SAA-C03 Timed Practice Test 1 — 10 Questions

Question 1

Your public API is hosted in two regions. You want Route 53 to automatically send traffic to the secondary region when the primary region’s endpoint fails. The primary API health check is returning failure codes, but clients still reach the primary region for several minutes. Which Route 53 configuration most directly addresses this behavior?

10 minute time limit — choose an answer to begin.

Accepted Answer

Use Route 53 failover routing with a primary record and a secondary record, each associated with its own health check, so Route 53 answers with the healthy region.. Route 53 failover routing with health checks on both primary and secondary records ensures that when the primary health check fails, Route 53 stops returning the primary record's IP and instead returns the secondary record's IP. This directly addresses the observed behavior where clients still reach the primary region for several minutes—likely because the primary record's health check was not configured or associated, or a simple routing policy was used without health check integration, causing stale DNS responses to be served until TTL expires.

Answer

Use a single Alias A record with simple routing and a short TTL so Route 53 quickly changes the IP address.

Answer

Use weighted routing to send a small percentage of traffic to the secondary region, increasing it manually when the primary fails.

Answer

Use latency routing only, letting Route 53 choose the lowest-latency region at query time, without health checks.

Question 2

A team serves static content (JavaScript, CSS, images) from S3 through CloudFront. After a recent release, CloudFront reports a low cache hit ratio and the S3 origin receives a much higher request rate. The site still works, but billing shows higher origin and data transfer costs. Which change is most likely to improve cache hit ratio and reduce origin load?

Accepted Answer

Configure a CloudFront cache policy (or update HTTP cache-control headers) to increase TTLs for versioned static assets and enable compression for text assets.. Increasing TTLs for versioned static assets via a CloudFront cache policy or HTTP Cache-Control headers ensures that CloudFront caches these immutable objects for longer periods, reducing the number of requests forwarded to the S3 origin. Enabling compression for text assets reduces the data transferred from origin to edge, further lowering origin load and costs. This directly addresses the low cache hit ratio and high origin request rate described in the scenario.

Answer

Disable CloudFront access logging so fewer requests are recorded and billing decreases automatically.

Answer

Set the distribution’s origin to use S3 Transfer Acceleration to reduce the number of requests hitting S3.

Answer

Force CloudFront to forward query strings to the origin for all static content so the latest versions are always fetched.

Question 3

A media company stores finalized video masters in an Amazon S3 bucket in the us-east-1 Region. Compliance requires that the objects be recoverable if they are accidentally deleted or overwritten for at least 90 days, and that no user, including administrators, be able to permanently erase them during that period. Which S3 feature should the solutions architect enable?

Accepted Answer

S3 Object Lock in compliance mode with a retention period of 90 days on the bucket.. The requirement is legal-hold-style immutability that even administrators cannot override. S3 Object Lock in compliance mode enforces exactly that: protected object versions cannot be deleted or overwritten by any identity until the retention period lapses, and the retention cannot be shortened. Governance mode and replication both leave a path for privileged users to destroy the data.

Answer

S3 Versioning with a lifecycle rule that transitions noncurrent versions to S3 Glacier Deep Archive after 30 days.

Answer

S3 Object Lock in governance mode with a retention period of 90 days on the bucket.

Answer

S3 Cross-Region Replication to a bucket in another Region with versioning enabled on both buckets.

Question 4

A company serves private images stored in S3 through Amazon CloudFront. Only authenticated users should be able to access each image, and access should expire after 1 hour. Which CloudFront feature best meets this requirement?

Accepted Answer

Signed URLs or signed cookies with an expiration time of 1 hour. Signed URLs or signed cookies allow CloudFront to grant temporary access to private content by embedding authentication information (policy, signature, key pair ID) directly in the request. By setting an expiration time of 1 hour in the policy statement, access automatically becomes invalid after that period, meeting both the authentication and expiry requirements without exposing the S3 bucket publicly.

Answer

A WAF rule that blocks requests without valid JWTs, without using signed URLs

Answer

Turning on S3 bucket public access block, without any CloudFront viewer authentication

Answer

Enabling CloudFront geo restriction to allow only one country

Question 5

A global mobile game backend serves mostly static images and JavaScript files from an S3 origin. Users in distant countries report slow load times. What should improve performance most? The design must avoid adding custom operational scripts.

Accepted Answer

Amazon CloudFront distribution with the S3 bucket as origin. Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for users in distant countries by serving files from the nearest edge. Using the S3 bucket as the origin, CloudFront distributes the content globally without requiring any custom operational scripts, directly addressing the slow load times for static assets.

Answer

RDS read replicas

Answer

A larger S3 bucket

Answer

An EC2 Auto Scaling group in one Region

Question 6

A team runs an Amazon RDS for MySQL database in a single Availability Zone. They want automatic failover with minimal downtime if the primary database instance becomes unavailable. Automated backups are already enabled. Which configuration change best meets the requirement?

Accepted Answer

Enable RDS Multi-AZ so AWS maintains a standby in another Availability Zone for automatic failover.. Enabling Multi-AZ on Amazon RDS for MySQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary instance fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, minimizing downtime without manual intervention. This meets the requirement for automatic failover with minimal downtime.

Answer

Keep the deployment as single-AZ, but increase automated backup retention to 35 days.

Answer

Create a read replica in another Availability Zone, but keep Multi-AZ disabled.

Answer

Rely on restoring from the most recent manual snapshot after an outage.

Question 7

A web application for a healthcare document service is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy?

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that can be associated with an Application Load Balancer to filter and monitor HTTP/HTTPS requests. It includes managed rule sets specifically designed to block common web exploits like SQL injection and cross-site scripting (XSS) with minimal operational overhead, as AWS manages the rule updates.

Answer

Security groups on the application instances

Answer

Network ACLs on the public subnets

Answer

AWS Shield Advanced only

Question 8

A travel booking site uses EC2 instances behind an ALB. CPU is consistently high during peak traffic, and request latency rises. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Auto Scaling policy based on an appropriate CloudWatch metric. An Auto Scaling policy based on an appropriate CloudWatch metric (such as CPUUtilization or request latency) dynamically adds or removes EC2 instances to match demand. This managed AWS-native control directly addresses high CPU and rising latency during peak traffic by scaling out capacity, which is the preferred approach per the architecture review board's requirement for a managed solution.

Answer

A VPC endpoint for CloudWatch only

Answer

S3 Object Lock

Answer

Disable health checks

Question 9

A company needs an Amazon RDS database that automatically fails over to a standby when the primary DB instance becomes unavailable. Which approach best meets the requirement with minimal operational effort?

Accepted Answer

Deploy the DB as a Multi-AZ DB instance so AWS maintains a synchronous standby in another Availability Zone and performs automated failover.. Amazon RDS Multi-AZ automatically provisions and maintains a synchronous standby replica in a different Availability Zone. When the primary DB instance fails, AWS handles the automatic failover to the standby with zero manual intervention, meeting the requirement with minimal operational effort.

Answer

Keep the DB as a single-AZ instance and implement a manual process to promote a standby when needed.

Answer

Enable versioned backups only, and restore the database each time the primary instance becomes unavailable.

Answer

Replicate the database to another region and switch clients to the secondary region using manual DNS changes.

Question 10

A backend service uses an IAM role to read files from an S3 bucket. It must only read objects under s3://prod-reporting/incoming/ but currently receives AccessDenied (403) on GetObject for that prefix.

The role already has this statement:
- Action: s3:ListBucket
- Resource: arn:aws:s3:::prod-reporting

Which policy statement would most directly follow least privilege to allow only the required reads under the incoming prefix?

Accepted Answer

Allow reads with a prefix-scoped statement: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"].. It grants only the s3:GetObject permission on the specific prefix path arn:aws:s3:::prod-reporting/incoming/*, which directly allows reading objects under that prefix while adhering to least privilege. The existing s3:ListBucket permission already enables listing the bucket, so only the missing read action needs to be added.

Answer

Allow only listing and reading with a single statement: Action = ["s3:*"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"].

Answer

Allow all S3 reads at the account level: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::*"].

Answer

Allow bucket listing with a condition that forces the prefix: Action = ["s3:ListBucket"], Resource = ["arn:aws:s3:::prod-reporting"], Condition = {"StringLike": {"s3:prefix": "incoming/*"}}.