SAA-C03 Practice Exam 55 — 20 Questions

Question 1

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The business wants to avoid a reactive-only remediation approach.

Accepted Answer

Interface VPC endpoint for Systems Manager. An Interface VPC endpoint for Systems Manager (using AWS PrivateLink) allows the private application to securely read parameters from Parameter Store without traversing the internet. A Gateway VPC endpoint for S3 provides a private, highly available route to download objects from S3 using the S3 service's prefix list and route table entries, avoiding NAT or internet gateways. Together, these endpoints ensure all traffic stays within the AWS network, meeting the requirement to avoid public internet routing.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 2

A microservice reads a secret from AWS Secrets Manager using its task role (ServiceRole). The secret is configured to use a customer-managed CMK. In production, the service fails with AccessDeniedException on GetSecretValue. CloudTrail shows that Secrets Manager attempted kms:Decrypt but was denied. Which IAM policy change is most appropriate to fix the failure while keeping least privilege?

Accepted Answer

Add kms:Decrypt permission for the specific CMK ARN to ServiceRole, and also keep secretsmanager:GetSecretValue for the specific secret ARN.. The AccessDeniedException occurs because the task role (ServiceRole) lacks the kms:Decrypt permission for the customer-managed CMK used to encrypt the secret. Secrets Manager calls kms:Decrypt on your behalf when retrieving the secret value. Adding kms:Decrypt for the specific CMK ARN to ServiceRole, while retaining secretsmanager:GetSecretValue for the specific secret ARN, grants the minimum required permissions to decrypt and read the secret.

Answer

Add secretsmanager:ListSecrets permission on "*" so the service can discover the secret and retry the read.

Answer

Add s3:GetObject permission to ServiceRole for the KMS key alias stored in an S3 bucket.

Answer

Add kms:Encrypt permission instead of kms:Decrypt, because the service only needs to read the secret.

Question 3

A mobile app reads the same product catalog items repeatedly throughout the day. The DynamoDB table is already properly keyed, but read latency is still a problem during sales events. The team can tolerate eventually consistent reads and wants the least disruptive change. What should they add?

Accepted Answer

Enable DynamoDB Accelerator to cache frequently accessed items in memory.. DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that reduces read latency for frequently accessed items by orders of magnitude, from single-digit milliseconds to microseconds. Since the team can tolerate eventually consistent reads, DAX is ideal because it caches read results and serves them without additional DynamoDB read capacity consumption, making it the least disruptive change — no schema changes or application rewrites are required.

Answer

Add a global secondary index for every frequently viewed product attribute.

Answer

Switch the table to on-demand capacity mode to reduce latency.

Answer

Move the catalog to Aurora and use a read replica for every region.

Question 4

A production Amazon RDS database already has automated backups enabled. At 10:45 UTC, the team discovers that a faulty migration corrupted rows in a table at 10:30 UTC. The business wants the database restored to exactly the state it had at 10:30 UTC with minimal risk. Which two actions should the team take? Select two.

Accepted Answer

Restore the database to a new instance using point-in-time restore for 10:30 UTC.. Option A is correct because Amazon RDS Point-in-Time Restore (PITR) allows you to restore a DB instance to any second within the backup retention period, including 10:30 UTC. This uses automated backups and transaction logs to reconstruct the exact database state at that specific time, providing a precise recovery point with minimal data loss.

Answer

Restore the most recent manual snapshot because it will include the 10:30 UTC state.

Answer

Overwrite the existing database instance in place so the application keeps the same storage volume.

Answer

Wait for automated backups to complete again, then replay the migration to restore the missing rows.

Question 5

A regional web application for a inventory service must fail over automatically to a secondary Region if the primary endpoint becomes unhealthy. Which two services or features are required?

Accepted Answer

Route 53 failover routing with health checks. Route 53 failover routing with health checks is correct because it monitors the health of the primary endpoint via periodic HTTP/HTTPS or TCP checks. If the health check fails, Route 53 automatically updates DNS resolution to point to the secondary Region's endpoint, enabling failover at the DNS level without manual intervention.

Answer

S3 Transfer Acceleration

Answer

AWS Organizations service control policies

Question 6

A payments platform requires disaster recovery across Regions. Requirements: RPO of 15 minutes and RTO of about 1 hour. The business cannot afford full duplicate capacity in both Regions all the time, but the team wants automated readiness so failover is mostly operationally guided rather than a slow rebuild. Which DR strategy is the best fit?

Accepted Answer

Warm standby, keeping core infrastructure and a partially provisioned environment ready in the secondary Region with frequent data replication.. Warm standby is the best fit because it maintains a partially provisioned environment in the secondary Region with core infrastructure (e.g., a smaller EC2 Auto Scaling group, a standby database with synchronous or asynchronous replication) and frequent data replication, enabling an RPO of 15 minutes and an RTO of about 1 hour. This approach balances cost and automated readiness, as the team can scale up the standby environment during failover without the expense of full duplicate capacity, while still meeting the recovery objectives through automated replication (e.g., Amazon RDS Multi-AZ cross-Region or DynamoDB global tables).

Answer

Backup and restore only, relying on scheduled snapshots and manual restores during incidents.

Answer

Pilot light, keeping only minimal infrastructure in the secondary Region and starting full services after failover.

Answer

Active/active, routing production traffic to both Regions continuously and accepting dual-region complexity.

Question 7

A retail API uses EC2 instances behind an ALB. CPU is consistently high during peak traffic, and request latency rises. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

Auto Scaling policy based on an appropriate CloudWatch metric. An Auto Scaling policy based on a CloudWatch metric like CPUUtilization or ALB TargetResponseTime can dynamically add or remove EC2 instances to match demand. This directly addresses the high CPU and rising latency during peak traffic without requiring custom scripts, as the scaling actions are fully managed by AWS. The ALB distributes traffic across the scaled instances, reducing per-instance load and improving response times.

Answer

S3 Object Lock

Answer

A VPC endpoint for CloudWatch only

Answer

Disable health checks

Question 8

A public API is delivered through CloudFront and an Application Load Balancer. The security team wants AWS to automatically block repetitive bursts from the same client IP and also reduce exposure to common web exploits without custom code. Which two AWS WAF features should be enabled? Select two.

Accepted Answer

A rate-based rule that blocks clients exceeding a request threshold from the same source IP.. A rate-based rule in AWS WAF automatically tracks request rates per source IP and blocks clients that exceed a configured threshold within a 5-minute evaluation window. This directly addresses the security team's requirement to block repetitive bursts from the same client IP without custom code.

Answer

ALB sticky sessions for all requests.

Answer

A security group rule that blocks requests based on HTTP path.

Answer

CloudFront origin access control for the API endpoint.

Question 9

A retail analytics table stores events in Amazon DynamoDB with partition key tenantId and sort key eventTime. During a promotion, one tenant generates most writes and repeatedly polls the same latest-status items, causing throttling on a single partition key and high latency on reads. The business can tolerate read results that are a few seconds stale. Which two changes will most effectively reduce throttling and latency? Select two.

Accepted Answer

Introduce write sharding by adding a bounded random suffix to the hot tenant partition key and fan out reads across the shards.. Option A is correct because write sharding distributes the hot tenant's writes across multiple partitions by appending a bounded random suffix to the partition key, preventing a single partition from throttling. Reads then fan out across all shards and aggregate results, which is acceptable since the business tolerates a few seconds of staleness. This directly addresses the single-partition bottleneck without changing the overall data model.

Answer

Keep the same key design and increase only the table’s provisioned RCUs and WCUs.

Answer

Replace the table reads with a Scan operation to distribute the load across all partitions.

Answer

Move the table to another Availability Zone so the hot tenant uses a different storage node.

Question 10

A Lambda function behind an API needs consistent low latency. Traffic normally drops to near zero, then spikes several times per hour. During spikes, the p95 latency often spikes above 800 ms due to cold starts. The team wants to keep using Lambda (no containers) but minimize cold start impact during predictable spikes. What is the best AWS configuration to meet this goal?

Accepted Answer

Enable Lambda provisioned concurrency on a published function alias and set the minimum provisioned instances to the baseline expected during spikes.. Provisioned concurrency initializes a specified number of execution environments in advance, keeping them warm and ready to handle requests instantly. By setting the minimum provisioned instances to the baseline expected during spikes, the function avoids cold starts for those requests, ensuring p95 latency stays low even when traffic surges from near zero.

Answer

Increase the function memory size to the maximum and rely on the larger memory to eliminate cold starts.

Answer

Configure an ALB with target group health checks to keep Lambda warm by sending periodic requests.

Answer

Turn on AWS CloudTrail data events to monitor cold start frequency and tune the runtime accordingly.

Question 11

A production application stores critical data on an Amazon EBS volume. The team wants a simple backup method that allows the volume to be restored later if the server is lost. What should they use?

Accepted Answer

Amazon EBS snapshots. Amazon EBS snapshots are the correct choice because they provide a simple, incremental backup method for EBS volumes. Snapshots capture the data on the volume at a specific point in time and are stored in Amazon S3, allowing the volume to be restored to a new EC2 instance if the original server is lost. This directly meets the requirement for a backup that enables restoration after server failure.

Answer

Amazon S3 bucket versioning

Answer

AWS Security Hub

Answer

Amazon CloudFront invalidations

Question 12

A patient portal receives bursts of orders that sometimes overwhelm a downstream fulfilment service. The architecture must absorb spikes and retry processing without losing requests. Which service should be placed between the web tier and fulfilment workers? The team wants the control to be enforceable during normal operations.

Accepted Answer

Amazon SQS queue. Amazon SQS is the correct choice because it acts as a durable buffer between the web tier and fulfilment workers, decoupling the producers from consumers. When bursts of orders arrive, SQS queues the messages and allows the fulfilment service to poll and process them at its own pace, absorbing spikes without data loss. The queue provides at-least-once delivery and supports retries via a dead-letter queue, ensuring no requests are lost even if processing fails.

Answer

AWS WAF

Answer

Amazon CloudFront

Answer

Amazon Route 53 weighted routing

Question 13

A microservice runs on an EC2 instance using an instance role. It must retrieve exactly one secret value from AWS Secrets Manager. The secret ARN is arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/dbPassword-AbCdEf. The secret is encrypted with the default AWS-managed Secrets Manager KMS key (alias/aws/secretsmanager). Which IAM policy statement provides the best least-privilege access?

Accepted Answer

Allow secretsmanager:GetSecretValue only for the specific secret ARN: Resource "arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/dbPassword-AbCdEf".. Option B is correct because it grants the least-privilege access by restricting the secretsmanager:GetSecretValue action to the exact secret ARN required. Since the secret is encrypted with the default AWS-managed KMS key (alias/aws/secretsmanager), no additional kms:Decrypt permission is needed because Secrets Manager automatically handles decryption with the default key when using GetSecretValue. This policy ensures the microservice can retrieve only the intended secret and no others.

Answer

Allow secretsmanager:GetSecretValue on all secrets: Resource "*".

Answer

Allow secretsmanager:DescribeSecret on the secret ARN, but not secretsmanager:GetSecretValue.

Answer

Allow secretsmanager:GetSecretValue on all secrets with the prefix: Resource "arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/*".

Question 14

A public API for a customer analytics portal is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. Option B is correct because the scenario requires standards-based token authentication from an external OpenID Connect (OIDC) provider. API Gateway's JWT authorizer natively validates JSON Web Tokens (JWTs) issued by OIDC providers by verifying the token's signature against the provider's JWKS endpoint, checking the `iss` and `aud` claims, and enforcing token expiration. This directly meets the requirement without needing custom Lambda authorizers or additional infrastructure.

Answer

API keys only

Answer

IAM authorization for all internet users

Answer

A VPC endpoint policy

Question 15

Based on the exhibit, the security team wants centralized detection and alerting for both successful and failed attempts to change S3 bucket policies and KMS key policies across multiple accounts. Which approach best meets the requirement?

Accepted Answer

Create an organization CloudTrail trail for management events and add EventBridge rules in the security account to alert on PutBucketPolicy and PutKeyPolicy events, including failed calls.. Option C is correct because an organization CloudTrail trail captures management events (including PutBucketPolicy and PutKeyPolicy) across all accounts in the organization, and EventBridge rules in the security account can filter for both successful and failed API calls (using the `errorCode` field) to trigger centralized alerts. This provides the required centralized detection and alerting for policy changes across multiple accounts.

Answer

Enable S3 server access logging on each bucket and archive the logs in the security account.

Answer

Use AWS Config rules only, because Config records every successful and failed API call automatically.

Answer

Enable GuardDuty in every account and use its findings as the main source for policy change notifications.

Question 16

A retail API uses EC2 instances behind an ALB. CPU is consistently high during peak traffic, and request latency rises. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Auto Scaling policy based on an appropriate CloudWatch metric. The correct answer is A because an Auto Scaling policy based on an appropriate CloudWatch metric (e.g., CPUUtilization or ALB RequestCountPerTarget) dynamically adds or removes EC2 instances to match demand, preventing sustained high CPU and rising latency. This is a managed, AWS-native control that aligns with the architecture review board's preference.

Answer

S3 Object Lock

Answer

A VPC endpoint for CloudWatch only

Answer

Disable health checks

Question 17

An ecommerce company runs a 24/7 frontend tier on EC2 and a nightly image-rendering job that can be interrupted and resumed from checkpoints. They want to minimize monthly compute cost without changing the application architecture. Which two actions should they take? Select two.

Accepted Answer

Purchase a Compute Savings Plan for the always-on frontend tier.. A Compute Savings Plan offers the largest discount (up to 66%) in exchange for a consistent compute spend commitment, making it ideal for the always-on frontend tier that runs 24/7. This plan applies to any EC2 instance family, region, and even Fargate or Lambda, providing flexibility while reducing costs for steady-state workloads.

Answer

Move both workloads to Dedicated Hosts.

Answer

Keep the rendering fleet entirely on On-Demand Instances.

Answer

Use dedicated GPUs for the frontend tier even though it is CPU-light.

Question 18

Based on the exhibit, the web application must remain available even if one Availability Zone fails. What is the best change to improve resilience with the least redesign?

Accepted Answer

Add subnet-b1 in a different Availability Zone to the Auto Scaling group.. Adding subnet-b1 in a different Availability Zone to the Auto Scaling group ensures that EC2 instances are launched across two Availability Zones. If one zone fails, the ALB can route traffic to healthy instances in the other zone, maintaining application availability. This change requires minimal redesign because it only modifies the Auto Scaling group's subnet configuration without altering the load balancer or compute architecture.

Answer

Increase DesiredCapacity to 4 while keeping all instances in subnet-a1.

Answer

Replace the Application Load Balancer with a Network Load Balancer.

Answer

Enable EBS encryption on the launch template volumes.

Question 19

Based on the exhibit, a single EC2 instance hosts a latency-sensitive cache that performs sustained random reads and writes to persistent block storage. The current EBS volume is a general-purpose SSD, but BurstBalance is repeatedly depleted and p95 I/O latency has risen above 20 ms. The workload needs more than 16,000 sustained IOPS. Which change is the best fix?

Accepted Answer

Replace the volume with an io2 EBS volume and provision the required IOPS.. The workload requires more than 16,000 sustained IOPS with low latency, and the gp2 volume's burst credits are exhausted, causing high latency. An io2 Block Express or io2 volume can be provisioned with the exact IOPS needed (up to 256,000 IOPS) and provides consistent single-digit millisecond latency, making it the best fix for this latency-sensitive, sustained I/O workload.

Answer

Move the data to Amazon S3 so the instance can read and write objects directly.

Answer

Keep gp2 and increase the instance size to a compute-optimized family.

Answer

Enable Amazon EFS with bursting throughput mode for the cache data.

Question 20

A SaaS platform plans to run in two AWS Regions for lower latency. The team wants to enable active-active writes (both regions accept updates) to avoid failover downtime. However, the business requires strong consistency for order status transitions (for example, only one transition from “Paid” to “Shipped” must be allowed).

Which statement is the best architectural choice to meet the consistency requirement?

Accepted Answer

Use active-active writes only when the workload tolerates eventual consistency; for strongly consistent transitions, use a single-writer pattern with failover (active-passive/pilot light).. Option A is correct because active-active writes across AWS Regions cannot guarantee strong consistency due to the inherent latency and lack of synchronous replication between Regions. For order status transitions that require exactly-once semantics (e.g., only one transition from 'Paid' to 'Shipped'), a single-writer pattern (active-passive or pilot light) ensures that only one Region accepts writes at a time, avoiding conflicts and maintaining a single source of truth. AWS services like DynamoDB global tables offer eventual consistency for multi-region writes, while Aurora Global Database provides read replicas with failover but not active-active writes for strong consistency.

Answer

Active-active writes always provide strong consistency because AWS replicates data across Regions automatically and immediately.

Answer

Active-active writes can be used safely by simply enabling retries and expecting the application to resolve conflicts without coordination.

Answer

To ensure strong consistency, run both Regions with different IAM roles and block cross-Region writes at the API layer only.