SAA-C03 Design Secure Architectures Practice Test 5 — 15 Questions

Question 1

A production application stores critical data on an Amazon EBS volume. The team wants a simple backup method that allows the volume to be restored later if the server is lost. What should they use?

Accepted Answer

Amazon EBS snapshots. Amazon EBS snapshots are the correct choice because they provide a simple, incremental backup method for EBS volumes. Snapshots capture the data on the volume at a specific point in time and are stored in Amazon S3, allowing the volume to be restored to a new EC2 instance if the original server is lost. This directly meets the requirement for a backup that enables restoration after server failure.

Answer

Amazon S3 bucket versioning

Answer

AWS Security Hub

Answer

Amazon CloudFront invalidations

Question 2

A high-frequency trading analytics service runs on several EC2 instances in the same Availability Zone. The application exchanges small messages between nodes and is sensitive to microsecond-level network latency. Which design best meets the requirement?

Accepted Answer

Place the instances in a cluster placement group in one Availability Zone.. A cluster placement group is designed for low-latency, high-throughput scenarios by placing instances in a single Availability Zone with non-blocking, fully bisectioned bandwidth and microsecond-level latency. This meets the requirement for microsecond-sensitive inter-node communication in high-frequency trading.

Answer

Place the instances in a spread placement group across multiple Availability Zones.

Answer

Place the instances in a partition placement group within one Availability Zone.

Answer

Deploy the instances behind an Application Load Balancer in multiple Availability Zones.

Question 3

A Lambda function processes CPU-heavy JSON transformations and often runs slower than expected. The team wants to improve performance without changing the code. What should they try first?

Accepted Answer

Increase the Lambda memory setting. Increasing the Lambda memory setting allocates more CPU power proportionally, as AWS Lambda allocates CPU credits linearly with memory (up to 10,240 MB). For CPU-heavy JSON transformations, this directly reduces execution time without any code changes, making it the simplest and most effective first step.

Answer

Move the function to Amazon S3

Answer

Change the function to an ALB target

Answer

Disable CloudWatch logging

Question 4

A legacy market-data service runs on EC2 and exposes a custom TCP protocol. Clients must connect over TCP with very low latency, and the team wants static IP addresses at the load-balancing layer. Which AWS service is the best fit?

Accepted Answer

Network Load Balancer, because it supports TCP, static IPs, and very low latency.. The Network Load Balancer (NLB) operates at Layer 4, supports TCP traffic natively, provides static IP addresses per Availability Zone, and delivers very low latency by processing packets without inspecting application-layer headers. This makes it the ideal choice for a legacy market-data service that requires a custom TCP protocol and fixed IPs at the load-balancing layer.

Answer

Application Load Balancer, because it provides advanced routing for all protocols.

Answer

Amazon API Gateway, because it can front any network protocol with throttling.

Answer

Amazon CloudFront, because it can route traffic to EC2 instances at the edge.

Question 5

A database administrator wants a regular backup of an Amazon RDS database so the team can restore to a recent point in time if needed. Which AWS feature should they use?

Accepted Answer

RDS automated backups and snapshots. Amazon RDS automated backups and snapshots provide the ability to restore a database to any point within the backup retention period (up to 35 days). Automated backups include transaction logs for point-in-time recovery, while manual snapshots are user-initiated backups stored until explicitly deleted. This directly meets the requirement for regular backups and point-in-time restore capability.

Answer

Amazon Route 53 alias records

Answer

Security groups

Answer

AWS WAF rules

Question 6

A company operates 40 AWS accounts and wants chargeback by application, environment, and business unit. Finance needs detailed line items, and engineering wants consistent monthly reports without manual spreadsheet work. The current tagging scheme is inconsistent, and many resources are missing billing metadata. Which three actions should the architect recommend? Select three.

Accepted Answer

Standardize cost allocation tags such as Application, Environment, and BusinessUnit.. Option A is correct because standardizing cost allocation tags like Application, Environment, and BusinessUnit ensures consistent metadata across all 40 accounts. This is a prerequisite for accurate chargeback, as AWS Cost Allocation Tags allow you to group resources by these dimensions for detailed billing reports.

Answer

Use AWS Budgets alone because it provides the most detailed line-item attribution.

Answer

Rely only on the Cost Explorer console for chargeback accuracy.

Question 7

An order-processing application becomes slow when traffic spikes. The frontend should stay responsive even if downstream workers are temporarily overloaded. What should the team add to the design?

Accepted Answer

Amazon SQS queue between the frontend and the workers. Adding an Amazon SQS queue between the frontend and the workers decouples the components, allowing the frontend to remain responsive by immediately offloading requests to the queue even when downstream workers are overloaded. The workers can then process messages at their own pace, and the queue acts as a buffer to absorb traffic spikes without blocking the frontend.

Answer

A larger NAT Gateway

Answer

A single bigger EC2 instance for the worker

Answer

An Amazon Route 53 health check on the frontend

Question 8

Based on the exhibit, what is the most appropriate change to restore application access while keeping encryption at rest with customer-managed KMS controls?

Accepted Answer

Update the KMS key policy or add a grant so AppServerRole can use the key for decrypt and data key operations.. The application is failing because AppServerRole lacks the necessary permissions to use the customer-managed KMS key for decrypting S3 objects. By updating the KMS key policy or adding a grant to allow the role to perform `kms:Decrypt` and `kms:GenerateDataKey` operations, you restore access while maintaining encryption at rest with customer-managed KMS controls.

Answer

Change the bucket to SSE-S3 so the application no longer depends on KMS permissions.

Answer

Move the EC2 instance into the same Availability Zone as the S3 bucket to reduce encryption errors.

Answer

Attach AmazonS3FullAccess to the application role so S3 can bypass KMS authorization.

Question 9

A media company has users around the world uploading 1 to 5 GB files directly to a single Amazon S3 bucket. Upload times are slow from distant regions, but the app must keep using S3 as the destination. What should the architects enable to improve upload performance?

Accepted Answer

Amazon S3 Transfer Acceleration on the bucket.. Amazon S3 Transfer Acceleration (B) uses AWS edge locations to accelerate uploads over the public internet. When a user uploads a file, the data is sent to the nearest edge location via optimized network paths, then forwarded over AWS's private backbone to the S3 bucket. This reduces latency and improves throughput for large files (1–5 GB) from distant regions, directly addressing the slow upload times while keeping S3 as the destination.

Answer

Amazon CloudFront for origin caching of uploaded files.

Answer

Provisioned IOPS EBS volumes attached to a transfer server.

Answer

Amazon EFS with a mount target in each Region.

Question 10

A backup process restores a 2 TB production database from an EBS snapshot onto a new volume. During the first hours after restore, the application sees slow reads whenever previously unused blocks are accessed. What is the best way to avoid this performance issue in future restores?

Accepted Answer

Enable Fast Snapshot Restore on the snapshots used for recovery.. When an EBS volume is restored from a snapshot, it is lazily loaded from Amazon S3 in the background. Accessing data blocks that have not yet been loaded triggers a read penalty because the volume must fetch them from S3 before serving the I/O. Enabling Fast Snapshot Restore (FSR) pre-warms the snapshot data so that restored volumes have full performance immediately, eliminating the slow reads on first access.

Answer

Increase the volume size to give the database more free space.

Answer

Move the database files to Amazon EFS after the restore completes.

Answer

Use magnetic standard volumes because they avoid snapshot hydration delays.

Question 11

Based on the exhibit, what is the most appropriate fix so the workload in Account A can access the S3 bucket in Account B without using long-lived access keys?

Accepted Answer

Create an IAM role in Account B, trust Account A's AppRole to assume it with STS, and then access the bucket using temporary credentials.. Option A is correct because it uses AWS Security Token Service (STS) to allow the workload in Account A to assume an IAM role in Account B, obtaining temporary credentials that grant access to the S3 bucket. This eliminates the need for long-lived access keys and follows the principle of least privilege, as the role can be scoped to specific S3 actions and resources.

Answer

Attach AmazonS3FullAccess to the instance profile role in Account A and keep using the same direct access path.

Answer

Add an SCP to Account A that allows S3 actions against buckets in Account B.

Answer

Enable S3 versioning on the bucket so cross-account requests are automatically trusted.

Question 12

Based on the exhibit, which AWS service should the team use so the database password can rotate automatically every 30 days and the application can retrieve it securely at runtime?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it natively supports automatic rotation of database passwords on a configurable schedule (e.g., every 30 days) and provides secure retrieval at runtime via the AWS SDK, CLI, or Secrets Manager API. Unlike Parameter Store, Secrets Manager is designed specifically for managing secrets with built-in rotation, encryption, and fine-grained access control.

Answer

AWS Systems Manager Parameter Store with a standard String parameter

Answer

Amazon Cognito user pools

Answer

AWS Key Management Service customer managed keys

Question 13

A company has three workloads. First, a stable EC2 application will remain on the same instance family for at least one year. Second, an ECS service on Fargate may shift between launch types but has steady baseline usage. Third, a fault-tolerant nightly batch job can be interrupted and restarted. Which three pricing choices should the architect recommend? Select three.

Accepted Answer

Standard Reserved Instances for the EC2 application.. Standard Reserved Instances (A) are ideal for the stable EC2 application because the workload has a predictable, steady-state usage and will remain on the same instance family for at least one year. By committing to a 1-year or 3-year term, the company receives a significant discount (up to 72%) compared to On-Demand pricing, making it the most cost-effective choice for this stable, long-running workload.

Answer

On-Demand Instances for all three workloads.

Answer

Dedicated Hosts for the batch job.

Question 14

A development environment runs a small web app on EC2 and an Amazon RDS database, but it is used only on weekdays during office hours. The team wants to minimize spend and can tolerate a short startup delay after the environment is started. Which two changes should the architect recommend? Select two.

Accepted Answer

Stop the EC2 instances outside business hours and start them on a schedule.. Option A is correct because stopping EC2 instances outside business hours eliminates compute costs (you are not charged for stopped instances, only for attached EBS volumes). The team tolerates a short startup delay, so a scheduled stop/start (e.g., via AWS Instance Scheduler or Lambda) directly reduces spend without architectural changes.

Answer

Move the app to larger EC2 instances so fewer machines are managed.

Answer

Keep RDS and EC2 running all weekend because start/stop is operationally risky.

Answer

Use Spot Instances for the database tier.

Question 15

A stateless web application runs on Amazon EC2 instances across two Availability Zones. The team wants unhealthy instances to be removed automatically and replaced without manual action. What is the best solution?

Accepted Answer

Use an Application Load Balancer with an Auto Scaling group and configure health checks.. Option B is correct because an Application Load Balancer (ALB) with an Auto Scaling group provides automated health checks and instance replacement. The ALB performs HTTP/HTTPS health checks against the instances, and when an instance fails the health check, the Auto Scaling group automatically terminates the unhealthy instance and launches a new one to maintain the desired capacity. This ensures the stateless web application remains available across both Availability Zones without manual intervention.

Answer

Place the instances in a single subnet and increase the instance size.

Answer

Use a network ACL to detect failed instances and restart them.

Answer

Store the web servers on EBS volumes so the data survives failures.