SAA-C03 Practice Exam 59 — 20 Questions

Question 1

You have an S3 bucket that stores customer-specific private files. You want to serve these files through CloudFront, where clients must use signed cookies (or signed URLs) to access the content. In addition, you need to block common web exploits and rate-limit suspicious traffic at the edge. Which design best meets these requirements?

Accepted Answer

Keep the S3 bucket private, configure CloudFront with Origin Access Control so only CloudFront can access the origin, require signed cookies/URLs for viewers, and associate an AWS WAF web ACL with CloudFront for blocking and rate limiting.. Option A is correct because it combines a private S3 bucket with Origin Access Control (OAC) to ensure only CloudFront can access the origin, enforces signed cookies/URLs for viewer authentication, and uses AWS WAF at the edge to block common web exploits and rate-limit suspicious traffic. This layered approach provides both authorization (via signed requests) and security filtering (via WAF) at the CloudFront edge, meeting all requirements.

Answer

Enable public read access on the S3 bucket and rely on WAF alone for authorization because WAF can validate signatures.

Answer

Configure CloudFront with signed URLs but do not change the S3 bucket access settings; leaving public access enabled is acceptable since CloudFront can filter traffic.

Answer

Use WAF at CloudFront but omit signed cookies/URLs because rate limiting and exploit blocking already provide access control for private files.

Question 2

Your team serves static JavaScript and CSS files from an S3 origin through CloudFront. After a release, the CloudFront cache hit ratio dropped because clients keep re-downloading the same assets. What is the best next change to improve caching performance?

Accepted Answer

Update origin responses to include long-lived Cache-Control headers (for example, max-age) so CloudFront can cache objects. Option A is correct because setting long-lived Cache-Control headers (e.g., max-age=31536000) on static assets tells CloudFront to cache them at edge locations for an extended period. This reduces the number of requests forwarded to the S3 origin, improving the cache hit ratio and preventing clients from re-downloading unchanged assets on every visit.

Answer

Switch the S3 bucket to S3 Glacier so objects are not frequently accessed

Answer

Disable CloudFront compression to reduce CPU usage at the edge

Answer

Set CloudFront to forward all query strings to the origin to ensure the latest assets are returned

Question 3

Your global users access static images stored in S3. Origin bandwidth costs are higher than expected because CloudFront is not caching effectively. What change most directly reduces origin fetches (and typically lowers data transfer costs) without changing application logic?

Accepted Answer

Configure CloudFront caching by setting appropriate cache-control headers and/or CloudFront cache policy/TTL values for the static objects. The high origin bandwidth costs are caused by CloudFront not caching effectively, meaning too many requests reach the S3 origin. By configuring appropriate Cache-Control headers or a CloudFront cache policy with optimal TTL values, you ensure that CloudFront caches the static images at edge locations for longer periods. This directly reduces the number of origin fetches, lowering data transfer costs without any changes to the application logic.

Answer

Disable CloudFront caching so every request goes back to S3 for the latest image

Answer

Route users directly to the S3 website endpoint to bypass CloudFront

Answer

Turn on a NAT Gateway for the CloudFront origin to reduce bandwidth charges

Question 4

You use Amazon CloudFront in front of a private content S3 origin. To mitigate an OWASP Top 10 issue, you created a WAF web ACL and associated it to the CloudFront distribution, but attacks are still reaching the origin.

CloudWatch logs show the web ACL rules never match for the CloudFront requests.

What is the most likely configuration mistake?

Accepted Answer

The WAF web ACL intended for CloudFront must be created in the us-east-1 (N. Virginia) region (CloudFront scope), even if the rest of the stack is in another region.. When using AWS WAF with CloudFront, the web ACL must be created in the US East (N. Virginia) region (us-east-1) because CloudFront is a global service that only supports WAF web ACLs with a global scope, which are always defined in us-east-1. If the web ACL is created in any other region, it will be a regional web ACL and cannot be associated with a CloudFront distribution, causing the rules to never be evaluated against incoming requests. This explains why CloudWatch logs show no rule matches—the web ACL is effectively not attached to the CloudFront distribution.

Answer

WAF rules only evaluate requests after they reach the origin, so the absence of matches means the origin is blocking traffic first.

Answer

For CloudFront, you must use a regional WAF endpoint and cannot use a global web ACL.

Answer

WAF web ACL rules never apply to signed URLs or signed cookies, so the web ACL is bypassed by design.

Question 5

Your EC2 instances run in private subnets with no NAT gateway. The instances use the AWS SDK to call STS AssumeRole to obtain temporary credentials for other services. Application logs show errors like: "EndpointConnectionError: Could not connect to https://sts.<region>.amazonaws.com".

Which change most directly resolves this while keeping instances private?

Accepted Answer

Create an interface VPC endpoint for STS (com.amazonaws..sts) and associate it with the instance subnets and a security group that allows HTTPS.. The error indicates that the EC2 instances in private subnets cannot reach the STS public endpoint over the internet because there is no NAT gateway or internet gateway attached to the private subnets. Creating an interface VPC endpoint for STS (com.amazonaws..sts) allows the instances to communicate with the STS API privately using AWS PrivateLink, without requiring internet access. Associating the endpoint with the instance subnets and a security group that allows HTTPS (port 443) ensures that traffic stays within the AWS network, resolving the connectivity error while keeping the instances private.

Answer

Create a gateway VPC endpoint for S3 and route the STS traffic through the S3 endpoint gateway.

Answer

Open an inbound rule in the instances’ security group to allow outbound HTTPS to the internet CIDR block directly.

Answer

Attach an Internet Gateway to the private subnet route table so the STS API can be reached over public internet.

Question 6

Your organization hosts an internet-facing application behind an Amazon CloudFront distribution. You want to mitigate common web exploits (for example, SQL injection and XSS) at the edge. Which action is the most appropriate way to do this using AWS services?

Accepted Answer

Create an AWS WAF web ACL using managed rule sets and associate it with the CloudFront distribution.. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). By creating a web ACL with managed rule sets (e.g., the AWS Managed Rules for SQL injection and XSS) and associating it with your CloudFront distribution, you can inspect incoming HTTP/HTTPS requests at the edge and block malicious payloads before they reach your origin. This is the most appropriate and scalable way to mitigate these threats at the edge.

Answer

Add inbound rules to the security group so that only port 443 is open from the internet.

Answer

Enable AWS Shield Advanced to block SQL injection and XSS.

Answer

Restrict IAM permissions for the application’s EC2 instances so that SQL injection payloads cannot be executed.

Question 7

Your AWS Organization uses a Service Control Policy (SCP) that includes a Deny statement for secretsmanager:GetSecretValue for all member accounts in the "Finance" OU when requests are made outside us-east-1. An application role has an IAM policy that allows secretsmanager:GetSecretValue for the required secret in us-west-2. In us-west-2, requests fail with AccessDenied. What is the most appropriate action?

Accepted Answer

Modify the SCP to allow secretsmanager:GetSecretValue in us-west-2 for the Finance OU (if that aligns with policy intent), or move the workload to us-east-1.. SCPs are deny-by-default and act as an outer boundary on all IAM policies in member accounts. Even if the application role's IAM policy allows secretsmanager:GetSecretValue in us-west-2, the SCP's explicit Deny for requests outside us-east-1 overrides that allow. The correct fix is either to modify the SCP to permit the action in us-west-2 (if that aligns with organizational intent) or to relocate the workload to us-east-1, because SCPs cannot be overridden by any IAM policy within the account.

Answer

Update the application role IAM policy to include us-west-2 in the resource ARN.

Answer

Create a permission boundary that removes the deny behavior for the member account.

Answer

Use sts:AssumeRole into another account that is not in the Finance OU to bypass the SCP.

Question 8

Your security team needs to detect and alert on any attempt to change sensitive policies, specifically S3 bucket policy changes and KMS key policy changes. The team wants alerts within minutes, and logs must be centrally retained for forensics. Which design best meets these detective control requirements using AWS-native services?

Accepted Answer

Enable CloudTrail management events and configure an EventBridge rule to send notifications for PutBucketPolicy and PutKeyPolicy API calls, while also delivering CloudTrail logs to a dedicated S3 bucket for retention.. Option A is correct because CloudTrail management events capture all API calls for S3 bucket policies (PutBucketPolicy) and KMS key policies (PutKeyPolicy) by default, and EventBridge rules can trigger near-real-time alerts (within minutes) for these specific API calls. Additionally, delivering CloudTrail logs to a dedicated S3 bucket provides centralized, immutable retention for forensic analysis, meeting both the alerting and retention requirements.

Answer

Rely on AWS Config resource snapshots only; use the snapshots to infer policy changes and generate alerts from the daily compliance summary reports.

Answer

Enable S3 access logging on the affected buckets only; treat these logs as sufficient evidence for KMS key policy modifications.

Answer

Turn on CloudWatch Logs for the S3 bucket and KMS key; alert on any log line containing the word 'policy' to detect changes.

Question 9

Your mobile app writes events to a single DynamoDB table with partition key = customerId and sort key = eventTime. During a promotional campaign, one tenant ("ACME") generates far more traffic than others. CloudWatch shows sustained throttling (ProvisionedThroughputExceeded) and elevated p99 latency only for that tenant. The workload pattern cannot be changed to a completely different schema, but you can change how items are partitioned. Which design change is most likely to reduce the hot-partition throttling while keeping efficient reads for ACME?

Accepted Answer

Change the partition key to a salted key such as customerId + shard number, and include the eventTime ordering using the sort key.. Option B is correct because salting the partition key by appending a shard number (e.g., customerId + random digit) distributes ACME's writes across multiple partitions, eliminating the hot partition. The sort key still preserves eventTime ordering, so queries for a specific customer can be parallelized across shards and merged client-side or via a composite sort key pattern, maintaining efficient reads.

Answer

Use the same partition key (customerId), but increase the table’s provisioned capacity for that tenant.

Answer

Switch to on-demand capacity mode and keep the partition key unchanged.

Answer

Enable Global Tables so that reads are served from a nearby replica for ACME.

Question 10

Your company needs a high-throughput, low-latency TCP service using a custom binary protocol. Requirements: preserve the original client source IP for rate limiting, keep latency minimal, and use TCP health checks. The current setup uses an Application Load Balancer and performance is inconsistent. Which load balancer choice best meets these requirements?

Accepted Answer

Use a Network Load Balancer (NLB) with TCP listeners so traffic stays at Layer 4 and the original source IP is preserved.. A Network Load Balancer (NLB) operates at Layer 4 and preserves the original client source IP by default, which is essential for accurate rate limiting. Its TCP listeners provide low-latency, high-throughput handling of custom binary protocols, and it supports TCP health checks natively. This directly addresses the performance inconsistency seen with the Application Load Balancer, which operates at Layer 7 and introduces additional processing overhead.

Answer

Keep the Application Load Balancer (ALB), because ALBs also preserve client source IP for TCP protocols.

Answer

Use Amazon API Gateway because it preserves client source IP and provides TCP health checks for all protocols.

Answer

Use Amazon CloudFront with an S3 origin, because CloudFront reduces latency for TCP-based protocols.

Question 11

Your web application runs on EC2 instances behind an Application Load Balancer (ALB). During traffic spikes, p95 response time increases, but average CPU utilization remains below 40%. The current Auto Scaling policy scales based on average CPU%. What should you change to improve performance during spikes?

Accepted Answer

Scale on a request-driven metric such as ALB RequestCount per target (or target-group request rate). The p95 response time is increasing during traffic spikes while CPU utilization remains low, indicating that the bottleneck is not compute capacity but rather request handling or connection overhead. By scaling on ALB RequestCountPerTarget, you directly target the metric causing latency—each target's request load—rather than an indirect metric like CPU. This ensures that new instances are launched precisely when individual targets are overwhelmed by requests, reducing queueing delays and improving response times.

Answer

Keep scaling on CPU% to avoid over-scaling

Answer

Disable scaling and manually increase capacity during business hours

Answer

Scale only when network packet drops fall below a threshold

Question 12

Your company currently uses an Application Load Balancer (ALB) in front of a service that receives a large number of TCP and UDP packets (including UDP-based telemetry). During load tests, you need to support both TCP and UDP traffic at high throughput while keeping stable IP endpoints for a downstream firewall allowlist. Which change best meets these requirements?

Accepted Answer

Switch to a Network Load Balancer (NLB) configured for TCP/UDP, and use Elastic IPs to provide stable endpoint IP addresses for allowlisting.. A Network Load Balancer (NLB) operates at Layer 4 and can handle both TCP and UDP traffic natively, unlike an ALB which only supports HTTP/HTTPS and cannot forward UDP packets. By assigning Elastic IPs to the NLB, you provide stable, static IP endpoints that can be added to a downstream firewall allowlist, meeting both the protocol and throughput requirements.

Answer

Keep the ALB and add an AWS WAF Web ACL to improve throughput and add static IP support.

Answer

Replace the ALB with an API Gateway REST API to support UDP because API Gateway can forward UDP packets.

Answer

Use an Auto Scaling group with multiple EC2 instances and no load balancer to avoid any networking bottlenecks.

Question 13

Your web tier runs on an EC2 Auto Scaling group behind an Application Load Balancer (ALB). You currently deploy both the ALB and the Auto Scaling group in only two Availability Zones (AZs). One AZ fails. What is the best configuration change to improve resilience?

Accepted Answer

Add a third Availability Zone so the ALB and Auto Scaling group span at least three AZs.. Adding a third Availability Zone (AZ) ensures that the Application Load Balancer (ALB) and Auto Scaling group (ASG) can continue to route traffic and maintain capacity even if one AZ fails. With only two AZs, a single AZ failure reduces the fleet by 50% and may cause the ALB to lose the minimum healthy hosts required to serve traffic. Spreading across three AZs provides a higher resilience margin, as the remaining two AZs can absorb the load while the failed AZ recovers.

Answer

Reduce health check timeouts so instances are replaced sooner in the failed AZ.

Answer

Enable instance scale-in protection to stop the ASG from terminating unhealthy instances.

Answer

Switch the ALB to an internal Network Load Balancer (NLB) to avoid cross-AZ traffic.

Question 14

Your organization uses IAM permission boundaries to prevent engineers from escalating privileges. An automated pipeline creates an IAM role for an application deployment and attaches a permission boundary. After deployment, the pipeline reports that the role could create a new KMS key. The permission boundary policy attached to the role allows only (for a specific KMS key ARN, prod-key): - kms:Decrypt - kms:DescribeKey There is no Allow statement for: - iam:CreateKey - kms:CreateKey What is the most likely reason the role was still able to create a KMS key?

Accepted Answer

The permission boundary was not actually attached to the role at creation time (for example, the pipeline bug attached a different boundary ARN or the attachment step failed).. The most likely reason is that the permission boundary was not actually attached to the role at creation time. Permission boundaries define the maximum permissions a role can have; if the boundary is missing or not attached, the role inherits the full permissions of its attached IAM policies. Since the boundary explicitly denies kms:CreateKey, the only way the role could create a KMS key is if the boundary was not enforced, pointing to a pipeline bug or attachment failure.

Answer

Permission boundaries automatically grant all KMS permissions needed by applications, even when they are not listed in the boundary.

Answer

Because the boundary allows kms:DescribeKey for prod-key, kms:CreateKey must also be implicitly allowed.

Answer

SCPs always override permission boundaries, so the boundary is ignored in Organizations.

Question 15

An application uses an Amazon RDS Multi-AZ DB instance. During a failover test, connections fail until the application is restarted, even though the database comes back online. Which two changes should the team make to improve resilience during failover? Select two.

Accepted Answer

Use the RDS endpoint name instead of hard-coding the current instance IP or hostname in the application.. Option B is correct because the RDS endpoint is a DNS name that automatically resolves to the current writer instance's IP address. During a failover, the DNS record is updated to point to the new primary, so using the endpoint instead of a hard-coded IP or hostname allows the application to reconnect without manual intervention. Option D is correct because adding retry logic with exponential backoff handles transient failures during DNS resolution and connection establishment, which are common during the brief period when the DNS TTL has not yet expired after a failover.

Answer

Cache and reconnect to the current writer IP address to avoid DNS lookups during failover.

Answer

Switch to a read replica and let it promote manually after every outage.

Answer

Disable connection pooling so each request opens a fresh socket during normal operation.

Question 16

A static marketing site is served through CloudFront from an S3 origin. After a product update, customers report a drop in CloudFront cache hit ratio and the CloudFront bill increases because the origin is receiving many more requests for the same JS/CSS assets. Asset URLs are versioned, but requests now include an Authorization header even though these assets are public. Which CloudFront change most directly improves the cache hit ratio for these assets?

Accepted Answer

Configure the CloudFront cache policy so Authorization is not included in the cache key, and use an origin request policy that does not forward Authorization to the S3 origin for this behavior. The drop in cache hit ratio is caused by the Authorization header being included in the cache key, which makes CloudFront treat each request as unique even when the asset URL is the same. By configuring the cache policy to exclude Authorization from the cache key and using an origin request policy that does not forward it to S3, CloudFront can serve cached responses for all users regardless of their Authorization header, restoring the cache hit ratio.

Answer

Increase the origin's max connections to handle more origin fetches

Answer

Set CloudFront minimum TTL to 0 seconds so caches expire faster and origin fetches start again

Answer

Disable CloudFront compression because Authorization headers are not cacheable when compression is enabled

Question 17

A team stores application logs in an S3 bucket. They keep logs for 18 months for compliance. Access patterns: logs are heavily accessed during the first 30 days, rarely accessed between days 31 and 180, and almost never accessed after day 180. They currently store everything in S3 Standard and want to reduce storage cost without violating the 18-month retention requirement. What should they implement?

Accepted Answer

Create an S3 lifecycle policy to transition logs to Standard-IA after 30 days and to Glacier Deep Archive after 180 days. Option B is correct because an S3 lifecycle policy can automatically transition objects from S3 Standard to S3 Standard-IA after 30 days (matching the heavy-access period) and then to S3 Glacier Deep Archive after 180 days (matching the near-zero-access period). This minimizes storage costs while retaining logs for the required 18 months, as Glacier Deep Archive offers the lowest storage cost for long-term archival data.

Answer

Leave logs in S3 Standard for 18 months and add a tag for internal reporting

Answer

Immediately move all logs to Glacier Instant Retrieval and expire after 18 months

Answer

Enable versioning and rely on object lifecycle expiration to reduce costs; do not change storage classes

Question 18

A internal reporting portal has old unattached EBS volumes and many stale snapshots. Which two actions reduce storage cost without affecting running instances? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Delete unattached EBS volumes after verifying they are no longer needed. Option C is correct because unattached EBS volumes incur storage costs without providing any benefit to running instances. Deleting them after verification directly reduces costs while having zero impact on running workloads. Option D is correct because snapshot lifecycle policies automate the deletion of obsolete snapshots based on age or count, eliminating manual cleanup and reducing storage costs without affecting running instances.

Answer

Disable CloudTrail logging

Answer

Stop all EC2 instances in the account

Question 19

A marketing site stores logs in S3. Logs are queried for 30 days, rarely accessed for one year, and then retained for compliance. What should reduce storage cost? The architecture review board prefers a managed AWS-native control.

Accepted Answer

S3 lifecycle policy that transitions objects to lower-cost storage classes over time. Option A is correct because an S3 Lifecycle policy is a managed AWS-native feature that automatically transitions objects to lower-cost storage classes (e.g., S3 Standard-IA after 30 days, S3 Glacier Instant Retrieval or S3 Glacier Flexible Retrieval after one year) based on age, reducing storage costs while maintaining compliance. This aligns with the access pattern: frequent queries for 30 days, rare access for a year, then long-term retention. It avoids manual intervention and optimizes cost without sacrificing availability or retrieval needs.

Answer

Keep all logs in S3 Standard indefinitely

Answer

Use EBS snapshots for the logs

Answer

Move all logs immediately to S3 Glacier Deep Archive

Question 20

A platform team lets application teams create IAM roles in member accounts through Infrastructure as Code. Security says every new role must stay within a centrally approved permission ceiling, even if someone later attaches broader managed policies or inline policies. Which control should be used to enforce that maximum permission set?

Accepted Answer

Attach a permissions boundary to each role so the role can never exceed the approved ceiling.. A permissions boundary is an AWS IAM feature that sets the maximum permissions an IAM role can have. When attached to a role, any policy that grants permissions beyond the boundary is effectively ignored, ensuring the role cannot exceed the approved permission ceiling even if broader managed or inline policies are later attached. This directly enforces the security requirement without restricting the application teams' ability to create roles via Infrastructure as Code.

Answer

Use an AWS Organizations service control policy to grant the role all needed permissions directly.

Answer

Use a resource-based policy on Amazon S3 to restrict the permissions that IAM roles can receive.

Answer

Require temporary STS session policies whenever the role is assumed.