Amazon SAA-C03 Online Practice Questions and Exam Preparation

Amazon SAA-C03 Online Questions & Answers

• Question 291:

  A company wants to direct its users to a backup static error page if the company's primary website is unavailable. The primary website's DNS records are hosted in Amazon Route 53. The domain is pointing to an Application Load Balancer (ALB). The company needs a solution that minimizes changes and infrastructure overhead.

  Which solution will meet these requirements?

  A. Update the Route 53 records to use a latency routing policy. Add a static error page that is hosted in an Amazon S3 bucket to the records so that the traffic is sent to the most responsive endpoints.
  B. Set up a Route 53 active-passive failover configuration. Direct traffic to a static error page that is hosted in an Amazon S3 bucket when Route 53 health checks determine that the ALB endpoint is unhealthy.
  C. Set up a Route 53 active-active configuration with the ALB and an Amazon EC2 instance that hosts a static error page as endpoints. Configure Route 53 to send requests to the instance only if the health checks fail for the ALB.
  D. Update the Route 53 records to use a multivalue answer routing policy. Create a health check. Direct traffic to the website if the health check passes. Direct traffic to a static error page that is hosted in Amazon S3 if the health check does not pass.
  B. Set up a Route 53 active-passive failover configuration. Direct traffic to a static error page that is hosted in an Amazon S3 bucket when Route 53 health checks determine that the ALB endpoint is unhealthy.

• Question 292:

  A company runs an application on a group of Amazon Linux EC2 instances. For compliance reasons, the company must retain all application log files for 7 years. The log files will be analyzed by a reporting tool that must be able to access all the files concurrently.

  Which storage solution meets these requirements MOST cost-effectively?

  A. Amazon Elastic Block Store (Amazon EBS)
  B. Amazon Elastic File System (Amazon EFS)
  C. Amazon EC2 instance store
  D. Amazon S3
  D. Amazon S3

• Question 293:

  A company wants to implement a data lake in the AWS Cloud. The company must ensure that only specific teams have access to sensitive data in the data lake. The company must have row-level access control for the data lake.

  Which solution will meet these requirements?

  A. Use Amazon RDS to store the data. Use IAM roles and permissions for data governance and access control.
  B. Use Amazon Redshift to store the data. Use IAM roles and permissions for data governance and access control.
  C. Use Amazon S3 to store the data. Use AWS Lake Formation for data governance and access control.
  D. Use AWS Glue Catalog to store the data. Use AWS Glue DataBrew for data governance and access control.
  C. Use Amazon S3 to store the data. Use AWS Lake Formation for data governance and access control.

  ---

  Explanation

  Option A: RDS:Suitable for relational databases but does not provide native support for data lakes or row-level access.

  Option B: Redshift:Primarily for analytics, not designed for large-scale data lake governance.

  Option C: S3 + Lake Formation:Provides native support for data lakes with granular access control, including row-level permissions.

  Option D: Glue Catalog + DataBrew:Focused on data preparation and metadata management, not row-level access control.

  References:

  AWS Lake Formation

• Question 294:

  A company has an application that runs on Amazon EC2 instances and uses an Amazon Aurora database.

  The EC2 instances connect to the database by using user names and passwords that are stored locally in a file. The company wants to minimize the operational overhead of credential management.

  What should a solutions architect do to accomplish this goal?

  A. Use AWS Secrets Manager. Turn on automatic rotation.
  B. Use AWS Systems Manager Parameter Store. Turn on automatic rotation.
  C. Create an Amazon S3 bucket to store objects that are encrypted with an AWS Key Management Service (AWS KMS) encryption key. Migrate the credential file to the S3 bucket. Point the application to the S3 bucket.
  D. Create an encrypted Amazon Elastic Block Store (Amazon EBS) volume for each EC2 instance. Attach the new EBS volume to each EC2 instance. Migrate the credential file to the new EBS volume. Point the application to the new EBS volume.
  A. Use AWS Secrets Manager. Turn on automatic rotation.

• Question 295:

  A company runs a global web application on Amazon EC2 instances behind an Application Load Balancer.

  The application stores data in Amazon Aurora. The company needs to create a disaster recovery solution and can tolerate up to 30 minutes of downtime and potential data loss. The solution does not need to handle the load when the primary infrastructure is healthy.

  What should a solutions architect do to meet these requirements?

  A. Deploy the application with the required infrastructure elements in place. Use Amazon Route 53 to configure active-passive failover. Create an Aurora Replica in a second AWS Region.
  B. Host a scaled-down deployment of the application in a second AWS Region. Use Amazon Route 53 to configure active-active failover. Create an Aurora Replica in the second Region.
  C. Replicate the primary infrastructure in a second AWS Region. Use Amazon Route 53 to configure active-active failover. Create an Aurora database that is restored from the latest snapshot.
  D. Back up data with AWS Backup. Use the backup to create the required infrastructure in a second AWS Region. Use Amazon Route 53 to configure active-passive failover. Create an Aurora second primary instance in the second Region.
  A. Deploy the application with the required infrastructure elements in place. Use Amazon Route 53 to configure active-passive failover. Create an Aurora Replica in a second AWS Region.

• Question 296:

  A company hosts an application on AWS and has generated approximately 2.5 TB of data over 12 years.

  The data is stored on Amazon EBS volumes. The company wants a cost-effective backup solution for long-term storage and must be able to retrieve the data within minutes for audits.

  Which solution will meet these requirements?

  A. Create EBS snapshots.
  B. Use Amazon S3 Glacier Deep Archive.
  C. Use Amazon S3 Glacier Flexible Retrieval.
  D. Use Amazon Elastic File System (Amazon EFS).
  C. Use Amazon S3 Glacier Flexible Retrieval.

  ---

  Explanation

  The requirements combine long-term, low-cost storage with retrieval within minutes, which narrows the viable storage classes significantly. Amazon S3 Glacier Flexible Retrieval is designed for exactly this use case: infrequently accessed data that must still be retrievable quickly.

  Option C provides substantially lower storage cost than EBS snapshots or EFS while supporting expedited retrievals, which can return data within minutes when required for audits. This meets both the cost and retrieval time constraints. Glacier Flexible Retrieval also integrates seamlessly with S3 lifecycle policies, enabling automated transitions from EBS snapshots or S3 Standard to archival storage.

  Option A (EBS snapshots) provides durability but is more expensive for long-term storage at this scale.

  Option B (Glacier Deep Archive) is cheaper but does not meet the retrieval requirement, as restore times are measured in hours, not minutes.

  Option D (EFS) is a high-performance file system and is the most expensive option for long-term backups.

  Therefore, C is the correct choice because it balances cost efficiency, durability, and audit-friendly retrieval times, aligning with AWS storage best practices for compliance-driven archival data.

• Question 297:

  A company recently migrated its application to a VPC on AWS. An AWS Site-to-Site VPN connection connects the company's on-premises network to the VPC. The application retrieves customer data from another system that resides on premises. The application uses an on-premises DNS server to resolve domain records. After the migration, the application is not able to connect to the customer data because of name resolution errors.

  Which solution will give the application the ability to resolve the internal domain names?

  A. Launch EC2 instances in the VPC. On the EC2 instances, deploy a custom DNS forwarder that forwards all DNS requests to the on-premises DNS server. Create an Amazon Route 53 private hosted zone that uses the EC2 instances for name servers.
  B. Create an Amazon Route 53 Resolver outbound endpoint. Configure the outbound endpoint to forward DNS queries against the on-premises domain to the on-premises DNS server.
  C. Set up two AWS Direct Connect connections between the AWS environment and the on-premises network. Set up a link aggregation group (LAG) that includes the two connections. Change the VPC resolver address to point to the on-premises DNS server.
  D. Create an Amazon Route 53 public hosted zone for the on-premises domain. Configure the network ACLs to forward DNS requests against the on-premises domain to the Route 53 public hosted zone.
  B. Create an Amazon Route 53 Resolver outbound endpoint. Configure the outbound endpoint to forward DNS queries against the on-premises domain to the on-premises DNS server.

  ---

  Explanation

  When AWS workloads must resolve DNS names from on-premises systems over a hybrid network (like VPN or Direct Connect), the best solution is to use Amazon Route 53 Resolver outbound endpoints.

  The outbound endpoint enables DNS queries to be forwarded from your VPC to on-premises DNS servers.

  You must also configure a Route 53 Resolver forwarding rule to define which domain names (e.g., corp. internal) should be forwarded to the specific on-premises DNS IPs. This setup allows private DNS resolution from AWS to on-premises systems and is fully managed, eliminating the need to run and maintain EC2-based DNS proxies (as in option A).

  Options C and D are incorrect:

  Option C is not DNS-specific and doesn't solve name resolution.

  Option D misuses a public hosted zone for a private DNS domain.

  References:

  Route 53 Resolver Outbound Endpoints

• Question 298:

  A company wants to use an Amazon RDS for PostgreSQL DB cluster to simplify time-consuming database administrative tasks for production database workloads. The company wants to ensure that its database is highly available and will provide automatic failover support in most scenarios in less than 40 seconds. The company wants to offload reads off of the primary instance and keep costs as low as possible.

  Which solution will meet these requirements?

  A. Use an Amazon RDS Multi-AZ DB instance deployment. Create one read replica and point the read workload to the read replica.
  B. Use an Amazon RDS Multi-AZ DB duster deployment Create two read replicas and point the read workload to the read replicas.
  C. Use an Amazon RDS Multi-AZ DB instance deployment. Point the read workload to the secondary instances in the Multi-AZ pair.
  D. Use an Amazon RDS Multi-AZ DB cluster deployment Point the read workload to the reader endpoint.
  D. Use an Amazon RDS Multi-AZ DB cluster deployment Point the read workload to the reader endpoint.

• Question 299:

  A company uses an Amazon CloudFront distribution to serve content pages for its website. The company needs to ensure that clients use a TLS certificate when accessing the company's website. The company wants to automate the creation and renewal of the TLS certificates.

  Which solution will meet these requirements with the MOST operational efficiency?

  A. Use a CloudFront security policy to create a certificate.
  B. Use a CloudFront origin access control (OAC) to create a certificate.
  C. Use AWS Certificate Manager (ACM) to create a certificate. Use DNS validation for the domain.
  D. Use AWS Certificate Manager (ACM) to create a certificate. Use email validation for the domain.
  C. Use AWS Certificate Manager (ACM) to create a certificate. Use DNS validation for the domain.

• Question 300:

  A financial company needs to handle highly sensitive data. The company will store the data in an Amazon

  S3 bucket.

  The company needs to ensure that the data is encrypted in transit and at rest. The company must manage the encryption keys outside the AWS Cloud.

  Which solution will meet these requirements?

  A. Encrypt the data in the S3 bucket with server-side encryption (SSE) that uses an AWS Key Management Service (AWS KMS) customer managed key.
  B. Encrypt the data in the S3 bucket with server-side encryption (SSE) that uses an AWS Key Management Service (AWS KMS) AWS managed key.
  C. Encrypt the data in the S3 bucket with the default server-side encryption (SSE).
  D. Encrypt the data at the company's data center before storing the data in the S3 bucket.
  D. Encrypt the data at the company's data center before storing the data in the S3 bucket.