SAA-C03 Design Secure Architectures Practice Test 4 — 15 Questions

Question 1

A company operates 40 AWS accounts and wants chargeback by application, environment, and business unit. Finance needs detailed line items, and engineering wants consistent monthly reports without manual spreadsheet work. The current tagging scheme is inconsistent, and many resources are missing billing metadata. Which three actions should the architect recommend? Select three.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Standardize cost allocation tags such as Application, Environment, and BusinessUnit.. Standardizing cost allocation tags like Application, Environment, and BusinessUnit ensures consistent metadata across all 40 accounts. This is a prerequisite for accurate chargeback, as AWS Cost Allocation Tags allow you to group resources by these dimensions for detailed billing reports.

Answer

Use AWS Budgets alone because it provides the most detailed line-item attribution.

Answer

Rely only on the Cost Explorer console for chargeback accuracy.

Question 2

An order-processing application becomes slow when traffic spikes. The frontend should stay responsive even if downstream workers are temporarily overloaded. What should the team add to the design?

Accepted Answer

Amazon SQS queue between the frontend and the workers. Adding an Amazon SQS queue between the frontend and the workers decouples the components, allowing the frontend to remain responsive by immediately offloading requests to the queue even when downstream workers are overloaded. The workers can then process messages at their own pace, and the queue acts as a buffer to absorb traffic spikes without blocking the frontend.

Answer

A larger NAT Gateway

Answer

A single bigger EC2 instance for the worker

Answer

An Amazon Route 53 health check on the frontend

Question 3

Based on the exhibit, what is the most appropriate change to restore application access while keeping encryption at rest with customer-managed KMS controls?

Accepted Answer

Update the KMS key policy or add a grant so AppServerRole can use the key for decrypt and data key operations.. The application is failing because AppServerRole lacks the necessary permissions to use the customer-managed KMS key for decrypting S3 objects. By updating the KMS key policy or adding a grant to allow the role to perform `kms:Decrypt` and `kms:GenerateDataKey` operations, you restore access while maintaining encryption at rest with customer-managed KMS controls.

Answer

Change the bucket to SSE-S3 so the application no longer depends on KMS permissions.

Answer

Move the EC2 instance into the same Availability Zone as the S3 bucket to reduce encryption errors.

Answer

Attach AmazonS3FullAccess to the application role so S3 can bypass KMS authorization.

Question 4

Based on the exhibit, what is the most appropriate fix so the workload in Account A can access the S3 bucket in Account B without using long-lived access keys?

Accepted Answer

Create an IAM role in Account B, trust Account A's AppRole to assume it with STS, and then access the bucket using temporary credentials.. It uses AWS Security Token Service (STS) to allow the workload in Account A to assume an IAM role in Account B, obtaining temporary credentials that grant access to the S3 bucket. This eliminates the need for long-lived access keys and follows the principle of least privilege, as the role can be scoped to specific S3 actions and resources.

Answer

Attach AmazonS3FullAccess to the instance profile role in Account A and keep using the same direct access path.

Answer

Add an SCP to Account A that allows S3 actions against buckets in Account B.

Answer

Enable S3 versioning on the bucket so cross-account requests are automatically trusted.

Question 5

Based on the exhibit, which AWS service should the team use so the database password can rotate automatically every 30 days and the application can retrieve it securely at runtime?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it natively supports automatic rotation of database passwords on a configurable schedule (e.g., every 30 days) and provides secure retrieval at runtime via the AWS SDK, CLI, or Secrets Manager API. Unlike Parameter Store, Secrets Manager is designed specifically for managing secrets with built-in rotation, encryption, and fine-grained access control.

Answer

AWS Systems Manager Parameter Store with a standard String parameter

Answer

Amazon Cognito user pools

Answer

AWS Key Management Service customer managed keys

Question 6

A company has three workloads. First, a stable EC2 application will remain on the same instance family for at least one year. Second, an ECS service on Fargate may shift between launch types but has steady baseline usage. Third, a fault-tolerant nightly batch job can be interrupted and restarted. Which three pricing choices should the architect recommend? Select three.

Accepted Answer

Standard Reserved Instances for the EC2 application.. Standard Reserved Instances (A) are ideal for the stable EC2 application because the workload has a predictable, steady-state usage and will remain on the same instance family for at least one year. By committing to a 1-year or 3-year term, the company receives a significant discount (up to 72%) compared to On-Demand pricing, making it the most cost-effective choice for this stable, long-running workload.

Answer

On-Demand Instances for all three workloads.

Answer

Dedicated Hosts for the batch job.

Question 7

A development environment runs a small web app on EC2 and an Amazon RDS database, but it is used only on weekdays during office hours. The team wants to minimize spend and can tolerate a short startup delay after the environment is started. Which two changes should the architect recommend? Select two.

Accepted Answer

Stop the EC2 instances outside business hours and start them on a schedule.. Stopping EC2 instances outside business hours eliminates compute costs (you are not charged for stopped instances, only for attached EBS volumes). The team tolerates a short startup delay, so a scheduled stop/start (e.g., via AWS Instance Scheduler or Lambda) directly reduces spend without architectural changes.

Answer

Move the app to larger EC2 instances so fewer machines are managed.

Answer

Keep RDS and EC2 running all weekend because start/stop is operationally risky.

Answer

Use Spot Instances for the database tier.

Question 8

A stateless web application runs on Amazon EC2 instances across two Availability Zones. The team wants unhealthy instances to be removed automatically and replaced without manual action. What is the best solution?

Accepted Answer

Use an Application Load Balancer with an Auto Scaling group and configure health checks.. An Application Load Balancer (ALB) with an Auto Scaling group provides automated health checks and instance replacement. The ALB performs HTTP/HTTPS health checks against the instances, and when an instance fails the health check, the Auto Scaling group automatically terminates the unhealthy instance and launches a new one to maintain the desired capacity. This ensures the stateless web application remains available across both Availability Zones without manual intervention.

Answer

Place the instances in a single subnet and increase the instance size.

Answer

Use a network ACL to detect failed instances and restart them.

Answer

Store the web servers on EBS volumes so the data survives failures.

Question 9

A company has a primary application in us-east-1 and a standby environment in us-west-2. Users should go to the primary site while it is healthy and automatically switch to the standby site if the primary fails. Which Route 53 routing policy should they use?

Accepted Answer

Failover routing with health checks. Failover routing with health checks is the correct choice because it allows you to configure an active-passive failover pattern where Route 53 directs traffic to the primary resource (us-east-1) as long as it passes a health check. If the health check fails, Route 53 automatically routes traffic to the secondary resource (us-west-2), ensuring high availability without manual intervention.

Answer

Weighted routing

Answer

Geolocation routing

Answer

Latency-based routing

Question 10

A company runs Amazon RDS for MySQL in a Multi-AZ configuration. If the primary database instance fails, what is the expected behavior?

Accepted Answer

RDS automatically fails over to the standby instance in the same Region and keeps the same endpoint.. Amazon RDS for MySQL in a Multi-AZ configuration automatically synchronously replicates data to a standby instance in a different Availability Zone. When the primary database instance fails, RDS automatically fails over to the standby instance, updating the DNS record for the same CNAME endpoint so that applications can resume operations without manual intervention. This ensures high availability with minimal downtime.

Answer

The database remains unavailable until an administrator manually creates a new instance.

Answer

Traffic is routed to a read replica in another Region for immediate continuity.

Answer

The failed primary continues serving traffic while the standby synchronizes in the background.

Question 11

A Lambda function in Account A must upload reports to an S3 bucket in Account B. Security does not want long-lived access keys anywhere, and the access should be easy to revoke from Account B. Which approach is best?

Accepted Answer

Create an IAM role in Account B that Account A can assume through STS, then grant the role S3 permissions.. It uses cross-account IAM roles with AWS Security Token Service (STS) to grant temporary credentials to the Lambda function. This avoids long-lived access keys, and the permissions can be revoked immediately by modifying or deleting the role in Account B, meeting the security requirements.

Answer

Create an IAM user in Account B and store its access keys in Lambda environment variables.

Answer

Attach a security group to the Lambda function that allows outbound traffic to the bucket.

Answer

Use AWS Organizations SCPs to grant the Lambda function permission to write to the bucket.

Question 12

Based on the exhibit, what should the architect recommend to reduce inter-node latency for this workload?

Accepted Answer

Launch the instances in a cluster placement group within the same Availability Zone.. A cluster placement group provides the lowest possible latency and highest packet-per-second performance by ensuring instances are placed in close physical proximity within a single Availability Zone. This is ideal for tightly coupled, high-performance computing workloads that require low inter-node latency.

Answer

Use a spread placement group so each instance is placed on separate hardware.

Answer

Move the instances into different Availability Zones to improve fault tolerance.

Answer

Use a partition placement group to balance traffic across partitions.

Question 13

Match each operational condition to the load balancing or Auto Scaling behavior that should occur.

Accepted Answer

High CPU utilization: Auto Scaling adds EC2 instances. Auto Scaling adds instances when metrics like CPU or network utilization exceed thresholds (scaling out), and reduces instances when metrics like CPU or request count (often from a load balancer) fall below thresholds (scaling in). Unhealthy hosts detected by Auto Scaling or a load balancer trigger instance replacement.

Answer

High CPU utilization: Auto Scaling reduces the number of instances

Answer

Unhealthy EC2 instance: Auto Scaling adds EC2 instances

Answer

Low request count: Auto Scaling adds EC2 instances

Question 14

A public web application is fronted by Amazon CloudFront and an ALB. The team is seeing SQL injection attempts and bursts of malicious HTTP requests that increase origin load. They want to block common web attacks before they reach the ALB. What should they do?

Accepted Answer

Associate an AWS WAF web ACL with the CloudFront distribution.. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. By associating an AWS WAF web ACL with the CloudFront distribution, you can inspect and filter HTTP(S) requests at the edge before they reach the ALB, reducing origin load and blocking malicious traffic early. This is the recommended approach for defending against layer 7 attacks at the CDN level.

Answer

Add an inbound security group rule to the ALB for the attacker IP ranges.

Answer

Use a network ACL to inspect and block SQL statements in the request body.

Answer

Enable Amazon KMS encryption on the ALB listener certificates.

Question 15

A finance application stores invoices in Amazon S3. Security requires that the data be encrypted with a key they control, and they want the ability to disable access quickly if the application is suspected of compromise. Developers do not want to manage encryption in application code. Which solution best meets these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed AWS KMS key.. SSE-KMS with a customer-managed AWS KMS key meets the requirements because it allows the finance application to encrypt data at rest using a key that the customer controls, and it provides the ability to quickly disable access by revoking or disabling the KMS key, which immediately blocks any decryption attempts. The developers do not need to manage encryption in application code because encryption is handled server-side by S3 using the KMS key.

Answer

Use SSE-S3 with the default Amazon-managed key for all uploads.

Answer

Encrypt objects on the client side and store the encryption key in the same S3 bucket.

Answer

Use Amazon S3 replication to a second bucket in another region.