SAA-C03 practice questions with answers

Answer: A) Store the credentials in AWS Secrets Manager with automatic rotation on a 30-day schedule, and retrieve them through the API

AWS Secrets Manager is the service built to store database credentials encrypted, rotate them automatically on a schedule (updating both the secret and the database), and serve them to applications at runtime. Parameter policies, KMS key rotation and ACM renewal do not change a database password.

• ASecrets Manager encrypts secrets with AWS KMS and rotates them on a schedule you set. Rotation updates the credentials in both the secret and the database. The application calls GetSecretValue at runtime and always gets the current password.
• BParameter policies delete the parameter (Expiration) or send EventBridge notifications. They never generate a new password or update the database. AWS recommends Secrets Manager for credentials that need automatic rotation.
• CKMS key rotation changes only the key's cryptographic material. It does not change the data the key protects, so the database password itself is never rotated.
• DACM manages and renews TLS certificates. It does not store or rotate database usernames and passwords.

Answer: A) Amazon Detective, which builds a behavior graph from CloudTrail logs, VPC Flow Logs, and GuardDuty findings

Amazon Detective is built for investigating security findings. It builds a behavior graph from CloudTrail, VPC Flow Logs and GuardDuty findings so analysts can visualize activity over time and find the root cause. GuardDuty, Security Hub CSPM and Inspector detect or aggregate issues but are not investigation tools.

• ADetective pulls API calls and network traffic from CloudTrail and VPC Flow Logs and takes in GuardDuty findings. It then shows a linked, interactive view of how entities behaved over time, so analysts can work out the root cause and scope of a finding.
• BGuardDuty is the threat detection service that produced the finding. It detects suspicious activity but does not provide the entity-relationship and timeline views used to investigate a root cause. Analysts pivot from GuardDuty into Detective for that.
• CSecurity Hub CSPM gathers, organizes and prioritizes findings and checks resources against best practices. It does not provide behavior-graph visualizations of API calls and network traffic for a root-cause investigation.
• DInspector scans EC2 instances, ECR images and Lambda functions for vulnerabilities and network exposure. It does not analyze a role's API activity or network traffic over time.

Answer: A) A Service Control Policy (SCP) that denies the cloudtrail:StopLogging action, applied at the organization root

• AAn SCP sets a permission boundary that applies across every account in its scope — even an account administrator with an IAM policy allowing cloudtrail:StopLogging cannot exceed what the SCP permits.
• BAn IAM policy can be changed or removed by an administrator within that individual account — it doesn't provide an organization-wide guarantee.
• CThis enables logging but does nothing to prevent an account administrator from later disabling it — the stated requirement is prevention, not just enablement.
• DAn alarm is a detective control — it notifies after the fact but doesn't actually prevent the logging from being disabled.

Answer: A) Store the credentials in AWS Secrets Manager and enable automatic rotation on a 30-day schedule for the secret

Only Secrets Manager rotates a database credential on a schedule, updating both the secret and the database. An app that reads the secret through the SDK at runtime picks up the new value with no redeployment.

• ASecrets Manager rotation updates the credentials in both the secret and the database, using managed rotation or a rotation Lambda function. Because the app reads the secret through the SDK, it gets the new value without redeploying. (Secrets injected as ECS environment variables would need a new task to pick up a rotated value.)
• BParameter Store policies only delete a parameter or send EventBridge notifications. They don't create a new password or update the database. AWS recommends Secrets Manager for credentials that need automatic rotation.
• CKMS rotation changes only the key material. It doesn't change the protected data, so the database password stays the same.
• DACM manages and renews TLS certificates. It doesn't store or rotate database user credentials.

Answer: A) Multi-site active/active (or hot standby), with the application running and data continuously replicated in a second Region

• AThe tightest RTO/RPO targets require infrastructure already running and near-real-time replication so failover is near-instant; this is the most expensive strategy.
• BRestoring from backups typically means an RTO of hours and an RPO equal to the backup interval — far outside the targets.
• CPilot light needs time to scale up compute on failover, usually exceeding a 5-minute RTO.
• DMulti-AZ protects against an AZ failure, not a Region-wide disaster.

Answer: A) Raise the queue's visibility timeout above typical job duration and have workers call ChangeMessageVisibility to extend it during long jobs

A message that is still being processed reappears when its visibility timeout expires. The fix is to set the timeout longer than the processing time and extend it with ChangeMessageVisibility for slow jobs. Long polling, delay queues, and FIFO deduplication don't control when an in-flight message reappears.

• AIf a message isn't deleted before its visibility timeout expires, it becomes visible again and another consumer can receive it. AWS recommends sizing the timeout to the processing time and using a heartbeat that calls ChangeMessageVisibility to extend it for long-running messages, up to the 12-hour limit.
• BLong polling reduces empty and false-empty responses. It has no effect on when a message that has already been received becomes visible again.
• CA delay queue hides a message only when it is first added to the queue, before any consumer receives it. After a consumer receives the message, the visibility timeout controls when it reappears.
• DFIFO exactly-once processing deduplicates messages at send time, within a 5-minute deduplication interval. A FIFO message still becomes visible again if the visibility timeout expires before it is deleted.

Answer: A) An Auto Scaling group spanning two AZs behind an Application Load Balancer, using ELB health checks

To survive an AZ loss you need capacity in multiple AZs, and to restore capacity automatically you need an Auto Scaling group. An ALB in front of a multi-AZ ASG that uses ELB health checks does both.

• AInstances in the surviving AZ keep serving through the ALB. Auto Scaling treats instances that fail health checks as unhealthy and replaces them to maintain desired capacity. With the balanced best effort strategy, if launches fail in one AZ, it launches in another healthy AZ.
• BThe ALB keeps routing to the surviving instance, so traffic is still served. However, nothing replaces the lost instance, so capacity stays halved until someone launches a new instance by hand.
• CHealth checks and replacement work for individual instance failures. But all capacity is in one AZ, so an AZ outage takes down the whole tier, and the group has no other enabled AZ to launch replacements into.
• DA spread placement group puts instances on distinct racks to reduce correlated hardware failures. Because every instance is in one AZ, the group does not survive the loss of that AZ, and it does not replace failed instances automatically.

Answer: A) Amazon Aurora Serverless v2

• AAurora Serverless v2 scales database capacity (ACUs) up and down in fine-grained steps in response to load, so spiky, intermittent workloads don't require provisioning for peak or manual resizing.
• BThat pays for peak capacity continuously through the idle periods.
• CManual resizing can't react fast enough to unpredictable bursts and causes downtime.
• DDynamoDB is NoSQL; if the workload needs relational SQL, it's not a drop-in fit.

Answer: A) Concurrency Scaling, which adds transient cluster capacity automatically during bursts of concurrent queries

• AConcurrency Scaling spins up extra compute for the duration of a spike so queued read queries run immediately, then releases it — you pay only for the extra usage (with a free credit allowance).
• BThat pays for peak capacity 24/7 for occasional spikes.
• CRDS isn't built for analytical warehouse workloads at this scale.
• DThat would increase load, not reduce queuing.

Answer: A) Amazon API Gateway invoking AWS Lambda functions that scale out per concurrent request

API Gateway with Lambda is serverless: Lambda adds execution environments per concurrent request with no provisioned servers or Auto Scaling setup. Its scaling rate and concurrency quotas are generous enough for most bursty workloads.

• ALambda creates execution environments on demand as concurrent requests arrive, with no servers to provision and no scaling policies to configure. Scaling is fast but bounded: each function can add up to 1,000 execution environments every 10 seconds, within the account concurrency quota (1,000 by default, and it can be increased).
• BThis means configuring Auto Scaling, which the team wants to avoid. Starting from zero also means waiting for instances to launch, so the first part of a burst is served poorly.
• CThe EC2 launch type still needs a fleet of container instances, and the capacity provider is built on Auto Scaling. Both go against the stated requirements.
• DThis pre-provisions peak capacity, which then sits idle and still costs money during the long quiet periods.

Answer: A) EFS Elastic throughput, which automatically scales throughput up and down with demand and bills for what is used

• AElastic throughput removes the need to predict or provision; it delivers high throughput on demand for spiky workloads, unlike Bursting (tied to size) or fixed Provisioned throughput.
• BBursting scales with stored data and can exhaust burst credits under sustained high demand.
• CA fixed low value caps performance during peaks; a fixed high value wastes money off-peak.
• DA single EBS volume can't be shared by hundreds of instances as a file system.

Answer: A) S3 Transfer Acceleration

• ATransfer Acceleration routes uploads through the nearest CloudFront edge location and over AWS's optimized backbone network to the bucket's region, meaningfully speeding up long-distance transfers.
• BObject Lock is a data-immutability/compliance feature (WORM protection) — it has nothing to do with upload speed.
• CRequester Pays shifts data transfer/request costs to the requester — it doesn't change transfer speed at all.
• DGlacier is a cold archival tier optimized for cost, not speed, and would make retrieval far slower, not faster.

Answer: A) Spot Instances

• ASpot Instances offer the deepest discount off On-Demand pricing in exchange for the possibility of interruption, which is well suited to fault-tolerant, interruptible batch workloads.
• BOn-Demand costs more than Spot and offers no discount for accepting interruption, which this workload doesn't need to avoid.
• CReserved Instances require a 1- or 3-year commitment for steady-state usage; they aren't the cheapest fit for an interruptible, flexible-timing batch job.
• DDedicated Hosts are the most expensive option, aimed at licensing/compliance needs for a physical server, not cost minimization.

Answer: A) S3 One Zone-IA

For data that can be regenerated, is accessed about once a month, needs millisecond access, and is kept longer than 30 days, S3 One Zone-IA is the lowest-cost fit. It gives up multi-AZ resilience, which this data doesn't need.

• ACorrect. AWS recommends One Zone-IA for recreatable, infrequently accessed data (about once a month) that needs millisecond access. It stores data in one Availability Zone, which makes it cheaper than S3 Standard-IA. The 90-day retention is longer than its 30-day minimum storage duration, and the large objects are above its 128 KB minimum billable size.
• BIncorrect. S3 Standard is designed for frequently accessed data and has a higher storage price than the IA classes. For long-lived files read about once a month, that higher price isn't justified.
• CIncorrect. Standard-IA fits the access pattern, but it stores data across multiple Availability Zones and costs more than One Zone-IA. AWS recommends it for data that can't be re-created, and these files can be regenerated.
• DIncorrect. Deep Archive objects are archived and must be restored before access, which takes hours. That fails the millisecond-access requirement, and the class also has a 180-day minimum storage duration.

Answer: A) Use Instance Scheduler on AWS to stop the instances each evening and start them each morning

Stopped EC2 instances don't incur usage charges, so scheduled stop/start (for example with Instance Scheduler on AWS) brings compute cost in line with the ~50 hours of actual use. EBS storage is still billed while the instances are stopped.

• AA stopped instance incurs no usage charges. Scheduling stops cuts billed compute time from 168 to about 50 hours a week, roughly a 70% compute saving, with no architecture change. Attached EBS volumes (and any associated Elastic IP addresses) are still billed while the instances are stopped.
• BA Reserved Instance discount applies to every hour of the term, whether the instance runs or not. For instances needed only about 30% of the time, the commitment pays for idle hours, so cost does not track actual use.
• CDownsizing lowers the hourly rate but still bills all 168 hours a week. It can also make the environments too slow to be useful.
• DThis trims storage cost a little but does nothing about the instance hours, which are most of the cost and are mostly idle.