AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 12
Question 110
A popular catalog endpoint issues the same relational queries millions of times daily. Adding a dedicated cache cluster would save significant RDS read capacity, and the company has measured cache-hit potential and TTL requirements. Which cost optimization should it assess?
- Add an Amazon ElastiCache tier, compare cache fleet cost with reduced database load, and define invalidation and TTL behavior.
- Purchase larger RDS instances without testing caching because every repeated read needs a fresh database query.
- Move the SQL service into S3 Requester Pays so clients automatically pay the RDS compute bill.
- Replace the catalog tables with an SQS dead-letter queue to make reads free.
Explanation
Correct Answer
A:An in-memory cache can avoid repeated database reads when hit rate and tolerated staleness support it. The added cache and replication charges must be weighed against reduced DB resource needs.
Incorrect Answers
B:A larger database might increase read capacity but can cost more than caching repeated values, and it ignores the measured opportunity to eliminate redundant queries.
C:Requester Pays is an S3 request/data transfer billing feature and does not shift RDS relational query compute costs by changing the database API.
D:An SQS DLQ is a failure buffer for messages, not a queryable, low-latency authoritative cache for SQL catalog entries.
Question 111
An application in one AWS Region exchanges large datasets with a second VPC in another Region over an established inter-Region VPC peering connection. The network path uses private addresses and stays on the AWS backbone, but the finance team sees recurring data-transfer charges. Which statement best explains the costs?
- Every byte on an inter-Region VPC peering connection is free because it remains on private AWS networking infrastructure.
- The peering connection itself has no creation charge, but inter-Region data transferred over the connection is billable; the traffic volume and applicable Region rates must be modeled.
- Inter-Region peering routes packets through an internet gateway by definition, so only ordinary public internet egress rates can apply.
- Enabling encryption for the inter-Region peering connection automatically waives all regional transfer charges, including data sent to a distant Region.
Explanation
Correct Answer
B:AWS does not charge merely to establish a VPC peering connection, but transferred bytes can incur charges across Availability Zones and Regions. The inter-Region data path therefore needs a usage-based cost model.
Incorrect Answers
A:Private routing is a security and connectivity property, not a promise that inter-Region data transfer is free. AWS charges for peering traffic that crosses Regions.
C:Inter-Region VPC peering uses private IP addresses over the AWS backbone rather than requiring internet-gateway traversal. Treating it as ordinary internet egress misstates the connectivity and pricing.
D:Encryption of inter-Region peering traffic is a transport protection; it does not remove the documented charges for data transfer between Regions.
Question 112
A media site serves the same static public assets to millions of users worldwide. S3 origin egress and repeated requests are large portions of the bill, and the assets are cacheable with reasonable TTLs. Which network-delivery optimization is most suitable?
- Increase origin requests by disabling all caching at the CDN edge.
- Deploy a NAT gateway in front of all browsers so the origin never receives repeated public requests.
- Use CloudFront with a properly tuned cache policy to serve repeated assets from edge caches and measure combined CDN/origin economics.
- Buy more RDS Reserved Instances because that directly discounts public S3 object data transfer.
Explanation
Correct Answer
C:CloudFront edge caching can lower repeat origin fetches and improve delivery performance for cacheable public files. Total savings depend on CDN pricing, cache hit rate and origin billing.
Incorrect Answers
A:Disabling edge caches causes more requests and data transfer to reach the origin, counter to the desired traffic reduction.
B:NAT gateways serve outbound connectivity from private VPC workloads; they cannot front internet browsers as a public static-content cache.
D:Relational DB instance commitments do not reduce S3 origin or CDN traffic billing for a public asset site.
Question 113
Attackers recently proxied one-time passcodes entered on a lookalike administrator sign-in page. A company's AWS root sign-in is currently protected only by a password and text-message challenge. The security architect is specifically hardening the root authentication step, not delegating daily operations. Which control should be prioritized?
- Create an S3 bucket policy requiring server-side encryption for objects uploaded by administrators.
- Rotate the root password monthly while keeping SMS one-time codes as the only additional factor.
- Grant all administrators AdministratorAccess and disable the existing root MFA requirement.
- Register and enforce an available phishing-resistant FIDO security key or passkey MFA method for root sign-in.
Explanation
Correct Answer
D:FIDO authentication cryptographically binds a response to the authentic sign-in origin, so a phishing proxy cannot simply replay a six-digit code against AWS. Root MFA still requires strong recovery and account access procedures.
Incorrect Answers
A:A bucket encryption policy may protect stored object data, but it does not establish who can sign in as root or whether the sign-in challenge resists phishing relays. It is unrelated to this identity threat.
B:Rotating passwords limits the lifetime of an exposed password, but a real-time phishing proxy can relay a current password and SMS code during the same session. It does not create origin-bound authentication.
C:AdministratorAccess is an IAM authorization policy and does not protect root authentication. Disabling MFA removes a separate control and leaves the specific credential-relay attack unaddressed.
Question 114
A deployment script inherited from a startup's early AWS setup uses access keys created for the root user. Several repositories contain copies, and the security team wants to remove the standing root-level blast radius without interrupting automated EC2 provisioning. What is the correct migration?
- Rotate the root access keys quarterly and copy the replacements into every build environment.
- Store the root access key inside an encrypted S3 object and let all build jobs download it.
- Put an AWS Organizations SCP on the management account to convert root access keys into read-only credentials.
- Replace the keys with scoped IAM roles or temporary STS credentials for automation, then deactivate and delete root access keys.
Explanation
Correct Answer
D:Roles and temporary credentials can authorize only the provisioning operations needed and expire automatically. Removing root keys eliminates a permanent account-wide credential from repositories and build jobs.
Incorrect Answers
A:Rotating shared root keys shortens exposure but preserves the same overprivileged long-lived access model and distributes root credentials across systems. It does not eliminate the root blast radius.
B:Encrypting the object at rest does not narrow the key's root permissions, remove copied keys, or provide per-workload authorization. Any process that retrieves it still has account-wide root credentials.
C:SCPs are guardrails for covered member-account principals, not a mechanism for changing the identity of root access keys. The proper replacement is a least-privilege role-based credential path.
Question 115
A regulated business needs to complete occasional root-only actions such as changing certain account settings. Today the root password is shared with everyone in operations and used for routine deployment. Auditors require controlled emergency access with clear custody and a traceable procedure. Which design best meets that policy?
- Allow permanent daily root access but require staff to write changes into a shared spreadsheet afterward.
- Remove all recovery access to the root identity, including MFA devices, so no one can ever use it.
- Create individual root users for each operations employee to distinguish their activity.
- Reserve root sign-in for documented emergency or root-only work, protect its credentials and MFA, and monitor use while routine work uses delegated roles.
Explanation
Correct Answer
D:A controlled break-glass procedure maintains availability for genuine root-only account operations while eliminating shared daily root use. Credential custody, MFA, logging and review make invocation accountable.
Incorrect Answers
A:Manual reporting cannot enforce least privilege or prevent abuse of root credentials between reports. A shared root login also fails to provide robust actor attribution for individual API calls.
B:Some account administration or recovery actions may still require root-level access. Eliminating every recovery avenue risks account lockout instead of establishing monitored, restricted break-glass access.
C:An AWS account has a root identity, not separately created per-employee root users. The supported way to identify administrators individually is delegated federation or IAM identities, not root duplication.
Question 116
A company has twelve AWS accounts and 600 employees. Every account has local IAM users, and revoking access for a departing employee requires twelve independent changes. The architect wants one centrally administered workforce entry point while preserving account-specific privileges. Which approach is best?
- Configure one security group with every employee's corporate IP address and use it as the AWS sign-in permission system.
- Create another long-lived IAM user for each employee in a thirteenth management account and share its keys with member accounts.
- Grant public S3 bucket access to all company employees so access no longer depends on AWS IAM users.
- Use IAM Identity Center with centralized workforce identities and account-level permission-set assignments.
Explanation
Correct Answer
D:Identity Center provides a consistent workforce access portal and central assignment of permission sets to accounts. Disabling a worker and their assignments no longer depends on locating separate local IAM users in every account.
Incorrect Answers
A:Security groups filter VPC network traffic to attached resources; they do not authenticate human administrators or assign cross-account AWS API permissions. The account identity model remains fragmented.
B:An IAM user in one account does not automatically authorize activity in all other accounts. Static keys also recreate the long-lived credential and revocation problems the company is trying to remove.
C:S3 public resource access cannot replace authenticated workforce administration of EC2, IAM and other account services. It would also expose resources outside the intended employee population.
Question 117
An enterprise already authenticates employees in a corporate SAML identity provider and has a reliable joiner/mover/leaver lifecycle. Its AWS landing zone is expanding, but security leadership refuses to operate another independent password directory. How should the architect integrate workforce sign-in?
- Export employee passwords from the corporate directory and create a separate IAM user with the same password in every account.
- Add the identity provider's public IP address to every RDS database security group as a substitute for AWS login federation.
- Issue one root-user access key and pass it through the identity provider's employee portal.
- Connect the existing supported external identity provider to IAM Identity Center and map employees to AWS account assignments.
Explanation
Correct Answer
D:Identity Center supports workforce federation with an external identity source, allowing established identity lifecycle controls to govern AWS access. Permission sets still define authorization in target accounts.
Incorrect Answers
A:Copying passwords into IAM users creates an independent credential store and undermines centralized revocation. IAM users do not synchronize password and lifecycle state merely because an administrator imported credentials.
B:Database security groups regulate network connections, not AWS console or API authentication. Opening RDS connectivity does not establish an identity federation trust for employees.
C:A shared root key is not a federated session and grants the wrong level of privilege. Portal distribution does not turn root into distinct auditable employee principals with account-scoped access.
Question 118
New compliance analysts must receive read-only access to two audit accounts, while platform engineers need deployment rights in five workload accounts. The company has connected employees to IAM Identity Center. How should these entitlements be represented?
- Give both groups AWS account root credentials, then limit the engineers with VPC network ACLs.
- Add every person's email address as a Principal entry in an S3 bucket policy and treat that policy as account login permission.
- Create appropriate permission sets and assign them to the relevant identity groups in the selected AWS accounts.
- Create one AWS Organizations SCP that allows auditors read access and engineers deployment access without using any IAM permission sets.
Explanation
Correct Answer
C:Permission sets describe the IAM access granted through Identity Center for designated accounts. Group-to-account assignments separate analyst read permissions from engineer deployment permissions without duplicating local users.
Incorrect Answers
A:Root credentials cannot be scoped to group-specific IAM actions by a VPC ACL. ACLs govern subnet packet flows and would not prevent root-level changes to IAM or account settings.
B:S3 bucket policies authorize access to a resource for AWS principals, not human sign-in to every AWS account. The employees need account-level role sessions with the correct permission sets.
D:SCPs set upper permission boundaries; their Allow statements do not grant workforce access to an account. Group assignments and actual role permissions are still required for authorized actions.
Question 119
An employee signs in successfully through IAM Identity Center and can open the intended account, but receives AccessDenied on one encrypted S3 bucket. Administrators have already confirmed that the employee is assigned the correct account. What should the architect inspect next?
- Replace the worker's Identity Center session with the AWS account root session for all bucket reads.
- Reconfigure the corporate identity provider to accept a shorter password; the login is clearly failing before token issuance.
- Check the permission-set-generated role permissions together with the bucket and KMS key policies, looking for missing allows or explicit denies.
- Add s3:GetObject as a direct IAM permission on a new IAM user for the employee but leave the Identity Center role, bucket policy and KMS key policy unchanged.
Explanation
Correct Answer
C:Identity Center sign-in and account assignment do not automatically authorize every resource operation. S3 and customer-managed KMS keys may impose additional resource/key permissions, and an explicit Deny can block an otherwise valid role session.
Incorrect Answers
A:Using root bypasses the intended least-privilege authorization design and removes individual workforce attribution. The appropriate response is to correct the scoped policies that govern the required access.
B:The employee already authenticated and opened the account, so changing password policy does not explain an S3 authorization denial. The fault is downstream in the applicable resource and role permissions.
D:A separate IAM user would create another identity without resolving the current federated role’s effective permissions. An existing bucket or KMS explicit deny would still apply to the relevant request.
Question 120
A central operations account needs to administer a restricted workload account during a migration. Company policy forbids storing access keys for a user in the target account and requires short-lived credentials. Which cross-account access pattern is best?
- Create a target-account IAM user and email its access key to the central operations team.
- Add an S3 bucket policy permitting the operations account to read buckets and assume it grants all EC2 and IAM administration.
- Attach an internet gateway to both VPCs and rely on IP routing to provide AWS management API permissions.
- Create a scoped IAM role in the workload account and have authorized operators assume it through AWS STS.
Explanation
Correct Answer
D:STS AssumeRole yields temporary credentials for the target role with permissions granted there. Cross-account access can therefore be limited by trust and role policies without provisioning long-lived users in the target account.
Incorrect Answers
A:The long-lived IAM user key violates the stated credential-lifecycle requirement and complicates attribution and revocation. Cross-account role sessions are designed for temporary delegation instead.
B:A bucket policy is resource-specific; it does not authorize the full set of workload-account operations. A role with scoped policies and a matching trust relationship is needed.
C:An internet gateway permits network routing under its route-table conditions but does not grant a principal AWS API authorization in another account. Network paths and IAM permissions are separate.
