SAA-C03 Practice Exam 63 — 20 Questions

Question 1

A company runs a stateless web API on Amazon EC2 behind an Application Load Balancer. The team notices that during business hours, the ALB starts queueing requests and the average request latency rises. They want to scale out quickly and reliably based on demand, not CPU alone. Which Auto Scaling approach best matches this requirement?

Accepted Answer

Use target tracking scaling based on ALB request count per target.. Option B is correct because target tracking scaling based on ALB request count per target directly measures the load on each instance, allowing the Auto Scaling group to add or remove instances to maintain a target value. This approach scales out quickly and reliably based on actual demand (request queuing and latency), not just CPU, which aligns with the requirement to respond to rising latency and queueing during business hours.

Answer

Use a fixed-size Auto Scaling group and increase capacity manually once per hour.

Answer

Scale based only on EC2 instance memory utilization, regardless of load.

Answer

Use step scaling with a single threshold on average network-in bytes.

Question 2

A regional web application for a content publishing system must fail over automatically to a secondary Region if the primary endpoint becomes unhealthy. Which two services or features are required? The design must avoid adding custom operational scripts.

Accepted Answer

Route 53 failover routing with health checks. Route 53 failover routing with health checks is required because it automatically directs traffic away from an unhealthy primary endpoint to a secondary endpoint, enabling cross-region failover without custom scripts. A deployed standby application stack in the secondary Region is necessary to serve traffic when the primary fails, as Route 53 can only route to healthy endpoints that are actually running.

Answer

AWS Organizations service control policies

Answer

S3 Transfer Acceleration

Question 3

A read-heavy document portal repeatedly queries the same product catalogue data from DynamoDB with millisecond latency requirements. Which service can reduce read latency and table load? The design must avoid adding custom operational scripts.

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB that delivers microsecond read latency, reducing the number of read requests hitting the underlying table. It requires no custom scripts—just a DAX cluster endpoint—and automatically caches frequently accessed items, making it ideal for a read-heavy document portal with millisecond latency requirements.

Answer

Amazon Kinesis Data Firehose

Answer

S3 Transfer Acceleration

Answer

AWS Glue Data Catalog

Question 4

A dev sandbox has unpredictable DynamoDB traffic with long idle periods and occasional spikes. Which capacity mode should minimize operational overhead and avoid paying for idle provisioned capacity? The architecture review board prefers a managed AWS-native control.

Accepted Answer

DynamoDB on-demand capacity mode. DynamoDB on-demand capacity mode (Option C) is ideal for unpredictable traffic with long idle periods and spikes because it automatically scales to handle workload demands without requiring any capacity planning. You pay only for the reads and writes you perform, eliminating the cost of idle provisioned capacity and the operational overhead of managing scaling thresholds.

Answer

Reserved capacity for maximum daily traffic

Answer

Provisioned capacity set for peak traffic

Answer

Global tables in every Region

Question 5

A latency-sensitive video platform uploads large files to S3 from users around the world. Which two features can improve upload performance? The architecture review board prefers a managed AWS-native control.

Accepted Answer

S3 Transfer Acceleration. S3 Transfer Acceleration (B) uses AWS edge locations to accelerate uploads over long distances by routing traffic through the AWS global network, reducing latency and packet loss compared to the public internet. Multipart upload (C) improves performance by splitting large files into smaller parts that can be uploaded in parallel, increasing throughput and allowing retries of individual parts without restarting the entire upload.

Answer

S3 Object Lock

Answer

S3 Inventory

Question 6

A test environment runs on x86 EC2 instances and uses open-source software with no architecture-specific licensing restriction. What should be evaluated to reduce compute cost? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Graviton-based instances after performance testing. Option B is correct because AWS Graviton-based instances (ARM architecture) offer up to 40% better price-performance compared to x86 instances for many workloads. Since the environment uses open-source software with no architecture-specific licensing restrictions, migrating to Graviton after performance testing can significantly reduce compute costs without requiring custom operational scripts, as AWS provides native support for ARM-based instances.

Answer

Cross-Region data replication for all data

Answer

io2 Block Express volumes for all instances

Answer

Dedicated Hosts by default

Question 7

A global video platform serves mostly static images and JavaScript files from an S3 origin. Users in distant countries report slow load times. What should improve performance most? The team wants the control to be enforceable during normal operations.

Accepted Answer

Amazon CloudFront distribution with the S3 bucket as origin. Amazon CloudFront is a content delivery network (CDN) that caches static content (images, JavaScript) at edge locations worldwide, reducing latency for users in distant countries. By using the S3 bucket as an origin, CloudFront serves cached copies from the nearest edge, drastically improving load times. This solution is enforceable during normal operations because CloudFront provides cache control headers and invalidation APIs to manage content freshness.

Answer

A larger S3 bucket

Answer

RDS read replicas

Answer

An EC2 Auto Scaling group in one Region

Question 8

A financial reporting platform uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly? The design must avoid adding custom operational scripts.

Accepted Answer

Use an S3 bucket policy that allows access only from the CloudFront distribution. Option A is correct because an S3 bucket policy that explicitly denies access to any principal except the CloudFront distribution's origin access identity (OAI) or origin access control (OAC) ensures that direct requests to the S3 bucket endpoint are rejected. This policy leverages the aws:SourceArn or aws:SourceIp condition key to restrict access solely to CloudFront, preventing users from bypassing the CDN and hitting the bucket directly.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 9

A data engineering team runs a nightly ETL job on EC2. The job can be checkpointed every 5 minutes and can be retried from the last checkpoint if the instance terminates. The job runtime varies from 2 to 4 hours, and the team has no need for a specific instance type, as long as it completes before 7:00 AM local time. They currently run the job on On-Demand EC2, leading to high monthly compute cost.

Which change best reduces cost while maintaining the business deadline?

Accepted Answer

Use Spot Instances for the ETL workload, and configure the job to checkpoint frequently and restart on interruption.. Option A is correct because Spot Instances offer significant cost savings (up to 90% compared to On-Demand) and are ideal for fault-tolerant, checkpointable workloads. The job's ability to checkpoint every 5 minutes and retry from the last checkpoint means it can gracefully handle Spot Instance interruptions, ensuring it still completes before the 7:00 AM deadline without incurring the high cost of On-Demand instances.

Answer

Use Reserved Instances with a 1-year term to lower costs, since reservations provide discounts for any usage.

Answer

Switch to On-Demand but enable Auto Scaling so the job finishes faster during peak hours.

Answer

Use Spot Instances but disable checkpointing to simplify the application.

Question 10

A high-volume telemetry pipeline writes streaming click events that must be processed by multiple independent consumers. Which service is most appropriate? The design must avoid adding custom operational scripts.

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is designed for real-time streaming of high-volume data, such as click events, and allows multiple independent consumers to process the same stream concurrently via enhanced fan-out or shared throughput. It provides durable, ordered data retention and integrates with AWS Lambda, Kinesis Data Analytics, and Kinesis Data Firehose without requiring custom operational scripts.

Answer

AWS DataSync

Answer

Amazon EBS

Answer

Amazon Route 53

Question 11

A dev sandbox currently uses two NAT gateways in each of three Availability Zones, but only one private subnet per AZ needs outbound internet access. What should the architect review first? The design must avoid adding custom operational scripts.

Accepted Answer

Whether one NAT gateway per AZ is sufficient for the required private subnets. Option D is correct because the question asks what the architect should review first to optimize costs while maintaining functionality. Using two NAT gateways per AZ when only one private subnet per AZ needs outbound internet access is redundant; a single NAT gateway per AZ can handle the traffic for all private subnets in that AZ. The design must avoid custom operational scripts, so the simplest review is to check if one NAT gateway per AZ is sufficient, which would reduce costs without breaking connectivity.

Answer

Disabling route tables

Answer

Replacing every NAT gateway with an internet gateway attached to private subnets

Answer

Moving all workloads to public subnets

Question 12

A latency-sensitive mobile game backend uploads large files to S3 from users around the world. Which two features can improve upload performance?

Accepted Answer

S3 multipart upload. S3 multipart upload is correct because it allows large files to be uploaded in parallel parts, which reduces the impact of network latency and improves throughput. For a latency-sensitive mobile game backend, this feature enables faster uploads by splitting the file into smaller chunks that can be uploaded concurrently, even over unstable connections.

Answer

S3 Object Lock

Answer

S3 Inventory

Question 13

A fleet of test servers is rebuilt every week from AMIs. EBS volumes are often left behind after termination, and the team creates daily snapshots of every volume even when nothing changes. Which three actions most reduce storage cost while preserving recovery options? Select three.

Accepted Answer

Use gp3 for new EBS volumes instead of gp2 when similar performance is enough.. Option A is correct because gp3 volumes offer a baseline performance that is often sufficient for test server workloads, and they are typically more cost-effective than gp2 volumes when similar performance is adequate. By using gp3, you avoid paying for provisioned IOPS that you do not need, directly reducing storage costs without sacrificing recovery options.

Answer

Keep unattached volumes around for troubleshooting after instance termination.

Answer

Raise provisioned IOPS on every volume so snapshot restore time feels faster.

Question 14

A fintech startup uses AWS to run a web API and a PostgreSQL database. They must meet an RPO of 15 minutes and an RTO of 2 hours for a Region-wide disaster. Budget allows running a small, always-on set of infrastructure in a secondary Region, but not full production capacity. The team wants a DR approach that is regularly testable without large manual effort.

Which disaster recovery strategy is the best fit?

Accepted Answer

Warm standby: keep a scaled-down application environment and database replication active in the secondary Region, using automated failover controls.. Warm standby (B) is the best fit because it maintains a scaled-down but fully functional application environment in the secondary Region with active database replication, meeting the RPO of 15 minutes via synchronous or near-synchronous replication (e.g., PostgreSQL streaming replication or AWS DMS with ongoing replication). Automated failover controls (e.g., Route 53 health checks and Lambda automation) can achieve the RTO of 2 hours by scaling up the standby environment, and the always-on infrastructure allows regular, low-effort testing of the failover process without manual intervention.

Answer

Pilot light: replicate databases and store backups, keep only minimal infrastructure in the secondary Region, and scale up fully during failover.

Answer

Backup and restore only: rely on daily automated backups and restore into the secondary Region during an incident.

Answer

Multi-site active-active: run both Regions at full capacity and route live traffic to both simultaneously.

Question 15

A company keeps daily database backups in an S3 bucket. They may restore from backups during the first 30 days if there is an issue. After 30 days, backups are rarely restored, but must be retained for 2 years. Which lifecycle strategy most cost-effectively meets these requirements?

Accepted Answer

Use an S3 lifecycle policy to keep backups in S3 Standard for 30 days, then transition them to S3 Glacier Deep Archive for the remainder of the 2-year retention period.. Option C is correct because it uses an S3 lifecycle policy to store backups in S3 Standard for the first 30 days when restores are likely, then transitions them to S3 Glacier Deep Archive for the remaining retention period. S3 Glacier Deep Archive offers the lowest storage cost for long-term, rarely accessed data, making this the most cost-effective strategy while meeting the 2-year retention requirement.

Answer

Delete backups after 30 days to avoid storage costs, since restores are rare.

Answer

Keep all backups in S3 Standard for the entire 2-year retention period.

Answer

Move backups to S3 Glacier Deep Archive immediately after creation, even for the first 30 days.

Question 16

A production log archive runs continuously on EC2 with predictable usage for the next three years. The team wants a discount while retaining some instance-family flexibility. What should they buy? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Compute Savings Plan. A Compute Savings Plan offers the lowest prices on EC2 compute usage (up to 66% off On-Demand) in exchange for a 1- or 3-year commitment, while allowing instance-family flexibility across any region, OS, or tenancy. This matches the predictable three-year workload and the team's requirement for instance-family flexibility, and it is a managed AWS-native offering (no manual reservation management).

Answer

S3 Intelligent-Tiering

Answer

Dedicated Instances

Answer

Spot Instances only

Question 17

A log archive has old unattached EBS volumes and many stale snapshots. Which two actions reduce storage cost without affecting running instances?

Accepted Answer

Delete unattached EBS volumes after verifying they are no longer needed. Unattached EBS volumes incur storage costs even when not in use, as EBS pricing is based on provisioned capacity per GB-month. Deleting them after verifying they are no longer needed eliminates this cost without affecting running instances, since attached volumes are untouched. This directly addresses the question's requirement to reduce storage costs without impacting running workloads.

Answer

Stop all EC2 instances in the account

Answer

Disable CloudTrail logging

Question 18

A marketing team runs a report-generation process that must execute once per day at 02:00 UTC. It usually completes in 10315 minutes, but sometimes takes up to 45 minutes due to varying data volumes. They currently run the workload on an EC2 instance that is always on, which wastes money during off-hours. The team wants to minimize operational overhead and pay mainly for actual execution time.

What is the best architecture choice?

Accepted Answer

Use an EventBridge schedule to run the report as an Amazon ECS task on AWS Fargate and write results to S3.. Option B is correct because AWS Fargate allows the report-generation task to run as an Amazon ECS task triggered by an EventBridge schedule, eliminating the need for an always-on EC2 instance. Fargate charges only for the vCPU and memory resources consumed during the task's execution (typically 10–45 minutes), which aligns with the team's goal of minimizing operational overhead and paying mainly for actual execution time. Writing results to S3 provides durable, cost-effective storage without managing infrastructure.

Answer

Use a scheduled Amazon EC2 Auto Scaling group that keeps a minimum of one instance running at all times.

Answer

Use AWS Lambda triggered by an EventBridge schedule at 02:00 UTC and write results to S3.

Answer

Use an EMR cluster provisioned daily with manual teardown to ensure the instance is always available before 02:00.

Question 19

A media platform stores originals in an S3 bucket. The application must: (1) prevent any public access to the bucket, (2) allow authenticated users to upload and download objects using presigned URLs, and (3) enforce that all requests use HTTPS and only touch objects under the user-specific prefix (for example, s3://media-originals/user-123/*). The bucket currently allows uploads but sometimes returns 403 AccessDenied for presigned URLs.

Which change is the best fix while meeting the security requirements?

Accepted Answer

Keep Block Public Access enabled, remove any Allow statement to Principal="*", and use a bucket policy or access point policy that denies non-HTTPS requests and allows PutObject/GetObject only when the object key matches the authenticated user's session tag, such as arn:aws:s3:::media-originals/${aws:PrincipalTag/userId}/*.. Option B is correct because it keeps S3 Block Public Access enabled (preventing any public access), uses a bucket policy or access point policy with a condition key like `aws:PrincipalTag` to restrict `PutObject`/`GetObject` to the user-specific prefix (e.g., `arn:aws:s3:::media-originals/${aws:PrincipalTag/userId}/*`), and denies non-HTTPS requests via a `aws:SecureTransport` condition. This ensures presigned URLs work only for authenticated users with the correct session tag, while eliminating the 403 errors caused by overly restrictive policies or missing principal restrictions.

Answer

Disable S3 Block Public Access and add an ACL that grants READ and WRITE to the bucket owner only.

Answer

Use bucket website hosting and allow public GET requests so presigned URLs are not needed for downloads.

Answer

Use ACLs to grant ObjectOwner full control and rely on the application to generate presigned URLs with longer expirations to avoid 403 errors.

Question 20

A customer analytics portal uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly? The design must avoid adding custom operational scripts.

Accepted Answer

Configure Origin Access Control for the S3 origin. Option B is correct because Origin Access Control (OAC) is a CloudFront feature that restricts access to an S3 origin so that only the CloudFront distribution can retrieve objects. OAC uses a signed request mechanism that prevents direct S3 access, ensuring users cannot bypass CloudFront and hit the bucket directly without custom scripts.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting