SAA-C03 Multiple Select — 30 Questions

Question 1

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Interface VPC endpoint for Systems Manager. Option A is correct because an Interface VPC endpoint (powered by AWS PrivateLink) for Systems Manager creates elastic network interfaces in the private subnets with private IP addresses, allowing the instances to call the ssmmessages, ec2messages, and ssm endpoints privately without traversing the public internet. Option D is correct because a Gateway VPC endpoint for Amazon S3 adds a route-table target that lets traffic to S3 stay on the AWS private network, so the private application can download objects without an internet or NAT path. Together these two endpoints satisfy the requirement to reach both S3 and Parameter Store privately and require no custom operational scripts. Option B is not appropriate because an Internet gateway provides public internet connectivity and would expose or require public routing, which the scenario explicitly forbids. Option C is not appropriate because a NAT gateway enables outbound internet access (and incurs cost per AZ) rather than keeping traffic private, so it does not meet the no-public-internet requirement.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 2

A internal reporting portal has old unattached EBS volumes and many stale snapshots. Which two actions reduce storage cost without affecting running instances? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Delete unattached EBS volumes after verifying they are no longer needed. Unattached EBS volumes incur storage costs without providing any benefit to running instances. Deleting them after verification directly reduces costs while having zero impact on running workloads. Option D is correct because snapshot lifecycle policies automate the deletion of obsolete snapshots based on age or count, eliminating manual cleanup and reducing storage costs without affecting running instances.

Answer

Disable CloudTrail logging

Answer

Stop all EC2 instances in the account

Question 3

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) for Systems Manager allow EC2 instances in private subnets to access Parameter Store without traversing the internet. Gateway VPC endpoints for S3 provide a highly available, managed route to S3 via the VPC route table, requiring no NAT or internet gateway. Both are AWS-native, managed services that meet the architecture review board's preference.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 4

A reporting application in Account B must read files from an S3 bucket in Account A. The bucket contains objects encrypted with a customer managed KMS key in Account A. The application role in Account B already has an identity policy allowing s3:GetObject on the bucket prefix, but requests still fail with AccessDenied. Which two changes are required for the application to read the objects? Select two.

Accepted Answer

Add a bucket policy in Account A that allows the Account B role to perform s3:GetObject on the required prefix.. Cross-account S3 access requires the destination account (Account A) to explicitly grant access via a bucket policy that allows the source account's role (Account B) to perform s3:GetObject on the specified prefix. Without this bucket policy, the S3 service in Account A will deny the request, even if the IAM identity policy in Account B permits the action. Option B is correct because the objects are encrypted with a customer managed KMS key in Account A; the application role in Account B must be added to the KMS key policy with kms:Decrypt permission to decrypt the objects during retrieval. Both the S3 bucket policy and the KMS key policy are required for cross-account encrypted access.

Answer

Attach an IAM policy in Account B that grants s3:* on the bucket and its objects.

Answer

Create an S3 gateway endpoint in Account B so the application can reach the bucket privately.

Answer

Add an SCP in Account A that allows the Account B role to bypass KMS encryption checks.

Question 5

A payments API requires point-in-time recovery and accidental-delete protection for a DynamoDB table. Which two settings should the architect enable? The design must avoid adding custom operational scripts.

Accepted Answer

Deletion protection or tightly controlled delete permissions. Deletion protection (option A) prevents accidental deletion of the DynamoDB table itself, which is critical for the accidental-delete protection requirement. Point-in-time recovery (option B) enables restoring the table to any point within the last 35 days, satisfying the point-in-time recovery requirement. Both features are native DynamoDB capabilities that require no custom scripts.

Answer

Global secondary indexes

Answer

DAX

Question 6

A service processes messages from an Amazon SQS queue. Sometimes the worker finishes the business logic but does not delete the message before the visibility timeout expires, so the message is delivered again. Which two changes improve resilience and reduce the impact of duplicate processing? Select two.

Accepted Answer

Make the message handler idempotent.. Making the message handler idempotent ensures that even if a message is processed multiple times (due to visibility timeout expiry), the business outcome remains the same. Idempotency is a key design pattern for resilient architectures when using at-least-once delivery systems like SQS. Option B is correct because setting the visibility timeout long enough for normal processing prevents premature redelivery, reducing the chance of duplicate processing in the first place.

Answer

Switch from SQS to Amazon SNS for reliable buffering.

Answer

Shorten the queue retention period so messages expire quickly.

Answer

Disable retries in the consumer application.

Question 7

A log archive has old unattached EBS volumes and many stale snapshots. Which two actions reduce storage cost without affecting running instances? The design must avoid adding custom operational scripts.

Accepted Answer

Delete unattached EBS volumes after verifying they are no longer needed. Deleting unattached EBS volumes eliminates storage costs for volumes that are not in use, and since they are not attached to any running instance, this action does not affect running instances. Option D is correct because applying snapshot lifecycle policies automates the deletion of obsolete snapshots, reducing storage costs without requiring custom scripts or impacting running instances.

Answer

Stop all EC2 instances in the account

Answer

Disable CloudTrail logging

Question 8

A log archive has old unattached EBS volumes and many stale snapshots. Which two actions reduce storage cost without affecting running instances? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Delete unattached EBS volumes after verifying they are no longer needed. Deleting unattached EBS volumes eliminates storage costs for volumes that are not in use, and since they are not attached to any running instance, this action does not affect running instances. Option D is correct because applying snapshot lifecycle policies (e.g., using Amazon Data Lifecycle Manager) automates the expiration of obsolete snapshots, reducing storage costs without impacting running instances. Both actions are managed AWS-native controls, aligning with the architecture review board's preference.

Answer

Stop all EC2 instances in the account

Answer

Disable CloudTrail logging

Question 9

A regional web application for a content publishing system must fail over automatically to a secondary Region if the primary endpoint becomes unhealthy. Which two services or features are required? The design must avoid adding custom operational scripts.

Accepted Answer

Route 53 failover routing with health checks. Option B is correct because Route 53 failover routing with health checks automatically redirects DNS queries to the secondary endpoint when the primary health check is deemed unhealthy, providing the required automatic failover without custom scripts. Option D is correct because a deployed standby application stack in the secondary Region is necessary to actually serve traffic after failover; DNS redirection alone cannot run the application. Option A is incorrect because AWS Organizations service control policies govern permissions and guardrails, not traffic failover or health-based routing. Option C is incorrect because S3 Transfer Acceleration only speeds up uploads to S3 buckets and does not provide regional failover or health checking.

Answer

AWS Organizations service control policies

Answer

S3 Transfer Acceleration

Question 10

A workload runs in private subnets and must reach Amazon S3 and AWS Secrets Manager without using the internet or a NAT gateway. The team wants to keep the traffic on AWS private networking and avoid public IPs. Which two changes should the architect make? Select two.

Accepted Answer

Create an S3 gateway VPC endpoint and update the route tables for the private subnets.. Option A is correct because an S3 gateway VPC endpoint provides private access to Amazon S3 by adding a prefix-list route to the private subnet route tables, so traffic to S3 stays on the AWS network without internet or NAT. Option C is correct because AWS Secrets Manager is accessed through an interface VPC endpoint (AWS PrivateLink), which creates an elastic network interface in the subnet and requires the workload's security group to allow outbound/inbound access to that endpoint on port 443. Option B is wrong because a NAT gateway still routes traffic through the internet and requires a public subnet, which the scenario explicitly excludes. Option D is wrong because assigning public IPv4 addresses exposes the instances to the internet and does not provide private AWS service access. Option E is wrong because VPC peering connects VPCs, not AWS service endpoints, and cannot be used to reach S3 or Secrets Manager privately.

Answer

Place a NAT gateway in the public subnet so the private instances can reach AWS services.

Answer

Assign public IPv4 addresses to the instances and restrict them with security groups.

Answer

Use VPC peering to the AWS service endpoints instead of VPC endpoints.

Question 11

A company is designing a secure architecture for a three-tier web application on AWS. The application runs on Amazon EC2 instances in private subnets, uses an Amazon RDS for MySQL database in private subnets, and is accessed by users over the internet through an Application Load Balancer. The security team requires that the database credentials be stored securely and rotated automatically, and that EC2 instances retrieve credentials without hardcoding them. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Attach an IAM role to the EC2 instances that grants permission to retrieve the secret from AWS Secrets Manager.. AWS Secrets Manager stores and automatically rotates database credentials using a Lambda rotation function. An IAM role attached to the EC2 instances grants permission to retrieve the secret, eliminating hardcoded credentials. Together, these meet the requirements for secure storage, automatic rotation, and secure retrieval. Other options either lack rotation, are not designed for secrets, or require manual intervention.

Answer

Use AWS Systems Manager Parameter Store with SecureString parameters and manually update the credentials every 90 days.

Answer

Store the database credentials in an encrypted Amazon S3 object and grant the EC2 instance role access to read the object.

Answer

Embed the database credentials in the EC2 user data script and encrypt the script with AWS KMS.

Question 12

A retailer runs a reporting-heavy relational app on Amazon RDS MySQL. Peak dashboard traffic lasts only three hours each day, but the database is sized for the peak all day. The business wants lower cost without rewriting the application. Which three actions are best? Select three.

Accepted Answer

Right-size the writer based on actual utilization instead of peak guesses.. Option A is correct because right-sizing the writer instance to match actual CPU, memory, and IOPS utilization rather than peak-day guesses directly reduces the largest cost component of an RDS MySQL deployment without changing the application. Option B is correct because adding read replicas and routing dashboard (read-only) queries to them offloads the writer, letting the writer be smaller and cheaper while still serving peak reporting traffic. Option C is correct because evaluating Aurora MySQL is a valid cost-optimization step: Aurora's distributed storage and replica model can be cheaper for replica-heavy read workloads, and it remains MySQL-compatible so no application rewrite is needed. Option D is wrong because DynamoDB is a NoSQL service that would require rewriting the relational application, which the business explicitly wants to avoid. Option E is wrong because permanently increasing provisioned IOPS raises, not lowers, the monthly bill.

Answer

Migrate to DynamoDB immediately because every relational workload is more expensive.

Answer

Increase provisioned IOPS permanently so the monthly bill drops.

Question 13

A developer accidentally corrupts part of a production Amazon RDS database, and the issue is discovered 45 minutes later. The team needs to restore the database to the state immediately before the change. Which two actions should be part of the recovery plan? Select two.

Accepted Answer

Enable automated backups with a retention period that covers the recovery window.. Automated backups must be enabled to allow point-in-time recovery (PITR) within the retention window. Since the corruption occurred 45 minutes ago, the retention period must cover at least that duration to restore to the state immediately before the change. Option B is correct because PITR restores the database to a specified time (down to the second) within the backup retention period, creating a new DB instance that reflects the state just before the corruption.

Answer

Convert the database to a single-AZ deployment for faster restores.

Answer

Delete the corrupted rows manually and continue without restoring.

Answer

Use a read replica as the only recovery source for all deletions.

Question 14

A media company serves versioned JavaScript and CSS files from Amazon S3 through CloudFront. After each release, the cache hit ratio drops sharply because the same distribution also fronts a personalized API path, and the current cache policy forwards cookies, all query strings, and several headers to every origin request. The static assets already use content-hashed filenames. Which two changes will most directly improve cache hit ratio for the static assets without changing the application behavior? Select two.

Accepted Answer

Create a dedicated cache behavior for the static asset path that excludes cookies, query strings, and unneeded headers from the cache key.. Creating a dedicated cache behavior for the static asset path (e.g., /static/*) allows you to configure a cache policy that excludes cookies, query strings, and unneeded headers from the cache key. Since the static assets use content-hashed filenames, they are immutable and do not vary by user-specific attributes. By removing these variables from the cache key, CloudFront can serve the same cached object to all users, drastically improving the cache hit ratio.

Answer

Increase the size of the S3 bucket’s underlying storage to absorb more origin traffic.

Answer

Add Lambda@Edge logic to append a timestamp to every asset request so updates are always fetched immediately.

Answer

Disable compression so CloudFront can treat each object as a separate cache entry.

Question 15

A startup runs a 24/7 web tier on Amazon EC2 with a stable baseline of 8 instances and a nightly analytics batch job that can resume from checkpoints if interrupted. The company wants to minimize monthly compute cost without hurting the always-on web tier. Which two actions should it take? Select two.

Accepted Answer

Buy a Compute Savings Plan for the steady web tier baseline.. A Compute Savings Plan offers the largest discount (up to 66%) in exchange for a 1- or 3-year hourly spend commitment, and it automatically applies to any EC2 instance family, size, or region. For the stable 8-instance web tier that runs 24/7, this plan provides significant cost savings while maintaining full flexibility to change instance types or even move to containers or Lambda, without affecting the always-on requirement.

Answer

Buy Standard Reserved Instances only for the nightly analytics batch job.

Answer

Move the entire workload to On-Demand Instances for maximum flexibility.

Answer

Use Dedicated Hosts for the batch job so the fleet is isolated.

Question 16

An order-processing worker consumes messages from Amazon SQS. Occasionally, the worker times out after successfully creating a payment record but before deleting the message, which causes duplicate charges during retries. Some messages also fail validation repeatedly because required fields are missing. Which two changes should the team make? Select two.

Accepted Answer

Make the payment step idempotent using a unique transaction identifier.. Making the payment step idempotent using a unique transaction identifier ensures that if the same message is processed multiple times due to a timeout, the payment is only charged once. This is a common pattern for handling at-least-once delivery semantics in Amazon SQS, where the worker must be designed to handle duplicate messages safely.

Answer

Reduce the visibility timeout so failed messages return to the queue faster.

Answer

Run only one long-lived worker instance so the queue can never be processed twice.

Answer

Switch from a standard queue to a FIFO queue and remove all other changes.

Question 17

An application uses Amazon Aurora MySQL. CloudWatch shows the writer instance near 85% CPU while the only reader instance averages 15% CPU. Trace logs show that all SELECT statements still target the writer endpoint. The workload is read-heavy, and the application already tolerates eventual consistency for reads. Which two changes will best increase total read throughput without a schema redesign? Select two.

Accepted Answer

Point read-only queries to the Aurora reader endpoint instead of the writer endpoint.. The Aurora reader endpoint is designed to distribute read-only connections across all available Aurora Replicas, offloading SELECT queries from the writer instance. Currently, all SELECT statements target the writer endpoint, causing the writer's CPU to be at 85% while the reader instance is underutilized at 15%. By redirecting read traffic to the reader endpoint, the writer's CPU load decreases, and the existing reader instance can handle more read throughput without any schema changes.

Answer

Convert the cluster to a single-AZ RDS MySQL instance to reduce replication overhead.

Answer

Replace the writer endpoint with the instance endpoint of the primary node to speed up SELECT queries.

Answer

Add Amazon ElastiCache and move all database writes into the cache layer.

Question 18

A production Amazon RDS database already has automated backups enabled. At 10:45 UTC, the team discovers that a faulty migration corrupted rows in a table at 10:30 UTC. The business wants the database restored to exactly the state it had at 10:30 UTC with minimal risk. Which two actions should the team take? Select two.

Accepted Answer

Restore the database to a new instance using point-in-time restore for 10:30 UTC.. Amazon RDS Point-in-Time Restore (PITR) allows you to restore a DB instance to any second within the backup retention period, including 10:30 UTC. This uses automated backups and transaction logs to reconstruct the exact database state at that specific time, providing a precise recovery point with minimal data loss.

Answer

Restore the most recent manual snapshot because it will include the 10:30 UTC state.

Answer

Overwrite the existing database instance in place so the application keeps the same storage volume.

Answer

Wait for automated backups to complete again, then replay the migration to restore the missing rows.

Question 19

A CPU-bound batch rendering service runs on EC2. The application is Linux-based, compatible with ARM64, and the team wants the best throughput per dollar without changing the workload's architecture. Which two instance-family choices should the team consider first? Select two.

Accepted Answer

A compute-optimized family, because it is designed for workloads that spend most of their time on CPU.. Compute-optimized families (e.g., C5, C6g) are designed for workloads that spend most of their time on CPU, such as batch rendering. Option B is correct because Graviton-based instances (e.g., C6g, M6g) use ARM64 architecture, which is compatible with the workload and often delivers better price-performance for compute-intensive tasks, maximizing throughput per dollar without architectural changes.

Answer

A memory-optimized family, because extra RAM always increases compute throughput.

Answer

A storage-optimized family, because local storage bandwidth is the main factor for rendering performance.

Answer

A burstable family, because CPU credits make sustained rendering faster during long runs.

Question 20

A logistics company runs an order-tracking service on Amazon EC2 instances that write state to an Amazon DynamoDB table. A recent incident showed that a single Availability Zone failure caused the service to lose capacity, and the team also discovered that a developer accidentally deleted a production table. The architect must improve both Availability Zone resilience and protection against accidental table deletion. (Choose two.)

Accepted Answer

Enable DynamoDB point-in-time recovery on the table and attach a resource-based policy that denies the dynamodb:DeleteTable action to non-administrative principals.. Zone resilience for the compute tier comes from running instances across multiple Availability Zones behind a load balancer, so a single zone loss does not remove all capacity. Accidental table deletion is mitigated by enabling point-in-time recovery, which allows restore to a recent point in time, and by restricting who holds the delete-table permission so the mistake is far less likely to recur.

Answer

Create a DynamoDB global secondary index on the partition key used by the tracking queries and project all attributes into the index.

Answer

Enable DynamoDB Streams on the table and write a consumer that copies every change into an Amazon S3 bucket for long-term retention.

Answer

Convert the DynamoDB table to use provisioned capacity mode with auto scaling so that read and write capacity automatically adjusts during traffic spikes.