SAA-C03 Design Secure Architectures Practice Test 2 — 15 Questions

Question 1

A studio keeps 4 PB of completed video projects in Amazon S3. Editors work on active projects for about 60 days, auditors occasionally review the same objects for several months, and legal policy requires retention for 7 years. Retrieval of very old files can take hours. Which three actions should the architect recommend? Select three.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transition objects to S3 Standard-IA after 60 days.. After 60 days of active editing, objects can be transitioned to S3 Standard-IA, which offers lower storage costs than S3 Standard while still providing low-latency retrieval for occasional access by auditors. This lifecycle policy optimizes cost without sacrificing availability for the review period.

Answer

Keep the files in S3 Standard indefinitely so retrieval is always fast.

Answer

Copy the files to a single EBS volume for lower per-GB cost.

Question 2

A single EC2 instance hosts a database that needs low-latency block storage and a persistent volume that remains attached to the instance. Which AWS storage service is the best fit?

Accepted Answer

Amazon EBS. Amazon EBS provides persistent block-level storage volumes that can be attached to a single EC2 instance, offering low-latency performance suitable for database workloads. Unlike ephemeral instance store volumes, EBS volumes persist independently of the instance's lifecycle, ensuring data durability even when the instance is stopped or terminated.

Answer

Amazon S3

Answer

Amazon EFS

Answer

AWS Storage Gateway

Question 3

A company runs a steady inventory API on AWS Fargate and AWS Lambda during the day, plus a nightly batch render farm on EC2 that can be interrupted and retried. The finance team wants the lowest predictable discount for the always-on compute and the lowest possible cost for the batch jobs. Which two purchasing choices should the architect recommend? Select two.

Accepted Answer

Purchase a Compute Savings Plan for the steady Fargate and Lambda usage.. A Compute Savings Plan offers the lowest predictable discount (up to 66% compared to On-Demand) and automatically applies to Fargate and Lambda usage, covering the always-on inventory API without requiring instance family or region commitments. This provides flexibility while still delivering significant savings over On-Demand pricing.

Answer

Purchase Standard Reserved Instances for the steady Fargate and Lambda usage.

Answer

Use On-Demand Instances for the batch render farm to avoid interruptions.

Answer

Move the render farm to Dedicated Hosts to improve price predictability.

Question 4

A company operates 40 AWS accounts and wants chargeback by application, environment, and business unit. Finance needs detailed line items, and engineering wants consistent monthly reports without manual spreadsheet work. The current tagging scheme is inconsistent, and many resources are missing billing metadata. Which three actions should the architect recommend? Select three.

Accepted Answer

Standardize cost allocation tags such as Application, Environment, and BusinessUnit.. Standardizing cost allocation tags like Application, Environment, and BusinessUnit ensures consistent metadata across all 40 accounts. This is a prerequisite for accurate chargeback, as AWS Cost Allocation Tags allow you to group resources by these dimensions for detailed billing reports.

Answer

Use AWS Budgets alone because it provides the most detailed line-item attribution.

Answer

Rely only on the Cost Explorer console for chargeback accuracy.

Question 5

A company has three workloads. First, a stable EC2 application will remain on the same instance family for at least one year. Second, an ECS service on Fargate may shift between launch types but has steady baseline usage. Third, a fault-tolerant nightly batch job can be interrupted and restarted. Which three pricing choices should the architect recommend? Select three.

Accepted Answer

Standard Reserved Instances for the EC2 application.. Standard Reserved Instances (A) are ideal for the stable EC2 application because the workload has a predictable, steady-state usage and will remain on the same instance family for at least one year. By committing to a 1-year or 3-year term, the company receives a significant discount (up to 72%) compared to On-Demand pricing, making it the most cost-effective choice for this stable, long-running workload.

Answer

On-Demand Instances for all three workloads.

Answer

Dedicated Hosts for the batch job.

Question 6

A development environment runs a small web app on EC2 and an Amazon RDS database, but it is used only on weekdays during office hours. The team wants to minimize spend and can tolerate a short startup delay after the environment is started. Which two changes should the architect recommend? Select two.

Accepted Answer

Stop the EC2 instances outside business hours and start them on a schedule.. Stopping EC2 instances outside business hours eliminates compute costs (you are not charged for stopped instances, only for attached EBS volumes). The team tolerates a short startup delay, so a scheduled stop/start (e.g., via AWS Instance Scheduler or Lambda) directly reduces spend without architectural changes.

Answer

Move the app to larger EC2 instances so fewer machines are managed.

Answer

Keep RDS and EC2 running all weekend because start/stop is operationally risky.

Answer

Use Spot Instances for the database tier.

Question 7

Match each operational condition to the load balancing or Auto Scaling behavior that should occur.

Accepted Answer

High CPU utilization: Auto Scaling adds EC2 instances. Auto Scaling adds instances when metrics like CPU or network utilization exceed thresholds (scaling out), and reduces instances when metrics like CPU or request count (often from a load balancer) fall below thresholds (scaling in). Unhealthy hosts detected by Auto Scaling or a load balancer trigger instance replacement.

Answer

High CPU utilization: Auto Scaling reduces the number of instances

Answer

Unhealthy EC2 instance: Auto Scaling adds EC2 instances

Answer

Low request count: Auto Scaling adds EC2 instances

Question 8

A media company stores raw project files in Amazon S3. Files are accessed heavily for the first 60 days, occasionally for legal review during the next six months, and must be retained for 7 years. Retrieval for the oldest files can take hours. Which three actions should the architect recommend? Select three.

Accepted Answer

Transition objects to S3 Standard-IA after 60 days.. S3 Standard-IA is designed for data accessed less frequently but requires rapid access when needed. After 60 days of heavy access, transitioning to Standard-IA reduces storage costs while maintaining low-latency retrieval for occasional legal reviews.

Answer

Store the same files in EBS snapshots instead of S3 to lower archive costs.

Answer

Replicate the bucket to another Region to reduce storage charges.

Question 9

The web tier of an online scheduling app runs on an Auto Scaling group behind an ALB. Traffic spikes every weekday at 13:00 when a corporate newsletter is sent. CloudWatch shows CPU averages 18% outside that window, and the current fleet uses larger instances than the load test requires. The application is stateless and can scale out in a few minutes. Which two changes should the architect recommend? Select two.

Accepted Answer

Use scheduled scaling to raise desired capacity before the known newsletter window and lower it afterward.. The traffic spike is predictable (every weekday at 13:00), making scheduled scaling the most cost-effective and reliable approach. Scheduled scaling allows you to increase the desired capacity of the Auto Scaling group before the newsletter window and decrease it afterward, ensuring the application can handle the load without relying on dynamic scaling policies that might lag behind the sudden spike. This avoids over-provisioning during non-peak hours while guaranteeing capacity exactly when needed.

Answer

Keep the current oversized instances to avoid any scaling activity.

Answer

Replace the Auto Scaling group with Spot Instances only.

Answer

Disable ALB health checks to save a small amount of traffic.

Question 10

A retail company lets developers deploy ECS services but they must never be able to modify IAM. The team currently uses an IAM user per developer with an admin-like policy, and several access keys have been leaked. You are asked to redesign access so that: (1) developers authenticate with temporary credentials, (2) they can create/update ECS services and related autoscaling resources, and (3) IAM changes are impossible even if a developer tries to attach new policies.

Which design best meets all requirements?

Accepted Answer

Use an IAM role that developers assume for deployments; attach least-privilege policies for ECS and Auto Scaling; and attach a permission boundary that does not allow iam:* actions, so additional inline or managed policies cannot grant IAM permissions.. It uses an IAM role with temporary credentials (via AWS STS AssumeRole), satisfying the requirement that developers never have long-term access keys. The least-privilege policies restrict actions to ECS and Auto Scaling only, and the permission boundary explicitly denies iam:* actions, preventing developers from escalating privileges by attaching new policies to their role. This combination ensures developers can deploy ECS services but cannot modify IAM in any way.

Answer

Create an IAM user for each developer and keep the existing broad permissions, rotating keys every 90 days.

Answer

Attach a policy that allows ecs:* and autoscaling:* and rely on developers to self-review that no IAM statements are added to their roles.

Answer

Create a single shared IAM role with full administrator permissions so developers can troubleshoot faster when deployments fail.

Question 11

Based on the exhibit, the company has one shared S3 bucket for many internal teams. Security wants each team to access only its own prefix, ACLs must remain disabled, and the current bucket policy has become too large and error-prone. What is the best redesign?

Accepted Answer

Create one S3 access point per team and attach an access point policy that limits that team to its own prefix.. S3 Access Points allow you to create separate access points for each team, each with its own policy that restricts access to a specific prefix (e.g., s3://shared-bucket/team-a/). This eliminates the need for a large, error-prone bucket policy while keeping ACLs disabled, meeting the security requirement for per-team prefix isolation without modifying the underlying bucket configuration.

Answer

Re-enable object ACLs and manage access by setting object-level ACLs for each team's prefix.

Answer

Split the bucket into one bucket per team and keep using a single shared bucket policy for all of them.

Answer

Make the bucket public and issue presigned URLs for team access so IAM policies are no longer needed.

Question 12

A workload runs in private subnets and must reach Amazon S3 and AWS Secrets Manager without using the internet or a NAT gateway. The team wants to keep the traffic on AWS private networking and avoid public IPs. Which two changes should the architect make? Select two.

Accepted Answer

Create an S3 gateway VPC endpoint and update the route tables for the private subnets.. An S3 gateway VPC endpoint allows private subnet instances to access S3 via AWS's private network without needing internet access or a NAT gateway. The endpoint uses route table entries to direct S3 traffic through the gateway, which is a horizontally scaled, redundant component that does not require public IPs.

Answer

Place a NAT gateway in the public subnet so the private instances can reach AWS services.

Answer

Assign public IPv4 addresses to the instances and restrict them with security groups.

Answer

Use VPC peering to the AWS service endpoints instead of VPC endpoints.

Question 13

Company A stores encrypted log files in its S3 bucket using SSE-KMS with a customer-managed KMS key. A partner application in Company B uploads objects into Company A's bucket using an IAM role in Company B. Uploads fail with an error indicating KMS access is denied (kms:Encrypt not authorized). Neither the partner IAM policy nor the S3 bucket policy currently mentions KMS.

What is the most secure and correct change to allow cross-account uploads to succeed?

Accepted Answer

In Company A's KMS key policy, allow Company B's partner role principal to use the key for kms:Encrypt, kms:GenerateDataKey, and kms:DescribeKey, and also add a matching IAM policy in Company B that grants the partner role those same KMS actions on Company A's key ARN, constrained to the target S3 bucket context when possible.. Cross-account SSE-KMS uploads require both the KMS key policy in Company A to explicitly grant the partner role principal the necessary KMS actions (kms:Encrypt, kms:GenerateDataKey, kms:DescribeKey) and an IAM policy in Company B that allows the partner role to call those actions on Company A's key ARN. The bucket policy alone cannot authorize KMS operations; KMS key policies act as the primary access control for customer-managed keys, and without the key policy grant, the partner role's IAM permissions are insufficient. Constraining the IAM policy to the target S3 bucket context (using kms:ViaService or kms:EncryptionContext conditions) adds a security best practice by limiting the key's use to only that specific S3 bucket.

Answer

In Company B's IAM policy, allow kms:Encrypt on Company A's KMS key ARN, without changing Company A's key policy.

Answer

Create a new KMS key in Company B and configure Company A's S3 bucket to use that key for SSE-KMS.

Answer

Disable key policy restrictions by setting the KMS key to enabled and removing all policy statements so that encryption automatically works for any principal.

Question 14

A startup runs an API on Amazon EC2. The instance must read items from one DynamoDB table and upload logs to one S3 bucket. Platform engineers also need a way to create new application roles, but those roles must never exceed a predefined set of permissions. Which three actions should the architect take? Select three.

Accepted Answer

Attach an IAM role to the EC2 instance profile and remove long-lived access keys from the server.. Attaching an IAM role to the EC2 instance profile allows the instance to obtain temporary credentials via the instance metadata service (IMDS), eliminating the need to store long-lived access keys on the server. This follows the AWS security best practice of using IAM roles for EC2 to securely access DynamoDB and S3 without managing static credentials.

Answer

Give the EC2 instance an IAM user with administrator access for simplicity.

Answer

Store the access keys in the application configuration file and rotate them later.

Question 15

A company stores customer invoices in an Amazon S3 bucket. The application must keep the bucket private, ACLs should not be used, and customers should receive temporary download links for individual invoices. Which three changes should the architect make? Select three.

Accepted Answer

Enable S3 Block Public Access on both the bucket and the AWS account.. Option A is correct because enabling S3 Block Public Access at both the bucket and account level prevents any accidental public exposure of the invoices, enforcing the requirement that the bucket stay private. Option C is correct because setting the S3 Object Ownership setting to Bucket owner enforced disables ACLs entirely, so access is managed solely through bucket policies and IAM, matching the requirement that ACLs not be used. Option D is correct because presigned URLs grant time-limited, per-object access to individual invoices without making the bucket or objects public, which is exactly how customers should receive temporary download links. Option B is wrong because it relies on object ACLs and public objects, contradicting both the no-ACL and private-bucket requirements. Option E is wrong because moving the bucket to another Region does not isolate it from the internet and does nothing to provide temporary per-invoice download links.

Answer

Continue using object ACLs so each customer invoice can be made public briefly.

Answer

Move the bucket to another AWS Region to isolate it from the internet.