Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 1481:

  A company is hosting a website behind multiple Application Load Balancers. The company has different distribution rights for its content around the world. A solutions architect needs to ensure that users are served the correct content without violating distribution rights.

  Which configuration should the solutions architect choose to meet these requirements?

  A. Configure Amazon CloudFront with AWS WAF.
  B. Configure Application Load Balancers with AWS WAF
  C. Configure Amazon Route 53 with a geolocation policy
  D. Configure Amazon Route 53 with a geoproximity routing policy
  C. Configure Amazon Route 53 with a geolocation policy

• Question 1482:

  A company wants to host a scalable web application on AWS. The application will be accessed by users from different geographic regions of the world. Application users will be able to download and upload unique data up to gigabytes in size.

  The development team wants a cost-effective solution to minimize upload and download latency and maximize performance.

  What should a solutions architect do to accomplish this?

  A. Use Amazon S3 with Transfer Acceleration to host the application.
  B. Use Amazon S3 with CacheControl headers to host the application.
  C. Use Amazon EC2 with Auto Scaling and Amazon CloudFront to host the application.
  D. Use Amazon EC2 with Auto Scaling and Amazon ElastiCache to host the application.
  A. Use Amazon S3 with Transfer Acceleration to host the application.

• Question 1483:

  A company plans to deploy an application that uses an Amazon CloudFront distribution. The company will set an Application Load Balancer (ALB) as the origin for the distribution. The company wants to ensure that users access the ALB only through the CloudFront distribution. The company plans to deploy the solution in a new VPC.

  Which solution will meet these requirements?

  A. Configure the network ACLs in the subnet where the ALB is deployed to allow inbound traf-fic only from the public IP addresses of the CloudFront edge locations.
  B. Create a VPC origin for the CloudFront distribution. Set the VPC origin Amazon Resource Name (ARN) to the ARN of the ALB.
  C. Create a security group that allows only inbound traffic from the public IP addresses of the CloudFront edge locations. Associate the security group with the ALB.
  D. Create a VPC origin for the CloudFront distribution. Configure an ALB rule. Set the source IP condition to allow traffic only from the public IP addresses of the CloudFront edge locations.
  C. Create a security group that allows only inbound traffic from the public IP addresses of the CloudFront edge locations. Associate the security group with the ALB.

  ---

  Explanation

  To ensure ALB access only via CloudFront, AWS prescribes restricting the origin to traffic from CloudFront.

  For ALB origins, the standard pattern is to allow inbound to the ALB only from CloudFront edge IP ranges using security groups or ALB listener rules. Network ACLs are coarse and stateless and add operational burden. CloudFront does not have a "VPC origin" object; instead, CloudFront references the ALB DNS name. By limiting the ALB's security group to CloudFront IP ranges, direct client access to the ALB is blocked while CloudFront remains permitted. This aligns with security best practices to "restrict origin access to only CloudFront" and use SGs for instance/ALB layer controls.

  References:

  Amazon CloudFront Developer Guide -- Restricting access to Application Load Balancers

  Elastic Load Balancing Security Groups

  Well-Architected Security Pillar (protect origins, least privilege at network layer).

• Question 1484:

  A company wants to create a mobile app that allows users to stream slow-motion video clips on their mobile devices. Currently, the app captures video clips and uploads the video clips in raw format into an Amazon S3 bucket. The app retrieves these video clips directly from the S3 bucket. However, the videos are large in their raw format. Users are experiencing issues with buffering and playback on mobile devices.

  The company wants to implement solutions to maximize the performance and scalability of the app while minimizing operational overhead.

  Which combination of solutions will meet these requirements? (Choose two.)

  A. Deploy Amazon CloudFront for content delivery and caching.
  B. Use AWS DataSync to replicate the video files across AW'S Regions in other S3 buckets.
  C. Use Amazon Elastic Transcoder to convert the video files to more appropriate formats.
  D. Deploy an Auto Sealing group of Amazon EC2 instances in Local Zones for content delivery and caching.
  E. Deploy an Auto Scaling group of Amazon EC2 instances to convert the video files to more appropriate formats.
  A. Deploy Amazon CloudFront for content delivery and caching.

• Question 1485:

  A company runs a containerized application on a Kubernetes cluster in an on-premises data center. The company is using a MongoDB database for data storage. The company wants to migrate some of these environments to AWS, but no code changes or deployment method changes are possible at this time. The company needs a solution that minimizes operational overhead.

  Which solution meets these requirements?

  A. Use Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 worker nodes for compute and MongoDB on EC2 for data storage.
  B. Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate for compute and Amazon DynamoDB for data storage
  C. Use Amazon Elastic Kubernetes Service (Amazon EKS) with Amazon EC2 worker nodes for compute and Amazon DynamoDB for data storage.
  D. Use Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate for compute and Amazon DocumentDB (with MongoDB compatibility) for data storage.
  D. Use Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate for compute and Amazon DocumentDB (with MongoDB compatibility) for data storage.

• Question 1486:

  A company runs an application that uses Amazon RDS for PostgreSQL. The application receives traffic only on weekdays during business hours. The company wants to optimize costs and reduce operational overhead based on this usage.

  Which solution will meet these requirements?

  A. Use the Instance Scheduler on AWS to configure start and stop schedules.
  B. Turn off automatic backups. Create weekly manual snapshots of the database.
  C. Create a custom AWS Lambda function to start and stop the database based on minimum CPU utilization.
  D. Purchase All Upfront reserved DB instances.
  A. Use the Instance Scheduler on AWS to configure start and stop schedules.

• Question 1487:

  A company hosts a frontend application that uses an Amazon API Gateway API backend that is integrated with AWS Lambda. When the API receives requests, the Lambda function loads many libraries. Then the Lambda function connects to an Amazon RDS database, processes the data, and returns the data to the frontend application. The company wants to ensure that response latency is as low as possible for all its users with the fewest number of changes to the company's operations.

  Which solution will meet these requirements?

  A. Establish a connection between the frontend application and the database to make queries faster by bypassing the API.
  B. Configure provisioned concurrency for the Lambda function that handles the requests.
  C. Cache the results of the queries in Amazon S3 for faster retrieval of similar datasets.
  D. Increase the size of the database to increase the number of connections Lambda can establish at one time.
  B. Configure provisioned concurrency for the Lambda function that handles the requests.

• Question 1488:

  A company is deploying a critical application by using Amazon RDS for MySQL. The application must be highly available and must recover automatically. The company needs to support interactive users (transactional queries) and batch reporting (analytical queries) with no more than a 4-hour lag. The analytical queries must not affect the performance of the transactional queries.

  Which solution meets these requirements?

  A. Configure Amazon RDS for MySQL in a Multi-AZ DB instance deployment with one standby instance. Point the transactional queries to the primary DB instance. Point the analytical queries to a secondary DB instance that runs in a different Availability Zone.
  B. Configure Amazon RDS for MySQL in a Multi-AZ DB cluster deployment with two standby instances. Point the transactional queries to the primary DB instance. Point the analytical queries to the reader endpoint.
  C. Configure Amazon RDS for MySQL to use multiple read replicas across multiple Availability Zones. Point the transactional queries to the primary DB instance. Point the analytical queries to one of the replicas in a different Availability Zone.
  D. Configure Amazon RDS for MySQL as the primary database for the transactional queries with automated backups enabled. Each night, create a read-only database from the most recent snapshot to support the analytical queries. Terminate the previously created database.v
  C. Configure Amazon RDS for MySQL to use multiple read replicas across multiple Availability Zones. Point the transactional queries to the primary DB instance. Point the analytical queries to one of the replicas in a different Availability Zone.

  ---

  Explanation

  The requirement has three key elements: high availability with automatic recovery, separation of transactional and analytical workloads, and acceptable reporting lag up to 4 hours. The clean AWS-native pattern for isolating heavy read/ reporting traffic from transactional writes in RDS for MySQL is to use read replicas and direct reporting queries to the replica endpoint(s). Option C meets these requirements well.

  The primary RDS for MySQL instance handles transactional traffic (reads/writes). One or more RDS read replicas asynchronously replicate data from the primary. Because replication is asynchronous, some lag is expected; the requirement explicitly tolerates up to a 4-hour lag, which fits the read replica model. Directing batch reporting and analytical queries to a replica prevents those expensive queries from consuming CPU, memory, and I/O on the primary, thereby protecting interactive user performance. Deploying replicas across multiple Availability Zones also improves availability of the reporting tier and reduces the risk that an AZ issue prevents reporting access.

  Option A is incorrect because a standard Multi-AZ DB instance uses a synchronous standby that is not readable and is intended for failover, not for serving analytical queries.

  Option B describes a Multi-AZ DB cluster deployment, which does provide readable standbys in some RDS engines; however, for the classic RDS MySQL exam pattern, the most direct and widely used method to isolate analytics is read replicas.

  Option D creates a nightly snapshot-based read-only copy; this increases operational complexity, can result in stale data for most of the day, and introduces provisioning delays, which is unnecessary when replicas provide continuous near-real-time copies.

  Therefore, Option C is the best fit because it provides HA for the primary, isolates reporting reads to replicas, and meets the allowed replication lag requirement.

• Question 1489:

  A company uses a general-purpose instance class Amazon RDS for MySQL DB instance. The company has configured the DB instance in a Multi-AZ configuration across two Availability Zones as part of the company's production application.

  The company's finance team needs to run SQL queries against the DB instance to generate reports.

  Customers have reported significant performance issues with the application during report generation.

  A solutions architect needs to minimize the effect of the reporting job on the DB instance.

  Which solution will meet these requirements?

  A. Create a proxy in Amazon RDS Proxy. Update the reporting job to query the proxy endpoint.
  B. Update the RDS DB instance configuration to use three Availability Zones.
  C. Add an RDS read replica. Update the reporting job to query the replica endpoint.
  D. Change the RDS configuration from a general-purpose instance class to a memory-optimized instance class.
  C. Add an RDS read replica. Update the reporting job to query the replica endpoint.

  ---

  Explanation

  The issue described is a classic case of read-heavy reporting workloads interfering with transactional application traffic. Although the RDS instance is configured for Multi-AZ, Multi-AZ deployments are designed for high availability and failover, not for scaling read performance. All reads and writes still occur on the primary instance, which explains why reporting queries negatively affect customer-facing performance. Option C, adding an Amazon RDS read replica, is the most effective and AWS-recommended solution. Read replicas asynchronously replicate data from the primary instance and provide a separate endpoint for read-only workloads such as reporting, analytics, and dashboards. By redirecting the finance team's reporting queries to the replica endpoint, the primary database is freed to handle transactional workloads, significantly improving overall application performance.

  Option A (RDS Proxy) helps manage database connections efficiently, especially for bursty workloads, but it does not offload query execution or isolate heavy read traffic.

  Option B is invalid because RDS Multi-AZ does not support spreading a single DB instance across three AZs, and even if it did, it would not reduce read contention.

  Option D increases instance resources but does not solve the root cause; reporting queries would still compete with production traffic and would also increase cost unnecessarily.

  Therefore, C is the optimal solution because it isolates reporting workloads, scales read capacity, improves application responsiveness, and aligns with AWS best practices for high-performance database architectures.

• Question 1490:

  A company has a relational database workload that runs on Amazon Aurora MySQL. According to new compliance standards, the company must rotate all database credentials every 30 days. The company needs a solution that maximizes security and minimizes development effort.

  Which solution will meet these requirements?

  A. Store the database credentials in AWS Secrets Manager. Configure automatic credential rotation for every 30 days.
  B. Store the database credentials in AWS Systems Manager Parameter Store. Create an AWS Lambda function to rotate the credentials every 30 days.
  C. Store the database credentials in an environment file or in a configuration file. Modify the credentials every 30 days.
  D. Store the database credentials in an environment file or in a configuration file. Create an AWS Lambda function to rotate the credentials every 30 days.
  A. Store the database credentials in AWS Secrets Manager. Configure automatic credential rotation for every 30 days.

  ---

  Explanation

  The correct answer is A because the company needs to rotate database credentials every 30 days while maximizing security and minimizing development effort. AWS Secrets Manager is the AWS service specifically designed to store, manage, and rotate secrets such as database usernames and passwords. It supports automatic rotation for supported databases, including Amazon Aurora MySQL, which makes it the most secure and operationally efficient solution. With Secrets Manager, credentials are encrypted at rest, access can be controlled through IAM policies, and applications can retrieve secrets programmatically without embedding them in source code or configuration files. Automatic rotation reduces the risk associated with static credentials and helps meet compliance requirements with minimal manual work.

  Because rotation is built into the service, the development effort is significantly lower than creating and maintaining custom rotation logic.

  Option B can work, but it requires building and operating a custom Lambda rotation function, which adds complexity compared with the native automation available in Secrets Manager. Options C and D are not best practices because storing credentials in environment files or configuration files increases security risk and does not provide a managed secrets lifecycle.

  AWS security best practices recommend centralizing sensitive credentials in AWS Secrets Manager and enabling automatic rotation whenever possible. This improves security posture, reduces operational overhead, and aligns directly with compliance requirements for regular credential changes. Therefore, storing Aurora MySQL credentials in Secrets Manager with 30-day automatic rotation is the best solution.