SAA-C03 Practice Test 6 — 10 Questions

Question 1

In an AWS Organizations environment, developers create IAM roles using an automation tool. The security team wants to guarantee that even if a developer attaches an overly permissive inline policy, the role cannot exceed a fixed set of allowed actions. The team already uses permission boundaries on each role. The tool’s role-creation API call succeeds, but one developer’s new role can still delete production S3 buckets. What is the most likely reason, and what should be corrected?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The boundary policy was not actually attached during role creation, or the automation tool attached the wrong boundary ARN; correct the role-creation request to set the intended PermissionBoundary.. Permission boundaries must be explicitly attached to an IAM role during creation via the `PermissionBoundary` parameter. If the automation tool fails to attach the intended boundary policy or attaches the wrong ARN, the role will have no effective boundary, allowing any inline policy to grant full access. The developer's role could then delete production S3 buckets because the boundary was not enforced.

Answer

Permission boundaries do not affect permissions for resources created with role chaining; enable role chaining instead to apply the boundary.

Answer

KMS key policies override permission boundaries for S3, so deletion permission comes from the KMS policy; restrict the KMS key policy instead.

Answer

Permission boundaries apply only to managed policies, not to inline policies; move the overly permissive permissions to a managed policy type to keep it bounded.

Question 2

A production Amazon RDS database already has automated backups enabled. At 10:45 UTC, the team discovers that a faulty migration corrupted rows in a table at 10:30 UTC. The business wants the database restored to exactly the state it had at 10:30 UTC with minimal risk. Which two actions should the team take? Select two.

Accepted Answer

Restore the database to a new instance using point-in-time restore for 10:30 UTC.. Amazon RDS Point-in-Time Restore (PITR) allows you to restore a DB instance to any second within the backup retention period, including 10:30 UTC. This uses automated backups and transaction logs to reconstruct the exact database state at that specific time, providing a precise recovery point with minimal data loss.

Answer

Restore the most recent manual snapshot because it will include the 10:30 UTC state.

Answer

Overwrite the existing database instance in place so the application keeps the same storage volume.

Answer

Wait for automated backups to complete again, then replay the migration to restore the missing rows.

Question 3

Your mobile app writes events to a single DynamoDB table with partition key = customerId and sort key = eventTime. During a promotional campaign, one tenant ("ACME") generates far more traffic than others. CloudWatch shows sustained throttling (ProvisionedThroughputExceeded) and elevated p99 latency only for that tenant. The workload pattern cannot be changed to a completely different schema, but you can change how items are partitioned. Which design change is most likely to reduce the hot-partition throttling while keeping efficient reads for ACME?

Accepted Answer

Change the partition key to a salted key such as customerId + shard number, and include the eventTime ordering using the sort key.. Salting the partition key by appending a shard number (e.g., customerId + random digit) distributes ACME's writes across multiple partitions, eliminating the hot partition. The sort key still preserves eventTime ordering, so queries for a specific customer can be parallelized across shards and merged client-side or via a composite sort key pattern, maintaining efficient reads.

Answer

Use the same partition key (customerId), but increase the table’s provisioned capacity for that tenant.

Answer

Switch to on-demand capacity mode and keep the partition key unchanged.

Answer

Enable Global Tables so that reads are served from a nearby replica for ACME.

Question 4

A media processing pipeline uses EBS-backed storage for an application that performs sustained random I/O with low latency requirements. During peak processing windows, the team sees increased read latency and occasional timeouts at the application layer. They need predictable, high IOPS performance rather than best-effort throughput. Which EBS configuration choice is most appropriate?

Accepted Answer

Use io1 or io2 EBS volumes configured with a high provisioned IOPS value, and attach them to EBS-optimized instances.. Io1 and io2 volumes are provisioned IOPS SSD volumes designed for sustained, predictable high IOPS performance, which directly addresses the application's need for low-latency random I/O during peak loads. Attaching them to EBS-optimized instances ensures dedicated network bandwidth for EBS traffic, eliminating contention and preventing timeouts.

Answer

Use gp2 volumes and rely on burst credits to handle peak random I/O latency requirements.

Answer

Use standard HDD (st1) volumes, because they provide high throughput and will reduce latency automatically.

Answer

Use S3 instead of EBS for random I/O latency reduction without changing the application.

Question 5

A serverless checkout API uses AWS Lambda behind API Gateway. Every weekday at 09:00 UTC, marketing triggers a predictable surge. The first few minutes after each surge show cold-start latency, but traffic volume is forecastable and the business wants stable p95 latency. Which two changes should the team implement? Select two.

Accepted Answer

Publish a Lambda version and attach provisioned concurrency to an alias that points to that version.. Provisioned concurrency keeps a specified number of Lambda execution environments initialized and ready to respond immediately, eliminating cold starts for predictable traffic patterns. By publishing a Lambda version and attaching provisioned concurrency to an alias pointing to that version, the team ensures that the surge at 09:00 UTC is handled without cold-start latency, stabilizing p95 latency.

Answer

Increase the Lambda timeout so the function has more time to initialize during the spike.

Answer

Double the memory size during the spike without changing the concurrency model.

Answer

Move the function into more Availability Zones so the platform can spread cold starts across regions.

Question 6

Based on the exhibit, which Route 53 configuration should be used so traffic automatically returns to the secondary Region only when the primary Region becomes unhealthy?

Accepted Answer

Use failover routing with a primary alias record, a secondary alias record, and a Route 53 health check on the primary target.. Failover routing in Amazon Route 53 is designed for active-passive configurations. By creating a primary alias record pointing to the ALB in the primary Region and a secondary alias record pointing to the ALB in the secondary Region, and attaching a Route 53 health check to the primary target, traffic automatically fails over to the secondary Region only when the health check detects the primary as unhealthy. This meets the requirement of returning traffic to the secondary Region only upon primary failure.

Answer

Use latency-based routing with both ALB records enabled.

Answer

Use geolocation routing so users are always sent to the closest Region.

Answer

Use a CNAME record that points to both ALBs so DNS can round-robin between Regions.

Question 7

A company’s private workload in a VPC uploads objects to an S3 bucket. Security requires that S3 requests are allowed only when they traverse a specific S3 Gateway VPC Endpoint (vpce-0abc123example). Which change best enforces this restriction at the S3 bucket level?

Accepted Answer

Add an S3 bucket policy Deny statement for s3:PutObject when aws:sourceVpce is not equal to vpce-0abc123example.. It uses an S3 bucket policy with a Deny statement that explicitly denies any s3:PutObject request unless the request originates from the specified VPC Endpoint (vpce-0abc123example). The aws:sourceVpce condition key evaluates the VPC endpoint ID from which the request is made, ensuring that only traffic through that specific Gateway VPC Endpoint is allowed. This enforces the security requirement at the bucket level, overriding any other policies that might allow access from other sources.

Answer

Add an S3 bucket policy Deny statement that blocks requests unless the principal uses MFA.

Answer

Enable Block Public Access and remove the public bucket policy statement.

Answer

Attach an IAM policy to the workload role that allows s3:PutObject only to the bucket ARN.

Question 8

A trading dashboard stores uploaded documents in S3. The business requires a copy in another AWS Region for disaster recovery. What should be configured?

Accepted Answer

S3 Cross-Region Replication with versioning enabled. S3 Cross-Region Replication (CRR) with versioning enabled automatically replicates objects to a destination bucket in a different AWS Region, providing a durable, low-latency disaster recovery copy. Versioning must be enabled on both source and destination buckets to track object changes and ensure consistency during replication. This meets the requirement for a cross-region copy without manual intervention.

Answer

An EBS snapshot schedule

Answer

S3 lifecycle transition to Glacier Flexible Retrieval

Answer

A CloudFront distribution

Question 9

A partner integration sends a custom binary TCP protocol to a service running on EC2 instances in private subnets. The partners require static endpoint IPs for allowlisting, and the application must see the original client source IP for rate limiting. Which two changes best fit the protocol and network requirements? Select two.

Accepted Answer

Replace the Application Load Balancer with a Network Load Balancer.. A Network Load Balancer (NLB) is required because it supports TCP traffic natively at Layer 4, which is necessary for a custom binary TCP protocol that cannot be interpreted by an Application Load Balancer (ALB) at Layer 7. Additionally, an NLB preserves the original client source IP address by default when used with targets in private subnets, meeting the requirement for rate limiting based on the client IP. Static IP addresses can be assigned to the NLB via Elastic IPs, satisfying the partner's need for static endpoint IPs for allowlisting.

Answer

Put the service behind API Gateway REST API and use Lambda integration.

Answer

Use CloudFront to cache the binary packets at edge locations.

Answer

Terminate the traffic with an Amazon RDS proxy to stabilize the connections.

Question 10

A team stores important documents in Amazon S3. They want to recover earlier versions if someone overwrites or deletes a file by mistake. What should they enable?

Accepted Answer

Amazon S3 Versioning. Amazon S3 Versioning is the correct choice because it allows you to preserve, retrieve, and restore every version of every object stored in an S3 bucket. When enabled, S3 automatically maintains a unique version ID for each object, so if a file is overwritten or deleted, the previous version remains accessible. This directly addresses the requirement to recover earlier versions after accidental modification or deletion.

Answer

Amazon EBS snapshots

Answer

Amazon CloudWatch logs

Answer

VPC flow logs