Free SAA-C03 sample questions

Correct answer: Launch the instances into a partition placement group with two partitions within a single Availability Zone.

A partition placement group provides the best balance for this scenario. It spreads instances across distinct underlying hardware (partitions/racks) within an Availability Zone, reducing correlated failures. At the same time, it keeps the instances geographically close within that AZ, which is crucial for low-latency communication. A cluster placement group offers the lowest latency but places instances on the same rack, making it vulnerable to a single rack failure. A spread placement group across multiple AZs would introduce higher latency, which is not suitable for the trading application's requirements.

Correct answers: Configure a gateway VPC endpoint for Amazon S3 and associate it with the private subnet's route table.; Enable Redshift Enhanced VPC Routing.

A gateway VPC endpoint for Amazon S3 allows traffic from the VPC to S3 to travel over the AWS private network, avoiding the public internet. This is a critical component for meeting the security requirement.

Enhanced VPC Routing forces all COPY and UNLOAD traffic between the Redshift cluster and data repositories (like S3) to go through the VPC. When used with a VPC endpoint, it ensures the traffic stays on the AWS private network.

Correct answer: Store the database credentials in AWS Secrets Manager and enable automatic rotation. Configure the EC2 instances with an IAM role that grants permission to read the secret.

AWS Secrets Manager is the ideal service for this use case. It provides native integration with Amazon RDS for automated credential rotation, which updates the secret in Secrets Manager and the password in the database simultaneously. Since the application cannot be modified, using IAM authentication or an RDS Proxy would not work. By granting the EC2 instance's IAM role permission to read the secret, the application can fetch the current credentials at runtime without hardcoding them.

Correct answer: Purchase 2 Standard Reserved Instances and use Scheduled Scaling to scale up with 8 Spot Instances during business hours.

This is the most cost-effective strategy. Purchasing Reserved Instances for the 2 instances that run 24/7 provides the highest discount for the constant baseline. For the predictable peak during business hours, Scheduled Scaling can be used to increase the desired capacity. Using Spot Instances for this additional capacity provides significant savings, and is appropriate because the stateless application can tolerate interruptions. This blended approach correctly matches purchasing options to usage patterns.

Correct answer: Configure Amazon Aurora Global Database with read replicas in the Europe and Asia regions.

Amazon Aurora Global Database is specifically designed for this use case. It provides low-latency global reads by placing read replicas in different regions, which have a typical replication lag of under a second. It also offers a robust disaster recovery solution, allowing for a failover to a secondary region in typically less than one minute. This meets both the performance and resiliency requirements with minimal application changes, as the application can use region-specific endpoints.

Correct answer: Use Amazon Kinesis Data Streams with the device ID as the partition key, processed by a Lambda function, and delivered to Amazon S3 via Amazon Kinesis Data Firehose.

This architecture meets all requirements. Kinesis Data Streams is designed for high-volume streaming data. Using the device ID as the partition key ensures that data from each device is processed in order. AWS Lambda provides scalable, serverless processing. Kinesis Data Firehose is the simplest, most cost-effective way to durably store the raw streaming data in Amazon S3 for later analysis.

Correct answer: False

This statement is false. A VPC endpoint policy is an IAM resource policy that you attach to an endpoint. You can use this policy to control access to the service. The policy can restrict access to specific resources (like S3 buckets) and also to specific API actions (like `s3:GetObject` or `s3:PutObject`). This allows for granular control over what actions can be performed on which resources through the endpoint.

Correct answer: Use Amazon EFS and mount the same file system on both the primary and standby EC2 instances.

Amazon EFS provides a shared file system that can be mounted concurrently by multiple EC2 instances, even across different Availability Zones. This makes it the perfect solution for this scenario. Both the primary and standby instances can read and write to the same EFS file system, ensuring that the temporary data is always available to the active instance. EBS volumes are tied to a single AZ, and instance stores are ephemeral and cannot be shared.

Correct answer: Create a Service Control Policy (SCP) with a `Deny` statement for `cloudtrail:StopLogging` and `cloudtrail:UpdateTrail` and attach it to the relevant Organizational Units (OUs).

Service Control Policies (SCPs) are the correct tool for this requirement. SCPs are a type of organization policy that you can use to manage permissions in your organization. They offer central control over the maximum available permissions for all accounts in your organization. An explicit `Deny` in an SCP overrides any `Allow` from IAM policies and applies to all principals in the account, including the root user. This makes them ideal for enforcing security guardrails.

Correct answer: Enable caching on the API Gateway stage.

Enabling caching directly on the API Gateway stage is the simplest and most integrated solution. It allows you to cache the responses from your backend Lambda function, reducing the number of calls made to the function and the downstream DynamoDB table. This provides a low-latency experience for frequently requested data without requiring significant changes to the Lambda function or adding another service like ElastiCache to manage.