Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 1351:

  A large financial services company uses Amazon ElastiCache (Redis OSS) for its new application that has a global user base. A solutions architect must develop a caching solution that will be available across AWS Regions and include low-latency replication and failover capabilities for disaster recovery (DR). The company's security team requires the encryption of cross-Region data transfers.

  Which solution meets these requirements with the LEAST amount of operational effort?

  A. Enable cluster mode in ElastiCache (Redis OSS). Then create multiple clusters across Regions and replicate the cache data by using AWS Database Migration Service (AWS DMS). Promote a cluster in the failover Region to handle production traffic when DR is required.
  B. Create a global data store in ElastiCache (Redis OSS). Then create replica clusters in two other Regions. Promote one of the replica clusters as primary when DR is required.
  C. Disable cluster mode in ElastiCache (Redis OSS). Then create multiple replication groups across Regions and replicate the cache data by using AWS Database Migration Service (AWS DMS). Promote a replication group in the failover Region to primary when DR is required.
  D. Create a snapshot of ElastiCache (Redis OSS) in the primary Region and copy it to the failover Region.Use the snapshot to restore the cluster from the failover Region when DR is required.
  B. Create a global data store in ElastiCache (Redis OSS). Then create replica clusters in two other Regions. Promote one of the replica clusters as primary when DR is required.

  ---

  Explanation

  The optimal solution for low-latency global caching with disaster recovery and cross-Region replication is to use Amazon ElastiCache Global Datastore for Redis OSS.

  A Global Datastore enables fully managed cross-Region replication and supports automatic failover by promoting read replica clusters in another Region. ElastiCache ensures encryption in-transit and at-rest, meeting compliance and security requirements.

  It's a fully managed AWS-native feature, reducing operational effort compared to setting up DMS-based or snapshot-based replication manually.

  Other options (A, C, D):

  Require manual setup and management (e.g., custom DMS pipelines, snapshots).

  Do not offer real-time replication or failover without manual intervention.

  References:

  ElastiCache Global Datastore for Redis

• Question 1352:

  A company has a business system that generates hundreds of reports each day. The business system saves the reports to a network share in CSV format. The company needs to store this data in the AWS Cloud in near-real time for analysis.

  Which solution will meet these requirements with the LEAST administrative overhead?

  A. Use AWS DataSync to transfer the files to Amazon S3. Create a scheduled task that runs at the end of each day.
  B. Create an Amazon S3 File Gateway. Update the business system to use a new network share from the S3 File Gateway.
  C. Use AWS DataSync to transfer the files to Amazon S3. Create an application that uses the DataSync API in the automation workflow.
  D. Deploy an AWS Transfer for SFTP endpoint. Create a script that checks for new files on the network share and uploads the new files by using SFTP.
  B. Create an Amazon S3 File Gateway. Update the business system to use a new network share from the S3 File Gateway.

• Question 1353:

  A large media company hosts a web application on AWS. The company wants to start caching confidential media files so that users around the world will have reliable access to the files. The content is stored in Amazon S3 buckets. The company must deliver the content quickly, regardless of where the requests originate geographically.

  Which solution will meet these requirements?

  A. Use AWS DataSync to connect the S3 buckets to the web application.
  B. Deploy AWS Global Accelerator to connect the S3 buckets to the web application.
  C. Deploy Amazon CloudFront to connect the S3 buckets to CloudFront edge servers.
  D. Use Amazon Simple Queue Service (Amazon SQS) to connect the S3 buckets to the web application.
  C. Deploy Amazon CloudFront to connect the S3 buckets to CloudFront edge servers.

• Question 1354:

  A company has an application that runs on Amazon EC2 instances and uses an Amazon Aurora database.

  The EC2 instances connect to the Aurora database by using user names and passwords that the company stores locally in a file. The company changes the user names and passwords every month. The company wants to minimize the operational overhead of credential management.

  Which solution will meet these requirements?

  A. Store the credentials as a secret within AWS Secrets Manager. Assign IAM permissions to the secret. Reconfigure the application to call the secret. Enable rotation on the secret and configure rotation to occur on a monthly schedule.
  B. Use AWS Systems Manager Parameter Store to create a new parameter for the credentials. Use IAM policies to restrict access to the parameter. Reconfigure the application to access the parameter.
  C. Create an Amazon S3 bucket to store objects. Use an AWS Key Management Service (AWS KMS) key to encrypt the objects. Migrate the credentials file to the S3 bucket. Update the application to retrieve the credentials file from the S3 bucket.
  D. Create an encrypted Amazon Elastic Block Store (Amazon EBS) volume for each EC2 instance. Attach the encrypted EBS volumes to the EC2 instances. Migrate the credentials file to the new EBS volumes.
  A. Store the credentials as a secret within AWS Secrets Manager. Assign IAM permissions to the secret. Reconfigure the application to call the secret. Enable rotation on the secret and configure rotation to occur on a monthly schedule.

  ---

  Explanation

  AWS Secrets Manager is purpose-built to securely store, manage, and rotate sensitive credentials such as database user names and passwords. Option A is the most operationally efficient solution because it eliminates manual password rotation, reduces human error, and centralizes secret lifecycle management.

  Secrets Manager integrates natively with Amazon Aurora, enabling automated credential rotation using AWS-managed or custom Lambda rotation logic. Once rotation is enabled, Secrets Manager updates the database credentials and stores the new values securely without requiring administrators to manually update files on EC2 instances.

  By assigning IAM permissions to the secret, access can be tightly controlled using least-privilege principles. The application retrieves credentials at runtime, removing the need to store passwords locally on disk, which significantly improves security posture. Secrets Manager also provides auditing capabilities through AWS CloudTrail, allowing visibility into secret access and changes.

  Option B (Systems Manager Parameter Store) can securely store secrets, but automated rotation is not natively supported in the same way as Secrets Manager. Implementing rotation with Parameter Store would require additional custom automation, increasing operational complexity.

  Option C stores credentials in S3, which is not designed for frequent credential rotation or secure secret access patterns, even when encrypted.

  Option D only encrypts credentials at rest on individual instances and does not address rotation, distribution, or centralized management, resulting in high operational overhead.

  Therefore, A best meets the requirements by providing secure storage, automated monthly rotation, fine-grained access control, and minimal operational effort, aligning with AWS security and operational excellence best practices.

• Question 1355:

  A company has an application that runs on several Amazon EC2 instances. Each EC2 instance has multiple Amazon Elastic Block Store (Amazon EBS) data volumes attached to it. The application's EC2 instance configuration and data need to be backed up nightly. The application also needs to be recoverable in a different AWS Region.

  Which solution will meet these requirements in the MOST operationally efficient way?

  A. Write an AWS Lambda function that schedules nightly snapshots of the application's EBS volumes and copies the snapshots to a different Region.
  B. Create a backup plan by using AWS Backup to perform nightly backups. Copy the backups to another Region. Add the application's EC2 instances as resources.
  C. Create a backup plan by using AWS Backup to perform nightly backups. Copy the backups to another Region. Add the application's EBS volumes as resources.
  D. Write an AWS Lambda function that schedules nightly snapshots of the application's EBS volumes and copies the snapshots to a different Availability Zone.
  B. Create a backup plan by using AWS Backup to perform nightly backups. Copy the backups to another Region. Add the application's EC2 instances as resources.

• Question 1356:

  A company needs to allow a vendor to access CloudWatch Logs in the company's AWS account by using IAM roles for cross-account access.

  Which solution will meet these requirements?

  A. Create roles in both accounts and trust the company role.
  B. Create a role in the vendor account and trust the company role.
  C. Create a role in the company account and trust the company role.
  D. Create a role in the company account with permissions and trust the vendor role.
  D. Create a role in the company account with permissions and trust the vendor role.

  ---

  Explanation

  For cross-account access, the standard AWS pattern is to create an IAM role in the resource-owning account (the company's account) and configure the trust policy to allow the external vendor account to assume that role.

  Option D correctly follows this model. The company creates an IAM role with the necessary CloudWatch Logs permissions and configures the trust policy to trust the vendor's IAM role ARN. The vendor then assumes this role to access logs securely. The other options misconfigure trust relationships or place permissions in the wrong account, breaking the cross-account access model. Therefore, D is the correct solution.

• Question 1357:

  A company uses Amazon EC2 instances to host its internal systems. As part of a deployment operation, an administrator tries to use the AWS CLI to terminate an EC2 instance. However, the administrator receives a 403 (Access Denied) error message. The administrator is using an IAM role that has the following IAM policy attached:

  

  What is the cause of the unsuccessful request?

  A. The EC2 instance has a resource-based policy with a Deny statement.
  B. The principal has not been specified in the policy statement.
  C. The "Action" field does not grant the actions that are required to terminate the EC2 instance.
  D. The request to terminate the EC2 instance does not originate from the CIDR blocks 192.0.2.0/24 or 203.0.113.0/24.
  D. The request to terminate the EC2 instance does not originate from the CIDR blocks 192.0.2.0/24 or 203.0.113.0/24.

• Question 1358:

  A company manages an application that stores data on an Amazon RDS for PostgreSQL Multi-AZ DB instance. Increases in traffic are causing performance problems. The company determines that database queries are the primary reason for the slow performance.

  What should a solutions architect do to improve the application's performance?

  A. Serve read traffic from the Multi-AZ standby replica.
  B. Configure the DB instance to use Transfer Acceleration.
  C. Create a read replica from the source DB instance. Serve read traffic from the read replica.
  D. Use Amazon Kinesis Data Firehose between the application and Amazon RDS to increase the concurrency of database requests.
  C. Create a read replica from the source DB instance. Serve read traffic from the read replica.

• Question 1359:

  A company runs an application on Microsoft SQL Server databases in an on-premises data center. The company wants to migrate to AWS and optimize costs for its infrastructure on AWS.

  Which solution will meet these requirements?

  A. Migrate the databases to Amazon EC2 instances that use SQL Server Amazon Machine Images (AMIs) provided by AWS.
  B. Migrate to Amazon Aurora PostgreSQL by using Babelfish for Aurora PostgreSQL.
  C. Migrate the databases to a PostgreSQL database that runs on Amazon EC2 instances.
  D. Migrate the databases to Amazon RDS for Microsoft SQL Server.
  B. Migrate to Amazon Aurora PostgreSQL by using Babelfish for Aurora PostgreSQL.

  ---

  Explanation

  Amazon Aurora PostgreSQL with Babelfish allows SQL Server applications to run directly on Aurora PostgreSQL with minimal code changes. Babelfish adds a SQL Server-compatible endpoint, significantly lowering costs compared to running licensed SQL Server instances on RDS or EC2.

  AWS Documentation Extract:

  "Babelfish for Aurora PostgreSQL enables Aurora to understand T-SQL and SQL Server wire protocol, allowing you to run SQL Server applications on Amazon Aurora PostgreSQL with lower costs." (Source: Babelfish for Aurora PostgreSQL documentation)

  Option A, Option D: SQL Server on EC2 or RDS incurs high Microsoft licensing costs.

  Option C: Plain PostgreSQL would require more code refactoring than Babelfish.

  References:

  AWS Certified Solutions Architect?Official Study Guide, Babelfish and Cost Optimization.

• Question 1360:

  A company wants to ingest customer payment data into the company's data lake in Amazon S3. The company receives payment data every minute on average. The company wants to analyze the payment data in real time. Then the company wants to ingest the data into the data lake.

  Which solution will meet these requirements with the MOST operational efficiency?

  A. Use Amazon Kinesis Data Streams to ingest data. Use AWS Lambda to analyze the data in real time.
  B. Use AWS Glue to ingest data. Use Amazon Kinesis Data Analytics to analyze the data in real time.
  C. Use Amazon Kinesis Data Firehose to ingest data. Use Amazon Kinesis Data Analytics to analyze the data in real time.
  D. Use Amazon API Gateway to ingest data. Use AWS Lambda to analyze the data in real time.
  C. Use Amazon Kinesis Data Firehose to ingest data. Use Amazon Kinesis Data Analytics to analyze the data in real time.