Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 151:

  A company designed a stateless two-tier application that uses Amazon EC2 in a single Availability Zone and an Amazon RDS Multi-AZ DB instance. New company management wants to ensure the application is highly available.

  What should a solutions architect do to meet this requirement?

  A. Configure the application to use Multi-AZ EC2 Auto Scaling and create an Application Load Balancer
  B. Configure the application to take snapshots of the EC2 instances and send them to a different AWS Region
  C. Configure the application to use Amazon Route 53 latency-based routing to feed requests to the application
  D. Configure Amazon Route 53 rules to handle incoming requests and create a Multi-AZ Application Load Balancer
  A. Configure the application to use Multi-AZ EC2 Auto Scaling and create an Application Load Balancer

• Question 152:

  A company runs a web application that is backed by Amazon RDS. A new database administrator caused data loss by accidentally editing information in a database table. To help recover from this type of incident, the company wants the ability to restore the database to its state from 5 minutes before any change within the last 30 days.

  Which feature should the solutions architect include in the design to meet this requirement?

  A. Read replicas
  B. Manual snapshots
  C. Automated backups
  D. Multi-AZ deployments
  C. Automated backups

• Question 153:

  A company hosts an application on multiple Amazon EC2 instances. The application processes messages from an Amazon SQS queue, writes to an Amazon RDS table, and deletes the message from the queue.

  Occasional duplicate records are found in the RDS table. The SQS queue does not contain any duplicate messages.

  What should a solutions architect do to ensure messages are being processed once only?

  A. Use the CreateQueue API call to create a new queue.
  B. Use the AddPermission API call to add appropriate permissions.
  C. Use the ReceiveMessage API call to set an appropriate wait time.
  D. Use the ChangeMessageVisibility API call to increase the visibility timeout.
  D. Use the ChangeMessageVisibility API call to increase the visibility timeout.

• Question 154:

  A company is planning to connect a remote office to its AWS infrastructure. The office requires permanent and secure connectivity to AWS. The connection must provide secure access to resources in two VPCs.

  However, the VPCs must not be able to access each other.

  Which solution will meet these requirements?

  A. Create two transit gateways. Set up one AWS Site-to-Site VPN connection from the remote office to each transit gateway. Connect one VPC to the transit gateway. Configure route table propagation to the appropriate transit gateway based on the destination VPC IP range.
  B. Set up one AWS Site-to-Site VPN connection from the remote office to each of the VPCs. Update the VPC route tables with static routes to the remote office resources.
  C. Set up one AWS Site-to-Site VPN connection from the remote office to one of the VPCs. Set up VPC peering between the two VPCs. Update the VPC route tables with static routes to the remote office and peered resources.
  D. Create a transit gateway. Set up an AWS Direct Connect gateway and one Direct Connect connection between the remote office and the Direct Connect gateway. Associate the transit gateway with the Direct Connect gateway. Configure a separate private virtual interface (VIF) for each VPC, and configure routing.
  B. Set up one AWS Site-to-Site VPN connection from the remote office to each of the VPCs. Update the VPC route tables with static routes to the remote office resources.

  ---

  Explanation

  The requirement is secure, permanent connectivity to two VPCs without enabling VPC-to-VPC communication.

  Option B achieves this by establishing a separate Site-to-Site VPN connection between the remote office and each VPC. Updating each VPC's route tables ensures traffic from the remote office reaches the correct VPC resources, while preventing routing between the VPCs themselves. Options involving transit gateways (A and D) would introduce transitive routing capabilities, which violates the requirement of isolation between VPCs.

  Option C (VPC peering) directly conflicts with the requirement by enabling cross-VPC access. Therefore, option B is the correct solution as it maintains isolation while providing secure VPN connectivity.

  References:

  AWS Site-to-Site VPN User Guide -- Connecting on-premises networks to multiple VPCs?AWS Well-Architected Framework -- Security Pillar: Network isolation and segmentation

• Question 155:

  A company wants to implement new security compliance requirements for its development team to limit the use of approved Amazon Machine Images (AMIs). The company wants to provide access to only the approved operating system and software for all its Amazon EC2 instances. The company wants the solution to have the least amount of lead time for launching EC2 instances.

  Which solution will meet these requirements?

  A. Create a portfolio by using AWS Service Catalog that includes only EC2 instances launched with approved AMIs. Ensure that all required software is preinstalled on the AMIs. Create the necessary permissions for developers to use the portfolio.
  B. Create an AMI that contains the approved operating system and software by using EC2 Image Builder. Give developers access to that AMI to launch the EC2 instances.
  C. Create an AMI that contains the approved operating system Tell the developers to use the approved AMI Create an Amazon EventBridge rule to run an AWS Systems Manager script when a new EC2 instance is launched. Configure the script to install the required software from a repository.
  D. Create an AWS Config rule to detect the launch of EC2 instances with an AMI that is not approved. Associate a remediation rule to terminate those instances and launch the instances again with the approved AMI. Use AWS Systems Manager to automatically install the approved software on the launch of an EC2 instance.
  A. Create a portfolio by using AWS Service Catalog that includes only EC2 instances launched with approved AMIs. Ensure that all required software is preinstalled on the AMIs. Create the necessary permissions for developers to use the portfolio.

  ---

  Explanation

  AWSService Catalogis designed to allow organizations to manage a catalog of approved products (including AMIs) that users can deploy. By creating a portfolio that contains only EC2 instances launched with preapproved AMIs, the company can enforce compliance with the approved operating system and software for all EC2 instances. Service Catalog also streamlines the process of launching EC2 instances, reducing the lead time while ensuring that developers use only the approved configurations.

  Option B (EC2 Image Builder): While EC2 Image Builder helps in creating and managing AMIs, it doesn ' t provide the enforcement mechanism that Service Catalog does.

  Option C (EventBridge rule and Systems Manager script): This solution is reactive and involves more operational complexity compared to Service Catalog.

  Option D (AWS Config rule): This option is reactive (it terminates non-compliant instances after launch) and introduces additional operational overhead.

  References:

  AWS Service Catalog

• Question 156:

  A company is running a photo hosting service in the us-east-1 Region. The service enables users across multiple countries to upload and view photos. Some photos are heavily viewed for months, and others are viewed for less than a week. The application allows uploads of up to 20 MB for each photo. The service uses the photo metadata to determine which photos to display to each user.

  Which solution provides the appropriate user access MOST cost-effectively?

  A. Store the photos in Amazon DynamoDB. Turn on DynamoDB Accelerator (DAX) to cache frequently viewed items.
  B. Store the photos in the Amazon S3 Intelligent-Tiering storage class. Store the photo metadata and its S3 location in DynamoDB.
  C. Store the photos in the Amazon S3 Standard storage class. Set up an S3 Lifecycle policy to move photos older than 30 days to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Use the object tags to keep track of metadata.
  D. Store the photos in the Amazon S3 Glacier storage class. Set up an S3 Lifecycle policy to move photos older than 30 days to the S3 Glacier Deep Archive storage class. Store the photo metadata and its S3 location in Amazon OpenSearch Service.
  B. Store the photos in the Amazon S3 Intelligent-Tiering storage class. Store the photo metadata and its S3 location in DynamoDB.

• Question 157:

  A company hosts an end-user application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company needs to configure end-to-end encryption between the ALB and the EC2 instances.

  Which solution will meet this requirement with the LEAST operational effort?

  A. Deploy AWS CloudHSM. Import a third-party certificate into CloudHSM. Configure the EC2 instances and the ALB to use the CloudHSM imported certificate.
  B. Import a third-party certificate bundle into AWS Certificate Manager (ACM). Generate a self-signed certificate on the EC2 instances. Associate the ACM imported third-party certificate with the ALB.
  C. Import a third-party SSL certificate into AWS Certificate Manager (ACM). Install the third-party certificate on the EC2 instances. Associate the ACM imported third-party certificate with the ALB.
  D. Use Amazon-issued AWS Certificate Manager (ACM) certificates on the EC2 instances and the ALB.
  D. Use Amazon-issued AWS Certificate Manager (ACM) certificates on the EC2 instances and the ALB.

  ---

  Explanation

  End-to-end encryption means TLS is used not only from the client to the ALB, but also from the ALB to the EC2 targets. The least operational effort is achieved by using AWS Certificate Manager (ACM) Amazon-issued certificates where possible, because ACM automates key management, certificate provisioning, and renewal for supported use cases. Associating an ACM certificate with the ALB is a standard managed approach for TLS termination at the load balancer, and using managed certificates reduces the overhead of tracking expiration, renewing, and distributing certificates. For encryption on the backend connection (ALB to instances), the instances must present a certificate and complete TLS. Using Amazon-issued ACM certificates (via supported mechanisms) reduces manual certificate lifecycle work compared with importing and managing third-party certificates. By avoiding third-party cert procurement and manual renewals, the solution minimizes ongoing operations and reduces the risk of outages due to expired certificates. This aligns with the requirement for the least operational effort while meeting the security requirement.

  Option A is far more operationally heavy: CloudHSM is intended for scenarios requiring customer-managed HSMs and adds complexity in deployment, scaling, integration, and operations.

  Option B introduces self-signed certificates on instances, which increases operational friction (distribution, trust, rotation) and is not as clean for managed operations.

  Option C works but requires managing third-party certificate lifecycle (renewals, re-import, redeploy to instances), which is more overhead than Amazon-issued managed certificates.

  Therefore, Option D best meets end-to-end encryption needs with the lowest ongoing operational burden by using AWS-managed certificate issuance and lifecycle management capabilities.

• Question 158:

  A company has an application that runs only on Amazon EC2 Spot Instances. The instances run in an Amazon EC2 Auto Scaling group with scheduled scaling actions. However, the capacity does not always increase at the scheduled times, and instances terminate many times a day. A solutions architect must ensure that the instances launch on time and have fewer interruptions.

  Which action will meet these requirements?

  A. Specify the capacity-optimized allocation strategy for Spot Instances. Add more instance types to the Auto Scaling group.
  B. Specify the capacity-optimized allocation strategy for Spot Instances. Increase the size of the instances in the Auto Scaling group.
  C. Specify the lowest-price allocation strategy for Spot Instances. Add more instance types to the Auto Scaling group.
  D. Specify the lowest-price allocation strategy for Spot Instances. Increase the size of the instances in the Auto Scaling group.
  A. Specify the capacity-optimized allocation strategy for Spot Instances. Add more instance types to the Auto Scaling group.

  ---

  Explanation

  Spot Instances can be interrupted when AWS needs the capacity back. To reduce interruptions and improve availability, AWS provides the capacity-optimized allocation strategy.

  Capacity-optimized strategy launches Spot Instances from the most available Spot capacity pools instead of the lowest-priced ones, reducing interruption rates.

  By adding multiple instance types (e.g., using Instance Type Flexibility), the Auto Scaling group can launch instances in a broader set of pools, improving the chance that capacity is available.

  Scheduled scaling actions combined with a diverse set of instances under the capacity-optimized strategy ensure higher resilience and better timing for instance launches.

  This approach directly supports the Resiliency design principle in the AWS Well-Architected Framework.

  References:

  Best Practices for EC2 Spot Instances Capacity-Optimized Allocation Strategy

• Question 159:

  A company runs a web application on Amazon EC2 instances in an Auto Scaling group. The application uses a database that runs on an Amazon RDS for PostgreSQL DB instance. The application performs slowly when traffic increases. The database experiences a heavy read load during periods of high traffic.

  Which actions should a solutions architect take to resolve these performance issues? (Choose two.)

  A. Turn on auto scaling for the DB instance.
  B. Create a read replica for the DB instance. Configure the application to send read traffic to the read replica.
  C. Convert the DB instance to a Multi-AZ DB instance deployment. Configure the application to send read traffic to the standby DB instance.
  D. Create an Amazon ElastiCache cluster. Configure the application to cache query results in the ElastiCache cluster.
  E. Configure the Auto Scaling group subnets to ensure that the EC2 instances are provisioned in the same Availability Zone as the DB instance.
  B. Create a read replica for the DB instance. Configure the application to send read traffic to the read replica.
  D. Create an Amazon ElastiCache cluster. Configure the application to cache query results in the ElastiCache cluster.

• Question 160:

  A solutions architect has created a new AWS account and must secure AWS account root user access.

  Which combination of actions will accomplish this? (Choose two.)

  A. Ensure the root user uses a strong password.
  B. Enable multi-factor authentication to the root user.
  C. Store root user access keys in an encrypted Amazon S3 bucket.
  D. Add the root user to a group containing administrative permissions.
  E. Apply the required permissions to the root user with an inline policy document.
  A. Ensure the root user uses a strong password.
  B. Enable multi-factor authentication to the root user.