AWS SAA-C03 Practice Exam.
Free practice test — 35 verified questions, instant feedback.

Answer: B
A customer-managed key (CMK) in AWS KMS lets the customer define the key policy, control rotation, and audit usage via CloudTrail, satisfying the need for control over rotation and access. SSE-S3 uses AWS-owned/managed keys with no customer control over policy or rotation cadence. Versioning protects against accidental overwrite/deletion but is unrelated to encryption. Skipping at-rest encryption ignores the explicit requirement and default bucket privacy does not equal encryption.

Answer: B
IAM roles attached via instance profiles let EC2 retrieve short-lived, automatically rotated credentials from the instance metadata service, eliminating the need for hardcoded long-term keys. IAM users with access keys embedded in the environment are long-term credentials and a security risk. IAM groups apply only to users, not compute resources. EC2 instances do not support resource-based policies for this purpose.

Answer: B
A resource-based bucket policy can explicitly grant a principal from another account (the Lambda's execution role ARN) permissions such as s3:PutObject, enabling secure cross-account access without shared long-term credentials. Sharing IAM user keys is an anti-pattern and long-term credential exposure. Transfer Acceleration only speeds up uploads over long distances and grants no permissions. VPC peering handles network routing, not S3 authorization.

Answer: B
Enabling account/region-level default EBS encryption plus an SCP that denies the CreateVolume action when Encrypted=false gives a preventive, org-wide guardrail. AWS Config can only detect and remediate non-compliant resources after creation, which is reactive, not preventive. Amazon Inspector assesses vulnerabilities, not encryption enforcement. CloudWatch alarms only notify; they don't block the action.

Answer: C
A NAT gateway placed in a public subnet allows instances in private subnets to initiate outbound connections to the internet (e.g., for patches) while remaining unreachable from inbound internet traffic, preserving the security posture. Attaching an internet gateway directly to a private subnet would effectively make it public. Assigning public IPs exposes the database directly to inbound internet traffic. VPC peering connects two VPCs' private address spaces and does not provide internet access.

Answer: A
GuardDuty is an agentless, managed threat-detection service that continuously analyzes VPC Flow Logs, DNS logs, and CloudTrail management/data events to identify malicious or unauthorized behavior. AWS Config tracks resource configuration compliance, not threat detection. Amazon Macie focuses specifically on discovering and classifying sensitive data (e.g., PII) in S3, not general threat detection. Trusted Advisor gives best-practice checks around cost, performance, and some security basics, but not continuous behavioral threat analysis.

Answer: A
Direct Connect provides a dedicated, private network link with consistent latency; pairing it with a Site-to-Site VPN as failover gives an encrypted backup path over the internet if the dedicated connection fails, satisfying both requirements at a reasonable cost. Two VPN-only connections both traverse the public internet and lack the dedicated private link. Direct Connect alone lacks a fallback in case of failure. VPC peering only connects VPCs to each other, not on-premises networks.

Answer: C
Pre-signed URLs grant time-limited access to specific S3 objects using the permissions of the URL creator, expiring automatically after the configured duration, which is exactly the scoped, temporary access needed. Long-term IAM users create unnecessary standing access. Making a bucket public exposes it to anyone on the internet, not just the auditors. Sharing root credentials is a severe security violation and provides unrestricted account access.

Answer: B
Spanning three AZs (instead of two) with an Auto Scaling group and ALB reduces the percentage of total capacity lost during any single AZ failure and provides more headroom for the surviving AZs to absorb traffic. Vertical scaling does not address the distribution of failure domains. Consolidating into a single AZ removes redundancy entirely, making the app fully vulnerable to that AZ's outage. Replacing the ALB with a single EC2 reverse proxy introduces a single point of failure.

Answer: B
Externalizing session state to ElastiCache or DynamoDB decouples session data from any individual instance's lifecycle, so scaling events or instance replacement no longer lose user sessions — this is the core practice of designing stateless, horizontally scalable compute tiers. Increasing cooldown only delays scaling actions, it doesn't fix data loss. Sticky sessions alone still lose data if that specific instance terminates. Disabling termination defeats the purpose of Auto Scaling and elasticity.

Answer: B
RDS Multi-AZ maintains a synchronously replicated standby in another AZ and automatically fails over, updating the DNS endpoint so the application reconnects with minimal changes. Read replicas in the same AZ don't protect against an AZ failure and require manual promotion plus app reconfiguration. Manual snapshot restoration is slow (not minutes) and requires manual intervention. Increasing storage size has no bearing on availability or failover.

Answer: C
Warm standby keeps a scaled-down but fully functional copy of the production environment running in another region; during a disaster, it is scaled up rapidly, giving a lower RTO than pilot light but at lower cost than full active-active. Backup and restore has the highest RTO since infrastructure must be rebuilt from backups. Pilot light keeps only core elements (e.g., databases) running, requiring more provisioning time before full traffic can be served. Multi-site active-active runs full production capacity in both regions simultaneously, which is costlier than the scaled-down warm standby described.

Answer: A
SQS decouples producers from consumers by durably buffering messages; workers can poll and process at their own pace, absorbing spikes without losing orders, since messages persist in the queue until processed and deleted. CloudFront is a content delivery network for caching content at edge locations, not a messaging buffer. Direct Connect provides private network connectivity, unrelated to message queuing. Route 53 is a DNS service and does not buffer application messages.

Answer: B
DynamoDB on-demand mode automatically adjusts to handle traffic spikes instantly without capacity planning, which fits unpredictable bursty workloads and minimizes throttling risk without manual tuning. Fixed provisioned capacity requires estimating peak throughput and risks throttling if bursts exceed it. Provisioned capacity without auto scaling has the same rigidity issue. A 3-year reserved commitment assumes stable, predictable usage, which contradicts the described bursty and unpredictable pattern.

Answer: A
ALB health checks detect and stop routing traffic to unhealthy targets, while an Auto Scaling group configured with ELB health checks will automatically terminate and replace instances that fail those checks, providing full self-healing. A Route 53 simple routing policy does not perform health-based failover or instance replacement. Manual monitoring is slow and not scalable, defeating the purpose of automated resilience. A larger instance type doesn't address instance-level failures or self-healing.

Answer: A
CloudFront is a CDN that caches static content at globally distributed edge locations, reducing latency for end users while still forwarding requests for dynamic content back to the origin. Direct Connect is a private network link between on-premises and AWS, not a content caching/distribution service. EFS is a shared file system for compute workloads, not an edge caching service. Storage Gateway bridges on-premises storage with AWS cloud storage and is unrelated to content delivery latency for end users.

Answer: B
Redshift is a columnar, massively parallel processing (MPP) data warehouse purpose-built for large-scale analytical queries across petabyte-scale structured datasets. RDS for MySQL is a general-purpose relational OLTP database not optimized for large-scale analytical scans. DynamoDB is a NoSQL key-value/document store optimized for low-latency lookups, not complex analytical SQL joins/aggregations at petabyte scale. ElastiCache is an in-memory cache, not a persistent analytical data warehouse.

Answer: B
Lambda is a fully managed, event-driven compute service that can be triggered directly by S3 object-created events, automatically scales with the number of uploads, and requires no server provisioning — ideal for short-lived per-file transformations. EC2 Reserved Instances require provisioning and managing always-on servers, adding unnecessary overhead for brief, sporadic jobs. Dedicated Hosts are physical server allocations, the opposite of serverless. Direct Connect is a network connectivity service, not a compute option.

Answer: A
RDS read replicas asynchronously replicate from the primary and can absorb read-heavy reporting workloads, offloading contention from the primary that handles transactional writes — a good fit since the workload tolerates eventual consistency. Increasing IOPS on the primary alone doesn't separate the competing workloads and may only partially help. Restricting reporting to off-peak hours limits business flexibility and doesn't scale as data grows. Disabling backups risks data loss and provides negligible, unrelated I/O relief since backups use snapshot mechanisms that minimally impact live I/O.

Answer: B
A cluster placement group packs instances close together within a single Availability Zone on the same underlying hardware network, minimizing inter-instance latency — ideal for tightly coupled HPC workloads. A spread placement group instead maximizes physical separation to reduce correlated failure, which increases rather than decreases latency between nodes. Partition placement groups are designed for distributed workloads (e.g., Hadoop) needing failure isolation across partitions, not minimal latency. Spreading instances across multiple regions with no placement group would drastically increase latency, defeating the tightly coupled requirement.

Answer: A
Kinesis Data Streams is designed to ingest and durably buffer high-throughput streaming data, allowing multiple independent consumer applications to read from the stream in near real time using separate shard iterators. Storage Gateway connects on-premises applications to cloud storage, not real-time stream processing. RDS Multi-AZ provides relational database high availability, not stream ingestion. Snowball is a physical data transfer appliance for bulk offline data migration, unrelated to real-time streaming.

Answer: B
Spot Instances offer the deepest discounts off On-Demand pricing by using spare EC2 capacity, and are well suited for fault-tolerant, flexible workloads like batch analytics that can handle interruption when AWS reclaims capacity. On-Demand pricing is the most expensive per-hour option with no discount for flexibility. A 3-year Reserved Instance commitment assumes steady-state, predictable usage and is a poor fit for an irregular batch job, plus it requires long-term commitment. Dedicated Hosts are the most expensive option, billing for entire physical servers, and are meant for licensing/compliance needs, not cost minimization.

Answer: C
Compute Savings Plans offer significant discounts in exchange for a committed hourly spend over a 1- or 3-year term, while allowing flexibility to change instance family, size, OS, and even move workloads between EC2, Fargate, and Lambda — matching the steady-state usage with flexibility requirement. On-Demand offers no discount for guaranteed long-term usage. Spot Instances can be interrupted at any time, unsuitable for a steady, always-on production workload. Dedicated Hosts billed hourly are the most expensive option and are intended for licensing/compliance, not cost optimization with flexibility.

Answer: C
S3 Glacier Instant Retrieval is designed for rarely accessed data (like quarterly-or-less access) that still needs millisecond retrieval, offering lower storage cost than Standard-IA for this access pattern. S3 Standard is optimized for frequently accessed data and costs more than necessary for rare access. Standard-IA is cheaper than Standard but still costs more than Glacier Instant Retrieval for very infrequent access, though it does offer millisecond access. Glacier Deep Archive is the cheapest tier but retrieval takes hours, not minutes, failing the retrieval-speed requirement.

Answer: A
Applying consistent cost-allocation tags to resources and activating them in Billing, then analyzing spend in Cost Explorer, is the standard way to attribute costs by department or project across many accounts. Requester Pays shifts data transfer costs to whoever requests the object, unrelated to internal cost attribution. Switching to Reserved Instances affects the pricing model but does nothing to attribute spend by department. Consolidating into a single account without structure would make cost attribution harder, not easier, since granular boundaries would be lost.

Answer: B
Gateway VPC endpoints (for S3) or interface endpoints for other AWS services let traffic to those services stay on the AWS network instead of routing through the NAT gateway, reducing NAT data-processing charges for AWS-service traffic specifically. Simply resizing to a bigger instance doesn't apply since NAT Gateway is a managed service, not a resizable EC2 instance, and wouldn't reduce data-processing charges anyway. Moving instances to public subnets increases security exposure and isn't a targeted cost fix. Disabling VPC Flow Logs affects logging costs, not NAT data-processing charges.

Answer: A
Using a custom CloudWatch metric (like queue depth) with target tracking scaling aligns scaling actions to the actual bottleneck, adding capacity precisely when needed and avoiding both under- and over-provisioning based on a misleading metric like CPU. Permanently raising the minimum size to cover worst-case peaks wastes money during normal/low periods. Disabling Auto Scaling entirely and over-provisioning removes elasticity and guarantees ongoing overpayment. Simply using larger instance types raises baseline cost without addressing the actual bottleneck (queue depth vs. CPU).

Answer: B
Latency-based routing directs each user to the AWS Region endpoint that historically provides the lowest network latency for their location, which directly minimizes latency for globally distributed users under a single domain. Simple routing just returns one or more IPs with no location or latency awareness. Weighted routing with equal weights distributes traffic evenly regardless of user proximity or latency, not optimizing for the closest region. Geoproximity routing bases decisions on geographic location and bias settings rather than measured network latency, which is a different (though related) mechanism than latency-based routing.

Answer: B
Without Multi-AZ, an RDS instance has no synchronously replicated standby, so recovering from a failure means restoring from the latest automated backup or manual snapshot, which takes time to provision and may lose data created after that backup. Automatic failover with zero data loss is a Multi-AZ-specific capability, not available on a single-instance deployment. DynamoDB global tables are a separate, unrelated NoSQL replication feature that does not apply to an RDS relational instance. Recovery is still possible via backups/snapshots even without Multi-AZ, so 'no recovery possible' is incorrect.

Answer: B
Federating via IAM Identity Center or SAML 2.0 lets employees authenticate using their existing corporate AD credentials and assume appropriately scoped IAM roles, avoiding duplicate identity management while enabling department-based access control. Manually creating individual IAM users duplicates identity administration and doesn't leverage the existing directory. Sharing one IAM user's credentials among many people eliminates accountability and violates least-privilege/auditability principles. Storing AD passwords directly as IAM passwords isn't a supported or secure federation mechanism and still duplicates credential management.

Answer: B
S3 Object Lock in compliance mode enforces a WORM (write-once-read-many) retention period during which no user, including the root user, can delete or overwrite the protected object versions, satisfying strict regulatory retention needs. Versioning alone still allows the current version to be permanently deleted (e.g., a delete marker plus explicit version deletion by an admin) and doesn't guarantee an immutable retention period. A bucket policy denying delete for IAM users can still be modified or bypassed by the root user or a sufficiently privileged principal, unlike compliance-mode Object Lock. Lifecycle rules only move data between storage classes or expire objects; they don't provide immutability or delete protection.

Answer: A
Fargate is a serverless compute engine for containers that runs ECS or EKS tasks without requiring the customer to provision, patch, or scale EC2 instances, while still letting the customer specify per-task CPU and memory. Running ECS on self-managed EC2 instances requires the customer to provision and maintain the underlying servers, which contradicts the 'no instance management' requirement. Elastic Beanstalk with a manually managed EC2 fleet still involves managing instances directly. Dedicated Hosts are physical servers billed for full control and licensing needs, the opposite of a serverless container approach.

Answer: A
S3 Transfer Acceleration routes uploads through CloudFront's globally distributed edge locations over optimized AWS backbone network paths to the bucket's region, improving throughput for users geographically far from the bucket. S3 Select retrieves a subset of data from within an object using SQL-like expressions, unrelated to upload transfer speed. S3 Batch Operations performs bulk actions (e.g., copy, tag) on existing objects at scale, not upload acceleration. S3 Inventory provides scheduled reports listing objects and metadata, unrelated to transfer performance.

Answer: B
The AWS Pricing Calculator lets architects model estimated costs for a proposed architecture across multiple services before any resources are actually deployed, which is exactly the pre-build estimation need described. Cost Explorer analyzes actual historical billing and usage data from an existing account, not hypothetical pre-deployment estimates. Trusted Advisor's cost-related checks review already-provisioned resources for optimization opportunities, not proposed future architectures. CloudWatch billing alarms notify when actual spend crosses a threshold; they don't provide upfront cost estimation.

Answer: A
AWS Backup provides centralized, policy-based scheduling of EBS snapshots (and other resource backups) along with configurable lifecycle rules to transition or expire old backups automatically, avoiding custom scripting. Macie is focused on discovering and classifying sensitive data in S3, unrelated to snapshot scheduling. X-Ray is a distributed tracing service for analyzing application performance and request flows, not backup management. Inspector performs automated vulnerability and security assessment scans, not backup scheduling.