AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 1
Question 1
A financial-services company has been sharing the AWS account root sign-in among operators for ordinary EC2 and S3 administration. Its security team wants individually attributable least-privilege access without preventing genuine root-only emergency tasks. Which change addresses the access design?
- Give each operator a permission-scoped federated role through IAM Identity Center and restrict routine root use.
- Store the shared root password in Secrets Manager and keep using root for every normal deployment.
- Create a resource-based policy granting each operator permission to become the account root user.
- Use an AWS Organizations SCP with an Allow statement as the only grant of administrative permissions.
Explanation
Correct Answer
A:Federated or IAM role-based workforce access provides separate identities, permission scoping and audit trails. The root sign-in can then remain guarded for the small set of tasks that truly require the account owner.
Incorrect Answers
B:A secret store can protect a credential at rest, but it does not transform routine root use into least-privilege identity or distinguish which operator acted through the shared root identity.
C:AWS account root is not a role that an S3 bucket or other resource policy can delegate to individuals. Resource policies are authorization controls for defined principals, not root-user cloning.
D:An SCP establishes organization-wide permission ceilings, not a standalone permission grant. Operators still need valid IAM identities, appropriate identity policies, and any necessary resource authorization.
Question 2
An analytics fleet runs in private VPC subnets and reads objects from Amazon S3. It must not require internet-routed egress or pay NAT processing charges for that S3 traffic. Which network change most directly meets the requirement?
- Add an internet gateway default route to each private subnet and attach public IPv4 addresses to its instances.
- Deploy a Network Load Balancer in front of Amazon S3 and send requests to its private listener.
- Create an S3 gateway VPC endpoint, associate the private route tables, and apply suitable endpoint and bucket access policies.
- Add a Site-to-Site VPN from the VPC to its own Region so the instances can reach S3 without changing routes.
Explanation
Correct Answer
C:The S3 gateway endpoint adds a service prefix-list route to associated route tables. Eligible S3 traffic stays on the AWS network without using a NAT gateway; endpoint and bucket policies still enforce authorization.
Incorrect Answers
A:Giving private instances public connectivity undermines the specified design, and internet gateways do not provide the private service route requested. The change also fails to remove the need for egress architecture.
B:An NLB is a load balancer for registered application targets, not a supported replacement for the regional Amazon S3 API endpoint. It adds an unnecessary layer without providing gateway-endpoint routing.
D:A site-to-site VPN connects separate networks through tunnels; it does not create the VPC-local gateway endpoint service path and would not by itself satisfy S3 private routing for these subnets.
Question 3
A healthcare archive must retain each immutable object version for seven years. The requirement states that even highly privileged administrators cannot shorten retention or delete protected versions before their retention date. Which configuration is appropriate?
- Enable ordinary S3 Versioning and grant administrators s3:DeleteObjectVersion.
- Create a lifecycle expiration rule set to seven years without enabling Object Lock.
- Use S3 Object Lock governance mode and rely on privileged bypass when necessary.
- Use S3 Object Lock compliance mode with the required per-version retention settings.
Explanation
Correct Answer
D:Compliance-mode Object Lock prevents deletion or shortening the configured retention on protected object versions, including by privileged AWS account principals, satisfying the strict immutable-retention requirement.
Incorrect Answers
A:Versioning preserves prior versions after normal overwrites, but a principal authorized to delete a particular version can still remove it. Versioning alone does not enforce immutable minimum retention.
B:A lifecycle rule automates transitions and expiration; it does not impose WORM protection against deletion by sufficiently privileged users, so it cannot enforce the specified non-bypassable period.
C:Governance mode can be bypassed by principals with the required permission and explicit request, making it unsuitable when the retention must remain unalterable even to privileged administrators.
Question 4
An ordering service publishes an OrderPlaced event. Fraud checking, inventory reservation and customer notification must each receive their own copy and process independently, even if one consumer is offline for an hour. Which integration is most suitable?
- Write one message to one SQS Standard queue and attach three competing worker consumers to it.
- Publish to an SNS topic with a separate subscribed SQS queue for each consumer and correctly scoped queue policies.
- Send the event synchronously to all three APIs and fail the original checkout whenever any consumer is unavailable.
- Store the event only in a CloudWatch Logs stream and have consumers poll the log service as the reliable delivery bus.
Explanation
Correct Answer
B:SNS fan-out provides a copy to each subscribed SQS queue. The independent queues buffer work through consumer downtime and let the downstream systems scale or retry without coupling their lifecycles.
Incorrect Answers
A:Consumers of the same SQS queue compete for messages; each message is processed by one receiving worker at a time, not automatically replicated to all three services.
C:Synchronous fan-out couples checkout latency and availability to the slowest downstream integration, contrary to the requirement that a consumer outage not block the producer.
D:CloudWatch Logs is for operational log ingestion and analysis. It is not the purpose-built, independently durable fan-out workflow of SNS topics plus per-consumer SQS queues.
Question 5
A production Amazon RDS relational database hosts the order-write workload. The organization wants automatic database failover after an Availability Zone failure while minimizing application changes and preserving a single writer. Read throughput is not currently the bottleneck. Which design best fits?
- Turn on the supported RDS Multi-AZ deployment option and have clients use the normal database endpoint.
- Create one read replica in the same Availability Zone and have all clients send writes to the replica endpoint.
- Take daily manual snapshots in the same Availability Zone and restore them during an outage.
- Add more RDS storage IOPS to the current single-AZ database instance without any standby placement.
Explanation
Correct Answer
A:An RDS Multi-AZ configuration provides a synchronous standby/failover architecture for supported engines and configurations. The service manages primary failure detection and endpoint recovery, directly addressing zonal database availability.
Incorrect Answers
B:An ordinary RDS read replica is generally for asynchronous read scaling and is not the same automatic standby/failover mechanism. Sending writes to a read replica is not a valid normal application write path.
C:Snapshots help restore data, but restoring a daily same-AZ backup is neither an automatic Multi-AZ failover nor equivalent in RPO or RTO to a managed standby.
D:Provisioning more IOPS can improve throughput but does not change the AZ failure domain. It provides no standby writer or automated recovery for a lost Availability Zone.
Question 6
An EC2 workload uses Amazon EBS gp3. Monitoring shows that random I/O demand has risen but the application does not need more disk capacity. The architect wants to increase provisioned storage performance without buying additional gigabytes. What should be changed?
- Replace the EBS volume with EFS One Zone so volume IOPS no longer depend on capacity.
- Keep the volume's baseline gp3 settings and increase the EC2 root filesystem size by 1 TB.
- Adjust the supported gp3 provisioned IOPS and throughput independently of its volume size, subject to limits and instance bandwidth.
- Move the database to S3 Standard and mount the bucket as an ordinary low-latency block device.
Explanation
Correct Answer
C:gp3 decouples provisioned IOPS and throughput from capacity within its supported limits. The architect must also check instance-side EBS bandwidth so the additional provisioned performance can actually be consumed.
Incorrect Answers
A:EFS is a shared file system with different latency, availability, protocol and consistency properties. Switching to One Zone is not an appropriate transparent way to tune an existing low-latency EBS block volume.
B:Enlarging capacity alone is unnecessary on gp3 when the shortfall is provisioned IOPS or throughput. The workload may remain bottlenecked even after paying for unused space.
D:S3 is object storage and is not an API-compatible replacement for an EBS block volume. An object bucket cannot be treated as the same low-latency block filesystem without changing application architecture.
Question 7
A ticketing site's EC2 Auto Scaling group gets a large, repeatable increase in requests before the same weekly onsale. Ordinary target-tracking scaling frequently launches additional capacity only after customer response times deteriorate. What should the architect add?
- Disable scaling and keep the fleet at its minimum size to avoid overprovisioning.
- Use predictive scaling informed by historical load, validating that its forecasts and scheduling meet the event pattern.
- Replace the EC2 fleet with an S3 bucket and expect it to execute the application server code.
- Set the ALB's idle timeout to several hours instead of adjusting serving capacity.
Explanation
Correct Answer
B:Predictive scaling can anticipate recurring load patterns and provision capacity ahead of expected spikes. It is appropriate where historical patterns forecast the weekly event and capacity can warm before demand.
Incorrect Answers
A:A fixed minimum fleet would intensify the spike-related saturation and does not address the lag between demand growth and instance readiness.
C:Amazon S3 serves object data and static site assets; it cannot execute arbitrary stateful EC2 application code without an application rewrite using suitable compute services.
D:Idle timeout affects connection lifecycle at the load balancer; it does not add application instances or CPU capacity ahead of a predictable traffic surge.
Question 8
A DynamoDB table ingests clickstream events. Most writes use the same tenant identifier as the partition key, and throttling occurs on one hot partition even though the table has aggregate spare capacity. Which schema change most directly addresses the skew?
- Increase the maximum size of the CloudWatch Logs retention period for the table.
- Add an RDS Proxy in front of DynamoDB to distribute SQL connections across partitions.
- Create a GSI that has the same hot partition key and continue writing all records to one original partition.
- Redesign the write partition key to distribute requests across sufficiently many values, potentially introducing a controlled write-sharding pattern.
Explanation
Correct Answer
D:DynamoDB distributes items and capacity by partition-key hash. Increasing key cardinality or sharding a dominant tenant's writes removes the disproportionate load from one logical hot key, though retrieval patterns must adapt.
Incorrect Answers
A:Log retention does not influence the partition-key hash distribution or remove the write-capacity hot spot; the operational symptom is request skew rather than historical monitoring storage.
B:RDS Proxy pools relational database connections for supported RDS/Aurora engines. DynamoDB is an API-based NoSQL service and its partition hot spots are not solved by relational connection pooling.
C:A same-key secondary index does not eliminate write concentration on the original table partition; it may add index write work without fixing the high-traffic hash-key distribution.
Question 9
A multiplayer application serves users across three AWS Regions using non-cacheable TCP connections. Enterprise firewalls need stable global IP addresses, and the application requires routing to healthy regional endpoints over the AWS global network. Which service is the best fit?
- AWS Global Accelerator with its static anycast IP addresses and properly configured regional endpoint groups.
- Amazon CloudFront configured to cache TCP game-state connections as if they were static objects.
- Amazon Route 53 latency records alone, promising a fixed pair of anycast IP addresses that never change.
- An S3 Gateway VPC endpoint shared across Regions as the public application listener.
Explanation
Correct Answer
A:Global Accelerator provides static anycast addresses and uses the AWS global network with health-aware routing to suitable regional endpoints. It fits non-cacheable TCP workloads that need stable allowlisted public IPs.
Incorrect Answers
B:CloudFront is a CDN for HTTP(S) content and supported web delivery patterns. It is not a generic TCP proxy cache for arbitrary interactive game connections.
C:Route 53 latency routing responds with DNS answers and can steer clients, but it does not itself provision the stable global anycast address pair required by the allowlist constraint.
D:An S3 gateway endpoint is a private route-table entry for the S3 service, not a public network listener or cross-Region global acceleration mechanism.
Question 10
A telemetry platform needs multiple independent applications to consume each event stream within seconds, replay retained records after downstream failures, and preserve ordering for a given device identifier. The developers will implement their own stream processors. Which ingestion service should they select?
- Amazon Data Firehose solely as a buffered delivery pipeline, without any separate retained multi-consumer event stream.
- Amazon SQS Standard as a broadcast stream guaranteeing order across all consumers.
- Amazon Kinesis Data Streams with partition keys based on device IDs and suitable retention and consumer capacity.
- Amazon Athena to continuously accept producer writes and store ordered retained event records in memory.
Explanation
Correct Answer
C:Kinesis Data Streams stores ordered records within a shard and supports multiple consumer applications with configurable retention. Device-based partition keys preserve ordering for each device within the stream's shard mapping.
Incorrect Answers
A:Firehose is optimized for managed delivery to destinations and optional transforms. Its batching and destination pipeline do not replace a purpose-built retained stream with independent custom consumers and per-key ordering.
B:Standard SQS queues distribute messages among competing consumers and do not promise strict ordering. Multiple independent replaying consumers need a retained stream or explicit fan-out architecture.
D:Athena is a SQL query engine over sources such as S3, not a low-latency append-only producer endpoint supporting per-key stream ordering and consumer replay semantics.
