SAA-C03 Practice Exam 67 — 20 Questions

Question 1

Based on the exhibit, DNS still sends traffic to the primary Region even though Route 53 health checks show the primary endpoint is unhealthy. What is the best change to make failover work as intended?

Accepted Answer

Use a failover routing policy with a primary record and a secondary record, and attach the health check to the primary record.. Option B is correct because a failover routing policy with a health check attached to the primary record is the only configuration that allows Route 53 to automatically stop sending traffic to an unhealthy primary endpoint and redirect it to the secondary endpoint. Without the health check attached to the primary record, Route 53 has no mechanism to detect the failure and will continue routing traffic to the primary Region, even if the health check status shows unhealthy.

Answer

Change both records to weighted routing with a 50/50 split so Route 53 can shift traffic gradually.

Answer

Switch to latency-based routing so users are always directed to the lowest-latency Region.

Answer

Use geolocation routing so clients in one Region are sent to the healthier endpoint.

Question 2

A company runs Amazon EC2 instances in private subnets. Those instances only need to access Amazon S3 (read/write) and Amazon DynamoDB. The VPC currently routes all outbound traffic through a NAT Gateway, increasing monthly cost. What change most directly reduces NAT Gateway usage for these AWS services?

Accepted Answer

Remove the NAT Gateway path for S3 and DynamoDB by creating S3 Gateway VPC endpoints and DynamoDB Gateway VPC endpoints, and updating the private subnet route tables to route S3/DynamoDB traffic to those endpoints.. Option A is correct because S3 Gateway VPC endpoints and DynamoDB Gateway VPC endpoints allow EC2 instances in private subnets to access these services directly over the AWS network without traversing a NAT Gateway. This eliminates NAT Gateway data processing charges for S3 and DynamoDB traffic, directly reducing costs. The route tables in the private subnets are updated to direct S3 and DynamoDB traffic to the gateway endpoints, bypassing the NAT Gateway entirely.

Answer

Keep the NAT Gateway but disable any cross-region routing settings for the route table entries that point to the NAT Gateway.

Answer

Create interface VPC endpoints for all services (including S3) and route S3 traffic to the interface endpoint network interfaces (ENIs).

Answer

Add an IAM policy that denies requests unless they originate from the public subnet, so the application sends fewer requests through the NAT Gateway.

Question 3

A startup has a stable production web service that runs continuously (24/7) on AWS. They have consistent compute requirements for the next 1 year, but the instance size and family might change as they optimize performance. To reduce cost while maintaining flexibility across instance types, which purchasing option should they consider?

Accepted Answer

Compute Savings Plans. Compute Savings Plans offer the lowest prices for EC2 compute usage (up to 66% off On-Demand) while allowing flexibility to change instance family, size, OS, and region (within a region). This matches the startup's need for consistent 1-year compute requirements with potential instance type changes during performance optimization.

Answer

Reserved Instances with a fixed instance type

Answer

Spot Instances

Answer

On-Demand Instances

Question 4

Your organization uses IAM permission boundaries to prevent privilege escalation. A deployment role was created with a permission boundary. After an incident, you discover that an operator was later able to remove or change the permission boundary (the operator has iam:PutRolePermissionsBoundary permissions). You need to ensure operators cannot remove or change the permission boundary after it is set. What is the best security control to add?

Accepted Answer

Add an explicit IAM Deny for operators on both iam:PutRolePermissionsBoundary and iam:DeleteRolePermissionsBoundary for all affected roles.. Option B is correct because adding an explicit IAM Deny for both `iam:PutRolePermissionsBoundary` and `iam:DeleteRolePermissionsBoundary` on the affected roles prevents operators from removing or changing the permission boundary, even if they have the corresponding Allow permissions. This is a classic use of an explicit Deny, which overrides any Allow in AWS IAM policy evaluation logic, ensuring the boundary remains immutable after deployment.

Answer

Grant operators iam:PutRolePermissionsBoundary so they can reapply the boundary if needed.

Answer

Rely only on the role’s trust policy so operators cannot assume the role.

Answer

Attach a more permissive permission boundary so the roles remain functional after changes.

Question 5

A company is designing a high-performance architecture for a real-time analytics platform that ingests millions of events per second. The events must be processed with minimal latency and then stored for long-term analysis. Which three services should be combined to build this architecture? (Choose three.)

Accepted Answer

Amazon Kinesis Data Streams for real-time data ingestion. Amazon Kinesis Data Streams is correct because it is designed for real-time data ingestion of millions of events per second with low latency, providing durable storage and ordered processing. AWS Lambda is correct because it can process events from Kinesis in near real-time with automatic scaling, making it ideal for minimal-latency processing. Amazon Redshift is correct because it is a petabyte-scale data warehouse optimized for long-term storage and complex analytics on large datasets, supporting high-performance queries.

Answer

Amazon CloudWatch Logs for event storage

Answer

Amazon RDS for MySQL for storing processed results

Answer

Amazon SQS (Simple Queue Service) for buffering events

Question 6

An order-processing worker consumes messages from Amazon SQS. Occasionally, the worker times out after successfully creating a payment record but before deleting the message, which causes duplicate charges during retries. Some messages also fail validation repeatedly because required fields are missing. Which two changes should the team make? Select two.

Accepted Answer

Make the payment step idempotent using a unique transaction identifier.. Option A is correct because making the payment step idempotent using a unique transaction identifier ensures that if the same message is processed multiple times due to a timeout, the payment is only charged once. This is a common pattern for handling at-least-once delivery semantics in Amazon SQS, where the worker must be designed to handle duplicate messages safely.

Answer

Reduce the visibility timeout so failed messages return to the queue faster.

Answer

Run only one long-lived worker instance so the queue can never be processed twice.

Answer

Switch from a standard queue to a FIFO queue and remove all other changes.

Question 7

Based on the exhibit, the team wants to stop poison messages from consuming worker capacity and also prevent duplicate side effects if the same message is delivered more than once. Which design change best meets the requirement?

Accepted Answer

Configure a dead-letter queue and make the handler idempotent by storing a durable processed-message key.. Option C is correct because a dead-letter queue isolates poison messages that repeatedly fail processing, preventing them from consuming worker capacity. Making the handler idempotent by storing a durable processed-message key (e.g., using DynamoDB or a database) ensures that even if the same message is delivered more than once, duplicate side effects are avoided. This combination directly addresses both requirements: stopping poison messages from wasting resources and preventing duplicate processing.

Answer

Increase the SQS queue batch size so each worker processes more messages per request.

Answer

Replace SQS with Amazon SNS and let each worker subscribe directly to the topic.

Answer

Disable retries and shorten the visibility timeout so failed messages disappear sooner.

Question 8

An organization lets application teams create IAM roles in member accounts. Security wants every newly created role to stay within an approved permission ceiling, and teams must not be able to remove that ceiling later. Which two controls best meet the requirement? Select two.

Accepted Answer

Attach the approved permissions boundary to every role created by the teams.. Option A is correct because a permissions boundary is an IAM feature that sets the maximum permissions a role can have. By attaching an approved permissions boundary to every newly created role, the organization enforces a permission ceiling that cannot be exceeded, even if the role has additional policies attached. This directly meets the requirement of keeping roles within an approved ceiling.

Answer

Use an S3 bucket policy to prevent the roles from gaining extra privileges.

Answer

Rely on a role trust policy to limit the permissions the role can have.

Answer

Use a session policy attached to one assumed-role session to enforce the ceiling permanently.

Question 9

A CI/CD pipeline needs to deploy to your production environment. Security requires that the pipeline uses temporary credentials (not long-lived access keys) and only has permissions to read a specific set of parameters from AWS Systems Manager Parameter Store and write application logs to CloudWatch Logs. What is the best AWS approach?

Accepted Answer

Create an IAM role in the production account, grant least-privilege policies, and let the CI assume it using STS AssumeRole.. Option B is correct because it uses an IAM role with least-privilege policies that the CI/CD pipeline can assume via AWS STS AssumeRole, generating temporary credentials that automatically expire. This eliminates the need for long-lived access keys and adheres to the security requirement of using temporary credentials. The role's policies can be scoped to exactly read specific parameters from Systems Manager Parameter Store and write logs to CloudWatch Logs.

Answer

Create an IAM user for the pipeline and store access keys in the CI system.

Answer

Attach the required permissions to an IAM group and add the pipeline’s principal to that group directly.

Answer

Use AWS KMS to encrypt the pipeline’s access keys and store the ciphertext in the CI system.

Question 10

Based on the exhibit, the current disaster recovery design misses the RTO target even though the database replica is current. Which deployment model best meets the requirements with the least always-on cost?

Accepted Answer

Warm standby, because a scaled-down application stack stays running in the secondary Region and can take over faster.. Warm standby is the correct choice because it keeps a scaled-down application stack running in the secondary Region, which can be scaled up quickly to handle production traffic. This design meets the RTO target by reducing failover time compared to a pilot light, while avoiding the higher always-on cost of an active-active deployment.

Answer

Pilot light, because only the database needs to be running in the secondary Region.

Answer

Active-active, because both Regions should always serve traffic to guarantee the RTO.

Answer

Backup and restore, because restoring from backups is the least expensive DR model available.

Question 11

A inventory service uses Lambda functions that call an unreliable third-party API. Failed events must be retained for later investigation after retries are exhausted. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

A Lambda dead-letter queue or failure destination. Lambda dead-letter queues (DLQs) or failure destinations are the correct AWS-native mechanism to retain failed events after retries are exhausted. When a Lambda function fails to process an event (e.g., due to an unreliable third-party API), the function can be configured to send the failed event payload to an SQS queue or SNS topic for later investigation. This ensures no data loss and aligns with the requirement for a managed, AWS-native solution.

Answer

Lambda reserved concurrency set to zero

Answer

A larger deployment package

Answer

CloudFront error pages

Question 12

A company is designing a cost-optimized serverless architecture using AWS Lambda for a data processing workload. The workload runs multiple times per day and processes files up to 500 MB. Which three design decisions will help minimize costs? (Choose three.)

Accepted Answer

Store processed output in Amazon S3 using the S3 Standard-Infrequent Access (S3 Standard-IA) storage class if accessed infrequently.. Optimizing the Lambda function code to reduce execution duration directly lowers costs because AWS Lambda pricing is based on the number of requests and the duration of code execution, measured in GB-seconds. By writing efficient code, you reduce the compute time, which minimizes the billable GB-seconds. Storing processed output in S3 Standard-IA is cost-effective for infrequently accessed data, as it offers lower storage costs than S3 Standard while still providing high durability and availability. Using S3 batch operations to invoke Lambda functions in parallel reduces the overall processing time by distributing the workload across multiple concurrent invocations, which can lower the total compute duration and thus the cost.

Answer

Deploy Lambda functions in multiple Regions to reduce latency for global users.

Answer

Use Lambda Provisioned Concurrency to ensure zero cold starts, improving performance.

Answer

Allocate the maximum memory (10,240 MB) to each Lambda function to reduce execution time.

Question 13

A media company stores original uploads in an S3 bucket. They must recover from accidental overwrites/deletes and also recover quickly from a full Region outage. The required RPO is about 1 hour. Which configuration best meets these requirements?

Accepted Answer

Enable S3 versioning and configure cross-Region replication to a bucket in another Region.. Option C is correct because enabling S3 versioning protects against accidental overwrites and deletes by preserving all object versions, while cross-Region replication (CRR) asynchronously replicates objects to a bucket in another Region, providing recovery from a full Region outage. With versioning enabled, CRR replicates both current and previous object versions, meeting the ~1-hour RPO (typically within minutes for new objects) and ensuring data durability across Regions.

Answer

Enable an S3 lifecycle policy to transition objects to Glacier after 7 days without enabling versioning.

Answer

Enable S3 cross-Region replication (CRR) but leave the bucket without versioning enabled.

Answer

Rely on frequent EBS snapshots of a temporary cache used during uploads.

Question 14

A customer portal must recover from a regional outage within a few hours. The business wants lower ongoing cost than a fully active second Region and does not want to rebuild everything from scratch during the outage. Which two DR patterns best fit that goal? Select two.

Accepted Answer

Pilot light. Pilot light is correct because it maintains a minimal, always-running core infrastructure (e.g., a small database and application server) in the secondary Region, replicating data continuously. During a regional outage, you can rapidly scale up the environment by provisioning additional resources (e.g., EC2 instances from pre-baked AMIs) to become fully active, meeting the recovery time objective (RTO) of a few hours while keeping ongoing costs lower than a fully active second Region.

Answer

Backup and restore

Answer

Multi-site active-active

Answer

Single-AZ deployment

Question 15

A customer portal must recover from a regional outage within a few hours. The business wants lower ongoing cost than a fully active second Region and does not want to rebuild everything from scratch during the outage. Which two DR patterns best fit that goal? Select two.

Accepted Answer

Pilot light. Pilot light is correct because it maintains a minimal core infrastructure (e.g., database, networking) in the secondary Region that can be quickly scaled up during a disaster, meeting the recovery time objective (RTO) of a few hours while keeping ongoing costs lower than a fully active second Region. It avoids rebuilding everything from scratch by having critical data and configurations already in place, allowing compute resources to be launched on demand.

Answer

Backup and restore

Answer

Multi-site active-active

Answer

Single-AZ deployment

Question 16

A log archive serves infrequently accessed user documents that must be available immediately when requested. Which S3 storage class is likely the best cost fit? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Standard-IA or S3 One Zone-IA depending on resilience requirements. S3 Standard-IA or S3 One Zone-IA is the best cost fit because the workload involves infrequently accessed documents that require immediate retrieval. These storage classes offer lower storage costs than S3 Standard while maintaining low-latency access (milliseconds), and they avoid custom operational scripts since retrieval is automatic via standard S3 GET requests. The choice between Standard-IA and One Zone-IA depends on whether the data requires multi-AZ resilience or can tolerate a single-AZ failure.

Answer

Instance store volumes

Answer

S3 Standard for all objects

Answer

S3 Glacier Deep Archive

Question 17

A partner company needs read-only access to reports in an S3 bucket for a e-learning platform. The partner has its own AWS account. What is the most secure scalable access pattern? The design must avoid adding custom operational scripts.

Accepted Answer

Create a bucket policy that grants the partner role least-privilege access to the required prefix. Option C is correct because it uses a resource-based bucket policy that grants the partner's IAM role cross-account read-only access to a specific prefix, adhering to the principle of least privilege. This approach is secure (no public exposure), scalable (no manual key rotation), and requires no custom scripts, as AWS handles the cross-account trust automatically via the bucket policy's Principal element referencing the partner's AWS account ID.

Answer

Copy the objects to a public website bucket

Answer

Create an IAM user in the company account and share the access keys

Answer

Make the objects public and rely on difficult-to-guess object names

Question 18

A company is deploying a serverless application using AWS Lambda functions that process credit card transactions. The application stores data in Amazon DynamoDB and sends notifications through Amazon SNS. Compliance requirements mandate that all data in transit and at rest is encrypted, and that no AWS Lambda function can access resources in other AWS accounts. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Attach an IAM policy to the Lambda execution role that denies access to resources outside the account using a condition on aws:SourceAccount.. The correct options enforce account isolation and encryption in transit. Option 2 uses an IAM policy with a condition key like `aws:SourceAccount` to explicitly deny any action where the resource ARN belongs to a different AWS account, preventing cross-account access. Option 3 enables encryption in transit by routing Lambda traffic through an Elastic Network Interface (ENI) in a private subnet, using VPC endpoints for DynamoDB (HTTPS) and SNS (HTTPS) so data never traverses the public internet. Option 4 ensures the Lambda function is attached to the VPC, which is necessary for the VPC endpoints to be used; without this, traffic would still go over the public internet, breaking encryption-in-transit compliance.

Answer

Configure DynamoDB to use AWS owned keys for encryption at rest.

Answer

Use a security group to block all outbound traffic from the Lambda function to the internet.

Answer

Configure the Lambda function to use an IAM role that allows access to all accounts.

Question 19

A company is designing a multi-tier web application on AWS that must be resilient to the failure of an entire AWS Region. The application uses Amazon Route 53, an Application Load Balancer, EC2 instances, and Amazon RDS. Which three design choices support a multi-Region resilient architecture? (Choose three.)

Accepted Answer

Configure Route 53 with a failover routing policy and health checks on the application endpoints.. Route 53 failover routing with health checks is correct because it allows DNS to automatically route traffic away from a failed primary region to a standby region, which is essential for multi-Region resilience. Deploying the application stack in two separate AWS Regions with an active-passive setup is correct because it ensures that if the primary region fails, the passive region can take over, providing regional fault isolation. Amazon RDS Cross-Region read replicas are correct because they keep the standby region's database synchronized with the primary, enabling promotion to a primary database in a disaster recovery scenario.

Answer

Use Route 53 latency-based routing to direct users to the closest healthy region.

Answer

Store all application state in a single Amazon ElastiCache cluster in the primary region.

Answer

Place the Application Load Balancer in a single region but use it across multiple Availability Zones.

Question 20

A data analytics company stores large datasets in Amazon S3. The data is accessed frequently for the first 30 days, then accessed rarely but needs to be retrievable within 1 hour for compliance purposes for up to 3 years. After 3 years, the data must be archived for 7 years with retrieval times acceptable up to 12 hours. Which three of the following strategies would optimize storage costs? (Choose three.)

Accepted Answer

Use S3 Intelligent-Tiering for automatic cost savings based on access patterns.. S3 Intelligent-Tiering is correct because it automatically moves objects between access tiers based on changing access patterns, optimizing costs without manual lifecycle rules. For data that is frequently accessed for 30 days and then rarely accessed, Intelligent-Tiering can cost-effectively handle the transition without upfront lifecycle configuration.

Answer

Transition data to S3 Glacier Deep Archive immediately after upload.

Answer

Store all data in S3 One Zone-IA for the first 30 days to save on storage costs.

SAA-C03 Practice Exam 67 — 20 Questions

Exhibit

SAA-C03 Practice Exam 67 — 20 Questions

Exhibit