SAA-C03 Practice Exam 52 — 20 Questions

Question 1

A data-processing application runs in private subnets and needs to read objects from Amazon S3 and write items to Amazon DynamoDB. The team currently routes all outbound traffic through a NAT Gateway, and monthly networking charges are rising. Which two changes will most directly reduce cost while keeping traffic on the AWS network? Select two.

Accepted Answer

Add an S3 gateway VPC endpoint to the private route tables.. Adding an S3 gateway VPC endpoint allows instances in private subnets to access S3 directly over the AWS network without traversing the NAT Gateway, eliminating NAT data processing charges for S3 traffic. This reduces monthly networking costs while keeping traffic within the AWS backbone.

Answer

Add a second NAT Gateway in another Availability Zone.

Answer

Move the instances into public subnets so they can reach AWS services directly.

Answer

Send private subnet traffic to S3 and DynamoDB through an Internet Gateway route.

Question 2

A Lambda function behind API Gateway has predictable traffic spikes every hour. The function does not need access to resources in a VPC, and p95 latency spikes are caused by cold starts during scale-out. Which two actions are most effective? Select two.

Accepted Answer

Enable provisioned concurrency for the function.. Option A is correct because provisioned concurrency pre-warms a specified number of Lambda execution environments, eliminating cold starts for those instances. This directly addresses the p95 latency spikes caused by cold starts during predictable traffic spikes, as the function will have warm containers ready to handle incoming requests without the initialization delay.

Answer

Set reserved concurrency to a low fixed number.

Answer

Increase the Lambda timeout to 15 minutes.

Answer

Add an SQS dead-letter queue to reduce startup latency.

Question 3

A distributed system needs extremely low network latency between a set of EC2 instances running the same workload. The team wants the instances to be placed as close together as AWS allows to reduce round-trip time. Which placement strategy should the architect use?

Accepted Answer

Use a Cluster placement group for the instances that must communicate frequently over low latency.. A Cluster placement group is the correct choice because it places instances in a single Availability Zone within the same rack or logical cluster, providing the lowest possible network latency and maximum throughput (up to 10 Gbps for single-flow traffic) between instances. This is ideal for tightly coupled, latency-sensitive workloads like HPC or real-time distributed systems.

Answer

Use a Spread placement group across multiple Availability Zones to maximize fault tolerance.

Answer

Use the default placement strategy without specifying a placement group.

Answer

Use a placement group of type Partition to ensure independent failure of each instance.

Question 4

A compliance archive writes one log file per day to Amazon S3. The logs are almost never accessed after day 30, but if they are needed they must still be retrievable in milliseconds. They must be deleted automatically after one year. Which two lifecycle settings should you apply? Select two.

Accepted Answer

Transition the objects to S3 Glacier Instant Retrieval after 30 days.. Option A is correct because S3 Glacier Instant Retrieval provides millisecond retrieval times for archived data, meeting the requirement that logs must be retrievable in milliseconds after 30 days. This storage class is designed for long-lived, rarely accessed data that still needs immediate access, making it ideal for compliance archives that are almost never accessed but must be available instantly when needed.

Answer

Transition the objects to S3 Standard-IA after 30 days.

Answer

Keep the logs in S3 Standard indefinitely and delete them manually when needed.

Answer

Replicate the logs to another Region for cheaper archival storage.

Question 5

A low-latency market-data engine runs 10 EC2 instances that exchange small messages thousands of times per second. The team wants the lowest possible network latency and jitter, and they can tolerate single-AZ placement for this tier because another layer handles disaster recovery. Which changes should they make? Select three.

Accepted Answer

Use a cluster placement group for the instances.. A cluster placement group is designed for low-latency, high-throughput scenarios by ensuring instances are in close proximity within a single Availability Zone, which minimizes network latency and jitter. This directly meets the requirement for the lowest possible network latency and jitter for the market-data engine.

Answer

Use a spread placement group to maximize low-latency communication across the fleet.

Answer

Distribute the instances across multiple Availability Zones to reduce intra-cluster latency.

Question 6

A high-volume telemetry pipeline writes streaming click events that must be processed by multiple independent consumers. Which service is most appropriate?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is the most appropriate service because it is designed for real-time streaming data ingestion and processing. It can capture and store terabytes of data per hour from hundreds of thousands of sources, such as click events, and allows multiple independent consumers to read and process the same stream concurrently using the Kinesis Client Library (KCL) or enhanced fan-out with dedicated throughput.

Answer

AWS DataSync

Answer

Amazon EBS

Answer

Amazon Route 53

Question 7

A Lambda function for a IoT ingestion API needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, automatically rotating, and managing secrets such as database passwords. With rotation enabled, Secrets Manager can automatically rotate the password every 30 days without requiring custom code, and it integrates natively with Lambda via the AWS SDK to retrieve the secret at runtime, avoiding storage in environment variables.

Answer

A KMS-encrypted Lambda environment variable

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

An encrypted object in Amazon S3

Question 8

A media company runs a batch job that processes image thumbnails. The job can be restarted from checkpoints and does not have user-facing SLAs. The batch capacity can tolerate interruptions. Which EC2 purchasing option is the best cost optimization choice?

Accepted Answer

Use EC2 Spot Instances, accepting the possibility of interruptions and using checkpoints to resume.. Spot Instances offer significant cost savings (up to 90% compared to On-Demand) and are ideal for fault-tolerant, stateless, or checkpointable workloads. Since the batch job can restart from checkpoints and tolerates interruptions, Spot Instances provide the best cost optimization without compromising functionality.

Answer

Use On-Demand Instances because interruptions are not allowed for production workloads.

Answer

Purchase Reserved Instances because they provide a discount regardless of the workload timing.

Answer

Buy Savings Plans because they guarantee capacity and remove the risk of interruptions entirely.

Question 9

A legacy market-data service runs on EC2 and exposes a custom TCP protocol. Clients must connect over TCP with very low latency, and the team wants static IP addresses at the load-balancing layer. Which AWS service is the best fit?

Accepted Answer

Network Load Balancer, because it supports TCP, static IPs, and very low latency.. The Network Load Balancer (NLB) operates at Layer 4, supports TCP traffic natively, provides static IP addresses per Availability Zone, and delivers very low latency by processing packets without inspecting application-layer headers. This makes it the ideal choice for a legacy market-data service that requires a custom TCP protocol and fixed IPs at the load-balancing layer.

Answer

Application Load Balancer, because it provides advanced routing for all protocols.

Answer

Amazon API Gateway, because it can front any network protocol with throttling.

Answer

Amazon CloudFront, because it can route traffic to EC2 instances at the edge.

Question 10

A company serves mostly static images and JavaScript files from an origin in one AWS Region. They want to reduce origin load and improve global performance. Which change most directly increases cache-hit ratio for static assets while avoiding stale content?

Accepted Answer

Use versioned file names (e.g., app.abc123.js) and configure a long TTL with appropriate revalidation behavior.. Option B is correct because using versioned file names (e.g., app.abc123.js) allows you to set a long Cache-Control max-age TTL (e.g., one year) without risking stale content. When the file changes, the new version gets a new URL, so clients and edge caches immediately fetch the fresh object, maximizing cache hits for unchanged assets while avoiding stale content.

Answer

Set Cache-Control headers on the origin to always be no-cache so clients revalidate frequently.

Answer

Disable query string forwarding so all URLs without query strings share one cached object even when content differs.

Answer

Forward all headers, including cookies, to maximize personalization in edge cached responses.

Question 11

Based on the exhibit, what is the most appropriate fix so the workload in Account A can access the S3 bucket in Account B without using long-lived access keys?

Accepted Answer

Create an IAM role in Account B, trust Account A's AppRole to assume it with STS, and then access the bucket using temporary credentials.. Option A is correct because it uses AWS Security Token Service (STS) to allow the workload in Account A to assume an IAM role in Account B, obtaining temporary credentials that grant access to the S3 bucket. This eliminates the need for long-lived access keys and follows the principle of least privilege, as the role can be scoped to specific S3 actions and resources.

Answer

Attach AmazonS3FullAccess to the instance profile role in Account A and keep using the same direct access path.

Answer

Add an SCP to Account A that allows S3 actions against buckets in Account B.

Answer

Enable S3 versioning on the bucket so cross-account requests are automatically trusted.

Question 12

A media archive needs low-latency full-text search across product descriptions and filtered attributes. Which managed service is most suitable?

Accepted Answer

Amazon OpenSearch Service. Amazon OpenSearch Service is the correct choice because it provides a managed, scalable solution for full-text search and real-time analytics on large volumes of data. It supports low-latency queries across product descriptions and filtered attributes through its inverted index and query DSL, making it ideal for media archive search use cases.

Answer

AWS Config

Answer

Amazon EFS

Answer

Amazon SQS

Question 13

A company serves the same public content to many users through Amazon CloudFront. The origin is experiencing increased fetches because CloudFront cache hit rate is dropping. Most requests include an Authorization header and a custom header that changes per user. The response content is identical regardless of these headers. What change should the solutions architect make to restore a high cache hit rate?

Accepted Answer

Create a custom cache policy that excludes the Authorization header and the per-user changing custom header from the cache key.. Option A is correct because CloudFront's default cache key includes the Authorization header and all custom headers, which causes unique cache entries for each user even though the content is identical. By creating a custom cache policy that excludes these headers from the cache key, CloudFront will treat requests with different header values as the same cached object, restoring a high cache hit rate and reducing origin fetches.

Answer

Lower the TTL to a few seconds so cached objects expire sooner and origin fetches decrease.

Answer

Disable caching for the affected paths so CloudFront always forwards all headers to the origin.

Answer

Force all requests to use query-string based caching and include all headers in the cache policy for correctness.

Question 14

A media company serves versioned JavaScript and CSS files from Amazon S3 through CloudFront. After each release, the cache hit ratio drops sharply because the same distribution also fronts a personalized API path, and the current cache policy forwards cookies, all query strings, and several headers to every origin request. The static assets already use content-hashed filenames. Which two changes will most directly improve cache hit ratio for the static assets without changing the application behavior? Select two.

Accepted Answer

Create a dedicated cache behavior for the static asset path that excludes cookies, query strings, and unneeded headers from the cache key.. Option A is correct because creating a dedicated cache behavior for the static asset path (e.g., /static/*) allows you to configure a cache policy that excludes cookies, query strings, and unneeded headers from the cache key. Since the static assets use content-hashed filenames, they are immutable and do not vary by user-specific attributes. By removing these variables from the cache key, CloudFront can serve the same cached object to all users, drastically improving the cache hit ratio.

Answer

Increase the size of the S3 bucket’s underlying storage to absorb more origin traffic.

Answer

Add Lambda@Edge logic to append a timestamp to every asset request so updates are always fetched immediately.

Answer

Disable compression so CloudFront can treat each object as a separate cache entry.

Question 15

A containerized service fleet running on EC2 instances needs to share user-uploaded files and access them with low latency. The workload is bursty: sometimes dozens of instances concurrently read the same directory for short periods, and then traffic drops. Which Amazon EFS configuration best matches these performance needs?

Accepted Answer

Use Amazon EFS General Purpose performance mode and Throughput mode set to Bursting.. Option A is correct because the workload is bursty with concurrent reads of the same directory, which favors the General Purpose performance mode for its strong consistency and lower latency per operation. The Bursting Throughput mode is ideal for bursty traffic as it allows the file system to accumulate burst credits during idle periods and consume them during high-demand spikes, matching the described pattern without incurring additional costs.

Answer

Use Amazon EFS Max I/O performance mode with Throughput mode set to Provisioned.

Answer

Use Amazon EFS General Purpose performance mode with Throughput mode set to Provisioned.

Answer

Use Amazon EFS Max I/O performance mode with Throughput mode set to Bursting.

Question 16

Based on the exhibit, a CI pipeline assumes a shared deployment role in Account A. The role can access several artifact prefixes, but this pipeline must only upload to teamA/prod/ and decrypt using a single KMS key for this execution. Changing the shared role would affect other pipelines. Which approach should the pipeline use?

Accepted Answer

Pass an inline session policy in the AssumeRole request that further restricts the temporary credentials to teamA/prod/ and the approved KMS key.. Option B is correct because an inline session policy passed in the AssumeRole request allows you to further restrict the temporary credentials' permissions without modifying the shared role itself. This ensures the pipeline can only upload to teamA/prod/ and decrypt using the specified KMS key, while other pipelines using the same role remain unaffected.

Answer

Attach a permission boundary to the pipeline's assumed session so the temporary credentials cannot exceed the shared role permissions.

Answer

Add an SCP to Account A that forces all roles to use the same S3 prefix and key whenever they are assumed.

Answer

Change the role trust policy to allow only the teamA/prod/ prefix and the key ARN because trust policies can scope S3 object paths directly.

Question 17

An order system receives events and uses a Lambda function to write each order into a database. During traffic spikes, the database sometimes throttles, and Lambda retries lead to occasional message loss in the event flow. The team wants buffering, automatic retries, and a way to isolate messages that repeatedly fail so they can be inspected later. What design change best meets this need?

Accepted Answer

Use Amazon SQS as a buffer between the event source and Lambda, with an SQS dead-letter queue (DLQ).. Option B is correct because Amazon SQS acts as a durable buffer between the event source and Lambda, absorbing traffic spikes and decoupling the producer from the consumer. The SQS dead-letter queue (DLQ) automatically captures messages that exceed the configured maximum retries, allowing the team to inspect and reprocess them later without loss. This design provides the required buffering, automatic retries via the Lambda event source mapping, and isolation of repeatedly failing messages.

Answer

Send events directly from EventBridge to Lambda without any queue to simplify the flow.

Answer

Use SNS fan-out to multiple Lambda functions, but keep no retry logic and no DLQ.

Answer

Store events in an S3 bucket and trigger Lambda immediately after each upload, without using DLQs.

Question 18

A media company runs a fleet of EC2 instances using Auto Scaling across multiple instance families (for example, m-series and c-series) in a single region. The business wants to commit to steady usage for one year to reduce cost, but the application team must retain flexibility to switch instance families and scale up/down as demand changes. They need the cost-reduction approach that best matches this flexibility. Which option is the best fit?

Accepted Answer

Purchase Compute Savings Plans so the commitment applies regardless of instance family changes within the selected scope.. Compute Savings Plans provide the most flexibility because they apply to any EC2 instance family (including m-series and c-series) within a region, automatically adjusting to instance family changes and scaling. This matches the requirement to commit to steady usage for one year while retaining the ability to switch families and scale up/down, offering up to 66% savings over On-Demand without locking the application to a specific instance type.

Answer

Purchase Standard Reserved Instances tied to a specific instance family and region, so the application can only run on the selected family.

Answer

Purchase Spot Instances for all capacity and disable On-Demand fallback to guarantee the lowest cost.

Answer

Rely only on On-Demand and reduce cost by using a CloudFront-only approach for all dynamic content.

Question 19

An organization hosts the same public API in two AWS Regions. Normal traffic should go to the primary Region. If the primary endpoint becomes unhealthy, Route 53 should automatically route users to the secondary Region. What is the best Route 53 configuration approach?

Accepted Answer

Use Route 53 failover routing with health checks that mark the primary as unhealthy and fail over to the secondary.. Route 53 failover routing is designed for active-passive configurations where traffic is directed to a primary resource unless a health check marks it as unhealthy, at which point all traffic automatically shifts to the secondary resource. This directly matches the requirement of routing normal traffic to the primary Region and failing over to the secondary Region only when the primary endpoint becomes unhealthy.

Answer

Use simple routing with one record that contains both regions as weighted targets.

Answer

Use weighted routing and set the secondary Region weight to 0 until needed.

Answer

Use latency-based routing so requests go to the region with the lowest latency, regardless of health.

Question 20

You deploy a Web ACL with an AWS WAF rate-based rule intended to limit abusive traffic to your API. After the deployment, attackers still reach the backend service. ALB access logs show requests arrive at the ALB, but WAF logs indicate the Web ACL is not evaluating those requests.

Which change most likely fixes the issue?

Accepted Answer

Associate the Web ACL with the Application Load Balancer resource ARN so WAF evaluates requests sent to that ALB.. The Web ACL must be explicitly associated with the ALB resource ARN for AWS WAF to evaluate incoming requests. Without this association, WAF does not inspect traffic, allowing attackers to bypass the rate-based rule and reach the backend service. Associating the Web ACL with the ALB ensures that all requests to the ALB are evaluated by the WAF rules before being forwarded to the target group.

Answer

Add a security group rule that drops inbound traffic from the attacker IP range at the instances' ENIs.

Answer

Create a target group stickiness policy so WAF can count requests consistently per client IP.

Answer

Enable AWS Shield Advanced but keep the Web ACL unattached because Shield automatically applies rate limiting.