Free SAA-C03 Practice Test – 20 Questions with Explanations

A healthcare SaaS runs in an AWS Organizations multi-account setup and patient data must stay private within a single Region. The ALB must remain public but the app tier must reach only internal APIs over VPC endpoints with no internet egress. You are reviewing the current subnet routing before a go-live window with zero downtime allowed.

Which subnet is the best placement for the app tier to meet the constraints?

A retail company runs a shopping-cart microservice on Amazon ECS with AWS Fargate in private subnets and must keep all traffic private-only with no public internet egress. The service must scale to 5,000 requests per second with p95 under 60 ms and cannot tolerate cart loss during task replacement. Engineers captured symptoms in Exhibit 1 to decide how to handle state.

Which change best supports stateless scaling while meeting the constraints?

A health insurer stores claims attachments in Amazon S3 and must retain each object for 7 years with audit logging. Objects are frequently accessed in the first 14 days, occasionally accessed until day 60, and then almost never accessed, but compliance investigations require restores within 12 hours. The data must stay in one Region and the team wants to minimize long-term storage cost without changing the application.

Which lifecycle action best fits the long-tail portion of the lifecycle shown in Exhibit 1?

A Lambda-based integration calls a third-party API using a token that must be rotated every 7 days for compliance. The workload must use private-only access to AWS services and cannot store secrets in environment variables or deployment artifacts. Audit logs for secret access must be retained for 12 months.

Which change best satisfies the constraints with the least architectural change?

A global customer profile service must stay available during a full us-east-1 outage with an RTO under 5 minutes. Data is regulated and must remain in US Regions only, and the solution must avoid public internet dependencies for inter-Region traffic paths. The workload needs near-zero data loss for writes and must support automatic failover for clients.
Which design choices best support an active-active DR strategy for this workload? (Select THREE.)

A media rendering farm runs thousands of short-lived EC2 instances across multiple Availability Zones and cannot be redeployed to change file IO paths. The workload requires POSIX semantics with file locking for concurrent writers, and the storage must remain multi-AZ available with p95 single-digit millisecond access for metadata operations. Cost must be controlled by avoiding over-provisioned performance capacity when the fleet scales down.

Which storage service best fits these requirements?

A media company ingests clickstream events that contain regulated identifiers and must keep all data in ap-southeast-2 with 1-year audit retention. The business requires end-to-end ingest-to-transform latency under 15 seconds at 250,000 events/second during bursts, and there is no public internet egress from the VPC. Producers cannot be changed this quarter, and the team wants the simplest scaling model that can absorb burst throughput without manual shard planning.

Which ingestion choice best meets the size/speed requirement while preserving the constraints?

A fintech platform stores compliance exports in Amazon S3 in eu-west-1 and must retain them for 6 years with audit evidence. All access must be private-only through VPC endpoints and data cannot be replicated out of the region. Existing tooling performs direct object GET operations and cannot be changed, but retrieval for audit exports must be available within 15 minutes.

Which option is the best cost-optimized tiering approach for the audit/ prefix given the constraints?

A multi-account data lake stores datasets in Amazon S3 and each object is labeled with a classification value (Public, Internal, Restricted) during ingestion. Governance requires centrally enforced, least-privilege access across accounts with no application redeploy, and all access must remain private within AWS networks. The security team needs analysts to query only Internal data while a separate audit group can access Restricted data with approvals.

Based on Exhibit 1, which control best enforces access using classification across accounts?

A checkout workflow calls Fraud, Inventory, and Shipping synchronously, and a downstream slowdown sometimes causes a cascading failure across the site. The system must absorb 10x burst traffic, and audit logs must be retained for 12 months due to regulated data. Service-to-service calls must remain private with no public internet access, and teams deploy across multiple AWS accounts.

Which change best applies a distributed design pattern to reduce cascading failures and absorb bursts?

A legal firm must keep active case files accessible from on-prem with minimal workflow change, and the authoritative copy must stay in a single AWS Region for data residency. The office cannot use public internet connectivity, and the solution must provide a local cache to keep day-to-day access responsive. Storage growth is expected to reach hundreds of TB, so the backend must scale without on-prem expansion.

Which solution best matches Exhibit 1?

A streaming commerce app uses an Aurora MySQL cluster and sees p95 read latency spikes during evening peaks while write latency must remain steady. The data is regulated and must stay private-only, and the team cannot redeploy services during the current release freeze. Budget is capped, so the fix should add capacity only where needed with no downtime.

Which change best reduces p95 read latency without impacting write performance?

An e-commerce platform stores invoice PDFs in an S3 bucket encrypted with SSE-KMS and must retain audit logs for 7 years. A third-party analytics account needs read access only to a single prefix, and access must be private-only with no public internet exposure. You captured current access patterns and permissions in Exhibit 1 to remove unnecessary privilege.

Which change best enforces least privilege for the vendor’s access requirement?

A customer-facing API runs on an Amazon EC2 Auto Scaling group behind an Application Load Balancer and must keep p95 latency under 250 milliseconds. The workload has unpredictable bursts, the team cannot change application code, and there is a strict budget cap to avoid over-provisioning. All traffic must remain private-only to backend systems with centralized logging retained for 12 months.

Which scaling strategy best meets the latency target while minimizing cost?

A multi-account analytics platform runs Amazon ECS tasks in private subnets and must keep traffic private-only for regulated data. Cost Explorer shows a sudden jump in network spend after a scale-out event, and the team has a strict budget cap with no application code changes allowed. The workloads primarily read and write to Amazon S3 and DynamoDB from the VPC.

Which change will reduce network spend the most without violating the constraints?

A bank is building an approval workflow that includes automated checks plus a manual review step that can take up to 36 hours. The solution must keep a complete execution history for audits and must not rely on public internet access for internal service calls. The design must minimize cost while ensuring the workflow does not duplicate irreversible external actions.

Which orchestration option best fits the requirements?

A regulated research workload stores datasets in S3 and critical metadata in Amazon RDS, and auditors require recoverable data for seven years. Backups must be immutable and centrally governed across accounts, but data must remain in-country within one Region. The team wants the lowest operational overhead and cannot modify the applications.
Which controls best meet the requirements? (Select THREE.)

A company centralizes application logs in an Amazon S3 bucket in a security account and must keep access private with no public internet paths. Uploads must be encrypted with SSE-KMS and must include a DataClass tag for governance, and the teams cannot redeploy the log shippers. An engineer added the following bucket policy but untagged objects are still being written successfully.
Snippet

Which change fixes the policy to enforce the tag requirement at upload time?

A database server on Amazon EC2 uses a single EBS volume and is exceeding its monthly cost target. The workload contains regulated data and must remain encrypted, and changes must be applied with no downtime and no instance replacement. The team must keep p95 latency stable and retain audit evidence of the change for 12 months.

Which change best reduces storage cost while meeting the constraints?

A payments service publishes “PaymentAuthorized” events that must be consumed by Fraud, Notifications, and Ledger services in separate AWS accounts. The design must keep traffic private-only (no public internet) and tolerate any one consumer being down for 48-72 hours without losing events. The team also wants per-consumer retries and clear operational visibility for backlog during burst periods.

Which option best matches the requirements?