AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 4
Question 30
A platform group lets application teams create their own IAM roles. A developer can attach arbitrary administrator policies to newly created roles. Security requires a hard maximum permission set even when team-managed role policies are overly broad. Which control best provides this boundary?
- Add a resource tag named Restricted to every EC2 instance and leave role creation unchanged.
- Require each created role to have an approved IAM permissions boundary restricting its effective maximum permissions.
- Grant iam:* to each developer and rely on CloudWatch alarms as a substitute for authorization control.
- Add a Deny statement to each developer-managed role's identity policy and let developers remove or edit that same policy when creating new roles.
Explanation
Correct Answer
B:An IAM permissions boundary limits the maximum permissions of the role even if an attached identity policy grants broader actions. Delegated role creation must also be constrained so developers cannot omit or remove the approved boundary.
Incorrect Answers
A:Tags can support ABAC when policies use them but are not, by themselves, a ceiling on what newly created roles can do across AWS services.
C:Monitoring is detective rather than preventive. CloudWatch alerts do not stop a new role with broad effective permissions from being abused before an alert is investigated.
D:A Deny can restrict use while it remains effective, but an unconstrained creator able to remove it can escape the proposed ceiling. An enforced permissions boundary plus creation/update controls prevents bypass.
Question 31
An internet-facing application behind an Application Load Balancer has repeated HTTP requests matching known exploit payloads and abusive source patterns. The company wants managed and custom layer-7 filtering without replacing the ALB. Which design is most direct?
- Add an S3 gateway endpoint to the public subnets and expect it to filter inbound HTTP headers.
- Increase the ALB listener idle timeout until suspicious requests expire.
- Associate an AWS WAF web ACL with the supported ALB and configure appropriate managed and custom rules.
- Add a VPN to every administrator laptop and assume public clients will then be inspected.
Explanation
Correct Answer
C:AWS WAF integrates with supported ALB resources and evaluates web requests using rule groups, conditions and actions. It can filter the stated application-layer patterns before the request reaches the targets.
Incorrect Answers
A:An S3 gateway endpoint routes eligible S3 API traffic privately; it does not inspect public HTTP requests received by an ALB.
B:The idle timeout affects connection handling, not whether a malicious request's URI, headers or other layer-7 attributes should be allowed or blocked.
D:An administrator VPN can protect management connectivity but does not inspect or control the public application's client requests through an internet-facing ALB.
Question 32
A containerized order service has a database password baked into its Docker image. Rotating the password requires rebuilding the image, and several teams can see the embedded value. Which change best reduces credential exposure while supporting rotation?
- Store the database credential in AWS Secrets Manager, authorize the workload role to retrieve it, and integrate a supported rotation/retrieval process.
- Put the password in an image layer with a less recognizable filename and continue sharing the image.
- Move the password to a public S3 bucket with a long cache TTL to avoid reloading it.
- Allow every ECS task to read the account root user's access keys instead of the database password.
Explanation
Correct Answer
A:Secrets Manager stores secret values independently from immutable container images, supports permission-controlled retrieval and suitable rotation workflows. The service code should handle refresh and avoid logging retrieved values.
Incorrect Answers
B:Renaming a file does not remove embedded secrets from image layers, registries, downloads or developer access. Rotation still entails a risky redeployment process.
C:A public object would increase exposure of a live credential. Caching does not provide secret access control or safe credential rotation for a database client.
D:Root credentials carry far broader AWS permissions and are not database authentication secrets. Propagating them to tasks would create a severe additional security problem.
Question 33
A documentation service frequently overwrites files stored under stable S3 object keys. Operators occasionally delete or replace the wrong file and need to restore its previous content. Immutability against privileged administrators is not required. Which capability directly supports recovery?
- Enable S3 Transfer Acceleration for every bucket operation.
- Set CloudFront's default TTL to one year so old objects remain available permanently at the origin.
- Place the bucket behind a NAT gateway to retain past keys.
- Enable S3 Versioning and establish an operational restore process for earlier object versions and delete markers.
Explanation
Correct Answer
D:S3 Versioning retains prior versions after writes and uses delete markers for ordinary deletes, allowing operators with proper permissions to retrieve or restore earlier content. Lifecycle and permission controls should fit retention needs.
Incorrect Answers
A:Transfer Acceleration helps eligible long-distance uploads using edge locations. It does not preserve the old content of an overwritten object key.
B:CloudFront cache behavior is not an authoritative object history, and stale cached content cannot replace controlled version recovery in S3.
C:NAT is a network egress service and has no object history or rollback mechanism for changes made through the S3 API.
Question 34
A company is provisioning a new Amazon RDS production instance. Policy requires database storage, automated backups and snapshots to be encrypted at rest using the approved encryption configuration. TLS between clients and database is already configured. What should the architect do?
- Keep the new DB unencrypted because TLS automatically encrypts the underlying RDS data volumes.
- Enable RDS storage encryption with an authorized KMS key when creating the DB instance or cluster, checking the supported engine and snapshot configuration.
- Set the DNS record for the DB endpoint to an alias so that snapshot blocks become encrypted.
- Enable CloudWatch Logs retention on the DB but leave its storage unencrypted.
Explanation
Correct Answer
B:RDS encryption at rest uses AWS KMS integration for supported engines and encrypts the storage with associated automated backups and snapshots. Choosing it at creation avoids incompatible after-the-fact changes to an unencrypted deployment.
Incorrect Answers
A:TLS protects bytes in transit but is not storage encryption. It does not determine whether database volumes and derived backups are encrypted on disk.
C:DNS aliases influence endpoint resolution and do not modify block encryption or snapshot cryptography.
D:Operational log retention affects audit information and cost, not the encryption state of RDS storage or backups.
Question 35
A background processor calls ReceiveMessage every second on an SQS Standard queue. Messages arrive only a few times per minute, so most requests return empty. The team wants fewer empty receives without sacrificing buffered delivery. What should change?
- Replace SQS with Amazon S3 static website hosting to reduce API requests.
- Turn off queue retention so workers cannot receive old work.
- Use SQS long polling with an appropriate WaitTimeSeconds or queue receive-wait setting.
- Set the message visibility timeout to zero so every empty receive waits for a different queue.
Explanation
Correct Answer
C:Long polling can wait for messages before returning, reducing empty API responses and often minimizing receive cost while retaining SQS queue durability and delivery behavior.
Incorrect Answers
A:S3 website hosting is not a work queue and has no ReceiveMessage buffering semantics for the producer-consumer pattern.
B:Shortening retention could lose unprocessed messages and would not make consumers wait for new messages during sparse traffic.
D:Visibility timeout governs how long a received message is hidden from other consumers, not the duration of a ReceiveMessage request that finds no messages.
Question 36
A loan-processing workflow invokes document validation, a risk check and final approval. Each step can fail independently, and reviewers need a durable execution history, conditional branches and explicit retry behavior. Which AWS service best coordinates the workflow?
- Run all steps inside one Lambda invocation with a custom sleep-and-poll loop until every external service responds.
- Publish one CloudWatch metric for each workflow state and treat metric alarms as the workflow engine.
- Use CloudFront functions to orchestrate long-running external approval steps at the edge.
- Use AWS Step Functions state machines to coordinate the tasks, branch on results and apply configured retries and error handling.
Explanation
Correct Answer
D:Step Functions provides explicit state transitions, choices, waits and retries around supported service integrations. Its execution record allows operators to diagnose individual task failures and resume through designed paths.
Incorrect Answers
A:A monolithic Lambda faces execution-duration and error-recovery constraints and requires custom persistence for state, progress, branching and retries across long-running steps.
B:Metrics and alarms help observe progress but cannot provide the state transitions, waiting behavior, execution history and compensating paths needed for this business workflow.
C:CloudFront Functions are lightweight edge request logic, not durable multi-step business process orchestration with external approvals.
Question 37
A company has a primary HTTPS endpoint in one Region and a prebuilt secondary endpoint in another. During a regional outage it wants DNS answers to favor the secondary after a configured health evaluation rather than waiting for an operator to edit records. Which DNS configuration fits?
- Use Route 53 failover records with appropriate health checks or evaluated target health and tested primary-secondary routing.
- Use an EC2 security group to advertise the secondary endpoint as an internet BGP route.
- Add an RDS read replica in the primary AZ and assume DNS for every application endpoint will switch Regions.
- Set every DNS record to a hardcoded primary private IP with a long TTL and make manual updates the failover procedure.
Explanation
Correct Answer
A:Route 53 failover routing can return the secondary record when the primary is judged unhealthy according to the configured health or alias evaluation. Application data readiness and DNS cache effects still need testing.
Incorrect Answers
B:Security groups filter instance or ENI traffic and do not announce public BGP routes or make authoritative DNS failover decisions.
C:An RDS replica does not govern DNS routing for an HTTPS application endpoint, nor does a same-AZ reader provide cross-Region service failover by itself.
D:Hardcoding a single private address and requiring manual updates directly violates the automatic regional endpoint-selection requirement and can delay recovery.
Question 38
An application needs local database reads for customers in two distant AWS Regions while maintaining one primary write Region. Its recovery design also requires managed low-latency cross-Region database replication for a supported Aurora engine. Which architecture is the best match?
- Use one single-AZ RDS instance in the primary Region and serve all distant users across the WAN.
- Run nightly AWS DMS full-load-only jobs into an independent Aurora cluster in the second Region and treat the resulting copies as continuously fresh local readers.
- Evaluate an Aurora Global Database with its primary cluster and supported secondary regional clusters, accounting for async replication and promotion behavior.
- Copy occasional Aurora DB snapshots to the second Region and restore independent clusters after each snapshot as the sole multi-Region read strategy.
Explanation
Correct Answer
C:Aurora Global Database offers a primary Region with secondary clusters for low-latency regional reads and disaster recovery on supported engines. Replication is asynchronous, so promotion and possible lag must be planned.
Incorrect Answers
A:One single-AZ instance provides neither local regional readers nor a managed cross-Region recovery copy of the relational data.
B:A nightly full-load copy is a periodic data move, not continuously low-lag Aurora global replication. Read freshness and failover automation would not meet the near-real-time regional requirement.
D:Snapshot copy and restore provide point-in-time recovery copies, not active low-latency regional readers kept current continuously by Aurora Global Database replication.
Question 39
A transactional database on EC2 has sustained small random I/O demand and strict latency goals. A measured gp3 configuration cannot supply the required supported IOPS/performance envelope. Which storage choice is most appropriate for a qualifying instance?
- Move the database to S3 Glacier Deep Archive and issue random block reads over a filesystem mount.
- Use an appropriately provisioned Amazon EBS io2 volume and verify its limits, attachment support and instance-side EBS bandwidth.
- Replace the database disk with an SQS FIFO queue to gain strict write-order block storage.
- Increase CloudFront cache TTL on the database's administrative website without changing the volume.
Explanation
Correct Answer
B:EBS io2 is intended for high-performance block workloads with provisioned IOPS and supported durability characteristics. The design still requires checking volume and EC2 instance throughput/IOPS ceilings.
Incorrect Answers
A:Glacier Deep Archive is archival object storage with restore workflows and cannot serve EC2 transactional block I/O at the required latency.
C:A message queue is not a block device and does not provide random transactional reads/writes, filesystem semantics or database volume guarantees.
D:Caching an administrative HTTP page does not increase the underlying database block device's random I/O capacity.
Question 40
A manufacturer must repeatedly synchronize tens of terabytes of files from an on-premises NAS to an S3 bucket. It wants scheduled transfers, validation and managed throughput handling rather than operating custom rsync hosts and restart scripts. What is the best fit?
- Use S3 static website hosting to copy files from SMB/NFS automatically without transfer agents.
- Use CloudTrail event history as a managed file-replication engine.
- Attach one EBS Multi-Attach volume across the on-premises network and to the S3 bucket.
- Configure AWS DataSync with a supported source location, destination, agent/connection model and scheduled transfer tasks.
Explanation
Correct Answer
D:DataSync offers managed transfer tasks between supported file/object locations, with scheduling, parallelism and verification capabilities. The network path and endpoint prerequisites must be sized for the data volume.
Incorrect Answers
A:S3 website hosting serves public website content but cannot crawl an on-premises NAS and continuously perform scheduled, verified bulk copy jobs.
B:CloudTrail records AWS API activity; audit logging is not a managed payload-movement and checksum-validation mechanism for NAS files.
C:EBS is a zonal block service attached to supported EC2 instances, not a distributed mount bridging local NAS storage into an S3 bucket.
