SAA-C03 Practice Questions

Question 1

A company wants to ensure that its internal applications can access Amazon S3 without the traffic ever leaving the AWS network or passing through the public internet. What should they implement to achieve this securely?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and update the route tables.. A VPC Gateway Endpoint for Amazon S3 provides a private, logical connection between a VPC and S3 that keeps traffic on the AWS backbone and never traverses the public internet. Updating route tables to direct S3-bound traffic to the gateway endpoint ensures instances in private subnets reach S3 privately.

Answer

Configure a NAT Gateway in a public subnet to route S3 traffic.

Answer

Use an AWS Direct Connect connection between the VPC and S3.

Answer

Set up a VPN connection between the private subnet and the S3 service.

Question 2

A global e-commerce site uses an Amazon RDS for MySQL database. Users in different regions are complaining about slow page load times when browsing product catalogs. How can the architect improve read performance for global users with minimal changes to the application?

Accepted Answer

Create Read Replicas in different AWS Regions.. Cross-region read replicas allow you to serve read traffic from a location physically closer to your users, reducing latency. This architectural pattern is essential for high-performing global applications where the primary database is located in a single region but the user base is distributed worldwide.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Upgrade the RDS instance to a larger instance class.

Answer

Enable Enhanced Monitoring with a 1-second granularity.

Question 3

A research firm is running a tightly coupled High Performance Computing (HPC) workload on AWS using EC2 instances. The firm needs to minimize network latency and maximize inter-node communication speed. Which network enhancement should the architect recommend?

Accepted Answer

Deploy the instances using an Elastic Fabric Adapter (EFA).. Elastic Fabric Adapter (EFA) is a network interface for Amazon EC2 instances that enables customers to run applications requiring high levels of inter-node communications at scale. It uses a custom protocol to provide lower and more consistent latency than traditional TCP/IP stacks used in standard networking.

Answer

Enable Enhanced Networking with the Elastic Network Adapter (ENA).

Answer

Use a Spread Placement Group for the EC2 instances.

Answer

Implement AWS Global Accelerator for the cluster.

Question 4

A company is hosting a web application on EC2 instances behind an Application Load Balancer. The security team requires that all data in transit between the client and the ALB be encrypted using TLS. Which service should the architect use to manage the SSL/TLS certificates for the ALB?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the managed service designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services like Application Load Balancers, CloudFront, and API Gateway. ACM handles certificate renewal automatically and integrates natively with ALB listeners, making it the correct choice for managing TLS certificates for the ALB.

Answer

AWS Secrets Manager

Answer

AWS Key Management Service (KMS)

Answer

IAM Server Certificate Upload

Question 5

A developer needs to access an Amazon RDS database from an EC2 instance within a private subnet. The database must only accept traffic from the instance. Which security configuration is most appropriate?

Accepted Answer

Configure the RDS security group to allow inbound traffic from the EC2 instance security group ID.. Configuring the RDS Security Group to allow inbound traffic on the database port exclusively from the security group ID associated with the EC2 instance follows the principle of least privilege. This stateful configuration ensures that only authorized resources can communicate with the database, significantly reducing the attack surface. By referencing the security group ID instead of an IP address, the architecture remains resilient to dynamic IP changes.

Answer

Configure the RDS security group to allow inbound traffic from 0.0.0.0/0 on the database port.

Answer

Configure the RDS security group to allow inbound traffic from the database's own IP address.

Answer

Configure the RDS security group to allow inbound traffic from the private IP of the EC2 instance.

Question 6

A company is hosting a multi-tier web application on AWS using Amazon EC2 instances in a private subnet behind an Application Load Balancer (ALB). The security team requires that all incoming web traffic is encrypted in transit from the client to the ALB and from the ALB to the backend EC2 instances. Which combination of configurations meets these requirements?

Accepted Answer

Configure an HTTPS listener on the ALB using an ACM certificate and configure the backend instances to accept HTTPS traffic.. To encrypt traffic from client to ALB, an HTTPS listener with an ACM certificate is required. To encrypt traffic from ALB to backend EC2 instances, the backend must accept HTTPS (TLS) traffic, which means the ALB target group protocol must be HTTPS and the instances must have certificates installed and be listening on the HTTPS port. Option C is the only one that satisfies both requirements.

Answer

Configure an HTTP listener on the ALB and configure the backend instances to accept HTTP traffic on port 80.

Answer

Configure an HTTPS listener on the ALB and route traffic to the backend instances using HTTP on port 80.

Answer

Configure a TCP listener on the ALB and install self-signed certificates directly on the target EC2 instances.

Question 7

A company has several VPCs in the same region that need to access an Amazon S3 bucket for data logging. Currently, data is transferred over the public internet, incurring data transfer charges. What is the most cost-effective way to allow the VPCs to access S3?

Accepted Answer

Create an S3 Gateway Endpoint in each VPC.. S3 Gateway Endpoints are the most cost-effective solution because they are provided at no additional cost and do not incur hourly charges or data processing fees. They allow traffic to stay within the AWS network, eliminating data transfer out charges to the public internet while maintaining high security and performance.

Answer

Deploy a NAT Gateway in each VPC.

Answer

Create an S3 Interface Endpoint (PrivateLink) in each VPC.

Answer

Establish a AWS Direct Connect connection to S3.

Question 8

A solutions architect is designing a batch processing workload that runs for 4 hours every night. The workload can be interrupted and resumed without data loss. Cost optimization is a primary requirement for this deployment.

Accepted Answer

Configure an Auto Scaling group using Amazon EC2 Spot Instances with an appropriate instance diversification strategy.. Spot Instances offer up to 90% discount compared to On-Demand and are ideal for interruptible, resumable batch workloads. Using an Auto Scaling group with instance diversification across multiple instance types and Availability Zones increases the chance of acquiring and retaining Spot capacity, and the workload can tolerate interruptions without data loss. This directly satisfies the cost optimization requirement while maintaining availability.

Answer

Use Amazon EC2 Reserved Instances to cover the nightly batch processing requirements over a one-year term.

Answer

Provision Amazon EC2 On-Demand Instances and terminate them manually through an AWS Lambda script after completion.

Answer

Purchase Amazon EC2 Dedicated Hosts to run the nightly batch processing instances securely and predictably.

Question 9

An application running on Amazon Aurora MySQL experiences significant performance degradation during peak hours due to a surge in read-only traffic. The database currently uses a single primary instance and one replica. What is the most effective way to scale the database for these spikes while maintaining high performance?

Accepted Answer

Configure Aurora Auto Scaling for the Aurora Replicas.. Aurora Auto Scaling automatically adds and removes Aurora Replicas based on metrics like CPU utilization or the number of connections, scaling read capacity in response to demand spikes without manual intervention. This is the most effective solution because it handles peak-hour surges dynamically while maintaining high availability across Availability Zones. Manual scaling (Option A) is reactive and slow, and vertical scaling of the primary (Option C) does not address read traffic distribution.

Answer

Manually add more Aurora Replicas during peak hours.

Answer

Increase the instance size of the primary Aurora instance.

Answer

Use Amazon SQS to buffer incoming read requests.

Question 10

A security engineer needs to block a specific range of malicious IP addresses from accessing an entire subnet within a VPC. The solution must ensure that the traffic is rejected before it reaches any EC2 instances. Which AWS feature should be used to implement this restriction?

Accepted Answer

Network Access Control Lists (NACLs). Network ACLs are stateless, subnet-level firewalls that evaluate traffic before it reaches any EC2 instance, making them the correct tool to block a malicious IP range at the subnet boundary. Because NACLs support explicit deny rules with CIDR ranges, they can reject the traffic before it hits the instances.

Answer

Security Groups

Answer

AWS WAF

Answer

AWS Shield Standard

Question 11

A database administrator needs to ensure that an Amazon RDS for MySQL instance can withstand an Availability Zone failure and provide low-latency reads for a reporting application. Which TWO steps should be taken?

Accepted Answer

Enable Multi-AZ deployment for the RDS instance.. Enabling Multi-AZ provides the high availability needed to survive an AZ failure by maintaining a synchronous standby. Creating a Read Replica in a different AZ offloads read traffic from the primary instance, improving performance for the reporting application while also providing an additional layer of data redundancy across the region.

Answer

Use EBS Snapshots to back up the database every 5 minutes.

Answer

Enable Enhanced Monitoring with a 1-second granularity.

Answer

Implement a Network Load Balancer in front of the RDS instance.

Question 12

A global gaming company wants to reduce latency for its players who are distributed worldwide. The application uses UDP-based traffic and requires a static entry point to simplify firewall management. Which service should the architect recommend to optimize the network path?

Accepted Answer

AWS Global Accelerator.. AWS Global Accelerator uses the AWS global network to route traffic to the optimal regional endpoint based on health and proximity. Unlike CloudFront, which is primarily for HTTP/S content, Global Accelerator supports non-HTTP protocols like UDP. It provides static IP addresses that act as a fixed entry point, improving performance by keeping traffic on the AWS backbone.

Answer

Amazon CloudFront.

Answer

Amazon Route 53 with Geolocation routing.

Answer

AWS Direct Connect.

Question 13

A global e-commerce enterprise runs its checkout workflow using AWS Lambda functions integrated with Amazon API Gateway. During flash sales, traffic spikes cause downstream payment APIs to timeout, leading to lost transactions and frustrated customers. The solutions architect needs to redesign the architecture to decouple the frontend from the payment processor and ensure no transaction requests are lost. What should the architect do?

Accepted Answer

Integrate an Amazon SQS FIFO queue between API Gateway and the downstream payment processing Lambda functions.. Integrating an Amazon SQS FIFO queue between API Gateway and the payment Lambda decouples the frontend from the downstream payment processor, buffering requests during traffic spikes so no transaction is lost. FIFO queues preserve order and provide exactly-once processing, which is critical for payment transactions. The Lambda functions can then poll the queue at a controlled rate, preventing downstream timeouts.

Answer

Configure API Gateway to cache responses using an Amazon ElastiCache Redis cluster deployed in multi-AZ mode.

Answer

Increase the timeout and memory allocation of the API Gateway integration and the AWS Lambda functions.

Answer

Use AWS Step Functions with standard workflows to execute the payment processing steps sequentially.

Question 14

A company is concerned that its database credentials, currently stored as environment variables in AWS Lambda, are not being rotated regularly. Which AWS service should the company use to securely store and automatically rotate these credentials?

Accepted Answer

AWS Secrets Manager with its built-in rotation feature for Amazon RDS.. AWS Secrets Manager is purpose-built for storing secrets and provides native, automatic rotation using Lambda rotation functions, including built-in templates for Amazon RDS, Aurora, Redshift, and DocumentDB credentials. It integrates with RDS so the database password and the secret are rotated together without application downtime. This directly satisfies the requirement to store credentials securely and rotate them automatically.

Answer

AWS Systems Manager Parameter Store with SecureString parameters.

Answer

AWS Key Management Service (KMS) to encrypt the environment variables.

Answer

AWS Identity and Access Management (IAM) roles for the Lambda function.

Question 15

A large corporation uses AWS Organizations to manage hundreds of accounts. The security team wants to ensure that no account can provision resources in unauthorized regions and that only approved AWS services can be used. Which TWO features should be used to enforce these constraints across the entire organization? (Select TWO.)

Accepted Answer

Service Control Policies (SCPs) applied to the root of the Organization.. Option B is correct because Service Control Policies (SCPs) applied at the organization root set the maximum available permissions for all accounts in the organization, so they can centrally deny access to unapproved AWS services across every member account. Option E is correct because an SCP with a Condition element using the aws:RequestedRegion global condition key can explicitly deny API calls made to regions outside the approved list, enforcing the region restriction organization-wide. Together, SCPs at the root and region-based conditions satisfy both requirements: restricting services and restricting regions for all accounts. Option A is not appropriate because IAM policies in each member account are decentralized, must be maintained per account, and do not act as a guardrail against account administrators granting themselves broader permissions. Option C is incorrect because AWS Resource Access Manager (RAM) shares resources such as subnets or Transit Gateways between accounts; it does not restrict which services or regions can be used. Option D is incorrect because AWS Config rules detect and can remediate noncompliant resources after creation, but they do not prevent provisioning in unauthorized regions the way an SCP deny does.

Answer

IAM Policies attached to each administrative user in every member account.

Answer

AWS Resource Access Manager (RAM) to share authorized services across accounts.

Answer

AWS Config rules to automatically terminate resources in unauthorized regions.

AWS Certified Solutions Architect - Associate SAA-C03 practice test

Three ways to study

Study SAA-C03 by domain

Study SAA-C03 by topic

Design Secure Architectures practice questions

Design Cost-Optimized Architectures practice questions

Design Resilient Architectures practice questions

Design High-Performing Architectures practice questions

SAA-C03 VPC practice questions

SAA-C03 S3 lifecycle policy questions

SAA-C03 RDS Multi-AZ questions

SAA-C03 IAM policy practice questions

SAA-C03 Route 53 failover questions

SAA-C03 CloudFront practice questions

SAA-C03 NAT gateway questions

SAA-C03 VPC endpoint questions

AWS Certified Solutions Architect - Associate practice questions