MOST cost-effective?

Accepted Answer

Create an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 30 days.. S3 Glacier Deep Archive offers the lowest storage cost for long-term retention and is designed for data accessed less than once per year. A lifecycle policy to transition after 30 days automates the process and ensures data is moved to the most economical tier. Other options either cost more or do not provide the necessary durability for compliance.

Answer

Enable S3 Versioning and use S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.

Answer

Use S3 One Zone-IA after 30 days to reduce costs.

Answer

Use S3 Intelligent-Tiering to automatically move data between access tiers.

Question 4

A company runs a two-tier web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The EC2 instances must access an Amazon Aurora MySQL DB cluster. A security engineer must ensure that only these EC2 instances can connect to the database, and that no credentials are stored on the instances. What should the security engineer do?

Accepted Answer

Configure the DB cluster security group to allow inbound MySQL traffic from the EC2 instances' security group, and enable IAM database authentication on the cluster.. Restricting the Aurora security group to the EC2 instances' security group enforces network-level isolation so only those instances can open a MySQL session. Enabling IAM database authentication lets the application use its IAM role to obtain a temporary token, so no long-lived database password is stored on the instances, satisfying both the access and credential requirements.

Answer

Create a VPC endpoint for Aurora and attach an IAM policy that allows only the EC2 instance role to use the endpoint.

Answer

Store the Aurora master credentials in AWS Secrets Manager and grant the EC2 instance role permission to retrieve the secret at boot.

Answer

Place the DB cluster in a private subnet and attach an AWS WAF web ACL to the cluster endpoint to filter incoming connections.

Question 5

A startup runs a stateless web application on a single Amazon EC2 instance in one Availability Zone. The application has become popular, and the startup wants to ensure that the application can survive the failure of an Availability Zone and can handle increased traffic. Which architecture change should the startup make FIRST?

Accepted Answer

Move the application to an Auto Scaling group that spans multiple Availability Zones, and place an Application Load Balancer in front of it.. Moving to an Auto Scaling group across multiple Availability Zones with an Application Load Balancer provides both high availability and elasticity. The load balancer health checks ensure traffic goes only to healthy instances, and the Auto Scaling group replaces failed instances automatically. This architecture eliminates single points of failure and allows the application to scale with demand, which is the fundamental first step for resilience.

Answer

Resize the existing EC2 instance to a larger instance type to handle increased traffic and improve availability.

Answer

Create an Amazon Machine Image (AMI) of the instance and store it in Amazon S3 for quick recovery after a failure.

Answer

Enable detailed monitoring on the EC2 instance and create Amazon CloudWatch alarms to notify the team of failures.

Question 6

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application must be highly available and able to withstand the failure of an entire AWS Region. The company wants to minimize operational overhead and ensure that failover is automatic. Which solution should a solutions architect recommend?

Accepted Answer

Deploy the application in two AWS Regions. Use Amazon Route 53 with a failover routing policy and health checks to route traffic to the secondary Region if the primary becomes unhealthy.. To withstand a Region failure with automatic failover, the application must be deployed in at least two Regions. Route 53 failover routing with health checks automatically redirects traffic to the secondary Region when the primary is unhealthy. This minimizes operational overhead because the failover is managed by Route 53 and does not require manual intervention.

Answer

Deploy the application in two AWS Regions. Use Amazon Route 53 with a weighted routing policy and equal weights for both Regions.

Answer

Deploy the application in two Availability Zones within a single Region. Use an Application Load Balancer to distribute traffic across both AZs.

Answer

Deploy the application in a single Region using AWS Global Accelerator to route traffic to the nearest edge location.

Question 7

A retail company runs a stateless web tier on Amazon EC2 instances behind an Application Load Balancer. During flash sales, response times spike because each request triggers many database queries. The team wants to reduce database load and improve read latency for product catalog pages that change only a few times per day. Which solution is MOST appropriate?

Accepted Answer

Deploy an Amazon ElastiCache for Redis cluster and cache the catalog query results.. Caching the catalog query results in ElastiCache for Redis removes most repeated database reads and serves product pages from memory, which directly cuts database load and read latency. DynamoDB migration is invasive, Performance Insights only diagnoses, and adding web instances increases pressure on the database rather than relieving it.

Answer

Add more EC2 instances to the web tier behind the load balancer.

Answer

Enable Amazon RDS Performance Insights and tune the slowest queries.

Answer

Move the catalog tables to Amazon DynamoDB with on-demand capacity.

Question 8

A solutions architect is configuring a VPC for a three-tier web application. The database tier must not be reachable from the internet, and only the application tier should be able to initiate connections to the database on port 3306. The application tier runs on EC2 instances in a separate subnet. Which configuration enforces this requirement?

Accepted Answer

Place the database instances in a private subnet and attach a security group that allows inbound MySQL traffic from the application tier's security group on port 3306.. A security group rule that names the application tier's security group as the source grants access based on identity rather than IP range, so only those instances can reach the database on port 3306. Hosting the database in a private subnet removes any internet route, which is what keeps the tier unreachable from outside the VPC.

Answer

Place the database instances in a private subnet and attach a network ACL that allows inbound traffic from the application subnet's CIDR range on port 3306.

Answer

Place the database instances in a private subnet and attach a security group that allows inbound traffic on port 3306 from 0.0.0.0/0, relying on the subnet's lack of an internet route for protection.

Answer

Place the database instances in a public subnet and attach a security group that allows inbound MySQL traffic only from the application tier's public IP addresses.

Question 9

A company runs an EC2 Auto Scaling group behind an internet-facing Application Load Balancer. The security team must ensure that the instances accept HTTP traffic only from the ALB and never directly from the internet, while the ALB itself must accept traffic only from a specific corporate CIDR range. Which combination of security group configurations should a solutions architect implement?

Accepted Answer

Create an inbound rule on the instance security group allowing TCP 80 from the ALB's security group, and an inbound rule on the ALB security group allowing TCP 80 from the corporate CIDR range.. The secure pattern is to make the instances trust only the load balancer by referencing the ALB's security group as the source, and to make the ALB trust only the intended clients by scoping its inbound rule to the corporate CIDR range. This creates a chained trust model where the instances never accept direct internet connections and the ALB is not exposed beyond the approved network range.

Answer

Create an inbound rule on the instance security group allowing TCP 80 from 0.0.0.0/0, and an inbound rule on the ALB security group allowing TCP 80 from the corporate CIDR range.

Answer

Create an inbound rule on the instance security group allowing TCP 80 from the corporate CIDR range, and an inbound rule on the ALB security group allowing TCP 80 from the ALB's security group.

Answer

Create an inbound rule on the instance security group allowing TCP 80 from the corporate CIDR range, and an inbound rule on the ALB security group allowing TCP 80 from 0.0.0.0/0.

Question 10

A healthcare company runs a patient portal on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in memory on each instance, and users are being logged out when the load balancer routes them to a different instance. The company wants to keep the application stateless and avoid modifying application code. Which solution best meets these requirements?

Accepted Answer

Store session data in an Amazon ElastiCache for Redis cluster and have the instances read and write sessions there.. To keep an application stateless, session data must live outside the compute instances. ElastiCache for Redis provides a shared, low-latency session store that any instance can access, so users remain logged in regardless of which instance handles the request. Sticky sessions, warm pools, and cross-zone load balancing either mask the problem or address unrelated concerns without removing instance-local state.

Answer

Configure the Auto Scaling group to use a warm pool so that new instances inherit the session state from existing instances.

Answer

Enable sticky sessions on the Application Load Balancer using duration-based cookie stickiness.

Answer

Enable cross-zone load balancing on the Application Load Balancer to ensure sessions are distributed evenly.

Question 11

A company runs a batch processing job on Amazon EC2 instances that runs for 4 hours every night. The job can be interrupted and restarted from a checkpoint. The company wants to minimize compute costs for this job. Which solution is MOST cost-effective?

Accepted Answer

Run the job on Spot Instances.. Spot Instances are the most cost-effective choice for interruptible, checkpointed batch workloads because they leverage spare EC2 capacity at a steep discount. The job runs for a short, predictable duration nightly and can resume after interruptions, which perfectly matches Spot's interruption model. Reserved Instances and Dedicated Hosts involve commitments or high fixed costs that are wasteful for intermittent usage, and On-Demand is more expensive than Spot.

Answer

Run the job on On-Demand Instances.

Answer

Use Dedicated Hosts for the instances.

Answer

Purchase a 1-year All Upfront Reserved Instance for the instances.

Question 12

A healthcare company stores patient records in an Amazon S3 bucket. Compliance requires that every object be encrypted with a key that the company rotates on its own schedule, that key usage be logged separately from S3 data events, and that a specific group of IAM principals be the only identities allowed to use the key for cryptographic operations. The security team has already created a symmetric AWS KMS customer managed key. Which combination of actions should the team take to meet these requirements?

Accepted Answer

Configure the bucket to use SSE-KMS with the customer managed key, and edit the key policy so only the designated principals have kms:Decrypt, kms:GenerateDataKey, and related permissions.. A customer managed key in AWS KMS is the only option that gives the organization control over rotation, produces dedicated CloudTrail logging of key usage, and enforces who may perform cryptographic operations through the key policy. Pairing it with SSE-KMS on the bucket applies that governance to every object written to the bucket without application changes.

Answer

Enable SSE-C on the bucket and distribute the raw encryption key to the application team so they pass it in the x-amz-server-side-encryption-customer-key header with each request.

Answer

Enable S3 default encryption with SSE-S3 (AES-256) on the bucket, and rely on the AWS managed key aws/s3 for rotation and audit logging.

Answer

Use client-side encryption with the AWS Encryption SDK, store the data key in AWS Secrets Manager, and let any principal in the account retrieve it when needed.

Question 13

A company runs a web application on AWS and wants to reduce costs. The application uses an Application Load Balancer (ALB) to distribute traffic to Amazon EC2 instances in an Auto Scaling group. The company observes that the EC2 instances are underutilized during off-peak hours. They want to optimize costs without affecting performance during peak hours. Which two actions should they take? (Choose two.)

Accepted Answer

Configure the Auto Scaling group to use a mixed instances policy with a percentage of On-Demand and Spot Instances.. Scheduled scaling reduces capacity during predictable off-peak periods, directly cutting EC2 costs. A mixed instances policy with On-Demand and Spot balances cost savings with reliability, ensuring performance during peaks. Together, these actions optimize costs without impacting performance. Other options either do not directly save costs, introduce risk, or are not feasible.

Answer

Enable Application Load Balancer access logs and analyze them to identify cost-saving opportunities.

Answer

Use Spot Instances for all EC2 instances in the Auto Scaling group.

Answer

Reduce the size of the ALB to a smaller load balancer type.

Question 14

A company runs a containerized web application on Amazon ECS with a steady baseline of 10 tasks that must run continuously. During business hours, traffic spikes require up to 30 additional tasks that can be terminated at any time. The company wants to minimize costs while ensuring the baseline tasks are always available. Which combination of purchasing options should be used for the ECS tasks?

Accepted Answer

Use Reserved Instances or Savings Plans for the baseline and Spot Instances for the additional tasks.. The baseline of 10 tasks runs continuously, so Reserved Instances or Savings Plans offer the best discount for that predictable usage. The additional tasks are variable and can be interrupted, making Spot Instances ideal for cost savings. Combining these two purchasing options aligns cost with the characteristics of each workload component, ensuring availability for the baseline while minimizing spend on the spikes.

Answer

Use Dedicated Hosts for the baseline and On-Demand Instances for the additional tasks.

Answer

Use On-Demand Instances for the baseline and Spot Instances for the additional tasks.

Answer

Use Spot Instances for all tasks, including the baseline, to maximize savings.

Question 15

A data engineering team runs an Amazon EMR cluster that processes large datasets stored in Amazon S3. The cluster uses Amazon EBS volumes for temporary storage, and jobs frequently spill intermediate data to disk. The team notices that shuffle operations are slow and wants to improve performance without changing the data format or increasing the number of core nodes. Which change should the team make?

Accepted Answer

Replace the EBS volumes with instance store volumes and configure EMR to use them for shuffle and temporary data.. Shuffle-heavy EMR workloads benefit from fast local storage, and instance store volumes provide higher IOPS and lower latency than EBS. Configuring EMR to use instance store for shuffle and temporary data reduces spill time and improves job performance without adding core nodes or altering data formats. Managed scaling, larger EBS volumes, and S3-backed shuffle either do not address the local disk bottleneck or introduce additional latency.

Answer

Increase the size of the existing EBS volumes and enable EBS optimization on the core nodes.

Answer

Move the intermediate data to an Amazon S3 bucket and configure EMR to use S3 for shuffle storage.

Answer

Enable EMR managed scaling to automatically add task nodes during shuffle-heavy stages.