SAA-C03 Practice Test 50 — 15 Questions

Question 1

A company runs an application behind an Application Load Balancer (ALB). An Auto Scaling group (ASG) is configured with desired capacity 2, but it is attached only to subnets in a single Availability Zone. The ALB is healthy because it is configured across multiple Availability Zones.

When the Availability Zone that contains the ASG subnets experiences an outage, what change most directly improves resilience and allows capacity to be restored automatically?

Accepted Answer

Update the ASG to use subnet IDs that span at least two Availability Zones so it can launch replacement instances after an AZ outage.. An Auto Scaling group (ASG) can only launch instances into the subnets explicitly assigned to it. If those subnets reside in a single Availability Zone (AZ) and that AZ fails, the ASG has no capacity to launch replacement instances, even though the ALB is multi-AZ. By configuring the ASG with subnet IDs spanning at least two AZs, the ASG can automatically launch instances in a healthy AZ, restoring capacity and resilience.

Answer

Reduce the ALB health check interval to speed up detection of unhealthy targets.

Answer

Enable connection draining on the ALB so existing requests complete before targets are terminated.

Answer

Increase the ASG desired capacity from 2 to 6 to compensate for the missing subnets.

Question 2

Based on the exhibit, your application runs entirely in private subnets and only needs to reach Amazon S3, Amazon DynamoDB, AWS Secrets Manager, and CloudWatch Logs. The monthly bill is dominated by NAT Gateway charges. Which change most directly reduces cost while preserving private connectivity to these AWS services?

Accepted Answer

Create S3 and DynamoDB gateway endpoints, create interface endpoints for Secrets Manager and CloudWatch Logs, update route tables, and remove the NAT Gateway.. It replaces the costly NAT Gateway with free VPC Gateway Endpoints for S3 and DynamoDB, and uses AWS PrivateLink interface endpoints for Secrets Manager and CloudWatch Logs. This eliminates all internet-bound data transfer costs while keeping traffic entirely within the AWS network, directly addressing the cost concern without sacrificing private connectivity.

Answer

Replace the NAT Gateway with an Internet Gateway and keep the current private subnet routes unchanged.

Answer

Add a second NAT Gateway in another Availability Zone to reduce cross-AZ data transfer charges.

Answer

Create only interface endpoints for all four services and keep the NAT Gateway for fallback.

Question 3

A company uses IAM permission boundaries to prevent developers from escalating privileges. The security team created a permission boundary that allows only read-only actions on most AWS services, but teams can still manage their own resources. A developer can create an IAM role with broad permissions, and the boundary does not appear to be restricting it. Which corrective action best aligns with how permission boundaries work?

Accepted Answer

Ensure the role creation process sets the permission boundary on the new role, using the boundary’s ARN in the CreateRole call or role template.. Permission boundaries must be explicitly applied to a role during its creation (via the `CreateRole` API call or an infrastructure-as-code template). Without setting the boundary ARN, the role inherits no restriction, allowing the developer to create a role with broad permissions that bypasses the intended boundary. Option B correctly identifies that the role creation process must include the boundary ARN to enforce the limitation.

Answer

Rely on an AWS-managed policy attached to the developer’s IAM user; permission boundaries only apply to users.

Answer

Attach the permission boundary policy as an SCP in AWS Organizations so it automatically applies to all roles.

Answer

Grant the developer IAM permissions to add a “deny” statement to the boundary policy so the boundary blocks escalation.

Question 4

A IoT ingestion API must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control?

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. An SCP (Service Control Policy) is the strongest preventive control because it can deny the ec2:CreateVolume API call when the encrypted condition is false, effectively blocking the creation of any unencrypted EBS volume at the account level before it happens. This is a preventive control that enforces encryption as a mandatory requirement, unlike detective or corrective measures that act after the fact.

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Answer

Enable VPC Flow Logs

Answer

Tag encrypted volumes after creation

Question 5

A analytics dashboard uses RDS MySQL and receives many read-only reporting queries that slow down the primary database. What should the architect add?

Accepted Answer

RDS read replica and route reporting queries to it. Adding an RDS read replica offloads read-heavy reporting queries from the primary MySQL instance, preserving write performance. The read replica asynchronously replicates data using MySQL's native binlog replication, and routing reporting queries to its endpoint reduces contention on the primary.

Answer

S3 lifecycle policy

Answer

Multi-AZ standby and route reads to the standby

Answer

A larger NAT gateway

Question 6

A claims workflow uses Amazon SQS. Poison messages are repeatedly failing and blocking useful retries. What should the architect configure?

Accepted Answer

A dead-letter queue with an appropriate maxReceiveCount. A dead-letter queue (DLQ) with an appropriate maxReceiveCount allows messages that repeatedly fail processing to be moved out of the source queue after a specified number of receive attempts. This prevents poison messages from blocking the queue and consuming retry capacity, enabling the workflow to continue processing valid messages without interruption.

Answer

A FIFO queue without a redrive policy

Answer

Short polling instead of long polling

Answer

A larger message retention period only

Question 7

Based on the exhibit, a web application must stay available if one Availability Zone fails. What is the best change to improve resilience?

Accepted Answer

Add a subnet in another Availability Zone to the Auto Scaling group and keep the ALB spanning both AZs.. Adding a subnet in another Availability Zone (AZ) to the Auto Scaling group and keeping the ALB spanning both AZs ensures that if one AZ fails, the ALB can route traffic to healthy instances in the other AZ. This is the standard pattern for building multi-AZ resilient architectures with Auto Scaling and ALB, as it eliminates the single point of failure at the AZ level.

Answer

Increase the desired capacity to 8 instances in the same subnet.

Answer

Replace the Application Load Balancer with a Network Load Balancer.

Answer

Move the instances to a larger instance type with more CPU and memory.

Question 8

Based on the exhibit, what change best reduces Lambda cold-start impact for a predictable user-upload workflow?

Accepted Answer

Enable provisioned concurrency for the function.. Provisioned concurrency pre-warms a specified number of execution environments so that when a user upload triggers the Lambda function, there is no cold-start latency. This is the most direct way to eliminate initialization time for a predictable workload, as it keeps instances ready to handle requests immediately.

Answer

Set a reserved concurrency limit for the function to protect it from throttling.

Answer

Increase the function timeout to give more time for initialization.

Answer

Move the function to a larger memory setting only to eliminate all initialization time.

Question 9

A backend service in AWS uses an IAM role to upload large files to an S3 bucket using multipart upload. The upload typically succeeds, but it intermittently fails during cleanup with this error: "AccessDenied: User is not authorized to perform: s3:AbortMultipartUpload" The role identity policy currently allows only: - s3:PutObject on arn:aws:s3:::my-bucket/uploads/* - s3:ListBucket on arn:aws:s3:::my-bucket with a prefix condition What is the best least-privilege change to fix the cleanup failure?

Accepted Answer

Add s3:AbortMultipartUpload for arn:aws:s3:::my-bucket/uploads/*.. The error occurs because the IAM role lacks permission to abort multipart uploads. Multipart uploads in S3 require s3:AbortMultipartUpload to clean up incomplete upload parts after a failure or interruption. Option A grants this permission on the specific uploads/* prefix, which is the least-privilege fix because it scopes the action to the exact path where the service uploads files.

Answer

Add s3:AbortMultipartUpload for arn:aws:s3:::my-bucket/*.

Answer

Add s3:ListBucket for arn:aws:s3:::my-bucket/uploads/* so the service can find parts to abort.

Answer

Add kms:Decrypt permissions for the KMS key used to encrypt objects in the bucket.

Question 10

An engineering team deploys a stateless web API on EC2 using an Auto Scaling group and an Application Load Balancer (ALB). During a recent test, they noticed that when one Availability Zone was unavailable, traffic failed until new instances were manually launched. Which change most directly improves automatic failover for the compute layer within a single Region?

Accepted Answer

Ensure the ALB and Auto Scaling group span multiple subnets in at least two Availability Zones.. An Application Load Balancer (ALB) and Auto Scaling group must span multiple subnets in at least two Availability Zones (AZs) to provide automatic failover. When one AZ becomes unavailable, the ALB automatically reroutes traffic to healthy targets in the remaining AZs, and the Auto Scaling group can launch replacement instances in the surviving AZs. This architecture ensures that the compute layer remains available without manual intervention.

Answer

Place the Auto Scaling group in only one subnet so instance launches are simpler.

Answer

Increase the target group deregistration delay to allow old instances to stay longer.

Answer

Use a Network Load Balancer, but keep all subnets in a single Availability Zone.

Question 11

Based on the exhibit, a public API is behind CloudFront and is experiencing bursts of requests from the same client IP, causing upstream saturation. The team wants AWS to automatically block that IP when the request rate becomes excessive while keeping enforcement as close to the client as possible. Which control should they add?

Accepted Answer

Add an AWS WAF rate-based rule to the CloudFront distribution and configure it to block the source IP after the threshold is exceeded.. AWS WAF rate-based rules are designed to automatically block IP addresses that exceed a specified request rate within a 5-minute evaluation window. By attaching this rule to a CloudFront distribution, enforcement occurs at the edge location closest to the client, preventing excessive requests from reaching the upstream API and mitigating saturation.

Answer

Add a network ACL rule that denies the source IP after five requests are observed.

Answer

Enable AWS Shield Advanced and create a custom protection group for the single IP address.

Answer

Place the API behind a security group rule that allows only the current client IP range.

Question 12

A company uses Amazon RDS with automated backups enabled (retention period: 7 days). At 10:30 UTC, a bad release corrupts specific rows in a production table. The team detects the issue at 11:10 UTC. They need to revert the database state to what it was from 10:00–10:30 UTC, recover quickly, and minimize risk to the currently running workload. What is the best option?

Accepted Answer

Perform a point-in-time restore to a new DB instance using a timestamp before the corruption (for example, a time within 10:00–10:30 UTC).. Amazon RDS automated backups enable point-in-time recovery (PITR) to any second within the retention window. By restoring to a timestamp between 10:00 and 10:30 UTC, you recover the database to a state before the corruption occurred, without affecting the current production instance. This minimizes risk to the running workload because the restore creates a new DB instance, leaving the original untouched until you are ready to switch.

Answer

Reboot the DB instance and rely on the corrupted data being overwritten by storage-level changes.

Answer

Restore only the most recent automated backup snapshot, even if it is after the corruption timestamp.

Answer

Create a read replica of the current DB instance and overwrite the corrupted table using SELECT queries from the replica.

Question 13

A company runs an Amazon RDS for PostgreSQL database. The application performs frequent OLTP writes, but it also has a separate dashboard that runs heavy SELECT queries and is slowing down overall database performance. The writes must remain on the primary. What is the best approach to improve performance for the dashboard?

Accepted Answer

Create an RDS read replica and route the dashboard’s read-only queries to the replica endpoint. Creating an RDS read replica allows you to offload the heavy SELECT queries from the primary database instance. The replica asynchronously replicates data from the primary using PostgreSQL's streaming replication, so the dashboard can query the replica without impacting the OLTP write performance on the primary. This directly addresses the requirement that writes remain on the primary while improving dashboard query performance.

Answer

Increase instance storage throughput limits and disable synchronous replication to speed up all queries

Answer

Replace RDS with Amazon S3 because dashboards require SQL result caching

Answer

Move the primary database to a different AWS Region to reduce network latency

Question 14

Account A hosts an IAM role (RoleInAccountA). The trust policy in Account A correctly allows a specific principal from Account B to call sts:AssumeRole. However, when Account B’s application calls sts:AssumeRole, it receives an AccessDenied error. What is the most likely missing requirement in Account B?

Accepted Answer

Account B’s calling principal must have an identity-based policy that allows sts:AssumeRole on RoleInAccountA’s role ARN.. For an IAM role in Account A to be assumed by a principal in Account B, two conditions must be met: (1) the trust policy of the role in Account A must grant the sts:AssumeRole permission to the Account B principal, and (2) the calling principal in Account B must have an identity-based policy that explicitly allows sts:AssumeRole on the ARN of RoleInAccountA. Without this identity-based policy in Account B, the request is denied by AWS's explicit deny default, even if the trust policy in Account A is correctly configured.

Answer

Account A must attach an S3 bucket policy statement to allow sts:AssumeRole from Account B.

Answer

Account B must add kms:Decrypt permissions to the caller to satisfy AssumeRole.

Answer

Account B must create an SCP in the organization to allow sts:AssumeRole.

Question 15

A microservice reads a secret from AWS Secrets Manager using its task role (ServiceRole). The secret is configured to use a customer-managed CMK. In production, the service fails with AccessDeniedException on GetSecretValue. CloudTrail shows that Secrets Manager attempted kms:Decrypt but was denied. Which IAM policy change is most appropriate to fix the failure while keeping least privilege?

Accepted Answer

Add kms:Decrypt permission for the specific CMK ARN to ServiceRole, and also keep secretsmanager:GetSecretValue for the specific secret ARN.. The AccessDeniedException occurs because the task role (ServiceRole) lacks the kms:Decrypt permission for the customer-managed CMK used to encrypt the secret. Secrets Manager calls kms:Decrypt on your behalf when retrieving the secret value. Adding kms:Decrypt for the specific CMK ARN to ServiceRole, while retaining secretsmanager:GetSecretValue for the specific secret ARN, grants the minimum required permissions to decrypt and read the secret.

Answer

Add secretsmanager:ListSecrets permission on "*" so the service can discover the secret and retry the read.

Answer

Add s3:GetObject permission to ServiceRole for the KMS key alias stored in an S3 bucket.

Answer

Add kms:Encrypt permission instead of kms:Decrypt, because the service only needs to read the secret.