SAA-C03 Practice Test 46 — 15 Questions

Question 1

A containerized service needs to read exactly one secret value from AWS Secrets Manager. The secret’s ARN is already known, and the secret is encrypted with the AWS-managed KMS key for Secrets Manager, so no separate KMS permissions are needed for this question. The service does not need to list secrets, create secrets, rotate them, or write updates. What is the most least-privilege IAM permission statement to grant the service role?

Accepted Answer

Allow secretsmanager:GetSecretValue on the specific secret ARN only.. Option A is correct because the service only needs to read a single secret value, and the least-privilege permission is to allow only the `secretsmanager:GetSecretValue` action on that specific secret's ARN. This grants exactly the required read access without any additional capabilities, adhering to the principle of least privilege. Since the secret is encrypted with the AWS-managed KMS key for Secrets Manager, no separate KMS permissions are needed, as the key policy automatically grants access to the Secrets Manager service.

Answer

Allow secretsmanager:* on all resources in the account.

Answer

Allow secretsmanager:ListSecrets so the service can discover the secret ARN at runtime.

Answer

Allow secretsmanager:PutSecretValue so the service can retrieve and update the secret value.

Question 2

A production internal reporting portal runs continuously on EC2 with predictable usage for the next three years. The team wants a discount while retaining some instance-family flexibility. What should they buy? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Compute Savings Plan. The Compute Savings Plan offers the largest discount (up to 66%) in exchange for a commitment to a consistent amount of compute usage (measured in $/hour) for a 1- or 3-year term, while retaining flexibility across instance families, regions, and compute services (EC2, Fargate, Lambda). This matches the requirement for a discount on predictable three-year usage with instance-family flexibility, and it is a managed AWS-native purchasing option.

Answer

Spot Instances only

Answer

Dedicated Instances

Answer

S3 Intelligent-Tiering

Question 3

A company stores customer invoices in an Amazon S3 bucket. The application must keep the bucket private, ACLs should not be used, and customers should receive temporary download links for individual invoices. Which three changes should the architect make? Select three.

Accepted Answer

Enable S3 Block Public Access on both the bucket and the AWS account.. Option A is correct because enabling S3 Block Public Access at both the bucket and account level ensures that no public access can be granted to the bucket or its objects, which aligns with the requirement to keep the bucket private. This setting overrides any other permissions that might inadvertently allow public access, providing a strong security baseline.

Answer

Continue using object ACLs so each customer invoice can be made public briefly.

Answer

Move the bucket to another AWS Region to isolate it from the internet.

Question 4

Based on the exhibit, the platform team wants developers to create application roles for Lambda and ECS, but no developer-created role may ever exceed the approved permission set. Which change best meets this requirement?

Accepted Answer

Attach a permissions boundary strategy to the delegated workflow and require every created role to include that boundary using the iam:PermissionsBoundary condition.. Option B is correct because it uses a permissions boundary to enforce the maximum permission set that any developer-created role can have. By attaching a permissions boundary to the delegated workflow and using the `iam:PermissionsBoundary` condition in the trust policy, every role created by developers is automatically constrained to the approved boundary, preventing any role from exceeding the approved permission set even if the developer tries to attach additional policies.

Answer

Remove all IAM permissions from AppProvisioner and require a central security team to create every role manually.

Answer

Allow developers to keep creating roles, but add a CloudTrail rule that alerts security after a privileged policy is attached.

Answer

Move the delegated IAM workflow into a separate VPC and restrict it with security groups and network ACLs.

Question 5

A customer analytics portal uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly?

Accepted Answer

Configure Origin Access Control for the S3 origin. Option B is correct because Origin Access Control (OAC) is a CloudFront feature that restricts access to an S3 origin so that only the CloudFront distribution can fetch objects. When OAC is configured, CloudFront signs requests using a trusted identity, and the S3 bucket policy can then deny any request that does not come from that identity, effectively blocking direct S3 access.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 6

Based on the exhibit, downstream payment timeouts cause EventBridge deliveries to back up and some events are retried until they age out. What change best improves resilience and preserves events during downstream outages?

Accepted Answer

Put an Amazon SQS queue between EventBridge and the consumer, and have workers drain the queue with a DLQ for poison messages.. Option B is correct because introducing an SQS queue between EventBridge and the consumer decouples the event delivery from the downstream payment API. During outages, events are stored durably in SQS and can be processed later without being lost. A Dead Letter Queue (DLQ) captures events that fail repeatedly, preventing poison messages from blocking the queue and ensuring no events age out due to retry exhaustion.

Answer

Increase the Lambda timeout so each invocation can wait longer for the payment API.

Answer

Switch the target to a Lambda function with reserved concurrency of zero during outages.

Answer

Replace EventBridge with CloudWatch Logs subscriptions so the consumer can poll the log stream later.

Question 7

Based on the exhibit, a web application must stay available if one Availability Zone fails. What is the best change to improve resilience?

Accepted Answer

Add a subnet in another Availability Zone to the Auto Scaling group and keep the ALB spanning both AZs.. Adding a subnet in another Availability Zone (AZ) to the Auto Scaling group and keeping the ALB spanning both AZs ensures that if one AZ fails, the ALB can route traffic to healthy instances in the other AZ. This is the standard pattern for building multi-AZ resilient architectures with Auto Scaling and ALB, as it eliminates the single point of failure at the AZ level.

Answer

Increase the desired capacity to 8 instances in the same subnet.

Answer

Replace the Application Load Balancer with a Network Load Balancer.

Answer

Move the instances to a larger instance type with more CPU and memory.

Question 8

A company uses an Amazon Aurora DB cluster in a Multi-AZ configuration. During a planned failover of the writer instance, the database endpoints in the application are updated incorrectly. After failover, reads work but writes fail with connection errors and timeouts for several minutes. The team currently uses the instance endpoint for the writer. What should they change to improve write resilience during failovers?

Accepted Answer

Use the Aurora cluster writer endpoint for all write operations.. The Aurora cluster writer endpoint always points to the current primary (writer) instance, even after a failover. By using this endpoint instead of a static instance endpoint, the application automatically resolves to the new writer without manual updates, eliminating connection errors and timeouts during failover transitions.

Answer

Continue using the instance endpoint, but increase application retry count so the writer changes are handled more quickly.

Answer

Use a read replica endpoint for writes because it is typically stable across failovers.

Answer

Disable Multi-AZ failover so the writer instance never changes and writes remain consistent.

Question 9

A company operates 40 AWS accounts and wants chargeback by application, environment, and business unit. Finance needs detailed line items, and engineering wants consistent monthly reports without manual spreadsheet work. The current tagging scheme is inconsistent, and many resources are missing billing metadata. Which three actions should the architect recommend? Select three.

Accepted Answer

Standardize cost allocation tags such as Application, Environment, and BusinessUnit.. Option A is correct because standardizing cost allocation tags like Application, Environment, and BusinessUnit ensures consistent metadata across all 40 accounts. This is a prerequisite for accurate chargeback, as AWS Cost Allocation Tags allow you to group resources by these dimensions for detailed billing reports.

Answer

Use AWS Budgets alone because it provides the most detailed line-item attribution.

Answer

Rely only on the Cost Explorer console for chargeback accuracy.

Question 10

A company runs an Amazon RDS for PostgreSQL database. The application performs frequent OLTP writes, but it also has a separate dashboard that runs heavy SELECT queries and is slowing down overall database performance. The writes must remain on the primary. What is the best approach to improve performance for the dashboard?

Accepted Answer

Create an RDS read replica and route the dashboard’s read-only queries to the replica endpoint. Creating an RDS read replica allows you to offload the heavy SELECT queries from the primary database instance. The replica asynchronously replicates data from the primary using PostgreSQL's streaming replication, so the dashboard can query the replica without impacting the OLTP write performance on the primary. This directly addresses the requirement that writes remain on the primary while improving dashboard query performance.

Answer

Increase instance storage throughput limits and disable synchronous replication to speed up all queries

Answer

Replace RDS with Amazon S3 because dashboards require SQL result caching

Answer

Move the primary database to a different AWS Region to reduce network latency

Question 11

A production log archive runs continuously on EC2 with predictable usage for the next three years. The team wants a discount while retaining some instance-family flexibility. What should they buy?

Accepted Answer

Compute Savings Plan. The Compute Savings Plan (C) is correct because it offers a discount (up to 66%) in exchange for a commitment to a consistent amount of compute usage (measured in $/hour) for a 1- or 3-year term, while allowing flexibility to change instance families, sizes, OS, tenancy, and even regions within EC2, Fargate, and Lambda. This matches the requirement of predictable usage for three years with instance-family flexibility, unlike Reserved Instances which lock to a specific instance family.

Answer

S3 Intelligent-Tiering

Answer

Dedicated Instances

Answer

Spot Instances only

Question 12

A company runs its customer-facing web app on EC2 behind an Application Load Balancer. The database is Amazon RDS for PostgreSQL. The requirement is that if a single Availability Zone fails, the database must automatically fail over within the same AWS Region with minimal application changes. Which database setup best meets this requirement?

Accepted Answer

Deploy the RDS PostgreSQL instance as Multi-AZ with automatic failover enabled.. Option B is correct because RDS Multi-AZ for PostgreSQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, with no changes required to the application's connection string (the DNS name remains the same). This meets the requirement for minimal application changes and automatic failover within the same Region.

Answer

Use an RDS single-AZ instance and periodically restore from automated backups if needed.

Answer

Create a read replica in a different AZ and use it only when the primary fails.

Answer

Use RDS with Multi-AZ disabled, but increase storage IOPS to prevent failover.

Question 13

A company runs EC2 workloads in one region with somewhat steady overall demand. Over time, the team frequently changes instance families (for performance/optimization) and sometimes changes instance size, but wants predictable cost discounts. Which purchase option provides the best balance of cost savings and flexibility?

Accepted Answer

Savings Plans (Compute Savings Plans), scoped for flexible EC2 usage in the region.. Compute Savings Plans offer the best balance of cost savings and flexibility because they provide up to 66% discount in exchange for a commitment to a consistent amount of compute usage (measured per hour) in a region, but they automatically apply to any EC2 instance family, size, OS, or tenancy, as well as AWS Fargate and Lambda. This matches the team's need to frequently change instance families and sizes while still getting predictable discounts, unlike Standard RIs which lock you to a specific family and size.

Answer

Standard Reserved Instances for a specific instance family and size only.

Answer

Spot Instances for all workloads, assuming interruptions will never happen.

Answer

On-Demand only, because it avoids the complexity of purchase option scopes.

Question 14

A Lambda function needs to read the current value of exactly one AWS Secrets Manager secret at startup. Which least-privilege IAM permission (action and resource scope) should you grant to the Lambda execution role?

Accepted Answer

secretsmanager:GetSecretValue on only the secret’s full ARN. The Lambda function needs to read the current value of exactly one secret at startup. The least-privilege permission is `secretsmanager:GetSecretValue` scoped to that secret's full ARN. This action retrieves the secret value, and restricting the resource to the specific ARN ensures the function cannot access any other secrets.

Answer

secretsmanager:ListSecrets on all secrets (resource set to "*")

Answer

secretsmanager:UpdateSecret on the specific secret ARN

Answer

secretsmanager:DescribeSecret on all secrets (resource set to "*")

Question 15

A cross-account IAM role in Account B reads encrypted S3 objects from Account A. The objects use SSE-KMS with a customer-managed KMS key in Account A. Account B can successfully call s3:GetObject, but decryption fails with an AccessDeniedException from KMS. What change most directly fixes the issue?

Accepted Answer

Update the customer-managed KMS key policy in Account A to allow kms:Decrypt for the specific Account B role principal.. SSE-KMS with a customer-managed KMS key requires explicit permission to use the key for decryption. The S3 GetObject call succeeds because the bucket policy allows it, but KMS decryption fails because the KMS key policy in Account A does not grant kms:Decrypt to the IAM role principal in Account B. Updating the KMS key policy to allow the Account B role principal to call kms:Decrypt directly resolves the AccessDeniedException.

Answer

Add kms:Decrypt only to the Account B role’s IAM policy, without changing the customer-managed KMS key policy in Account A.

Answer

Update the Account A S3 bucket policy to grant kms:Decrypt to Account B.

Answer

Enable KMS key rotation, which automatically allows cross-account decrypt permissions.