SAA-C03 Practice Exam 54 — 20 Questions

Question 1

A media company runs a 24/7 ingestion API on EC2 behind an Application Load Balancer and a nightly transcoding job that can resume from checkpoints. The API fleet runs at roughly 65 percent CPU all day, while the batch workers sit idle most of the time. The company wants to cut compute cost without risking the API. Which two changes should they make? Select two.

Accepted Answer

Purchase a Compute Savings Plan for the always-on API fleet.. A is correct because a Compute Savings Plan offers the largest discount (up to 66%) in exchange for a 1- or 3-year commitment to a consistent amount of compute usage (measured in $/hour), regardless of instance family, region, or OS. The API fleet runs at a steady 65% CPU 24/7, making it an ideal candidate for this flexible, cost-saving commitment without locking into a specific instance type.

Answer

Replace the API fleet with Dedicated Hosts to lock in lower rates.

Answer

Buy Standard Reserved Instances for the batch workers and keep them running 24/7.

Answer

Increase the worker Auto Scaling minimum to prevent Spot interruptions.

Question 2

A media company uses CloudFront in front of an S3 bucket origin for video thumbnails. They want to prevent users from bypassing CloudFront and accessing the S3 bucket directly, while still allowing CloudFront to fetch objects. What is the best option?

Accepted Answer

Use CloudFront Origin Access Control (OAC) or Origin Access Identity (OAI) and update the bucket policy to allow only CloudFront.. CloudFront Origin Access Control (OAC) or Origin Access Identity (OAI) allows you to restrict direct access to an S3 bucket by configuring the bucket policy to grant read permissions only to the CloudFront distribution's service principal. This ensures that users can only retrieve thumbnails through CloudFront, leveraging its caching and security features, while blocking any direct S3 requests.

Answer

Keep the bucket public and rely on signed cookies for all thumbnail requests.

Answer

Enable S3 static website hosting so users access thumbnails directly from the S3 website endpoint.

Answer

Set S3 bucket permissions to allow all IAM users and block access only by using a WAF rule at CloudFront.

Question 3

A mobile game backend uses Amazon Aurora. The workload has many short-lived database connections from Lambda functions, causing connection storms. What should be added? The architecture review board prefers a managed AWS-native control.

Accepted Answer

RDS Proxy. RDS Proxy is a fully managed, AWS-native service that sits between Lambda functions and Aurora, pooling and reusing database connections. This prevents connection storms by reducing the overhead of establishing new connections for each short-lived Lambda invocation, and it also improves scalability and resilience by handling failover transparently.

Answer

An internet gateway

Answer

S3 Select

Answer

A larger Route 53 hosted zone

Question 4

A production Amazon RDS database has automated backups enabled. An application mistakenly updates a table and the issue is discovered one hour later. The team needs to restore the database to the exact state it had 45 minutes ago. Which approach best meets the requirement?

Accepted Answer

Perform a point-in-time restore to a timestamp within the automated backup window.. Amazon RDS Point-in-Time Recovery (PITR) allows you to restore a DB instance to any specific second within the automated backup retention period, which includes the transaction logs needed to reconstruct the database state at the desired time. Since the issue is discovered one hour after the mistaken update, PITR can restore the database to exactly 45 minutes ago by replaying binary logs up to that precise timestamp, meeting the requirement without data loss.

Answer

Restore only from the latest daily snapshot, then manually undo the last hour’s changes.

Answer

Increase Multi-AZ to generate a new standby and redirect traffic back to the previous primary state.

Answer

Stop the database and change the application to ignore the table going forward.

Question 5

A reporting application in Account B must read files from an S3 bucket in Account A. The bucket contains objects encrypted with a customer managed KMS key in Account A. The application role in Account B already has an identity policy allowing s3:GetObject on the bucket prefix, but requests still fail with AccessDenied. Which two changes are required for the application to read the objects? Select two.

Accepted Answer

Add a bucket policy in Account A that allows the Account B role to perform s3:GetObject on the required prefix.. Option A is correct because cross-account S3 access requires the destination account (Account A) to explicitly grant access via a bucket policy that allows the source account's role (Account B) to perform s3:GetObject on the specified prefix. Without this bucket policy, the S3 service in Account A will deny the request, even if the IAM identity policy in Account B permits the action. Option B is correct because the objects are encrypted with a customer managed KMS key in Account A; the application role in Account B must be added to the KMS key policy with kms:Decrypt permission to decrypt the objects during retrieval. Both the S3 bucket policy and the KMS key policy are required for cross-account encrypted access.

Answer

Attach an IAM policy in Account B that grants s3:* on the bucket and its objects.

Answer

Create an S3 gateway endpoint in Account B so the application can reach the bucket privately.

Answer

Add an SCP in Account A that allows the Account B role to bypass KMS encryption checks.

Question 6

An internal API is hosted in two AWS Regions behind Route 53. Under normal conditions, clients should use the primary region. If the primary endpoint becomes unhealthy, traffic must automatically switch to the secondary region. Which Route 53 setup best meets this requirement?

Accepted Answer

Use failover routing policy: create two alias records for the same name (primary and failover) and associate health checks with the primary record.. Route 53 failover routing policy is designed for active-passive failover scenarios. By creating two alias records (primary and secondary) for the same DNS name and associating a health check with the primary record, Route 53 automatically directs traffic to the secondary region if the primary health check fails. This meets the requirement of automatic failover without manual intervention.

Answer

Use latency-based routing with one record per region and no health checks.

Answer

Use weighted routing and manually change the weights during incidents.

Answer

Create a single alias record only for the primary region and rely on client-side DNS retries.

Question 7

Based on the exhibit, what is the best change to improve read performance without increasing write latency on the primary database?

Accepted Answer

Create an RDS read replica and direct the reporting queries to the replica endpoint.. Creating an RDS read replica offloads read-heavy reporting queries from the primary database instance, improving read performance without increasing write latency on the primary. The replica operates asynchronously, so writes on the primary are not blocked or delayed by the reporting workload.

Answer

Convert the DB instance to Multi-AZ so the primary can serve more reads.

Answer

Increase the primary instance class to a larger size and keep all traffic on one writer.

Answer

Migrate the reporting workload to DynamoDB to gain faster reads.

Question 8

A risk simulation workload uses CloudWatch Logs heavily. Retaining all debug logs forever is increasing costs. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

CloudWatch Logs retention policies per log group. CloudWatch Logs retention policies allow you to set per-log-group expiration rules (e.g., 30 days, 90 days) to automatically delete old log events, directly reducing storage costs without custom scripts. Since the workload uses CloudWatch Logs heavily and retains debug logs forever, configuring a retention policy on each log group is the simplest, most cost-effective solution that requires no operational overhead.

Answer

AWS Config aggregation

Answer

CloudWatch detailed monitoring on all instances

Answer

Route 53 health checks

Question 9

A public API for a e-learning platform is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. Option D is correct because API Gateway supports JWT authorizers that validate JSON Web Tokens (JWTs) issued by an external OpenID Connect (OIDC) provider. This allows the API to authenticate clients using standards-based tokens without managing a custom Lambda authorizer, and it directly integrates with the OIDC issuer's JWKS endpoint to verify token signatures.

Answer

A VPC endpoint policy

Answer

IAM authorization for all internet users

Answer

API keys only

Question 10

A media company serves versioned JavaScript and CSS from an S3 origin through CloudFront. After a release, the cache hit ratio drops because the SPA sends an Authorization header and several tracking query strings on every request, even though the assets are public and identical for all users. Which changes would most improve cache efficiency without changing the content returned? Select three.

Accepted Answer

Create a CloudFront cache policy that excludes the Authorization header from the cache key when the assets do not require per-user authorization.. Option A is correct because CloudFront's default behavior includes the Authorization header in the cache key, causing unique cache entries for each user even when the content is public. By creating a cache policy that excludes the Authorization header, CloudFront treats all requests for the same object as identical, dramatically improving the cache hit ratio without affecting the content served.

Answer

Place the S3 origin behind an Application Load Balancer so CloudFront can reuse more cached responses.

Answer

Enable S3 Transfer Acceleration to increase the cache hit ratio for repeated browser requests.

Question 11

A rendering service runs on a single EC2 instance and writes a large working set of metadata to disk using sustained random reads and writes. The data must persist across stops and restarts, and the team sees queue depth spikes when the job reaches peak throughput. Which changes should the team make? Select three.

Accepted Answer

Use an Amazon EBS io2 volume with provisioned IOPS for the metadata store.. Option A is correct because an Amazon EBS io2 volume with provisioned IOPS is designed for I/O-intensive workloads with sustained random reads and writes, such as the rendering service's metadata store. The io2 volume type offers high durability (99.999%) and consistent low-latency performance, which directly addresses the queue depth spikes caused by peak throughput demands. Provisioned IOPS ensures the volume can handle the required random I/O without throttling, meeting the persistence requirement across stops and restarts.

Answer

Move the working set to Amazon EFS because it automatically stripes across Availability Zones.

Answer

Store the metadata in Amazon S3 because object storage is cheaper and supports random writes.

Question 12

An events service publishes critical notifications using Amazon SNS. Three independent downstream systems (A, B, and C) subscribe to the topic. Downstream system B sometimes fails to process certain messages (for example, it times out or returns an error while handling the message), and you want: 1) failures in B to be isolated so A and C keep processing unaffected, and 2) messages that B cannot successfully process after retries to be sent to a DLQ for B. Which design best meets these requirements?

Accepted Answer

For each downstream system, create its own SQS queue, subscribe each SQS queue to the SNS topic, and configure a redrive policy with a DLQ for each SQS queue.. Option B is correct because it creates a dedicated SQS queue for each downstream system, which isolates failures: if system B fails, its SQS queue will accumulate messages while systems A and C continue processing from their own queues. Each SQS queue can have a redrive policy that moves messages to a per-queue DLQ after the configured maximum retries are exhausted, satisfying the requirement for a B-specific DLQ without affecting the other subscribers.

Answer

Subscribe each downstream directly with HTTPS endpoints and configure a single SNS dead-letter queue (DLQ) for the topic.

Answer

Use one shared SQS queue for all three downstream systems and configure a single DLQ only when all three downstream systems fail.

Answer

Use EventBridge rules to invoke A, B, and C synchronously with retries enabled, and send failures to a common DLQ.

Question 13

A media archive requires consistent high IOPS for a transactional database on EC2. Which EBS volume type is most suitable? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Provisioned IOPS SSD such as io2. The io2 Provisioned IOPS SSD volume type is designed for latency-sensitive transactional workloads that require consistent, high IOPS. It provides a service-level agreement (SLA) of 99.999% durability and supports up to 256,000 IOPS per volume, making it ideal for a database on EC2 that demands predictable performance. As a managed AWS-native EBS volume, it aligns with the architecture review board's preference for a fully AWS-controlled storage solution.

Answer

st1 Throughput Optimized HDD

Answer

Instance store only

Answer

sc1 Cold HDD

Question 14

A media company uploads raw video thumbnails to an S3 bucket every hour. The application needs these thumbnails for active browsing for the first 7 days. After day 7, access becomes rare. Requirements: - Objects must remain available in S3 for at least 180 days total. - After day 7, the team can tolerate retrieval latency in the range of minutes to hours. - They want to minimize storage cost while keeping the ability to read objects (no application changes required). Which storage strategy is the most cost-optimized fit?

Accepted Answer

Use a lifecycle rule to transition objects to S3 Glacier Flexible Retrieval after day 7 and expire them after day 180.. Option B is correct because S3 Glacier Flexible Retrieval provides retrieval times from minutes to hours, which matches the tolerance for rare access after day 7, and offers the lowest storage cost among the options for data that is rarely accessed. A lifecycle rule transitions objects from S3 Standard (used for the first 7 days of active browsing) to Glacier Flexible Retrieval on day 7, then expires them after day 180, meeting the 180-day retention requirement without application changes.

Answer

Use a bucket-level lifecycle rule to transition objects to S3 Standard-IA on day 7 and then expire them after day 180.

Answer

Keep all objects in S3 Standard for 180 days, and enable S3 Intelligent-Tiering only if the bucket’s access frequency is above a threshold.

Answer

Use a lifecycle rule to transition objects to S3 Glacier Instant Retrieval after day 7 and expire them after day 180.

Question 15

Based on the exhibit, the web team wants the application to continue serving traffic if one Availability Zone fails. Which change best meets the requirement with the least operational overhead?

Accepted Answer

Add the unused subnet in us-east-1b to the Auto Scaling group so instances can launch in both AZs.. Option B is correct because it adds the unused subnet in us-east-1b to the Auto Scaling group, enabling EC2 instances to launch across two Availability Zones. This provides fault isolation: if one AZ fails, the ALB can route traffic to healthy instances in the other AZ. The change requires only a configuration update to the Auto Scaling group, minimizing operational overhead while meeting the high-availability requirement.

Answer

Increase desired capacity to 3 in the same Availability Zone so one extra instance is always available.

Answer

Replace the Application Load Balancer with a Network Load Balancer because it will automatically keep the app online.

Answer

Move the application to a larger EC2 instance type so a single server can handle the full workload.

Question 16

Based on the exhibit, the team serves versioned JavaScript and CSS files from an S3 origin through CloudFront. After a release, the cache hit ratio dropped and origin fetches increased sharply. What change best reduces both CloudFront and S3 costs without changing the application’s public behavior?

Accepted Answer

Create a cache policy that excludes Authorization, cookies, and unnecessary query strings, and narrow the origin request policy to forward only the headers the S3 origin actually needs.. B is correct because versioned JavaScript and CSS files are immutable, so CloudFront should cache them aggressively. By creating a cache policy that excludes unnecessary headers (like Authorization and cookies) and query strings, and narrowing the origin request policy to forward only required headers, you maximize cache hits and reduce origin fetches. This directly lowers both CloudFront data transfer costs (fewer origin requests) and S3 request costs (fewer GET requests), without altering the application's public behavior.

Answer

Increase the CloudFront price class to include more edge locations.

Answer

Disable CloudFront and serve the files directly from S3 to avoid cache invalidation overhead.

Answer

Use Lambda@Edge to rewrite every request into a unique path so that clients never receive stale files.

Question 17

A microservice runs in private subnets and must read exactly one AWS Secrets Manager secret using its IAM task role: arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/db-pass-AbCdEf Security requires that every Secrets Manager API call comes only through a specific Interface VPC Endpoint (vpce-0a1b2c3d4e5f6g7h), and must not be reachable over any other network path. Which IAM policy change best enforces this requirement?

Accepted Answer

In the task role policy statement for secretsmanager:GetSecretValue on the secret ARN, add a condition that allows the action only when aws:SourceVpce equals vpce-0a1b2c3d4e5f6g7h.. Option A is correct because the condition `aws:SourceVpce` in the IAM policy restricts the `secretsmanager:GetSecretValue` API call to originate only from the specified VPC Endpoint (vpce-0a1b2c3d4e5f6g7h). This ensures that the secret can only be accessed via that specific Interface Endpoint, blocking any other network path (e.g., internet, NAT gateway, or other VPC endpoints). The task role is attached to the microservice, so the policy directly enforces the security requirement at the API level.

Answer

Add a condition that allows secretsmanager:GetSecretValue only when aws:SourceIp is within 10.0.0.0/8.

Answer

Require TLS by adding a condition on aws:SecureTransport for the Secrets Manager permission.

Answer

Add a KMS condition using kms:ViaService=secretsmanager.us-east-1.amazonaws.com instead of restricting Secrets Manager directly.

Question 18

Based on the exhibit, which AWS service should the security team enable to continuously discover sensitive data stored inside Amazon S3 objects?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data such as personally identifiable information (PII) or financial data stored in Amazon S3. It provides continuous visibility into data security risks by generating findings when sensitive data is detected, making it the correct choice for this use case.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 19

A media company runs a 24/7 recommendation engine on EC2 in one AWS Region. The workload is interruption-intolerant, and the team expects steady usage but may change instance families and sizes during planned optimizations. Compared to the current On-Demand setup, they want the lowest cost while avoiding the rigidity of locking to a specific instance type.

What should the solutions architect recommend?

Accepted Answer

Purchase a Compute Savings Plan for the expected steady hourly usage in that Region.. B is correct because a Compute Savings Plan offers the lowest cost for steady-state workloads without locking to a specific instance type, providing up to 66% discount compared to On-Demand while allowing flexibility to change instance families, sizes, OS, or tenancy within a Region. This matches the requirement for cost savings and flexibility during planned optimizations.

Answer

Switch the instances to Spot Instances and use interruption handling because it is the largest discount.

Answer

Purchase a Standard Reserved Instance tied to a single specific instance type for the next 3 years.

Answer

Keep On-Demand and rely on Auto Scaling to reduce capacity when utilization is low.

Question 20

A patient portal must process every event at least once, but duplicate processing is acceptable if the consumer handles idempotency. Which eventing approach is most suitable? The team wants the control to be enforceable during normal operations.

Accepted Answer

Use Amazon SQS standard queue and design consumers to be idempotent. Amazon SQS standard queues provide at-least-once delivery, ensuring every event is processed at least once, which matches the requirement. Duplicate processing is acceptable because the team can design consumers to be idempotent, handling duplicates without side effects. SQS is a fully managed, scalable, and durable service that enforces this behavior during normal operations without requiring custom infrastructure.

Answer

Use an in-memory queue on one EC2 instance

Answer

Use UDP messages sent directly to workers

Answer

Use CloudFront signed URLs