SAA-C03 Practice Exam 58 — 20 Questions

Question 1

A financial services firm stores trade confirmations in an Amazon S3 bucket. Regulations require that every object be encrypted at rest with a key the firm controls and can audit independently of AWS, and that key usage be logged. The firm wants to avoid changing application code. Which encryption approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSE-KMS with a customer managed key in AWS KMS, with CloudTrail logging of KMS API calls.. SSE-KMS with a customer managed key provides server-side encryption that requires no application changes while giving the firm ownership of the key policy, rotation, and access. KMS integrates with CloudTrail so every use of the key can be audited independently. SSE-S3, SSE-C, and client-side encryption each fall short on either customer control, auditability, or the no-code-change constraint.

Answer

SSE-S3 with bucket default encryption enabled.

Answer

SSE-C with the customer providing an encryption key on every PUT and GET request.

Answer

Client-side encryption using a key stored in an application configuration file on each server.

Question 2

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a customer analytics portal. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy? The design must avoid adding custom operational scripts.

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. The bucket policy can use the `aws:sourceVpce` condition key to restrict access exclusively to traffic originating from a specific VPC endpoint ID. This ensures that only requests sent through that VPC endpoint are allowed, meeting the security team's requirement without requiring custom scripts or additional infrastructure.

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A deny statement for all IAM users except the EC2 role

Question 3

A healthcare provider hosts a patient-records API on Amazon EC2 instances in a single Availability Zone behind an Application Load Balancer. An audit finds the architecture cannot tolerate the loss of that Availability Zone. Budget is limited, and the API reads from an Amazon Aurora MySQL cluster that currently has one writer instance and no replicas. Which change most effectively addresses the audit finding?

Accepted Answer

Add an Aurora Replica in a second Availability Zone and register EC2 instances in that same second Availability Zone with the load balancer's target group.. The audit finding is about surviving the loss of one Availability Zone, so the fix must add capacity in a second zone for both tiers. An Aurora Replica in another zone gives the database an automatic failover target, and EC2 instances in that same zone let the load balancer continue serving requests. Cross-Region designs exceed the requirement and the budget.

Answer

Enable Aurora backtrack on the cluster and increase the EC2 Auto Scaling group maximum size within the existing Availability Zone.

Answer

Convert the cluster to Aurora Global Database and add a secondary AWS Region for the EC2 fleet.

Answer

Replace Aurora with a single-instance Amazon RDS for MySQL deployment and place all EC2 instances in an Auto Scaling group with a desired capacity of one.

Question 4

A healthcare analytics platform stores derived datasets in an Amazon S3 bucket. Regulatory rules require that every object remain recoverable for 90 days after creation even if an application bug issues a delete, and that no object version be permanently destroyed during that window. The team wants the strongest protection with the least custom code. Which S3 feature should the solutions architect enable?

Accepted Answer

S3 Object Lock in compliance mode with a 90-day retention period.. S3 Object Lock in compliance mode enforces write-once-read-many protection for a defined retention period and cannot be bypassed by any user, including the root user. A 90-day retention period meets the recoverability requirement without custom code, making it the strongest and least-effort control for preventing permanent destruction of object versions.

Answer

S3 Lifecycle rules that transition objects to S3 Glacier Deep Archive after 1 day and expire them after 90 days.

Answer

S3 Object Lock in governance mode with a 90-day retention period.

Answer

S3 Versioning combined with a bucket policy that denies s3:DeleteObject.

Question 5

A inventory service exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most? The architecture review board prefers a managed AWS-native control.

Accepted Answer

CloudFront caching with appropriate TTLs. CloudFront caching with appropriate TTLs allows cached responses to be served to users even when the S3 origin is temporarily unavailable. By setting a minimum TTL (e.g., 0 seconds for fresh content, but a higher default or maximum TTL for stale content), CloudFront can continue delivering previously cached pages from edge locations during an S3 outage, ensuring high availability and resilience. This is a managed AWS-native feature that aligns with the architecture review board's preference.

Answer

AWS Backup Vault Lock

Answer

IAM Access Analyzer

Answer

S3 Select

Question 6

A media analytics company ingests a continuous stream of JSON clickstream events, roughly 20,000 records per second, into an Amazon Kinesis Data Streams stream with 32 shards. Downstream consumers must be able to re-read the same records up to 7 days later to rebuild a reporting index. Which combination of settings should the team use to maximize the number of records each consumer can read per second while preserving this replay capability?

Accepted Answer

Increase the shard count to 64, set the data retention period to 168 hours, and have each consumer use enhanced fan-out with its own dedicated 2 MiB/s read throughput per shard.. The scenario needs higher aggregate read throughput plus a full week of replayable data. Enhanced fan-out is the only mechanism that gives each consumer a dedicated 2 MiB/s per-shard read pipe instead of sharing the 2 MiB/s per-shard polling budget, and the 168-hour retention setting preserves records for the required rebuild window. Adding shards raises the aggregate ceiling further.

Answer

Switch the stream to on-demand capacity mode, keep the retention period at 24 hours, and have consumers read with the Kinesis Client Library because it partitions reads across shards with no per-shard limit.

Answer

Increase the shard count to 64, set the retention period to 168 hours, and rely on the shared GetRecords polling model because it automatically scales to 10 MiB/s per shard when many consumers register.

Answer

Keep 32 shards, set the retention period to 24 hours, and have consumers poll with the GetRecords API using a single shared throughput budget of 2 MiB/s per shard.

Question 7

A logistics company runs an order-processing workflow using AWS Step Functions. A task state invokes a Lambda function that charges customer credit cards through a third-party gateway. Occasionally the gateway times out, and the workflow fails even though the charge may have succeeded. The architect must make the workflow resilient to these transient failures and avoid duplicate charges. (Choose two.)

Accepted Answer

Configure a Retry policy on the task state with an exponential backoff and a bounded MaxAttempts value for the relevant error names.. Resilience to transient gateway timeouts requires the workflow to retry the task, and safety requires that retries not charge the customer twice. A bounded Retry policy with exponential backoff handles the transient failure, while an idempotency key carried into each attempt lets the payment gateway recognize and deduplicate repeated requests. Together they deliver both reliability and correctness.

Answer

Increase the Lambda function's reserved concurrency to the account limit so more charge requests can run in parallel.

Answer

Add a Catch field to the task state that transitions to a Fail state so the workflow stops cleanly on any error.

Answer

Enable AWS X-Ray tracing on the state machine and Lambda function to record where the timeouts occur.

Question 8

A small analytics team runs a nightly batch job on a single Amazon EC2 instance. The job starts at 2:00 AM and finishes by 4:00 AM. The instance is idle for the rest of the day. The team wants to reduce EC2 costs and is willing to accept that the instance may be stopped and started. Which action will reduce costs MOST effectively?

Accepted Answer

Stop the instance when the job completes and start it again before the next run using an automated schedule.. When an instance is needed only for a short, predictable window, stopping it during idle hours removes the compute charges for those hours. Automated start and stop scheduling is a simple and effective cost optimization for intermittent workloads. Reserved Instances and larger instance types do not eliminate the cost of idle time.

Answer

Move the job to a larger instance type to finish faster.

Answer

Enable detailed monitoring and create a CloudWatch alarm to reboot the instance if CPU utilization is low.

Answer

Purchase a 1-year All Upfront Reserved Instance for the instance.

Question 9

A retail API runs on Amazon EC2 instances behind an Application Load Balancer and stores orders in an Amazon RDS for PostgreSQL database. A test that stopped one Availability Zone caused the API to return errors because all application servers were in the same AZ and the database was single-AZ. Which two changes should the architect make to continue serving traffic during a single-AZ failure? Select two.

Accepted Answer

Configure the Auto Scaling group to launch instances across private subnets in at least two Availability Zones.. Option B is correct because an Auto Scaling group that spans private subnets in at least two Availability Zones ensures application instances remain available if one AZ fails, and the ALB can route to healthy targets in the surviving AZ. Option D is correct because converting RDS for PostgreSQL to a Multi-AZ deployment creates a synchronous standby in a different AZ and automatically fails over the database endpoint, eliminating the single-AZ database as a point of failure. Option A is wrong because increasing instance size does not address the single-AZ placement of the application servers. Option C is wrong because a single-AZ Network Load Balancer still fails when that AZ fails and does not improve database resilience. Option E is wrong because a read replica is asynchronous, is not an automatic failover target for writes, and pointing the application at the replica endpoint does not provide a highly available primary database.

Answer

Increase the EC2 instance size and keep all application servers in the same subnet.

Answer

Replace the Application Load Balancer with a Network Load Balancer in a single Availability Zone.

Answer

Add an Amazon RDS read replica and point the application to the replica endpoint.

Question 10

A financial services firm runs a batch settlement job on a fleet of Amazon EC2 instances that pull work from an Amazon SQS queue. The job must not lose messages if an instance is terminated mid-processing, and duplicate processing must be minimized because each settlement charge is expensive. The team also wants to avoid indefinite reprocessing of a message that repeatedly fails. Which two changes should the solutions architect make to meet these requirements? (Choose two.)

Accepted Answer

Increase the queue's visibility timeout so it exceeds the maximum expected processing time.. Raising the visibility timeout above the maximum processing time prevents a still-running message from being redelivered to another consumer, which directly reduces duplicate settlement charges. Attaching a dead-letter queue with a maximumReceiveCount moves repeatedly failing messages aside after a set number of receives, so they are not reprocessed indefinitely while healthy traffic continues.

Answer

Switch the queue to an Amazon SQS FIFO queue with content-based deduplication.

Answer

Store a processing flag in an Amazon ElastiCache for Redis cluster and check it before charging.

Answer

Enable long polling on the queue by setting ReceiveMessageWaitTimeSeconds to 20.

Question 11

A media company stores generated video thumbnails in an Amazon S3 bucket. The bucket currently uses the S3 Standard storage class, and the objects are accessed frequently for the first 30 days and then almost never. The company wants to reduce storage costs automatically without changing the application and must retain the objects for at least one year. Which action should a solutions architect take?

Accepted Answer

Configure an S3 Lifecycle rule to transition objects to S3 Standard-IA after 30 days and retain them for the required period.. The access pattern is known and stable: frequent for about 30 days, then rarely. A lifecycle rule that transitions objects to S3 Standard-IA after 30 days lowers storage cost automatically, requires no application change, and keeps the objects available for the required retention period.

Answer

Enable S3 Intelligent-Tiering on the bucket and let AWS move the objects between access tiers automatically.

Answer

Configure an S3 Lifecycle rule to transition objects to S3 One Zone-IA after 30 days and expire them after 365 days.

Answer

Configure an S3 Lifecycle rule to transition objects to S3 Standard-IA after 30 days and to S3 Glacier Instant Retrieval after 90 days.

Question 12

A healthcare company runs a stateless patient-intake API on a fleet of Amazon EC2 instances in a single VPC. The compliance team requires the workload to survive the complete loss of one Availability Zone with no manual intervention, and the instances must be replaced automatically if they fail health checks. The application stores no local state and writes all data to Amazon RDS. Which approach meets these requirements with the LEAST operational effort?

Accepted Answer

Create an Auto Scaling group spanning two Availability Zones with a launch template, and attach it to an Application Load Balancer target group with health checks enabled.. Resilience to a full Availability Zone loss requires capacity spread across at least two zones, and automatic instance replacement requires an Auto Scaling group whose health checks are tied to the load balancer. Combining a multi-AZ Auto Scaling group with an Application Load Balancer target group delivers both properties without manual intervention, which is exactly what the compliance requirement demands.

Answer

Launch the instances directly with a launch template into two subnets in different Availability Zones, and attach each instance to a Network Load Balancer with cross-zone load balancing enabled.

Answer

Place the instances behind an Application Load Balancer in one Availability Zone and configure an Amazon Route 53 health check with a failover record pointing to a static Elastic IP address.

Answer

Deploy the instances as an Auto Scaling group in a single Availability Zone and enable detailed CloudWatch monitoring with a scaling policy based on CPU utilization.

Question 13

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences variable traffic patterns, with sudden spikes during marketing campaigns. The operations team wants to ensure that the application can scale out quickly to handle the spikes and scale in when traffic decreases, while minimizing costs. Which solution should a solutions architect recommend?

Accepted Answer

Configure an Auto Scaling group with a target tracking scaling policy based on average CPU utilization.. A target tracking scaling policy with an Auto Scaling group is the most effective way to handle variable traffic. It automatically adjusts capacity based on CPU utilization, scaling out during spikes and scaling in during low traffic, which optimizes both performance and cost. Other options are either static, do not address scaling, or require major architectural changes.

Answer

Deploy the application on AWS Lambda behind an API Gateway and remove the EC2 instances.

Answer

Use a scheduled scaling policy that adds instances at the start of each marketing campaign.

Answer

Enable sticky sessions on the ALB and increase the instance size.

Question 14

A healthcare company is designing a new application on AWS. The application will store protected health information (PHI) in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using a customer managed AWS KMS key so that they can control key rotation and audit key usage. They also need to ensure that only the application's IAM role can decrypt the data. Which solution meets these requirements?

Accepted Answer

Use SSE-KMS with a customer managed KMS key and update the key policy to allow only the application's IAM role to decrypt.. The requirement is for server-side encryption with a customer managed KMS key, enabling control over rotation and auditing. SSE-KMS with a customer managed key provides this, and the key policy can restrict decryption to the application's IAM role. Other options either use AWS-managed keys, require custom key management, or shift encryption to the client side, none of which fully satisfy the stated needs.

Answer

Use SSE-C with a customer-provided key stored in AWS Secrets Manager and grant the application's IAM role access to the secret.

Answer

Use client-side encryption with an AWS KMS customer managed key before uploading to S3, and store the encrypted data in the bucket.

Answer

Use SSE-S3 with an S3 Bucket Key and restrict access with a bucket policy that allows only the application's IAM role.

Question 15

A logistics company runs an order-processing workload that reads messages from an Amazon SQS queue and writes results to an Amazon DynamoDB table. Occasionally the same order is processed twice and produces duplicate shipments. The architects must ensure each order is processed exactly once end to end, while keeping throughput as high as possible. What should they do?

Accepted Answer

Use an SQS FIFO queue with a message group ID per order and a DynamoDB conditional write on the order ID.. Exactly-once processing requires both a transport that deduplicates and orders messages per key, and an idempotent write at the destination. An SQS FIFO queue with per-order message group IDs provides the first, and a DynamoDB conditional write on the order ID provides the second, so retries cannot create duplicate shipments.

Answer

Keep the SQS Standard queue and increase the visibility timeout to several hours.

Answer

Enable DynamoDB Streams on the table and process changes with a second Lambda function.

Answer

Move the queue to Amazon SNS and subscribe a Lambda function to fan out the orders.

Question 16

A genomics research team stores about 400 TB of compressed sequence files in Amazon S3 and runs a distributed analysis on Amazon EC2 instances in the same Region. The analysis reads each file sequentially and writes intermediate results to local instance storage. The team reports that the S3 GET requests are a bottleneck and wants to improve read throughput while keeping data durable. (Choose two.)

Accepted Answer

Prefix the object keys with a hash or random value to spread requests across multiple S3 partitions.. S3 request performance is bounded by how well requests spread across the index partitions and by per-object concurrency. Randomizing key prefixes distributes GETs across many partitions so no single prefix throttles, and byte-range fetches let many threads or instances read one large object in parallel. Together they raise aggregate read throughput for the 400 TB analysis while the objects stay durable in S3.

Answer

Mount the bucket with an S3 File Gateway and read the files over NFS from the EC2 fleet.

Answer

Enable S3 Versioning on the bucket so concurrent readers can access older object versions.

Answer

Configure the bucket for S3 Standard-Infrequent Access to lower the cost of frequent GET requests.

Question 17

A data analytics team runs an Amazon EMR cluster for 2 hours every weekday morning to process a daily batch. The cluster must be fully available during that window, and the team wants the lowest possible compute cost. The jobs are stateless and can be re-run if a node fails. Which configuration should a solutions architect recommend?

Accepted Answer

Provision the EMR cluster with On-Demand Instances for the master node and Spot Instances for task nodes.. The workload is a short, recurring, fault-tolerant batch job, so the best cost strategy is to combine a stable On-Demand master with Spot task nodes that can be reclaimed and restarted. This preserves cluster availability while taking advantage of Spot's lower pricing. Long-term commitments and Dedicated Hosts are poor fits because the compute is neither continuous nor compliance-driven.

Answer

Provision the EMR cluster entirely with Dedicated Hosts to guarantee physical isolation and predictable pricing.

Answer

Provision the EMR cluster with On-Demand Instances for all node types and enable automatic scaling.

Answer

Provision the EMR cluster with Reserved Instances for a 3-year term to lock in the lowest hourly rate.

Question 18

A healthcare company runs a containerized claims-processing service on Amazon ECS with the Fargate launch type in a single AWS Region. The service must survive the loss of an entire Availability Zone with no manual intervention, and the architecture must keep the same service endpoint for callers. The service is fronted by an Application Load Balancer. Which combination of actions should a solutions architect take to meet these requirements with the LEAST operational overhead?

Accepted Answer

Configure the ECS service with a desired count of at least two tasks and use the spread placement strategy across the subnets of multiple Availability Zones, then register those subnets with the Application Load Balancer.. Resilience to an Availability Zone failure requires capacity to exist in more than one zone simultaneously. An ECS service with a desired count of two or more and the spread placement strategy across multiple Availability Zone subnets keeps tasks running elsewhere when one zone fails, and the Application Load Balancer automatically stops routing to unhealthy targets while preserving a stable DNS endpoint.

Answer

Deploy the ECS tasks on Amazon EC2 launch type instances in an Auto Scaling group that spans one Availability Zone, and attach an Elastic Load Balancer health check to the group.

Answer

Create a second ECS service in a different AWS Region and use an Amazon Route 53 latency-based routing policy with health checks to send traffic to the Regional Application Load Balancers.

Answer

Increase the ECS task CPU and memory reservation so each task can absorb the load of a failed Availability Zone, and enable container health checks in the task definition.

Question 19

A healthcare company stores protected health information in an Amazon S3 bucket. Auditors require that every object be encrypted with a customer managed AWS KMS key, that key rotation be controlled by the company, and that the company be able to revoke access to the data immediately by disabling the key. Which encryption configuration meets these requirements?

Accepted Answer

SSE-KMS with a customer managed key in AWS KMS, with automatic key rotation enabled.. Using SSE-KMS with a customer managed key lets the company define the key policy, enable automatic rotation, and disable the key to immediately block decryption. AWS managed keys cannot be disabled or rotated on a company-defined schedule, and SSE-S3 keys are fully managed by AWS, so neither provides the required control or revocation capability.

Answer

Client-side encryption with a data key stored in the application configuration file.

Answer

SSE-S3 with bucket versioning enabled and S3 Object Lock in compliance mode.

Answer

SSE-KMS with an AWS managed key (aws/s3) and automatic annual rotation enabled.

Question 20

A customer portal must recover from a regional outage within a few hours. The business wants lower ongoing cost than a fully active second Region and does not want to rebuild everything from scratch during the outage. Which two DR patterns best fit that goal? Select two.

Accepted Answer

Pilot light. Pilot light (B) is correct because it keeps a minimal, always-on core (for example replicated data and pre-provisioned but scaled-down compute) in the DR Region, so recovery only requires scaling up and starting the remaining resources rather than rebuilding everything from scratch, and its low baseline footprint keeps ongoing cost well below a fully active second Region. Warm standby (C) is correct because it runs a scaled-down but fully functional copy of the workload in the second Region, allowing it to be scaled up to production capacity within hours while still costing less than a fully active second Region. Backup and restore (A) is not the best fit because recovery means redeploying and rebuilding the entire environment from backups, which typically exceeds a few hours and requires substantial manual effort. Multi-site active-active (D) is excluded because running full production capacity in two Regions simultaneously is the most expensive option and contradicts the goal of lower ongoing cost. Single-AZ deployment (E) is not a cross-Region DR pattern at all and provides no protection against a regional outage.

Answer

Backup and restore

Answer

Multi-site active-active

Answer

Single-AZ deployment