SAA-C03 (SAA-C03) — Questions 1–75

The issue is that the Web ACL is not evaluating requests at all, which indicates a missing association between the Web ACL and the ALB. Adding a security group rule to drop traffic from attacker IPs does not address the root cause—the Web ACL is not in the evaluation path—and security groups operate at the instance level, not at the ALB level for WAF inspection.

Stickiness (session affinity) ensures requests from the same client are sent to the same target, but it does not cause WAF to evaluate requests. The issue is that the Web ACL is not associated with the ALB, so WAF never inspects traffic regardless of stickiness.

AWS Shield Advanced does not automatically apply rate limiting; it provides DDoS protection but does not replace the need to associate a Web ACL for WAF rate-based rules. The Web ACL must be explicitly associated with a resource like an ALB to evaluate requests.

This option would be correct in a scenario where the Web ACL is already properly associated and evaluating traffic, but attackers are still reaching the backend because the WAF rate-based rule is not effectively blocking them. In that case, adding a security group rule to drop traffic from known attacker IPs at the instance ENIs would provide an additional layer of defense.

A question where clients report intermittent failures or inconsistent behavior from a backend that maintains state, and the solution must ensure all requests from a client go to the same target. For example: 'Users are randomly logged out when using a stateful web application behind an ALB. Which configuration ensures session persistence?'

If the question described a scenario where the goal is to protect against large-scale DDoS attacks that overwhelm infrastructure, and the requirement is to get enhanced DDoS mitigation and cost protection, then enabling AWS Shield Advanced would be correct, even without a Web ACL for rate limiting.

Candidates may think that blocking attacker IPs at the instance level is a quick fix to stop abusive traffic, overlooking that the primary issue is the Web ACL not being associated with the ALB. They might also confuse the roles of security groups and WAF in traffic filtering.

Candidates may confuse rate-based rules (which count requests per IP) with stickiness, thinking that binding a client to one target helps WAF count requests accurately. However, WAF counts at the ALB level, not per target.

Candidates may think Shield Advanced includes all WAF capabilities automatically, or that it can substitute for a Web ACL, due to its name implying comprehensive protection.

Increasing the deregistration delay only keeps existing connections alive longer; it does not speed up the bootstrapping of new instances, so it does not reduce the time until additional capacity is available.

Reducing the minimum size to one instance does not address the bootstrapping delay; it only lowers the baseline capacity, potentially worsening performance during traffic spikes.

Replacing the ALB with a Network Load Balancer does not address the bootstrapping delay of EC2 instances; NLB operates at layer 4 and does not affect instance initialization time.

This option would be correct in a scenario where the question asks how to prevent in-flight requests from being dropped during a scale-in event, such as when instances are being terminated and you need to ensure graceful connection draining.

If the question were about minimizing costs for a predictable, low-traffic application where over-provisioning is unnecessary, reducing the minimum size to one instance would be correct.

In a scenario where the application requires ultra-low latency and high throughput for TCP/UDP traffic, and the bootstrapping delay is not a concern, replacing an ALB with an NLB would be correct to reduce latency and handle millions of requests per second.

Candidates may confuse the deregistration delay with a mechanism that helps new instances become ready faster, or they might think it gives more time for bootstrapping to complete before traffic is sent.

Candidates may think that a smaller minimum size forces faster scaling, but it actually reduces the buffer of running instances, increasing the impact of bootstrapping delays.

Candidates may think that a faster load balancer (NLB) will reduce the time until new instances can receive traffic, overlooking that the bottleneck is instance bootstrapping, not load balancer performance.

Increasing desired capacity within the same subnet does not protect against an Availability Zone failure; all instances remain in a single AZ, so if that AZ fails, the application becomes unavailable.

Replacing the ALB with a Network Load Balancer does not improve resilience across Availability Zones; it operates at a different layer and does not inherently provide cross-AZ fault tolerance for the application.

Increasing instance size (CPU/memory) does not address the requirement for availability zone failure resilience; it only improves performance, not fault tolerance across AZs.

This option would be correct if the question asked for improving performance or handling increased load within a single AZ, without any requirement for multi-AZ resilience.

This would be correct if the question required handling millions of requests per second with ultra-low latency, or if the application needed to preserve the source IP address for backend processing, as NLB operates at Layer 4.

This option would be correct if the question asked for improving application performance under high load, such as 'A web application is experiencing high CPU utilization and slow response times. What change would best improve performance?'

Candidates may think that simply adding more instances improves resilience, not realizing that resilience requires distributing instances across multiple Availability Zones.

Candidates may think NLB is more resilient because it is simpler and faster, but they overlook that ALB already supports cross-AZ load balancing and is better suited for HTTP/HTTPS applications.

Candidates may think that more powerful instances inherently make the application more resilient, confusing performance improvement with high availability.

Increasing visibility timeout does not prevent poison messages from retrying indefinitely; they would still be redelivered until deleted manually. Also, deleting on validation failure only removes poison messages but does not address duplicate side effects from legitimate retries, as the worker may still process the same message multiple times before the timeout expires.

SNS does not provide exactly-once delivery; it delivers messages at least once, so duplicates can still occur. Additionally, SNS does not handle poison messages or retries, so it fails to address both requirements.

FIFO queues guarantee exactly-once processing but do not prevent duplicate side effects from legitimate retries (e.g., after timeout) because the same message can be redelivered with a different deduplication ID. Also, poison messages would still retry indefinitely unless a DLQ is configured, which is not mentioned.

This option would be correct if the question asked: 'How to ensure a message is not processed by another consumer while a worker is still handling it, and how to remove invalid messages immediately?' In that scenario, increasing visibility timeout prevents premature redelivery, and deleting on validation failure removes poison messages without further retries.

This option would be correct if the question required decoupling message publication from processing, fanning out messages to multiple subscribers, and did not require poison message handling or duplicate prevention.

A question where the requirement is to eliminate duplicate messages entirely and poison messages are not a concern, or where the consumer is idempotent and the main issue is message ordering and deduplication at the queue level.

Candidates may think that increasing visibility timeout gives enough time to acknowledge, and deleting poison messages on validation failure seems like a direct fix. They overlook that poison messages would still be retried until the visibility timeout expires, and that legitimate retries due to timeouts are not handled idempotently.

Candidates may mistakenly believe SNS offers exactly-once delivery or confuse SNS's fan-out capability with SQS's message handling, overlooking that SNS alone cannot manage retries or poison messages.

Candidates may think FIFO queues provide exactly-once delivery and thus solve both problems, overlooking that redeliveries due to timeouts can still cause duplicates and that poison messages need explicit handling via DLQ.

The question requires reading exactly one secret's value at startup, so listing all secrets is unnecessary and violates least privilege by granting access to all secrets.

The question asks for reading a secret value at startup, but UpdateSecret is a write operation that modifies the secret, not reads it. It does not satisfy the requirement to read the current value.

The question requires reading the current secret value, but DescribeSecret only retrieves metadata (e.g., rotation date, tags) and not the secret value. Additionally, scoping to all secrets violates least privilege.

If the Lambda function needed to discover which secrets exist (e.g., to dynamically select one based on naming pattern) before reading its value, then secretsmanager:ListSecrets on all secrets would be appropriate.

A Lambda function that needs to rotate a secret (e.g., update a database password) after reading it would require secretsmanager:UpdateSecret on the specific secret ARN to write the new value.

A question that asks for listing metadata of all secrets (e.g., to check rotation status) and least privilege is not a concern, or the requirement is to retrieve metadata for any secret in the account.

Candidates may think listing is a harmless read operation, but they overlook that least privilege demands scoping to the specific secret ARN, not all secrets.

Candidates may confuse the action needed for reading versus updating, or think that UpdateSecret is needed to 'refresh' the secret value, not realizing that GetSecretValue alone suffices for reading.

Candidates may confuse DescribeSecret with GetSecretValue, thinking it returns the secret value, or they may over-scope resources out of convenience.

Adding a read replica does not reduce failover impact because the application still uses the same JDBC URL, which points to the writer endpoint. During failover, the writer endpoint may be unavailable, and read replicas cannot handle write operations, so connection errors persist.

Increasing EC2 instance size addresses application-side compute capacity, not database failover connectivity issues. The connection errors stem from DNS propagation delays and endpoint changes during Aurora failover, which are unaffected by application server size.

Switching to a single-AZ RDS PostgreSQL instance removes high availability and does not address failover impact; it actually increases downtime risk during a failure.

This option would be correct in a scenario where the application primarily performs read operations and needs to offload read traffic from the primary database to improve read performance or availability. For example, a reporting application that can tolerate stale reads could use read replicas to distribute load.

This option would be correct in a scenario where the application is experiencing performance degradation due to CPU or memory exhaustion on the application servers, and the database is healthy. For example, if an application's response times increase under load and CloudWatch shows high EC2 CPU utilization, resizing to a larger instance type would alleviate the bottleneck.

This option would be correct if the question asked for the simplest, lowest-cost database solution for a non-critical application that can tolerate downtime and does not require high availability or failover support.

Candidates may think that adding a read replica provides high availability or redundancy, but they overlook that the application's JDBC URL still points to the writer endpoint, which is the single point of failure during failover.

Candidates may assume that increasing server resources can compensate for any performance issue, including database failover delays, or they might misinterpret 'connection errors' as a symptom of insufficient application capacity rather than a database endpoint issue.

Candidates may think simplifying the architecture by removing Aurora's complexity will reduce failover issues, but they overlook that single-AZ lacks failover capability entirely.

CloudWatch Logs metric filters on application logs cannot capture the full API request parameters (e.g., which principal made the change and the exact parameters used) because application logs are not authoritative for IAM changes and lack the detailed API call context required for immutable audit records.

AWS Config stores resource configuration changes but does not capture the full API request parameters (e.g., which principal made the change or the exact parameters used), so it cannot provide the immutable audit record of API calls required for forensic investigation.

A SOC analyst needs to monitor application-level errors or specific patterns (e.g., failed login attempts) across multiple accounts and trigger alarms. In that scenario, CloudWatch Logs metric filters on centralized application logs would be appropriate for real-time alerting, not for immutable audit trails of API changes.

A question that asks for a solution to track resource configuration changes over time and detect drift, without needing to capture API caller identity or request parameters, would make AWS Config the correct answer.

Candidates may think CloudWatch Logs can serve as a centralized audit tool because it aggregates logs, but they overlook that application logs do not capture the full API request/response details needed for IAM policy changes, and they are not immutable.

Candidates may confuse AWS Config's configuration history with API audit logging, assuming it captures who made changes, when it only records the resulting state of resources.

S3 Standard is the most expensive storage class; relying on lower request rates does not reduce the per-GB storage cost, so it fails to minimize cost for rarely accessed logs.

Copying logs to EBS snapshots weekly is not cost-effective for long-term retention because EBS snapshots are designed for block-level backups of EC2 instances, not for storing log files. Additionally, this approach incurs ongoing costs for snapshot storage and does not provide native lifecycle management for infrequently accessed data.

S3 replication does not reduce storage costs; it increases them by storing duplicate data in another region. The question asks for cost reduction, not data redundancy or disaster recovery.

If the question asked for the cheapest storage for data that is accessed frequently (e.g., daily) and requires low latency, S3 Standard would be the correct choice because it offers high durability and low-latency access without retrieval costs.

This option would be correct if the question required point-in-time recovery of an EC2 instance's root volume or data volume, with weekly backup snapshots for disaster recovery purposes, and the logs were stored on the instance's EBS volume rather than in S3.

A question requiring cross-region disaster recovery or compliance with data residency regulations where data must be stored in multiple geographic locations would make S3 replication the correct answer.

Candidates may think that infrequent access automatically reduces cost, overlooking that S3 Standard charges the same storage fee regardless of access frequency.

Candidates may think that using EBS snapshots is a valid backup strategy for any data, including logs, and that deleting the original files after copying reduces costs, without realizing that S3 lifecycle rules are more cost-effective and purpose-built for log retention.

Candidates may confuse replication with cost-saving mechanisms, thinking that moving data to another region automatically reduces costs, or they may overlook the additional storage and transfer fees.

This option only enforces SecureTransport (HTTPS), not encryption at rest. It does not require SSE-KMS or a specific KMS key, so objects could be uploaded without server-side encryption or with a different encryption method.

This condition restricts Content-Type, not encryption. The requirement is about SSE-KMS encryption, not the MIME type of the object.

Option D is wrong because the question requires encryption with a specific KMS key, not decryption permissions. Denying PutObject based on the caller's inability to decrypt does not enforce the use of the required KMS key for encryption; it only checks decryption capability, which is irrelevant for uploads.

This would be correct if the question required enforcing encryption in transit for all S3 uploads, e.g., 'Ensure all PutObject requests use HTTPS.' Then a Deny with aws:SecureTransport false would be appropriate.

If the question required that only binary files (e.g., application/octet-stream) be uploaded to a specific bucket, a Deny policy on other Content-Type values would enforce that rule.

Option D would be correct in a scenario where the requirement is to prevent uploads by users who cannot decrypt objects in the bucket (e.g., to ensure only authorized decryptors can upload). For example: 'A security policy requires that only users with permission to decrypt objects using a specific KMS key can upload to the bucket.'

Candidates may confuse encryption in transit (HTTPS) with encryption at rest (SSE), or assume that requiring HTTPS automatically enforces server-side encryption, which is not true.

Candidates may confuse content restrictions with encryption requirements, or think that controlling Content-Type is a way to enforce data format standards that indirectly relate to security.

Candidates may confuse encryption and decryption permissions, thinking that requiring kms:Decrypt for uploads somehow enforces encryption, or they may assume that KMS key permissions are symmetric for encrypt and decrypt operations.

The error indicates that the KMS key policy in Account A does not grant the Account B role permission to decrypt. Adding kms:Decrypt to the key policy is necessary, but removing it from the role policy in Account B is incorrect because the role still needs the permission for the request to proceed; both the key policy and the role policy must allow the action.

The error includes 'kms:Decrypt', indicating the KMS key policy is missing cross-account decrypt permission. Simply using s3:GetObject does not bypass KMS authorization; S3 cannot automatically authorize KMS decrypt across accounts without proper key policy.

Switching to SSE-S3 removes KMS involvement, but the question states that the bucket uses SSE-KMS with a customer-managed key. Changing encryption type is an indirect workaround that does not address the root cause (missing KMS key policy permissions) and may violate compliance or security requirements.

This option would be correct if the question stated that the role in Account B had kms:Decrypt permissions but the key policy in Account A was overly permissive, and the goal was to restrict access by removing the permission from the role and relying solely on the key policy to grant cross-account access.

In a scenario where the S3 bucket uses SSE-S3 (not SSE-KMS) and the IAM role in Account B has s3:GetObject permission, then no KMS permissions are needed, and S3 handles decryption automatically.

This option would be correct if the question described a scenario where the application does not require KMS-based encryption, the bucket's encryption can be changed without affecting other dependencies, and the goal is to eliminate KMS-related permissions entirely to simplify access.

Candidates may think that removing the permission from the role simplifies the configuration or that the key policy alone is sufficient, misunderstanding that both the key policy and the IAM policy must grant the permission for cross-account access.

Candidates may think S3 handles all authorization automatically, overlooking that cross-account KMS access requires explicit key policy grants, not just IAM permissions.

Candidates may think that switching to SSE-S3 removes the KMS dependency and thus the error, without considering that the bucket is already configured with SSE-KMS and changing encryption type is a significant change that may not be allowed or desired.

Asynchronous Lambda invocation from EventBridge has limited retry (0-2 attempts) and no DLQ support, so events lost after transient failures cannot be inspected or reprocessed, failing the requirement for bounded retries and inspectability.

Removing retry and DLQ configuration prevents at-least-once processing and makes it impossible to inspect unprocessable events, directly contradicting the requirements.

Storing failed events only in CloudWatch logs and manually reprocessing them does not provide automated retries, bounded retries, or a systematic way to inspect and reprocess unprocessable events, violating the requirements for at-least-once processing and automated reprocessing.

This option would be correct if the question required minimal cost and complexity for a non-critical system where occasional event loss is acceptable, and there was no need for DLQ or reprocessing.

In a scenario where the requirement is exactly-once processing with no duplicates and no need for retries or inspection of failed events, and the system can tolerate event loss on failure.

This option would be correct in a scenario where the requirement is to have a simple, low-cost solution for debugging and manual intervention, with no need for automated retries or DLQ, and where the volume of failures is very low and acceptable to handle manually.

Candidates may think asynchronous invocation automatically handles retries and durability, overlooking that EventBridge async targets have no DLQ and limited retry, and that increasing timeout doesn't prevent loss from other transient failures.

Candidates may think SNS with Lambda is simpler and that removing retries reduces duplicates, but they overlook the need for reliability and failure inspection.

Candidates may think that logging failures is sufficient for auditing and that manual reprocessing is acceptable, underestimating the need for automated retry and DLQ mechanisms to ensure reliability and reduce operational overhead.

Amazon EBS snapshots are used for backing up Amazon Elastic Block Store volumes attached to EC2 instances, not for S3 object versioning. They do not provide the ability to recover earlier versions of S3 objects.

Amazon CloudWatch logs capture log data from AWS resources, not file versions. They cannot recover overwritten or deleted S3 objects.

VPC flow logs capture IP traffic information for network interfaces in a VPC, not file version history in S3. They cannot recover overwritten or deleted S3 objects.

When a question asks for a backup solution for EC2 instance volumes (e.g., to recover from accidental data loss or corruption), enabling EBS snapshots would be the correct answer.

A question asks: 'A company needs to monitor API calls to an S3 bucket for security analysis. What should they enable?' CloudWatch Logs would be correct if the question specified logging API activity via CloudTrail and storing logs in CloudWatch.

A question asks: 'A company needs to analyze network traffic patterns and troubleshoot connectivity issues between EC2 instances in a VPC. What should they enable?' VPC flow logs would be the correct answer.

Candidates may confuse EBS snapshots with versioning because both involve creating point-in-time backups, but they apply to different AWS services (EBS vs. S3).

Candidates may confuse logging (CloudWatch) with versioning, thinking logs can track changes and enable recovery, but logs only record events, not object versions.

Candidates may confuse 'logs' with version tracking, or think that any logging feature can help recover data, not understanding that VPC flow logs are for network metadata only.

Scaling up the writer instance does not offload read queries; the writer still handles all traffic, so read latency remains high during reporting windows. Aurora Replicas are needed to distribute read-only queries.

Moving the dashboard to DynamoDB without changing the query model is wrong because DynamoDB is a NoSQL database with a different query model (key-value and document), so existing SQL queries from the reporting dashboard would not work without significant application changes.

In a scenario where the database is CPU-bound on the writer due to write-heavy workload and read latency is acceptable, scaling up the writer instance (vertical scaling) would be correct to increase write throughput.

This option would be correct in a scenario where the reporting dashboard requires extremely low-latency access to a simple, high-traffic dataset (e.g., user session data or IoT events) and the application can be refactored to use DynamoDB's query patterns, with the original Aurora cluster handling only transactional writes.

Candidates may think that a more powerful writer can handle both reads and writes faster, overlooking that Aurora's architecture separates read scaling via replicas.

Candidates may think DynamoDB is always a good choice for read-heavy workloads due to its scalability and low latency, overlooking the fact that the existing query model (SQL) is incompatible with DynamoDB's NoSQL interface.

Resizing the writer instance to a larger class does not offload read traffic from the writer; reporting queries still compete with OLTP writes on the same instance, failing to isolate workloads and reduce write latency.

Cross-region replication does not reduce latency for reporting queries in the primary region; it creates a separate cluster in another region, which would not help with low-latency reads for local reporting and introduces additional cost and complexity.

Disabling read replicas and using only application-layer caching forces all reporting queries through the writer endpoint, increasing write latency during reporting runs. This contradicts the goal of offloading reads to keep the writer focused on OLTP writes.

A solutions architect needs to improve overall database performance for a single-instance Aurora PostgreSQL that experiences high CPU and memory pressure from both reads and writes, with no requirement to separate read traffic. Scaling up the instance class provides more resources to handle the combined load.

When the requirement is disaster recovery across regions and reporting can tolerate higher latency, or when the primary region is heavily loaded and reporting queries can be offloaded to a different geographic location with acceptable latency.

In a scenario where the application requires strong read-after-write consistency and cannot tolerate even eventual consistency, and the reporting workload is small enough that caching handles most reads, directing all queries to the writer endpoint ensures immediate consistency.

Candidates may think that a larger instance can simply 'power through' the workload, overlooking the architectural best practice of separating read and write traffic to avoid contention.

Candidates may think that replicating to another region automatically distributes read load, but they overlook that cross-region replication is for disaster recovery, not for reducing read latency in the same region.

Candidates may think caching alone can solve read performance without understanding that reporting queries often involve complex aggregations that caching cannot fully address, and they may underestimate the impact of mixing read and write workloads on the same instance.

Increasing EC2 instance size and keeping all servers in one subnet does not provide fault tolerance across Availability Zones; a single AZ failure would still take down all application servers.

A Network Load Balancer (NLB) in a single AZ cannot provide cross-AZ failover; the question requires serving traffic during a single-AZ failure, which demands multi-AZ architecture. An NLB alone does not address the lack of application server redundancy.

A read replica does not provide automatic failover; the application would need to manually switch to the replica endpoint, which does not address the single-AZ failure of the primary database. The question requires continued serving traffic during a single-AZ failure, which Multi-AZ provides by automatic failover.

If the question described a performance bottleneck (e.g., CPU or memory saturation) and the goal was to improve throughput for a single-AZ workload, increasing instance size would be correct.

When the requirement is to handle extremely high throughput with low latency for TCP/UDP traffic, and the application is already deployed across multiple AZs with its own failover logic. An NLB in a single AZ could be correct if the question explicitly states that only one AZ is used and the goal is to maximize performance within that AZ.

A read replica would be correct if the question asked for offloading read traffic from the primary database to improve read performance, or if the requirement was to have a standby for disaster recovery in a different region (cross-region read replica) without automatic failover.

Candidates may think bigger instances alone can handle failures, confusing vertical scaling with high availability.

Candidates may confuse load balancer types, thinking an NLB provides better availability than an ALB, or they may overlook that the NLB is still confined to a single AZ, which does not solve the multi-AZ failure requirement.

Candidates may confuse read replicas with Multi-AZ deployments, thinking that a read replica provides high availability, but it does not offer automatic failover and is primarily for read scaling.

Increasing visibility timeout reduces duplicates but does not guarantee idempotency; messages can still be processed multiple times if the timeout is exceeded. It also fails to handle poison messages that repeatedly fail processing.

FIFO queues guarantee exactly-once processing, but the question states messages reappear due to processing timeout; deleting immediately upon receipt would lose messages that fail processing, and FIFO does not prevent duplicate side effects if processing is not idempotent.

SNS with synchronous HTTP endpoints does not guarantee exactly-once processing; the sender may still retry, and the receiver could process duplicates. It also lacks a mechanism to handle poison messages that repeatedly fail, as there is no dead-letter queue.

This option would be correct in a scenario where the processing time is consistently predictable and the only concern is to avoid temporary overlaps, with no requirement for duplicate prevention or poison message handling.

A question where the requirement is to process messages in strict order without duplicates, and the processing is idempotent or the message is deleted only after successful processing (e.g., using a FIFO queue with a consumer that deletes after processing and a DLQ for failures).

This option would be correct in a scenario where the team needs to fan out messages to multiple subscribers and requires immediate, synchronous confirmation of processing, with no concern for duplicate prevention or poison message handling.

Candidates may think that increasing visibility timeout is a simple fix to prevent duplicates, overlooking the need for idempotency and poison message management.

Candidates may think FIFO queues eliminate duplicates entirely, but they only prevent duplicates during delivery, not during processing; they also overlook the need for idempotency and poison message handling.

Candidates may think synchronous processing eliminates duplicates because the sender waits for a response, but they overlook that retries can still cause duplicates, and there is no built-in poison message handling.