SAA-C03 Practice Test 5 — 10 Questions

Question 1

A ticket booking system uses Aurora MySQL. The company wants fast cross-Region disaster recovery with low RPO. Which architecture should be considered?

Accepted Answer

Aurora Global Database. Aurora Global Database is designed for cross-Region disaster recovery with a typical RPO of 1 second or less, using storage-based replication that does not impact database performance. This meets the requirement for fast failover and low data loss, unlike manual snapshot-based approaches which have higher RPO and slower recovery.

Answer

A single-AZ Aurora cluster

Answer

An ElastiCache Redis replica

Answer

Manual snapshots copied monthly

Question 2

Based on the exhibit, the database must fail over automatically if the primary Availability Zone goes down. Which solution should the architect choose?

Accepted Answer

Convert the database to a Multi-AZ RDS deployment.. A Multi-AZ RDS deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, without requiring manual intervention or changes to the application connection string.

Answer

Create a read replica in the same Availability Zone as the primary database.

Answer

Increase the backup retention period to 35 days.

Answer

Move the database to an EC2 instance with an attached EBS volume.

Question 3

A team runs a CPU-intensive image processing service on Amazon EC2. The service spends most of its time resizing and compressing images, and the team wants the best price-performance starting point for compute-heavy work. Which EC2 instance family should they choose?

Accepted Answer

Compute optimized instances. Compute optimized instances (C family) are designed for workloads that benefit from high-performance processors, such as batch processing, media transcoding, and image processing. Since the team's service is CPU-intensive (resizing and compressing images), the C family provides the best price-performance starting point for compute-heavy work.

Answer

Memory optimized instances

Answer

Storage optimized instances

Answer

General purpose instances

Question 4

A Lambda function behind an API needs consistent low latency. Traffic normally drops to near zero, then spikes several times per hour. During spikes, the p95 latency often spikes above 800 ms due to cold starts. The team wants to keep using Lambda (no containers) but minimize cold start impact during predictable spikes. What is the best AWS configuration to meet this goal?

Accepted Answer

Enable Lambda provisioned concurrency on a published function alias and set the minimum provisioned instances to the baseline expected during spikes.. Provisioned concurrency initializes a specified number of execution environments in advance, keeping them warm and ready to handle requests instantly. By setting the minimum provisioned instances to the baseline expected during spikes, the function avoids cold starts for those requests, ensuring p95 latency stays low even when traffic surges from near zero.

Answer

Increase the function memory size to the maximum and rely on the larger memory to eliminate cold starts.

Answer

Configure an ALB with target group health checks to keep Lambda warm by sending periodic requests.

Answer

Turn on AWS CloudTrail data events to monitor cold start frequency and tune the runtime accordingly.

Question 5

A warehouse integration service receives bursts of orders that sometimes overwhelm a downstream fulfilment service. The architecture must absorb spikes and retry processing without losing requests. Which service should be placed between the web tier and fulfilment workers? The design must avoid adding custom operational scripts.

Accepted Answer

Amazon SQS queue. Amazon SQS is the correct choice because it acts as a durable, scalable message buffer that decouples the web tier from the fulfilment workers. When order bursts arrive, messages are stored reliably in the queue, and workers can poll at their own pace, retrying failed messages automatically without any custom scripts. This pattern absorbs spikes and ensures no requests are lost, meeting the requirement for a fully managed, serverless integration.

Answer

AWS WAF

Answer

Amazon Route 53 weighted routing

Answer

Amazon CloudFront

Question 6

You use a customer managed AWS KMS key (CMK) to encrypt objects in an S3 bucket using SSE-KMS. A specific IAM role must be able to decrypt objects. Where should you grant kms:Decrypt permissions so that the role can decrypt data encrypted with that CMK?

Accepted Answer

In the KMS key policy, allowing kms:Decrypt (and any other required KMS permissions) for the role’s principal ARN.. When using a customer managed KMS key (CMK) with SSE-KMS, the KMS key policy is the primary access control mechanism. To allow a specific IAM role to decrypt objects, you must grant kms:Decrypt (and typically kms:DescribeKey) in the key policy for that role's principal ARN. Without this explicit permission in the key policy, the role will be denied decryption even if it has s3:GetObject permissions, because KMS enforces its own authorization.

Answer

Only in the S3 bucket policy by granting s3:GetObject, because S3 bucket policy controls decryption.

Answer

Only in the IAM role identity policy; the KMS key policy does not need changes for SSE-KMS.

Answer

By enabling S3 default encryption; KMS permissions are automatically granted to all IAM roles in the account.

Question 7

Your company hosts an internal API in two AWS Regions. You want Amazon Route 53 to automatically send traffic to the secondary Region if the primary Region’s endpoint becomes unhealthy. Which Route 53 configuration best meets this requirement?

Accepted Answer

Failover routing with a primary record associated with a health check, and a secondary (failover) record associated with its own health check settings.. Failover routing in Route 53 is specifically designed for active-passive configurations where traffic is directed to a primary resource unless a health check indicates it is unhealthy, at which point traffic is automatically routed to the secondary (failover) record. By associating a health check with the primary record, Route 53 can monitor the endpoint's health and perform the failover seamlessly. This directly meets the requirement to send traffic to the secondary Region when the primary endpoint becomes unhealthy.

Answer

Latency-based routing with health checks for both Regions.

Answer

Weighted routing to distribute traffic evenly across both Regions.

Answer

Geolocation routing based on the client’s country to choose a Region.

Question 8

A public API for a image sharing application is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used? The design must avoid adding custom operational scripts.

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. C is correct because the scenario requires standards-based token authentication from an external OpenID Connect (OIDC) provider, and API Gateway's JWT authorizer natively validates JWTs issued by OIDC providers without requiring custom code. This authorizer verifies the token's signature, expiry, and issuer against the OIDC discovery endpoint, meeting the requirement to avoid custom operational scripts.

Answer

A VPC endpoint policy

Answer

API keys only

Answer

IAM authorization for all internet users

Question 9

A production application stores critical data on an Amazon EBS volume. The team wants a simple backup method that allows the volume to be restored later if the server is lost. What should they use?

Accepted Answer

Amazon EBS snapshots. Amazon EBS snapshots are the correct choice because they provide a simple, incremental backup method for EBS volumes. Snapshots capture the data on the volume at a specific point in time and are stored in Amazon S3, allowing the volume to be restored to a new EC2 instance if the original server is lost. This directly meets the requirement for a backup that enables restoration after server failure.

Answer

Amazon S3 bucket versioning

Answer

AWS Security Hub

Answer

Amazon CloudFront invalidations

Question 10

A microservice needs to read exactly one secret value from AWS Secrets Manager. Which IAM permission statement provides the best least-privilege approach to allow the microservice to retrieve that secret value?

Accepted Answer

Allow secretsmanager:GetSecretValue only on the specific secret ARN required by the service. It grants the minimum necessary permission—secretsmanager:GetSecretValue—scoped to the exact Amazon Resource Name (ARN) of the secret the microservice needs. This follows the AWS least-privilege principle by restricting access to a single action on a single resource, preventing the microservice from reading other secrets even if compromised.

Answer

Allow secretsmanager:GetSecretValue on all secrets using Resource: "*"

Answer

Allow secretsmanager:* on the secret name prefix using a wildcard pattern

Answer

Allow secretsmanager:GetSecretValue on the AWS account root ARN