SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Amazon CloudFront

  Why this is correct

  Amazon CloudFront is a global content delivery network (CDN) that caches static assets—such as images, CSS, and JavaScript—at edge locations geographically closer to end users. This reduces latency, offloads requests from the origin server, and improves the overall user experience for global audiences. CloudFront also integrates natively with S3, supports custom domains, SSL/TLS encryption, and allows you to set cache TTLs to control freshness, making it the definitive AWS service for efficient static content distribution.

• ✗

  AWS Direct Connect

  Why it's wrong here

  AWS Direct Connect establishes a dedicated, private network connection between an on-premises data center and AWS, offering predictable network performance and reduced bandwidth costs compared to internet-based connections. However, it is purely a transport/pathway service—it does not cache or replicate content at edge locations, nor does it accelerate public web content delivery to global users. Direct Connect would only benefit a specific private workload's connectivity, not static asset delivery for a globally distributed audience.

  When this WOULD be correct

  A company needs a consistent, low-latency connection between its on-premises data center and AWS for large data transfers or real-time applications, and the question specifies hybrid cloud connectivity requirements.

• ✗

  Amazon Route 53 health checks

  Why it's wrong here

  Amazon Route 53 health checks are used to monitor the availability and health of AWS and on-premises resources by periodically sending requests to an endpoint and verifying expected responses. They enable features like DNS failover to route traffic away from unhealthy endpoints, but they do not cache content, store files, or otherwise influence the performance of serving static images, CSS, or JavaScript. Their purpose is operational resilience, not content acceleration, so they are irrelevant to the stated requirement of improving latency and origin traffic.

  When this WOULD be correct

  A company has a multi-region application deployment and wants to automatically route users to healthy endpoints, failing over if an endpoint becomes unhealthy. In that scenario, Route 53 health checks combined with DNS failover would be the correct answer.

• ✗

  Amazon EFS

  Why it's wrong here

  Amazon EFS is a scalable, elastic, POSIX-compliant shared file storage service designed for use with EC2 instances and on-premises servers. While it can store static assets, it does not provide edge caching or any geographical distribution; serving files from EFS requires compute resources to retrieve and transmit data to users, and those files travel over the origin's network path. This does not solve the problem of reducing latency for global users or offloading origin traffic, which is precisely the capability CloudFront provides.

  When this WOULD be correct

  A question where a company needs a shared file system accessible by multiple EC2 instances for concurrent read/write operations, such as a web application's shared content or a data processing pipeline, with low-latency access within a region.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question