AWS Certified Solutions Architect - Associate (SAA-C03) practice questions

A company runs an application on Amazon EC2 instances that must read objects from a specific Amazon S3 bucket. Developers currently store long-lived IAM user access keys in the application configuration file. A solutions architect must remove the static credentials while granting only the access the application needs. Which approach best meets these requirements?

• AAttach an IAM role to the EC2 instances with a policy that allows the s3:GetObject action on the specific bucket, and have the application use the role credentials.check_circle Correct
• BCreate an IAM user with an S3 read-only managed policy and embed its access key and secret key in the EC2 instance user data at launch.
• CAttach an IAM role to the EC2 instances that grants the AdministratorAccess managed policy so the application can reach the bucket without stored keys.
• DStore the IAM user access keys in AWS Secrets Manager and have the running application retrieve the same long-lived keys at startup.

Why A is correct: An instance profile role supplies automatically rotated temporary credentials and a scoped GetObject policy on one bucket grants least privilege without any static keys.

Why B is wrong: Moving the key to user data still relies on long-lived static credentials that can leak, so it fails the requirement to remove static credentials entirely.

Why C is wrong: A role does remove static keys, but AdministratorAccess grants far more than the read access needed and violates the least-privilege requirement badly.

Why D is wrong: Secrets Manager protects the keys at rest, but the application still authenticates with long-lived IAM user credentials rather than removing them as required.

An order-processing web tier writes directly to a fleet of EC2 worker instances over HTTP. During flash sales the workers are overwhelmed and requests are dropped, but at night the workers sit idle. The team wants to absorb traffic spikes, let the workers pull work at their own pace, and stop losing orders, with the least operational effort. Which change best meets these requirements?

• APlace an Application Load Balancer in front of the worker fleet and enable connection draining so that surplus order requests queue at the load balancer until a worker becomes available.
• BSend each order to an Amazon SQS standard queue and have the worker instances poll the queue, so messages persist until a worker is free to process them.check_circle Correct
• CPublish each order to an Amazon SNS topic and subscribe every worker instance so that all workers receive the same order and the fastest worker processes it first.
• DRoute every order through an Amazon EventBridge bus with a rule that invokes the worker fleet directly, relying on EventBridge to retain orders the workers cannot yet accept.

Why A is wrong: An ALB distributes synchronous requests but does not durably buffer them; when no healthy target can respond the requests time out, so orders are still lost during a spike.

Why B is correct: An SQS queue durably buffers messages and lets consumers poll at their own rate, smoothing spikes and preventing dropped orders with minimal operational effort.

Why C is wrong: SNS pushes a copy to every subscriber, so all workers would process the same order, and it does not buffer messages for slow consumers to pull later.

Why D is wrong: EventBridge routes and filters events to targets but is built for push-style delivery, not for letting a worker pool pull buffered work at its own pace.

A photo-sharing platform must react to every new image upload by triggering three independent tasks at the same time: generate thumbnails, update a search index, and run content moderation. Each task is owned by a separate team and may be added or removed over time without changing the uploader code. Which messaging design best satisfies these requirements?

• AWrite each upload event to a single Amazon SQS standard queue that all three tasks poll, so every task competes to read the same message and processes its share.
• BHave the uploader invoke each task's API endpoint in sequence so the thumbnail, index, and moderation services run one after another for every uploaded image.
• CPublish an upload event to an Amazon SNS topic and subscribe one Amazon SQS queue per task, letting each team consume its own queue independently of the others.check_circle Correct
• DPublish the upload event to an Amazon SNS topic and subscribe the three task functions directly, accepting that a failed delivery to one subscriber drops that event for that task.

Why A is wrong: A single SQS queue delivers each message to only one consumer, so the three tasks would compete and most events would reach just one task rather than all three.

Why B is wrong: Direct synchronous calls couple the uploader to every task, force sequential rather than parallel processing, and require uploader code changes whenever a task is added or removed.

Why C is correct: The SNS fan-out pattern delivers each event to multiple SQS queues, so each task gets its own durable copy and teams can be added or removed by managing subscriptions, not uploader code.

Why D is wrong: Subscribing compute directly to SNS works for parallel fan-out, but without an intermediate queue a delivery failure can lose the event, unlike a durable per-task queue.