SAA-C03 Practice Test 48 — 15 Questions

Question 1

A team is designing a new workload that runs on Amazon EC2 instances in a private subnet. The instances must read and write objects in an Amazon S3 bucket in the same account, and security policy forbids long-term access keys on the instances. The team wants to grant least-privilege access and ensure the instances can reach S3 without traversing the public internet. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an IAM role to the instances using an instance profile, and grant the role only the required s3:GetObject and s3:PutObject permissions on the specific bucket.. An IAM role attached through an instance profile supplies temporary credentials without long-term keys, and an S3 gateway endpoint keeps bucket traffic on the AWS network. Together they satisfy the credential, least-privilege, and private-connectivity requirements. Static keys in Parameter Store and NAT-based egress each violate one of the stated constraints.

Answer

Create a NAT gateway in the public subnet and route the private subnet's default route to it so the instances can reach the S3 public endpoint.

Answer

Store an IAM user access key and secret access key in AWS Systems Manager Parameter Store as a SecureString, and have the application retrieve them at startup.

Answer

Configure an S3 bucket policy that allows the s3:GetObject and s3:PutObject actions for the account root user, and let the instances inherit those permissions.

Question 2

A healthcare data platform stores patient documents in an Amazon S3 bucket in us-east-1. Regulations require that the data remain readable with low latency even if the entire us-east-1 Region becomes unavailable, and that writes continue in a secondary Region. The team wants object-level replication with minimal operational overhead and must preserve version history. Which solution BEST meets these requirements?

Accepted Answer

Enable S3 Cross-Region Replication (CRR) with versioning enabled on both buckets, and configure the application to read from the replica bucket during a regional failure.. Cross-Region Replication copies objects to a bucket in another Region and requires versioning on both buckets, which preserves version history. The replica bucket remains accessible if the primary Region fails, and writes can be directed there, meeting both the availability and data-durability goals with minimal operational effort.

Answer

Use S3 Transfer Acceleration on the existing bucket and rely on edge locations to serve reads during the outage.

Answer

Enable S3 Same-Region Replication to a second bucket in us-east-1 and serve reads from that bucket during a regional failure.

Answer

Configure an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive in a second Region.

Question 3

A healthcare company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application must be accessible only to users connecting from a specific corporate IP range, and all traffic must be encrypted in transit. The security team wants to enforce these requirements at the load balancer level without modifying the application. Which combination of steps should a solutions architect take?

Accepted Answer

Configure an HTTPS listener on the ALB with an AWS Certificate Manager certificate, and attach a security group that allows inbound HTTPS only from the corporate IP range.. To encrypt traffic in transit and restrict access to a corporate IP range at the ALB, use an HTTPS listener with an ACM certificate and a security group that allows inbound 443 only from the corporate CIDR. The ALB security group provides stateful, resource-level filtering. This meets both requirements without application changes and is the standard secure architecture for internet-facing ALBs.

Answer

Configure an HTTPS listener on the ALB and use a network ACL on the public subnets to allow only the corporate IP range on port 443.

Answer

Configure an HTTPS listener on the ALB and enable AWS Shield Advanced to allow only the corporate IP range.

Answer

Configure an HTTP listener on the ALB and use AWS WAF to block requests from IPs outside the corporate range.

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16. The company wants to allow its EC2 instances in a private subnet to access Amazon S3 without traversing the public internet. The company also wants to minimize data transfer costs. Which solution should a solutions architect recommend?

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and update the route tables for the private subnets to use the endpoint.. A gateway VPC endpoint for Amazon S3 is the correct choice because it provides private connectivity from the VPC to S3 without using the public internet and is free of charge. Updating the route tables ensures that traffic to S3 is directed through the endpoint, meeting both the private access and cost minimization requirements.

Answer

Configure an AWS Site-to-Site VPN connection to an on-premises data center that has a direct connection to Amazon S3.

Answer

Create an interface VPC endpoint for Amazon S3 in the VPC and update the route tables to use the endpoint.

Answer

Attach an internet gateway to the VPC and configure a NAT gateway in a public subnet to allow outbound traffic to Amazon S3.

Question 5

A startup runs a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The application must call AWS APIs such as Amazon DynamoDB and Amazon S3. A security engineer must ensure that no long-term AWS credentials are stored on the instances and that each instance receives credentials automatically. Which solution should the engineer use?

Accepted Answer

Attach an IAM role for Amazon EC2 to an instance profile and associate it with each instance so the SDK retrieves temporary credentials from the instance metadata service.. Associating an IAM role with the instances through an instance profile lets the AWS SDK obtain temporary, automatically rotated credentials from the instance metadata service. This removes the need to store access keys on the instances, limits permissions to what the role allows, and satisfies the requirement that each instance receives credentials without manual handling.

Answer

Store an IAM user access key and secret key in AWS Systems Manager Parameter Store as a SecureString and retrieve them at instance boot.

Answer

Configure the instances to call AWS Security Token Service AssumeRole with a shared secret stored in an encrypted Amazon EBS volume.

Answer

Create an IAM user per instance, generate access keys, and rotate them every 90 days using a scheduled AWS Lambda function.

Question 6

An Auto Scaling group for a background worker runs EC2 instances continuously. Over the last 30 days, CloudWatch shows sustained CPU utilization around 6% with no memory pressure, and queue processing latency meets all SLAs. The team wants to lower monthly cost with minimal risk. What is the best next action?

Accepted Answer

Perform right sizing by downsizing to a smaller instance family/size and validate SLAs. The current instance type is over-provisioned, as sustained CPU utilization is only 6% with no memory pressure and all SLAs are met. Right-sizing to a smaller instance family or size directly reduces compute cost while maintaining performance, making it the lowest-risk, cost-optimization action. This aligns with the AWS Well-Architected Framework's cost optimization pillar, which recommends matching instance capacity to actual workload requirements.

Answer

Increase the instance size to reduce CPU throttling risk

Answer

Switch the group to Spot Instances to reduce cost without changing instance sizing

Answer

Buy Reserved Instances with a long term commitment before making any sizing changes

Question 7

Multiple teams share one AWS Organization. Finance wants chargeback by project, alerts before overspend, and monthly views by account without manually opening each account. Which three actions best fit? Select three.

Accepted Answer

Enforce cost allocation tags on resources and activate them for billing reports.. Option A is correct because enforcing and activating cost allocation tags (e.g., project tags) is the prerequisite for attributing AWS charges to projects in billing data, enabling accurate chargeback. Option B is correct because AWS Budgets supports cost budgets scoped by tag, account, or service, and can trigger SNS alerts and budget actions (such as applying SCPs or stopping instances) before overspend occurs. Option C is correct because Cost Explorer and Cost and Usage Reports (CUR) provide the consolidated, multi-account analysis by account, tag, and service that Finance needs without manually opening each account, especially when integrated with AWS Organizations. Option D is not appropriate because merely isolating teams into separate accounts without tagging does not provide project-level chargeback or the required tag-based views. Option E is incorrect because CloudTrail records API activity for auditing, not resource costs, and cannot estimate spend by resource.

Answer

Put every team in a separate AWS account and ignore tagging.

Answer

Use CloudTrail trails to estimate spend by resource because it records API calls.

Question 8

Your EC2 instances run in private subnets with no NAT gateway. The instances use the AWS SDK to call STS AssumeRole to obtain temporary credentials for other services. Application logs show errors like: "EndpointConnectionError: Could not connect to https://sts.<region>.amazonaws.com".

Which change most directly resolves this while keeping instances private?

Accepted Answer

Create an interface VPC endpoint for STS (com.amazonaws..sts) and associate it with the instance subnets and a security group that allows HTTPS.. The error indicates that the EC2 instances in private subnets cannot reach the STS public endpoint over the internet because there is no NAT gateway or internet gateway attached to the private subnets. Creating an interface VPC endpoint for STS (com.amazonaws..sts) allows the instances to communicate with the STS API privately using AWS PrivateLink, without requiring internet access. Associating the endpoint with the instance subnets and a security group that allows HTTPS (port 443) ensures that traffic stays within the AWS network, resolving the connectivity error while keeping the instances private.

Answer

Create a gateway VPC endpoint for S3 and route the STS traffic through the S3 endpoint gateway.

Answer

Open an inbound rule in the instances’ security group to allow outbound HTTPS to the internet CIDR block directly.

Answer

Attach an Internet Gateway to the private subnet route table so the STS API can be reached over public internet.

Question 9

Based on the exhibit, which Route 53 configuration should be used so traffic automatically returns to the secondary Region only when the primary Region becomes unhealthy?

Accepted Answer

Use failover routing with a primary alias record, a secondary alias record, and a Route 53 health check on the primary target.. Failover routing in Amazon Route 53 is designed for active-passive configurations. By creating a primary alias record pointing to the ALB in the primary Region and a secondary alias record pointing to the ALB in the secondary Region, and attaching a Route 53 health check to the primary target, traffic automatically fails over to the secondary Region only when the health check detects the primary as unhealthy. This meets the requirement of returning traffic to the secondary Region only upon primary failure.

Answer

Use latency-based routing with both ALB records enabled.

Answer

Use geolocation routing so users are always sent to the closest Region.

Answer

Use a CNAME record that points to both ALBs so DNS can round-robin between Regions.

Question 10

A patient portal must process every event at least once, but duplicate processing is acceptable if the consumer handles idempotency. Which eventing approach is most suitable? The team wants the control to be enforceable during normal operations.

Accepted Answer

Use Amazon SQS standard queue and design consumers to be idempotent. Amazon SQS standard queues provide at-least-once delivery, ensuring every event is processed at least once, which matches the requirement. Duplicate processing is acceptable because the team can design consumers to be idempotent, handling duplicates without side effects. SQS is a fully managed, scalable, and durable service that enforces this behavior during normal operations without requiring custom infrastructure.

Answer

Use an in-memory queue on one EC2 instance

Answer

Use UDP messages sent directly to workers

Answer

Use CloudFront signed URLs

Question 11

A global video platform serves mostly static images and JavaScript files from an S3 origin. Users in distant countries report slow load times. What should improve performance most? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Amazon CloudFront distribution with the S3 bucket as origin. Amazon CloudFront is a global content delivery network (CDN) that caches static content (images, JavaScript) at edge locations closer to users, drastically reducing latency for distant countries. By using the S3 bucket as the origin, CloudFront offloads requests from S3 and accelerates delivery via HTTP/2, TCP optimizations, and persistent connections. This is the most effective managed AWS-native solution for improving global load times for static assets.

Answer

A larger S3 bucket

Answer

RDS read replicas

Answer

An EC2 Auto Scaling group in one Region

Question 12

A web application runs in private subnets with no NAT gateway. It needs to retrieve credentials from AWS Secrets Manager at runtime. After a recent network hardening change, the application logs timeout errors when calling Secrets Manager.

Which change will most directly enable private connectivity to Secrets Manager while keeping the subnets NAT-free?

Accepted Answer

Create an interface VPC endpoint (AWS PrivateLink) for the Secrets Manager service and update the security group rules to allow HTTPS from the application subnets.. An interface VPC endpoint (AWS PrivateLink) for Secrets Manager creates a private, direct connection to the service within the VPC, using Elastic Network Interfaces (ENIs) in the subnets. This allows the application to reach Secrets Manager over HTTPS without traversing the internet, a NAT gateway, or an internet gateway, directly resolving the timeout errors caused by the network hardening change that removed public internet access.

Answer

Add a public DNS entry in the instance /etc/hosts pointing Secrets Manager to the instance’s private IP so requests do not leave the VPC.

Answer

Attach an internet gateway to the private route table so that Secrets Manager traffic can reach public endpoints without NAT.

Answer

Enable S3 VPC endpoint and store the secrets in an S3 bucket instead of Secrets Manager, then retrieve them using S3 gateway endpoints.

Question 13

A site serves static assets (JS/CSS) through CloudFront from an S3 origin. After a recent frontend change, CloudFront shows a cache hit ratio below 20%. In CloudFront access logs, requests to the same asset URL path differ by a query parameter named rnd (a random value appended by the app on every request). The origin content is identical regardless of rnd. What is the best CloudFront configuration change to restore effective caching?

Accepted Answer

Create a custom CloudFront Cache Policy that does not include the rnd query parameter in the cache key (whitelist only required parameters, or forward no query strings).. The rnd query parameter makes each request appear unique to CloudFront, causing a cache miss for every request even though the underlying content is identical. By creating a custom cache policy that either forwards no query strings or whitelists only required parameters, CloudFront will ignore the rnd parameter when computing the cache key, allowing it to serve cached responses and dramatically improve the cache hit ratio.

Answer

Increase the origin response Cache-Control max-age header on S3 so CloudFront caches longer even with different rnd values.

Answer

Disable compression on CloudFront so the response body is identical byte-for-byte and cache hits improve.

Answer

Switch the origin from S3 to an ALB so CloudFront can cache based on ALB target health checks instead of the query string.

Question 14

You deploy a Web ACL with an AWS WAF rate-based rule intended to limit abusive traffic to your API. After the deployment, attackers still reach the backend service. ALB access logs show requests arrive at the ALB, but WAF logs indicate the Web ACL is not evaluating those requests.

Which change most likely fixes the issue?

Accepted Answer

Associate the Web ACL with the Application Load Balancer resource ARN so WAF evaluates requests sent to that ALB.. A Web ACL must be explicitly associated with a resource (such as an ALB) for AWS WAF to evaluate incoming requests. In this scenario, the Web ACL was deployed but not associated with the ALB resource ARN, so WAF never inspected the traffic. Associating the Web ACL with the ALB ensures that all requests to the ALB are evaluated by the rate-based rule before reaching the backend.

Answer

Add a security group rule that drops inbound traffic from the attacker IP range at the instances' ENIs.

Answer

Create a target group stickiness policy so WAF can count requests consistently per client IP.

Answer

Enable AWS Shield Advanced but keep the Web ACL unattached because Shield automatically applies rate limiting.

Question 15

A company is running a production web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The workload has predictable traffic spikes during business hours and low traffic at night. The current architecture uses On-Demand EC2 instances, leading to high costs. The company wants to reduce costs without sacrificing availability or performance. Which three of the following strategies would help achieve this goal? (Choose three.)

Accepted Answer

Use Auto Scaling with a mixed instances policy that includes On-Demand and Spot Instances.. Purchasing Reserved Instances for the baseline 24/7 capacity provides a significant discount (up to 72%) compared to On-Demand pricing, directly reducing costs for the always-running portion of the workload. This strategy is correct because it matches the predictable, steady-state traffic component without sacrificing availability or performance.

Answer

Add Spot Instances for the entire workload during peak hours.

Answer

Migrate to AWS Lambda for all web application traffic.

Answer

Consolidate all instances into a single larger instance to reduce overhead.