SAA-C03 practice questions and answers

Correct answer: B — Enable a Multi-AZ deployment for the RDS instance.

Multi-AZ keeps a standby copy of the database in another Availability Zone and fails over to it automatically. The database endpoint stays the same, so the application does not need any change. A read replica can be promoted, but that is a manual step. Snapshots lose up to an hour of data and take time to restore. A second Region with DMS is far more work than this requirement needs.

Correct answer: B — Attach an IAM role to the EC2 instance with a policy that allows read access to the bucket.

An IAM role attached to the instance gives the application temporary credentials that rotate automatically. Nothing is stored on disk. All the other answers put long-lived keys on the server or open the bucket to the internet.

Correct answer: A — Amazon DynamoDB Accelerator (DAX)

DAX is a caching layer built for DynamoDB. It is API-compatible, so the application keeps using the DynamoDB SDK calls, and cached reads drop from milliseconds to microseconds. A GSI helps with different query patterns, not repeat reads. Memcached would work but you must write all the cache logic yourself. More capacity units cost more and still return millisecond reads.

Correct answer: B — Compute Savings Plans

Compute Savings Plans give a discount similar to Reserved Instances but apply across instance families, sizes, Regions, and even Fargate and Lambda. Standard RIs lock you to a family, which conflicts with the plan to change instance types. Spot can be reclaimed at any time, so it does not fit a steady always-on workload. On-Demand is the most expensive choice.

Correct answer: B — Send jobs to an Amazon SQS queue and let workers poll the queue.

SQS decouples the two tiers. The queue absorbs spikes, jobs are kept until a worker finishes them, and an Auto Scaling group can scale workers on queue depth. A load balancer still pushes work at busy servers and does not store jobs. Bigger instances only delay the problem. Polling S3 is a home-made queue with no visibility timeout or retry handling.

Correct answer: A — Use CloudFront Origin Access Control (OAC) and a bucket policy that only allows the distribution.

Origin Access Control is the current recommended way to lock an S3 origin to one CloudFront distribution. CloudFront signs requests to S3, and the bucket policy allows only that distribution. Hard-coding CloudFront IP ranges is fragile because they change. A custom header alone still leaves the bucket public. S3 is a regional service and does not live inside a subnet.

Correct answer: A — Create Amazon CloudFront distribution in front of the application.

CloudFront caches static content at edge locations close to users, which is the quickest win for slow images and CSS. Copying the stack to more Regions is expensive and complex. Placement groups improve networking between instances inside one AZ, not for end users. Transfer Acceleration speeds up uploads to S3, not downloads of site assets.

Correct answer: C — S3 Intelligent-Tiering

Intelligent-Tiering watches access patterns for each object and moves it between frequent and infrequent tiers automatically, with no retrieval fee and millisecond access. That is exactly the case of unpredictable access. Standard costs more for cold data. Standard-IA charges a retrieval fee and a minimum storage duration. Glacier adds retrieval time, which the team does not accept.

Correct answer: A — Amazon Route 53 failover routing with health checks on both endpoints

Route 53 failover routing sends traffic to the primary record while its health check passes, and switches to the secondary record when it fails. An ALB works inside one Region only. Weighted routing splits traffic all the time instead of failing over. Auto Scaling groups cannot span Regions.

Correct answer: B — SSE-KMS with a customer managed AWS KMS key

A customer managed KMS key lets the company control the key policy and rotation, and every encrypt and decrypt call is logged in AWS CloudTrail. SSE-S3 keys are fully managed by AWS, so there is no customer control or per-key audit trail. A key in application code is a security problem, not a solution. Versioning and Object Lock protect against deletion, not access.

Correct answer: C — io2 Block Express

io2 Block Express is the provisioned IOPS family built for the highest performance databases — up to 256,000 IOPS per volume with very consistent latency. gp3 tops out at 16,000 IOPS, gp2 IOPS scale with volume size and are less predictable, and st1 is throughput-optimized HDD for big sequential workloads such as logs.

Correct answer: A, B — Add subnets in at least one more Availability Zone and enable them on the load balancer. · Run the Auto Scaling group across multiple Availability Zones.

High availability inside a Region comes from spreading across Availability Zones: the load balancer needs subnets in more than one AZ, and the Auto Scaling group must launch instances in those AZs so capacity survives an AZ failure. The load balancer type does not change availability. A cluster placement group keeps instances in one AZ, which is the opposite of what is needed. Termination protection only stops manual termination.

Correct answer: A, B — Add a bucket policy in Account A that allows the Account B principal to read the objects. · Create an IAM role in Account A that trusts Account B, and let Account B assume it.

Cross-account access to S3 is done either with a resource-based policy (the bucket policy naming the other account) or with a cross-account IAM role that Account B assumes. Sharing access keys breaks credential hygiene and is never the exam answer. Public access exposes the data to everyone. Security groups protect network interfaces, not S3 buckets.

Correct answer: A — Create a gateway VPC endpoint for Amazon S3 and route S3 traffic through it.

A gateway VPC endpoint for S3 costs nothing and keeps the traffic on the AWS network, so it skips the NAT gateway's hourly and per-GB processing charges. A NAT instance is cheaper per hour but you manage and scale it yourself. Public subnets remove the private design and still charge for internet data transfer. Transfer Acceleration adds cost rather than removing it.

Correct answer: B — Amazon EFS mounted on all instances

Amazon EFS is a shared NFS file system for Linux that many instances can mount at once, and it grows and shrinks automatically. EBS volumes are attached to a single instance in most cases and do not give a shared namespace. S3 is object storage without POSIX semantics. FSx for Windows File Server uses SMB and targets Windows workloads.

Correct answer: B — A NAT gateway in a public subnet, with a route from the private subnets

A NAT gateway lets private instances start outbound connections while blocking inbound ones. Routing private subnets straight to an internet gateway would make them public. An egress-only internet gateway does the same job as NAT but only for IPv6. VPC peering connects VPCs and gives no internet path.

Correct answer: B — An Amazon SQS FIFO queue with message group IDs

FIFO queues give exactly-once processing and keep strict order inside each message group ID. Standard queues are at-least-once and best-effort ordering, so duplicates and out-of-order delivery are possible. SNS is publish/subscribe fan-out, not a work queue. Firehose loads streaming data into stores like S3 and does not give per-order processing semantics.

Correct answer: A — Add Aurora Replicas and point the reporting workload at the reader endpoint.

Aurora Replicas share the same storage volume and serve read traffic through the reader endpoint, so reporting queries stop competing with writes. A larger writer costs more and still mixes both workloads. Nightly restores give stale data and extra work. Aurora is already replicated across AZs — that setting is about availability, not read scaling.

Correct answer: B — Spot Instances

Spot Instances use spare capacity at a large discount and are the right choice for fault-tolerant, restartable batch work. On-Demand costs much more. Dedicated Hosts are for licensing and isolation requirements. Reserved Instances suit steady, always-on workloads, not a few hours a night.

Correct answer: A — AWS WAF with managed rules and a rate-based rule

AWS WAF inspects HTTP requests and can block SQL injection with managed rule groups, while rate-based rules throttle noisy IP addresses. Shield Standard protects against network and transport layer DDoS automatically but does not read HTTP payloads. GuardDuty detects threats and alerts — it does not block. Network ACLs filter by IP and port only, and cannot see the SQL in a request body.

Correct answer: A — S3 Versioning together with MFA delete

Versioning keeps every version of an object, so overwrites and deletes are recoverable. MFA delete requires a multi-factor code before a version can be permanently removed. Replication copies data but does not by itself stop deletion of versions. Lifecycle rules manage cost, and access logging only records who did what.

Correct answer: B — Configure provisioned concurrency on the published version or alias

Provisioned concurrency keeps a set number of execution environments initialized and ready, which removes the cold start for those requests. Timeout controls how long a run may last, not startup time. Putting a function in a VPC can add setup work rather than remove it. Graviton usually lowers cost and can help runtime, but it is not the cold start fix.

Correct answer: D — S3 Glacier Deep Archive

Glacier Deep Archive is the lowest-cost S3 class and is designed for data kept for years with retrieval measured in hours — exactly this case. Glacier Flexible Retrieval costs more and targets retrievals in minutes to hours. Both IA classes are far more expensive for seven-year archives, and One Zone-IA also stores data in a single Availability Zone.

Correct answer: A — AWS Secrets Manager

Secrets Manager has built-in rotation that can update the secret and the database password together with a Lambda rotation function. Parameter Store can hold encrypted values but does not rotate them for you. An S3 object or environment variables require you to build and run the rotation yourself.

Correct answer: A, B — Store sessions in Amazon ElastiCache for Redis. · Store sessions in an Amazon DynamoDB table.

Moving session state off the instance makes the tier stateless: ElastiCache for Redis and DynamoDB are both standard choices. Sticky sessions still lose the session when the instance goes away. Disabling scale-in avoids the symptom and wastes money. Instance store is ephemeral local disk, so it disappears with the instance.

Correct answer: B — Security groups are stateful and support allow rules only; network ACLs are stateless and support allow and deny rules.

A security group is stateful — return traffic for an allowed connection is automatically permitted — and it can only allow, never deny. A network ACL is stateless, so inbound and outbound rules must both be written, and it supports explicit deny rules. Security groups attach to elastic network interfaces; network ACLs attach to subnets.

Correct answer: B — AWS Global Accelerator

Global Accelerator gives two static anycast IP addresses and sends TCP and UDP traffic over the AWS backbone from the nearest edge location, which lowers latency and jitter. CloudFront is built for HTTP/HTTPS content delivery. Latency-based routing only picks a Region at DNS time and does not improve the network path. Direct Connect is a private link from a company data centre, not for players on the internet.

Correct answer: A — Migrate the volumes to gp3 and set IOPS and throughput independently of size.

With gp3 you pay for the capacity you need and then dial in IOPS and throughput separately, so the oversized volumes can shrink. gp2 ties IOPS to size, which is why the volumes are big. io2 is a premium class and would raise cost. Instance store is not durable, and deleting volumes nightly breaks the applications.

Correct answer: B — A service control policy (SCP) applied to the organizational units

Service control policies set the maximum permissions for accounts in an organization, so an SCP that denies CloudTrail stop and delete actions blocks even the account root and administrators. IAM policies can be changed by an account admin. Config rules detect drift after the fact. A permissions boundary limits one principal, not the whole account.

Correct answer: C — Warm standby

Warm standby keeps a scaled-down but running copy of the workload with data replicating continuously, so recovery is a matter of scaling up — minutes of RTO and seconds of RPO. Backup and restore takes hours. Pilot light has only core pieces such as the database running, so bringing up the app tier takes longer. Active/active meets the target but costs the most.

Correct answer: B — The delete is denied, because an explicit deny always overrides any allow.

IAM evaluates every applicable policy together: the request is denied by default, an allow can permit it, and an explicit deny anywhere overrides every allow. Order of attachment and relative permissiveness never matter.

Correct answer: A — AWS Systems Manager Session Manager with the SSM Agent and session logging to CloudWatch Logs or S3.

Session Manager connects outbound through the SSM Agent, so no inbound port is opened and no key material exists, and every session can be logged and recorded. A bastion is a host you must patch and expose. Instance Connect still needs network reachability and pushes keys. A VPN plus keys reintroduces key distribution.

Correct answer: A — Enable S3 Block Public Access at the account level.

Account-level Block Public Access overrides bucket policies and ACLs for every current and future bucket in the account, which is exactly the guardrail described. Per-bucket policies must be maintained one at a time and miss new buckets. Versioning protects against deletion. Config detects the problem after it happens.

Correct answer: A — Request a public certificate in AWS Certificate Manager and attach it to an HTTPS listener on the load balancer.

ACM public certificates are free when used with integrated services such as ELB, CloudFront and API Gateway, and ACM renews them automatically as long as validation stays in place. Terminating TLS at the load balancer keeps certificates off the instances. Imported certificates — including self-signed ones — are not auto-renewed, and browsers reject self-signed certs.

Correct answer: A — In the app tier security group, add an inbound rule for port 8080 whose source is the web tier's security group ID.

A security group rule can reference another security group as its source, so membership follows instances automatically as they launch and terminate — no IP tracking. Maintaining IP lists with automation is fragile. Allowing the entire VPC CIDR or a subnet range grants far more than the web tier, including anything else placed in that range.

Correct answer: A — Publish the service with AWS PrivateLink: a Network Load Balancer plus a VPC endpoint service that customers consume through interface endpoints.

PrivateLink exposes one service through interface endpoints in the consumer VPC, so traffic never leaves the AWS network, there is no route table or CIDR relationship between the two VPCs, and overlapping address space is irrelevant. Peering and transit gateway both join networks and break on overlapping CIDRs, and they do not scale to hundreds of tenants cleanly. An internet-facing ALB puts the traffic on the public internet.

Correct answer: A — Use AWS IAM Identity Center with the corporate IdP as the identity source, and assign permission sets to groups per account.

IAM Identity Center is the workforce SSO service: connect an external IdP, define permission sets, and assign them to groups per account — users get short-lived credentials and no IAM user exists anywhere. Cognito is for application end users, not workforce access. Sharing access keys is the pattern being eliminated, and a managed AD per account multiplies the work.

Correct answer: A — Amazon Macie

Macie uses machine learning and pattern matching to discover sensitive data in S3 and reports findings continuously. Inspector scans workloads for software vulnerabilities, GuardDuty detects threats from log activity, and the Config rule checks bucket permissions — none of them look inside objects.

Correct answer: A — Store the password in AWS Secrets Manager and reference it in the task definition's `secrets` block, granting the task execution role permission to read it.

The `secrets` block makes the ECS agent fetch the value from Secrets Manager (or SSM Parameter Store) at task start and inject it into the container, so the plaintext never sits in the task definition. Environment variables in the task definition are visible to anyone with describe permissions, and anything baked into an image or a label travels wherever the image goes.

Correct answer: A — Amazon GuardDuty

GuardDuty analyses CloudTrail, VPC flow logs and DNS logs against threat intelligence, so malicious domain lookups produce findings with nothing installed on the instance. Inspector scans for vulnerabilities. Security Hub aggregates findings from other services rather than generating them. Detective helps investigate a finding after GuardDuty raises it.

Correct answer: A — Set the bucket's Object Ownership to Bucket owner enforced, which disables ACLs and makes the bucket owner the owner of every object.

Bucket owner enforced disables ACLs entirely and gives the bucket owner ownership of all objects, which is the current AWS recommendation and removes the cross-account ownership problem at the source. The ACL header approach depends on every partner remembering it. Versioning is unrelated, and copying objects doubles storage and adds moving parts.

Correct answer: A — Subscribe to AWS Shield Advanced.

Shield Advanced adds the DDoS Response Team, cost protection that credits scaling charges caused by an attack, richer attack visibility and WAF at no extra charge on protected resources. Shield Standard is automatic but has none of those. WAF rate limiting helps at the application layer but offers no response team or billing protection. GuardDuty detects threats and does not mitigate DDoS.

Correct answer: A — A redrive policy that moves a message to a dead-letter queue after a set maxReceiveCount.

A dead-letter queue with maxReceiveCount takes the poison message out of the main flow after a few failed attempts, so healthy messages keep moving and the bad one can be inspected. A longer visibility timeout slows the loop without ending it, FIFO changes ordering not failure handling, and shorter retention throws away good messages too.

Correct answer: A — Perform a point-in-time restore, which creates a new DB instance at the chosen second within the retention window.

Automated backups plus transaction logs let RDS restore to any second in the retention window, and the restore always creates a new instance that you then point the application at. A nightly snapshot loses hours of work and cannot overwrite an instance in place. Replicas and the Multi-AZ standby both replicate the corrupting change within seconds.

Correct answer: A — Amazon DynamoDB global tables

Global tables give multi-Region, multi-active DynamoDB tables with replication typically under a second and independent Regional endpoints. RDS read replicas accept reads only and need promotion. An Aurora cluster serves writes from one Region; even a global database has a single writer. ElastiCache is a cache, not the system of record.

Correct answer: A — Losing that AZ cuts internet access for all private subnets — deploy one NAT gateway per AZ and point each private subnet's route table at the NAT gateway in its own AZ.

A NAT gateway is redundant inside its own Availability Zone but not across zones, so a zonal failure isolates every subnet routing through it — and cross-AZ traffic also costs more. The standard design is one NAT gateway per AZ with matching route tables. NAT instances are self-managed and slower. Attaching an internet gateway would make the subnets public.

Correct answer: A — Enable S3 Cross-Region Replication to a bucket in us-east-1, with versioning on both buckets.

Cross-Region Replication copies new and updated objects automatically and requires versioning on the source and destination buckets. A nightly sync leaves up to a day of drift and a job to babysit. Transfer Acceleration speeds uploads to one bucket. One Zone-IA reduces durability by storing in a single AZ, which is the opposite of the goal.

Correct answer: A — Enable an EventBridge archive on the event bus and replay the archived events over the affected time window.

EventBridge archives retain matching events for a chosen period, and replay re-sends them to selected rules for a start and end time — built for exactly this recovery. A database restore does not recreate missed events. Re-running producers is usually impossible and can duplicate side effects. Retry settings only affect delivery of events happening now.

Correct answer: A — Change the Auto Scaling group's health check type to ELB and set an appropriate health check grace period.

By default an Auto Scaling group only uses EC2 status checks, which pass while the OS is healthy and the application is dead. Setting the health check type to ELB makes the group act on the load balancer's verdict and replace the instance; the grace period stops new instances being killed during start-up. Shorter intervals detect faster but still trigger no replacement, and the other options block or delay replacement.

Correct answer: A — Use AWS Backup with a backup plan, resource assignment by tag, and a cross-Region copy rule.

AWS Backup centralises policies across supported services, selects resources by tag, copies recovery points to another Region, and provides Backup Audit Manager reports for compliance evidence. Per-service Lambda functions or manual settings recreate that badly with no central proof. Data Lifecycle Manager covers EBS snapshots and AMIs only.

Correct answer: A — Move the file system to EFS Standard, which stores data redundantly across multiple Availability Zones.

One Zone classes store data in a single Availability Zone, so an AZ outage takes the data offline — the trade-off you accept for the lower price. If the workload cannot tolerate that, the fix is a Standard (multi-AZ) file system. Nightly backups still mean downtime and data loss. Mounting from other AZs does not change where the data lives, and Intelligent-Tiering only moves data between access tiers.

Correct answer: A — Cache the query results in Amazon ElastiCache and serve subsequent requests from the cache until the TTL expires.

Caching removes the repeated work entirely — an in-memory hit costs microseconds and the database runs the aggregation once per TTL. A read replica moves the same expensive query to another instance you also pay for. A bigger instance runs the query faster but still runs it every time. Multi-AZ is for availability, and the standby serves no traffic.

Correct answer: A — Use multipart upload for the large files and enable S3 Transfer Acceleration on the bucket.

Multipart upload splits the object into parts that transfer in parallel and lets a failed part be retried on its own instead of restarting the whole upload; Transfer Acceleration routes the traffic over the CloudFront edge network to shorten the public internet path. Compression helps marginally and changes the files. Regional buckets plus replication multiply cost and complexity. Intelligent-Tiering is a storage cost feature.

Correct answer: A — Launch the instances in a cluster placement group with enhanced networking, in a single Availability Zone.

A cluster placement group packs instances close together on the same high-bisection-bandwidth network segment inside one AZ, which is the documented pattern for tightly coupled HPC. A spread placement group deliberately separates instances for availability, which raises latency. Load balancers and Global Accelerator handle inbound client traffic, not node-to-node communication.

Correct answer: A — Amazon FSx for Lustre, linked to the S3 bucket

FSx for Lustre is the high-performance file system built for HPC and ML: it presents S3 objects as files, loads data lazily, and scales to hundreds of GB/s with sub-millisecond latency. EFS is general-purpose NFS and does not reach those numbers. EBS volumes are per-instance and would need the data copied to each one. FUSE mounts add latency and are not a supported performance answer.

Correct answer: A — Query the data in place with Amazon Athena, partitioning and converting to a columnar format to reduce scanned bytes.

Athena is serverless and charges per terabyte scanned, so occasional queries over S3 cost almost nothing when the data is partitioned and stored as Parquet or ORC. Redshift and RDS require provisioned, always-running infrastructure and a load process. EMR is powerful but is a cluster to configure and pay for.

Correct answer: A — Amazon Kinesis Data Streams with a retention period of at least 24 hours and multiple consumers

Kinesis Data Streams keeps records for a configurable retention period and lets many consumers read the same shard at their own position, so replay after a fix is built in. Firehose is a delivery pipeline with no consumer replay. SQS deletes a message once it is processed and has no consumer groups. SNS fans out to subscribers but does not retain records for re-reading.

Correct answer: A — Create a cross-Region read replica in ap-southeast-2 and route Australian read traffic to it.

A cross-Region read replica places a readable copy near the users, cutting round-trip latency for the read-heavy pages while writes continue against the primary. Multi-AZ adds a standby in the same Region that serves no traffic. CloudFront accelerates HTTP content, not database connections. A larger instance in Europe cannot fix the speed of light.

Correct answer: A — A lifecycle configuration that transitions objects to S3 Standard-IA after 30 days and to S3 Glacier Deep Archive after 90 days.

Lifecycle rules match storage class to the access pattern described, and Deep Archive is the cheapest option for the seven-year tail where hours-long retrieval is acceptable. Keeping everything in Standard is the expensive default. Archiving on day one makes the first 30 days of frequent queries slow and costly to retrieve. EBS is block storage attached to instances and is far more expensive per GB.

Correct answer: A — Use on-demand capacity mode.

On-demand charges per request and absorbs sudden spikes with no capacity settings, which is what an unpredictable launch needs. Provisioning for peak pays for idle capacity on the quiet days. Auto scaling reacts over minutes and a low maximum guarantees throttling. Reserved capacity is a commitment that only pays off with steady, predictable traffic.

Correct answer: A — Serve the content through Amazon CloudFront, which caches at the edge and has lower data transfer pricing than EC2 egress.

A CDN answers repeat requests from the edge, so most bytes never leave the origin, and CloudFront's data transfer rates are lower than direct EC2 egress — often the single biggest saving for a media-heavy site. Changing Region does not remove egress. Reserved Instances discount compute, not transfer. Requester Pays shifts cost to consumers, which is not viable for a public site.

Correct answer: A — Stop and start the instances on a schedule, for example with AWS Systems Manager or the AWS Instance Scheduler solution.

Instances that run 60 hours a week instead of 168 cost roughly two thirds less, and scheduled stop/start needs no application change. Reserved Instances assume the instances run continuously, so committing for three years locks in paying for idle time. Dedicated Hosts cost more. Downsizing helps a little but never approaches turning them off.

Correct answer: A — Run the container on AWS Fargate with a task launched per demand, or move the logic to AWS Lambda, so nothing runs while idle.

For a workload measured in hundreds of requests a day, paying per request or per task-second removes almost all the cost, and both Fargate and Lambda are multi-AZ by design. Spot lowers the rate but you still pay around the clock and accept interruptions. One larger instance is cheaper but a single point of failure. A Savings Plan discounts capacity that is mostly idle.

Correct answer: A — AWS Compute Optimizer

Compute Optimizer analyses CloudWatch metrics with machine learning and returns rightsizing recommendations for EC2, Auto Scaling groups, EBS volumes and Lambda functions, including the estimated saving. Cost Explorer shows what you spent, Budgets alerts on thresholds, and raw dashboards leave the analysis to you.

Correct answer: A — Amazon Aurora Serverless v2, which scales capacity up and down in fine-grained increments with demand.

Aurora Serverless v2 adjusts capacity in fine increments as load changes, so an idle night costs a fraction of a peak-sized instance while staying PostgreSQL compatible. A Reserved Instance sized for peak is the expensive option being replaced. Redshift is an analytics warehouse. DynamoDB is a NoSQL store and would mean rewriting the application.