Free AWS Certified Solutions Architect - Associate (SAA-C03) Practice Questions

Sample SAA-C03 Practice Questions

Browse all 10 free AWS Certified Solutions Architect - Associate practice questions below.

1. A financial services company operates a multi-tier application across 50 VPCs in us-east-1. They need to implement centralized egress filtering for all internet-bound traffic using third-party firewall appliances. The solution must minimize operational overhead and support automatic failover. Which architecture provides the MOST scalable solution?

   • Configure AWS Network Firewall in each VPC and use AWS Firewall Manager to centrally manage policies.
   • Deploy NAT Gateways in each VPC and route traffic through a central inspection VPC using VPC Peering.
   • Use AWS Transit Gateway with a dedicated inspection VPC containing Gateway Load Balancer endpoints connected to firewall appliances.
   • Deploy a Network Load Balancer in a central VPC and configure all spoke VPCs to route traffic through the NLB to firewall EC2 instances.

2. A media streaming company has a Lambda function that processes video uploads and stores metadata in an RDS MySQL database. During peak hours, the function experiences throttling errors and database connection timeouts. The database shows high CPU usage from connection management, and CloudWatch Logs show 'Too many connections' errors. Which solution will resolve these issues with the LEAST code changes?

   • Implement an Amazon SQS queue between Lambda and the database to throttle connection requests.
   • Create an Amazon RDS Proxy and configure the Lambda function to connect through the proxy endpoint.
   • Implement connection pooling logic in the Lambda function code using a library like mysql2/promise with pool configuration.
   • Increase the RDS instance size to provide more memory and CPU for connection handling.

3. A healthcare organization runs a HIPAA-compliant application on Amazon EKS. The application consists of multiple microservices, where each service requires access to different AWS resources: the patient service needs DynamoDB access, the imaging service needs S3 access, and the billing service needs access to both SQS and Secrets Manager. Security requirements mandate that each service can access only its required AWS resources and nothing more. Which solution provides the MOST granular and secure permissions model?

   • Attach an IAM role to the EKS worker nodes with permissions for all required services (DynamoDB, S3, SQS, Secrets Manager) and rely on application-level access control.
   • Store AWS access keys in Kubernetes Secrets and mount them as environment variables in each pod, with different keys for each microservice.
   • Create separate IAM roles for each microservice. Use Kubernetes service accounts with IAM Roles for Service Accounts (IRSA) to assign each pod its specific role.
   • Use EKS Pod Identities to assign IAM roles directly to pods, with separate roles for each microservice's requirements.

4. An e-commerce company uses Amazon Aurora MySQL for their product catalog database. The application experiences highly variable traffic: during normal hours it uses minimal resources, but during flash sales traffic can spike to 100x normal levels within minutes. The company wants to optimize costs while ensuring the database can handle sudden traffic spikes without performance degradation. Which Aurora configuration meets these requirements MOST cost-effectively?

   • Use Aurora Serverless v1 with automatic pause enabled and scaling configured for the expected peak load.
   • Use Aurora Provisioned with 15 read replicas in an Auto Scaling group that scales based on CPU utilization.
   • Use Aurora Provisioned with a single large instance (db.r6g.16xlarge) to handle peak load and maintain it at all times.
   • Deploy Aurora Serverless v2 with a minimum capacity of 0.5 ACUs and maximum capacity of 128 ACUs configured to scale automatically based on workload.

5. A data analytics company has an AWS Lambda function that processes large CSV files uploaded to S3. The processing involves data transformation, validation, and loading into Amazon Redshift. During testing, some files are taking 14 minutes to process, approaching Lambda's maximum execution time, and the team is concerned about timeout failures in production. Which architectural change will BEST address this issue while maintaining a serverless approach?

   • Split large CSV files client-side before uploading to S3, ensuring no single file triggers more than 10 minutes of processing.
   • Increase the Lambda function timeout to 15 minutes and allocate maximum memory (10,240 MB) to speed up processing.
   • Migrate the processing logic from Lambda to an ECS Fargate task triggered by S3 event notifications.
   • Use AWS Step Functions to orchestrate the workflow, breaking the processing into smaller Lambda functions for chunked processing, with state management between steps.

6. A developer needs to implement an AWS Lambda function in AWS account A that accesses an Amazon Simple Storage Service (Amazon S3) bucket in AWS account B. As a Solutions Architect, which of the following will you recommend to meet this requirement?

   • Create an IAM role for the AWS Lambda function that grants access to the Amazon S3 bucket. Set the IAM role as the AWS Lambda function's execution role. Make sure that the bucket policy also grants access to the AWS Lambda function's execution role
   • The Amazon S3 bucket owner should make the bucket public so that it can be accessed by the AWS Lambda function in the other AWS account
   • Create an IAM role for the AWS Lambda function that grants access to the Amazon S3 bucket. Set the IAM role as the Lambda function's execution role and that would give the AWS Lambda function cross-account access to the Amazon S3 bucket
   • AWS Lambda cannot access resources across AWS accounts. Use Identity federation to work around this limitation of Lambda

7. An organization wants to delegate access to a set of users from the development environment so that they can access some resources in the production environment which is managed under another AWS account. As a solutions architect, which of the following steps would you recommend?

   • Create new IAM user credentials for the production environment and share these credentials with the set of users from the development environment
   • It is not possible to access cross-account resources
   • Create a new IAM role with the required permissions to access the resources in the production environment. The users can then assume this IAM role while accessing the resources from the production environment
   • Both IAM roles and IAM users can be used interchangeably for cross-account access

8. A financial services company is looking to move its on-premises IT infrastructure to AWS Cloud. The company has multiple long-term server bound licenses across the application stack and the CTO wants to continue to utilize those licenses while moving to AWS. As a solutions architect, which of the following would you recommend as the MOST cost-effective solution?

   • Use Amazon EC2 on-demand instances
   • Use Amazon EC2 dedicated hosts
   • Use Amazon EC2 reserved instances (RI)
   • Use Amazon EC2 dedicated instances

9. A retail company maintains an AWS Direct Connect connection to AWS and has recently migrated its data warehouse to AWS. The data analysts at the company query the data warehouse using a visualization tool. The average size of a query returned by the data warehouse is 60 megabytes and the query responses returned by the data warehouse are not cached in the visualization tool. Each webpage returned by the visualization tool is approximately 600 kilobytes. Which of the following options offers the LOWEST data transfer egress cost for the company?

   • Deploy the visualization tool on-premises. Query the data warehouse directly over an AWS Direct Connect connection at a location in the same AWS region
   • Deploy the visualization tool in the same AWS region as the data warehouse. Access the visualization tool over a Direct Connect connection at a location in the same region
   • Deploy the visualization tool in the same AWS region as the data warehouse. Access the visualization tool over the internet at a location in the same region
   • Deploy the visualization tool on-premises. Query the data warehouse over the internet at a location in the same AWS region

10. An Internet of Things (IoT) company would like to have a streaming system that performs real-time analytics on the ingested IoT data. Once the analytics is done, the company would like to send notifications back to the mobile applications of the IoT device owners. As a solutions architect, which of the following AWS technologies would you recommend to send these notifications to the mobile applications?

    • Amazon Kinesis with Amazon Simple Email Service (Amazon SES)
    • Amazon Kinesis with Amazon Simple Queue Service (Amazon SQS)
    • Amazon Kinesis with Amazon Simple Notification Service (Amazon SNS)
    • Amazon Simple Queue Service (Amazon SQS) with Amazon Simple Notification Service (Amazon SNS)