SAA-C03 Practice Exam 56 — 20 Questions

Question 1

A order processing API stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of a seven-year immutable audit log without custom scripts. Compliance mode enforces a legal hold that cannot be removed by any user, ensuring logs remain intact.

Answer

S3 server access logging

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Question 2

Account Y provides a role named AnalyticsReadOnly to engineers in Account X. The role trust policy currently allows sts:AssumeRole from the Account X principal. A new security requirement states that only STS sessions created with MFA are allowed to assume the role. Which trust policy condition is the best choice to enforce MFA for sts:AssumeRole?

Accepted Answer

Add a condition "Bool": { "aws:MultiFactorAuthPresent": "true" } in the role trust policy for the sts:AssumeRole action.. Option A is correct because the `aws:MultiFactorAuthPresent` condition key checks whether the principal used MFA to obtain the session credentials. By adding a `Bool` condition set to `"true"` in the trust policy for the `sts:AssumeRole` action, only STS sessions that were created after MFA authentication will be allowed to assume the role. This directly enforces the security requirement without affecting other authentication methods.

Answer

Add a condition "StringEquals": { "aws:username": "mfa-user" } in the IAM policy attached to the role.

Answer

Add a condition requiring "sts:ExternalId" to equal a fixed value in the trust policy.

Answer

Add a condition "Bool": { "aws:SecureTransport": "true" } in the trust policy to require HTTPS.

Question 3

Based on the exhibit, the security team needs to detect and alert on both successful and failed attempts to change S3 bucket policies and KMS key policies across the organization. Which solution best meets that requirement?

Accepted Answer

Enable an organization trail for management events in all regions and create an EventBridge rule that matches PutBucketPolicy and PutKeyPolicy, then send alerts to SNS.. Option A is correct because AWS CloudTrail management events capture all API calls that modify S3 bucket policies (PutBucketPolicy) and KMS key policies (PutKeyPolicy). By enabling an organization trail for all regions, you centralize these events across the entire AWS Organization. An Amazon EventBridge rule can then filter for these specific API calls and send alerts via Amazon SNS, meeting the requirement to detect both successful and failed attempts.

Answer

Enable AWS Config in all accounts and use only a periodic compliance evaluation to alert when bucket or key policies drift.

Answer

Use IAM Access Analyzer because it continuously blocks policy changes that would expose the resources publicly.

Answer

Turn on S3 server access logging and KMS key rotation, because both services will capture policy modifications automatically.

Question 4

A public API for a customer analytics portal is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used? The design must avoid adding custom operational scripts.

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. Option B is correct because a JWT authorizer in API Gateway can validate tokens issued by an external OpenID Connect (OIDC) provider without requiring custom code. The JWT authorizer automatically verifies the token's signature, expiry, and issuer against the OIDC provider's JWKS endpoint, meeting the requirement for standards-based authentication and avoiding custom operational scripts.

Answer

API keys only

Answer

IAM authorization for all internet users

Answer

A VPC endpoint policy

Question 5

A public web application sits behind Amazon CloudFront with an Application Load Balancer as the origin. The security team wants all edge traffic inspected by AWS WAF and also wants to prevent anyone on the internet from reaching the ALB directly. Which two changes should be made? Select two.

Accepted Answer

Associate an AWS WAF web ACL with the CloudFront distribution.. Option A is correct because AWS WAF can be associated directly with a CloudFront distribution to inspect all edge traffic before it reaches the origin. This allows the security team to filter malicious requests at the AWS edge locations, reducing the attack surface and offloading processing from the Application Load Balancer.

Answer

Place the ALB in private subnets and keep the CloudFront distribution unchanged.

Answer

Use an S3 Origin Access Control instead of a security group change.

Answer

Open the ALB to 0.0.0.0/0 and rely on WAF alone for protection.

Question 6

A media processing pipeline uses EBS-backed storage for an application that performs sustained random I/O with low latency requirements. During peak processing windows, the team sees increased read latency and occasional timeouts at the application layer. They need predictable, high IOPS performance rather than best-effort throughput. Which EBS configuration choice is most appropriate?

Accepted Answer

Use io1 or io2 EBS volumes configured with a high provisioned IOPS value, and attach them to EBS-optimized instances.. Option B is correct because io1 and io2 volumes are provisioned IOPS SSD volumes designed for sustained, predictable high IOPS performance, which directly addresses the application's need for low-latency random I/O during peak loads. Attaching them to EBS-optimized instances ensures dedicated network bandwidth for EBS traffic, eliminating contention and preventing timeouts.

Answer

Use gp2 volumes and rely on burst credits to handle peak random I/O latency requirements.

Answer

Use standard HDD (st1) volumes, because they provide high throughput and will reduce latency automatically.

Answer

Use S3 instead of EBS for random I/O latency reduction without changing the application.

Question 7

A media company has users around the world uploading 1 to 5 GB files directly to a single Amazon S3 bucket. Upload times are slow from distant regions, but the app must keep using S3 as the destination. What should the architects enable to improve upload performance?

Accepted Answer

Amazon S3 Transfer Acceleration on the bucket.. Amazon S3 Transfer Acceleration (B) uses AWS edge locations to accelerate uploads over the public internet. When a user uploads a file, the data is sent to the nearest edge location via optimized network paths, then forwarded over AWS's private backbone to the S3 bucket. This reduces latency and improves throughput for large files (1–5 GB) from distant regions, directly addressing the slow upload times while keeping S3 as the destination.

Answer

Amazon CloudFront for origin caching of uploaded files.

Answer

Provisioned IOPS EBS volumes attached to a transfer server.

Answer

Amazon EFS with a mount target in each Region.

Question 8

A patient portal must use shared file storage across Linux EC2 instances in multiple Availability Zones. The storage must remain available during an AZ failure. Which service should be used? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Amazon EFS with mount targets in multiple Availability Zones. Amazon EFS provides a fully managed, shared POSIX-compliant file system that can be mounted concurrently across multiple Linux EC2 instances. By creating mount targets in multiple Availability Zones, the file system remains accessible even if one AZ fails, meeting the high-availability requirement. This aligns with the architecture review board's preference for a managed AWS-native control.

Answer

Instance store volumes

Answer

An EBS volume attached to all instances

Answer

S3 mounted as a POSIX file system without a file gateway

Question 9

A photo studio stores original project archives in Amazon S3. Objects are read heavily for 14 days after upload, occasionally during the next 11 months, and almost never after one year. The team wants the lowest storage cost while keeping retrieval within minutes during the first year. Which three actions are best? Select three.

Accepted Answer

Keep new objects in S3 Standard for the first 14 days.. A is correct because S3 Standard is designed for frequently accessed data with low latency and high throughput, making it ideal for the first 14 days when objects are read heavily. After this period, transitioning to S3 Standard-IA reduces storage costs while still providing millisecond retrieval for occasional access during the next 11 months.

Answer

Transition objects to S3 Glacier Flexible Retrieval after 14 days.

Answer

Disable versioning to make the lifecycle rules work correctly.

Question 10

Based on the exhibit, what should the architect recommend to reduce inter-node latency for this workload?

Accepted Answer

Launch the instances in a cluster placement group within the same Availability Zone.. A cluster placement group provides the lowest possible latency and highest packet-per-second performance by ensuring instances are placed in close physical proximity within a single Availability Zone. This is ideal for tightly coupled, high-performance computing workloads that require low inter-node latency.

Answer

Use a spread placement group so each instance is placed on separate hardware.

Answer

Move the instances into different Availability Zones to improve fault tolerance.

Answer

Use a partition placement group to balance traffic across partitions.

Question 11

A Multi-AZ Amazon RDS database experiences incorrect writes at 10:15 UTC due to a buggy release. The team detects the problem at 10:25 UTC. They want to restore the data to a known-good point around 10:15 UTC, and validate the recovered data, without taking the current production instance offline during the recovery process. What is the most appropriate AWS action?

Accepted Answer

Perform a point-in-time restore (PITR) to a new DB instance using a restore time around 10:15 UTC, then test the restored instance before cutting over.. Option B is correct because Amazon RDS point-in-time recovery (PITR) allows you to restore a DB instance to any second within the backup retention period, creating a new, independent DB instance. This lets you validate the recovered data without affecting the current production instance, which remains online and serving traffic. The team can then cut over to the restored instance after confirming it is clean.

Answer

Immediately reboot the RDS instance and rely on the reboot to roll back the bad writes.

Answer

Create a new Read Replica from the current primary and use it as the recovered database after applying reverse migrations.

Answer

Temporarily disable Multi-AZ to speed up storage rollback, then re-enable Multi-AZ.

Question 12

Based on the exhibit, the application team wants the database to keep the same connection endpoint during failover and to reconnect automatically after the primary instance becomes unavailable. Which change best meets the requirement?

Accepted Answer

Replace the IP address with the RDS DNS endpoint and add client retry logic that re-resolves DNS after connection loss.. Option B is correct because using the RDS DNS endpoint ensures that the application connects to the current primary instance, even after a failover. When the primary becomes unavailable, RDS promotes a standby (or read replica) to a new primary and updates the DNS record to point to the new instance's IP. By adding client retry logic that re-resolves DNS after a connection loss, the application automatically picks up the new IP and reconnects without manual intervention, meeting both requirements of a stable endpoint and automatic reconnection.

Answer

Keep the IP address and increase the JDBC connection timeout so the application waits longer during failover.

Answer

Create an additional read replica and point the application to it so failover is faster.

Answer

Place a Network Load Balancer in front of the database and use the load balancer target IP to avoid DNS changes.

Question 13

A patient portal must process every event at least once, but duplicate processing is acceptable if the consumer handles idempotency. Which eventing approach is most suitable? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Use Amazon SQS standard queue and design consumers to be idempotent. Amazon SQS standard queues provide at-least-once delivery, meaning each message is delivered at least once but may be delivered more than once. This aligns perfectly with the requirement that every event must be processed at least once and that duplicate processing is acceptable if consumers are idempotent. SQS is a fully managed, AWS-native service that meets the architecture review board's preference for a managed solution.

Answer

Use an in-memory queue on one EC2 instance

Answer

Use UDP messages sent directly to workers

Answer

Use CloudFront signed URLs

Question 14

Based on the exhibit, which storage design best supports the application servers' shared working directory requirement?

Accepted Answer

Mount Amazon EFS on every EC2 instance and use it as the shared workspace.. Amazon EFS provides a fully managed, NFS-based shared file system that can be mounted concurrently on multiple EC2 instances across multiple Availability Zones. This directly satisfies the requirement for a shared working directory where all application servers can read and write files simultaneously without additional synchronization logic.

Answer

Attach one gp3 EBS volume to each instance and synchronize the files with cron jobs.

Answer

Store the artifacts in S3 and have each node read them directly from S3 as a filesystem.

Answer

Use instance store on each instance because it provides the fastest local file access.

Question 15

Based on the exhibit, an application role in Account B can reach an S3 bucket in Account A, but reads fail with AccessDenied on KMS. The bucket objects use SSE-KMS with a customer managed key in Account A. What change is required so the application can decrypt the objects while keeping the access restricted?

Accepted Answer

Add the Account B role ARN to the KMS key policy with kms:Decrypt and kms:DescribeKey permissions, scoped to S3 usage in us-east-1.. Option A is correct because when using SSE-KMS with a customer managed key, cross-account access requires the KMS key policy to explicitly grant the external IAM role (from Account B) the kms:Decrypt and kms:DescribeKey permissions. Without these, S3 can retrieve the encrypted object, but KMS will deny the decryption request, resulting in an AccessDenied error. Scoping the policy to S3 usage in us-east-1 follows the principle of least privilege while enabling the necessary decryption.

Answer

Add s3:GetEncryptionConfiguration to the Account B IAM policy so S3 can use the customer managed key on reads.

Answer

Change the bucket to SSE-S3 because SSE-S3 always allows cross-account reads without any KMS policy changes.

Answer

Add the Account B role to the bucket ACL with FULL_CONTROL so S3 can bypass KMS on behalf of the reader.

Question 16

A SaaS company runs a production API on an EC2 Auto Scaling group with steady demand 24/7. The team uses multiple instance types over time (they switch types during tuning) but the overall compute hours are stable. They want a cost reduction without committing to a specific instance type or size. Which AWS pricing option best meets the requirement?

Accepted Answer

Purchase a Compute Savings Plan for the region and commit to a dollar-per-hour amount. B is correct because a Compute Savings Plan provides the flexibility to change instance types, sizes, and even compute services (e.g., EC2, Fargate, Lambda) within a region while still receiving discounted rates (up to 66% vs. on-demand). This matches the requirement of reducing costs without committing to a specific instance type or size, as the plan is based on a dollar-per-hour commitment rather than instance family or tenancy.

Answer

Buy EC2 Spot Instances for the Auto Scaling group to maximize savings

Answer

Purchase Reserved Instances that are limited to a single specific instance type in the Auto Scaling group

Answer

Use on-demand only, and rely on Auto Scaling to reduce cost during low utilization

Question 17

An S3 bucket stores user-uploaded images. Access patterns are unpredictable: some objects are never read again, while others are occasionally retrieved months later. The team wants to reduce storage cost without having to manually track access frequency or run periodic analyses. Which S3 storage and lifecycle approach is the best fit?

Accepted Answer

Enable S3 Intelligent-Tiering so objects can automatically move between access tiers based on observed access patterns.. S3 Intelligent-Tiering is the best fit because it automatically moves objects between access tiers (frequent, infrequent, archive instant, archive) based on changing access patterns, eliminating the need for manual tracking or lifecycle rules. This optimizes storage costs for unpredictable access patterns without requiring you to define fixed time-based transitions or perform periodic analyses.

Answer

Use S3 Glacier Instant Retrieval for all objects immediately to minimize storage cost.

Answer

Create a lifecycle rule that transitions objects to Standard-IA after a fixed 30 days, regardless of access.

Answer

Keep all objects in S3 Standard and reduce costs by enabling server access logging compression.

Question 18

A mobile banking backend stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects until the retention period expires. This meets the compliance requirement of immutable audit logs for seven years, as compliance mode enforces a legal hold that cannot be removed by any party.

Answer

S3 server access logging

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Question 19

A patient portal must use shared file storage across Linux EC2 instances in multiple Availability Zones. The storage must remain available during an AZ failure. Which service should be used?

Accepted Answer

Amazon EFS with mount targets in multiple Availability Zones. Amazon EFS provides a scalable, fully managed NFS file system that can be mounted concurrently on multiple Linux EC2 instances. By creating mount targets in multiple Availability Zones, the file system remains accessible even if one AZ fails, ensuring high availability and shared file storage across instances.

Answer

Instance store volumes

Answer

An EBS volume attached to all instances

Answer

S3 mounted as a POSIX file system without a file gateway

Question 20

A retail company lets developers deploy ECS services but they must never be able to modify IAM. The team currently uses an IAM user per developer with an admin-like policy, and several access keys have been leaked. You are asked to redesign access so that: (1) developers authenticate with temporary credentials, (2) they can create/update ECS services and related autoscaling resources, and (3) IAM changes are impossible even if a developer tries to attach new policies.

Which design best meets all requirements?

Accepted Answer

Use an IAM role that developers assume for deployments; attach least-privilege policies for ECS and Auto Scaling; and attach a permission boundary that does not allow iam:* actions, so additional inline or managed policies cannot grant IAM permissions.. Option B is correct because it uses an IAM role with temporary credentials (via AWS STS AssumeRole), satisfying the requirement that developers never have long-term access keys. The least-privilege policies restrict actions to ECS and Auto Scaling only, and the permission boundary explicitly denies iam:* actions, preventing developers from escalating privileges by attaching new policies to their role. This combination ensures developers can deploy ECS services but cannot modify IAM in any way.

Answer

Create an IAM user for each developer and keep the existing broad permissions, rotating keys every 90 days.

Answer

Attach a policy that allows ecs:* and autoscaling:* and rely on developers to self-review that no IAM statements are added to their roles.

Answer

Create a single shared IAM role with full administrator permissions so developers can troubleshoot faster when deployments fail.