SAA-C03 Practice Exam 53 — 20 Questions

Question 1

A marketing site has EC2 instances that are oversized based on CPU, memory, and network utilisation. Which AWS service should identify rightsizing recommendations? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer analyzes historical utilization metrics (CPU, memory, network) of EC2 instances and generates rightsizing recommendations to reduce cost without compromising performance. It uses machine learning to identify over-provisioned resources and suggests instance type changes, all without requiring custom scripts or agents.

Answer

AWS Shield

Answer

AWS DataSync

Answer

AWS Artifact

Question 2

Based on the exhibit, an application runs on Amazon Aurora MySQL. The writer instance is frequently near 85% CPU while the reader instance is under 20% CPU. Application traces show that most of the database traffic is read-only SELECT queries, but the code currently sends all queries to the writer endpoint. What should the solutions architect recommend to improve performance with the smallest functional change?

Accepted Answer

Point read-only database traffic to the Aurora reader endpoint and keep writes on the writer endpoint.. Option B is correct because the Aurora reader endpoint distributes read-only traffic across all available reader instances, offloading the writer instance and reducing its CPU utilization. Since the application traces show most traffic is read-only SELECT queries, this change requires only modifying the connection string for reads while keeping writes on the writer endpoint, making it the smallest functional change.

Answer

Increase the writer instance size and keep all traffic on the writer endpoint.

Answer

Convert the cluster to a Multi-AZ RDS PostgreSQL deployment to get automatic failover and better read performance.

Answer

Enable cross-Region read replicas so SELECT queries are routed to a remote Region for improved performance.

Question 3

Based on the exhibit, a trading platform exposes a custom binary TCP protocol to partner systems. The service must preserve the original client source IP for rate limiting, support TLS pass-through to the application, and minimize network latency. The team also wants a simple architecture that can scale across multiple Availability Zones. What load balancing option should the solutions architect choose?

Accepted Answer

Network Load Balancer with TCP listeners and target groups in the private subnets.. A Network Load Balancer (NLB) with TCP listeners is the correct choice because it preserves the original client source IP address (via the Proxy Protocol header or direct preservation in the TCP flow), supports TLS pass-through (no decryption at the load balancer), and minimizes latency by operating at Layer 4. It also scales across multiple Availability Zones with simple target groups in private subnets, meeting all stated requirements.

Answer

Application Load Balancer with path-based routing and HTTP/2 enabled.

Answer

Amazon API Gateway REST API integrated directly with the EC2 instances.

Answer

CloudFront in front of the EC2 instances to cache and terminate the client connections.

Question 4

A production log archive runs continuously on EC2 with predictable usage for the next three years. The team wants a discount while retaining some instance-family flexibility. What should they buy? The design must avoid adding custom operational scripts.

Accepted Answer

Compute Savings Plan. The Compute Savings Plan (C) offers the largest discount (up to 66%) in exchange for a commitment to a consistent amount of compute usage (measured in $/hour) for a 1- or 3-year term, while still allowing flexibility across instance families, sizes, OS, tenancy, and regions. This matches the predictable three-year workload and the requirement for instance-family flexibility without custom scripts.

Answer

S3 Intelligent-Tiering

Answer

Dedicated Instances

Answer

Spot Instances only

Question 5

A Lambda function for a claims portal needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, automatically rotating, and managing secrets like database passwords. It supports automatic rotation every 30 days via a built-in Lambda rotation function, and it avoids storing the password in environment variables, which are visible in the Lambda console and logs.

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

An encrypted object in Amazon S3

Answer

A KMS-encrypted Lambda environment variable

Question 6

A marketing site runs on x86 EC2 instances and uses open-source software with no architecture-specific licensing restriction. What should be evaluated to reduce compute cost? The architecture review board prefers a managed AWS-native control.

Accepted Answer

AWS Graviton-based instances after performance testing. Option C is correct because AWS Graviton-based instances use ARM-based custom processors that offer up to 40% better price-performance compared to comparable x86 instances for many workloads. Since the marketing site runs open-source software with no architecture-specific licensing restrictions, migrating to Graviton after performance testing can significantly reduce compute costs while leveraging a managed AWS-native control (e.g., EC2 Auto Scaling groups with Graviton instance types).

Answer

Cross-Region data replication for all data

Answer

io2 Block Express volumes for all instances

Answer

Dedicated Hosts by default

Question 7

A Lambda function for a healthcare document service needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it is designed specifically for storing and automatically rotating database credentials. It supports native rotation for Amazon RDS, Redshift, and DocumentDB with a built-in Lambda rotation function, and it can rotate secrets on a schedule (e.g., every 30 days) without storing the password in environment variables. This meets the healthcare document service's requirement for automatic rotation and secure storage.

Answer

A KMS-encrypted Lambda environment variable

Answer

An encrypted object in Amazon S3

Answer

AWS Systems Manager Parameter Store SecureString without automation

Question 8

A latency-sensitive trading workload runs on 6 EC2 instances. You must distribute the instances so they do NOT share the same underlying hardware rack, reducing the risk of correlated rack-level faults. Which EC2 placement group strategy best meets this requirement?

Accepted Answer

Spread placement group. A Spread placement group is the correct choice because it ensures each EC2 instance is placed on distinct underlying hardware (different racks), eliminating shared fault domains. This directly meets the requirement to avoid correlated rack-level failures for latency-sensitive trading workloads.

Answer

Cluster placement group

Answer

Partition placement group

Answer

No placement group, rely on the default scheduler

Question 9

A media company keeps application logs in Amazon S3 for 400 days. The logs are read heavily for the first 30 days, occasionally for the next 90 days, and almost never after that. The team wants to lower storage cost without affecting retention requirements. Which two lifecycle transitions should it configure? Select two.

Accepted Answer

Transition the objects to S3 Standard-IA after 30 days.. Option A is correct because after the first 30 days of heavy read access, transitioning to S3 Standard-IA reduces storage costs while still providing low-latency retrieval for the occasional reads that occur over the next 90 days. S3 Standard-IA is designed for data accessed infrequently but requires rapid access, matching the usage pattern described.

Answer

Transition the objects to S3 One Zone-IA after 30 days.

Answer

Keep the objects in S3 Standard for the full 400 days.

Answer

Use only S3 Intelligent-Tiering and never add archival transitions.

Question 10

A Lambda function processes CPU-heavy JSON transformations and often runs slower than expected. The team wants to improve performance without changing the code. What should they try first?

Accepted Answer

Increase the Lambda memory setting. Increasing the Lambda memory setting allocates more CPU power proportionally, as AWS Lambda allocates CPU credits linearly with memory (up to 10,240 MB). For CPU-heavy JSON transformations, this directly reduces execution time without any code changes, making it the simplest and most effective first step.

Answer

Move the function to Amazon S3

Answer

Change the function to an ALB target

Answer

Disable CloudWatch logging

Question 11

A Lambda function for a order processing API needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is designed to securely store, retrieve, and automatically rotate database credentials on a schedule. It natively supports rotation every 30 days via a built-in Lambda rotation function, and it avoids storing the password in environment variables, meeting both security and compliance requirements.

Answer

An encrypted object in Amazon S3

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

A KMS-encrypted Lambda environment variable

Question 12

A microservice needs to read exactly one secret value from AWS Secrets Manager. Which IAM permission statement provides the best least-privilege approach to allow the microservice to retrieve that secret value?

Accepted Answer

Allow secretsmanager:GetSecretValue only on the specific secret ARN required by the service. Option B is correct because it grants the minimum necessary permission—secretsmanager:GetSecretValue—scoped to the exact Amazon Resource Name (ARN) of the secret the microservice needs. This follows the AWS least-privilege principle by restricting access to a single action on a single resource, preventing the microservice from reading other secrets even if compromised.

Answer

Allow secretsmanager:GetSecretValue on all secrets using Resource: "*"

Answer

Allow secretsmanager:* on the secret name prefix using a wildcard pattern

Answer

Allow secretsmanager:GetSecretValue on the AWS account root ARN

Question 13

A marketing portal serves private PDF files stored in Amazon S3 through CloudFront. Users authenticate to the portal first, and each download link must expire after one hour. The S3 origin must never be directly reachable from the internet. Which three actions should be used? Select three.

Accepted Answer

Use CloudFront signed URLs or signed cookies with a one-hour expiration window.. Option A is correct because CloudFront signed URLs or signed cookies allow you to restrict access to content for a specific time window. By setting the expiration to one hour, you ensure that each download link becomes invalid after that period, meeting the requirement for expiring links. This approach also keeps the S3 bucket private, as users must authenticate through CloudFront rather than accessing S3 directly.

Answer

Expose the S3 bucket through the static website endpoint and secure it with security group rules.

Answer

Use an AWS WAF web ACL attached to the S3 bucket instead of CloudFront.

Question 14

A marketing team runs a report-generation process that must execute once per day at 02:00 UTC. It usually completes in 10315 minutes, but sometimes takes up to 45 minutes due to varying data volumes. They currently run the workload on an EC2 instance that is always on, which wastes money during off-hours. The team wants to minimize operational overhead and pay mainly for actual execution time.

What is the best architecture choice?

Accepted Answer

Use an EventBridge schedule to run the report as an Amazon ECS task on AWS Fargate and write results to S3.. Amazon ECS on AWS Fargate is the best choice because it eliminates the need to manage servers, scales automatically, and charges only for the vCPU and memory resources consumed during task execution. The EventBridge schedule triggers the Fargate task at 02:00 UTC, and the report is written to S3, which provides durable, cost-effective storage. This architecture minimizes operational overhead and cost by avoiding an always-on EC2 instance.

Answer

Use a scheduled Amazon EC2 Auto Scaling group that keeps a minimum of one instance running at all times.

Answer

Use AWS Lambda triggered by an EventBridge schedule at 02:00 UTC and write results to S3.

Answer

Use an EMR cluster provisioned daily with manual teardown to ensure the instance is always available before 02:00.

Question 15

A public API currently uses API Gateway REST APIs and Lambda. Traffic is low most of the day, but marketing runs a predictable traffic spike every weekday at 09:00 UTC. Users complain about cold starts during the first few minutes of the spike, and the team wants to avoid paying for provisioned concurrency all day. Which two changes should they make? Select two.

Accepted Answer

Switch from REST APIs to HTTP APIs if the feature set is sufficient.. Option A is correct because HTTP APIs are designed to be faster and more cost-effective than REST APIs, with up to 71% lower latency and 60% lower cost per request. This reduces the impact of cold starts by minimizing the overhead of request processing, and the cost savings align with the team's goal of avoiding all-day provisioned concurrency costs.

Answer

Keep provisioned concurrency at the maximum level 24/7.

Answer

Move the API to a single t3.nano EC2 instance.

Answer

Add an S3 gateway endpoint to reduce cold starts.

Question 16

A marketing team uses CloudFront with an S3 origin to serve a single-page web app. After a release, CloudFront cache hit ratio dropped sharply. The app requests the same static JS and CSS assets, but each request includes a unique tracking query parameter (for example, ?utm_source=campaign123, campaign456, etc.). You want CloudFront to cache those assets efficiently even when the tracking query parameter changes. What should you do?

Accepted Answer

Update the CloudFront cache policy so the cache key ignores the tracking query parameter, while still using the path and other essential headers.. Option B is correct because CloudFront's cache key determines whether a request is served from the cache or forwarded to the origin. By configuring a cache policy that ignores the tracking query parameter (e.g., utm_source), CloudFront treats all requests for the same asset path as identical, regardless of the unique tracking parameter. This allows the same JS and CSS files to be cached once and served for all campaign variations, restoring the cache hit ratio.

Answer

Create a cache policy that forwards the query string to the origin and varies the cache key by all query parameters.

Answer

Enable S3 origin access control and keep the existing default cache policy, because origin access changes caching behavior automatically.

Answer

Set the CloudFront Time-to-Live (TTL) to 0 seconds to ensure the origin always serves the latest asset content.

Question 17

A media archive requires consistent high IOPS for a transactional database on EC2. Which EBS volume type is most suitable?

Accepted Answer

Provisioned IOPS SSD such as io2. The scenario requires consistent high IOPS for a transactional database, which demands low-latency, predictable performance. Provisioned IOPS SSD volumes like io2 are designed specifically for such workloads, offering up to 256,000 IOPS per volume with 99.999% durability, making them the most suitable choice for consistent high IOPS.

Answer

st1 Throughput Optimized HDD

Answer

Instance store only

Answer

sc1 Cold HDD

Question 18

A order processing API uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend?

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS allows EC2 instances to authenticate to PostgreSQL using a short-lived token generated via the AWS CLI or SDK, instead of a static password. By assigning an IAM instance role to the EC2 instance, the application can obtain the token without storing any credentials on the instance, meeting both security requirements. This approach uses the IAM role's temporary security credentials to generate a password token that is valid for 15 minutes, after which a new token must be obtained.

Answer

Store the database password in user data

Answer

Use a security group rule that allows only application instances

Answer

Embed the database password in the AMI

Question 19

A risk simulation workload uses CloudWatch Logs heavily. Retaining all debug logs forever is increasing costs. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

CloudWatch Logs retention policies per log group. CloudWatch Logs retention policies allow you to set per-log-group expiration rules (e.g., 30 days, 90 days) to automatically delete old log events, directly reducing storage costs for debug logs that are no longer needed. This is a managed, AWS-native control that requires no custom scripts or external tools, aligning with the architecture review board's preference.

Answer

AWS Config aggregation

Answer

CloudWatch detailed monitoring on all instances

Answer

Route 53 health checks

Question 20

A public API for a B2B file exchange site is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. Option C is correct because API Gateway's JWT authorizer natively validates JSON Web Tokens issued by an external OpenID Connect (OIDC) provider. It verifies the token's signature, expiry, and issuer against the OIDC provider's JWKS endpoint without requiring custom Lambda code, making it the simplest and most secure choice for standards-based token authentication.

Answer

API keys only

Answer

IAM authorization for all internet users

Answer

A VPC endpoint policy