SAA-C03 Practice Test 49 — 15 Questions

Question 1

A DynamoDB-backed multi-tenant app experiences throttling. Most write traffic for tenant 'ACME' targets a single logical stream of events (you write items for ACME in near-real time). The table currently uses partition key = tenantId and sort key = eventTimestamp. CloudWatch shows partition-level throttling concentrated in the ACME partition. What design change most directly improves write throughput for the hottest tenant while still enabling efficient queries for recent events for that tenant?

Accepted Answer

Mitigate the hotspot by changing the partition key to include a shard value (for example, tenantId + '#' + shardId) and write using shardId. Query recent events by fanning out across ACME shards and merging results by eventTimestamp.. Option B is correct because it directly addresses the partition-level throttling by introducing a shard key (e.g., tenantId + '#' + shardId) as the partition key, which distributes ACME's write load across multiple physical partitions. To query recent events for ACME, the application must fan out queries across all shards and merge results by eventTimestamp, which is efficient because each shard holds a subset of the data and the sort key remains eventTimestamp for ordering.

Answer

Add a Global Secondary Index (GSI) with the same partition key (tenantId) and eventTimestamp, and rely on the GSI to spread load.

Answer

Increase the table’s write capacity (or on-demand baseline) without changing the partition key, because DynamoDB will automatically balance hotspots.

Answer

Switch the sort key to a random value to prevent writes from landing on the same physical partition.

Question 2

A dev sandbox has unpredictable DynamoDB traffic with long idle periods and occasional spikes. Which capacity mode should minimize operational overhead and avoid paying for idle provisioned capacity?

Accepted Answer

DynamoDB on-demand capacity mode. DynamoDB on-demand capacity mode (Option C) is ideal for unpredictable workloads with long idle periods and occasional spikes because it automatically scales to handle traffic without requiring any capacity planning. You pay only for the reads and writes you actually perform, eliminating the cost of idle provisioned capacity and the operational overhead of managing scaling.

Answer

Reserved capacity for maximum daily traffic

Answer

Provisioned capacity set for peak traffic

Answer

Global tables in every Region

Question 3

A global mobile game backend serves mostly static images and JavaScript files from an S3 origin. Users in distant countries report slow load times. What should improve performance most? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Amazon CloudFront distribution with the S3 bucket as origin. Amazon CloudFront is a global content delivery network (CDN) that caches static content (images, JavaScript) at edge locations close to users, drastically reducing latency. By using the S3 bucket as the origin, CloudFront offloads requests from S3 and serves cached objects from the nearest edge, which directly addresses slow load times for distant users. This is a managed AWS-native service that aligns with the architecture review board's preference.

Answer

RDS read replicas

Answer

A larger S3 bucket

Answer

An EC2 Auto Scaling group in one Region

Question 4

A DynamoDB table for a retail API has a partition key based only on the current date. Write throttling occurs during business hours. What is the best design change? The design must avoid adding custom operational scripts.

Accepted Answer

Use a higher-cardinality partition key that distributes writes across partitions. Using only the current date as a partition key creates a 'hot partition' because all writes for the day target a single partition, exceeding its 1,000 WCU limit. A higher-cardinality partition key (e.g., combining date with user ID or order ID) distributes writes evenly across partitions, eliminating throttling without custom scripts.

Answer

Create a global secondary index with the same date key

Answer

Reduce the table's write capacity

Answer

Move the table to S3 Glacier Instant Retrieval

Question 5

A global video platform serves mostly static images and JavaScript files from an S3 origin. Users in distant countries report slow load times. What should improve performance most? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Amazon CloudFront distribution with the S3 bucket as origin. Amazon CloudFront is a global content delivery network (CDN) that caches static content (images, JavaScript) at edge locations closer to users, drastically reducing latency for distant countries. By using the S3 bucket as the origin, CloudFront offloads requests from S3 and accelerates delivery via HTTP/2, TCP optimizations, and persistent connections. This is the most effective managed AWS-native solution for improving global load times for static assets.

Answer

A larger S3 bucket

Answer

RDS read replicas

Answer

An EC2 Auto Scaling group in one Region

Question 6

A company stores sensitive PDFs in Amazon S3 and serves them through CloudFront. Users must access PDFs only through CloudFront, and direct S3 URL requests must fail. Which three changes should be implemented? Select three.

Accepted Answer

Enable CloudFront Origin Access Control (OAC) for the S3 origin.. Option A is correct because CloudFront Origin Access Control (OAC) is the modern, recommended method to restrict S3 bucket access exclusively to a CloudFront distribution. OAC uses a signed request mechanism that verifies the request originates from CloudFront, ensuring direct S3 URL requests are denied. This replaces the older Origin Access Identity (OAI) and provides stronger security with support for features like cross-region buckets and server-side encryption with KMS.

Answer

Enable S3 static website hosting on the bucket.

Answer

Make the object ACLs public so CloudFront can retrieve them.

Question 7

A e-learning platform uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly?

Accepted Answer

Configure Origin Access Control for the S3 origin. Origin Access Control (OAC) is the recommended way to restrict access to an S3 bucket so that it only accepts requests from a specific CloudFront distribution. By configuring OAC, CloudFront signs requests to S3 using a trusted identity, and the bucket policy denies any direct access that does not include that signature, effectively preventing users from bypassing CloudFront.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 8

A company serves a public API through a CloudFront distribution. They want to automatically block common web exploits (for example, OWASP Top 10–style threats) without building custom detection logic. Which AWS service configuration best meets the goal?

Accepted Answer

Enable AWS WAF with AWS Managed Rules and associate the web ACL with the CloudFront distribution.. AWS WAF with AWS Managed Rules provides pre-configured rule sets specifically designed to block common web exploits, including OWASP Top 10 threats, without requiring custom detection logic. By associating the web ACL with a CloudFront distribution, the filtering occurs at the edge, protecting the origin from malicious traffic before it reaches the application.

Answer

Enable AWS Shield Advanced only; it fully replaces the need for WAF rule evaluation.

Answer

Attach a security group rule to the ALB to block malicious patterns based on HTTP request bodies.

Answer

Use Security Hub to block requests automatically when it detects suspicious activity.

Question 9

A dev sandbox currently uses two NAT gateways in each of three Availability Zones, but only one private subnet per AZ needs outbound internet access. What should the architect review first?

Accepted Answer

Whether one NAT gateway per AZ is sufficient for the required private subnets. The question states that only one private subnet per AZ needs outbound internet access, so using two NAT gateways per AZ is likely over-provisioned and costly. The architect should first review whether one NAT gateway per AZ is sufficient, as NAT gateways are billed per hour and per gigabyte of data processed, and reducing from two to one per AZ can cut costs without sacrificing availability. This aligns with the cost-optimized design principle of right-sizing resources to actual demand.

Answer

Disabling route tables

Answer

Replacing every NAT gateway with an internet gateway attached to private subnets

Answer

Moving all workloads to public subnets

Question 10

A financial reporting platform uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly?

Accepted Answer

Use an S3 bucket policy that allows access only from the CloudFront distribution. Option A is correct because an S3 bucket policy can explicitly deny access to any principal except the CloudFront distribution's origin access identity (OAI) or origin access control (OAC). This ensures that direct requests to the S3 bucket URL are rejected, forcing all traffic through CloudFront. The policy uses a condition like `aws:SourceArn` or `aws:SourceAccount` to restrict access to the CloudFront distribution's ARN, preventing bypass.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 11

A fintech startup uses AWS to run a web API and a PostgreSQL database. They must meet an RPO of 15 minutes and an RTO of 2 hours for a Region-wide disaster. Budget allows running a small, always-on set of infrastructure in a secondary Region, but not full production capacity. The team wants a DR approach that is regularly testable without large manual effort.

Which disaster recovery strategy is the best fit?

Accepted Answer

Warm standby: keep a scaled-down application environment and database replication active in the secondary Region, using automated failover controls.. Warm standby (B) is the best fit because it maintains a scaled-down but fully functional application environment in the secondary Region with active database replication, meeting the RPO of 15 minutes (via synchronous or near-synchronous replication like PostgreSQL streaming replication) and RTO of 2 hours (via automated failover controls such as Route 53 health checks and AWS Lambda automation). This approach allows regular testing without large manual effort by simply promoting the standby environment, and the budget constraint is satisfied by running only minimal compute resources (e.g., smaller EC2 instances) in the secondary Region.

Answer

Pilot light: replicate databases and store backups, keep only minimal infrastructure in the secondary Region, and scale up fully during failover.

Answer

Backup and restore only: rely on daily automated backups and restore into the secondary Region during an incident.

Answer

Multi-site active-active: run both Regions at full capacity and route live traffic to both simultaneously.

Question 12

A global video platform serves mostly static images and JavaScript files from an S3 origin. Users in distant countries report slow load times. What should improve performance most? The design must avoid adding custom operational scripts.

Accepted Answer

Amazon CloudFront distribution with the S3 bucket as origin. Amazon CloudFront is a content delivery network (CDN) that caches static content (images, JavaScript files) at edge locations worldwide. By distributing content closer to users, it reduces latency and improves load times for distant countries without requiring any custom operational scripts or changes to the S3 bucket.

Answer

A larger S3 bucket

Answer

RDS read replicas

Answer

An EC2 Auto Scaling group in one Region

Question 13

A DynamoDB table stores device status items. The partition key is deviceId, and the partition distribution is healthy (no single partition dominates). However, during peak periods the application experiences high read latency because many clients repeatedly request the latest status for the same devices. Which action best improves read latency without changing the DynamoDB partitioning model?

Accepted Answer

Add Amazon DAX as a caching layer in front of DynamoDB and route repeated read operations through DAX.. Amazon DAX is a fully managed, in-memory cache for DynamoDB that provides microsecond read latency. By caching the results of repeated GetItem and Query requests for the same device status items, DAX offloads read traffic from the underlying DynamoDB table, reducing the number of read capacity units consumed and eliminating the latency caused by repeated fetches from disk. This directly addresses the high read latency during peak periods without altering the existing partition key or partitioning model.

Answer

Change the partition key to a random value for each request to eliminate hot partitions.

Answer

Increase write capacity only, because writes generally determine read latency in DynamoDB.

Answer

Create an additional Global Secondary Index (GSI) and read exclusively from the index to accelerate reads.

Question 14

Based on the exhibit, a static asset distribution site uses Amazon CloudFront with an S3 origin. The assets are versioned by filename, but the cache hit ratio remains low after each release. Which CloudFront change is the best way to improve cache reuse without changing the origin objects?

Accepted Answer

Remove Authorization and unnecessary query strings from the CloudFront cache key.. Option B is correct because removing Authorization headers and unnecessary query strings from the CloudFront cache key ensures that multiple requests for the same versioned asset (e.g., style.v2.css) share a single cached object, regardless of user-specific headers or irrelevant query parameters. This directly increases the cache hit ratio without modifying the origin objects, as CloudFront will serve the same cached response for identical cache keys.

Answer

Keep the current cache key and increase the S3 bucket's storage class.

Answer

Disable the CloudFront cache so every request is served directly from S3.

Answer

Switch the origin from Amazon S3 to an Application Load Balancer.

Question 15

Based on the exhibit, the payment worker sometimes processes the same SQS Standard message more than once after a timeout. What change best prevents duplicate charges while keeping the queue architecture?

Accepted Answer

Make the payment workflow idempotent by recording a unique order key before charging.. Option C is correct because making the payment workflow idempotent ensures that even if the same SQS Standard message is processed more than once (due to a visibility timeout), the duplicate charge is prevented by checking a unique order key before processing. This is the most robust solution for handling at-least-once delivery semantics of Standard queues without changing the queue architecture.

Answer

Increase the SQS visibility timeout to 15 minutes and leave the worker unchanged.

Answer

Replace the Standard queue with a FIFO queue and rely only on message ordering.

Answer

Add a second consumer so duplicate messages are processed faster.