Skip to content
Tags: aws saa-c03 solutions-architect

AWS Solutions Architect Associate (SAA-C03) - Full Practice Exam 1

Suggested duration: 130 minutes

Exam code: SAA-C03

By Oleksandr Andrushchenko — Published on
0 Likes
0 Dislikes

A full-length, original 65-question practice exam covering secure, resilient, high-performing, and cost-optimized AWS architectures. Includes scenario-based single-answer and multiple-answer questions, with explanations for every choice. Suggested practice time: 130 minutes. Independent preparation material; not an official AWS exam.

Questions — 65

  1. EC2 workers in private subnets upload large amounts of data to S3 buckets in the same Region. All S3 traffic currently passes through NAT gateways. The company wants to avoid NAT processing charges for this traffic without making the workers public. Which TWO changes best meet the requirement? (Choose TWO.)
  2. Thousands of devices publish telemetry. Several independent applications must read the stream, replay recent records, and process records for each device in order. Producers already emit each device's records in sequence. Which design best meets these ingestion requirements?
  3. An S3 bucket has correctly scoped access permissions and default encryption at rest. An audit requires rejecting object requests that are sent without TLS. Which control directly enforces this requirement?
  4. Analysts use Athena to query years of clickstream CSV files in S3. Most queries select a few columns for one day, but currently scan almost all historical data. Which TWO changes best reduce scanned data and improve these queries? (Choose TWO.)
  5. A product page frequently executes the same expensive relational lookup. A few seconds of stale product-description data is acceptable. The database remains the system of record. Which design best reduces repeated database work?
  6. An internet-facing application uses CloudFront and an ALB. Security logs show repeated SQL injection and cross-site scripting attempts in HTTP requests. The company wants managed request filtering without changing application code. Which solution best addresses these attacks?
  7. A company keeps large, infrequently downloaded derivative media files for at least one year. The originals are safely stored elsewhere, and derivatives can be recreated if an Availability Zone is lost. Downloads must start immediately. Which listed storage class best reduces storage cost while accepting the stated availability tradeoff?
  8. A media company stores 64 MiB objects in S3 for several years. Some remain popular while others become cold and later popular again. Patterns are unpredictable. The company needs immediate access and wants automatic storage-cost optimization without maintaining age-based transition rules. Which option best fits?
  9. An editorial application frequently replaces files at the same S3 object keys. Editors must be able to recover a previous file after an accidental overwrite. Recovery must not depend on a separate nightly copy job. Which bucket feature best meets this requirement?
  10. A company manages 40 AWS accounts and authenticates employees through an existing SAML 2.0 identity provider. Engineers need centrally managed, temporary access to different AWS accounts according to their team membership. Which solution has the least ongoing administration?
  11. An application stores disposable session data in an ElastiCache Redis OSS replication group. It needs managed failover if the primary's Availability Zone fails. Which configuration best improves cache availability?
  12. A company has a predictable baseline of eligible compute spending for the next three years. It expects to move some workloads between EC2 instance families, Regions, and Fargate. It wants a commitment discount with flexibility across those choices. Which purchasing option best matches this requirement?
  13. An operator accidentally deletes rows from RDS for PostgreSQL at 14:10. Automated backups are enabled with a seven-day retention period, and the desired 14:09 recovery point is restorable. The team must recover that earlier state without modifying the current instance until recovery is validated. Which approach should it use?
  14. An application retrieves a database username and password for Amazon RDS for PostgreSQL. Security policy requires automatically changing the password every 30 days and allowing the application to retrieve the current value without a new deployment. Which solution has the least custom credential-management work?
  15. A telemetry application writes millions of independent device readings to DynamoDB. One table uses the constant value all-devices as its partition key and a timestamp as its sort key. Writes are throttled despite substantial table capacity. Queries normally retrieve one device's readings by time range. Which redesign best addresses the hot-key pattern?
  16. A document-processing service runs on EC2 instances in an Auto Scaling group. It must read objects only from the incoming/ prefix of one S3 bucket. The security team prohibits storing long-lived AWS credentials on instances. Which solution meets these requirements with the least credential-management overhead?
  17. A company serves a non-HTTP TCP application from two AWS Regions. Worldwide clients require a stable pair of anycast IP addresses and routing over the AWS global network to healthy regional endpoints. Which service best meets these requirements?
  18. A compliance team must discover which S3 objects contain passport numbers, payment-card numbers, or other sensitive personal information. It wants managed classification findings rather than a custom scanning application. Which service should it use?
  19. A security team wants managed detection of suspicious API activity and potential compromised credentials, including unusual calls associated with known threats. The team does not want to maintain its own detection engine. Which service most directly meets this requirement?
  20. A company runs an RDS for PostgreSQL database continuously. Its instance class, Region, and deployment configuration are expected to remain stable for three years. The company wants a discount on eligible database instance usage without changing the database engine. Which option is the best match?
  21. A company keeps newly uploaded S3 objects in one Region and needs asynchronous copies in a second Region for recovery. Existing historical objects will be handled separately. Which TWO configurations are required for cross-Region replication? (Choose TWO.)
  22. An Auto Scaling group processes SQS jobs. Average processing time is 10 seconds, and acceptable average queue wait is 120 seconds. CPU utilization is low because workers wait on external I/O. Which TWO choices provide an appropriate scaling signal and initial target? (Choose TWO.)
  23. A business must recover its application in a second Region within minutes. It already continuously replicates data there. It is willing to pay for a smaller but fully functional copy of the application that runs continuously and is scaled up during a disaster. Which disaster recovery strategy is described?
  24. EC2 instances in private subnets must retrieve Secrets Manager secrets. The VPC has no internet gateway or NAT gateway. DNS support is enabled. Which configuration provides private service access without adding an internet route?
  25. A multiplayer service uses a custom UDP protocol on EC2. Clients must connect through stable public IP addresses that can be allowlisted. The service runs in multiple Availability Zones. Which load-balancing option best matches the protocol and addressing requirements?
  26. A standard SQS queue feeds workers that occasionally encounter malformed messages. These messages fail repeatedly and consume processing capacity. Operations must inspect them separately after several failed deliveries. Which configuration is most appropriate?
  27. A stateless web service runs on one EC2 instance. Each instance can handle the entire normal workload. The service must remain available if one Availability Zone fails and must replace unhealthy instances automatically. Which design provides the best improvement with minimal application changes?
  28. An EC2 application uses a 200 GiB gp2 EBS volume. Its storage capacity is sufficient, but it needs more sustained IOPS without purchasing additional capacity solely to increase performance. Which change best meets this requirement?
  29. An upload API must acknowledge jobs quickly while workers process them asynchronously. Bursts can exceed worker capacity. Jobs must survive worker restarts, and a duplicate delivery must not create a duplicate invoice. Which TWO design choices meet these requirements? (Choose TWO.)
  30. An S3 bucket in account A stores objects encrypted with a customer managed KMS key in account A. A role in account B needs direct GetObject access without assuming a role in A. No explicit denies apply. Which TWO permission changes are required? (Choose TWO.)
  31. A tightly coupled simulation runs on supported EC2 instances. Workers exchange large volumes of data and require very low inter-instance network latency. This particular job can run within one Availability Zone. Which placement strategy is most appropriate?
  32. A database running on an appropriately sized Nitro-based EC2 instance needs 100,000 provisioned IOPS on one EBS volume, consistently low latency, and high durability. The required capacity and performance are within the selected io2 configuration's limits. Which volume type is most appropriate?
  33. An SQS worker usually finishes a job in 40 seconds, but some jobs take four minutes. The queue visibility timeout is 60 seconds, so another worker sometimes starts the same unfinished job. Which change best reduces premature redelivery while keeping recovery possible after a worker failure?
  34. A website serves versioned JavaScript files through CloudFront from S3. Filenames change whenever contents change, and each version can be cached for one year. The origin is receiving excessive requests because the files currently expire from caches after seconds. Which change best improves delivery efficiency?
  35. A company must keep large audit objects for seven years. Access is extremely rare, and a retrieval wait of up to 48 hours is acceptable. The company already has separate controls for mandatory retention. Among the following storage classes, which best minimizes long-term storage cost for this access pattern?
  36. A company stores confidential reports in S3. It requires server-side encryption and must control the key policy, audit use of the encryption key, and disable that key when access must be suspended. Which option best meets these key-management requirements?
  37. A company has a working Direct Connect path between its data center and AWS. An audit now requires IPsec encryption for traffic on that path. The company wants to retain Direct Connect connectivity. Which approach meets the requirement?
  38. An analysis job runs as an IAM role in account A. It needs temporary read access to a role named ReportReader in account B. ReportReader already has the required S3 read permissions. No SCP or permissions boundary denies the operation. Which TWO configurations are required? (Choose TWO.)
  39. A SaaS vendor assumes an IAM role in each customer's AWS account to read billing data. A customer wants to prevent another vendor customer from tricking the vendor into assuming this role on the wrong customer's behalf. Which control should the customer add?
  40. A company delivers training videos through CloudFront from an S3 bucket's REST endpoint. Videos must be accessible through the designated distribution, but direct anonymous S3 requests must fail. Which solution meets these requirements?
  41. A regulated company must retain each S3 record for seven years. During retention, even the account root user must be unable to delete or shorten protection for the retained object version. Which configuration meets this requirement?
  42. An engineering team wants email notifications when its monthly AWS costs exceed a configured amount or are forecast to exceed that amount. The notifications should not require the team to inspect a report manually. Which service is the best fit?
  43. A company uses AWS Organizations with all features enabled. Administrators in member accounts currently have broad IAM permissions. The company must prevent ordinary IAM principals in an organizational unit from disabling CloudTrail, even when those principals have AdministratorAccess. Which approach is most appropriate?
  44. A research team stores datasets in S3 and uses a Linux compute cluster for simulations. Jobs require a shared POSIX file system with very high aggregate throughput and low-latency parallel access. The team wants integration with the S3 datasets. Which service is the best fit?
  45. A company has packaged a stateless HTTP service as a container. It needs managed scheduling, automatic replacement of failed tasks, and scaling across two Availability Zones. The team does not want to patch or size EC2 container hosts. Which design best meets these requirements?
  46. A company needs to deliver a continuous stream of application events to S3. It can tolerate buffering for a few minutes and wants optional managed transformation before delivery. It does not need custom per-record consumers or replay from the delivery service. Which option has the least stream-delivery administration?
  47. An insurance workflow validates a document, calls an external service, waits for a human decision, and then sends a notification. Individual steps need retries and separate failure handling. The workflow can run for several days. Which service is the best managed coordinator?
  48. A company migrates a Windows application to EC2. It requires a managed shared file system using SMB, Windows ACLs, and integration with the company's Active Directory. Application changes must be minimal. Which storage service best meets these requirements?
  49. A company uploads large files to S3 with multipart upload. Some clients disconnect permanently before completing their uploads. Storage charges continue to grow even though the unfinished files do not appear as completed objects. Which bucket configuration best addresses the abandoned parts?
  50. A Linux application runs on EC2 instances across two Availability Zones. All instances need concurrent NFS access to the same durable files, including when instances are replaced. The team wants managed regional storage rather than operating file servers. Which design best meets these requirements?
  51. A company runs an active application in one Region and a ready standby in another. It wants Route 53 to return the standby endpoint after health evaluation marks the primary unhealthy. Which routing policy is most suitable?
  52. A payment system requires events for each individual account to be processed in order. Events for different accounts should be processed concurrently. Producers also need FIFO deduplication for retried sends. Which TWO settings best support this design? (Choose TWO.)
  53. An RDS for MySQL database serves orders and reporting queries. Long-running reports consume resources needed by writes. Reports can tolerate replication lag of several seconds. The company wants to keep the current database engine. Which change best isolates the reporting workload?
  54. A consumer application needs self-service registration, password reset, MFA, and sign-in through external social identity providers. Its backend will validate tokens before serving API requests. Which AWS service best supplies the managed user directory and authentication flow?
  55. A public ALB forwards HTTPS traffic to application instances on TCP 8080. Those instances connect to RDS for PostgreSQL on TCP 5432. The application and database are private. Which TWO inbound security-group rules enforce access between these tiers without hard-coded instance IP addresses? (Choose TWO.)
  56. Every new order must be processed by billing, inventory, and analytics. Each team must receive every event and retry independently when its service is unavailable. Which TWO components form an appropriate managed fanout design? (Choose TWO.)
  57. A company runs a large nightly rendering workload. Tasks are independent, checkpoint progress, and can tolerate interruption and retry. The completion window has several hours of flexibility. Which TWO choices best reduce compute cost while making interruptions manageable? (Choose TWO.)
  58. An application uses Aurora PostgreSQL in one Region. It needs a second Region for local reads and disaster recovery. Small replication lag and potential loss of recent transactions during an unplanned regional outage are acceptable. The team wants a managed cross-Region design. Which solution best fits?
  59. A DynamoDB-backed catalog repeatedly reads a small set of items. It needs lower read latency and fewer repeated table reads. These reads can be eventually consistent, and the team wants a DynamoDB-compatible managed cache. Which option is most appropriate?
  60. A VPC has existing zonal NAT gateways in Availability Zones A and B. Private workers in zone B currently send outbound internet traffic through the NAT gateway in zone A, incurring cross-AZ data transfer. Both gateways must remain deployed for other workloads. Which change best reduces this traffic cost while preserving private worker addressing?
  61. An internal tool receives a few hundred requests daily, with many hours of no traffic. Each request performs two seconds of stateless processing, fits within Lambda limits, and can tolerate normal cold-start latency. Which compute design is generally the most cost-effective of the following for avoiding idle server charges?
  62. A new DynamoDB application has long quiet periods and unpredictable bursts. The team cannot confidently forecast read or write demand and wants request-based billing without selecting provisioned capacity units in advance. Which capacity mode best fits this requirement?
  63. A development team uses EBS-backed EC2 instances only on weekdays from 08:00 to 18:00. Work may resume the next morning, so EBS data must persist. The team wants to reduce compute charges outside those hours. Which TWO statements describe an appropriate approach? (Choose TWO.)
  64. An application uses an RDS for MySQL Single-AZ DB instance. It needs managed automatic failover after an Availability Zone failure. It does not need additional read capacity. Which change meets these requirements with the least database administration?
  65. A flash-sale API uses Lambda and RDS for PostgreSQL. Sudden Lambda concurrency creates many short-lived database connections, exhausting the database's connection limit. The company wants a managed connection-pooling layer without changing the database engine. Which service should it add?

Comments — 0