SAA-C03 Practice Exam 52 — 20 Questions

Question 1

A order processing API stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of a seven-year immutable audit log without custom scripts. Compliance mode enforces a legal hold that cannot be removed by any user, ensuring logs remain intact.

Answer

S3 server access logging

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Question 2

A stateless web API runs on EC2 instances behind an Application Load Balancer (ALB). The Auto Scaling group (ASG) currently uses subnets from only one Availability Zone, even though the ALB spans two Availability Zones. During maintenance of that single AZ, the ALB remains up but clients see timeouts because there are no healthy targets. Which change most directly improves resilience against an AZ failure?

Accepted Answer

Update the ASG to launch instances across subnets in at least two Availability Zones and ensure ALB health checks target an application-ready path.. The most direct fix for AZ failure resilience is to distribute the ASG across multiple Availability Zones. With the ALB already spanning two AZs, if the ASG only launches instances in one AZ, a failure of that AZ leaves the ALB with zero healthy targets, causing timeouts. By configuring the ASG to launch instances in at least two AZs and setting ALB health checks to an application-ready path, the ALB can route traffic to healthy instances in the surviving AZ, maintaining availability.

Answer

Keep the ASG in one subnet/AZ, but enable ALB stickiness to reduce session interruption.

Answer

Add a NAT gateway in the public subnets so instances can reach the internet during maintenance events.

Answer

Create a second ALB in the same Availability Zone and route traffic using DNS failover.

Question 3

A financial services company runs a high-traffic REST API on Amazon EC2 instances behind an Application Load Balancer. The API retrieves user session data from an Amazon DynamoDB table for every request. During peak hours, DynamoDB read capacity is exhausted, causing throttling and increased latency. The workload is read-heavy and the session data is accessed frequently but changes infrequently. The solutions architect needs to reduce DynamoDB read load and improve API response times with minimal application changes. Which solution meets these requirements?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for the table and modify the application to use the DAX client for session reads.. DynamoDB Accelerator (DAX) is a fully managed, highly available in-memory cache for DynamoDB that delivers up to a 10x performance improvement, from milliseconds to microseconds. It is API-compatible with DynamoDB, so the application only needs to use the DAX client. For read-heavy workloads with infrequent updates, DAX reduces read capacity consumption and improves response times without requiring a major rewrite or data migration.

Answer

Migrate the session data to Amazon ElastiCache for Redis and modify the application to read from Redis instead of DynamoDB.

Answer

Create a read replica of the DynamoDB table in another region and direct all reads to the replica.

Answer

Increase the DynamoDB read capacity to a higher provisioned level and enable auto scaling.

Question 4

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a financial reporting platform. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy?

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. The bucket policy can use the `aws:sourceVpce` condition key to restrict access to requests that originate from a specific VPC endpoint (a Gateway VPC Endpoint for S3). This ensures that only traffic flowing through that endpoint can access the bucket, meeting the security team's requirement. The EC2 instance in the private subnet routes S3 traffic through the endpoint via the subnet's route table, and the bucket policy enforces the restriction at the resource level.

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A deny statement for all IAM users except the EC2 role

Question 5

A production Amazon RDS database has automated backups enabled. At 10:45 UTC, an issue is discovered. The team needs to restore the database to its state as of 10:30 UTC. Which capability should they use?

Accepted Answer

Point-in-time restore (PITR) using automated backups to a specific timestamp.. Amazon RDS automated backups enable point-in-time recovery (PITR) to any second within the backup retention period, restoring to a new DB instance. Since the issue was discovered at 10:45 UTC and the desired recovery point is 10:30 UTC, PITR can restore the database to that exact timestamp, provided it falls within the automated backup window and retention period.

Answer

Perform a Multi-AZ manual failover of the standby to recover to the earlier timestamp.

Answer

Promote a cross-region replication target to replace the current database with the last-known good copy.

Answer

Switch to a read replica to access an older view of data without restoring.

Question 6

A trading dashboard uses Aurora MySQL. The company wants fast cross-Region disaster recovery with low RPO. Which architecture should be considered? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Aurora Global Database. Aurora Global Database is the correct choice because it provides a managed, cross-Region disaster recovery solution with a Recovery Point Objective (RPO) of less than 1 second and a Recovery Time Objective (RTO) of typically less than 1 minute. It uses storage-based replication to keep a secondary cluster in another AWS Region up to date with minimal latency, meeting the low RPO requirement without manual intervention.

Answer

A single-AZ Aurora cluster

Answer

Manual snapshots copied monthly

Answer

An ElastiCache Redis replica

Question 7

A web API runs on an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). During traffic spikes, users experience request timeouts even though CPU stays below 40%. After investigation, you find the ASG often has too few healthy targets to handle the current request rate. Which change will best improve responsiveness during spikes?

Accepted Answer

Create a target tracking scaling policy using an ALB metric such as RequestCountPerTarget or TargetResponseTime.. The issue is that the ASG has too few healthy targets to handle the request rate, even though CPU is low. A target tracking scaling policy based on RequestCountPerTarget or TargetResponseTime directly aligns scaling with the ALB's view of demand, ensuring the ASG adds instances when request rates spike, regardless of CPU utilization. This addresses the root cause—insufficient capacity to serve incoming requests—rather than relying on a metric (CPU) that does not reflect the bottleneck.

Answer

Keep the ASG scaling policy based on CPU utilization, but increase the ASG min capacity by 50%.

Answer

Enable EC2 detailed monitoring for one-minute granularity and keep CPU scaling.

Answer

Switch to scaling based on the ASG network out bytes metric only, ignoring ALB response metrics.

Question 8

A telemetry pipeline uses an Application Load Balancer in one Region. Global users need lower network latency to the application without caching dynamic responses. What should be considered? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to route traffic from global users to the Application Load Balancer, reducing latency and jitter by leveraging Anycast IP addresses and edge locations. It does not cache responses, making it ideal for dynamic content where low latency is required without custom operational scripts.

Answer

S3 Cross-Region Replication

Answer

CloudFront only with long TTLs

Answer

AWS Backup cross-Region copy

Question 9

A warehouse integration service must use shared file storage across Linux EC2 instances in multiple Availability Zones. The storage must remain available during an AZ failure. Which service should be used? The team wants the control to be enforceable during normal operations.

Accepted Answer

Amazon EFS with mount targets in multiple Availability Zones. Amazon EFS provides a fully managed, POSIX-compliant NFS file system that can be mounted concurrently on multiple Linux EC2 instances across different Availability Zones. By creating mount targets in each AZ, the file system remains accessible even if one AZ fails, because the other mount targets continue to serve traffic. EFS also supports lifecycle policies and IAM enforcement to control access during normal operations, meeting the requirement for enforceable control.

Answer

S3 mounted as a POSIX file system without a file gateway

Answer

Instance store volumes

Answer

An EBS volume attached to all instances

Question 10

A travel booking site uses EC2 instances behind an ALB. CPU is consistently high during peak traffic, and request latency rises. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

Auto Scaling policy based on an appropriate CloudWatch metric. An Auto Scaling policy based on a CloudWatch metric like CPUUtilization or request latency directly addresses the high CPU and rising latency by automatically adding EC2 instances during peak traffic. This eliminates the need for custom scripts and ensures the application scales horizontally to maintain performance.

Answer

A VPC endpoint for CloudWatch only

Answer

S3 Object Lock

Answer

Disable health checks

Question 11

Based on the exhibit, a central deployment role in Account A is assumed by several CI/CD pipelines from Account B. The role must remain reusable, but the team wants the TeamA pipeline to upload artifacts only to s3://artifact-bucket/teamA/prod/ without creating a separate IAM role. What is the best approach?

Accepted Answer

Pass an STS session policy when TeamA assumes the role to further restrict the temporary credentials to the teamA/prod prefix.. When the TeamA pipeline assumes the central IAM role in Account A, it can pass an STS session policy that further restricts the temporary credentials to only allow actions on the s3://artifact-bucket/teamA/prod/ prefix. This approach keeps the role reusable for other pipelines while enforcing a narrower permission scope at the session level, without requiring a separate IAM role.

Answer

Use an IAM user in Account B and hard-code the narrower S3 path in its access key policy.

Answer

Add a bucket ACL that grants write access only to the TeamA pipeline session name.

Answer

Attach a permissions boundary to the central role so every pipeline session inherits the narrower prefix automatically.

Question 12

A risk simulation workload generates analytics files that are accessed unpredictably. Some files become hot again months later. The team wants automatic storage cost optimisation without retrieval delays. What should be used?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct choice because it automatically moves objects between access tiers (frequent, infrequent, and archive instant access) based on changing access patterns, without any retrieval delays. This handles the unpredictable access described—files that become hot again months later—by keeping them in the archive instant access tier until access resumes, then promoting them instantly. It optimizes storage costs automatically without manual intervention or cold retrieval waits.

Answer

Manual monthly review and object copying

Answer

S3 Glacier Flexible Retrieval for all files

Answer

EFS One Zone for analytics files

Question 13

A DynamoDB table stores device status items. The partition key is deviceId, and the partition distribution is healthy (no single partition dominates). However, during peak periods the application experiences high read latency because many clients repeatedly request the latest status for the same devices. Which action best improves read latency without changing the DynamoDB partitioning model?

Accepted Answer

Add Amazon DAX as a caching layer in front of DynamoDB and route repeated read operations through DAX.. Amazon DAX is a fully managed, in-memory cache for DynamoDB that provides microsecond read latency. By caching the results of repeated GetItem and Query requests for the same device status items, DAX offloads read traffic from the underlying DynamoDB table, reducing the number of read capacity units consumed and eliminating the latency caused by repeated fetches from disk. This directly addresses the high read latency during peak periods without altering the existing partition key or partitioning model.

Answer

Change the partition key to a random value for each request to eliminate hot partitions.

Answer

Increase write capacity only, because writes generally determine read latency in DynamoDB.

Answer

Create an additional Global Secondary Index (GSI) and read exclusively from the index to accelerate reads.

Question 14

Based on the exhibit, the company runs a self-managed RabbitMQ cluster on EC2 for asynchronous work. The queue only needs durable at-least-once delivery, and the application does not require AMQP-specific features such as exchanges, routing keys, or broker plugins. Which change is the best cost-optimization move?

Accepted Answer

Replace RabbitMQ with Amazon SQS Standard and keep the workers unchanged except for the queue client library.. Amazon SQS Standard provides at-least-once delivery and durable message storage without requiring AMQP-specific features like exchanges or routing keys. Replacing RabbitMQ with SQS eliminates the operational overhead of managing EC2 instances and RabbitMQ clusters, while SQS's pay-per-request pricing is more cost-effective than running EC2 instances 24/7 for a self-managed queue.

Answer

Replace RabbitMQ with Amazon MQ for RabbitMQ to keep the same protocol and reduce costs.

Answer

Increase the RabbitMQ instance size and add a fourth node for higher availability.

Answer

Move the queue to Amazon DynamoDB and use scans for consumers to detect new messages.

Question 15

A DynamoDB-backed multi-tenant app experiences throttling during a promotion. Most writes and reads target tenant "ACME" and use the same partition key value, causing a hot partition. Which design change most directly improves performance?

Accepted Answer

Add a "shard" component to the partition key (for example, tenantId + hashed bucket) to spread traffic across partitions. Adding a shard component to the partition key (e.g., appending a random or hash-based suffix to the tenant ID) distributes writes and reads for the same tenant across multiple physical partitions. This directly alleviates the hot partition caused by all ACME traffic hitting a single partition key value, allowing DynamoDB to utilize its full provisioned throughput across partitions.

Answer

Increase the table’s read capacity without changing the partition key

Answer

Switch all reads to strongly consistent reads to guarantee faster results

Answer

Store ACME data in S3 and query it directly to avoid DynamoDB throttling

Question 16

A global video platform serves mostly static images and JavaScript files from an S3 origin. Users in distant countries report slow load times. What should improve performance most? The design must avoid adding custom operational scripts.

Accepted Answer

Amazon CloudFront distribution with the S3 bucket as origin. Amazon CloudFront is a content delivery network (CDN) that caches static content (images, JavaScript files) at edge locations worldwide. By distributing content closer to users, it reduces latency and improves load times for distant countries without requiring any custom operational scripts or changes to the S3 bucket.

Answer

A larger S3 bucket

Answer

RDS read replicas

Answer

An EC2 Auto Scaling group in one Region

Question 17

Based on the exhibit, a batch platform in Account B must assume a role in Account A. Only the specific role arn:aws:iam::222233334444:role/BatchRunner should be allowed to assume it, and the design must prevent any other role in Account B from reusing the same external ID. Which change best meets the requirement?

Accepted Answer

Change the trust policy principal from account root to arn:aws:iam::222233334444:role/BatchRunner and keep the ExternalId condition.. The trust policy on the target role in Account A must restrict the principal to the exact BatchRunner role ARN (arn:aws:iam::222233334444:role/BatchRunner) rather than the entire Account B root. This ensures that only that specific role can assume the target role. Keeping the ExternalId condition adds an additional layer of security by requiring a unique identifier that only BatchRunner knows, preventing any other role in Account B from reusing the same external ID.

Answer

Add an identity-based policy to the BatchRunner role that allows sts:AssumeRole on the target role.

Answer

Replace the ExternalId condition with a role session name condition so only BatchRunner sessions are accepted.

Answer

Attach an SCP to Account B that denies sts:AssumeRole unless the request comes from BatchRunner.

Question 18

A team wants a web application to keep serving traffic if one Availability Zone fails. Match each architecture element to the resilience behavior it provides.

Accepted Answer

Elastic Load Balancer: Distributes incoming traffic across multiple targets in multiple Availability Zones. These pairs match architecture elements with their resilience behaviors for surviving an Availability Zone failure, focusing on AWS services that provide high availability and fault tolerance.

Answer

Amazon S3: Automatically fails over to a secondary region in case of an Availability Zone failure

Answer

AWS CloudFormation: Distributes application load across multiple Availability Zones

Question 19

A latency-sensitive video platform uploads large files to S3 from users around the world. Which two features can improve upload performance? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Transfer Acceleration. S3 Transfer Acceleration (B) uses AWS edge locations to route uploads over optimized network paths, reducing latency for users far from the destination bucket. S3 Multipart Upload (C) allows parallel uploads of file parts, improving throughput and resilience for large files. Both features enhance upload performance without requiring custom scripts.

Answer

S3 Object Lock

Answer

S3 Inventory

Question 20

An orders service consumes payment instructions from an Amazon SQS queue. Sometimes the consumer times out after applying the payment but before deleting the SQS message. As a result, the same payment instruction is processed again. Which design change most directly prevents duplicate side effects caused by message retries?

Accepted Answer

Implement idempotency by recording a processed marker keyed by the instruction ID and ignoring duplicates.. Implementing idempotency ensures that even if the same payment instruction is processed multiple times due to a timeout and retry, the side effect (e.g., applying the payment) occurs only once. By recording a processed marker keyed by the instruction ID (e.g., using a DynamoDB table or Redis), the consumer can check the marker before processing and ignore duplicates. This directly addresses the root cause—duplicate processing—without altering the queue's retry behavior.

Answer

Delete the SQS message immediately after it is received, before processing, to ensure it is not retried.

Answer

Increase the SQS visibility timeout to a maximum value to avoid retries entirely.

Answer

Convert the queue to FIFO and enable content-based deduplication.