SAA-C03 sample questions with answers
The other 172 questions are in the practice tool, with answers revealed as you go.
Start 20 questionsDesign secure architectures
- An identity-based policy attached to a user contains an explicit Deny statement for s3:DeleteObject on all resources. A different policy attached to the same user grants s3:DeleteObject. What happens when the user attempts to delete an S3 object?
- A company stores sensitive customer data in Amazon S3. It requires encryption at rest with keys the company itself manages, plus a full audit trail of every key usage event. Which option meets these requirements?
- An application uses Amazon RDS for MySQL. A compliance mandate requires the encryption key to live in hardware the company physically controls and that AWS personnel cannot access. Which solution satisfies this?
- A security policy requires that every S3 upload is refused unless the request carries the required server-side encryption header. Uploads without an x-amz-server-side-encryption header must be automatically rejected. How should the bucket be configured?
- An enterprise runs hundreds of AWS accounts under Organizations. The security team needs continuous, centralized evaluation of every account against PCI DSS requirements such as no public S3 buckets, encrypted EBS volumes, and enabled CloudTrail. Which service provides this consolidated compliance view?
Design resilient architectures
- A web application runs on Amazon EC2 instances in a single Availability Zone and stores its data in a Single-AZ Amazon RDS for MySQL DB instance. The company wants the application to keep working if that Availability Zone fails. Which two changes meet this requirement? (Choose two.)
- A web application runs on EC2 instances in an Auto Scaling group behind an Application Load Balancer and must stay available if an entire Availability Zone fails. How should the architecture be designed?
- An application consumes messages from a producer tier, and the consumer tier is sometimes temporarily unavailable. During that downtime, messages must not be lost. Which architecture pattern achieves this?
- A production database has an RTO of 4 hours and an RPO of 1 hour. Which disaster recovery strategy is the most cost-effective while meeting both objectives?
- Which AWS service provides point-in-time recovery for DynamoDB tables, allowing restoration to any second within the past 35 days?
- A company wants users routed to the nearest AWS Region by measured latency to minimize response time, while also failing over automatically to a healthy Region if the primary becomes unavailable. Which Route 53 routing policy combination achieves this?
- A startup is building a mobile backend API on AWS and wants the system to absorb sudden bursts of millions of requests with no pre-provisioned servers and no dropped requests. Which architecture is most appropriate?
- A company stores important business data in Amazon EFS. A ransomware attack encrypted all files in the file system, and the company must recover the data as it was before the attack. What provides this recovery capability?
- A company has critical business data on on-premises servers and uses AWS for disaster recovery. When the on-premises site fails, the AWS environment must immediately serve production traffic — even at reduced capacity — with no time spent first starting servers, and without paying for a full-scale second production environment. Which DR strategy fits best?
Design high-performing architectures
- Match each requirement to the AWS service or feature that meets it best.
- A platform must ingest millions of IoT sensor readings per hour and query them with time-range scans. Which AWS database is purpose-built for this workload?
- A Lambda function processing financial transactions sees 3-5 second cold starts and misses a 200 ms response requirement for business-critical requests. Which feature minimizes cold starts?
- A company streams live sporting events to millions of concurrent viewers worldwide with minimal buffering. Which CloudFront configuration suits live video delivery?
- A web application must push stock price updates to thousands of connected users with sub-second latency, in a read-heavy pattern with one writer and many readers. Which AWS service is optimized for this publish-subscribe, real-time delivery pattern?
- An application serves personalized content and its APIs must authenticate requests carrying JSON Web Tokens (JWTs) issued by a third-party identity provider such as Auth0. The authentication must happen at the API layer, without custom verification code in each microservice. Which AWS service handles JWT validation there?
- A bioinformatics workload requires maximum single-threaded CPU performance for a genomic sequencing algorithm, with jobs that run 2–4 hours. Which EC2 instance family fits best?
- A CloudFront distribution serves both video files (already-compressed MP4 and HLS) and text assets such as JavaScript and CSS. The goal is to reduce bandwidth on the compressible assets without touching video delivery. How should automatic compression be configured?
- A DynamoDB table's primary key is composed of a product identifier and an order date. Items must also be queried by customer identifier sorted by order date, which the primary key cannot serve. What is the native DynamoDB solution?
Design cost-optimized architectures
- A company is choosing Amazon S3 storage classes for data in the same AWS Region. Order these storage classes from the highest to the lowest storage price per GB-month. Consider storage price only, not retrieval or request charges.
- A production database runs 24/7 on an r6i.4xlarge EC2 instance, and the team is confident the workload will run for at least three years. Which purchasing option provides the maximum cost savings?
- A company stores 500 TB in S3. Analysis shows 30% of objects accessed frequently, 40% accessed monthly, and 30% untouched for over 180 days. Which S3 feature automatically moves objects to cheaper storage classes based on access patterns?
- A company's private-subnet EC2 instances fetch large objects from S3 through a NAT gateway, and the associated data-processing charges show up prominently on every bill. What is the most effective fix to eliminate those charges?
- A company runs development and test EC2 instances only during business hours (Monday to Friday, 8 AM to 6 PM). What is the simplest way to cut these environments' costs by roughly 70%?
- A company's Lambda function runs 10 million times a month at about 200 ms per invocation with 512 MB of memory, and the Lambda bill is higher than budgeted. Which optimization reduces Lambda costs most?
- A company wants to centralize AWS billing across its 15 accounts so it can benefit from volume discounts and Reserved Instance sharing. Which AWS feature enables this?
- A company must move 80 TB of on-premises data to S3 as a one-time migration. Only a shared 1 Gbps internet connection is available and production traffic runs over it. Which migration option is most efficient?