Free Practice Questions for Amazon Web Services SAA-C03 Exam

DAX does not support enabling encryption at rest on an existing cluster. To use encryption at rest, you must create a new DAX cluster with encryption enabled at creation time and migrate workloads accordingly.

AWS WAF has limits on how much of an HTTP request body it can inspect. When requests exceed the inspectable size, AWS WAF treats the body as oversize relative to the configured inspection limits, which can lead to rules not evaluating the entire body content. If suspicious payloads are embedded beyond the inspected portion of a large POST request (for example, > 8 MB), WAF cannot reliably detect them purely through body inspection rules.

Given this constraint, the most effective way to “ensure” proper protection is to implement an oversize handling strategy using AWS WAF rule logic: block oversized requests by default and then explicitly allow oversized requests only from known legitimate sources. Option A accomplishes this by adding a rule that blocks oversize requests (so attackers cannot bypass inspection by sending very large bodies) and a higher-priority allow rule to permit large requests from trusted hosts (for example, specific known partners, internal CIDRs, or authenticated upstream systems). This design reduces the attack surface and provides deterministic behavior for requests that cannot be fully inspected.

Option B is incorrect because Shield Advanced is for DDoS protection and does not extend WAF’s request-body inspection size. Option C is unrelated: Content-Type can influence application parsing, but it will not overcome WAF body-size inspection limitations. Option D is not a practical fit for AWS WAF inspection because WAF evaluates requests at the edge/service layer; it does not natively “call Lambda to rewrite the request body” before WAF evaluates it. Any preprocessing would require a different architectural pattern (such as handling uploads out-of-band), which is beyond the scope and would add operational complexity.

Therefore, A is the correct approach: implement explicit oversized request handling by blocking by default and allowing only vetted large requests.

AWS documentation states that when Lambda processes events, a dead-letter queue (DLQ) using Amazon SQS is the correct mechanism to capture failed invocations for later reprocessing.

SQS provides durable buffering and decoupling, allowing records to be retried safely without loss.

Kinesis Firehose (Option B) does not support SQL replays or arbitrary replay control. SNS (Option D) is not a durable store. OpenSearch (Option C) is not intended for durable retry queues.

=====================================================

Amazon S3 presigned URLs are the most secure fit because they providetime-limited access to specific objectswithout requiring the external vendor to have AWS credentials or direct bucket permissions. AWS documentation states that presigned URLs grant temporary access to private S3 objects and can be used for downloads through a browser or program. This is stronger than creating an IAM user or sharing temporary keys because those methods still expose AWS credentials to a third party. A bucket policy based only on source IP is broader and less precise than object-level, time-bounded access. Presigned URLs let the company control exactlywhich objectcan be downloaded andfor how long, which is exactly what the scenario requires. (AWS Documentation)

============

Since the company already usesIAM Identity Center, the lowest-overhead and most consistent design is to manage access throughpermission setsassigned to groups. AWS documentation explains that permission sets are the central mechanism IAM Identity Center uses to grant least-privilege access to AWS accounts and resources. This approach fits team-based access for development, testing, and operations without having to manage individual IAM users in each account. It also aligns with AWS guidance to apply least privilege by creating restrictive permission sets instead of broad standing permissions. The other options either introduce more manual identity management or create unnecessary account complexity for the scenario described. (AWS Documentation)

============

AWS Key Management Service (AWS KMS) provides multi-Region keys, allowing the same key to be used across Regions without managing your own hardware or key replication.

Multi-Region keys are fully managed and support attribute-based access control (ABAC) using tags and condition keys.

CloudHSM (Options C and D) requires full key lifecycle management, synchronization, and hardware operations, resulting in significantly higher overhead.

Imported key material (Option B) increases key-management responsibility.

=====================================================

Comprehensive and Detailed Explanation (from AWS Solutions Architect documentation):

Amazon DynamoDB is a fully managed NoSQL database engineered for extremely high throughput and millisecond-level response times at any scale. It can automatically scale to support millions of requests per second and requires no management of infrastructure, storage provisioning, or server maintenance.

AWS documentation specifically highlights DynamoDB as the optimal solution for ecommerce workloads that require consistent low-latency performance, massive scalability, and near-zero operational overhead.

Aurora and RDS cannot support millions of requests per second, and Redshift is a data warehouse not intended for transactional workloads.

The application has aknown steady baselineand the processescannot be interrupted, so Spot Instances are not appropriate. For steady-state EC2 usage, AWS cost optimization guidance favors commitment-based pricing such as Reserved Instances or Savings Plans, while EC2 Auto Scaling can still maintain the baseline instance count for the workload. Auto Scaling groups are designed to keep at least the configured minimum number of instances running. Option B does not include a discount strategy for the baseline, and option C introduces Spot capacity, which conflicts with the non-interruptible requirement. Lambda is also not a natural fit for long-running analytics processes. Therefore, using an Auto Scaling group sized for the baseline and applying Reserved Instance pricing to that baseline is the most cost-effective answer among the choices.

============

AWS recommends usingSystems Manager Session Managerinstead of direct SSH for administrative access because it provides browser-based or CLI-based access without bastion hosts and supports centralized audit logging. To allow private instances to reach Systems Manager without internet exposure, the VPC needs the appropriateinterface VPC endpoint. The managed instances also need the proper instance permissions, and AWS documentation points to theAmazonSSMManagedInstanceCorepolicy for that purpose. A gateway endpoint is not used for Session Manager, and attaching a user-facing Session Manager policy to the EC2 instances themselves is the wrong permission model. This makesB and Ethe most operationally efficient and secure combination. (AWS Documentation)

============

IAM user creation and deletion are AWS API management events. CloudTrail records management events such as IAM CreateUser and DeleteUser API calls. EventBridge can match these CloudTrail events with an event pattern and route the matching events to an Amazon SNS topic. Subscribing the company’s email address to the SNS topic provides the required email notification. Amazon Inspector is for vulnerability and exposure findings, not IAM account-change monitoring. GuardDuty can detect suspicious IAM behavior, but it is not the correct service for deterministic notifications every time a user is created or deleted. Amazon Macie is focused on sensitive data discovery and data security findings in services such as Amazon S3, not IAM lifecycle events.

EC2 Account Attributes: Amazon EC2 allows you to set account attributes to automatically encrypt new EBS volumes. This ensures that all new volumes created in your account are encrypted by default.

Configuration Steps:

Go to the EC2 Dashboard.

Select " Account Attributes " and then " EBS encryption " .

Enable default EBS encryption and select the default AWS KMS key or a customer-managed key.

Prevention of Unencrypted Volumes: By setting this account attribute, you ensure that it is not possible to create unencrypted EBS volumes, thereby enforcing compliance with security requirements.

Operational Efficiency: This solution requires minimal configuration changes and provides automatic enforcement of encryption policies, reducing operational overhead.

Amazon Aurora MySQL supports the SELECT INTO OUTFILE S3 SQL syntax to export query results directly to Amazon S3. This is an efficient and low-overhead method for archiving data.

Once data is in S3, Lifecycle rules can be configured to automatically transition older data to lower-cost storage classes (such as S3 Glacier) or delete it after a defined period, providing a cost-optimized and automated archive solution.

The Glue-based options involve more services and operational overhead. SCT is intended for database migrations, not for periodic data archival.

Amixed Auto Scaling groupwith both On-Demand and Spot Instances is the best answer because AWS documents that mixed instances groups let you launch and automatically scale a fleet of On-Demand and Spot Instances in a single Auto Scaling group to optimize cost while maintaining scale and performance. Since the workload can tolerate occasional disruptions, Spot is appropriate, but keeping some On-Demand capacity adds stability. This is a more practical architecture than moving the whole workload to Spot alone. Continuing with only On-Demand or buying Reserved Instances would not optimize cost as well for variable usage.

============

Amazon CloudFront is a highly cost-effective CDN that caches content like images and videos at edge locations globally. This reduces latency and the load on the origin S3 bucket. It is ideal for static content that is accessed by many users.

The most cost-effective way to provide consistent SQL query performance on a heavily structured dataset, where some data is accessed more frequently, is to use Amazon Redshift as your main data warehouse for hot data and Amazon Redshift Spectrum to query cold data that remains in S3. With this approach, frequently queried data is loaded into Redshift for fast, consistent querying, while infrequently accessed data is left in S3 and accessed on demand via Spectrum, avoiding unnecessary data warehousing costs. Amazon Kinesis Data Firehose provides an easy and scalable way to ingest streaming data directly to both S3 and Redshift.

AWS Documentation Extract:

" Amazon Redshift Spectrum allows you to run queries against exabytes of data in Amazon S3 without loading or transforming the data. Load hot data into Redshift for fast access and query cold data in S3 with Spectrum, optimizing both cost and performance. "

(Source: Amazon Redshift documentation, Spectrum)

A: Athena is good for ad hoc queries but not for consistent, high-performance SQL workloads.

B, C: Loading all data into Redshift is not cost-effective if some data is infrequently accessed.

Amazon SQS with a 2-day retention ensures the data lives just as long as needed. EventBridge Pipes allow direct integration between event producers and consumers, with optional filtering and transformation. AWS Step Functions supports manual approval steps, which fits the workflow requirement perfectly.

When using imported key material with AWS KMS, you maintain control over the key lifecycle. AWS KMS allows you to import new key material into an existing KMS key (of type " external " or " imported " ), thus rotating the key material without changing the key ID or ARNs. This enables applications to continue using the same key for cryptographic operations without disruption.

You can also set an expiration time for the old key material, after which AWS KMS deletes the old material and requires new key material to be imported, enforcing regular rotation per your compliance requirements.

AWS Documentation Extract:

" To rotate imported key material, you can re-import new key material into the same KMS key. This retains the same key ID and ARNs so applications are unaffected. You can set an expiration time for imported key material and replace it as needed, ensuring compliance with your rotation policy. "

(Source: AWS Key Management Service Developer Guide, Importing Key Material, Rotating Key Material)

Other options:

A: You cannot create a new KMS key with the same key ID as an existing one.

B: Deleting and recreating the key disrupts application access because the key ID changes.

D: Automatic rotation is only available for AWS-managed keys, not for imported key material.

Latency-based routing in Amazon Route 53 is designed to route users to the Region that provides the lowest network latency, based on Amazon’s measurements of latency between AWS Regions and users’ networks. For applications deployed in multiple Regions, this provides the highest performance experience for global users.

Therefore, creating an A record with a latency routing policy is the correct choice.

Geolocation (Option B) routes based on user location, which may not always correspond to the lowest latency.

Failover (Option C) is for active-passive architectures, not performance optimization.

Geoproximity (Option D) is more complex and focused on directing traffic based on geographic bias rather than measured latency.

Amazon RDS Custom for Oracle: This service allows you to bring your own Oracle Database licenses and provides the flexibility to customize the database settings, making it suitable for applications that require privileged access and third-party database features.

BYOL (Bring Your Own License):

RDS Custom supports the BYOL model, allowing you to use your existing Oracle licenses and comply with licensing requirements.

This helps in leveraging existing investments and reducing migration costs.

Customization and Third-Party Features:

RDS Custom allows for deeper customization of the database environment compared to standard RDS instances.

This makes it possible to support the third-party features that your application relies on without significant changes.

Migration Process:

Use native Oracle tools like Data Pump or RMAN to migrate the database to RDS Custom.

Customize the database settings post-migration to ensure compatibility with third-party features.

Unpredictable Lambda traffic can create a “connection storm” against a relational database because each concurrent Lambda invocation may open its own database connection. Relational engines like PostgreSQL have finite connection capacity, and excessive connections can degrade performance, increase latency, and exhaust database resources. Amazon RDS Proxy is designed to address this by pooling and reusing database connections, multiplexing many application requests over a smaller number of established database connections. This helps keep database performance more predictable under spiky, highly concurrent workloads such as Lambda.

Because the database is a private RDS for PostgreSQL instance, the Lambda functions must run with network access to the VPC subnets and security groups that can reach the database and proxy. Therefore, deploying the Lambda functions inside a VPC and pointing the database client to the RDS Proxy endpoint is the correct operational pattern. RDS Proxy also provides benefits like improved failover behavior handling and centralizing credential management integration patterns (commonly with IAM authentication and/or Secrets Manager), further reducing operational risk.

Option A uses a custom endpoint, which does not solve the fundamental connection scaling problem; it’s not a connection pooler. Option C and D place Lambda outside the VPC, which will not work for a private database that has no public connectivity path. Even if connectivity were possible, D would still be incomplete because you’d need private networking to reach the proxy.

Therefore, B best meets the requirement by introducing managed connection pooling via RDS Proxy and ensuring private network reachability by running Lambda in the VPC.