SAA-C03 Practice Exam 66 — 20 Questions

Question 1

Based on the exhibit, the team wants to improve application performance without changing the code. Which EC2 instance family should they choose next?

Accepted Answer

Choose a memory-optimized instance family such as R6i to provide more RAM.. The exhibit shows that the application is experiencing high memory utilization (e.g., memory pressure or swapping), which degrades performance. Choosing a memory-optimized instance family such as R6i provides more RAM per vCPU, directly addressing the bottleneck without requiring code changes. This improves application performance by reducing or eliminating swap usage and allowing more data to be cached in memory.

Answer

Choose a compute-optimized instance family such as C6i to increase CPU performance.

Answer

Choose a storage-optimized instance family such as I4i to improve block storage throughput.

Answer

Choose a burstable instance family such as T3 to reduce cost and improve performance.

Question 2

Based on the exhibit, which change best reduces latency during peak traffic without overprovisioning the fleet?

Accepted Answer

Change the Auto Scaling policy to target tracking on ALB RequestCountPerTarget.. Option B is correct because using a target tracking scaling policy on ALB RequestCountPerTarget dynamically adjusts the fleet size based on the actual load per instance, ensuring that capacity scales with demand during peak traffic without manual intervention or overprovisioning. This approach directly addresses latency caused by high request rates per instance by maintaining a target request count, which reduces response time without adding unnecessary instances during off-peak periods.

Answer

Replace the instances with a larger instance family so each server has more headroom.

Answer

Use scheduled scaling to add instances only during the business hours peak window.

Answer

Replace the ALB with a Network Load Balancer to reduce request latency.

Question 3

Your ecommerce app runs behind an Application Load Balancer (ALB) and uses an RDS database for orders. During an AZ impairment in us-east-1, customers report that checkout takes several minutes to recover. The current design places EC2 instances only in private subnets of AZ-a, while the ALB spans multiple subnets. The RDS DB instance is Multi-AZ. Management wants automatic recovery within the same Region.

Which change best addresses the issue with minimal operational overhead?

Accepted Answer

Move the EC2 instances into Auto Scaling Groups that span private subnets in at least two AZs, keeping the ALB spanning those subnets.. The correct answer is A because the current design has a single point of failure: all EC2 instances are in one Availability Zone (AZ-a). During an AZ impairment, those instances become unreachable, causing the checkout process to fail until the impairment ends or manual intervention occurs. By placing EC2 instances in an Auto Scaling Group spanning at least two AZs, the application can automatically recover by launching new instances in a healthy AZ, while the ALB distributes traffic across the surviving AZs. This minimizes operational overhead as Auto Scaling handles instance replacement automatically.

Answer

Switch from RDS Single-AZ to RDS Multi-AZ, keeping the EC2 instances in only AZ-a because failover will still reach them.

Answer

Terminate the ALB and use a Network Load Balancer (NLB) in front of the existing single-AZ EC2 instances.

Answer

Add more EC2 instances in AZ-a and increase the ALB health check thresholds to avoid unnecessary replacements during impairments.

Question 4

Your company has an internal service hosted behind a Network Load Balancer (NLB) in VPC 10.0.0.0/16. A consumer team in a different VPC (10.1.0.0/16) must call the service without using the public internet. You want private connectivity using AWS PrivateLink. Which configuration best enables least-privilege access while keeping the traffic private?

Accepted Answer

Create a VPC endpoint (interface endpoint) in the consumer VPC that points to the service name published by the provider account, and limit allowed clients using the endpoint’s security group rules.. Option B is correct because AWS PrivateLink uses an interface VPC endpoint in the consumer VPC to connect privately to a Network Load Balancer (NLB) in the provider VPC, keeping traffic within the AWS network. The endpoint’s security group acts as a stateful firewall to restrict which clients in the consumer VPC can access the service, enforcing least-privilege access. This eliminates exposure to the public internet and avoids complex routing or gateway configurations.

Answer

Expose the NLB with an Internet Gateway route and restrict access using a security group attached to the NLB.

Answer

Create an S3 Gateway endpoint in the consumer VPC and store the service hostname in SSM Parameter Store so clients can resolve privately.

Answer

Use a bastion host in the provider VPC and allow the consumer VPC to SSH to it; from there, the consumer makes HTTP calls to the NLB.

Question 5

Your EC2 instances run in private subnets with no NAT gateway. The instances use the AWS SDK to call STS AssumeRole to obtain temporary credentials for other services. Application logs show errors like: "EndpointConnectionError: Could not connect to https://sts.<region>.amazonaws.com".

Which change most directly resolves this while keeping instances private?

Accepted Answer

Create an interface VPC endpoint for STS (com.amazonaws..sts) and associate it with the instance subnets and a security group that allows HTTPS.. The error indicates the EC2 instances cannot reach the STS public endpoint over the internet because they are in private subnets without a NAT gateway. An interface VPC endpoint for STS (com.amazonaws..sts) allows private, direct connectivity to the STS API using AWS PrivateLink, without requiring internet access. Associating the endpoint with the instance subnets and a security group that allows HTTPS (port 443) resolves the connectivity issue while keeping the instances private.

Answer

Create a gateway VPC endpoint for S3 and route the STS traffic through the S3 endpoint gateway.

Answer

Open an inbound rule in the instances’ security group to allow outbound HTTPS to the internet CIDR block directly.

Answer

Attach an Internet Gateway to the private subnet route table so the STS API can be reached over public internet.

Question 6

A inventory service exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most? The design must avoid adding custom operational scripts.

Accepted Answer

CloudFront caching with appropriate TTLs. CloudFront caches responses at edge locations based on configured TTLs (Cache-Control or Expires headers). If the S3 origin becomes temporarily unavailable, CloudFront can still serve stale or cached content to users, maintaining availability without any custom scripts or failover logic. This directly addresses the requirement to serve cached pages during short S3 outages.

Answer

AWS Backup Vault Lock

Answer

IAM Access Analyzer

Answer

S3 Select

Question 7

A company is designing a highly available web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) and uses an Amazon RDS Multi-AZ DB instance. Which three design choices would improve the application's resilience against an AWS Availability Zone failure? (Choose three.)

Accepted Answer

Deploy EC2 instances across at least two Availability Zones in the same AWS Region.. Deploying EC2 instances across at least two Availability Zones (AZs) ensures that if one AZ fails, the ALB can route traffic to healthy instances in the other AZ, maintaining application availability. This is a fundamental pattern for building resilient architectures on AWS, as it eliminates the single point of failure at the AZ level.

Answer

Configure the ALB as a Network Load Balancer for faster failover.

Answer

Use Amazon Route 53 health checks with a failover routing policy to redirect traffic to a different Region.

Answer

Provision EC2 instances in a single Availability Zone and use Auto Scaling to replace failed instances.

Question 8

A company is designing a secure CI/CD pipeline on AWS. Developers push code to AWS CodeCommit, which triggers AWS CodePipeline to build and deploy applications to Amazon EC2 instances running in a VPC. The security team requires that all code is scanned for secrets and vulnerabilities before deployment, and that deployment artifacts are encrypted at rest in Amazon S3. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Add a CodeBuild step in the pipeline that runs a static code analysis tool to scan for secrets and vulnerabilities.. Adding a CodeBuild step that runs static code analysis (e.g., using tools like Checkov, Bandit, or custom scripts) directly addresses the requirement to scan for secrets and vulnerabilities before deployment. This integrates security scanning into the CI/CD pipeline as a gated step, ensuring only compliant code proceeds.

Answer

Configure the S3 bucket used for deployment artifacts to have default encryption with SSE-S3.

Answer

Enable AWS CloudTrail to log all access to the S3 bucket and CodeCommit repository.

Answer

Use an S3 bucket policy that grants full public access to the deployment artifacts for faster downloads.

Question 9

A company is designing a secure multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets, and the EC2 instances need to access an Amazon RDS database in a separate private subnet. The company must ensure that all traffic is encrypted in transit and that only necessary access is allowed. Which of the following steps should the company take to meet these requirements? (Choose four.)

Accepted Answer

Configure the ALB with an HTTPS listener and install a TLS certificate from AWS Certificate Manager (ACM).. Configuring the ALB with an HTTPS listener and a TLS certificate from ACM ensures that traffic between clients and the ALB is encrypted in transit. This is a fundamental requirement for securing a multi-tier web application, as it protects data from eavesdropping and tampering during transmission over the internet.

Answer

Assign a public IP address to the RDS database instance to simplify connectivity from the EC2 instances.

Answer

Place the EC2 instances in a public subnet to allow direct access to the internet for security updates.

Question 10

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The workload is predictable during business hours but has low usage at night. Which three options can reduce costs without compromising performance? (Choose three.)

Accepted Answer

Purchase Compute Savings Plans to cover the baseline EC2 usage during business hours.. Compute Savings Plans offer significant discounts (up to 66%) compared to On-Demand pricing in exchange for a commitment to a consistent amount of compute usage (measured in $/hour) over a 1- or 3-year term. They apply to EC2 instances, AWS Fargate, and Lambda, making them ideal for covering the predictable baseline workload during business hours. This reduces costs without affecting performance because the instances continue to run at full capacity.

Answer

Use a single large EC2 instance to handle all traffic, reducing the number of running instances.

Answer

Replace the Application Load Balancer with a Network Load Balancer, which is cheaper per hour.

Answer

Use EC2 Spot Instances for the entire workload to achieve the lowest possible cost.

Question 11

A company runs a production database on Amazon RDS for MySQL with Multi-AZ enabled. The database experiences a sudden increase in read replicas due to a marketing campaign. Which three strategies would help ensure the database remains resilient under heavy read traffic? (Choose three.)

Accepted Answer

Create additional read replicas in different Availability Zones to distribute read traffic.. Creating additional read replicas in different Availability Zones distributes read traffic across multiple isolated locations, reducing load on the primary instance and improving read scalability. Using RDS Proxy between the application and the database manages connection pooling, which reduces the number of database connections and prevents resource exhaustion under heavy traffic. Configuring the application to use the read replica endpoint for read queries and the primary endpoint for writes offloads read traffic from the primary instance, preserving its capacity for write operations and maintaining write availability.

Answer

Enable Multi-AZ on the read replicas to provide automatic failover for read operations.

Answer

Promote a read replica to a standalone DB instance to offload write traffic.

Answer

Increase the storage size of the primary DB instance to improve I/O throughput.

Question 12

A company is deploying a stateless web application on Amazon ECS with Fargate. The application must be resilient to individual task failures and Availability Zone failures. Which three steps should the company take to achieve this resilience? (Choose three.)

Accepted Answer

Configure the ECS service to use a spread placement strategy across Availability Zones.. Configuring the ECS service with a spread placement strategy across Availability Zones ensures tasks are distributed across multiple AZs, providing resilience against AZ failures. Setting a minimum healthy percent of 50 and a maximum percent of 200 allows the service to maintain at least half of the desired tasks during deployments or failures while scaling up to replace failed tasks without downtime. Using an Application Load Balancer (ALB) in front of the ECS service distributes incoming traffic across healthy tasks in different AZs, automatically rerouting traffic if a task or AZ fails.

Answer

Place all ECS tasks in a single subnet to minimize network latency.

Answer

Store application session data in an attached EFS file system shared across all tasks.

Answer

Disable automatic task replacement to avoid unnecessary task churn during failures.

Question 13

A solutions architect is designing a highly available and resilient architecture for a critical internal application that processes financial transactions. The application runs on Amazon EC2 instances inside an Auto Scaling group. The database layer uses an Amazon Aurora MySQL cluster. The company requires that if an entire AWS Availability Zone (AZ) fails, the application must remain operational with minimal impact and automatically recover without manual intervention. Which combination of architectural decisions will meet these requirements? (Choose four.)

Accepted Answer

Configure the Auto Scaling group to span at least three Availability Zones in the same AWS Region.. Configuring the Auto Scaling group to span at least three Availability Zones ensures that if one AZ fails, the remaining AZs have sufficient capacity to handle the load, and the Auto Scaling group can automatically launch new instances in the healthy AZs. Deploying the Aurora cluster with at least one Aurora Replica in a different AZ than the primary instance provides automatic failover to a replica in under 30 seconds, ensuring database resilience without manual intervention. Using an Application Load Balancer (ALB) to distribute traffic across EC2 instances in multiple AZs allows the ALB to automatically route traffic away from failed AZs and only to healthy targets, maintaining application availability. Setting up an Amazon RDS Proxy manages database connections by pooling and reusing them, which reduces the load on the database during failover and improves resilience by providing seamless connection handling across AZ failures.

Answer

Deploy the Aurora cluster with a single DB instance to reduce complexity and cost.

Answer

Place the EC2 instances in a single Availability Zone to ensure data locality with the primary database.

Question 14

A company is running a production web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The workload has predictable traffic spikes during business hours and low traffic at night. The current architecture uses On-Demand EC2 instances, leading to high costs. The company wants to reduce costs without sacrificing availability or performance. Which three of the following strategies would help achieve this goal? (Choose three.)

Accepted Answer

Purchase Reserved Instances for the baseline capacity that runs 24/7.. Purchasing Reserved Instances for the baseline 24/7 capacity provides a significant discount (up to 72%) compared to On-Demand pricing, directly reducing costs for the always-running portion of the workload. This strategy is correct because it matches the predictable, steady-state traffic component without sacrificing availability or performance.

Answer

Add Spot Instances for the entire workload during peak hours.

Answer

Migrate to AWS Lambda for all web application traffic.

Answer

Consolidate all instances into a single larger instance to reduce overhead.

Question 15

A financial services application requires high-performance read access to a time-series dataset that is frequently updated with new records. The workload is write-heavy during market hours and read-heavy for reporting. The solution must support strong consistency and low-latency queries on a single key. Which three AWS services or features should be used together to meet these requirements? (Choose three.)

Accepted Answer

Amazon DynamoDB with Auto Scaling enabled for reads and writes. Amazon DynamoDB with DAX (DynamoDB Accelerator) is correct because DAX provides an in-memory cache that reduces read latency from single-digit milliseconds to microseconds for strongly consistent reads, directly addressing the high-performance read requirement for a time-series dataset. DynamoDB with Auto Scaling enabled for reads and writes is correct because it automatically adjusts throughput capacity based on traffic patterns, handling the write-heavy workload during market hours and read-heavy reporting without manual intervention. DynamoDB strongly consistent reads configured on the table is correct because it ensures that all read operations return the most up-to-date data, meeting the strong consistency requirement for financial applications where stale reads are unacceptable.

Answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA) storage class

Answer

Amazon RDS for PostgreSQL with Multi-AZ deployment

Answer

Amazon DynamoDB global tables for multi-Region replication

Question 16

A media company is designing a high-performance architecture to serve video content to users worldwide. The solution must minimize latency for end users and reduce the load on the origin servers. The video files are stored in an Amazon S3 bucket. Which three options should be combined to meet these requirements? (Choose three.)

Accepted Answer

Use Amazon CloudFront as a content delivery network (CDN) with the S3 bucket as the origin.. Amazon CloudFront as a CDN with the S3 bucket as the origin minimizes latency by caching video content at edge locations worldwide, serving users from the nearest edge. This reduces load on the origin S3 bucket by handling requests at the edge. Regional Edge Caches further improve cache hit ratios for less popular content by caching it at regional locations, reducing the need to fetch from the origin. Origin shield in CloudFront consolidates requests from multiple edge locations into a single request to the S3 origin, significantly reducing the number of direct requests and lowering origin load.

Answer

Enable S3 Transfer Acceleration on the bucket to speed up uploads.

Answer

Use Amazon ElastiCache for Memcached to cache video metadata at the edge.

Answer

Enable S3 default encryption using AWS KMS to improve data transfer performance.

Question 17

Order the steps to restore an Amazon RDS DB instance from a snapshot.

Question 18

A dev sandbox runs for several hours each night and can be interrupted and restarted. Which EC2 purchasing option should minimize cost? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Spot Instances. Spot Instances are ideal for fault-tolerant, interruptible workloads like a nightly dev sandbox because they offer up to 90% cost savings over On-Demand. Since the job can be interrupted and restarted, Spot Instances provide the lowest cost while still being a fully managed AWS-native option.

Answer

On-Demand Instances only

Answer

Dedicated Hosts

Answer

Provisioned IOPS volumes

Question 19

Based on the exhibit, what change should the team make to achieve the lowest possible network latency for the distributed workload?

Accepted Answer

Move the workload into a cluster placement group in one Availability Zone.. A cluster placement group provides the lowest possible network latency and highest throughput by placing all instances in a single Availability Zone with low-latency, non-blocking 10 Gbps or 25 Gbps network connectivity between them. This is ideal for tightly coupled, distributed workloads that require frequent inter-node communication, such as HPC or data analytics jobs.

Answer

Place the instances in a spread placement group across multiple Availability Zones.

Answer

Add an Application Load Balancer in front of the workers to reduce inter-node latency.

Answer

Increase the EC2 instance size while keeping the current multi-AZ layout.

Question 20

A DevOps team is designing a high-performance CI/CD pipeline to build and test code changes. The pipeline needs to scale to handle hundreds of concurrent builds, with fast build times and minimal idle compute cost. The builds are containerized and require consistent, reproducible environments. Which three options should be used to meet these requirements? (Choose three.)

Accepted Answer

Use AWS CodePipeline to orchestrate the build, test, and deploy stages.. AWS CodePipeline is the correct orchestration service to define and manage the CI/CD pipeline stages (build, test, deploy) in a serverless, highly available manner. Pre-built Docker images cached in Amazon ECR ensure consistent, reproducible environments and drastically reduce build times by avoiding image rebuilds. Using Amazon S3 as a cache store for CodeBuild allows storing and retrieving dependency caches (e.g., Maven .m2, npm node_modules) across builds, minimizing download times and speeding up the pipeline.

Answer

Use AWS CodeBuild with a large number of concurrent build projects.

Answer

Use self-managed Jenkins on EC2 Spot Instances to reduce costs.

Answer

Use Amazon EC2 Auto Scaling with a custom AMI for build agents.

SAA-C03 Practice Exam 66 — 20 Questions

Exhibit

SAA-C03 Practice Exam 66 — 20 Questions

Exhibit