SAA-C03 Practice Test 47 — 15 Questions

Question 1

Based on the exhibit, a public API is behind CloudFront and is experiencing bursts of requests from the same client IP, causing upstream saturation. The team wants AWS to automatically block that IP when the request rate becomes excessive while keeping enforcement as close to the client as possible. Which control should they add?

Accepted Answer

Add an AWS WAF rate-based rule to the CloudFront distribution and configure it to block the source IP after the threshold is exceeded.. AWS WAF rate-based rules are designed to automatically block IP addresses that exceed a specified request rate within a 5-minute evaluation window. By attaching this rule to a CloudFront distribution, enforcement occurs at the edge location closest to the client, preventing excessive requests from reaching the upstream API and mitigating saturation.

Answer

Add a network ACL rule that denies the source IP after five requests are observed.

Answer

Enable AWS Shield Advanced and create a custom protection group for the single IP address.

Answer

Place the API behind a security group rule that allows only the current client IP range.

Question 2

An S3 bucket uses a customer-managed KMS key as the default for SSE-KMS encryption. A service role will upload objects using s3:PutObject. Assuming the role already has permission to write to the bucket, which KMS permission is most directly required for the role to let S3 encrypt the object during upload?

Accepted Answer

kms:GenerateDataKey (and optionally kms:DescribeKey). When S3 uses SSE-KMS with a customer-managed KMS key, the service calls KMS to generate a data key for encrypting the object. The s3:PutObject operation requires the caller to have kms:GenerateDataKey permission on the KMS key so that S3 can obtain the plaintext and encrypted versions of the data key. Optionally, kms:DescribeKey may be needed for S3 to verify the key exists, but kms:GenerateDataKey is the most directly required permission.

Answer

kms:Decrypt only

Answer

kms:CreateAlias and kms:UpdateAlias only

Answer

kms:ScheduleKeyDeletion and kms:CancelKeyDeletion only

Question 3

A content publishing system exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most? The design must avoid adding custom operational scripts.

Accepted Answer

CloudFront caching with appropriate TTLs. CloudFront caches responses from the S3 origin based on configured TTLs (Cache-Control or Expires headers). If the S3 origin experiences a short outage, CloudFront can still serve cached content to users as long as the TTL has not expired, ensuring availability without custom scripts. This is the most direct and resilient feature for this use case.

Answer

IAM Access Analyzer

Answer

AWS Backup Vault Lock

Answer

S3 Select

Question 4

Based on the exhibit, the application should continue serving requests if one Availability Zone fails. Which change best improves resilience with the least operational complexity?

Accepted Answer

Add at least one subnet from a second Availability Zone to both the ALB and the Auto Scaling group.. Option B is correct because adding subnets from a second Availability Zone to both the ALB and the Auto Scaling group distributes the application across multiple AZs. This ensures that if one AZ fails, the ALB can route traffic to healthy targets in the remaining AZ, and the Auto Scaling group can maintain capacity by launching instances in the surviving AZ. This approach directly addresses the requirement to continue serving requests during an AZ failure with minimal operational complexity.

Answer

Increase the desired capacity in AZ-a so more instances can absorb the failure of that same Availability Zone.

Answer

Disable health checks so the ALB stops removing targets during brief infrastructure issues.

Answer

Move the application to a single larger instance type so the fleet has fewer moving parts.

Question 5

Based on the exhibit, the company has one shared S3 bucket for many internal teams. Security wants each team to access only its own prefix, ACLs must remain disabled, and the current bucket policy has become too large and error-prone. What is the best redesign?

Accepted Answer

Create one S3 access point per team and attach an access point policy that limits that team to its own prefix.. Option C is correct because S3 Access Points allow you to create separate access points for each team, each with its own policy that restricts access to a specific prefix (e.g., s3://shared-bucket/team-a/). This eliminates the need for a large, error-prone bucket policy while keeping ACLs disabled, meeting the security requirement for per-team prefix isolation without modifying the underlying bucket configuration.

Answer

Re-enable object ACLs and manage access by setting object-level ACLs for each team's prefix.

Answer

Split the bucket into one bucket per team and keep using a single shared bucket policy for all of them.

Answer

Make the bucket public and issue presigned URLs for team access so IAM policies are no longer needed.

Question 6

A company runs an Amazon Aurora DB cluster with a Multi-AZ deployment. The application is configured with a hard-coded endpoint that points to the current writer *DB instance* (an instance-specific endpoint), rather than the Aurora cluster writer endpoint. During an unexpected AZ failure, Aurora promotes the standby to become the new writer. However, the application continues to fail to connect until an operator updates the hard-coded endpoint. What change most directly improves resiliency so the application automatically reconnects after failover?

Accepted Answer

Connect using the Aurora cluster writer endpoint so DNS resolves to the current writer after failover.. Option B is correct because the Aurora cluster writer endpoint is a DNS name that always resolves to the current writer instance in the cluster, even after a failover. By using this endpoint instead of a hard-coded instance-specific endpoint, the application automatically reconnects to the new writer without manual intervention, directly improving resiliency.

Answer

Keep using the writer DB instance endpoint, but increase the client connection timeout.

Answer

Disable Multi-AZ failover and rely on manual snapshot restore to bring the database back online.

Answer

Enable cross-Region read replicas and route application traffic to the replica during the outage.

Question 7

A company stores user uploads in an S3 bucket. Objects are accessed rarely after upload, but when an object is accessed, it must be retrievable quickly (minutes to a few hours). Objects must be retained for at least 18 months. The team wants to reduce storage cost while meeting these requirements. Which lifecycle configuration best fits these requirements?

Accepted Answer

After 30 days, transition objects to S3 Glacier Instant Retrieval, and after 18 months, expire (delete) the objects.. Option B is correct because it transitions objects to S3 Glacier Instant Retrieval after 30 days, which provides millisecond retrieval for rarely accessed data, meeting the quick retrieval requirement. The 18-month expiration ensures compliance with the retention policy while minimizing storage costs compared to keeping data in S3 Standard.

Answer

Keep all objects in S3 Standard permanently to avoid lifecycle transition fees.

Answer

After 30 days, transition objects to S3 Intelligent-Tiering, and set expiration to 12 months.

Answer

After 30 days, transition objects to S3 Glacier Deep Archive, and set expiration to 18 months.

Question 8

Based on the exhibit, a retail analytics service repeatedly reads the same DynamoDB items during an active campaign. The business can tolerate data that is a few seconds stale, but the application must minimize latency and reduce pressure on DynamoDB. A load test shows that 80% of reads target only 200 item keys. What should the solutions architect implement?

Accepted Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table and point the application to the DAX endpoint.. DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache designed specifically for DynamoDB. It reduces read latency from single-digit milliseconds to microseconds and offloads repeated reads from the table, which directly addresses the requirement to minimize latency and reduce pressure on DynamoDB. Since the business can tolerate stale data (DAX default TTL is 5 minutes, but can be configured lower), DAX is ideal for the 80% of reads hitting only 200 hot keys.

Answer

Switch the table to provisioned capacity with auto scaling so DynamoDB can handle the repeated reads more efficiently.

Answer

Create a global table in a second Region and read from the replica Region to lower latency.

Answer

Move the hot items into Amazon ElastiCache for Redis and keep the remaining data in DynamoDB.

Question 9

A healthcare document service must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control?

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. Option A is correct because an SCP (Service Control Policy) is a preventive control that can deny the ec2:CreateVolume action when the encryption condition (ec2:Encrypted) is false. This ensures that no unencrypted EBS volumes can be created in the account, providing a strong, proactive guardrail that cannot be overridden by IAM policies within the account.

Answer

Tag encrypted volumes after creation

Answer

Enable VPC Flow Logs

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Question 10

Based on the exhibit, the team wants to improve application performance without changing the code. Which EC2 instance family should they choose next?

Accepted Answer

Choose a memory-optimized instance family such as R6i to provide more RAM.. The exhibit shows a memory-constrained application (e.g., high cache miss rates or swap usage) where performance is bottlenecked by insufficient RAM. Choosing a memory-optimized instance family like R6i provides more RAM per vCPU, allowing the application to keep more data in memory and reduce disk I/O, directly improving performance without code changes.

Answer

Choose a compute-optimized instance family such as C6i to increase CPU performance.

Answer

Choose a storage-optimized instance family such as I4i to improve block storage throughput.

Answer

Choose a burstable instance family such as T3 to reduce cost and improve performance.

Question 11

A company stores private report PDFs in an S3 bucket. They want users to access PDFs only through CloudFront. Even if someone knows the S3 object URL, direct S3 access must fail. What is the best S3 bucket policy approach?

Accepted Answer

Keep the bucket private and allow s3:GetObject only to the CloudFront origin access identity (OAI) or origin access control (OAC) principal (optionally restricting with aws:SourceArn for the specific distribution).. Option A is correct because it uses an Origin Access Identity (OAI) or Origin Access Control (OAC) to grant CloudFront exclusive read access to the S3 bucket. By setting a bucket policy that allows s3:GetObject only to the CloudFront OAI/OAC principal (and optionally restricting with aws:SourceArn for the specific distribution), direct S3 object URL requests are denied, ensuring users can only access PDFs through CloudFront.

Answer

Allow s3:GetObject to "Principal": "*" but rely on CloudFront signed URLs to prevent access.

Answer

Allow s3:GetObject to the CloudFront distribution using a Condition on aws:SourceIp without restricting the Principal.

Answer

Only enable default encryption (SSE-KMS) and leave bucket permissions unchanged.

Question 12

A development team stores application logs in Amazon CloudWatch Logs and has enabled detailed EC2 monitoring on every instance. Auditors require the logs to be retained for 90 days, but the operations team only needs the last 7 days to remain searchable in CloudWatch. Which two actions should they take to reduce monitoring cost? Select two.

Accepted Answer

Set the CloudWatch Logs retention period to 7 days and export or archive older logs in Amazon S3 or S3 Glacier for the remaining retention period.. Option A is correct because CloudWatch Logs charges for data storage and search capabilities. By setting the retention period to 7 days, logs older than 7 days are automatically deleted from CloudWatch, eliminating ongoing storage and search costs. Exporting or archiving these logs to Amazon S3 or S3 Glacier satisfies the 90-day audit requirement at a much lower cost, as S3 and Glacier have minimal storage fees and no search costs.

Answer

Set the CloudWatch Logs retention period to 90 days so everything stays searchable in CloudWatch.

Answer

Send logs to DynamoDB because it is cheaper for long-term retention.

Answer

Enable detailed monitoring only during peak business hours on every instance.

Question 13

A data engineering team runs a nightly ETL job on EC2. The job can be checkpointed every 5 minutes and can be retried from the last checkpoint if the instance terminates. The job runtime varies from 2 to 4 hours, and the team has no need for a specific instance type, as long as it completes before 7:00 AM local time. They currently run the job on On-Demand EC2, leading to high monthly compute cost.

Which change best reduces cost while maintaining the business deadline?

Accepted Answer

Use Spot Instances for the ETL workload, and configure the job to checkpoint frequently and restart on interruption.. Spot Instances offer significant cost savings (up to 90%) compared to On-Demand, and the ETL job's ability to checkpoint every 5 minutes and restart from the last checkpoint makes it resilient to Spot interruptions. This allows the team to meet the 7:00 AM deadline while drastically reducing compute costs, as the job can be retried on new Spot capacity if interrupted.

Answer

Use Reserved Instances with a 1-year term to lower costs, since reservations provide discounts for any usage.

Answer

Switch to On-Demand but enable Auto Scaling so the job finishes faster during peak hours.

Answer

Use Spot Instances but disable checkpointing to simplify the application.

Question 14

A company runs an application in private subnets (no inbound internet). The application must access Amazon S3 and AWS Secrets Manager endpoints without routing through the public internet and without exposing the instances to NAT gateways due to cost. Security requirements also state that only the required VPC traffic should be allowed to reach AWS services.

Which architecture best satisfies these requirements?

Accepted Answer

Add a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager; keep instances in private subnets and configure security group rules attached to the endpoints to allow inbound traffic only from the application subnets.. Option B is correct because it uses a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager, both of which allow private subnet instances to access these AWS services without traversing the public internet or requiring a NAT gateway. The security group rules attached to the interface endpoint restrict inbound traffic to only the application subnets, satisfying the security requirement of allowing only required VPC traffic. This architecture avoids NAT gateway costs and keeps instances isolated from inbound internet traffic.

Answer

Place instances in private subnets but use NAT gateways so traffic to S3 and Secrets Manager goes through the internet; restrict security groups to instance-to-instance only.

Answer

Use public subnets with instances that have no security group rules; rely on AWS services to reject unauthorized traffic.

Answer

Create an S3 bucket policy that allows requests from the application instances’ private IP addresses and enable public access to Secrets Manager via the default service endpoint.

Question 15

A company runs an application behind an Application Load Balancer (ALB). An Auto Scaling group (ASG) is configured with desired capacity 2, but it is attached only to subnets in a single Availability Zone. The ALB is healthy because it is configured across multiple Availability Zones.

When the Availability Zone that contains the ASG subnets experiences an outage, what change most directly improves resilience and allows capacity to be restored automatically?

Accepted Answer

Update the ASG to use subnet IDs that span at least two Availability Zones so it can launch replacement instances after an AZ outage.. Option A is correct because an Auto Scaling group (ASG) can only launch instances into the subnets explicitly assigned to it. If those subnets reside in a single Availability Zone (AZ) and that AZ fails, the ASG has no capacity to launch replacement instances, even though the ALB is multi-AZ. By configuring the ASG with subnet IDs spanning at least two AZs, the ASG can automatically launch instances in a healthy AZ, restoring capacity and resilience.

Answer

Reduce the ALB health check interval to speed up detection of unhealthy targets.

Answer

Enable connection draining on the ALB so existing requests complete before targets are terminated.

Answer

Increase the ASG desired capacity from 2 to 6 to compensate for the missing subnets.

SAA-C03 Practice Test 47 — 15 Questions

Exhibit

SAA-C03 Practice Test 47 — 15 Questions

Exhibit