SAA-C03 Practice Questions — Free

Question 1 of 25

An ACM certificate needs to renew automatically without manual intervention, requiring a domain validation method that supports this ongoing automatic renewal cleanly. What method is recommended for this?

• A.No validation method at all, since ACM issues certificates without any validation step
• B.DNS validation, since the required CNAME record persists and supports automatic renewalCorrect
• C.Email validation, which requires a human to click a confirmation link at each renewal
• D.Manual certificate upload, which does not apply to certificates ACM itself issues and manages

Question 2 of 25

A security team wants automated, continuous compliance checks confirming that no S3 bucket in the account is ever publicly accessible, with automatic remediation if one is found. What AWS service combination fits this?

• A.CloudWatch Logs Insights queries run interactively by an administrator
• B.AWS Config's managed S3-public-access rule, paired with auto-remediationCorrect
• C.Direct Connect's built-in security event notification feature
• D.Trusted Advisor's cost optimization category, checked once a month

Question 3 of 25

Remote employees need to securely connect to private resources in a VPC over an encrypted connection, without provisioning a full Site-to-Site VPN for each individual employee's home network. What should be used?

• A.AWS Client VPN, providing a managed client-based VPN endpoint for individual usersCorrect
• B.AWS Site-to-Site VPN, designed to connect two networks rather than individual clients
• C.AWS Direct Connect, intended for a dedicated physical link to one location
• D.A NAT Gateway, which provides outbound internet access rather than inbound VPN access

Question 4 of 25

A VPC endpoint for S3 should only allow access to a specific, named bucket, rather than allowing access to any bucket in the account through that endpoint. What should be configured?

• A.An IAM policy alone, since VPC endpoints cannot have their own separate policy
• B.Removing the VPC endpoint entirely, since endpoints cannot be scoped this way
• C.A Security Group rule, since Security Groups can filter access by bucket name
• D.A VPC endpoint policy restricting the endpoint's access to the specific bucketCorrect

Question 5 of 25

An auditing team requires a full, immutable trail of every API call made across all AWS accounts in the organization, stored centrally and protected from deletion by individual account administrators. What should a solutions architect design?

• A.A separate CloudTrail trail configured independently in each member account
• B.AWS Config recording resource configuration snapshots on a daily schedule
• C.CloudWatch Logs alone, capturing only application-level log output
• D.An org-wide CloudTrail trail, logging to a locked-down bucket in a dedicated accountCorrect

Question 6 of 25

Security findings from GuardDuty, Inspector, and Macie need to be aggregated onto a centralized dashboard across an AWS Organization, to prioritize remediation in one place. What service fits best?

• A.AWS Config, which tracks configuration state rather than aggregating findings
• B.Amazon CloudWatch, which aggregates operational metrics rather than security findings
• C.AWS Security Hub, aggregating and prioritizing findings from multiple security servicesCorrect
• D.AWS Trusted Advisor, focused on cost and best-practice checks, not finding aggregation

Question 7 of 25

A CloudHSM cluster needs to remain available if a single HSM instance fails. What is the recommended architecture?

• A.Deploy all HSM instances into one Availability Zone for simplicity
• B.Deploy a single HSM instance, relying on AWS to replace it automatically
• C.Deploy multiple HSM instances across Availability Zones within the clusterCorrect
• D.Use AWS KMS instead, which does not address the CloudHSM availability question

Question 8 of 25

An application needs to call other AWS services using credentials that automatically expire and rotate, rather than a static access key that could be leaked and used indefinitely. What is the underlying mechanism that provides this for an EC2 instance role?

• A.Disabling authentication entirely for calls originating from within the VPC
• B.A single long-term access key pair generated once and never rotated
• C.AWS Security Token Service (STS), issuing short-lived temporary credentials automaticallyCorrect
• D.A shared password used across every application calling AWS services

Question 9 of 25

An RDS database needs to survive the failure of an entire Availability Zone with automatic failover and no data loss, without requiring the application to handle failover logic itself. What should be configured?

• A.A manual daily snapshot of the database, restored only if a failure occurs
• B.Amazon RDS Read Replicas deployed asynchronously in multiple Regions
• C.A single-AZ RDS instance paired with frequent manual backups
• D.Amazon RDS Multi-AZ deployment, with a synchronous standby in a second AZCorrect

Question 10 of 25

An Auto Scaling group needs to wait a defined period after launching a new instance before counting it toward the group's health evaluation, avoiding a slow-starting but ultimately healthy instance being prematurely terminated. What should be configured?

• A.The health check grace period, delaying health evaluation for a newly launched instanceCorrect
• B.A shorter health check interval, which would make premature termination more likely, not less
• C.Removing health checks entirely, which eliminates the protection they otherwise provide
• D.The cooldown period, which governs time between scaling activities rather than initial health evaluation

Question 11 of 25

A DynamoDB table needs to remain available for both reads and writes even if an entire AWS Region becomes unavailable, with data replicated automatically. What DynamoDB feature should be used?

• A.A single-Region DynamoDB table, backed up manually on a nightly schedule
• B.DynamoDB Global Tables, replicating data across multiple RegionsCorrect
• C.DynamoDB Accelerator (DAX), which caches reads but does not replicate across Regions
• D.DynamoDB Streams alone, without any cross-Region replication configured

Question 12 of 25

When an Application Load Balancer deregisters an EC2 instance (for example, during a deployment), in-flight requests to that instance need to be allowed to complete before it's fully removed. What should be configured?

• A.Increasing the instance's size to process in-flight requests faster
• B.Disabling health checks entirely during the deployment window
• C.Immediately terminating the instance the moment deregistration begins
• D.The target group's deregistration delay (connection draining) settingCorrect

Question 13 of 25

A multi-AZ Application Load Balancer needs to keep functioning correctly even if one of its enabled Availability Zones temporarily has no healthy targets at all. What is the expected behavior in this situation?

• A.The ALB permanently and irreversibly removes the affected AZ from its configuration
• B.The entire ALB stops serving any traffic until every enabled AZ has healthy targets again
• C.The ALB requires a manual administrator action before it will route to any healthy target
• D.The ALB continues routing traffic to healthy targets in the remaining enabled AZsCorrect

Question 14 of 25

An order-processing application needs to ensure a message is never lost even if the processing service is temporarily down, and that failed messages can be inspected later rather than silently dropped. What should be added to the architecture?

• A.Deleting failed messages immediately to keep the primary queue clean
• B.Processing every message synchronously with no queue involved
• C.An SQS dead-letter queue, capturing messages that repeatedly failCorrect
• D.Reducing the queue's message retention period to the shortest value

Question 15 of 25

Large file uploads from geographically distant users into an S3 bucket need accelerating, reducing the time long-distance uploads take. What S3 feature addresses this?

• A.S3 Versioning, which tracks object history rather than affecting upload speed
• B.S3 Lifecycle policies, which govern storage class transitions, not upload speed
• C.S3 Object Lock, which enforces retention rather than affecting upload speed
• D.S3 Transfer Acceleration, routing uploads through nearby CloudFront edge locationsCorrect

Question 16 of 25

A telecommunications provider wants to run compute workloads embedded within 5G network infrastructure itself, minimizing latency for mobile application users even further than a Local Zone could provide. What should be evaluated?

• A.AWS Wavelength, embedding AWS compute within telecom providers' 5G networksCorrect
• B.AWS Direct Connect, a dedicated network link rather than compute embedded in 5G infrastructure
• C.AWS Outposts, which extends AWS into a customer's own data center rather than telecom infrastructure
• D.Amazon CloudFront, a content delivery network rather than compute embedded in 5G infrastructure

Question 17 of 25

The Amazon EC2 network interface type providing higher packet-per-second performance and lower latency for a network-intensive workload, compared to the older standard network interface type, needs identifying. What should be used?

• A.The standard (non-enhanced) network interface, which offers superior performance to ENA
• B.An interface type entirely unrelated to actual network performance characteristics
• C.Elastic Network Adapter (ENA), providing enhanced networking performance over the standard interfaceCorrect
• D.Disabling networking entirely, which removes the ability to measure any performance at all

Question 18 of 25

Latency needs reducing for users worldwide accessing static content stored in an S3 bucket in a single Region. What should be implemented?

• A.Amazon CloudFront, caching content at edge locations close to users globallyCorrect
• B.Amazon RDS Read Replicas, unrelated to serving static content from S3
• C.Moving the S3 bucket to a storage class optimized purely for lower cost
• D.Increasing the EC2 instance size in the origin Region to serve requests faster

Question 19 of 25

A workload requires very low, single-digit-millisecond latency to end users concentrated in a specific metro area, closer than a standard AWS Region can provide. What should be evaluated?

• A.AWS Local Zones, extending AWS infrastructure closer to large population centersCorrect
• B.A standard AWS Region alone, which is not designed for single-digit-millisecond metro-level latency
• C.AWS Snowmobile, an exabyte-scale physical transfer device unrelated to live latency-sensitive compute
• D.Amazon S3 Transfer Acceleration, which speeds up uploads rather than serving live low-latency compute

Question 20 of 25

A relational database's read-heavy reporting queries need offloading from the primary instance, without giving up strong consistency for the application's main transactional writes. What should be added?

• A.Amazon Redshift, replacing the relational database's transactional role entirely
• B.A second, entirely separate primary RDS instance handling only writes
• C.Amazon DynamoDB Accelerator (DAX), which caches only DynamoDB, not RDS
• D.Amazon RDS Read Replicas, dedicated to serving the reporting query loadCorrect

Question 21 of 25

A provisioned DynamoDB table's actual traffic pattern needs evaluating to determine whether On-Demand mode would cost less. What is a reasonable way to evaluate this?

• A.Assume Provisioned mode is always cheaper regardless of the traffic pattern
• B.Switch to On-Demand permanently without measuring the actual traffic pattern first
• C.Compare actual consumed capacity metrics in CloudWatch against both pricing modelsCorrect
• D.Assume On-Demand is always cheaper regardless of the traffic pattern

Question 22 of 25

The storage cost of infrequently accessed backup data needs reducing, where the data must still be retrievable within a few hours if ever needed, but almost never actually is. Which S3 storage class fits best?

• A.S3 Glacier Flexible RetrievalCorrect
• B.S3 Intelligent-Tiering, better suited to genuinely unpredictable access patterns
• C.S3 Standard-Infrequent Access, priced higher than Glacier for this exact pattern
• D.S3 Standard, optimized for frequently accessed, low-latency data

Question 23 of 25

A large, fixed EC2 Auto Scaling group minimum size is rarely actually needed, but some baseline capacity should always be guaranteed available. What is a reasonable balance?

• A.A minimum size of zero, removing any guaranteed baseline capacity
• B.A lower baseline sized for steady demand, with dynamic or predictive scaling adding capacity for peaksCorrect
• C.Disabling Auto Scaling, running a single fixed-size fleet sized for the average case
• D.A minimum equal to the highest anticipated peak at all times, regardless of typical demand

Question 24 of 25

Overall AWS spend needs reducing by identifying and terminating EC2 instances that have been stopped for a very long time but are still incurring EBS storage charges for their attached volumes. What is a direct cost-optimization step?

• A.Restart every stopped instance immediately to avoid looking like an unused resource
• B.Review long-stopped instances; terminate or snapshot-and-delete their volumes if unneededCorrect
• C.Leave stopped instances' attached volumes in place indefinitely at no cost concern
• D.Assume stopped instances incur zero cost, since compute billing itself is paused

Question 25 of 25

Amazon RDS is used, but the database is only actually needed running during business hours on weekdays, not around the clock. What is a straightforward way to reduce cost for this pattern?

• A.Automate stopping/starting RDS outside business hours via a scheduleCorrect
• B.Purchase a three-year Reserved Instance, built for continuous usage
• C.Switch to a larger instance size to compensate for reduced uptime
• D.Leave RDS running continuously, since it cannot be stopped and started