SAA-C03 Real Exam Questions and Verified Answers

Question 1 Single choice

A company uses an organization in AWS Organizations to manage five AWS accounts. The company requires a centralized solution to prevent anyone from creating IAM users or access keys in any account.

Which solution will meet this requirement with the LEAST administrative overhead?

A
Attach a service control policy SCP to the organization root that denies the creation of IAM users and access keys.
B
Add IAM inline policies to every user that block the creation of IAM users and access keys.
C
Enable Amazon GuardDuty in a delegated administrator account to detect the creation of IAM users and access keys.
D
Create AWS Config rules to automatically delete new IAM users and access keys after they are created.

Show answer and explanation

Correct answer: A

Explanation

Aservice control policyattached at the organization root is the right preventive control because SCPs define the maximum permissions for principals in member accounts across the organization. AWS documentation states that SCPs restrict permissions for IAM users and roles in member accounts and that an explicit deny overrides allows from other policies. That makes an SCP the cleanest centralized way to block creation of IAM users and access keys everywhere. Inline user policies would be harder to maintain, and GuardDuty or Config would be detective or corrective controls rather than the preventive control the question asks for.

Question 2 Single choice

A weather forecasting company needs to process hundreds of gigabytes of data with sub-millisecond latency. The company has a high performance computing (HPC) environment in its data center and wants to expand its forecasting capabilities.

A solutions architect must identify a highly available cloud storage solution that can handle large amounts of sustained throughput Files that are stored in the solution should be accessible to thousands of compute instances that will simultaneously access and process the entire dataset.

What should the solutions architect do to meet these requirements?

A
Use Amazon FSx for Lustre scratch file systems
B
Use Amazon FSx for Lustre persistent file systems.
C
Use Amazon Elastic File System (Amazon EFS) with Bursting Throughput mode.
D
Use Amazon Elastic File System (Amazon EFS) with Provisioned Throughput mode.

Show answer and explanation

Correct answer: B

Explanation

Amazon FSx for Lustre: Lustre is a high-performance file system designed for workloads that require fast storage with sustained high throughput and low latency. It integrates with Amazon S3, making it suitable for HPC environments.

Persistent File Systems:
Persistent Storage: Suitable for long-term storage and recurrent use, providing durability and availability.
High Throughput and Low Latency: Persistent Lustre file systems can handle large amounts of data with sub-millisecond latency, meeting the needs of high-performance computing workloads.

Simultaneous Access: FSx for Lustre allows thousands of compute instances to access and process large datasets concurrently, ensuring that the high volume of data is handled efficiently.

Highly Available: FSx for Lustre is designed to provide high availability and is managed by AWS, reducing the operational burden.

References:
Amazon FSx for Lustre High-Performance Computing on AWS

Question 3 Single choice

A company has an on-premises SFTP file transfer solution. The company is migrating to the AWS Cloud to scale the file transfer solution and to optimize costs by using Amazon S3. The company ' s employees will use their credentials for the on-premises Microsoft Active Directory (AD) to access the new solution.
The company wants to keep the current authentication and file access mechanisms.

Which solution will meet these requirements with the LEAST operational overhead?

A
Configure an S3 File Gateway. Create SMB file shares on the file gateway that use the existing Active Directory to authenticate
B
Configure an Auto Scaling group with Amazon EC2 instances to run an SFTP solution Configure the group to scale up at 60% CPU utilization.
C
Create an AWS Transfer Family server with SFTP endpoints Choose the AWS Directory Service option as the identity provider Use AD Connector to connect the on-premises Active Directory.
D
Create an AWS Transfer Family SFTP endpoint. Configure the endpoint to use the AWS Directory Service option as the identity provider to connect to the existing Active Directory.

Show answer and explanation

Correct answer: C

Explanation

AWS Transfer Family: This service provides fully managed support for file transfers directly into and out of Amazon S3 using the SFTP, FTPS, and FTP protocols.

SFTP Endpoints:
Set up an AWS Transfer Family server and configure SFTP endpoints to handle the file transfers.
This service is scalable and managed, reducing operational overhead compared to running an SFTP solution on EC2 instances.

Integration with Active Directory: Choose the AWS Directory Service option as the identity provider for the Transfer Family server.

Use AD Connector to link the on-premises Active Directory with AWS, allowing employees to use their existing AD credentials to access the SFTP service.

Operational Efficiency: This solution leverages managed services for both file transfer and identity management, ensuring minimal changes to the current authentication mechanisms and reducing operational overhead.

References:
AWS Transfer Family
AWS Directory Service and AD Connector

Question 4 Single choice

A company uses Amazon Redshift to store structured data and Amazon S3 to store unstructured data. The company wants to analyze the stored data and create business intelligence reports. The company needs a data visualization solution that is compatible with Amazon Redshift and Amazon S3.

Which solution will meet these requirements?

A
Use Amazon Redshift query editor v2 to analyze data stored in Amazon Redshift. Use Amazon Athena to analyze data stored in Amazon S3. Use Amazon QuickSight to access Amazon Redshift and Athena, visualize the data analyses, and create business intelligence reports.
B
Use Amazon Redshift Serverless to analyze data stored in Amazon Redshift. Use Amazon S3 Object Lambda to analyze data stored in Amazon S3. Use Amazon Managed Grafana to access Amazon Redshift and Object Lambda, visualize the data analyses, and create business intelligence reports.
C
Use Amazon Redshift Spectrum to analyze data stored in Amazon Redshift. Use Amazon Athena to analyze data stored in Amazon S3. Use Amazon QuickSight to access Amazon Redshift and Athena, visualize the data analyses, and create business intelligence reports.
D
Use Amazon OpenSearch Service to analyze data stored in Amazon Redshift and Amazon S3. Use Amazon Managed Grafana to access OpenSearch Service, visualize the data analyses, and create business intelligence reports.

Show answer and explanation

Correct answer: C

Explanation

This solution leverages:
Amazon Redshift Spectrum to query S3 data directly from Redshift.
Amazon Athena for ad-hoc analysis of S3 data.

Amazon QuickSight for unified visualization from multiple data sources.
"Redshift Spectrum enables you to run queries against exabytes of data in Amazon S3 without having to load or transform the data."

"QuickSight supports both Amazon Redshift and Amazon Athena as data sources."
- Redshift Spectrum
- Amazon QuickSight Supported Data Sources
This architecture allows scalable querying and visualization with minimum ETL overhead, ideal for BI dashboards.

Incorrect Options:
A: The query editor is not a BI tool.
B, D: Grafana is better for time-series data, not structured analytics or BI reports.

References:
Redshift Spectrum
Amazon QuickSight Integration

Question 5 Single choice

A company runs multiple Windows workloads on AWS. The company's employees use Windows file shares that are hosted on two Amazon EC2 instances. The file shares synchronize data between themselves and maintain duplicate copies.
The company wants a highly available and durable storage solution that preserves how users currently access the files.

What should a solutions architect do to meet these requirements?

A
Migrate all the data to Amazon S3. Set up IAM authentication for users to access files.
B
Set up an Amazon S3 File Gateway. Mount the S3 File Gateway on the existing EC2 instances.
C
Extend the file share environment to Amazon FSx for Windows File Server with a Multi-AZ configuration. Migrate all the data to FSx for Windows File Server.
D
Extend the file share environment to Amazon Elastic File System (Amazon EFS) with a Multi-AZ configuration. Migrate all the data to Amazon EFS.

Show answer and explanation

Correct answer: C

Question 6 Single choice

A company requires centralized auditing for all AWS accounts and compliance monitoring against AWS Foundational Security Best Practices (FSBP) with minimal operational overhead.

Which solution will meet these requirements?

A
Deploy AWS Control Tower in the management account. Enable AWS Security Hub and Account Factory.
B
Deploy AWS Control Tower in a member account.
C
Use AWS Managed Services (AMS) with GuardDuty.
D
Use AWS Managed Services (AMS) with Security Hub.

Show answer and explanation

Correct answer: A

Explanation

AWS Control Tower provides automatic account governance, centralized logging, CloudTrail aggregation, and integrates directly with AWS Security Hub, which evaluates compliance against FSBP standards. This is the lowest operational overhead AWS-native solution.

Question 7 Single choice

A company is designing an application on AWS that provides real-time dashboards. The dashboard data comes from on-premises databases that use a variety of schemas and formats. The company needs a solution to transfer and transform the data to AWS with minimal latency.

Which solution will meet these requirements?

A
Integrate the dashboard with Amazon Managed Streaming for Apache Kafka (Amazon MSK) to transfer and transform the data from the on-premises databases to the dashboards.
B
Use Amazon Data Firehose to transfer the data to an Amazon S3 Bucket. Configure the dashboard application to import new data from the S3 bucket periodically.
C
Use AWS Database Migration Service (AWS DMS) Schema Conversion to consolidate the on-premises databases into a single AWS database. Use an AWS Lambda function that is scheduled by Amazon EventBridge to transfer data from the consolidated database to the dashboard application.
D
Use AWS DataSync to transfer data from the source databases to the dashboard application continuously. Configure the dashboard application to import data from DataSync.

Show answer and explanation

Correct answer: A

Explanation

Amazon MSK is a fully managed, highly available Apache Kafka service for streaming data with low latency. Kafka Connect and stream processors enable ingest from heterogeneous sources and perform in-stream transformation before delivery to consumers (e.g., the dashboard service). This satisfies real-time updates from diverse schemas and formats. Kinesis alternatives could work, but among the given choices, MSK is the only streaming option designed for sub-second, continuous pipelines. Kinesis Data Firehose (B) buffers and batches data to S3 and is optimized for delivery to storage, not low-latency dashboards. AWS DMS schema conversion (C) focuses on database migration, not ongoing real-time, multi-format streaming for dashboards. AWS DataSync (D) is for file/object transfer, not database change streams. Hence, MSK best meets minimal-latency, transform-in-flight needs with managed operations.

References:
Amazon MSK - real-time streaming, low latency, Kafka Connect/Streams for transformations Well-Architected Performance Efficiency - use streaming for real-time analytics.

Question 8 Single choice

A company runs several custom applications on Amazon EC2 instances. Each team within the company manages its own set of applications and backups. To comply with regulations, the company must be able to report on the status of backups and ensure that backups are encrypted.

Which solution will meet these requirements with the LEAST effort?

A
Create an AWS Lambda function that processes AWS Config events. Configure the Lambda function to query AWS Config for backup-related data and to generate daily reports.
B
Check the backup status of the EC2 instances daily by reviewing the backup configurations in AWS Backup and Amazon Elastic Block Store (Amazon EBS) snapshots.
C
Use an AWS Lambda function to query Amazon EBS snapshots, Amazon RDS snapshots, and AWS Backup jobs. Configure the Lambda function to process and report on the data. Schedule the function to run daily.
D
Use AWS Config and AWS Backup Audit Manager to ensure compliance. Review generated reports daily.

Show answer and explanation

Correct answer: D

Explanation

AWS Backup Audit Manager automates auditing and reporting of backup activity and compliance, while AWS Config provides visibility into configuration changes. Together, they provide the simplest, most automated, and compliant backup monitoring solution. From AWS Documentation:

"AWS Backup Audit Manager automatically audits backup activity across AWS resources. You can use predefined or custom frameworks to monitor backup compliance and encryption status." (Source: AWS Backup Audit Manager User Guide)
Why D is correct: Ensures centralized visibility into all backup jobs.
Verifies encryption status automatically.
Generates ready-to-use reports with minimal operational overhead.
Complies with regulatory requirements for data protection.
Why others are incorrect: A & C: Custom Lambda automation increases maintenance effort.
B: Manual checking is operationally inefficient and error-prone.

References:
AWS Backup Audit Manager User Guide
AWS Config Documentation - "Compliance and Monitoring"
AWS Well-Architected Framework - Operational Excellence Pillar

Question 9 Single choice

A financial services company needs to migrate an on-premises MySQL database workload to AWS. The database requires consistent low-latency performance with a baseline of 32,000 IOPS to process transactions.

Which solution will meet these requirements?

A
Migrate the database to an Amazon S3 bucket. Enable S3 Transfer Acceleration.
B
Migrate the data to a Provisioned IOPS SSD io2 Amazon EBS Express volume.
C
Migrate the data to an Amazon EFS Standard file system.
D
Migrate the data to a General Purpose SSD gp3 Amazon EBS volume.

Show answer and explanation

Correct answer: B

Explanation

The correct answer isProvisioned IOPS SSD io2 Block Express. AWS documents that io2 Block Express is recommended for I/O-intensive, latency-sensitive workloads and is designed for consistent sub-millisecond latency with very high IOPS limits. AWS also notes that many instance types can achieve up to32,000 IOPS, which matches the baseline requirement in the question. S3 is object storage and not suitable for a transactional MySQL database. EFS is a shared file system, not the preferred low-latency block storage for this database pattern. gp3 is versatile and cost-effective, but it is not the targeted choice when the requirement explicitly emphasizes sustained, low-latency 32,000 IOPS performance. (AWS Documentation)

Question 10 Single choice

A company uses AWS Organizations to manage multiple AWS accounts. Each department in the company has its own AWS account. A security team needs to implement centralized governance and control to enforce security best practices across all accounts. The team wants to have control over which AWS services each account can use. The team needs to restrict access to sensitive resources based on IP addresses or geographic regions. The root user must be protected with multi-factor authentication (MFA) across all accounts.

Which solution will meet these requirements?

A
Use AWS Identity and Access Management (IAM) to manage IAM users and IAM roles in each account. Implement MFA for the root user in each account. Enforce service restrictions by using AWS managed prefix lists.
B
Use AWS Control Tower to establish a multi-account environment. Use service control policies (SCPs) to enforce service restrictions in AWS Organizations. Configure MFA for the root user across all accounts.
C
Use AWS Systems Manager to enforce service restrictions across multiple accounts. Use IAM policies to enforce MFA for the root user across all accounts.
D
Use AWS IAM Identity Center to manage user access and to enforce service restrictions by using permissions boundaries in each account.

Show answer and explanation

Correct answer: B

Explanation

Option B is the best centralized-governance design. AWS Control Tower establishes a governed multi-account landing zone, and AWS Organizations service control policies can restrict services and use global condition keys to restrict requests by Region or source IP where those condition keys apply.

Root-user protection still requires an explicit account-security process: configure MFA for each root user, or use AWS Organizations centralized root access so member accounts do not retain root credentials. Control Tower provides governance and controls, but it does not silently attach an MFA device to every root user. The other options do not provide an organization-wide service-control boundary.

References: AWS Control Tower controls; AWS Organizations service control policies; centralized root access for member accounts.