SAA-C03 Design Cost-Optimized Architectures Practice Test 4 — 15 Questions

Question 1

An application runs in private subnets and must access Amazon S3, Amazon DynamoDB, and AWS Secrets Manager. The security team wants the traffic to stay on the AWS network and the finance team wants to eliminate NAT Gateway charges. Which three changes should they make? Select three.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create gateway VPC endpoints for S3.. A gateway VPC endpoint for S3 allows instances in private subnets to access S3 over the AWS network without traversing the internet or a NAT gateway. This eliminates NAT Gateway charges and keeps traffic on the AWS backbone, meeting both security and cost requirements.

Answer

Place the instances in public subnets with an internet gateway.

Answer

Keep the NAT Gateway and add a proxy instance for service access.

Question 2

A static site is hosted in Amazon S3 and delivered by CloudFront. After a frontend release, the same JavaScript bundles are fetched repeatedly from the origin. Logs show that requests include unneeded query strings and cookies, which prevent cache reuse. Which two changes should the team make to reduce origin traffic and cost? Select two.

Accepted Answer

Configure a CloudFront cache policy that forwards only the query strings, headers, and cookies the app actually needs.. CloudFront cache policies allow you to explicitly control which query strings, headers, and cookies are forwarded to the origin. By forwarding only the parameters the application actually needs, you prevent cache keys from being polluted by unneeded values, which increases the cache hit ratio and reduces requests to the S3 origin. This directly addresses the problem of repeated fetches caused by extraneous query strings and cookies.

Answer

Increase the size of the S3 bucket.

Answer

Place an Application Load Balancer in front of S3.

Answer

Disable caching so clients always get the latest files.

Question 3

A public API currently uses API Gateway REST APIs and Lambda. Traffic is low most of the day, but marketing runs a predictable traffic spike every weekday at 09:00 UTC. Users complain about cold starts during the first few minutes of the spike, and the team wants to avoid paying for provisioned concurrency all day. Which two changes should they make? Select two.

Accepted Answer

Switch from REST APIs to HTTP APIs if the feature set is sufficient.. HTTP APIs are designed to be faster and more cost-effective than REST APIs, with up to 71% lower latency and 60% lower cost per request. This reduces the impact of cold starts by minimizing the overhead of request processing, and the cost savings align with the team's goal of avoiding all-day provisioned concurrency costs.

Answer

Keep provisioned concurrency at the maximum level 24/7.

Answer

Move the API to a single t3.nano EC2 instance.

Answer

Add an S3 gateway endpoint to reduce cold starts.

Question 4

A development team stores application logs in CloudWatch Logs and has enabled detailed EC2 monitoring on every instance. Auditors only require 90 days of logs, and operations only needs 5-minute instance metrics. Which three changes would most directly reduce recurring monitoring costs while still meeting those requirements? Select three.

Accepted Answer

Set CloudWatch Logs retention to 90 days.. Setting CloudWatch Logs retention to 90 days ensures logs are automatically deleted after the required period, eliminating storage costs for older data. By default, logs never expire, which would incur ongoing charges for data beyond the audit requirement. This directly reduces recurring costs by limiting the log data stored.

Answer

Keep CloudWatch Logs retention set to Never Expire.

Answer

Enable high-resolution custom metrics for every request.

Question 5

An application team sees that a fleet of EC2 instances averages 15% CPU utilization and has no memory pressure. The service must keep running continuously, but the team wants to lower cost with minimal risk. Which two actions should they take first? Select two.

Accepted Answer

Use Compute Optimizer recommendations to identify a smaller instance type.. AWS Compute Optimizer analyzes historical utilization metrics (CPU, memory, network) and provides rightsizing recommendations. Since the fleet averages only 15% CPU with no memory pressure, downsizing to a smaller instance type reduces cost without impacting performance. This is the first step to identify the optimal instance family and size.

Answer

Move the workload to Dedicated Hosts.

Answer

Add a second NAT Gateway.

Answer

Enable Provisioned Concurrency for the EC2 workload.

Question 6

A company runs an order system on EC2 with a self-managed PostgreSQL database, a self-managed RabbitMQ broker, and a shared file server for attachments. The team wants to reduce patching, backups, and cluster administration while keeping the architecture simple and using managed services where possible. Which three changes should they make? Select three.

Accepted Answer

Replace the database with Amazon RDS for PostgreSQL.. Amazon RDS for PostgreSQL is a managed database service that automates patching, backups, and replication, eliminating the need for self-managing PostgreSQL on EC2. This directly reduces the operational overhead of cluster administration and aligns with the goal of using managed services.

Answer

Keep the database on EC2 and add more EBS volumes.

Answer

Move RabbitMQ to Dedicated Hosts for better isolation.

Question 7

A data-processing application runs in private subnets and needs to read objects from Amazon S3 and write items to Amazon DynamoDB. The team currently routes all outbound traffic through a NAT Gateway, and monthly networking charges are rising. Which two changes will most directly reduce cost while keeping traffic on the AWS network? Select two.

Accepted Answer

Add an S3 gateway VPC endpoint to the private route tables.. Adding an S3 gateway VPC endpoint allows instances in private subnets to access S3 directly over the AWS network without traversing the NAT Gateway, eliminating NAT data processing charges for S3 traffic. This reduces monthly networking costs while keeping traffic within the AWS backbone.

Answer

Add a second NAT Gateway in another Availability Zone.

Answer

Move the instances into public subnets so they can reach AWS services directly.

Answer

Send private subnet traffic to S3 and DynamoDB through an Internet Gateway route.

Question 8

A media company keeps application logs in Amazon S3 for 400 days. The logs are read heavily for the first 30 days, occasionally for the next 90 days, and almost never after that. The team wants to lower storage cost without affecting retention requirements. Which two lifecycle transitions should it configure? Select two.

Accepted Answer

Transition the objects to S3 Standard-IA after 30 days.. After the first 30 days of heavy read access, transitioning to S3 Standard-IA reduces storage costs while still providing low-latency retrieval for the occasional reads that occur over the next 90 days. S3 Standard-IA is designed for data accessed infrequently but requires rapid access, matching the usage pattern described.

Answer

Transition the objects to S3 One Zone-IA after 30 days.

Answer

Keep the objects in S3 Standard for the full 400 days.

Answer

Use only S3 Intelligent-Tiering and never add archival transitions.

Question 9

A global software company distributes large installation packages from an Amazon S3 bucket. During release week, many users in the same region download the same file repeatedly, and the origin bill is rising because the same objects are fetched over and over. The team wants to lower origin data transfer and improve delivery cost. Which two actions should it take? Select two.

Accepted Answer

Put Amazon CloudFront in front of the S3 origin.. Amazon CloudFront acts as a content delivery network (CDN) that caches objects at edge locations close to users. By placing CloudFront in front of the S3 bucket, repeated downloads of the same file are served from the edge cache, drastically reducing the number of requests to the S3 origin and lowering data transfer costs from S3. CloudFront also offers free data transfer to the origin for cached content, further optimizing delivery cost.

Answer

Disable caching so every user always gets the newest file from S3.

Answer

Serve the downloads from a self-managed EC2 web server instead of S3.

Answer

Move the release packages to S3 Glacier Deep Archive for faster downloads.

Question 10

A marketing site serves versioned JavaScript and CSS files from an Amazon S3 origin through Amazon CloudFront. After a frontend release, the CloudFront cache hit ratio dropped because browsers now send an Authorization header on every static asset request even though the assets are public and do not require authentication. The team wants to lower origin load and improve cache efficiency. Which two actions should it take? Select two.

Accepted Answer

Create a separate CloudFront behavior for static assets with a cache policy and origin request policy that exclude the Authorization header.. Creating a separate CloudFront behavior for static assets allows you to attach a cache policy and an origin request policy that explicitly exclude the Authorization header. By not forwarding the Authorization header to the S3 origin, CloudFront can treat all requests for the same asset as cache hits, regardless of the header value, which restores the cache hit ratio and reduces origin load.

Answer

Forward the Authorization header to the origin for all static asset requests.

Answer

Set the cache TTL to zero so browsers always revalidate content.

Answer

Store the static assets in Amazon EFS so CloudFront can cache them more effectively.

Question 11

A development team stores application logs in Amazon CloudWatch Logs and has enabled detailed EC2 monitoring on every instance. Auditors require the logs to be retained for 90 days, but the operations team only needs the last 7 days to remain searchable in CloudWatch. Which two actions should they take to reduce monitoring cost? Select two.

Accepted Answer

Set the CloudWatch Logs retention period to 7 days and export or archive older logs in Amazon S3 or S3 Glacier for the remaining retention period.. CloudWatch Logs charges for data storage and search capabilities. By setting the retention period to 7 days, logs older than 7 days are automatically deleted from CloudWatch, eliminating ongoing storage and search costs. Exporting or archiving these logs to Amazon S3 or S3 Glacier satisfies the 90-day audit requirement at a much lower cost, as S3 and Glacier have minimal storage fees and no search costs.

Answer

Set the CloudWatch Logs retention period to 90 days so everything stays searchable in CloudWatch.

Answer

Send logs to DynamoDB because it is cheaper for long-term retention.

Answer

Enable detailed monitoring only during peak business hours on every instance.

Question 12

A company runs a customer portal on self-managed PostgreSQL on EC2, plus a self-managed RabbitMQ cluster for asynchronous work that only requires durable queueing and does not depend on RabbitMQ-specific exchange features. The operations team spends a lot of time patching, backing up, and scaling both systems. The business wants to reduce infrastructure management overhead and total cost of ownership. Which two changes are the best fit? Select two.

Accepted Answer

Migrate PostgreSQL to Amazon RDS for PostgreSQL.. Migrating PostgreSQL to Amazon RDS for PostgreSQL offloads patching, backups, and scaling to AWS, reducing operational overhead. RDS automates OS and database patching, provides automated backups with point-in-time recovery, and supports vertical scaling with minimal downtime. This directly addresses the team's time spent on maintenance while lowering TCO compared to self-managed EC2.

Answer

Move PostgreSQL to Amazon DynamoDB without redesigning the application.

Answer

Replace RabbitMQ with another EC2-based broker cluster for more control.

Answer

Keep the same design and increase instance sizes to simplify maintenance.

Question 13

A serverless checkout API has predictable traffic spikes every weekday at 09:00 UTC and low traffic the rest of the day. The team wants to reduce cost while keeping response times fast during the recurring spike. Which two actions should they take? Select two.

Accepted Answer

Use provisioned concurrency for the Lambda function during the expected spike window.. Provisioned concurrency initializes a specified number of Lambda execution environments in advance, ensuring no cold starts during traffic spikes. By scheduling provisioned concurrency to activate only during the 09:00 UTC window, the team keeps response times fast without paying for idle capacity the rest of the day.

Answer

Replace the API with a single always-on EC2 instance.

Answer

Keep provisioned concurrency permanently high all day and all week.

Answer

Disable API Gateway and use direct public internet access to Lambda.

Question 14

A company runs Amazon EC2 instances in private subnets. Those instances only need to access Amazon S3 (read/write) and Amazon DynamoDB. The VPC currently routes all outbound traffic through a NAT Gateway, increasing monthly cost. What change most directly reduces NAT Gateway usage for these AWS services?

Accepted Answer

Remove the NAT Gateway path for S3 and DynamoDB by creating S3 Gateway VPC endpoints and DynamoDB Gateway VPC endpoints, and updating the private subnet route tables to route S3/DynamoDB traffic to those endpoints.. S3 Gateway VPC endpoints and DynamoDB Gateway VPC endpoints allow EC2 instances in private subnets to access these services directly over the AWS network without traversing a NAT Gateway. This eliminates NAT Gateway data processing charges for S3 and DynamoDB traffic, directly reducing costs. The route tables in the private subnets are updated to direct S3 and DynamoDB traffic to the gateway endpoints, bypassing the NAT Gateway entirely.

Answer

Keep the NAT Gateway but disable any cross-region routing settings for the route table entries that point to the NAT Gateway.

Answer

Create interface VPC endpoints for all services (including S3) and route S3 traffic to the interface endpoint network interfaces (ENIs).

Answer

Add an IAM policy that denies requests unless they originate from the public subnet, so the application sends fewer requests through the NAT Gateway.

Question 15

A company hosts application servers in private subnets. They must access Amazon S3 and read secrets from AWS Secrets Manager, but they want to avoid internet egress. They currently use a NAT gateway and see high NAT-related costs. What change most directly reduces cost while keeping traffic on the AWS network?

Accepted Answer

Create a Gateway VPC endpoint for S3 and an Interface VPC endpoint for Secrets Manager, then route requests via those endpoints instead of NAT. It replaces the NAT gateway with VPC endpoints, which are free of data processing charges and keep all traffic within the AWS network. A Gateway VPC endpoint for S3 uses prefix lists and route table entries to send S3 traffic directly over the AWS backbone, while an Interface VPC endpoint for Secrets Manager uses AWS PrivateLink to provide private connectivity without internet egress. This eliminates NAT gateway hourly and data processing costs, directly addressing the cost concern.

Answer

Keep the NAT gateway and reduce instance size to lower NAT throughput charges

Answer

Switch Secrets Manager to use S3 as a storage backend so both services can use the S3 endpoint only

Answer

Move the private subnets to public subnets and attach an Internet Gateway to eliminate NAT