SAA-C03 Practice Exam 54 — 20 Questions

Question 1

An internal worker consumes messages from an Amazon SQS queue. Occasionally, a message fails validation in the worker (for example, missing required fields). Reprocessing the same bad message repeatedly wastes processing time and delays healthy messages. What is the best AWS approach to handle these poison messages without blocking the rest of the queue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an SQS dead-letter queue (DLQ) using a redrive policy with a maxReceiveCount.. An SQS dead-letter queue (DLQ) with a redrive policy that sets a maxReceiveCount allows the worker to process a message up to a specified number of times. After that threshold is exceeded, the message is automatically moved to the DLQ, isolating the poison message and preventing it from blocking or delaying the processing of healthy messages in the main queue.

Answer

Delete the SQS queue and recreate it daily to clear invalid messages.

Answer

Increase the consumer timeout/processing time so validation failures take longer to occur.

Answer

Use SNS fan-out without any DLQ and rely only on application retries.

Question 2

A financial analytics company runs an Amazon RDS for MySQL database that supports a read-heavy web application. The primary DB instance is heavily loaded during business hours, and read replicas are already deployed and receiving traffic from the application. The team wants to reduce the load on the primary DB instance caused by read queries as much as possible, while keeping the application changes minimal. Which action should a solutions architect take?

Accepted Answer

Configure the application to send read queries to the existing read replicas instead of the primary DB instance.. Read replicas exist precisely to offload read-only query traffic from a primary DB instance. Since replicas are already deployed and receiving some traffic, routing the application's read queries to them reduces contention on the primary with minimal change. Multi-AZ is for availability, vertical scaling adds cost without offloading reads, and introducing a cache is a larger architectural change that does not use existing replica capacity.

Answer

Increase the size of the primary DB instance to a larger instance class.

Answer

Enable Multi-AZ deployment on the primary DB instance.

Answer

Create an Amazon ElastiCache for Redis cluster and cache all read results.

Question 3

A financial services firm runs a stateless containerized trading dashboard on Amazon ECS with the Fargate launch type. The dashboard queries a backend over HTTPS and must present responses in under 200 ms. During market open, traffic triples within a few minutes and latency spikes because tasks take time to start. The team needs faster, more predictable scaling and wants to avoid over-provisioning during quiet periods. Which solution meets these requirements?

Accepted Answer

Configure a target tracking scaling policy on the ECS service using the ALBRequestCountPerTarget metric and set a short scale-out cooldown, keeping the minimum task count at a level that handles baseline traffic.. Application Auto Scaling target tracking on a request-count-per-target metric reacts to incoming demand rather than lagging CPU, which suits a burst at market open. Keeping scale-out cooldowns short and setting a modest minimum task count balances responsiveness with cost. The other approaches either delay scaling, add slower instance-based capacity, or rely on signals that fire too late.

Answer

Switch the ECS service to the EC2 launch type with a large Auto Scaling group and enable cluster auto scaling.

Answer

Configure a target tracking scaling policy on the ECS service using the ALBRequestCountPerTarget metric with a longer cooldown period.

Answer

Use AWS Application Auto Scaling with a scheduled scaling action and a target tracking policy on CPU utilization, plus a warm pool of pre-initialized tasks.

Question 4

A company wants a disaster recovery setup for a web application. They want to keep costs low but still recover within a couple of hours after a regional disruption. They are willing to run only minimal infrastructure in the secondary location and scale it up during the outage. Which DR approach best matches this requirement?

Accepted Answer

Pilot light, where the secondary Region keeps minimal core components ready and scales up during failover.. The Pilot light approach is correct because it keeps minimal core components (e.g., a small database, a scaled-down application server) running in the secondary Region, allowing rapid failover by scaling up those resources during an outage. This meets the requirement of low cost during normal operations while achieving recovery within a couple of hours, as the core infrastructure is already provisioned and can be scaled horizontally (e.g., using Auto Scaling groups and pre-configured AMIs) without needing to rebuild from scratch.

Answer

Active-active, where both Regions run full production at all times.

Answer

Cold standby, where no infrastructure is running in the secondary Region until an outage occurs.

Answer

Backups-only, where recovery relies solely on manually restoring snapshots during an outage.

Question 5

You host a public API using Amazon API Gateway in two AWS Regions: us-east-1 (primary) and us-west-2 (secondary). You want Route 53 to send client traffic to the secondary region only when the primary API is unhealthy. Which Route 53 setup best meets this requirement?

Accepted Answer

Use Route 53 failover routing with two ALIAS records (same DNS name) pointing to the API Gateway regional endpoints: one record is configured as PRIMARY with an associated health check, and the other is configured as SECONDARY.. Route 53 failover routing is designed for active-passive setups where traffic is sent to a primary resource unless it is unhealthy, in which case traffic is routed to a secondary resource. By creating two ALIAS records with the same DNS name, one marked PRIMARY with an associated health check and the other marked SECONDARY, Route 53 will automatically fail over to the secondary region when the health check for the primary API Gateway endpoint fails. This directly meets the requirement of sending traffic to the secondary region only when the primary API is unhealthy.

Answer

Use latency-based routing with one routing policy per region, and use CloudWatch alarms to update traffic weights between regions.

Answer

Use weighted routing across both regions and rely on Route 53 health checks to automatically set the secondary to 100% weight when the primary fails.

Answer

Use geolocation routing to map some client geographies to the secondary region and the rest to the primary region.

Question 6

An order lookup API repeatedly reads the same few items from DynamoDB. The application can tolerate slightly stale data for a few seconds, and the team wants the lowest-latency design with minimal application changes. Which two changes should they make? Select two.

Accepted Answer

Put Amazon DynamoDB Accelerator (DAX) in front of the table.. Option A is correct because Amazon DynamoDB Accelerator (DAX) is a fully managed, in-memory cache for DynamoDB that delivers microsecond read latency for repeated access to the same items, and it requires minimal application changes since it is API-compatible with DynamoDB. Option B is correct because eventually consistent reads cost half as many read capacity units and typically have lower latency than strongly consistent reads, and the scenario explicitly states the application can tolerate slightly stale data for a few seconds. Option C is wrong because strongly consistent reads are slower and consume twice the read capacity of eventually consistent reads, so they do not provide faster results. Option D is wrong because increasing item size does not reduce the number of requests and actually increases the cost and latency of each read. Option E is wrong because replacing DynamoDB with EBS volumes on EC2 would require major application changes, lose DynamoDB's managed scalability, and not provide the low-latency cached reads the team wants.

Answer

Switch all access to strongly consistent reads for faster results.

Answer

Increase the item size so fewer requests are needed.

Answer

Replace the table with Amazon EBS volumes mounted on EC2 instances.

Question 7

A company runs a containerized microservices application on Amazon ECS with the Fargate launch type. The application experiences highly variable traffic, with long periods of low utilization and occasional sharp spikes. The company wants to minimize cost while ensuring the application can scale quickly during spikes. The tasks are stateless and can be restarted. Which combination of actions will meet these requirements MOST cost-effectively?

Accepted Answer

Use a mix of Fargate On-Demand for a baseline and Fargate Spot for additional capacity, with a target tracking scaling policy.. For variable traffic with occasional spikes, a baseline of On-Demand capacity combined with Spot for burst capacity balances reliability and cost. Target tracking scaling responds to actual demand, and stateless tasks make Spot interruptions acceptable. Using Spot for everything risks availability, while using On-Demand for everything forgoes savings.

Answer

Use Fargate Spot for all tasks and enable ECS deployment circuit breaker to replace interrupted tasks.

Answer

Use Fargate On-Demand for all tasks and configure a scheduled scaling policy to add tasks at known peak times.

Answer

Use Fargate Spot capacity for all tasks and configure a target tracking scaling policy based on CPU utilization.

Question 8

Your order-processing system uses EventBridge rules to send events to a Lambda function that updates order status. Over the last week, some events fail with a transient database timeout, and the Lambda retries intermittently but then the events are lost (no alerts after failures). You want at-least-once processing, bounded retries, and a way to inspect unprocessable events for later reprocessing.

Which architecture change best meets these requirements?

Accepted Answer

Send EventBridge events to an SQS queue, configure a redrive policy to move messages to a dead-letter queue (DLQ) after a defined receive count, and make the Lambda processing idempotent.. It introduces an SQS queue between EventBridge and Lambda, which provides a durable buffer for events. The redrive policy moves events to a dead-letter queue (DLQ) after a defined number of failed processing attempts, ensuring bounded retries and preserving unprocessable events for later inspection and reprocessing. Making the Lambda idempotent guarantees at-least-once processing even if duplicate events occur.

Answer

Invoke Lambda directly from EventBridge in asynchronous mode, and increase the Lambda timeout to reduce failures.

Answer

Use SNS topics with Lambda subscriptions, but remove all retry and DLQ configuration to minimize duplicate events.

Answer

Store failed events only in CloudWatch logs, and have operators manually copy log entries back into the database for reprocessing.

Question 9

A analytics dashboard uses an Application Load Balancer in one Region. Global users need lower network latency to the application without caching dynamic responses. What should be considered? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to route traffic from edge locations to the optimal regional endpoint, reducing latency and jitter for global users. It does not cache content, making it ideal for dynamic responses that cannot be cached. The service requires no custom scripts, as it integrates directly with the Application Load Balancer via a static IP address or DNS name.

Answer

S3 Cross-Region Replication

Answer

AWS Backup cross-Region copy

Answer

CloudFront only with long TTLs

Question 10

Based on the exhibit, a static asset distribution site uses Amazon CloudFront with an S3 origin. The assets are versioned by filename, but the cache hit ratio remains low after each release. Which CloudFront change is the best way to improve cache reuse without changing the origin objects?

Accepted Answer

Remove Authorization and unnecessary query strings from the CloudFront cache key.. Removing Authorization headers and unnecessary query strings from the CloudFront cache key ensures that multiple requests for the same versioned asset (e.g., style.v2.css) share a single cached object, regardless of user-specific headers or irrelevant query parameters. This directly increases the cache hit ratio without modifying the origin objects, as CloudFront will serve the same cached response for identical cache keys.

Answer

Keep the current cache key and increase the S3 bucket's storage class.

Answer

Disable the CloudFront cache so every request is served directly from S3.

Answer

Switch the origin from Amazon S3 to an Application Load Balancer.

Question 11

A company runs a stateful analytics workload on EC2 instances that use EBS volumes. The data must be restorable in another Region after a major outage, with frequent point-in-time recovery. Which approach provides the most suitable replication mechanism for the EBS-backed data?

Accepted Answer

Create scheduled EBS snapshots and copy them to another Region, then restore the volumes from those snapshots during recovery.. Scheduled EBS snapshots provide point-in-time backups of EBS volumes, which can be copied to another Region using the cross-Region snapshot copy feature. During recovery, you restore volumes from those snapshots in the target Region, ensuring the data is restorable after a major outage. This approach meets the requirements for frequent point-in-time recovery and cross-Region durability.

Answer

Enable EBS multi-attach to spread the workload across AZs and replicate snapshots automatically between Regions.

Answer

Use RDS read replicas in another Region and keep the analytics dataset in an RDS instance only.

Answer

Rely on instance store for durability and copy only AMIs across Regions.

Question 12

A trading dashboard uses Aurora MySQL. The company wants fast cross-Region disaster recovery with low RPO. Which architecture should be considered?

Accepted Answer

Aurora Global Database. Aurora Global Database is designed for cross-Region disaster recovery with a typical RPO of 1 second and RTO of less than 1 minute, using storage-based replication that does not impact database performance. This meets the low RPO requirement for a trading dashboard, where data loss must be minimized.

Answer

A single-AZ Aurora cluster

Answer

Manual snapshots copied monthly

Answer

An ElastiCache Redis replica

Question 13

A media company runs a nightly batch job that processes video thumbnails. The batch can be interrupted at any time, and workers can resume automatically from checkpoints (a termination does not corrupt progress). The business goal is the lowest possible compute cost, and occasional interruptions are acceptable as long as the job continues automatically. Which approach is most cost-optimized?

Accepted Answer

Use EC2 Spot Instances and implement interruption handling with checkpoint-based restarts. Spot Instances offer the lowest compute cost (up to 90% discount vs. On-Demand) and the checkpoint-based design ensures that interruptions are handled gracefully without data loss. The job can resume automatically from the last checkpoint, making Spot Instances ideal for fault-tolerant, interruptible batch workloads.

Answer

Run the job on On-Demand EC2 instances to avoid interruptions

Answer

Buy Reserved Instances for the entire job window because interruptions are acceptable anyway

Answer

Use Savings Plans but schedule the job only during business hours to reduce the commit cost

Question 14

A digital agency runs a web application on a fleet of Amazon EC2 instances behind an Application Load Balancer. Traffic is steady and predictable during business hours but drops to near zero overnight and on weekends. The operations team wants to reduce compute costs without impacting availability during peak periods. They cannot modify the application code and must keep the same instance types. What should a solutions architect recommend?

Accepted Answer

Create an Auto Scaling group with a scheduled scaling policy that scales the desired capacity up before business hours and down after hours.. The workload has a predictable daily and weekly pattern, so the most direct cost control is to align capacity with demand. A scheduled scaling policy changes desired capacity at known times, terminating instances when traffic is near zero and adding them back before the peak. This avoids paying for idle capacity while keeping the application available when users need it, and it requires no application changes.

Answer

Enable burstable T3 instances and rely on CPU credits to absorb the peak traffic periods.

Answer

Switch the fleet to Spot Instances and configure the Auto Scaling group to maintain the same desired capacity at all times.

Answer

Purchase a 1-year Standard Reserved Instance for each instance and leave the fleet running 24/7.

Question 15

A batch analytics job runs for several hours each night and can be interrupted and restarted. Which EC2 purchasing option should minimize cost? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Spot Instances. Spot Instances are correct because the batch job is fault-tolerant (can be interrupted and restarted) and runs for several hours each night, making it an ideal candidate for Spot Instances, which offer up to 90% cost savings compared to On-Demand. AWS-managed services like EC2 Auto Scaling or Amazon EMR can automatically handle Spot Instance interruptions by replacing instances or checkpointing the job, aligning with the architecture review board's preference for a managed AWS-native control.

Answer

On-Demand Instances only

Answer

Dedicated Hosts

Answer

Provisioned IOPS volumes

Question 16

A test environment runs on x86 EC2 instances and uses open-source software with no architecture-specific licensing restriction. What should be evaluated to reduce compute cost? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Graviton-based instances after performance testing. AWS Graviton-based instances (ARM architecture) offer up to 40% better price-performance compared to x86 instances for many workloads. Since the environment uses open-source software with no architecture-specific licensing restrictions, migrating to Graviton after performance testing can significantly reduce compute costs without requiring custom operational scripts, as AWS provides native support for ARM-based instances.

Answer

Cross-Region data replication for all data

Answer

io2 Block Express volumes for all instances

Answer

Dedicated Hosts by default

Question 17

A financial services company runs an internal web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must authenticate employees against the corporate identity provider (IdP) that supports SAML 2.0, and the company wants to avoid managing custom sign-in code. Which solution should a solutions architect recommend?

Accepted Answer

Configure the ALB to use an Amazon Cognito user pool as an authentication action, and federate the corporate IdP with the user pool.. The ALB can perform user authentication as a listener rule action using Amazon Cognito or an OIDC-compliant IdP. Because the corporate IdP speaks SAML 2.0, federating it with a Cognito user pool lets the ALB handle the SAML exchange and issue a session cookie, so the application receives only authenticated requests and no custom sign-in code is required.

Answer

Create an IAM SAML identity provider and attach an IAM role to the EC2 instance profile so the instance can call the IdP.

Answer

Store the IdP SAML metadata in AWS Secrets Manager and have the application parse the SAML assertion on each request.

Answer

Place AWS WAF in front of the ALB and create a rule that validates the SAML assertion signature before forwarding traffic.

Question 18

A healthcare company uses AWS Lambda functions to process sensitive patient data. The functions need to access an Amazon RDS for MySQL database. The security team requires that database credentials are never stored in the Lambda function code or environment variables, and that credentials are automatically rotated every 90 days. The company also wants to minimize the operational overhead of managing the rotation. Which solution should a solutions architect recommend?

Accepted Answer

Store the credentials in AWS Secrets Manager and configure automatic rotation using a Lambda rotation function. Grant the Lambda execution role permission to retrieve the secret.. AWS Secrets Manager is designed for secure storage and automatic rotation of secrets, including database credentials. It integrates with RDS to rotate credentials using a Lambda function, reducing operational overhead. The Lambda function can retrieve the secret at runtime using its execution role, ensuring credentials are never stored in code or environment variables.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter and manually rotate them every 90 days.

Answer

Store the credentials in an encrypted Amazon S3 object and have the Lambda function download and decrypt the object at runtime.

Answer

Use AWS IAM database authentication for RDS and generate temporary credentials using AWS Security Token Service (STS).

Question 19

A startup runs a public web application on Amazon EC2 instances behind an Application Load Balancer. The instances are in a public subnet and currently allow SSH from 0.0.0.0/0 so that engineers can troubleshoot. Auditors flagged this exposure. Engineers still need occasional shell access to the instances, and the company wants the access to be auditable per engineer without managing bastion hosts or distributing key pairs. Which solution best meets these requirements?

Accepted Answer

Move the instances to private subnets, remove the inbound SSH rule, and grant engineers access through AWS Systems Manager Session Manager with IAM policies and session logging to Amazon S3 and CloudWatch Logs.. Session Manager removes the need for inbound SSH, bastion hosts, and key pairs by having the Systems Manager agent establish outbound connections to the service. IAM policies determine which engineers can start sessions on which instances, giving per-person attribution, and session logging to Amazon S3 and CloudWatch Logs satisfies the audit requirement without exposing any listening port.

Answer

Keep the instances in the public subnet, restrict SSH to the corporate office CIDR, and distribute a shared PEM key pair to all engineers through AWS Secrets Manager.

Answer

Attach an EC2 instance profile granting AmazonSSMManagedInstanceCore to the instances and open port 22 only to the VPC CIDR so Session Manager can reach the instances.

Answer

Deploy a bastion host in a public subnet with a security group that allows SSH only from the corporate CIDR, and have engineers forward through it to reach the instances.

Question 20

A healthcare analytics company stores protected health information in an Amazon S3 bucket. An application running on Amazon EC2 instances in a private subnet must upload objects to the bucket using temporary credentials. The security team requires that the EC2 instances never store long-term AWS credentials on disk, and that access be limited to only the specific S3 bucket. Which solution meets these requirements?

Accepted Answer

Attach an IAM role to the EC2 instance profile with a policy granting s3:PutObject on the specific bucket, and let the AWS SDK retrieve temporary credentials automatically.. The requirement is temporary credentials without on-disk secrets, scoped to one bucket. An IAM role attached to the EC2 instance profile delivers rotating credentials through the instance metadata service, and the role's policy can be limited to the required S3 actions on the specific bucket. Long-term keys, presigned URLs, and IP-based policies do not satisfy the no-stored-credential and least-privilege conditions.

Answer

Configure the S3 bucket policy to allow access from the EC2 instances' private IP addresses, and disable IAM authentication for the bucket.

Answer

Generate a presigned URL for each upload using a role with broad S3 permissions, and distribute the URLs to the EC2 instances.

Answer

Create an IAM user with an access key, store the key in AWS Secrets Manager, and configure the application to retrieve it at runtime.