SAA-C03 Hard Questions — 25 Difficult Questions

Question 1

Match each data-retention scenario to the most cost-effective Amazon S3 storage class. Assume the retrieval pattern and access-latency requirement are the most important constraints.

Accepted Answer

S3 Standard: Data accessed frequently; need low latency. S3 Standard is for frequent access; Intelligent-Tiering optimizes cost for unknown patterns; Standard-IA for infrequent but rapid access; Glacier Flexible Retrieval for minutes; Glacier Deep Archive for hours.

Answer

S3 Glacier Flexible Retrieval: Data accessed infrequently but requires rapid access when needed; retrieval time milliseconds

Answer

S3 Glacier Deep Archive: Data that can be retrieved within 1-5 minutes

Question 2

A warehouse integration service must use shared file storage across Linux EC2 instances in multiple Availability Zones. The storage must remain available during an AZ failure. Which service should be used? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Amazon EFS with mount targets in multiple Availability Zones. Amazon EFS provides a fully managed, NFS-based shared file system that can be mounted concurrently by multiple Linux EC2 instances across different Availability Zones. By creating mount targets in each AZ, the file system remains accessible even if one AZ fails, as traffic is automatically routed to the surviving mount targets. This meets the requirement for shared, resilient storage with a managed AWS-native control plane.

Answer

S3 mounted as a POSIX file system without a file gateway

Answer

Instance store volumes

Answer

An EBS volume attached to all instances

Question 3

Based on the exhibit, which design change is the best way to reduce the observed read latency for this DynamoDB-backed service?

Accepted Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table and send repeated read traffic through it.. Adding a DynamoDB Accelerator (DAX) cluster in front of the table reduces read latency by providing an in-memory cache for repeated read traffic. DAX delivers microsecond response times for eventually consistent reads, which directly addresses the observed latency issue without requiring application-level caching or table redesign.

Answer

Increase the on-demand table limits so DynamoDB can automatically absorb more traffic.

Answer

Create a global secondary index on tenantId to distribute the load across more partitions.

Answer

Move the dashboard data into S3 and use Lambda functions to read it on demand.

Question 4

A media company runs a 24/7 ingestion API on EC2 behind an Application Load Balancer and a nightly transcoding job that can resume from checkpoints. The API fleet runs at roughly 65 percent CPU all day, while the batch workers sit idle most of the time. The company wants to cut compute cost without risking the API. Which two changes should they make? Select two.

Accepted Answer

Purchase a Compute Savings Plan for the always-on API fleet.. A is correct because a Compute Savings Plan offers the largest discount (up to 66%) in exchange for a 1- or 3-year commitment to a consistent amount of compute usage (measured in $/hour), which perfectly matches the always-on API fleet that runs at a steady 65% CPU utilization. This plan applies to any EC2 instance family, region, or compute service (including Fargate and Lambda), giving flexibility while reducing costs for the predictable baseline load.

Answer

Replace the API fleet with Dedicated Hosts to lock in lower rates.

Answer

Buy Standard Reserved Instances for the batch workers and keep them running 24/7.

Answer

Increase the worker Auto Scaling minimum to prevent Spot interruptions.

Question 5

A company processes product-image uploads in bursts. Each transform takes up to ten minutes, and every job can be retried safely from the beginning. The current EC2 worker fleet is idle most of the day. Which two changes most reduce cost and idle capacity? Select two.

Accepted Answer

Buffer jobs in Amazon SQS and let workers scale from queue depth.. Amazon SQS decouples the bursty upload workload from the worker fleet. By using SQS queue depth as the metric for an Auto Scaling policy, workers scale up only when jobs are waiting and scale down to zero during idle periods, eliminating wasted capacity. This directly reduces cost by matching compute resources to actual demand.

Answer

Keep a fixed fleet of m6i.large instances in an Auto Scaling group with a higher minimum.

Answer

Use Reserved Instances for the workers even though demand is highly bursty.

Answer

Process uploads only during a nightly window so the fleet looks busier.

Question 6

A Lambda-based retail API has unpredictable traffic spikes and users see latency caused by cold starts. The function must respond consistently during expected campaign windows. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Provisioned concurrency during campaign windows. Provisioned concurrency pre-warms a specified number of Lambda execution environments, eliminating cold starts during the campaign windows. This is a managed AWS-native feature that ensures consistent sub-100ms response times even under unpredictable traffic spikes, directly addressing the latency issue.

Answer

A larger deployment package

Answer

Reserved concurrency only

Answer

CloudTrail data events

Question 7

A fleet of test servers is rebuilt every week from AMIs. EBS volumes are often left behind after termination, and the team creates daily snapshots of every volume even when nothing changes. Which three actions most reduce storage cost while preserving recovery options? Select three.

Accepted Answer

Use gp3 for new EBS volumes instead of gp2 when similar performance is enough.. Gp3 volumes offer a baseline performance that is often sufficient for test servers, and they are typically more cost-effective than gp2 volumes for the same amount of storage. By using gp3, you avoid paying for the additional IOPS that gp2 includes by default, which can reduce costs when the workload does not require high performance. This directly addresses the goal of reducing storage costs while maintaining adequate performance for recovery purposes.

Answer

Keep unattached volumes around for troubleshooting after instance termination.

Answer

Raise provisioned IOPS on every volume so snapshot restore time feels faster.

Question 8

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a e-learning platform. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy?

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. The bucket policy can use the `aws:sourceVpce` condition key to restrict access to requests originating from a specific VPC endpoint (interface or Gateway VPC endpoint). This ensures that only traffic routed through that endpoint can access the S3 bucket, meeting the security team's requirement for regulated exports.

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A deny statement for all IAM users except the EC2 role

Question 9

A CI system runs on EC2 instances in private subnets and uploads build artifacts to an S3 bucket. The security team wants to eliminate NAT Gateway costs, force all uploads to use TLS, and require SSE-KMS with an approved customer managed key. Which three changes should be made? Select three.

Accepted Answer

Create an S3 gateway VPC endpoint and associate it with the private subnets' route tables.. Creating an S3 gateway VPC endpoint allows EC2 instances in private subnets to access S3 without traversing the internet, eliminating the need for a NAT Gateway and its associated costs. The endpoint uses AWS’s internal network, and associating it with the private subnets' route tables ensures traffic to S3 is routed through the endpoint.

Answer

Deploy a NAT Gateway in each Availability Zone and route artifact traffic through it.

Answer

Use the S3 static website endpoint because it automatically enforces HTTPS.

Question 10

Based on the exhibit, the team serves versioned JavaScript and CSS files from an S3 origin through CloudFront. After a release, the cache hit ratio dropped and origin fetches increased sharply. What change best reduces both CloudFront and S3 costs without changing the application’s public behavior?

Accepted Answer

Create a cache policy that excludes Authorization, cookies, and unnecessary query strings, and narrow the origin request policy to forward only the headers the S3 origin actually needs.. B is correct because versioned JavaScript and CSS files are immutable, so CloudFront should cache them aggressively. By creating a cache policy that excludes unnecessary headers (like Authorization and cookies) and query strings, and narrowing the origin request policy to forward only required headers, you maximize cache hits and reduce origin fetches. This directly lowers both CloudFront data transfer costs (fewer origin requests) and S3 request costs (fewer GET requests), without altering the application's public behavior.

Answer

Increase the CloudFront price class to include more edge locations.

Answer

Disable CloudFront and serve the files directly from S3 to avoid cache invalidation overhead.

Answer

Use Lambda@Edge to rewrite every request into a unique path so that clients never receive stale files.

Question 11

A media company serves versioned JavaScript and CSS files from an Amazon S3 origin through CloudFront. After each release, origin requests spike even though the files are public. Browser requests include a tracking cookie, an Authorization header, and a cache-busting query string that the site no longer needs. Which three changes will most improve the CloudFront cache hit ratio without exposing private content? Select three.

Accepted Answer

Rename each static asset with a content hash or release version in the filename before publishing.. Renaming static assets with a content hash or version in the filename ensures that each new release creates a unique object key in S3. This allows CloudFront to treat the new file as a distinct object, avoiding cache invalidation issues and enabling long-term caching of the old version. Without this, even with cache-busting query strings, CloudFront might still serve stale content or require frequent invalidations, reducing the cache hit ratio.

Answer

Enable CloudFront compression and configure the origin to return Cache-Control: no-store for all files.

Answer

Forward all viewer headers to the origin so CloudFront can personalize every request.

Question 12

Security responders suspect exfiltration from an Amazon S3 bucket that stores sensitive reports encrypted with a customer managed KMS key. They need to identify which IAM principal downloaded each object and whether any principals called KMS Decrypt on the key during the same time window. Which two detective controls should be enabled? Select two.

Accepted Answer

Enable CloudTrail data events for the S3 bucket.. Enabling CloudTrail data events for the S3 bucket captures detailed logs of object-level operations, including GetObject (download) requests. This allows you to identify which IAM principal downloaded each object, including the source IP, user agent, and request time. Without data events, CloudTrail only logs management-level actions (e.g., bucket creation) and misses object-level access.

Answer

Enable S3 Object Lock in compliance mode.

Answer

Turn on default bucket encryption with SSE-KMS.

Answer

Enable MFA Delete on the bucket.

Question 13

A media company serves versioned JavaScript and CSS files from Amazon S3 through CloudFront. After each release, the cache hit ratio drops sharply because the same distribution also fronts a personalized API path, and the current cache policy forwards cookies, all query strings, and several headers to every origin request. The static assets already use content-hashed filenames. Which two changes will most directly improve cache hit ratio for the static assets without changing the application behavior? Select two.

Accepted Answer

Create a dedicated cache behavior for the static asset path that excludes cookies, query strings, and unneeded headers from the cache key.. Creating a dedicated cache behavior for the static asset path (e.g., /static/*) allows you to configure a cache policy that excludes cookies, query strings, and unneeded headers from the cache key. Since the static assets use content-hashed filenames, they are immutable and do not vary by user-specific attributes. By removing these variables from the cache key, CloudFront can serve the same cached object to all users, drastically improving the cache hit ratio.

Answer

Increase the size of the S3 bucket’s underlying storage to absorb more origin traffic.

Answer

Add Lambda@Edge logic to append a timestamp to every asset request so updates are always fetched immediately.

Answer

Disable compression so CloudFront can treat each object as a separate cache entry.

Question 14

Based on the exhibit, the company wants to lower CloudWatch and EC2 monitoring costs. Auditors require logs to be retained for 90 days, but operations only uses detailed per-instance metrics during rare troubleshooting events. Which change best reduces recurring cost while preserving the required visibility?

Accepted Answer

Set CloudWatch Logs retention to 90 days for all log groups, and switch EC2 monitoring from detailed to basic except during incidents.. It directly addresses the two cost drivers: CloudWatch Logs storage costs are minimized by setting a 90-day retention policy (matching the audit requirement), and EC2 detailed monitoring (1-minute metrics) is replaced with basic monitoring (5-minute metrics) during normal operations, with the ability to switch back to detailed only when needed for troubleshooting. This preserves the required log retention and the ability to obtain high-resolution metrics on demand, while eliminating the recurring cost of storing logs indefinitely and paying for detailed monitoring on every instance.

Answer

Disable CloudWatch Logs entirely and rely on application local files for 90 days.

Answer

Increase the number of CloudWatch alarms so that metrics are collected less expensively.

Answer

Export all logs to Amazon S3 immediately and keep detailed monitoring enabled on every instance.

Question 15

An application runs in private subnets and must download objects from Amazon S3 and read one secret from AWS Secrets Manager. NAT gateways are prohibited, and traffic must not traverse the public internet. The secret uses a customer managed KMS key. Which design is best?

Accepted Answer

Create a gateway VPC endpoint for S3 and an interface VPC endpoint for Secrets Manager with private DNS enabled.. It uses a gateway VPC endpoint for S3, which provides private connectivity to S3 without traversing the internet, and an interface VPC endpoint for Secrets Manager, which allows private access via AWS PrivateLink. Enabling private DNS ensures that the standard DNS names for both services resolve to the endpoint IPs, keeping all traffic within the AWS network and meeting the requirement to avoid NAT gateways and public internet.

Answer

Use a NAT gateway for outbound access and rely on security groups to block internet destinations.

Answer

Create interface VPC endpoints for both S3 and Secrets Manager and enable private DNS.

Answer

Use VPC peering to a public subnet that hosts a proxy for S3 and Secrets Manager access.

Question 16

Based on the exhibit, an automation pipeline in several member accounts creates IAM roles for application deployments. Security says no future role may exceed the approved boundary arn:aws:iam::123456789012:policy/DeployBoundary, even if someone later attaches AdministratorAccess. What should you implement to enforce this across the organization?

Accepted Answer

Create an SCP that denies iam:CreateRole unless iam:PermissionsBoundary equals arn:aws:iam::123456789012:policy/DeployBoundary, and also deny removing that boundary from created roles.. It uses an SCP to enforce that any IAM role creation must include the specific permissions boundary `arn:aws:iam::123456789012:policy/DeployBoundary`, and also prevents removal or modification of that boundary from existing roles. This ensures that even if an attacker or administrator later attaches a policy like AdministratorAccess, the effective permissions are still limited by the boundary, meeting the security requirement across all member accounts in the organization.

Answer

Attach DeployBoundary to the automation role only, because that automatically forces every created role to inherit the same boundary.

Answer

Create an SCP that denies iam:CreateRole and iam:PutRolePermissionsBoundary unless aws:RequestTag equals DeployBoundary.

Answer

Use AWS Access Analyzer to automatically attach the approved boundary whenever a role is created without one.

Question 17

Based on the exhibit, the current disaster recovery design misses the RTO target even though the database replica is current. Which deployment model best meets the requirements with the least always-on cost?

Accepted Answer

Warm standby, because a scaled-down application stack stays running in the secondary Region and can take over faster.. Warm standby is the correct choice because it keeps a scaled-down application stack running in the secondary Region, which can be scaled up quickly to handle production traffic. This design meets the RTO target by reducing failover time compared to a pilot light, while avoiding the higher always-on cost of an active-active deployment.

Answer

Pilot light, because only the database needs to be running in the secondary Region.

Answer

Active-active, because both Regions should always serve traffic to guarantee the RTO.

Answer

Backup and restore, because restoring from backups is the least expensive DR model available.

Question 18

Based on the exhibit, a distributed analytics workload runs on 12 EC2 instances in one Availability Zone. The nodes exchange thousands of small messages per second and require the lowest possible intra-cluster latency and jitter. Which EC2 placement strategy is the best fit?

Accepted Answer

Cluster placement group, because it places instances physically close together in one Availability Zone.. A cluster placement group is the best choice because it places all 12 EC2 instances in a single Availability Zone within the same high-bandwidth, low-latency logical segment of the network. This minimizes the physical distance and network hops between nodes, achieving the lowest possible intra-cluster latency and jitter required for the thousands of small messages exchanged per second.

Answer

Spread placement group, because it places each instance on distinct underlying hardware.

Answer

Partition placement group, because it isolates nodes across rack partitions.

Answer

Move the workload behind an Application Load Balancer so node-to-node traffic is balanced more efficiently.

Question 19

Based on the exhibit, the team wants to minimize compute cost for a workload with a steady 24/7 baseline and a separate nightly batch job that can be interrupted and resumed from checkpoints. They also expect to change EC2 instance families during the year as performance needs evolve. Which approach is the best fit?

Accepted Answer

Use a Compute Savings Plan to cover the steady baseline and run the nightly batch on Spot Instances.. A Compute Savings Plan covers any EC2 instance family (or even container/Fargate usage) at a discounted rate, making it ideal for the steady 24/7 baseline. The nightly batch job can be interrupted and resumed from checkpoints, which is a perfect use case for Spot Instances, offering up to 90% cost savings. This combination minimizes compute cost while maintaining flexibility to change instance families during the year.

Answer

Buy EC2 Instance Savings Plans for the baseline and run the nightly batch on On-Demand instances.

Answer

Purchase Standard Reserved Instances for all 12 instances and keep the current families fixed.

Answer

Run both tiers entirely on Spot Instances and rely on automatic restarts for the baseline web tier.

Question 20

An application uses Amazon Aurora MySQL. CloudWatch shows the writer instance near 85% CPU while the only reader instance averages 15% CPU. Trace logs show that all SELECT statements still target the writer endpoint. The workload is read-heavy, and the application already tolerates eventual consistency for reads. Which two changes will best increase total read throughput without a schema redesign? Select two.

Accepted Answer

Point read-only queries to the Aurora reader endpoint instead of the writer endpoint.. The Aurora reader endpoint is designed to distribute read-only connections across all available Aurora Replicas, offloading SELECT queries from the writer instance. Currently, all SELECT statements target the writer endpoint, causing the writer's CPU to be at 85% while the reader instance is underutilized at 15%. By redirecting read traffic to the reader endpoint, the writer's CPU load decreases, and the existing reader instance can handle more read throughput without any schema changes.

Answer

Convert the cluster to a single-AZ RDS MySQL instance to reduce replication overhead.

Answer

Replace the writer endpoint with the instance endpoint of the primary node to speed up SELECT queries.

Answer

Add Amazon ElastiCache and move all database writes into the cache layer.