SAA-C03 Practice Exam 59 — 20 Questions

Question 1

A logistics company runs an order processing system on Amazon EC2 instances that read and write to an Amazon RDS for MySQL database. The database is currently a Single-AZ deployment. The company needs the database to survive an Availability Zone failure with automatic failover and minimal downtime. The application connects using a hardcoded DNS name. Which change should a solutions architect make?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Convert the RDS for MySQL database to a Multi-AZ DB instance deployment and continue using the existing endpoint.. Converting the RDS for MySQL database to a Multi-AZ DB instance deployment creates a synchronous standby in a second Availability Zone and enables automatic failover. The database endpoint remains unchanged, so the application's hardcoded DNS name continues to work, satisfying the requirements for zone resilience and minimal downtime.

Answer

Enable automated backups with a longer retention period and restore the database to a new instance during a failure.

Answer

Create a read replica in another Availability Zone and update the application to use the read replica endpoint for writes.

Answer

Migrate the database to Amazon DynamoDB with global tables enabled.

Question 2

A company runs a microservices application on Amazon ECS with AWS Fargate. The tasks run continuously, and the company has committed to a 3-year term. The team wants to reduce Fargate compute cost while keeping the same task definitions and architecture. Which action should a solutions architect take?

Accepted Answer

Purchase a Compute Savings Plan to cover the Fargate vCPU and memory usage.. Compute Savings Plans cover Fargate usage and provide a discount in exchange for a term commitment, so they lower the vCPU and memory rate without changing task definitions or the ECS architecture. Fargate Spot and EC2 Spot introduce interruption risk unsuitable for continuously running services, and resizing task resources changes the workload rather than the pricing model.

Answer

Reduce the task CPU and memory values in the task definition to lower the Fargate rate.

Answer

Convert the Fargate tasks to EC2 launch type with Spot Instances.

Answer

Enable Fargate Spot for all tasks to obtain the lowest possible compute rate.

Question 3

A healthcare analytics company runs an Amazon RDS for MySQL database in a private subnet. A compliance requirement mandates that all data at rest be encrypted with a key that the company can rotate, audit, and immediately revoke. The database is currently unencrypted. What is the MOST operationally efficient way to meet this requirement?

Accepted Answer

Take a snapshot of the DB instance, restore it with encryption enabled using a customer managed KMS key, and repoint the application to the new instance.. Encryption at rest for RDS must be enabled at creation. For an existing unencrypted instance, the supported path is to snapshot, restore with encryption using a customer managed KMS key, and repoint the application. This meets the need for customer-controlled rotation, audit trails, and revocability.

Answer

Enable encryption on the existing DB instance by modifying it and specifying a customer managed AWS KMS key.

Answer

Create an encrypted read replica from the unencrypted instance, promote it, and update the application endpoint.

Answer

Enable encryption by restoring the automated backup to a new instance with the default AWS managed key aws/rds.

Question 4

A claims portal uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend?

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS with an EC2 instance role allows the application to obtain a short-lived authentication token (valid for 15 minutes) using the AWS CLI or SDK, without storing any credentials on the instance. The EC2 instance role provides the necessary permissions to generate the token, which is then used instead of a static password, meeting both security requirements.

Answer

Store the database password in user data

Answer

Embed the database password in the AMI

Answer

Use a security group rule that allows only application instances

Question 5

A media company stores video masters in an Amazon S3 bucket encrypted with a customer managed AWS KMS key. Editors sign in through a corporate identity provider that is federated to AWS IAM Identity Center, and they must be able to download and re-upload objects. The security team wants every editor's read of the key material recorded in CloudTrail with the editor's own identity, and wants to be able to revoke one editor's access without affecting the others. Which configuration meets these requirements?

Accepted Answer

Create a KMS key policy statement that allows kms:Decrypt and kms:GenerateDataKey to the IAM Identity Center permission set role, and let each editor assume that role with their federated identity.. When objects use SSE-KMS, every download requires kms:Decrypt and every upload requires kms:GenerateDataKey, and those calls appear in CloudTrail tied to the calling principal. Federating editors into a permission set role means the role session carries their identity, giving per-person audit records and per-person revocation by removing the assignment, while the key policy authorizes the shared role.

Answer

Generate a data key with kms:GenerateDataKeyWithoutPlaintext once, store it in AWS Secrets Manager, and have each editor retrieve it to encrypt and decrypt objects locally before uploading.

Answer

Enable S3 server access logging on the bucket and create a separate IAM user for each editor with an inline policy allowing kms:Decrypt on the key.

Answer

Attach a bucket policy to the S3 bucket that grants s3:GetObject to the federated principal, and rely on the default aws/s3 AWS managed key for encryption so no KMS permissions are needed.

Question 6

A logistics company runs a shipment-tracking service on a single Amazon EC2 instance in one Availability Zone. The instance stores tracking state in an attached Amazon EBS volume and writes nightly backups to Amazon S3. The company needs the service to survive the loss of an entire Availability Zone with minimal data loss and automatic recovery, while keeping changes minimal. Which design change should a solutions architect recommend?

Accepted Answer

Create an Amazon Machine Image of the instance and place an Auto Scaling group behind an Application Load Balancer across at least two Availability Zones, storing state in Amazon RDS Multi-AZ.. Surviving an Availability Zone failure requires eliminating single-AZ dependencies. Running stateless application instances in an Auto Scaling group behind an Application Load Balancer spreads compute across multiple zones and replaces failed capacity automatically, while Amazon RDS Multi-AZ keeps a synchronously updated standby in a different zone that takes over with the same endpoint, satisfying both automatic recovery and minimal data loss.

Answer

Enable termination protection and detailed monitoring on the existing instance, and increase the EBS volume size to improve durability.

Answer

Take more frequent EBS snapshots and copy them to another AWS Region so the volume can be restored after an outage.

Answer

Attach an additional Elastic Network Interface to the instance and assign an Elastic IP address so clients reconnect quickly after a failure.

Question 7

A small e-commerce company hosts its website on a single EC2 instance in a public subnet. The site receives low but steady traffic. The company wants to reduce cost and is willing to accept a brief interruption if the instance is terminated. The workload can be restarted automatically. Which EC2 purchasing option should the company use to minimize cost?

Accepted Answer

Spot Instances. Spot Instances provide the deepest discounts and are designed for workloads that can tolerate interruptions. Since the company accepts a brief interruption and can restart automatically, Spot aligns perfectly with the workload characteristics. On-Demand, Reserved Instances, and Dedicated Hosts are either more expensive or require commitments that are unnecessary for this flexible, low-traffic website.

Answer

On-Demand Instances

Answer

Reserved Instances with a 3-year term and all upfront payment

Answer

Dedicated Hosts

Question 8

A startup runs a read-heavy product catalogue API on Amazon DynamoDB. The table uses on-demand capacity mode, and the team notices that repeated queries for the same popular items return consistently, causing high read request charges. The application can tolerate data that is a few seconds stale. Which change reduces read costs while keeping latency low?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for the table and route the read queries through the DAX cluster.. A DAX cluster caches item reads in memory and serves repeated requests for the same popular items without touching the table, which cuts read request charges and keeps latency in the microsecond range. Because the application can accept data that is a few seconds stale, the cache's item TTL behavior is acceptable, making DAX the direct fit for this read-heavy, repeated-key pattern.

Answer

Create a global secondary index on the queried attributes and read from the index instead of the table.

Answer

Switch the table to provisioned capacity mode and purchase reserved capacity.

Answer

Increase the table's read capacity and enable auto scaling to handle the repeated queries.

Question 9

A startup runs a single Amazon EC2 instance hosting both a web application and its MySQL database. The founders want the application to survive the failure of the underlying hardware without changing the database engine, and they want the smallest possible operational change. What should the architect recommend?

Accepted Answer

Move the database to an Amazon RDS for MySQL Multi-AZ DB instance and place the web application on an EC2 instance in an Auto Scaling group spanning two Availability Zones.. The goal is automatic recovery for both tiers without changing the database engine. RDS for MySQL Multi-AZ provides a managed standby that fails over automatically, and an Auto Scaling group across two Availability Zones can replace a failed web server. Together they remove the single point of failure with far less operational burden than self-managing replication or restoring snapshots.

Answer

Keep both tiers on one EC2 instance but enable detailed monitoring and create an Amazon CloudWatch alarm that emails the founders when CPU is high.

Answer

Create an Amazon EBS snapshot schedule for the instance's volume and restore the snapshot to a new instance if the hardware fails.

Answer

Migrate the database to Amazon DynamoDB and rewrite the application to use the DynamoDB API.

Question 10

A company is designing a secure architecture for a new application on AWS. The application will store sensitive data in Amazon S3 and will be accessed by users from a web browser. The security team requires that data be encrypted in transit and at rest, and that access to the S3 bucket be limited to only the application's users. The company also wants to minimize operational overhead. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Configure the S3 bucket policy to deny requests that do not use TLS (aws:SecureTransport condition).. To encrypt data in transit, a bucket policy that denies non-TLS requests enforces HTTPS. To limit access to application users, Cognito user pools authenticate users and identity pools issue temporary credentials with an IAM role scoped to the bucket. Together, these provide secure access with minimal operational overhead. The other options either do not address both requirements or increase management burden.

Answer

Create an IAM user for each application user and attach a policy that allows access to the S3 bucket.

Answer

Configure the S3 bucket to use server access logging and enable AWS CloudTrail data events for the bucket.

Answer

Enable S3 default encryption with SSE-S3 and enable versioning on the bucket.

Question 11

A startup runs a nightly batch job on a single Amazon EC2 instance that stores results in an Amazon EBS volume. The job takes six hours, and the team wants to resume from the last completed step if the instance is terminated unexpectedly. Which approach provides the required durability with the least operational effort?

Accepted Answer

Store intermediate results in Amazon S3 and write a checkpoint file after each completed step. Storing intermediate results in Amazon S3 with checkpoint files gives durable, externally persisted state that survives instance termination and lets the job resume from the last completed step. S3 is managed, so there is no replication or volume management to operate, which matches the low-effort requirement. Snapshots and RAID do not provide automatic step-level resume without custom logic.

Answer

Enable EBS Multi-Attach on the volume and attach it to a standby instance in another Availability Zone

Answer

Move the EBS volume to a RAID 1 configuration across two Availability Zones using mdadm

Answer

Create a snapshot schedule for the EBS volume and restore from the latest snapshot after termination

Question 12

A startup is deploying a new web application on AWS. The security team wants to ensure that all data stored in Amazon S3 is encrypted at rest and that the company retains full control over the encryption keys, including the ability to audit key usage and rotate keys on demand. The team also wants to minimize the operational burden of managing key infrastructure. Which S3 encryption option should a solutions architect recommend?

Accepted Answer

Server-side encryption with AWS KMS customer managed keys (SSE-KMS).. SSE-KMS with customer managed keys provides encryption at rest while giving the company control over key policies, rotation, and auditing via CloudTrail. AWS handles the key infrastructure, so operational burden stays low. SSE-S3 offers no customer key control, SSE-C requires per-request key management, and client-side encryption shifts significant complexity to the application, making SSE-KMS the appropriate choice.

Answer

Client-side encryption with a key stored in AWS Secrets Manager.

Answer

Server-side encryption with customer-provided keys (SSE-C).

Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3).

Question 13

A claims workflow uses an RDS MySQL database and must remain available during an Availability Zone failure with minimal application changes. What should the architect enable?

Accepted Answer

Multi-AZ deployment for the RDS DB instance. Multi-AZ deployment for RDS MySQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of an AZ failure, Amazon RDS automatically fails over to the standby, providing high availability with minimal application changes (the application simply reconnects to the same endpoint). This meets the requirement for availability during an AZ outage without requiring code modifications.

Answer

S3 Cross-Region Replication

Answer

EBS snapshots every hour

Answer

Read replicas only

Question 14

A financial services firm runs a containerized risk-analysis platform on Amazon EKS. The containers are stateless and the platform runs continuously, but the firm wants a pricing model that reduces compute cost for the steady baseline while still allowing occasional short bursts above the baseline. Which combination of actions best achieves this?

Accepted Answer

Purchase a Compute Savings Plan sized to the steady baseline and run any burst capacity as On-Demand.. Matching a Compute Savings Plan to the steady baseline discounts the always-on portion of the container platform while letting short bursts run at On-Demand rates keeps costs aligned with actual usage. This avoids paying for peak capacity continuously, which is what reserving to peak would do. Spot capacity is cheaper but too unreliable for a production platform that must remain available.

Answer

Purchase a Convertible Reserved Instance for peak capacity and let it automatically cover bursts.

Answer

Purchase a Standard Reserved Instance sized to peak capacity for the entire platform.

Answer

Run the entire platform on Spot Instances to maximize the discount.

Question 15

A financial services firm runs a three-tier web application on AWS. The security team wants to ensure that only the application tier can connect to the database tier on TCP port 5432, and that no other subnet can initiate connections to the database. The database runs on Amazon RDS for PostgreSQL in a dedicated subnet group. Which combination of controls enforces this requirement with the LEAST administrative effort?

Accepted Answer

Create a security group for the database that allows inbound TCP 5432 from the application tier's security group, and assign it to the RDS instance.. Security groups are stateful and support referencing other security groups as sources, which allows the database to accept connections only from instances that carry the application tier's security group. This automatically scales with the application tier and avoids managing CIDR ranges or ephemeral ports. Network ACLs, route tables, and PrivateLink do not provide the same identity-aware, instance-level enforcement with minimal effort.

Answer

Use AWS PrivateLink to expose the database through a VPC endpoint and attach an endpoint policy that allows only the application tier.

Answer

Place the database in a private subnet and configure a route table that only the application tier can use to reach it.

Answer

Create a network ACL on the database subnet that allows inbound TCP 5432 from the application subnet CIDR and denies all other inbound traffic.

Question 16

A healthcare provider runs a patient-record API on Amazon EC2 instances behind an Application Load Balancer in one AWS Region. The API reads from an Amazon RDS for MySQL DB instance. The provider must be able to continue serving read traffic if the primary database instance fails, and must minimize the time the application is unavailable. Which change should a solutions architect make?

Accepted Answer

Convert the DB instance to an Amazon RDS Multi-AZ DB instance deployment so a standby is maintained in another Availability Zone.. Database high availability with minimal application downtime is achieved by running Amazon RDS Multi-AZ, which keeps a synchronously replicated standby in another Availability Zone and performs automatic failover to it. Because the failover updates the same endpoint, applications reconnect without manual reconfiguration.

Answer

Store the database credentials in AWS Secrets Manager and rotate them automatically on a schedule.

Answer

Create a read replica in the same Availability Zone and point read traffic to it using a custom application load-balancing layer.

Answer

Enable automated backups with a longer retention period and increase the DB instance class size.

Question 17

A financial services company runs a three-tier web application on AWS. The application tier consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. A security audit reveals that the application instances are receiving large volumes of unwanted traffic directly from the internet on port 443, bypassing the load balancer. The company wants to ensure that only traffic from the ALB can reach the application instances, while allowing the instances to download software updates from the internet. What should a solutions architect recommend?

Accepted Answer

Configure the application instances' security group to allow inbound traffic only from the ALB's security group, and place the instances in private subnets with a NAT gateway for outbound internet access.. The most secure and operationally sound approach is to use security group referencing so that the instances accept traffic only from the load balancer, and to remove direct internet exposure by placing instances in private subnets. A NAT gateway then allows outbound updates. This combination enforces the traffic path through the ALB while preserving necessary outbound connectivity.

Answer

Modify the network ACL on the application subnets to deny inbound traffic on port 443 from all sources except the ALB's private IP addresses.

Answer

Attach an AWS WAF web ACL to the ALB and create a rule to block all IP addresses except those in the ALB's subnet CIDR range.

Answer

Move the application instances to a placement group and enable enhanced networking to prevent direct internet access.

Question 18

A healthcare analytics platform processes streaming records with an AWS Lambda function that writes results to an Amazon DynamoDB table. The pipeline must not lose records if the function throws an error, and the operations team wants to inspect and reprocess failed records without writing custom retry code. Which approach should the solutions architect use?

Accepted Answer

Configure the event source mapping with a maximum retry count and a destination on failure set to an Amazon SQS queue configured as a dead-letter queue. Lambda event source mappings support a maximum retry count plus an on-failure destination that captures the failed batch after retries are exhausted. Pointing that destination at an SQS queue gives the team a durable holding area where failed records can be examined and replayed, satisfying both no-loss and no-custom-code goals. The other options either only tune performance, rely on nonexistent indefinite retries, or reintroduce the custom logic the team wants to eliminate.

Answer

Write a wrapper inside the function that catches exceptions and re-sends the batch to the stream before returning success

Answer

Set the function's timeout to the maximum value and rely on Lambda's built-in retry of the entire batch until it succeeds

Answer

Increase the Lambda function's reserved concurrency so that retries happen faster and failures are less likely

Question 19

A startup runs a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to rate-limit requests from specific IP addresses. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS WAF. AWS WAF is the service designed to filter and monitor HTTP requests at the application layer. It provides managed rule groups that block SQL injection and cross-site scripting, and rate-based rules that limit requests from specific IP addresses. Associating a web ACL with the Application Load Balancer enforces these protections directly on incoming traffic, meeting both requirements.

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Question 20

A order processing API must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control?

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. Service Control Policies (SCPs) are a preventive control that can deny the ec2:CreateVolume API call when the encryption condition (ec2:Encrypted) is false. This ensures that no unencrypted EBS volumes can be created at the account level, regardless of IAM permissions. SCPs operate at the AWS Organizations root, OU, or account level and are evaluated before any IAM policies, making them the strongest preventive mechanism.

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Answer

Enable VPC Flow Logs

Answer

Tag encrypted volumes after creation