SAA-C03 Practice Test 48 — 15 Questions

Question 1

Based on the exhibit, a serverless API on AWS Lambda experiences a predictable cold-start penalty every weekday at 09:00 UTC when a marketing campaign begins. The team wants the first requests to stay fast while minimizing extra cost during quiet periods. What is the best approach?

Accepted Answer

Enable provisioned concurrency on the published version and schedule it to scale up shortly before the spike.. Provisioned concurrency pre-warms a specified number of Lambda execution environments so that incoming requests do not incur a cold start. By scheduling the provisioned concurrency to scale up just before the 09:00 UTC spike and scale down afterward, the team eliminates the cold-start penalty during the campaign while minimizing cost during quiet periods. This directly addresses the predictable, time-bound traffic pattern without requiring code changes or over-provisioning.

Answer

Increase the Lambda timeout so cold starts have more time to complete.

Answer

Move the function behind an Application Load Balancer to improve warm-up behavior.

Answer

Increase the function memory to the maximum value and leave concurrency unchanged.

Question 2

A DynamoDB-backed event processing system experiences throttling during a promotion. All events are written and read using the same partition key value (tenantId = "ACME"). The workload is time-ordered per tenant, and the application can tolerate slight reordering across partitions. Which design change will most directly increase throughput and reduce hot-partition throttling?

Accepted Answer

Change the partition key to include an additional sharding attribute derived from a hash of eventId.. Option B is correct because adding a sharding attribute derived from a hash of eventId allows writes and reads to be distributed across multiple partition keys, breaking the single hot partition caused by using tenantId='ACME' for all operations. DynamoDB's throughput is limited per partition, so distributing the load across many partitions directly reduces throttling without changing the application's tolerance for slight reordering.

Answer

Increase the table's provisioned capacity (read/write units) to handle the promotion peak.

Answer

Enable DAX caching for all reads but keep the same partition key and item layout.

Answer

Switch the table to eventually consistent reads for queries to lower read throttling.

Question 3

Based on the exhibit, an application in the same AWS account can upload and read objects in an S3 bucket encrypted with a customer managed KMS key, but GetObject fails with an AccessDenied error from AWS KMS. The IAM role already has s3:GetObject, s3:PutObject, kms:Decrypt, and kms:GenerateDataKey permissions. What change most directly fixes the issue while preserving least privilege?

Accepted Answer

Update the KMS key policy to allow the application role to use the key, ideally with a kms:ViaService condition for S3.. The error is an AccessDenied from AWS KMS, not from S3, which means the IAM role has the required S3 permissions (s3:GetObject) and KMS API permissions (kms:Decrypt), but the KMS key policy does not explicitly grant the role access to the key. Since customer managed KMS keys require a key policy to grant IAM principals permission to use the key (IAM policies alone are insufficient unless the key policy delegates such authority), updating the key policy to allow the role with a kms:ViaService condition for S3 directly resolves the KMS-side denial while preserving least privilege.

Answer

Add an S3 bucket ACL that grants the application role full control over objects.

Answer

Replace the customer managed key with the AWS managed S3 key so IAM permissions become sufficient.

Answer

Add an S3 bucket policy that grants s3:GetObject and s3:PutObject to the role for all objects.

Question 4

A consumer application reads from an Amazon SQS queue. Some messages have an invalid format and always fail processing. They are retried repeatedly and consume consumer capacity. What is the best way to prevent these "poison pill" messages from blocking normal processing?

Accepted Answer

Configure a dead-letter queue (DLQ) with a redrive policy and a maxReceiveCount.. Option B is correct because a dead-letter queue (DLQ) with a redrive policy and a maxReceiveCount allows messages that repeatedly fail processing to be moved to a separate queue after a specified number of receive attempts. This prevents poison pill messages from being retried indefinitely, freeing consumer capacity for valid messages. Amazon SQS automatically redirects messages to the DLQ once the maxReceiveCount threshold is exceeded, ensuring normal processing is not blocked.

Answer

Enable long polling and increase the maximum message retention to 30 days.

Answer

Switch the queue to FIFO and disable retries in the consumer code.

Answer

Delete the main queue and recreate it after every failure.

Question 5

Based on the exhibit, which AWS service should the team use so the database password can rotate automatically every 30 days and the application can retrieve it securely at runtime?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it natively supports automatic rotation of database passwords on a configurable schedule (e.g., every 30 days) and provides secure retrieval at runtime via the AWS SDK, CLI, or Secrets Manager API. Unlike Parameter Store, Secrets Manager is designed specifically for managing secrets with built-in rotation, encryption, and fine-grained access control.

Answer

AWS Systems Manager Parameter Store with a standard String parameter

Answer

Amazon Cognito user pools

Answer

AWS Key Management Service customer managed keys

Question 6

A DynamoDB-backed multi-tenant app experiences throttling during a promotion. Most writes and reads target tenant "ACME" and use the same partition key value, causing a hot partition. Which design change most directly improves performance?

Accepted Answer

Add a "shard" component to the partition key (for example, tenantId + hashed bucket) to spread traffic across partitions. Option A is correct because adding a shard component to the partition key (e.g., appending a random or hash-based suffix to the tenant ID) distributes writes and reads for the same tenant across multiple physical partitions. This directly alleviates the hot partition caused by all ACME traffic hitting a single partition key value, allowing DynamoDB to utilize its full provisioned throughput across partitions.

Answer

Increase the table’s read capacity without changing the partition key

Answer

Switch all reads to strongly consistent reads to guarantee faster results

Answer

Store ACME data in S3 and query it directly to avoid DynamoDB throttling

Question 7

Based on the exhibit, what is the most appropriate change to restore application access while keeping encryption at rest with customer-managed KMS controls?

Accepted Answer

Update the KMS key policy or add a grant so AppServerRole can use the key for decrypt and data key operations.. The application is failing because AppServerRole lacks the necessary permissions to use the customer-managed KMS key for decrypting S3 objects. By updating the KMS key policy or adding a grant to allow the role to perform `kms:Decrypt` and `kms:GenerateDataKey` operations, you restore access while maintaining encryption at rest with customer-managed KMS controls.

Answer

Change the bucket to SSE-S3 so the application no longer depends on KMS permissions.

Answer

Move the EC2 instance into the same Availability Zone as the S3 bucket to reduce encryption errors.

Answer

Attach AmazonS3FullAccess to the application role so S3 can bypass KMS authorization.

Question 8

A game streaming service must use UDP for real-time gameplay traffic. For external firewall allowlisting, the service requires stable, static IP addresses. The TLS handshake must be handled end-to-end by the application servers (the load balancer must not terminate TLS). Which AWS load balancing option best fits these requirements?

Accepted Answer

Use a Network Load Balancer (NLB) with a UDP listener, configure the NLB to use Elastic IP addresses for static IPs, and use TCP listeners for TLS passthrough to the application servers.. A Network Load Balancer (NLB) supports UDP listeners, which are required for real-time gameplay traffic, and can be assigned Elastic IP addresses to provide stable, static IPs for firewall allowlisting. Additionally, NLB supports TCP listeners with TLS passthrough, meaning it forwards the encrypted traffic without terminating the TLS handshake, allowing the application servers to handle end-to-end encryption as required.

Answer

Use an Application Load Balancer (ALB) with UDP listeners and configure TLS passthrough.

Answer

Use Amazon API Gateway with a WebSocket API and keepalive pings to provide UDP-like low-latency delivery.

Answer

Use a Classic Load Balancer and multiplex UDP over TCP to meet the UDP and low-latency requirements.

Question 9

Based on the exhibit, an Amazon Aurora MySQL application is read-heavy, but the database writer is nearing CPU limits while the reader instance is mostly idle. The application currently sends all queries to the writer endpoint. Which change should you make first to increase read throughput?

Accepted Answer

Change the application to send read-only queries to the Aurora reader endpoint.. The correct answer is B because the Aurora reader endpoint is specifically designed to distribute read-only traffic across all available reader instances, offloading the writer and increasing read throughput. Since the reader instance is idle, directing read queries to the reader endpoint immediately reduces CPU load on the writer without requiring any architectural changes.

Answer

Keep using the writer endpoint so Aurora can route the reads automatically.

Answer

Convert the cluster to a single-AZ deployment so network hops are reduced.

Answer

Add an Amazon DynamoDB Accelerator (DAX) cluster in front of Aurora.

Question 10

A company keeps daily database backups in an S3 bucket. They may restore from backups during the first 30 days if there is an issue. After 30 days, backups are rarely restored, but must be retained for 2 years. Which lifecycle strategy most cost-effectively meets these requirements?

Accepted Answer

Use an S3 lifecycle policy to keep backups in S3 Standard for 30 days, then transition them to S3 Glacier Deep Archive for the remainder of the 2-year retention period.. Option C is correct because it balances cost and compliance: backups are kept in S3 Standard for the first 30 days when restores are frequent, ensuring low-latency access, then transitioned to S3 Glacier Deep Archive for the remaining retention period. S3 Glacier Deep Archive offers the lowest storage cost (approximately $0.00099/GB/month) for long-term retention, and the lifecycle policy automates the transition without manual intervention. This approach minimizes storage costs while meeting the 2-year retention requirement.

Answer

Delete backups after 30 days to avoid storage costs, since restores are rare.

Answer

Keep all backups in S3 Standard for the entire 2-year retention period.

Answer

Move backups to S3 Glacier Deep Archive immediately after creation, even for the first 30 days.

Question 11

A dev sandbox has unpredictable DynamoDB traffic with long idle periods and occasional spikes. Which capacity mode should minimize operational overhead and avoid paying for idle provisioned capacity? The design must avoid adding custom operational scripts.

Accepted Answer

DynamoDB on-demand capacity mode. DynamoDB on-demand capacity mode is ideal for unpredictable workloads with long idle periods and occasional spikes because it automatically scales to handle traffic without requiring any capacity planning or provisioning. You pay only for the reads and writes you actually perform, eliminating the cost of idle provisioned capacity and the operational overhead of managing scaling scripts or alarms.

Answer

Reserved capacity for maximum daily traffic

Answer

Provisioned capacity set for peak traffic

Answer

Global tables in every Region

Question 12

A containerized web service on Amazon ECS reads a database password at startup. Today, the password is stored in a plain environment variable and updated manually. Auditors require that credentials: (1) are encrypted at rest using AWS-managed controls, (2) can be rotated without redeploying the task definition, and (3) are accessible only to the running task via least-privilege permissions.

Which solution best meets these requirements?

Accepted Answer

Store the password in AWS Secrets Manager. Configure rotation for the secret. Grant the ECS task role secretsmanager:GetSecretValue for only that secret ARN. Update the application to fetch the secret at runtime and cache it briefly.. Option B is correct because AWS Secrets Manager encrypts secrets at rest using AWS KMS (AWS-managed key by default), supports automatic rotation without requiring a task definition redeploy, and allows least-privilege access by granting the ECS task role only secretsmanager:GetSecretValue for the specific secret ARN. The application fetches the secret at runtime and caches it briefly, satisfying all three auditor requirements.

Answer

Store the password in Systems Manager Parameter Store as a SecureString and grant the ECS task role GetParameter only for that parameter ARN. Have the application call GetParameter on each request or on a short refresh interval.

Answer

Store the password in a local file within the container image and mount it as a Docker secret at build time to avoid environment variables.

Answer

Store the password in an S3 bucket with server-side encryption and allow all ECS tasks to read it using a broad IAM policy on the bucket prefix.

Question 13

A distributed analytics platform runs on 12 EC2 instances in one Availability Zone. The nodes exchange a very high volume of east-west messages and the team wants the lowest possible network latency between instances. Which two changes should the architect make first? Select two.

Accepted Answer

Place the instances in a cluster placement group so AWS keeps them physically close together.. A cluster placement group is the correct choice because it ensures EC2 instances are placed in a single Availability Zone and are physically close together, which minimizes network latency and maximizes throughput for high-volume east-west traffic. This is the lowest-latency placement group option available, as it groups instances within a single rack or cluster of racks, reducing the number of network hops.

Answer

Spread the instances across multiple Availability Zones to reduce the chance of correlated failure.

Answer

Use a spread placement group so each instance lands on different underlying hardware.

Answer

Move the workload to burstable T-series instances to absorb short traffic spikes economically.

Question 14

A document portal requires consistent high IOPS for a transactional database on EC2. Which EBS volume type is most suitable?

Accepted Answer

Provisioned IOPS SSD such as io2. Provisioned IOPS SSD (io2) is the correct choice because it delivers consistent, high IOPS performance required for transactional databases running on EC2. io2 volumes offer a 99.999% durability and can sustain up to 256,000 IOPS per volume, making them ideal for latency-sensitive workloads like OLTP databases.

Answer

sc1 Cold HDD

Answer

Instance store only

Answer

st1 Throughput Optimized HDD

Question 15

A healthcare document service uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend?

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS with an EC2 instance role is correct because it allows the EC2 instance to assume an IAM role and obtain a short-lived authentication token (valid for 15 minutes) to connect to the PostgreSQL database, eliminating the need to store any credentials on the instance. This approach meets both requirements: no credentials stored on EC2 and the use of short-lived credentials. The token is generated using the AWS CLI or SDK with the IAM role's temporary security credentials, and the RDS instance must be configured to accept IAM authentication.

Answer

Embed the database password in the AMI

Answer

Store the database password in user data

Answer

Use a security group rule that allows only application instances

SAA-C03 Practice Test 48 — 15 Questions

Exhibit

SAA-C03 Practice Test 48 — 15 Questions

Exhibit