SAA-C03 Design Secure Architectures Practice Test 6 — 15 Questions

Question 1

An order-quote Lambda function is invoked directly by API Gateway. Traffic is predictable during the business day, and the first request after scaling from zero causes unacceptable latency. The team wants to keep the current architecture and reduce cold-start impact. Which configuration should they use?

Accepted Answer

Enable provisioned concurrency for the Lambda function.. Provisioned concurrency initializes a specified number of execution environments in advance, so when the first request arrives after scaling from zero, it is served by a pre-warmed instance instead of incurring a cold start. This directly addresses the unacceptable latency without changing the architecture or requiring code modifications.

Answer

Increase the function timeout so the first invocation has more time to finish.

Answer

Set reserved concurrency to a fixed number and leave the rest unchanged.

Answer

Increase the memory size only to eliminate cold starts.

Question 2

A website serves mostly cacheable images, CSS, and JavaScript from an ALB. Users in Europe and Asia report slower page loads, and the ALB receives far more requests than expected. The team also wants text assets compressed automatically. Which change is the best first step?

Accepted Answer

Place Amazon CloudFront in front of the ALB and enable compression and caching.. CloudFront is the correct first step because it acts as a CDN that caches cacheable content (images, CSS, JS) at edge locations close to users in Europe and Asia, reducing load on the ALB and improving page load times. It also supports automatic compression of text assets (e.g., via gzip or Brotli) without requiring backend changes, directly addressing the team's requirement for compressed text assets. By offloading requests from the ALB, CloudFront reduces the number of requests hitting the origin, solving the 'far more requests than expected' issue.

Answer

Increase the ALB size and add more target instances behind it.

Answer

Use Route 53 latency-based routing to send users to the nearest ALB.

Answer

Replace the ALB with an NLB to reduce latency for web requests.

Question 3

A company has a primary application in us-east-1 and a standby environment in us-west-2. Users should go to the primary site while it is healthy and automatically switch to the standby site if the primary fails. Which Route 53 routing policy should they use?

Accepted Answer

Failover routing with health checks. Failover routing with health checks is the correct choice because it allows you to configure an active-passive failover pattern where Route 53 directs traffic to the primary resource (us-east-1) as long as it passes a health check. If the health check fails, Route 53 automatically routes traffic to the secondary resource (us-west-2), ensuring high availability without manual intervention.

Answer

Weighted routing

Answer

Geolocation routing

Answer

Latency-based routing

Question 4

A company runs Amazon RDS for MySQL in a Multi-AZ configuration. If the primary database instance fails, what is the expected behavior?

Accepted Answer

RDS automatically fails over to the standby instance in the same Region and keeps the same endpoint.. Amazon RDS for MySQL in a Multi-AZ configuration automatically synchronously replicates data to a standby instance in a different Availability Zone. When the primary database instance fails, RDS automatically fails over to the standby instance, updating the DNS record for the same CNAME endpoint so that applications can resume operations without manual intervention. This ensures high availability with minimal downtime.

Answer

The database remains unavailable until an administrator manually creates a new instance.

Answer

Traffic is routed to a read replica in another Region for immediate continuity.

Answer

The failed primary continues serving traffic while the standby synchronizes in the background.

Question 5

A Lambda function in Account A must upload reports to an S3 bucket in Account B. Security does not want long-lived access keys anywhere, and the access should be easy to revoke from Account B. Which approach is best?

Accepted Answer

Create an IAM role in Account B that Account A can assume through STS, then grant the role S3 permissions.. Option A is correct because it uses cross-account IAM roles with AWS Security Token Service (STS) to grant temporary credentials to the Lambda function. This avoids long-lived access keys, and the permissions can be revoked immediately by modifying or deleting the role in Account B, meeting the security requirements.

Answer

Create an IAM user in Account B and store its access keys in Lambda environment variables.

Answer

Attach a security group to the Lambda function that allows outbound traffic to the bucket.

Answer

Use AWS Organizations SCPs to grant the Lambda function permission to write to the bucket.

Question 6

Based on the exhibit, what should the architect recommend to reduce inter-node latency for this workload?

Accepted Answer

Launch the instances in a cluster placement group within the same Availability Zone.. A cluster placement group provides the lowest possible latency and highest packet-per-second performance by ensuring instances are placed in close physical proximity within a single Availability Zone. This is ideal for tightly coupled, high-performance computing workloads that require low inter-node latency.

Answer

Use a spread placement group so each instance is placed on separate hardware.

Answer

Move the instances into different Availability Zones to improve fault tolerance.

Answer

Use a partition placement group to balance traffic across partitions.

Question 7

Match each operational condition to the load balancing or Auto Scaling behavior that should occur.

Question 8

A public web application is fronted by Amazon CloudFront and an ALB. The team is seeing SQL injection attempts and bursts of malicious HTTP requests that increase origin load. They want to block common web attacks before they reach the ALB. What should they do?

Accepted Answer

Associate an AWS WAF web ACL with the CloudFront distribution.. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. By associating an AWS WAF web ACL with the CloudFront distribution, you can inspect and filter HTTP(S) requests at the edge before they reach the ALB, reducing origin load and blocking malicious traffic early. This is the recommended approach for defending against layer 7 attacks at the CDN level.

Answer

Add an inbound security group rule to the ALB for the attacker IP ranges.

Answer

Use a network ACL to inspect and block SQL statements in the request body.

Answer

Enable Amazon KMS encryption on the ALB listener certificates.

Question 9

An e-commerce application uses Aurora MySQL. Writes are modest, but the product-detail page generates many read-only queries and the writer instance CPU is high. The application can tolerate a small amount of replication lag on those reads. What should the team do?

Accepted Answer

Add Aurora read replicas and send read-only traffic to the reader endpoint.. Adding Aurora read replicas and directing read-only traffic to the reader endpoint offloads SELECT queries from the writer instance, reducing its CPU load. Aurora replicas share the same underlying storage volume, so replication lag is minimal (typically <100ms) and acceptable for the product-detail page. This scales read throughput without increasing writer instance size or cost.

Answer

Increase the writer instance size and keep all traffic on the primary.

Answer

Replace Aurora with DynamoDB to eliminate replication lag.

Answer

Enable Multi-AZ failover only, because it increases read throughput automatically.

Question 10

A finance application stores invoices in Amazon S3. Security requires that the data be encrypted with a key they control, and they want the ability to disable access quickly if the application is suspected of compromise. Developers do not want to manage encryption in application code. Which solution best meets these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed AWS KMS key.. SSE-KMS with a customer-managed AWS KMS key meets the requirements because it allows the finance application to encrypt data at rest using a key that the customer controls, and it provides the ability to quickly disable access by revoking or disabling the KMS key, which immediately blocks any decryption attempts. The developers do not need to manage encryption in application code because encryption is handled server-side by S3 using the KMS key.

Answer

Use SSE-S3 with the default Amazon-managed key for all uploads.

Answer

Encrypt objects on the client side and store the encryption key in the same S3 bucket.

Answer

Use Amazon S3 replication to a second bucket in another region.

Question 11

A security operations team wants continuous compliance checks for AWS resources. They need to know when an EBS volume becomes unencrypted or when a security group starts allowing SSH from 0.0.0.0/0. Which AWS service should they use?

Accepted Answer

AWS Config, because it evaluates resource configuration against compliance rules.. AWS Config is the correct service because it continuously monitors and evaluates the configuration of AWS resources against desired compliance rules. It can detect when an EBS volume is unencrypted or when a security group rule allows SSH (port 22) from 0.0.0.0/0, and trigger notifications or remediation actions via AWS Config rules.

Answer

AWS CloudTrail, because it records every API call made in the account.

Answer

Amazon GuardDuty, because it automatically encrypts noncompliant resources.

Answer

Amazon Macie, because it manages encryption settings for all AWS resources.

Question 12

Based on the exhibit, which AWS service should the security team enable to continuously discover sensitive data stored inside Amazon S3 objects?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data such as personally identifiable information (PII) or financial data stored in Amazon S3. It provides continuous visibility into data security risks by generating findings when sensitive data is detected, making it the correct choice for this use case.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 13

A company hosts static images, CSS, and JavaScript files in an Amazon S3 bucket. Users around the world report slow page loads, and the origin receives many repeated requests for the same files. What should the team use to improve performance?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content (images, CSS, JavaScript) at edge locations worldwide. By serving cached copies from the edge closest to each user, CloudFront reduces latency, offloads repeated requests from the origin S3 bucket, and improves page load times for a global audience.

Answer

AWS Direct Connect

Answer

Amazon Route 53 health checks

Answer

Amazon EFS

Question 14

A media company stores raw project files in Amazon S3. Files are accessed heavily for the first 60 days, occasionally for legal review during the next six months, and must be retained for 7 years. Retrieval for the oldest files can take hours. Which three actions should the architect recommend? Select three.

Accepted Answer

Transition objects to S3 Standard-IA after 60 days.. Option A is correct because S3 Standard-IA is designed for data accessed less frequently but requires rapid access when needed. After 60 days of heavy access, transitioning to Standard-IA reduces storage costs while maintaining low-latency retrieval for occasional legal reviews.

Answer

Store the same files in EBS snapshots instead of S3 to lower archive costs.

Answer

Replicate the bucket to another Region to reduce storage charges.

Question 15

Based on the exhibit, what is the best way to let private EC2 instances reach Amazon S3 and AWS Systems Manager without sending traffic through the internet or a NAT gateway?

Accepted Answer

Create a gateway endpoint for S3 and interface endpoints for Systems Manager, EC2Messages, and SSMMessages.. Gateway endpoints for S3 allow private EC2 instances to access S3 via AWS's private network without traversing the internet or a NAT gateway, using prefix lists and route table entries. Interface endpoints for Systems Manager, EC2Messages, and SSMMessages provide private connectivity to AWS Systems Manager via PrivateLink, enabling secure instance management without public IPs or NAT.

Answer

Add a more permissive security group rule allowing outbound 0.0.0.0/0 on all ports.

Answer

Replace the NAT gateway with a network ACL that allows ephemeral ports to the internet.

Answer

Move the instances to public subnets so they can reach AWS services directly.