SAA-C03 Practice Exam 64 — 20 Questions

Question 1

A media company runs a batch job that processes image thumbnails. The job can be restarted from checkpoints and does not have user-facing SLAs. The batch capacity can tolerate interruptions. Which EC2 purchasing option is the best cost optimization choice?

Accepted Answer

Use EC2 Spot Instances, accepting the possibility of interruptions and using checkpoints to resume.. Spot Instances offer significant cost savings (up to 90% compared to On-Demand) and are ideal for fault-tolerant, stateless, or checkpointable workloads like batch image thumbnail processing. Since the job can resume from checkpoints and tolerates interruptions, Spot Instances provide the best cost optimization without compromising functionality.

Answer

Use On-Demand Instances because interruptions are not allowed for production workloads.

Answer

Purchase Reserved Instances because they provide a discount regardless of the workload timing.

Answer

Buy Savings Plans because they guarantee capacity and remove the risk of interruptions entirely.

Question 2

A retail analytics app uses Amazon RDS for PostgreSQL. Read traffic is growing, and the database CPU spikes mainly due to SELECT-heavy workloads. Writes are less frequent, and the app can tolerate eventually consistent reads for the reports. What is the most appropriate AWS-native way to improve read performance with minimal application changes?

Accepted Answer

Create an RDS read replica and point the reporting queries to the replica endpoint.. Creating an RDS read replica is the most appropriate AWS-native solution because it offloads SELECT-heavy read traffic from the primary database instance to a separate read-only replica, reducing CPU spikes on the primary. The application can tolerate eventually consistent reads for reports, which aligns with the natural replication lag of RDS read replicas (typically sub-second). This requires minimal application changes—only updating the reporting queries to point to the replica endpoint—and leverages PostgreSQL's built-in streaming replication.

Answer

Switch the cluster to DynamoDB without redesigning the data model.

Answer

Enable S3 event notifications to trigger a Lambda function after each write to the database.

Answer

Replace the RDS instance class with a smaller size to reduce cost and improve performance.

Question 3

A media archive requires consistent high IOPS for a transactional database on EC2. Which EBS volume type is most suitable? The design must avoid adding custom operational scripts.

Accepted Answer

Provisioned IOPS SSD such as io2. A Provisioned IOPS SSD (io2) volume is the correct choice because it delivers consistent, high IOPS required for transactional databases, with a 99.999% durability guarantee and the ability to provision IOPS independently of storage capacity. This avoids custom operational scripts by providing predictable performance natively through the EBS volume type.

Answer

st1 Throughput Optimized HDD

Answer

Instance store only

Answer

sc1 Cold HDD

Question 4

A regional web application for a inventory service must fail over automatically to a secondary Region if the primary endpoint becomes unhealthy. Which two services or features are required? The team wants the control to be enforceable during normal operations.

Accepted Answer

Route 53 failover routing with health checks. Route 53 failover routing with health checks is correct because it enables automatic DNS-level failover to a secondary Region when the primary endpoint is unhealthy. Route 53 health checks monitor the primary endpoint's health, and if they detect a failure, the DNS record is updated to route traffic to the secondary Region's endpoint. This provides enforceable control during normal operations by allowing you to define routing policies that are active at all times.

Answer

S3 Transfer Acceleration

Answer

AWS Organizations service control policies

Question 5

A warehouse integration service receives bursts of orders that sometimes overwhelm a downstream fulfilment service. The architecture must absorb spikes and retry processing without losing requests. Which service should be placed between the web tier and fulfilment workers? The design must avoid adding custom operational scripts.

Accepted Answer

Amazon SQS queue. Amazon SQS is the correct choice because it acts as a durable, scalable message buffer that decouples the web tier from the fulfilment workers. When order bursts arrive, messages are stored reliably in the queue, and workers can poll at their own pace, retrying failed messages automatically without any custom scripts. This pattern absorbs spikes and ensures no requests are lost, meeting the requirement for a fully managed, serverless integration.

Answer

AWS WAF

Answer

Amazon Route 53 weighted routing

Answer

Amazon CloudFront

Question 6

A production Amazon RDS database has automated backups enabled. At 10:45 UTC, an issue is discovered. The team needs to restore the database to its state as of 10:30 UTC. Which capability should they use?

Accepted Answer

Point-in-time restore (PITR) using automated backups to a specific timestamp.. Amazon RDS automated backups enable point-in-time recovery (PITR) to any second within the backup retention period, restoring to a new DB instance. Since the issue was discovered at 10:45 UTC and the desired recovery point is 10:30 UTC, PITR can restore the database to that exact timestamp, provided it falls within the automated backup window and retention period.

Answer

Perform a Multi-AZ manual failover of the standby to recover to the earlier timestamp.

Answer

Promote a cross-region replication target to replace the current database with the last-known good copy.

Answer

Switch to a read replica to access an older view of data without restoring.

Question 7

A SaaS platform serves an API using two regional deployments: us-east-1 (primary) and us-west-2 (secondary). Each region has its own ALB. The business requires automated DNS-based failover when the primary region becomes unhealthy, and they do not want manual DNS changes during incidents. 

Which Route 53 configuration is the best match?

Accepted Answer

Use Route 53 failover routing with a primary record pointing to the us-east-1 ALB and a secondary record pointing to the us-west-2 ALB, each using health checks.. Route 53 failover routing is designed specifically for active-passive failover scenarios where you have a primary and secondary resource. By associating health checks with each record, Route 53 automatically detects when the primary ALB in us-east-1 becomes unhealthy and routes traffic to the secondary ALB in us-west-2 without manual intervention. This meets the requirement for automated DNS-based failover without manual DNS changes.

Answer

Create a single Route 53 record using weighted routing across both ALBs with weights adjusted manually during an incident.

Answer

Use latency-based routing so Route 53 always selects the fastest region; health checks are unnecessary because client latency reflects availability.

Answer

Use a single A record with a static IP address that points to a NAT gateway, and update that IP during failure events.

Question 8

A media processing workflow generates analytics files that are accessed unpredictably. Some files become hot again months later. The team wants automatic storage cost optimisation without retrieval delays. What should be used?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering automatically moves objects between access tiers (frequent, infrequent, and archive instant access) based on changing access patterns, with no retrieval delays for hot objects. This is ideal for unpredictable access where some files become hot again months later, as it optimizes storage costs without manual intervention or retrieval latency.

Answer

Manual monthly review and object copying

Answer

S3 Glacier Flexible Retrieval for all files

Answer

EFS One Zone for analytics files

Question 9

A SaaS vendor needs temporary access to an S3 bucket in your AWS account to read customer exports. The vendor will assume an IAM role you created. During integration testing, the vendor reports that their AssumeRole requests succeed, but your security team is concerned about the possibility of confused-deputy attacks. Which trust policy approach most directly mitigates this risk?

Accepted Answer

Add an sts:ExternalId condition to the role trust policy that must match the unique external ID you provide to the vendor.. Option A is correct because adding an `sts:ExternalId` condition to the role trust policy forces the vendor to include a unique external ID in their `AssumeRole` API call. This prevents a confused-deputy attack by ensuring that the role can only be assumed when the caller presents the specific external ID you control, even if the vendor's account is compromised or used by a different AWS service.

Answer

Require the vendor to use the same MFA device serial number as your internal administrators in the trust policy.

Answer

Remove the role’s permissions policy and rely only on the S3 bucket policy to validate the caller.

Answer

Allow sts:AssumeRole from the vendor account root principal without restricting to the vendor’s specific IAM role.

Question 10

A regional web application for a content publishing system must fail over automatically to a secondary Region if the primary endpoint becomes unhealthy. Which two services or features are required? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Route 53 failover routing with health checks. Route 53 failover routing with health checks (Option B) is required because it monitors the primary endpoint's health and automatically reroutes traffic to a secondary Region when the primary becomes unhealthy. This is the managed AWS-native control for DNS-based failover, meeting the architecture review board's preference.

Answer

AWS Organizations service control policies

Answer

S3 Transfer Acceleration

Question 11

A new feature stores user events in DynamoDB. Each event must be fetched by user_id and sorted by event_time. The team expects many different users and wants to avoid a single hot partition. Which partition key design is best?

Accepted Answer

Use user_id as the partition key and event_time as the sort key.. Option B is correct because using `user_id` as the partition key ensures each user's events are stored in a separate partition, distributing the workload evenly and avoiding hot partitions. Adding `event_time` as the sort key allows DynamoDB to efficiently retrieve events for a given user in sorted order using a Query operation, which is both fast and cost-effective.

Answer

Use a constant partition key value (for example, partition_key='events') and store user_id as an attribute.

Answer

Use event_time as the partition key and user_id as an attribute to query later.

Answer

Use a randomly generated UUID as the partition key and query by user_id using a full table scan.

Question 12

A media company stores daily financial exports in Amazon S3. The files must be protected against accidental overwrite or deletion, and the business also wants a second copy in another Region for recovery after a regional outage. Which two actions should the architect take? Select two.

Accepted Answer

Enable bucket versioning on the S3 bucket.. Option A is correct because enabling S3 Versioning protects objects from accidental overwrite or deletion by preserving previous versions. When a file is overwritten or deleted, the original version is retained, allowing recovery. This directly addresses the requirement to guard against data loss from user or application errors.

Answer

Turn on S3 Transfer Acceleration for the bucket.

Answer

Use only lifecycle policies to move objects to Glacier.

Answer

Enable S3 Block Public Access on the bucket.

Question 13

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The implementation must work across routine deployments without manual intervention.

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) for Systems Manager allow private subnets to access Systems Manager Parameter Store without traversing the internet, using private IP addresses within the VPC. Gateway VPC endpoints for S3 provide a highly available, redundant path to S3 via route table entries, ensuring traffic stays within the AWS network. Together, they eliminate the need for internet gateways or NAT gateways, meeting the requirement for no public internet routing.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 14

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) for Systems Manager allow EC2 instances in private subnets to access Parameter Store without traversing the internet. Gateway VPC endpoints for S3 provide a highly available, managed route to S3 via the VPC route table, requiring no NAT or internet gateway. Both are AWS-native, managed services that meet the architecture review board's preference.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 15

A payments platform requires disaster recovery across Regions. Requirements: RPO of 15 minutes and RTO of about 1 hour. The business cannot afford full duplicate capacity in both Regions all the time, but the team wants automated readiness so failover is mostly operationally guided rather than a slow rebuild. Which DR strategy is the best fit?

Accepted Answer

Warm standby, keeping core infrastructure and a partially provisioned environment ready in the secondary Region with frequent data replication.. Warm standby is the best fit because it maintains a partially provisioned environment in the secondary Region with core infrastructure (e.g., a smaller EC2 instance fleet, a replicated database) and uses frequent data replication (e.g., Amazon RDS cross-Region replication or DynamoDB global tables) to achieve an RPO of 15 minutes. The RTO of about 1 hour is achievable by scaling up the standby environment and redirecting traffic, which is faster than a full rebuild but avoids the cost of full duplicate capacity. This balances the business constraint of not affording active/active with the need for automated readiness and guided failover.

Answer

Backup and restore only, relying on scheduled snapshots and manual restores during incidents.

Answer

Pilot light, keeping only minimal infrastructure in the secondary Region and starting full services after failover.

Answer

Active/active, routing production traffic to both Regions continuously and accepting dual-region complexity.

Question 16

A media company stores original uploads in an S3 bucket. They must recover from accidental overwrites/deletes and also recover quickly from a full Region outage. The required RPO is about 1 hour. Which configuration best meets these requirements?

Accepted Answer

Enable S3 versioning and configure cross-Region replication to a bucket in another Region.. Option C is correct because enabling S3 versioning protects against accidental overwrites and deletes by preserving all object versions, while cross-Region replication (CRR) asynchronously replicates objects to a bucket in another Region, enabling recovery from a full Region outage. With an RPO of about 1 hour, CRR meets this requirement as replication typically completes within minutes to a few hours, and versioning ensures point-in-time recovery of previous object states.

Answer

Enable an S3 lifecycle policy to transition objects to Glacier after 7 days without enabling versioning.

Answer

Enable S3 cross-Region replication (CRR) but leave the bucket without versioning enabled.

Answer

Rely on frequent EBS snapshots of a temporary cache used during uploads.

Question 17

A telemetry pipeline uses an Application Load Balancer in one Region. Global users need lower network latency to the application without caching dynamic responses. What should be considered? The architecture review board prefers a managed AWS-native control.

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it uses the AWS global network and Anycast IP addresses to route user traffic to the optimal Application Load Balancer endpoint, reducing latency for global users without caching dynamic responses. Unlike CloudFront, Global Accelerator does not cache content; it simply optimizes the network path, making it ideal for dynamic or real-time applications where caching is not acceptable. It is a managed AWS-native service that aligns with the architecture review board's preference.

Answer

S3 Cross-Region Replication

Answer

CloudFront only with long TTLs

Answer

AWS Backup cross-Region copy

Question 18

A ticket booking system uses Aurora MySQL. The company wants fast cross-Region disaster recovery with low RPO. Which architecture should be considered? The design must avoid adding custom operational scripts.

Accepted Answer

Aurora Global Database. Aurora Global Database is designed for cross-Region disaster recovery with a typical RPO of 1 second and RTO of 1 minute, using storage-based replication that does not require custom scripts. It replicates data from a primary Region to up to five secondary Regions with minimal impact on database performance, meeting the low RPO requirement without operational overhead.

Answer

A single-AZ Aurora cluster

Answer

An ElastiCache Redis replica

Answer

Manual snapshots copied monthly

Question 19

A warehouse integration service must process every event at least once, but duplicate processing is acceptable if the consumer handles idempotency. Which eventing approach is most suitable?

Accepted Answer

Use Amazon SQS standard queue and design consumers to be idempotent. Amazon SQS standard queues provide at-least-once delivery, meaning each message is delivered at least once but can occasionally be delivered more than once. This matches the requirement to process every event at least once, and since duplicate processing is acceptable when consumers are idempotent, the standard queue is the most suitable and cost-effective choice. SQS also decouples the warehouse integration service from its consumers, improving resilience and scalability.

Answer

Use CloudFront signed URLs

Answer

Use UDP messages sent directly to workers

Answer

Use an in-memory queue on one EC2 instance

Question 20

A workload runs in private subnets and must reach Amazon S3 and AWS Secrets Manager without using the internet or a NAT gateway. The team wants to keep the traffic on AWS private networking and avoid public IPs. Which two changes should the architect make? Select two.

Accepted Answer

Create an S3 gateway VPC endpoint and update the route tables for the private subnets.. Option A is correct because an S3 gateway VPC endpoint enables private subnet instances to access S3 over the AWS network without requiring internet gateways or NAT gateways. Gateway endpoints use route table entries to direct S3 traffic through the AWS backbone, avoiding public IPs entirely.

Answer

Place a NAT gateway in the public subnet so the private instances can reach AWS services.

Answer

Assign public IPv4 addresses to the instances and restrict them with security groups.

Answer

Use VPC peering to the AWS service endpoints instead of VPC endpoints.