SAA-C03 Practice Test 8 — 10 Questions

Question 1

A company hosts static images, CSS, and JavaScript files in an Amazon S3 bucket. Users around the world report slow page loads, and the origin receives many repeated requests for the same files. What should the team use to improve performance?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content (images, CSS, JavaScript) at edge locations worldwide. By serving cached copies from the edge closest to each user, CloudFront reduces latency, offloads repeated requests from the origin S3 bucket, and improves page load times for a global audience.

Answer

AWS Direct Connect

Answer

Amazon Route 53 health checks

Answer

Amazon EFS

Question 2

A company hosts a B2B file exchange site on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use?

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows secure shell access to EC2 instances without opening inbound ports (SSH 22 or RDP 3389) to the internet. It uses the AWS Systems Manager agent and an IAM instance role to establish a bidirectional connection via the AWS cloud, eliminating the need for a bastion host or public IP. This meets the requirement for administrators to connect without exposing any network ports.

Answer

A bastion host with SSH open to 0.0.0.0/0

Answer

A public Elastic IP address on each instance

Answer

An internet gateway attached to the private subnet

Question 3

A company runs Amazon RDS for MySQL in a Multi-AZ configuration. If the primary database instance fails, what is the expected behavior?

Accepted Answer

RDS automatically fails over to the standby instance in the same Region and keeps the same endpoint.. Amazon RDS for MySQL in a Multi-AZ configuration automatically synchronously replicates data to a standby instance in a different Availability Zone. When the primary database instance fails, RDS automatically fails over to the standby instance, updating the DNS record for the same CNAME endpoint so that applications can resume operations without manual intervention. This ensures high availability with minimal downtime.

Answer

The database remains unavailable until an administrator manually creates a new instance.

Answer

Traffic is routed to a read replica in another Region for immediate continuity.

Answer

The failed primary continues serving traffic while the standby synchronizes in the background.

Question 4

A company stores compliance reports in Amazon S3. Objects are written once and rarely accessed. They need to keep the data for 3 years. When retrieval is needed for an audit, the reports can be restored within hours (not minutes). What storage class should the company use for new objects, assuming minimal operational overhead?

Accepted Answer

S3 Glacier Flexible Retrieval. S3 Glacier Flexible Retrieval is the correct choice because it is designed for long-term archival data that is rarely accessed, with retrieval times ranging from minutes to hours. It offers a lower storage cost than S3 Standard while still meeting the 3-year retention requirement and the acceptable retrieval window of 'within hours'. This minimizes operational overhead as objects are automatically transitioned to the appropriate storage tier without manual lifecycle management.

Answer

S3 Standard

Answer

S3 Intelligent-Tiering

Answer

S3 Glacier Deep Archive

Question 5

A company hosts a e-learning platform on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use?

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows secure shell access to EC2 instances without opening inbound ports (SSH/RDP) or using a bastion host. It uses the AWS Systems Manager agent and an IAM instance role to establish a bidirectional connection over HTTPS to the AWS Systems Manager service, eliminating the need for public IP addresses or internet-facing security groups.

Answer

A public Elastic IP address on each instance

Answer

A bastion host with SSH open to 0.0.0.0/0

Answer

An internet gateway attached to the private subnet

Question 6

A test environment has EC2 instances that are oversized based on CPU, memory, and network utilisation. Which AWS service should identify rightsizing recommendations? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer uses machine learning to analyze historical utilization metrics (CPU, memory, network) and generates rightsizing recommendations for EC2 instances, including instance type changes and downsizing opportunities. It operates without requiring custom scripts, as it leverages existing CloudWatch metrics and optionally the Compute Optimizer agent for enhanced memory and disk metrics.

Answer

AWS DataSync

Answer

AWS Shield

Answer

AWS Artifact

Question 7

Account C wants engineers to access a role (RoleInAccountA) in account A using STS AssumeRole. Security policy requires that (1) only engineers from account C can assume the role, (2) they must provide an external ID value, and (3) the session must be MFA-authenticated. Which change is most appropriate in the RoleInAccountA trust policy to meet all three requirements?

Accepted Answer

Add conditions that (a) restrict the caller principals to account C engineers (for example, aws:PrincipalArn matches a specific engineer role/user pattern from account C), (b) require sts:ExternalId = <value>, and (c) require aws:MultiFactorAuthPresent = true.. Option B is correct because it satisfies all three security requirements: it restricts the caller principals to engineers from account C using the `aws:PrincipalArn` condition, enforces the external ID with `sts:ExternalId`, and mandates MFA authentication via `aws:MultiFactorAuthPresent = true`. The trust policy on RoleInAccountA must explicitly include the MFA condition because MFA enforcement cannot be delegated to the session policy or to the calling account's IAM permissions when the role is in a different account.

Answer

Add conditions sts:ExternalId = <value> only; do not include any MFA requirement because MFA can be enforced by the IAM role session policy.

Answer

Add conditions for aws:PrincipalTag:Department = Engineering and sts:ExternalId = <value>; omit MFA because MFA is optional for AssumeRole.

Answer

Add conditions aws:SecureTransport = true and sts:ExternalId = <value>; rely on IAM permissions in account C to require MFA.

Question 8

A company has a steady, predictable workload that must run continuously (24/7) in a single AWS Region. The team wants the lowest cost option available for this steady usage, but also expects they may choose different EC2 instance families in the future (without re-buying compute discounts). Which AWS purchase option best meets these goals?

Accepted Answer

Compute Savings Plans, committed for a 1- to 3-year term in the Region. Compute Savings Plans offer the lowest cost for steady, predictable workloads while providing instance family flexibility within a Region. Unlike Reserved Instances, they automatically apply discounts to any EC2 instance family (and even Fargate/Lambda) in the chosen Region, so the company can switch instance families in the future without losing the discount. A 1- or 3-year commitment yields significant savings (up to 66%) compared to On-Demand, making it the optimal choice for this scenario.

Answer

On-Demand Instances only, because they automatically adjust to future needs

Answer

Standard Reserved Instances tied to a single instance type and Availability Zone

Answer

EC2 Spot Instances, because they are always cheaper than savings programs

Question 9

Account 3000 owns a customer-managed KMS key (key-K). A data processing team in account 4000 needs to decrypt data encrypted with key-K. The role in account 4000 already has an identity policy allowing kms:Decrypt on key-K. Despite this, decrypt requests fail with an AccessDenied error referencing KMS. What is the most likely missing authorization step?

Accepted Answer

Update key-K’s key policy in account 3000 to allow kms:Decrypt for the specific role principal in account 4000.. The correct answer is A because KMS key policies are resource-based policies that must explicitly grant cross-account access. Even though the role in account 4000 has an identity-based policy allowing kms:Decrypt, the key policy in account 3000 (the key owner) must also include a statement that permits the specific role principal from account 4000 to perform kms:Decrypt on key-K. Without this, the KMS service will deny the request due to the lack of a valid authorization path.

Answer

Update the S3 bucket policy to allow kms:Decrypt for account 4000 principals on key-K.

Answer

Enable AWS managed key rotation on key-K and remove the existing key policy.

Answer

Switch the access from a role to an IAM user because KMS only supports user principals.

Question 10

A company hosts an application on EC2 instances in private subnets. The instances must (1) read objects from Amazon S3 and (2) retrieve secrets from AWS Secrets Manager. The team currently sends all outbound traffic through a NAT gateway to reach both services. They want to reduce monthly cost while keeping traffic private (no internet egress) and without changing application logic. Which change is the most cost-effective?

Accepted Answer

Create a Gateway VPC endpoint for S3 and an Interface VPC endpoint for Secrets Manager, and ensure the subnet route tables / endpoint routing directs those service calls to the endpoints instead of the NAT gateway.. Option A is correct because Gateway VPC Endpoints for S3 and Interface VPC Endpoints for Secrets Manager allow private connectivity to these AWS services without traversing the internet or a NAT gateway. This eliminates NAT gateway hourly charges and data processing fees, reducing costs while keeping traffic within the AWS network. The application logic remains unchanged as the endpoints are accessed via the same DNS names, with route tables directing traffic to the endpoints instead of the NAT gateway.

Answer

Keep the NAT gateway, but add AWS WAF rules to block non-service outbound requests to reduce NAT usage.

Answer

Disable IPv4 on the VPC subnets and rely on IPv6-only egress to reduce NAT gateway costs.

Answer

Replace the NAT gateway with a VPC firewall appliance instance to proxy outbound calls and reduce NAT fees.