SAA-C03 Practice Exam 53 — 20 Questions

Question 1

Based on the exhibit, a media company serves versioned JavaScript and CSS files from an Amazon S3 origin through CloudFront. After a frontend release, the cache hit ratio dropped sharply even though the file names are versioned. The application team says the browser requests include the same Authorization header on every asset request because the frontend and API share one domain. What should the solutions architect do to improve CloudFront cache hit ratio without changing the application authentication model for the API?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudFront cache policy that excludes Authorization, cookies, and unnecessary query strings from the cache key.. The sharp drop in cache hit ratio is caused by the Authorization header being included in the cache key, which makes each request unique even though the file names are versioned. By creating a CloudFront cache policy that excludes the Authorization header (and unnecessary cookies/query strings) from the cache key, CloudFront can serve cached responses to requests with different Authorization headers, restoring the cache hit ratio without altering the application's authentication model for the API.

Answer

Enable S3 Transfer Acceleration on the bucket so CloudFront fetches objects faster from the origin.

Answer

Switch the origin from S3 to an Application Load Balancer so CloudFront can cache dynamic responses more effectively.

Answer

Configure CloudFront to forward every viewer header to the origin so the origin can decide whether the content is cacheable.

Question 2

A production application writes to an Amazon Aurora PostgreSQL cluster. Users report that during business-hour reporting runs, write latency increases. The application team wants to keep the writer focused on OLTP writes while still providing low-latency reads for reporting queries. What architectural approach should the solutions architect recommend?

Accepted Answer

Create Aurora read replicas and direct reporting read-only connections to the cluster reader endpoint.. A is correct because creating Aurora read replicas and directing reporting read-only connections to the cluster reader endpoint offloads read traffic from the writer instance. This allows the writer to focus on OLTP writes, while the reader endpoint load-balances read-only queries across replicas, providing low-latency reads for reporting without impacting write performance.

Answer

Resize the writer instance to a larger class so it can handle both writes and reads with fewer slowdowns.

Answer

Enable cross-region replication for the entire cluster so reporting always runs in the secondary Region.

Answer

Disable read replicas and use caching only in the application layer, keeping all queries connected to the writer endpoint.

Question 3

A company runs EC2 workloads in one region with somewhat steady overall demand. Over time, the team frequently changes instance families (for performance/optimization) and sometimes changes instance size, but wants predictable cost discounts. Which purchase option provides the best balance of cost savings and flexibility?

Accepted Answer

Savings Plans (Compute Savings Plans), scoped for flexible EC2 usage in the region.. Compute Savings Plans offer the best balance of cost savings and flexibility because they provide up to 66% discount in exchange for a commitment to a consistent amount of compute usage (measured per hour) in a region, but they automatically apply to any EC2 instance family, size, OS, or tenancy, as well as AWS Fargate and Lambda. This matches the team's need to frequently change instance families and sizes while still getting predictable discounts, unlike Standard RIs which lock you to a specific family and size.

Answer

Standard Reserved Instances for a specific instance family and size only.

Answer

Spot Instances for all workloads, assuming interruptions will never happen.

Answer

On-Demand only, because it avoids the complexity of purchase option scopes.

Question 4

A telemetry pipeline uses RDS MySQL and receives many read-only reporting queries that slow down the primary database. What should the architect add? The architecture review board prefers a managed AWS-native control.

Accepted Answer

RDS read replica and route reporting queries to it. RDS read replicas are designed specifically to offload read-heavy workloads like reporting queries from the primary database. They provide an asynchronous read-only copy of the database that can handle SELECT statements without impacting the primary's write performance. This is a fully managed AWS-native solution that aligns with the architecture review board's preference.

Answer

Multi-AZ standby and route reads to the standby

Answer

S3 lifecycle policy

Answer

A larger NAT gateway

Question 5

A company hosts an application on EC2 instances in private subnets. The instances must (1) read objects from Amazon S3 and (2) retrieve secrets from AWS Secrets Manager. The team currently sends all outbound traffic through a NAT gateway to reach both services. They want to reduce monthly cost while keeping traffic private (no internet egress) and without changing application logic. Which change is the most cost-effective?

Accepted Answer

Create a Gateway VPC endpoint for S3 and an Interface VPC endpoint for Secrets Manager, and ensure the subnet route tables / endpoint routing directs those service calls to the endpoints instead of the NAT gateway.. Gateway VPC Endpoints for S3 and Interface VPC Endpoints for Secrets Manager allow private connectivity to these AWS services without traversing the internet or a NAT gateway. This eliminates NAT gateway hourly charges and data processing fees, reducing costs while keeping traffic within the AWS network. The application logic remains unchanged as the endpoints are accessed via the same DNS names, with route tables directing traffic to the endpoints instead of the NAT gateway.

Answer

Keep the NAT gateway, but add AWS WAF rules to block non-service outbound requests to reduce NAT usage.

Answer

Disable IPv4 on the VPC subnets and rely on IPv6-only egress to reduce NAT gateway costs.

Answer

Replace the NAT gateway with a VPC firewall appliance instance to proxy outbound calls and reduce NAT fees.

Question 6

A public API for a customer analytics portal is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used? The design must avoid adding custom operational scripts.

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. A JWT authorizer in API Gateway can validate tokens issued by an external OpenID Connect (OIDC) provider without requiring custom code. The JWT authorizer automatically verifies the token's signature, expiry, and issuer against the OIDC provider's JWKS endpoint, meeting the requirement for standards-based authentication and avoiding custom operational scripts.

Answer

API keys only

Answer

IAM authorization for all internet users

Answer

A VPC endpoint policy

Question 7

Based on the exhibit, the company stores application logs in Amazon S3 for 400 days. The logs are read heavily for the first 30 days, occasionally for the next 90 days, and very rarely after that. Retrieval after day 120 can take up to several hours, but the data must remain available until day 400. Which lifecycle policy is the most cost-effective fit?

Accepted Answer

Transition logs to S3 Standard-IA after 30 days, then to S3 Glacier Flexible Retrieval after 120 days, and expire them at 400 days.. It aligns the storage class transitions with the access patterns: S3 Standard for the first 30 days (heavy reads), S3 Standard-IA for the next 90 days (occasional reads), and S3 Glacier Flexible Retrieval for the remaining period (rare access, with retrieval up to several hours acceptable). This minimizes storage costs while ensuring data availability until day 400, where lifecycle expiration removes the objects.

Answer

Keep all logs in S3 Standard for 400 days and enable requester pays to reduce the company's bill.

Answer

Transition logs directly from S3 Standard to S3 Glacier Deep Archive after 30 days and expire them at 400 days.

Answer

Move logs to S3 Intelligent-Tiering only and disable lifecycle transitions because access is unpredictable.

Question 8

A public API for a customer analytics portal is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. The scenario requires standards-based token authentication from an external OpenID Connect (OIDC) provider. API Gateway's JWT authorizer natively validates JSON Web Tokens (JWTs) issued by OIDC providers by verifying the token's signature against the provider's JWKS endpoint, checking the `iss` and `aud` claims, and enforcing token expiration. This directly meets the requirement without needing custom Lambda authorizers or additional infrastructure.

Answer

API keys only

Answer

IAM authorization for all internet users

Answer

A VPC endpoint policy

Question 9

A fintech company has a two-Region DR requirement: RPO must be within 15 minutes and RTO must be under 2 hours. To control cost, they do not want to run full production infrastructure in the secondary Region continuously. They plan to continuously replicate the database and keep the application infrastructure in the secondary Region prepared, but at reduced capacity. Which DR strategy best matches this requirement and accurately describes their plan?

Accepted Answer

Warm standby: keep the essential parts of the application running in the secondary Region at reduced capacity, while using database replication to meet the RPO.. Warm standby is the correct strategy because it runs a scaled-down version of the production application in the secondary Region continuously, with database replication (e.g., Amazon RDS Multi-Region or Aurora Global Database) meeting the 15-minute RPO. The reduced-capacity infrastructure can be scaled up within the 2-hour RTO during a disaster, balancing cost and recovery requirements.

Answer

Pilot light: keep only minimal components (for example, replicated storage and a small amount of core services), so the app scales up during a disaster.

Answer

Active-active: run the application fully in both Regions with synchronized writes and share traffic continuously.

Answer

Cold standby: store backups in the secondary Region and provision all infrastructure only during a disaster.

Question 10

Your security team needs to detect and alert on any attempt to change sensitive policies, specifically S3 bucket policy changes and KMS key policy changes. The team wants alerts within minutes, and logs must be centrally retained for forensics. Which design best meets these detective control requirements using AWS-native services?

Accepted Answer

Enable CloudTrail management events and configure an EventBridge rule to send notifications for PutBucketPolicy and PutKeyPolicy API calls, while also delivering CloudTrail logs to a dedicated S3 bucket for retention.. CloudTrail management events capture all API calls for S3 bucket policies (PutBucketPolicy) and KMS key policies (PutKeyPolicy) by default, and EventBridge rules can trigger near-real-time alerts (within minutes) for these specific API calls. Additionally, delivering CloudTrail logs to a dedicated S3 bucket provides centralized, immutable retention for forensic analysis, meeting both the alerting and retention requirements.

Answer

Rely on AWS Config resource snapshots only; use the snapshots to infer policy changes and generate alerts from the daily compliance summary reports.

Answer

Enable S3 access logging on the affected buckets only; treat these logs as sufficient evidence for KMS key policy modifications.

Answer

Turn on CloudWatch Logs for the S3 bucket and KMS key; alert on any log line containing the word 'policy' to detect changes.

Question 11

A public API is served through an Application Load Balancer and protected by AWS WAF. The team wants AWS to automatically block clients that send too many requests from the same IP address within a short time window. Which AWS WAF feature is the best fit?

Accepted Answer

Use a rate-based rule in AWS WAF to block when requests per IP exceed a configured threshold over the WAF rate-based evaluation window.. A rate-based rule in AWS WAF is specifically designed to automatically block clients when the number of requests from a single IP address exceeds a configured threshold within a rolling evaluation window (typically 5 minutes). This feature directly addresses the requirement to mitigate high request rates from the same IP, making it the best fit for the described use case.

Answer

Use an AWS IAM policy on the ALB listener to deny requests when request count exceeds a threshold.

Answer

Enable S3 server access logs for the bucket that stores API responses and alert on high log volume.

Answer

Configure an AWS Lambda authorizer to reject requests after the Nth request from an IP address.

Question 12

Based on the exhibit, which design change is the best way to reduce the observed read latency for this DynamoDB-backed service?

Accepted Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table and send repeated read traffic through it.. Adding a DynamoDB Accelerator (DAX) cluster in front of the table reduces read latency by providing an in-memory cache for repeated read traffic. DAX delivers microsecond response times for eventually consistent reads, which directly addresses the observed latency issue without requiring application-level caching or table redesign.

Answer

Increase the on-demand table limits so DynamoDB can automatically absorb more traffic.

Answer

Create a global secondary index on tenantId to distribute the load across more partitions.

Answer

Move the dashboard data into S3 and use Lambda functions to read it on demand.

Question 13

A SOC analyst needs an immutable, centralized audit record of configuration and API changes across multiple AWS accounts. Recently, an operator changed an IAM role trust policy, and investigators must determine exactly which principal made the change and which parameters were used.

Your current setup sends application logs to CloudWatch Logs, but there is no organization-level API audit logging.

Which approach best satisfies the requirement?

Accepted Answer

Enable an AWS Organizations CloudTrail organization trail that delivers management event logs (including IAM) to a centralized S3 bucket in a dedicated audit account, for all regions.. An AWS Organizations CloudTrail organization trail captures management events (including IAM API calls like 'UpdateAssumeRolePolicy') across all accounts in the organization, delivering immutable logs to a centralized S3 bucket in a dedicated audit account. This provides the exact principal ARN, source IP, user agent, and request parameters for every API call, meeting the requirement for a centralized, immutable audit record of configuration and API changes.

Answer

Use CloudWatch Logs metric filters on application logs to infer which principals changed trust policies.

Answer

Rely on GuardDuty alerts to provide the full request parameters for every IAM policy change.

Answer

Enable AWS Config only and store periodic snapshots without CloudTrail management events.

Question 14

A solutions architect is designing an S3 bucket for a claims portal. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to S3 objects, even if a bucket policy or ACL later grants public access. This setting can be applied at the account or bucket level and ensures that all access is denied to anonymous users, meeting the requirement without custom scripts.

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Answer

Enable S3 Transfer Acceleration

Question 15

Based on the exhibit, the team serves versioned JavaScript and CSS files from an S3 origin through CloudFront. After a release, the cache hit ratio dropped and origin fetches increased sharply. What change best reduces both CloudFront and S3 costs without changing the application’s public behavior?

Accepted Answer

Create a cache policy that excludes Authorization, cookies, and unnecessary query strings, and narrow the origin request policy to forward only the headers the S3 origin actually needs.. B is correct because versioned JavaScript and CSS files are immutable, so CloudFront should cache them aggressively. By creating a cache policy that excludes unnecessary headers (like Authorization and cookies) and query strings, and narrowing the origin request policy to forward only required headers, you maximize cache hits and reduce origin fetches. This directly lowers both CloudFront data transfer costs (fewer origin requests) and S3 request costs (fewer GET requests), without altering the application's public behavior.

Answer

Increase the CloudFront price class to include more edge locations.

Answer

Disable CloudFront and serve the files directly from S3 to avoid cache invalidation overhead.

Answer

Use Lambda@Edge to rewrite every request into a unique path so that clients never receive stale files.

Question 16

An application runs on EC2 in us-east-1 and frequently reads objects from an S3 bucket that is physically located in us-west-2. The finance team reports unexpectedly high inter-Region data transfer charges because the application retrieves objects for many user requests. A constraint: the bucket in us-west-2 must remain the system of record for compliance, but the application can read from a replica in us-east-1.

What should the solutions architect do to minimize network spend while meeting the compliance constraint?

Accepted Answer

Enable S3 Cross-Region Replication from the us-west-2 source bucket to a destination bucket in us-east-1, and update the app to read from the us-east-1 bucket.. S3 Cross-Region Replication (CRR) automatically replicates objects from the source bucket in us-west-2 to a destination bucket in us-east-1, satisfying the compliance requirement that the us-west-2 bucket remains the system of record. By updating the application to read from the us-east-1 bucket, all read traffic stays within the same region, eliminating inter-region data transfer charges for object retrievals. This approach directly addresses the cost issue while preserving the original bucket as the authoritative source.

Answer

Create an interface VPC endpoint for S3 in us-east-1 and keep all object reads pointing to the us-west-2 bucket.

Answer

Use VPC peering between two regions and route all requests to the us-west-2 bucket over the peering link.

Answer

Use Route 53 latency-based routing to send users to a us-west-2 web endpoint and keep the S3 bucket unchanged.

Question 17

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The implementation must work across routine deployments without manual intervention.

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) for Systems Manager allow private subnets to access Systems Manager Parameter Store without traversing the internet, using private IP addresses within the VPC. Gateway VPC endpoints for S3 provide a highly available, redundant path to S3 via route table entries, ensuring traffic stays within the AWS network. Together, they eliminate the need for internet gateways or NAT gateways, meeting the requirement for no public internet routing.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 18

Company A stores encrypted log files in its S3 bucket using SSE-KMS with a customer-managed KMS key. A partner application in Company B uploads objects into Company A's bucket using an IAM role in Company B. Uploads fail with an error indicating KMS access is denied (kms:Encrypt not authorized). Neither the partner IAM policy nor the S3 bucket policy currently mentions KMS.

What is the most secure and correct change to allow cross-account uploads to succeed?

Accepted Answer

In Company A's KMS key policy, allow Company B's partner role principal to use the key for kms:Encrypt, kms:GenerateDataKey, and kms:DescribeKey, and also add a matching IAM policy in Company B that grants the partner role those same KMS actions on Company A's key ARN, constrained to the target S3 bucket context when possible.. For cross-account SSE-KMS uploads, the KMS key policy must explicitly grant the external IAM role principal the required KMS actions (kms:Encrypt, kms:GenerateDataKey, and kms:DescribeKey). Additionally, the partner account's IAM policy must also allow those same actions on the key ARN. This dual-permission model is required because KMS does not implicitly trust IAM policies in the key owner's account for cross-account access; the key policy is the authoritative gatekeeper. Option A correctly implements both sides, and constraining to the target S3 bucket context (via kms:ViaService or kms:EncryptionContext) adds a security best practice.

Answer

In Company B's IAM policy, allow kms:Encrypt on Company A's KMS key ARN, without changing Company A's key policy.

Answer

Create a new KMS key in Company B and configure Company A's S3 bucket to use that key for SSE-KMS.

Answer

Disable key policy restrictions by setting the KMS key to enabled and removing all policy statements so that encryption automatically works for any principal.

Question 19

Based on the exhibit, the web team wants the application to continue serving traffic if one Availability Zone fails. Which change best meets the requirement with the least operational overhead?

Accepted Answer

Add the unused subnet in us-east-1b to the Auto Scaling group so instances can launch in both AZs.. It adds the unused subnet in us-east-1b to the Auto Scaling group, enabling EC2 instances to launch across two Availability Zones. This provides fault isolation: if one AZ fails, the ALB can route traffic to healthy instances in the other AZ. The change requires only a configuration update to the Auto Scaling group, minimizing operational overhead while meeting the high-availability requirement.

Answer

Increase desired capacity to 3 in the same Availability Zone so one extra instance is always available.

Answer

Replace the Application Load Balancer with a Network Load Balancer because it will automatically keep the app online.

Answer

Move the application to a larger EC2 instance type so a single server can handle the full workload.

Question 20

A media processing pipeline runs batch jobs overnight. The jobs are stateless, can be restarted from checkpoints, and can tolerate interruptions. The team wants to minimize compute cost. Which EC2 approach is the best fit?

Accepted Answer

Use Spot Instances and design the jobs to handle interruptions by checkpointing and retrying.. Spot Instances offer significant cost savings (up to 90% off On-Demand) but can be reclaimed by AWS with a 2-minute interruption notice. Since the batch jobs are stateless, checkpointable, and interruption-tolerant, they are an ideal workload for Spot Instances. Designing the jobs to save progress to a durable checkpoint (e.g., Amazon S3) and automatically retry on interruption ensures resilience while minimizing compute cost.

Answer

Use On-Demand instances to guarantee uninterrupted capacity.

Answer

Use a 1-year Reserved Instance for the current instance type and lock the fleet to it.

Answer

Use Savings Plans but still treat interruptions as failures that require manual intervention.