AWS Certified Solutions Architect – Associate SAA-C03 AWS Certified Solutions Architect - Associate SAA-C03 AWS Certified Solutions Architect - Associate SAA-C03 1 / 50 A research lab runs periodic analytics jobs that require large storage throughput for only a few hours a day. They want to avoid paying for unused provisioned storage during idle periods. Which storage option is best? Use Amazon EBS Provisioned IOPS SSD volumes Use S3 Standard and download data to local instance disks during job run Use Amazon FSx for Lustre and link to S3 for scratch storage Use Amazon EFS in provisioned throughput mode 2 / 50 A developer team is building an internal web app that should only be accessible from the company’s VPN or office IP addresses. It is hosted on EC2 behind an ALB. What is the simplest way to restrict access? Use AWS WAF to allow specific CIDR blocks Attach a security group to the ALB that allows only known IP ranges Add IP-based access control logic in the web app code Use Route 53 private hosted zones 3 / 50 A machine learning team uses large EC2 GPU instances for training models. They want to reduce costs but maintain the same performance. Spot interruptions occasionally cause jobs to restart from scratch. What is the most cost-effective and fault-tolerant solution? Move training to Lambda and use parallel invocation Use EC2 Reserved Instances to lock in discounts Use Spot Instances with checkpointing and data stored in EFS Switch to ECS Fargate with GPU support 4 / 50 A company uses AWS Organizations with SCPs in place. Developers in a child account report they cannot create EC2 instances, even though their IAM policies allow it. What should the solutions architect investigate first? Check for missing VPC in the Region Review the SCPs applied at the OU or account level Validate IAM policy simulator for user permissions Check EC2 limits in the child account 5 / 50 An e-commerce company wants to automatically scale their EC2-based backend when CPU usage exceeds 70% and terminate instances when usage falls below 30%. They also want to prevent scaling too quickly due to sudden traffic spikes. What should the architect configure? Use scheduled scaling policies with buffer time Create a target tracking policy based on CPU utilization Use step scaling with cooldown periods and CloudWatch alarms Enable predictive scaling with EC2 Auto Scaling 6 / 50 A company stores logs in S3. They want to run daily queries over 90 days of logs, then archive data for compliance. Queries should be quick, and storage costs must remain low. What is the best solution? Use Amazon Redshift for all log storage and querying Store logs in S3 Standard and use Athena with partitioned tables, then move to Glacier using lifecycle policies Ingest logs into DynamoDB with TTL of 90 days Store logs in S3 Glacier Deep Archive and query using S3 Select 7 / 50 A SaaS provider offers services to multiple customers. Each customer must be logically isolated, and the application must support thousands of tenants with minimal operational overhead. Which design approach should the solutions architect choose? Launch a dedicated VPC and RDS instance per tenant Use a multi-tenant architecture with shared services and tenant ID-based access control Deploy each tenant in a separate AWS account Use CloudFormation to create isolated stacks for each tenant manually 8 / 50 A team is developing a new serverless application that integrates with external APIs. They want to control costs by avoiding unexpected bursts of function execution due to looping calls or malformed events. What is the best way to enforce these constraints? Use CloudWatch alarms to notify on high Lambda invocations Set a concurrency limit on the Lambda function Configure reserved concurrency to 0 and enable on-demand manually Use Step Functions to rate-limit the function invocations 9 / 50 A company has a global user base accessing its static website hosted on S3. Users in some regions report high latency. The company wants to reduce latency, protect against DDoS, and support custom domains with HTTPS. What is the best solution? Use S3 static website hosting with signed URLs Configure CloudFront with S3 as origin, attach a custom domain and ACM certificate Use an EC2 instance as a reverse proxy and terminate SSL Set up Route 53 latency-based routing across multiple S3 buckets 10 / 50 A healthcare company is deploying a web application that collects patient data. They require end-to-end encryption, including data in transit and at rest. Additionally, they want to ensure that only clients from trusted IP ranges can access the service. Which solution best meets these requirements? Use an ALB with WAF rules, store data in RDS encrypted with AWS-managed keys Use CloudFront with a signed URL policy, store data in S3 encrypted with SSE-S3 Use an ALB with security groups restricted to IP ranges and store data in RDS encrypted with a customer-managed KMS key Use API Gateway with Lambda authorizers and store data in DynamoDB encrypted with default keys 11 / 50 A retail company wants to build a product search feature using auto-complete as users type. The solution must scale with usage and offer fast response times with partial match support. Which service combination is best? DynamoDB with secondary indexes RDS MySQL with full-text search OpenSearch Service with edge-optimized API Gateway S3 with Athena for keyword filtering 12 / 50 An IoT company uses Kinesis Data Streams to ingest sensor data. They want to ensure every message is processed at least once and stored durably before processing. What should the architect recommend? Enable enhanced fan-out and process in Lambda Use Kinesis Data Firehose to S3 with Lambda transform Use SQS as a buffer and forward messages to Kinesis Use DynamoDB Streams for storage before Kinesis 13 / 50 A mobile application uses a Lambda function for backend processing. The function is now hitting concurrency limits during heavy usage. The team wants to handle more requests without significant refactoring. What should the architect do? Request a Lambda concurrency limit increase and implement reserved concurrency Use AWS Fargate as a replacement for Lambda Deploy multiple Lambda versions with aliases Add CloudFront caching to reduce Lambda invocations 14 / 50 A global enterprise is planning a disaster recovery strategy for a critical web app deployed in us-east-1. They want to achieve <30s failover and <5-minute RTO across Regions. What should they implement? Use Route 53 latency-based routing and global Aurora Use Route 53 failover routing with Route Health Checks and warm standby in another Region Deploy active/active multi-Region ALBs with Global Accelerator Implement CloudFront with dynamic origin failover 15 / 50 A security team wants to ensure that any new IAM user created in the AWS environment cannot make changes until they rotate their access keys and set up MFA. How should the solutions architect enforce this requirement? Create a Lambda-backed custom IAM policy Use IAM permission boundaries to block actions until MFA is enabled Use AWS Config rules to detect violations and auto-remediate Apply an SCP requiring MFA and access key rotation using condition keys 16 / 50 A web application is hosted on EC2 in a public subnet with an attached security group that allows HTTP/HTTPS. However, users report intermittent connection errors. Logs show that some health checks are failing from ALB. What could be the root cause? Route table for public subnet is missing a NAT Gateway ALB’s security group does not allow inbound traffic from EC2 EC2 security group does not allow inbound traffic from ALB Network ACLs are blocking return traffic to clients 17 / 50 An ecommerce company needs to encrypt data stored in Amazon RDS PostgreSQL. Compliance also requires that they rotate the encryption keys annually. What is the most secure and manageable solution? Enable RDS encryption with the default AWS managed key Use a customer-managed KMS key with automatic rotation enabled Enable Transparent Data Encryption (TDE) on the database manually Encrypt data at the application layer using the AWS Encryption SDK 18 / 50 A startup is running a fleet of EC2 Spot Instances for a batch job. Occasionally, the job gets interrupted due to spot termination, and the processing starts over, wasting compute cycles. What is the best approach to ensure progress is preserved and cost remains low? Use EC2 Auto Scaling with only On-Demand instances Use Spot Fleet with a capacity-optimized allocation strategy Store intermediate job state in S3 and implement checkpointing Use ECS Fargate and implement retries using Step Functions 19 / 50 A gaming company stores player session data in a DynamoDB table. Occasionally, a developer mistakenly deletes important attributes while updating player stats. The company wants to prevent this going forward. What should the solutions architect recommend? Enable point-in-time recovery on the DynamoDB table Use CloudWatch alarms on high DeleteItem operations Restrict updates using IAM condition keys for attribute-level write access Set TTL on all attributes that should not be removed 20 / 50 A serverless photo sharing app uses Lambda, S3, and DynamoDB. Users report that sometimes uploaded images never appear in the UI. Investigation shows that object metadata is missing from DynamoDB, even though files exist in S3. How should the architect redesign the workflow for reliability? Configure S3 event notifications to send metadata to an SNS topic Use S3 event notifications to trigger a Lambda function that writes metadata to DynamoDB Use EventBridge with S3 as source and Lambda as target for better delivery guarantee Use Step Functions to sequence file upload and metadata insertion 21 / 50 A real estate firm uses AWS to host its web and analytics workloads. They require real-time application metrics, anomaly detection for unusual patterns, and automatic alerts without maintaining monitoring infrastructure. What is the most appropriate solution? Install custom monitoring agents and forward data to an EC2-based Grafana instance Use CloudWatch Metrics with Contributor Insights and set anomaly detection alarms Use Amazon Athena to scan S3 logs and detect anomalies with Lambda Use X-Ray for monitoring all AWS resource activity and error rates 22 / 50 A ride-sharing platform wants to enforce security by restricting developers from launching EC2 instances directly into public subnets, while still allowing them to work within private subnets. How should a solutions architect implement this control? Use SCPs (Service Control Policies) with deny rules for specific subnet IDs Create IAM policies that restrict the RunInstances action to certain subnet IDs Use resource-based policies on EC2 to block instance creation Implement VPC endpoint policies with conditions based on subnet 23 / 50 A data analytics company stores time-series telemetry data in S3. They need a querying solution that supports partitioning by time and filters large datasets efficiently, without moving data to a database. What should the architect recommend? Use Amazon Athena with Hive-compatible partitions on S3 Move data to Redshift for querying and visualization Store data in DynamoDB and index on timestamp Use EMR Spark jobs with scheduled execution on S3 files 24 / 50 A media company has thousands of archived video files stored in S3 Glacier Deep Archive. Now, they need to generate metadata from these files using a new AI service, but they want to minimize retrieval costs and avoid long delays. What is the best strategy? Migrate all videos to S3 Standard and start processing Initiate bulk retrievals in batches and process as they complete Use S3 Select to extract metadata from files in Glacier Transition files to S3 Glacier Instant Retrieval and process immediately 25 / 50 A financial services firm processes sensitive transaction records via a REST API built with API Gateway and Lambda. Regulatory guidelines require complete auditability of each API request, including headers and body payloads, without logging sensitive values in plaintext. Which solution meets the compliance requirement? Enable CloudTrail and export API logs to S3 Enable API Gateway access logging and use KMS-encrypted CloudWatch logs Use API Gateway with AWS WAF and log all incoming requests to CloudTrail Use API Gateway access logging with sensitive data redacted and send logs to a Kinesis Firehose delivery stream 26 / 50 A client is building a highly available web application across two Regions. They want to ensure automatic DNS failover with minimal RTO. What configuration should the solutions architect choose? Use Route 53 weighted routing across Regions Use Route 53 latency-based routing with health checks and failover policy Use Global Accelerator with Application Load Balancers in each Region Use Route 53 geolocation routing with internal failover 27 / 50 A customer has a website hosted on EC2 and backed by an RDS MySQL database. They report increased latency during marketing campaigns. Database metrics show high read queries. What is the best short-term fix? Scale the RDS instance vertically Convert to Aurora Serverless Create RDS Read Replicas and update the application to use them for reads Use ElastiCache as a query result cache layer 28 / 50 A legacy monolith application running on EC2 needs to be containerized and modernized gradually. The company wants minimal disruption and easy rollback. Which service is best for incremental migration? Migrate to Lambda with container support Use ECS with EC2 launch type Use App2Container and deploy on ECS Fargate Rebuild the app using AWS Amplify 29 / 50 A real-time analytics app uses Kinesis Data Streams and processes millions of events per minute. The development team reports a ProvisionedThroughputExceededException during traffic spikes. What should a solutions architect recommend? Increase Kinesis stream retention period Use enhanced fan-out and increase the number of shards Use Kinesis Firehose with auto-scaling enabled Replace Kinesis with Kafka on EC2 30 / 50 A financial application must retain logs for 7 years in compliance with industry regulations. Logs are frequently accessed in the first 30 days and rarely after that. The solution should minimize storage cost. What is the most cost-effective storage class combination? Store in S3 Standard and move to S3 Glacier Deep Archive using lifecycle rules Use S3 Intelligent-Tiering for automatic cost optimization Keep all logs in S3 Standard-IA for 7 years Use S3 One Zone-IA and transition to Glacier 31 / 50 An e-commerce platform is seeing high read/write traffic on its product catalog stored in DynamoDB. Some reads are consistent, others can tolerate stale data. The company wants to optimize cost while ensuring high performance. What should a solutions architect do? Switch to strongly consistent reads across all queries Use DAX for caching eventually consistent reads Enable global tables and replication for faster access Move all reads to ElastiCache with nightly sync 32 / 50 Your application architecture uses microservices that must discover each other dynamically. They are deployed across multiple Availability Zones using ECS Fargate. You want to minimize custom configuration and ensure reliable service discovery. What should the architect recommend? Use DNS-based discovery via private hosted zone in Route 53 Register tasks in AWS Cloud Map and use service discovery integration in ECS Use environment variables for each container and inject IP addresses Use ELB for each service and communicate using hardcoded DNS names 33 / 50 A SaaS company wants to onboard customer applications in isolated environments. Each customer should have separate VPCs, but the company wants to maintain centralized logging and compliance monitoring across accounts. What is the most scalable approach? Use VPC peering and centralize CloudWatch logs into one account Create separate AWS accounts per customer and use AWS Control Tower with centralized logging Deploy one large shared VPC with strict IAM role separation Use AWS Organizations and S3 cross-account replication for logs 34 / 50 A healthcare company must store patient records in a secure and compliant manner. They are using S3 and want to enforce encryption in transit and at rest, along with access auditability. What should a solutions architect configure? Use bucket policies to enforce encryption and CloudTrail for access logging Enable versioning, default encryption with SSE-S3, and object ACLs Configure client-side encryption and disable public access Enable MFA Delete and S3 Transfer Acceleration 35 / 50 An online education platform stores video content in S3. They want to serve content globally with reduced latency and protect the original URLs from being exposed. What combination should the solutions architect use? S3 with signed URLs and a custom API gateway CloudFront with signed cookies and origin access control for S3 S3 with public ACLs and pre-signed links Use an EC2 proxy layer with authentication and S3 behind it 36 / 50 A company has a hybrid environment with on-premises systems connected to AWS via a Site-to-Site VPN. The VPN frequently experiences latency and packet loss. They plan to migrate critical workloads to AWS. What is the best recommendation to ensure consistent and low-latency connectivity? Replace the VPN with VPC peering Use AWS Direct Connect with a public virtual interface Set up AWS Direct Connect with a private virtual interface Create redundant Site-to-Site VPNs with accelerated routing 37 / 50 A company wants to deploy a serverless image recognition API. The solution must scale automatically, allow version control, and avoid cold start latency during business hours. What is the best architectural choice? Use AWS App Runner and provision scaling settings Deploy the API using Lambda and API Gateway with provisioned concurrency Use Lambda with container image deployment and CloudFront for caching Run containers using ECS Fargate behind an ALB 38 / 50 A logistics company is developing a real-time tracking system for vehicles. The application must ingest location data every second, store it for 12 months, and support analytics queries on recent and historical data. Which solution provides the best performance and cost-efficiency? Store data in DynamoDB with TTL and export old data to S3 Stream data using Kinesis Data Streams to Amazon Redshift Use Amazon Timestream for recent data and export monthly snapshots to S3 Glacier Store all data in S3 and use Athena for querying with partitioned tables 39 / 50 A startup uses Amazon Aurora MySQL for their backend. They want to deploy a new read-intensive microservice that should not impact write latency. The team is concerned about network cost, latency, and availability across multiple AZs. What should a solutions architect do? Create a cross-Region read replica for disaster recovery Migrate the database to RDS Multi-AZ PostgreSQL Use ElastiCache in front of Aurora for all reads Use Aurora Replicas in the same Region and route read traffic using the reader endpoint 40 / 50 A media company is developing a video processing pipeline that receives 4K videos uploaded by users into an S3 bucket. These videos must be transcoded into multiple formats and resolutions. The team wants to ensure processing is automatic, scalable, and tolerant to intermittent processing failures. Each job takes 3–4 minutes, and multiple files may be uploaded simultaneously. What is the most reliable and cost-efficient design? Configure S3 event notifications to trigger Lambda directly for transcoding Use S3 to trigger an SNS topic subscribed by an EC2 Auto Scaling Group that pulls jobs from SQS Set up S3 to trigger a Lambda function that pushes metadata to SQS, and process jobs using EC2 instances in an Auto Scaling Group Use AWS Step Functions with Lambda integration and invoke Step Functions from S3 events 41 / 50 You’ve deployed a VPC with public and private subnets. The private subnet hosts EC2 instances that need to access the internet but should not be exposed publicly. Which configuration enables this? Assign Elastic IPs to EC2 in private subnet Use an Internet Gateway and security group rules Enable S3 VPC Endpoint and IAM policies Deploy a NAT Gateway in the public subnet 42 / 50 A company is building a mobile app backend using API Gateway and Lambda. They want to securely store user-specific data and retrieve it based on identity. Which approach meets this requirement? Use Cognito Identity Pools with IAM roles to write to S3 Use API Gateway to pass JWT tokens and verify in Lambda Store data in DynamoDB and use Cognito Identity for fine-grained access Use API Gateway Lambda Authorizers with hardcoded secrets 43 / 50 An application receives large files from customers via HTTPS. Files are stored in S3 and processed by a fleet of EC2 instances. During traffic spikes, the EC2 fleet fails to scale fast enough. Which design improves scalability and minimizes manual intervention? Use S3 to trigger a Lambda function to process files Buffer uploads using Amazon Kinesis Process files asynchronously using S3 event notifications to SQS and EC2 Auto Scaling Deploy a larger EC2 instance type and increase max connections 44 / 50 A company stores sensitive data in S3 and wants to ensure objects are encrypted using a customer-managed key. They also want to rotate keys every 12 months. Which solution meets the requirement? Use SSE-S3 and enable automatic key rotation Use SSE-KMS with default AWS managed key Use SSE-KMS with a customer-managed key and enable rotation Use client-side encryption with AWS Encryption SDK 45 / 50 A startup uses ECS Fargate to run a containerized app. They want to reduce costs without rewriting code. App traffic varies drastically throughout the day. What should the solutions architect recommend? Migrate to EC2 Spot Instances with ECS Use AWS Lambda for spiky traffic Use AWS Auto Scaling for Fargate tasks Schedule task scaling using CloudWatch Events 46 / 50 A developer deployed a Lambda function triggered by S3 PUT events. The function processes large images and stores results in another S3 bucket. Recently, some files are processed multiple times or missed entirely. What should a solutions architect do? Use SQS queue as event destination for better reliability Enable S3 event notifications with SNS topic Increase Lambda timeout and memory Switch to S3 Batch Operations for processing 47 / 50 A financial firm runs a latency-sensitive trading app with low fault tolerance. It requires near-zero downtime even in case of infrastructure failure. Which design provides the highest availability? Use EC2 Auto Scaling with On-Demand instances in a single AZ Deploy in two Regions using Route 53 latency-based routing and failover routing Use EC2 in one Region with RDS Multi-AZ failover Place EC2 instances in two AZs with ALB and Spot Instances 48 / 50 Your company is storing billions of images in Amazon S3. A recent audit requires identifying and reporting access patterns for compliance. The team must implement a solution that reports which images are accessed and how often, without impacting performance. What should you do? Enable S3 Inventory Reports with object-level access data Use S3 server access logging and analyze logs using Amazon Athena Turn on CloudTrail data events and export to Amazon Redshift Enable versioning and track changes through object tags 49 / 50 A company is migrating a legacy application to AWS. The app requires static IPs for whitelisting and must run in multiple Availability Zones. The solution should minimize operational overhead. What is the best solution? Launch EC2 instances with Elastic IPs in each AZ Use AWS Global Accelerator for static IPs and route to ALBs in each AZ Use an ALB with cross-zone load balancing and Elastic IPs Use NAT Gateways with static IPs in each subnet 50 / 50 A company is running a multi-tier web application in a single AWS Region. The application layer runs on Amazon EC2 instances behind an Application Load Balancer. The database layer uses Amazon RDS for PostgreSQL. The team notices intermittent application slowness during peak hours, primarily related to long-running queries. What should a solutions architect recommend to improve performance with minimal application changes? Enable Multi-AZ on RDS and increase instance size Create Read Replicas and redirect read traffic using Route 53 latency-based routing Use Amazon ElastiCache to cache query results Enable RDS Performance Insights and configure query plan optimization Your score isThe average score is 0% 0% Restart quiz