SAA-C03 Multiple Select — 60 Questions

Question 1

A startup runs two EC2-based workloads in the same AWS Region. Its customer-facing API is always on, and its nightly video transcoding fleet can restart jobs from checkpoints if an instance is interrupted. The finance team wants the lowest monthly compute cost without changing the application design. Which two actions should the team take? Select two.

Accepted Answer

Buy a Compute Savings Plan to cover the always-on API baseline usage.. Option B is correct because a Compute Savings Plan offers the lowest cost for steady-state workloads like the always-on API, providing up to 66% savings over On-Demand in exchange for a 1- or 3-year commitment. It applies to any EC2 instance family within a Region, making it flexible and cost-effective for the baseline usage. Option C is correct because Spot Instances can be up to 90% cheaper than On-Demand and are ideal for fault-tolerant workloads like the transcoding fleet, which can resume from checkpoints if interrupted.

Answer

Purchase an All Upfront Reserved Instance for the transcoding fleet only.

Answer

Increase the API instance size so CPU utilization stays below 30 percent.

Answer

Move the API tier to Dedicated Hosts to improve isolation and lower spend.

Question 2

A service in private subnets downloads product images from Amazon S3 and stores job state in DynamoDB. A NAT Gateway is currently the only route to AWS services, and the monthly bill is dominated by NAT data processing charges. Which two changes will most directly reduce that cost? Select two.

Accepted Answer

Create a gateway VPC endpoint for Amazon S3.. A is correct because a gateway VPC endpoint for Amazon S3 allows instances in private subnets to access S3 directly over the AWS network without traversing the internet or a NAT Gateway. This eliminates NAT data processing charges for S3 traffic, which is the dominant cost driver in this scenario.

Answer

Add an internet gateway and move the instances into public subnets.

Answer

Replace the NAT Gateway with a Site-to-Site VPN connection.

Answer

Create an interface endpoint for S3 instead of a gateway endpoint.

Question 3

A static site is hosted in Amazon S3 and delivered by CloudFront. After a frontend release, the same JavaScript bundles are fetched repeatedly from the origin. Logs show that requests include unneeded query strings and cookies, which prevent cache reuse. Which two changes should the team make to reduce origin traffic and cost? Select two.

Accepted Answer

Configure a CloudFront cache policy that forwards only the query strings, headers, and cookies the app actually needs.. Option A is correct because CloudFront cache policies allow you to explicitly control which query strings, headers, and cookies are forwarded to the origin. By forwarding only the parameters the application actually needs, you prevent cache keys from being polluted by unneeded values, which increases the cache hit ratio and reduces requests to the S3 origin. This directly addresses the problem of repeated fetches caused by extraneous query strings and cookies.

Answer

Increase the size of the S3 bucket.

Answer

Place an Application Load Balancer in front of S3.

Answer

Disable caching so clients always get the latest files.

Question 4

A service processes messages from an Amazon SQS queue. Sometimes the worker finishes the business logic but does not delete the message before the visibility timeout expires, so the message is delivered again. Which two changes improve resilience and reduce the impact of duplicate processing? Select two.

Accepted Answer

Make the message handler idempotent.. Option A is correct because making the message handler idempotent ensures that even if a message is processed multiple times (due to visibility timeout expiry), the business outcome remains the same. Idempotency is a key design pattern for resilient architectures when using at-least-once delivery systems like SQS. Option B is correct because setting the visibility timeout long enough for normal processing prevents premature redelivery, reducing the chance of duplicate processing in the first place.

Answer

Switch from SQS to Amazon SNS for reliable buffering.

Answer

Shorten the queue retention period so messages expire quickly.

Answer

Disable retries in the consumer application.

Question 5

A single EC2 instance hosts a low-latency database cache that writes a large random working set to block storage. The application needs sustained high IOPS and low latency, and the storage must remain attached to the instance while it runs. Which two design choices best meet the requirement? Select two.

Accepted Answer

Use an io2 Block Express EBS volume for the highest sustained IOPS and low-latency performance.. Option A is correct because io2 Block Express EBS volumes are designed for mission-critical workloads requiring sustained high IOPS and low latency. They offer up to 256,000 IOPS per volume with sub-millisecond latency, making them ideal for a low-latency database cache that writes a large random working set to block storage. The storage remains attached to the EC2 instance while it runs, meeting the requirement for persistent block-level storage.

Answer

Use an S3 bucket as the backing store because object storage scales automatically.

Answer

Choose a cold HDD-based volume so the cache has durable low-cost storage.

Answer

Use the root volume from a T-series instance because burst credits can absorb the write spikes.

Question 6

A serverless checkout API uses AWS Lambda behind API Gateway. Every weekday at 09:00 UTC, marketing triggers a predictable surge. The first few minutes after each surge show cold-start latency, but traffic volume is forecastable and the business wants stable p95 latency. Which two changes should the team implement? Select two.

Accepted Answer

Publish a Lambda version and attach provisioned concurrency to an alias that points to that version.. Provisioned concurrency keeps a specified number of Lambda execution environments initialized and ready to respond immediately, eliminating cold starts for predictable traffic patterns. By publishing a Lambda version and attaching provisioned concurrency to an alias pointing to that version, the team ensures that the surge at 09:00 UTC is handled without cold-start latency, stabilizing p95 latency.

Answer

Increase the Lambda timeout so the function has more time to initialize during the spike.

Answer

Double the memory size during the spike without changing the concurrency model.

Answer

Move the function into more Availability Zones so the platform can spread cold starts across regions.

Question 7

A workload runs in private subnets and must reach Amazon S3 and AWS Secrets Manager without using the internet or a NAT gateway. The team wants to keep the traffic on AWS private networking and avoid public IPs. Which two changes should the architect make? Select two.

Accepted Answer

Create an S3 gateway VPC endpoint and update the route tables for the private subnets.. Option A is correct because an S3 gateway VPC endpoint allows private subnet instances to access S3 via AWS's private network without needing internet access or a NAT gateway. The endpoint uses route table entries to direct S3 traffic through the gateway, which is a horizontally scaled, redundant component that does not require public IPs.

Answer

Place a NAT gateway in the public subnet so the private instances can reach AWS services.

Answer

Assign public IPv4 addresses to the instances and restrict them with security groups.

Answer

Use VPC peering to the AWS service endpoints instead of VPC endpoints.

Question 8

A studio keeps 4 PB of completed video projects in Amazon S3. Editors work on active projects for about 60 days, auditors occasionally review the same objects for several months, and legal policy requires retention for 7 years. Retrieval of very old files can take hours. Which three actions should the architect recommend? Select three.

Accepted Answer

Transition objects to S3 Standard-IA after 60 days.. Option A is correct because after 60 days of active editing, objects can be transitioned to S3 Standard-IA, which offers lower storage costs than S3 Standard while still providing low-latency retrieval for occasional access by auditors. This lifecycle policy optimizes cost without sacrificing availability for the review period.

Answer

Keep the files in S3 Standard indefinitely so retrieval is always fast.

Answer

Copy the files to a single EBS volume for lower per-GB cost.

Question 9

A web application uses an Amazon Aurora DB cluster for a read-heavy workload. The team wants to increase read throughput without changing the database schema or rewriting application data access patterns. Which two changes should they make? Select two.

Accepted Answer

Add Aurora Replicas to scale out read traffic across multiple database instances.. Adding Aurora Replicas (Option A) directly increases read throughput by distributing read-only queries across multiple database instances, which is ideal for a read-heavy workload. Sending read queries to the Aurora reader endpoint (Option B) ensures that these queries are load-balanced across all available replicas, offloading the writer instance and improving overall performance without requiring schema or application changes.

Answer

Point all queries to the writer endpoint so Aurora can balance reads and writes internally.

Answer

Enable Multi-AZ standby for the cluster to increase the number of read-only connections.

Answer

Move the database to a single larger instance class instead of adding replicas.

Question 10

A startup runs a 24/7 web tier on Amazon EC2 with a stable baseline of 8 instances and a nightly analytics batch job that can resume from checkpoints if interrupted. The company wants to minimize monthly compute cost without hurting the always-on web tier. Which two actions should it take? Select two.

Accepted Answer

Buy a Compute Savings Plan for the steady web tier baseline.. A Compute Savings Plan offers the largest discount (up to 66%) in exchange for a 1- or 3-year hourly spend commitment, and it automatically applies to any EC2 instance family, size, or region. For the stable 8-instance web tier that runs 24/7, this plan provides significant cost savings while maintaining full flexibility to change instance types or even move to containers or Lambda, without affecting the always-on requirement.

Answer

Buy Standard Reserved Instances only for the nightly analytics batch job.

Answer

Move the entire workload to On-Demand Instances for maximum flexibility.

Answer

Use Dedicated Hosts for the batch job so the fleet is isolated.

Question 11

A CI system runs on EC2 instances in private subnets and uploads build artifacts to an S3 bucket. The security team wants to eliminate NAT Gateway costs, force all uploads to use TLS, and require SSE-KMS with an approved customer managed key. Which three changes should be made? Select three.

Accepted Answer

Create an S3 gateway VPC endpoint and associate it with the private subnets' route tables.. Option A is correct because creating an S3 gateway VPC endpoint allows EC2 instances in private subnets to access S3 without traversing the internet, eliminating the need for a NAT Gateway and its associated costs. The endpoint uses AWS’s internal network, and associating it with the private subnets' route tables ensures traffic to S3 is routed through the endpoint.

Answer

Deploy a NAT Gateway in each Availability Zone and route artifact traffic through it.

Answer

Use the S3 static website endpoint because it automatically enforces HTTPS.

Question 12

A regional web application for a content publishing system must fail over automatically to a secondary Region if the primary endpoint becomes unhealthy. Which two services or features are required?

Accepted Answer

Route 53 failover routing with health checks. Route 53 failover routing with health checks (B) is required because it continuously monitors the health of the primary endpoint and automatically reroutes traffic to a secondary Region when the primary becomes unhealthy. This is achieved by configuring a primary and secondary failover record set in Route 53, where the health check is associated with the primary record. When the health check fails, Route 53 returns the secondary record's IP address, enabling automatic failover at the DNS level.

Answer

AWS Organizations service control policies

Answer

S3 Transfer Acceleration

Question 13

A claims workflow requires point-in-time recovery and accidental-delete protection for a DynamoDB table. Which two settings should the architect enable? The design must avoid adding custom operational scripts.

Accepted Answer

Point-in-time recovery. Point-in-time recovery (PITR) for DynamoDB enables continuous backups with 35-day granularity, allowing restoration to any second within that window. This directly satisfies the point-in-time recovery requirement without custom scripts, as it is a native AWS feature.

Answer

DAX

Answer

Global secondary indexes

Question 14

A web application runs on an Auto Scaling group behind an Application Load Balancer. The business wants the service to keep running if one Availability Zone goes down. Which two changes should you make? Select two.

Accepted Answer

Place the Auto Scaling group in subnets across at least two Availability Zones.. Option A is correct because placing the Auto Scaling group in subnets across at least two Availability Zones ensures that if one AZ fails, the Auto Scaling group can still launch instances in the remaining healthy AZ(s). This is a fundamental pattern for high availability, as the Auto Scaling group distributes instances across the specified subnets, and if an entire AZ becomes unavailable, instances in other AZs continue to serve traffic.

Answer

Increase the instance size so each server can handle more traffic alone.

Answer

Disable ALB health checks so instances stay registered longer.

Answer

Run the whole stack in one Availability Zone for simpler networking.

Question 15

A containerized service on Amazon ECS connects to a database with a password that must never be stored in plaintext or hardcoded in the image. The application reads the password at startup and occasionally reconnects later, so it needs to retrieve the current secret when needed. Which three actions should the architect take? Select three.

Accepted Answer

Store the database password in AWS Secrets Manager.. AWS Secrets Manager is the correct service for storing sensitive data like database passwords because it provides encryption at rest (using AWS KMS) and automatic rotation capabilities. By storing the password in Secrets Manager, the architect ensures it is never exposed in plaintext or hardcoded in the container image, meeting the security requirement.

Answer

Store the password in a plain environment variable and update it manually during maintenance windows.

Answer

Use an IAM user access key inside the container so the database password can be embedded in code.

Question 16

A distributed analytics engine runs 12 EC2 instances in one Availability Zone. The nodes exchange thousands of tiny messages per second and must keep jitter as low as possible. The current design launches the instances across multiple placement groups and uses general-purpose burstable instances. Which two changes will most directly lower east-west network latency and variability? Select two.

Accepted Answer

Move all instances into a cluster placement group.. A cluster placement group provides a low-latency, high-bandwidth network connection by placing instances in a single Availability Zone within the same logical rack or cluster. This minimizes the physical distance and network hops between instances, directly reducing east-west latency and jitter for the thousands of tiny messages per second.

Answer

Spread the instances across three Availability Zones for better fault tolerance.

Answer

Front the nodes with an Application Load Balancer to balance the internal messages.

Answer

Store the messages on EBS volumes so the nodes avoid network communication.

Question 17

A CPU-bound batch rendering service runs on EC2. The application is Linux-based, compatible with ARM64, and the team wants the best throughput per dollar without changing the workload's architecture. Which two instance-family choices should the team consider first? Select two.

Accepted Answer

A compute-optimized family, because it is designed for workloads that spend most of their time on CPU.. Option A is correct because compute-optimized families (e.g., C5, C6g) are designed for workloads that spend most of their time on CPU, such as batch rendering. Option B is correct because Graviton-based instances (e.g., C6g, M6g) use ARM64 architecture, which is compatible with the workload and often delivers better price-performance for compute-intensive tasks, maximizing throughput per dollar without architectural changes.

Answer

A memory-optimized family, because extra RAM always increases compute throughput.

Answer

A storage-optimized family, because local storage bandwidth is the main factor for rendering performance.

Answer

A burstable family, because CPU credits make sustained rendering faster during long runs.

Question 18

A customer portal uses Amazon Aurora MySQL. The application currently sends all SELECT queries to the writer instance endpoint. During traffic spikes, read latency increases, and the team wants the cluster to survive a writer failover without manual endpoint changes for the application. Which changes should the team make? Select three.

Accepted Answer

Replace the hard-coded DB instance endpoint with the Aurora reader endpoint for read traffic.. Option A is correct because the Aurora reader endpoint automatically distributes read-only connections across all available Aurora Replicas, including the writer instance if it is configured to accept reads. This eliminates the need for manual endpoint changes during a failover, as the reader endpoint remains constant while the underlying instances change.

Answer

Keep sending all traffic to the writer endpoint because it always has the freshest data.

Answer

Replace Aurora with a single larger RDS instance and continue using the same read pattern.

Question 19

A company runs a customer portal on self-managed PostgreSQL on EC2, plus a self-managed RabbitMQ cluster for asynchronous work that only requires durable queueing and does not depend on RabbitMQ-specific exchange features. The operations team spends a lot of time patching, backing up, and scaling both systems. The business wants to reduce infrastructure management overhead and total cost of ownership. Which two changes are the best fit? Select two.

Accepted Answer

Migrate PostgreSQL to Amazon RDS for PostgreSQL.. Option A is correct because migrating PostgreSQL to Amazon RDS for PostgreSQL offloads patching, backups, and scaling to AWS, reducing operational overhead. RDS automates OS and database patching, provides automated backups with point-in-time recovery, and supports vertical scaling with minimal downtime. This directly addresses the team's time spent on maintenance while lowering TCO compared to self-managed EC2.

Answer

Move PostgreSQL to Amazon DynamoDB without redesigning the application.

Answer

Replace RabbitMQ with another EC2-based broker cluster for more control.

Answer

Keep the same design and increase instance sizes to simplify maintenance.

Question 20

A developer accidentally corrupts part of a production Amazon RDS database, and the issue is discovered 45 minutes later. The team needs to restore the database to the state immediately before the change. Which two actions should be part of the recovery plan? Select two.

Accepted Answer

Enable automated backups with a retention period that covers the recovery window.. Option A is correct because automated backups must be enabled to allow point-in-time recovery (PITR) within the retention window. Since the corruption occurred 45 minutes ago, the retention period must cover at least that duration to restore to the state immediately before the change. Option B is correct because PITR restores the database to a specified time (down to the second) within the backup retention period, creating a new DB instance that reflects the state just before the corruption.

Answer

Convert the database to a single-AZ deployment for faster restores.

Answer

Delete the corrupted rows manually and continue without restoring.

Answer

Use a read replica as the only recovery source for all deletions.