Free AWS SAA-C03 Practice Questions

Q1.A regional charity runs its donor management application in one Region. The trustees have stated that in a regional disaster a full day of downtime is acceptable, and they have asked for the lowest possible ongoing cost because unspent donations fund programmes. The architect must choose a disaster recovery strategy for the second Region. Which strategy meets these requirements?

• A.Backup and restore, copying backups to the second Region and running nothing there between disasters
• B.Pilot light, keeping the database replicating and running in the second Region with compute switched off
• C.Warm standby, running a scaled-down but fully working copy of the environment in the second Region
• D.Multi-site active-active, serving donors from both Regions at full capacity

Domain: Design Resilient Architectures

Q2.A university research office receives data from genomics instruments, survey tools and partner institutions in a mix of CSV, JSON and Parquet files. It wants one central store holding the data in its original format, with structure applied when the data is read rather than when it is written, so that SQL queries, Spark jobs and machine learning training can all read the same copy without loading it into each engine first. Which service should form the foundation of this design?

• A.Amazon S3
• B.Amazon Redshift
• C.Amazon EFS
• D.Amazon RDS for PostgreSQL

Domain: Design High-Performing Architectures

Q3.An online education provider gives its on-call engineers a role with the AdministratorAccess policy attached. During an incident the engineers only ever need to read the application's CloudWatch log group and restart the EC2 instances belonging to that application. Security wants least privilege without slowing incident response. What should the solutions architect do?

• A.Create a role whose permissions policy allows only the required log-read and instance restart actions on that application's resources, and have the on-call engineers assume it.
• B.Keep the AdministratorAccess role but require a manager to approve each use before an engineer assumes it.
• C.Replace AdministratorAccess with an account-wide read-only policy for the on-call role.
• D.Create an IAM user with access keys for each on-call engineer, scoped to the application's resources.

Domain: Design Secure Architectures

Q4.A payments processor is designing a settlement pipeline on an Amazon SQS FIFO queue. Settlement instructions for a given merchant account must be applied in strict order, but instructions for different merchant accounts are independent. Load testing shows the producer needs to sustain about 2,500 instructions per second, and the current implementation sends one message per SendMessage call and is being throttled. Which solution meets the throughput requirement while preserving the required ordering?

• A.Send messages in batches of ten with the merchant account identifier as the message group ID.
• B.Replace the FIFO queue with a standard queue and send messages in batches of ten.
• C.Add more consumer instances so that messages are received and deleted faster.
• D.Create ten FIFO queues and have the producer hash each merchant account to one of them, sending one message per call.

Domain: Design Resilient Architectures

Q5.A brokerage runs a monolithic trading application that requires a vendor supplied kernel module to be loaded at boot and expects a full operating system it can configure. A rewrite has been quoted at two years and rejected by the board. The platform team must move the application to AWS within six months and wants it to run behind a load balancer with automatic replacement of unhealthy nodes. Which solution meets these requirements?

• A.Run the application on EC2 instances in an Auto Scaling group behind an Application Load Balancer
• B.Containerise the application and run it as an Amazon ECS service on AWS Fargate
• C.Refactor the application into AWS Lambda functions behind an Application Load Balancer
• D.Deploy the application with AWS App Runner from a container image

Domain: Design High-Performing Architectures

Q6.A logistics company runs a packaged order routing application on EC2 instances in private subnets. The application publishes messages to an Amazon SQS queue using the standard regional service hostname, which is compiled into a vendor binary that cannot be modified or reconfigured. Security has demanded that the SQS traffic stop using the NAT gateway and stay on private addresses. Which solution meets these requirements?

• A.Create an interface VPC endpoint for Amazon SQS and enable private DNS on it.
• B.Create an interface VPC endpoint for Amazon SQS with private DNS disabled and point the application at the endpoint-specific DNS name.
• C.Create a gateway VPC endpoint for Amazon SQS and associate it with the private route tables.
• D.Keep the NAT gateway and permit outbound traffic only to the published Amazon SQS service addresses.

Domain: Design Secure Architectures

Q7.A security review of a two-year-old AWS account finds that the root user's password is stored in a shared team password vault, the root user has an active access key pair, and no second factor is configured for root. The team must remediate the findings for the root user. Which TWO actions should the team take? (Select TWO.)

• A.Enable multi-factor authentication on the root user.
• B.Delete the root user's access key pair.
• C.Attach a policy to the root user that denies all actions.
• D.Configure automatic rotation of the root access keys every 90 days.
• E.Delete the root user from the account and rely on IAM identities only.

Domain: Design Secure Architectures

Q8.A post-production house in Auckland delivers camera masters of roughly 40 GB each to an S3 bucket in eu-west-1 every night. Transfers currently take most of the night, and when the link drops near the end the entire upload has to start again. The company wants faster long-distance transfers and wants a network interruption to cost minutes rather than the whole file. Which combination of actions should the solutions architect take? (Select TWO.)

• A.Enable S3 Transfer Acceleration on the destination bucket and upload through the s3-accelerate endpoint.
• B.Use multipart upload so the parts transfer in parallel and a failed part is retried on its own.
• C.Upload each master as a single PUT request to avoid the overhead of assembling parts.
• D.Create a CloudFront distribution over the bucket and upload through the distribution domain name.
• E.Order AWS Snowball Edge devices and ship each night's masters to the Region.

Domain: Design High-Performing Architectures

Q9.A publishing company runs a web tier in an Auto Scaling group behind an Application Load Balancer, with the group configured to use ELB health checks. The target group health check calls an endpoint that opens a connection to the reporting database and runs a query. During a two minute database slowdown, every target failed its health check, the group terminated the entire fleet, and the site was unavailable for far longer than the database problem lasted. What should the solutions architect change?

• A.Point the target group health check at a lightweight application path that does not query the shared database
• B.Change the Auto Scaling group health check type back to EC2
• C.Increase the health check grace period on the Auto Scaling group
• D.Increase the deregistration delay on the target group

Domain: Design Resilient Architectures

Q10.An energy trading firm operates a warm standby in a second Region: a scaled-down but fully working copy of the application tier runs behind a load balancer, and an Aurora global database replicates from the primary Region. The firm is writing the failover runbook and needs the steps that actually make the standby capable of serving full production write traffic. Which three actions must the runbook include? (Select THREE.)

• A.Raise the Auto Scaling group minimum and desired capacity so the standby tier grows to production size
• B.Fail over the Aurora global database so the second Region becomes the writer
• C.Redirect user traffic to the standby endpoint through the configured DNS failover
• D.Launch the application instances in the second Region from the prepared AMIs
• E.Restore the most recent database snapshot into a new instance in the second Region
• F.Create the load balancer and target groups in the second Region from the infrastructure templates

Domain: Design Resilient Architectures