SAA-C03 Practice Exam 61 — 20 Questions

Question 1

A payments API requires point-in-time recovery and accidental-delete protection for a DynamoDB table. Which two settings should the architect enable? The architecture review board prefers a managed AWS-native control.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deletion protection or tightly controlled delete permissions. Point-in-time recovery (PITR) enables continuous backups of the DynamoDB table, allowing restoration to any point within the last 35 days, which satisfies the requirement for point-in-time recovery. Deletion protection prevents accidental deletion of the table by blocking drop-table operations, meeting the accidental-delete protection requirement. Both are managed AWS-native controls that require no custom scripting or external tooling.

Answer

Global secondary indexes

Answer

DAX

Question 2

A startup stores application configuration files in an Amazon S3 bucket. The security team wants to ensure that objects in the bucket are encrypted at rest with keys that the company manages and can rotate on its own schedule. Which S3 encryption option should a solutions architect choose?

Accepted Answer

Server-side encryption with AWS KMS keys (SSE-KMS) using a customer managed key.. SSE-KMS with a customer managed key gives the company ownership of the key policy, the ability to enable and schedule automatic key rotation, and CloudTrail visibility into key usage. The other S3 encryption options either leave key management to AWS, require the application to supply keys per request, or move encryption entirely to the client, none of which matches the requirement for company-managed, rotatable keys.

Answer

Server-side encryption with customer-provided keys (SSE-C).

Answer

Client-side encryption with an AWS KMS key before uploading objects to the bucket.

Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3).

Question 3

A healthcare company stores protected health information in an Amazon S3 bucket. Compliance requires that all data be encrypted at rest with keys that the company controls and can rotate on demand. The security team also needs to audit every use of the encryption keys and immediately revoke access for a compromised IAM role without affecting other roles. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS), and manage access through the KMS key policy.. Customer managed KMS keys provide the needed control: the company can rotate them, audit every cryptographic operation through CloudTrail, and enforce or revoke access using the key policy. AWS managed keys and S3 managed keys lack customer-controlled rotation and granular, auditable access control, so they cannot meet the compliance and revocation requirements.

Answer

Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3) and enable bucket versioning.

Answer

Use S3 server-side encryption with AWS KMS AWS managed keys (SSE-KMS) and enable S3 server access logging.

Answer

Use client-side encryption with an AWS KMS customer managed key and store the encrypted data key in S3 object metadata.

Question 4

A company hosts a critical web application on Amazon EC2 instances in a VPC. The security team wants to protect the application from common web exploits like SQL injection and cross-site scripting. They also want to monitor and control access to the application at the HTTP/HTTPS level. Which AWS service should a solutions architect use to meet these requirements?

Accepted Answer

AWS WAF integrated with an Application Load Balancer.. AWS WAF is specifically designed to protect web applications from application-layer attacks. When attached to an Application Load Balancer, it can inspect HTTP/HTTPS requests and apply rules to block SQL injection, XSS, and other exploits. It also provides logging and metrics for monitoring, satisfying the requirement to control access at the HTTP/HTTPS level.

Answer

Amazon GuardDuty with VPC Flow Logs.

Answer

AWS Shield Advanced with an Elastic Load Balancer.

Answer

AWS Network Firewall with a stateless rule group.

Question 5

A SaaS company serves a global web application from a single AWS Region. Users in distant geographies report high latency for static assets such as images and JavaScript bundles, and the company wants to reduce this latency without modifying the application code. Which action BEST achieves this?

Accepted Answer

Create an Amazon CloudFront distribution with the application's origin and serve static assets through the distribution.. Reducing latency for globally distributed users of static content is the classic use case for a content delivery network. CloudFront caches assets at edge locations near viewers, so repeat requests never cross the globe to the origin Region. It requires no application code change, and it offloads the origin, which improves both latency and scalability.

Answer

Enable Amazon S3 Transfer Acceleration on the bucket that holds the static assets.

Answer

Move the application's static assets into an Amazon S3 bucket in a second Region and update the asset URLs.

Answer

Attach an Elastic Load Balancer with cross-zone load balancing to the web tier.

Question 6

A risk simulation workload uses CloudWatch Logs heavily. Retaining all debug logs forever is increasing costs. What should be configured?

Accepted Answer

CloudWatch Logs retention policies per log group. CloudWatch Logs retention policies allow you to set per-log-group expiration rules (e.g., 30 days, 90 days) to automatically delete old log events, directly reducing storage costs for debug logs that are no longer needed. This is the most cost-effective and targeted solution for managing log lifecycle without affecting other monitoring or configuration services.

Answer

AWS Config aggregation

Answer

CloudWatch detailed monitoring on all instances

Answer

Route 53 health checks

Question 7

A healthcare company stores patient imaging studies in an Amazon S3 bucket. Compliance requires that every object be encrypted at rest with a key the company fully controls, including the ability to rotate and revoke the key independently of AWS. The security team must also be able to audit every use of the key. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable SSE-KMS with a customer managed key in AWS KMS and enable AWS CloudTrail data events for KMS.. A customer managed key in AWS KMS combined with SSE-KMS lets the organization control key rotation and revocation while CloudTrail records every use of the key for audit. S3 performs the encryption transparently, so no application changes are needed. This combination meets the encryption, control, and audit requirements with less operational effort than managing keys in the application or supplying keys on every request.

Answer

Enable SSE-C and store the encryption key in AWS Secrets Manager, rotating it every 90 days with a Lambda function.

Answer

Enable SSE-S3 with the default aws/s3 key and enable S3 server access logging on the bucket.

Answer

Use client-side encryption with the AWS Encryption SDK and store the data key in an Amazon S3 bucket protected by a bucket policy.

Question 8

A central security account stores encrypted log files in S3 using a customer managed AWS KMS key. A partner account already has S3 bucket access through an assumed role and now must also be able to encrypt and decrypt objects that use the same KMS key. Which two actions are required? Select two.

Accepted Answer

Update the KMS key policy to allow the partner role or account to use the key.. Option A is correct because a customer managed KMS key's key policy must explicitly grant the partner account or its role permission to use the key; cross-account KMS access is never granted by S3 bucket policies alone, and the key policy is the primary resource-based control that authorizes kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey for the external principal. Option C is correct because the partner account's identity-based IAM policy must also allow the KMS actions (kms:Encrypt, kms:Decrypt, kms:GenerateDataKey) on the CMK's ARN; for cross-account access both the key policy and the caller's IAM policy must permit the operation, so the partner role needs these permissions in addition to the key policy grant. Option B is wrong because automatic key rotation only rotates the backing key material on a schedule and has nothing to do with granting cross-account access. Option D is wrong because replacing the CMK with the AWS managed key alias/aws/s3 removes customer control and cannot be used for cross-account access since its key policy cannot be modified. Option E is wrong because KMS key material for customer managed keys is non-exportable by default and exporting/sharing key material is not the mechanism for cross-account KMS authorization.

Answer

Enable automatic key rotation to solve the cross-account access requirement.

Answer

Replace the CMK with the AWS managed key alias/aws/s3.

Answer

Export the KMS key material and share it with the partner account.

Question 9

A solutions architect is designing a high-performance computing (HPC) workload on AWS that requires a shared POSIX-compliant file system with high throughput and low latency for thousands of concurrent compute instances. The workload is temporary, running for a few hours each week, and the team wants to minimize cost. Which storage solution should the architect recommend?

Accepted Answer

Amazon FSx for Lustre with a scratch file system, linked to an Amazon S3 bucket for data import and export.. FSx for Lustre is purpose-built for HPC, offering a POSIX-compliant, high-throughput, low-latency file system. A scratch deployment is cost-effective for temporary workloads and can be linked to S3 for data staging. EFS, S3 with FUSE, and FSx for Windows File Server do not provide the required performance or protocol compatibility for this scenario.

Answer

Amazon FSx for Windows File Server with Multi-AZ deployment and SSD storage, shared across all compute instances.

Answer

Amazon S3 with S3 Transfer Acceleration and a custom FUSE client mounted on each compute instance to provide POSIX access.

Answer

Amazon EFS with Provisioned Throughput and mount targets in multiple Availability Zones, mounted on all compute instances.

Question 10

A retail company hosts a product catalogue API on Amazon EC2 instances behind an Application Load Balancer. The API serves mostly small JSON responses and is read-heavy. Users in a distant continent report slow response times even though the origin servers are not heavily loaded. The company cannot change the application and wants the lowest-latency read experience globally. Which service should they use?

Accepted Answer

Amazon CloudFront with the Application Load Balancer as the origin, configuring cache behaviors for the API paths.. A read-heavy API returning cacheable JSON is a strong fit for a CDN. CloudFront terminates user connections at nearby edge locations and serves cached responses, while forwarding cache misses to the ALB origin. This reduces round-trip time for distant users without changing the application or standing up a second Region.

Answer

An Application Load Balancer with cross-zone load balancing enabled and a larger instance fleet.

Answer

An Amazon Route 53 latency-based routing policy with additional EC2 instances in a second Region.

Answer

AWS Global Accelerator with an accelerator in front of the Application Load Balancer.

Question 11

A caching layer uses Amazon ElastiCache for Redis in front of a stateless web service. The service must continue to read cached responses during maintenance events and should automatically fail over to another node if one AZ becomes impaired. Which design change best satisfies this requirement?

Accepted Answer

Configure an ElastiCache Redis replication group with automatic failover across multiple Availability Zones.. An ElastiCache Redis replication group with automatic failover across multiple Availability Zones ensures that if the primary node or its AZ becomes impaired, a read-replica in another AZ is automatically promoted to primary. This allows the stateless web service to continue reading cached responses without interruption, satisfying both the maintenance and AZ impairment requirements.

Answer

Deploy a single-node Redis cluster and rely on application-level retries when cache misses occur.

Answer

Move the cache into the VPC but keep it in one Availability Zone to reduce network latency.

Answer

Use a Memcached cluster and configure only client-side connection pooling without failover support.

Question 12

A company stores millions of small, rarely accessed backup objects in Amazon S3 Standard. The objects must remain immediately retrievable within milliseconds and be retained for at least five years, but the company wants to reduce storage cost. Which action should the company take?

Accepted Answer

Add a lifecycle rule to transition the objects to S3 Standard-IA after 30 days.. S3 Standard-IA keeps objects immediately accessible with millisecond latency while charging less per gigabyte than S3 Standard, which matches the requirement to retain rarely accessed backups for five years without retrieval delays. A lifecycle rule can transition the objects automatically after 30 days. Glacier Deep Archive is cheaper but too slow, Intelligent-Tiering adds monitoring fees on small objects, and One Zone-IA sacrifices AZ resilience.

Answer

Convert the bucket to S3 One Zone-IA to save on storage and retrieval.

Answer

Add a lifecycle rule to transition the objects to S3 Glacier Deep Archive after 30 days.

Answer

Enable S3 Intelligent-Tiering and rely on it to move objects automatically.

Question 13

A SaaS provider runs a multi-tenant application on Amazon RDS for PostgreSQL. The database is 2 TB and experiences steady read-heavy traffic during business hours. The provider wants to offload read traffic to reduce load on the primary instance and lower cost compared to scaling up the primary. The application can tolerate slightly stale reads for reporting queries. Which solution is MOST cost-effective?

Accepted Answer

Create a read replica and route reporting queries to it.. A read replica offloads read-only reporting queries from the primary instance, reducing contention and allowing the primary to remain appropriately sized. Because asynchronous replication introduces slight lag, the application's tolerance for stale reads makes this acceptable. This approach is more cost-effective than scaling up the primary or enabling Multi-AZ, which does not provide readable standby capacity.

Answer

Enable Multi-AZ deployment and route reporting queries to the standby instance.

Answer

Migrate the database to Amazon DynamoDB with on-demand capacity mode.

Answer

Increase the size of the primary RDS instance to a larger instance class.

Question 14

A marketing team runs a report-generation process that must execute once per day at 02:00 UTC. It usually completes in 10315 minutes, but sometimes takes up to 45 minutes due to varying data volumes. They currently run the workload on an EC2 instance that is always on, which wastes money during off-hours. The team wants to minimize operational overhead and pay mainly for actual execution time.

What is the best architecture choice?

Accepted Answer

Use an EventBridge schedule to run the report as an Amazon ECS task on AWS Fargate and write results to S3.. Amazon ECS on AWS Fargate is the best choice because it eliminates the need to manage servers, scales automatically, and charges only for the vCPU and memory resources consumed during task execution. The EventBridge schedule triggers the Fargate task at 02:00 UTC, and the report is written to S3, which provides durable, cost-effective storage. This architecture minimizes operational overhead and cost by avoiding an always-on EC2 instance.

Answer

Use a scheduled Amazon EC2 Auto Scaling group that keeps a minimum of one instance running at all times.

Answer

Use AWS Lambda triggered by an EventBridge schedule at 02:00 UTC and write results to S3.

Answer

Use an EMR cluster provisioned daily with manual teardown to ensure the instance is always available before 02:00.

Question 15

A DynamoDB table for a travel booking site has a partition key based only on the current date. Write throttling occurs during business hours. What is the best design change? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Use a higher-cardinality partition key that distributes writes across partitions. Using a low-cardinality partition key like the current date causes all writes to land on a single partition, leading to throttling. By choosing a higher-cardinality partition key (e.g., combining date with a user ID or booking ID), writes are distributed evenly across multiple partitions, leveraging DynamoDB's internal partitioning to handle the throughput. This is a managed, AWS-native design change that resolves hot partition issues without additional services.

Answer

Create a global secondary index with the same date key

Answer

Move the table to S3 Glacier Instant Retrieval

Answer

Reduce the table's write capacity

Question 16

A company stores several petabytes of archived regulatory records in Amazon S3. The records must be retained for seven years and are almost never accessed, but if an auditor requests a record, it must be retrievable within 12 hours. The company wants the lowest storage cost that still meets the retrieval requirement. Which S3 storage class should the solutions architect choose?

Accepted Answer

S3 Glacier Deep Archive. The lowest-cost storage class that still returns data within the allowed 12-hour window is S3 Glacier Deep Archive, whose standard retrieval completes within 12 hours. Glacier Flexible Retrieval and the Infrequent Access classes cost more per gigabyte, and paying for faster retrieval or millisecond access provides no benefit when the retrieval requirement is so permissive.

Answer

S3 Standard-Infrequent Access

Answer

S3 Glacier Flexible Retrieval

Answer

S3 One Zone-Infrequent Access

Question 17

A logistics company runs an Amazon RDS for MySQL database that supports a shipment tracking application. Read replicas are already in use, but the primary instance's CPU is saturated by a small number of long-running analytical queries that the reporting team runs directly against the primary. The company wants to offload these analytical queries and improve primary performance while keeping the application's transactional writes fast. (Choose two.)

Accepted Answer

Move the analytical workload to Amazon Redshift and load data from RDS using AWS Database Migration Service or zero-ETL integration.. The goal is workload isolation. A dedicated read replica for reporting moves analytical reads off the primary without changing the application, while a purpose-built warehouse such as Amazon Redshift removes heavy scans entirely and keeps the warehouse current through DMS or zero-ETL. Together they protect transactional write latency.

Answer

Enable Multi-AZ on the primary instance so the standby can serve the analytical queries.

Answer

Increase the primary instance size and add more Provisioned IOPS to the storage volume to absorb the analytical queries.

Answer

Take frequent manual snapshots of the primary during reporting runs so the queries read from the snapshot.

Question 18

A media company distributes on-demand video to viewers in North America, Europe, and Asia. The videos are stored in a single Amazon S3 bucket in us-east-1 and are served directly from S3. Viewers in Asia report slow start times and frequent buffering. The company wants to reduce latency for all viewers with minimal operational overhead. Which solution meets these requirements?

Accepted Answer

Create an Amazon CloudFront distribution with the S3 bucket as the origin, and configure origin access control (OAC).. CloudFront is the managed content delivery service that caches objects at edge locations worldwide, which removes the long round trip to a single Region for viewers on other continents. Pairing it with origin access control keeps the bucket private while allowing only the distribution to fetch objects, so no objects need to be made public and no viewer-redirection logic is required.

Answer

Enable S3 Transfer Acceleration on the bucket and update the application to use the accelerated endpoint.

Answer

Configure an S3 Cross-Region Replication rule to copy objects into buckets in eu-west-1 and ap-southeast-1, and have the application redirect viewers to the nearest bucket.

Answer

Move the bucket to ap-southeast-1 and use S3 Same-Region Replication to keep a secondary copy in us-east-1.

Question 19

A trading dashboard stores uploaded documents in S3. The business requires a copy in another AWS Region for disaster recovery. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Cross-Region Replication with versioning enabled. S3 Cross-Region Replication (CRR) automatically replicates objects to a destination bucket in a different AWS Region, meeting the disaster recovery requirement without custom scripts. Versioning must be enabled on both source and destination buckets for CRR to function, as it tracks object versions and ensures consistency during replication.

Answer

An EBS snapshot schedule

Answer

S3 lifecycle transition to Glacier Flexible Retrieval

Answer

A CloudFront distribution

Question 20

A company uses AWS Organizations to manage multiple AWS accounts. A security engineer needs to prevent any IAM user in the organization from disabling AWS CloudTrail logging in any account. The solution must apply automatically to all existing and future accounts. What should the security engineer do?

Accepted Answer

Enable AWS CloudTrail organization trail and configure an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Service control policies (SCPs) in AWS Organizations provide centralized control over the maximum available permissions for all accounts. By denying cloudtrail:StopLogging and cloudtrail:DeleteTrail, the SCP ensures that no principal, including root, can disable the organization trail. This solution automatically applies to all current and future accounts, satisfying the requirement.

Answer

Create an IAM policy that denies the cloudtrail:StopLogging action and attach it to all IAM users in each account.

Answer

Use AWS Config to monitor CloudTrail configuration changes and trigger an AWS Lambda function to re-enable logging if it is stopped.

Answer

Create an IAM role in each account with a permissions boundary that denies cloudtrail:StopLogging and assign it to all users.