Free SAA-C03 practice questions

A company runs an application on Amazon EC2 instances that must read objects from a specific Amazon S3 bucket. Developers currently store long-lived IAM user access keys in the application configuration file. A solutions architect must remove the static credentials while granting only the access the application needs. Which approach best meets these requirements?

• AAttach an IAM role to the EC2 instances with a policy that allows the s3:GetObject action on the specific bucket, and have the application use the role credentials.check_circle Correct
• BCreate an IAM user with an S3 read-only managed policy and embed its access key and secret key in the EC2 instance user data at launch.
• CAttach an IAM role to the EC2 instances that grants the AdministratorAccess managed policy so the application can reach the bucket without stored keys.
• DStore the IAM user access keys in AWS Secrets Manager and have the running application retrieve the same long-lived keys at startup.

Why A is correct: An instance profile role supplies automatically rotated temporary credentials and a scoped GetObject policy on one bucket grants least privilege without any static keys.

Why B is wrong: Moving the key to user data still relies on long-lived static credentials that can leak, so it fails the requirement to remove static credentials entirely.

Why C is wrong: A role does remove static keys, but AdministratorAccess grants far more than the read access needed and violates the least-privilege requirement badly.

Why D is wrong: Secrets Manager protects the keys at rest, but the application still authenticates with long-lived IAM user credentials rather than removing them as required.

An identity-based policy attached to a developer grants s3:DeleteObject on a bucket, while a bucket policy on the same bucket contains an explicit Deny for s3:DeleteObject from any principal outside the production account. The developer belongs to the production account. When the developer attempts to delete an object, what is the result of IAM policy evaluation?

• AThe request is denied because an explicit Deny in any applicable policy always overrides any Allow during evaluation.
• BThe request is allowed because the identity-based Allow applies and the explicit Deny condition does not match an in-account principal.check_circle Correct
• CThe request is denied because a resource-based policy always takes precedence over an identity-based policy in cross-policy evaluation.
• DThe request is denied by implicit Deny because two conflicting statements remove the developer permission to act on the object.

Why A is wrong: Explicit Deny does win over Allow, but the Deny here is conditioned on principals outside the production account, so it does not apply to this in-account developer.

Why B is correct: The Deny targets only external principals, so it is not triggered for an in-account developer, and the matching identity-based Allow with no other Deny permits the action.

Why C is wrong: Resource and identity policies are evaluated together as a union of Allows rather than one type overriding the other, so this stated precedence rule is incorrect.

Why D is wrong: Implicit Deny applies only when no Allow exists, but an explicit Allow is present here, so the implicit Deny reasoning does not hold for this request.

A company has 60 engineers who each need identical permissions to manage Amazon EC2 and Amazon RDS resources in a development account. The security team wants to manage these permissions in one place and apply future permission changes once rather than editing each identity. How should a solutions architect grant the access?

• AAttach the EC2 and RDS managed policies directly to each of the 60 IAM users so every engineer holds an independent copy of the permissions.
• BCreate one shared IAM user with the EC2 and RDS permissions and distribute its access keys to all 60 engineers for daily use.
• CCreate an IAM group with the EC2 and RDS policies attached and add all 60 engineers to that group as members.check_circle Correct
• DCreate a federated identity provider and require every engineer to assume a unique role per session before they can touch any resource.

Why A is wrong: Direct per-user attachment works initially but forces 60 separate edits for any future change, which is exactly the management burden the team wants to avoid.

Why B is wrong: A shared identity removes individual accountability and spreads long-lived keys widely, so it is an insecure and untraceable way to grant the access.

Why C is correct: An IAM group centralises the policy set so future changes are made once on the group, while each engineer keeps a distinct, auditable individual identity.

Why D is wrong: Federation is valid for external identities, but it adds setup overhead and does not by itself centralise editing the shared permission set as a group would.

An order-processing web tier writes directly to a fleet of EC2 worker instances over HTTP. During flash sales the workers are overwhelmed and requests are dropped, but at night the workers sit idle. The team wants to absorb traffic spikes, let the workers pull work at their own pace, and stop losing orders, with the least operational effort. Which change best meets these requirements?

• APlace an Application Load Balancer in front of the worker fleet and enable connection draining so that surplus order requests queue at the load balancer until a worker becomes available.
• BSend each order to an Amazon SQS standard queue and have the worker instances poll the queue, so messages persist until a worker is free to process them.check_circle Correct
• CPublish each order to an Amazon SNS topic and subscribe every worker instance so that all workers receive the same order and the fastest worker processes it first.
• DRoute every order through an Amazon EventBridge bus with a rule that invokes the worker fleet directly, relying on EventBridge to retain orders the workers cannot yet accept.

Why A is wrong: An ALB distributes synchronous requests but does not durably buffer them; when no healthy target can respond the requests time out, so orders are still lost during a spike.

Why B is correct: An SQS queue durably buffers messages and lets consumers poll at their own rate, smoothing spikes and preventing dropped orders with minimal operational effort.

Why C is wrong: SNS pushes a copy to every subscriber, so all workers would process the same order, and it does not buffer messages for slow consumers to pull later.

Why D is wrong: EventBridge routes and filters events to targets but is built for push-style delivery, not for letting a worker pool pull buffered work at its own pace.

A photo-sharing platform must react to every new image upload by triggering three independent tasks at the same time: generate thumbnails, update a search index, and run content moderation. Each task is owned by a separate team and may be added or removed over time without changing the uploader code. Which messaging design best satisfies these requirements?

• AWrite each upload event to a single Amazon SQS standard queue that all three tasks poll, so every task competes to read the same message and processes its share.
• BHave the uploader invoke each task's API endpoint in sequence so the thumbnail, index, and moderation services run one after another for every uploaded image.
• CPublish an upload event to an Amazon SNS topic and subscribe one Amazon SQS queue per task, letting each team consume its own queue independently of the others.check_circle Correct
• DPublish the upload event to an Amazon SNS topic and subscribe the three task functions directly, accepting that a failed delivery to one subscriber drops that event for that task.

Why A is wrong: A single SQS queue delivers each message to only one consumer, so the three tasks would compete and most events would reach just one task rather than all three.

Why B is wrong: Direct synchronous calls couple the uploader to every task, force sequential rather than parallel processing, and require uploader code changes whenever a task is added or removed.

Why C is correct: The SNS fan-out pattern delivers each event to multiple SQS queues, so each task gets its own durable copy and teams can be added or removed by managing subscriptions, not uploader code.

Why D is wrong: Subscribing compute directly to SNS works for parallel fan-out, but without an intermediate queue a delivery failure can lose the event, unlike a durable per-task queue.

A banking application submits account transactions that must be processed in the exact order they were created for each account, and the same transaction must never be processed twice even if the producer retries a send. The throughput is well under a few hundred messages per second. Which messaging service and configuration meets these requirements?

• AAn Amazon SQS standard queue, relying on its best-effort ordering and setting a long visibility timeout so consumers rarely receive a duplicate transaction.
• BAn Amazon SNS standard topic with a message group attribute so that all transactions for one account are delivered in sequence to the subscribed consumers.
• CAn Amazon EventBridge bus with an ordered archive enabled so events are replayed to the consumer in their original creation sequence without repeats.
• DAn Amazon SQS FIFO queue using the account id as the message group id and enabling content-based deduplication to drop repeated transactions.check_circle Correct

Why A is wrong: Standard queues provide only best-effort ordering and at-least-once delivery, so transactions can arrive out of order or be delivered more than once regardless of visibility timeout.

Why B is wrong: A standard SNS topic does not guarantee ordering or deduplication, and a plain message attribute does not create the ordered, exactly-once delivery the scenario needs.

Why C is wrong: EventBridge does not guarantee per-key ordering or exactly-once delivery, and its archive is for replay rather than enforcing in-order, deduplicated processing.

Why D is correct: A FIFO queue preserves order within each message group and deduplicates within the dedup window, giving per-account ordering and exactly-once processing at this throughput.

A media company stores millions of objects in a single Amazon S3 bucket. A new batch pipeline issues a very high volume of concurrent GET and PUT requests against objects that all share the key prefix uploads/2026/, and the team observes elevated latency and HTTP 503 slow-down responses. They need the request throughput to scale higher without moving to a different storage service. Which change best increases the achievable request rate for this workload?

• AEnable S3 Versioning on the bucket so each request targets a distinct object version and the additional version metadata spreads the load.
• BSwitch the bucket to the S3 Intelligent-Tiering storage class so frequently accessed objects move to a tier that serves a higher request rate.
• CTurn on S3 Transfer Acceleration so requests route through edge locations and the bucket sustains a higher concurrent request rate per prefix.
• DSpread the objects and requests across several key prefixes, since S3 scales to thousands of requests per second per prefix and parallel prefixes multiply the throughput.check_circle Correct

Why A is wrong: Versioning keeps prior copies of an object for recovery, but it does not change how S3 partitions request capacity by prefix, so the throughput ceiling on the hot prefix is unchanged.

Why B is wrong: Intelligent-Tiering moves objects between access tiers to optimise storage cost, but all tiers share the same per-prefix request model, so it does not lift the throughput limit on a hot prefix.

Why C is wrong: Transfer Acceleration speeds long-distance transfers over the AWS edge network, but it does not raise the per-prefix request rate, so the 503 slow-down responses on the hot prefix persist.

Why D is correct: S3 request capacity scales per prefix, so distributing keys across many prefixes lets the workload run many parallel prefix limits at once and removes the single-prefix bottleneck causing the slow-down responses.

A company is migrating a Windows-based application that relies on a shared file system accessed over the SMB protocol, with support for NTFS access control lists and integration with the existing Microsoft Active Directory domain. The team wants a fully managed file storage service so they do not run and patch their own file servers. Which AWS storage service meets these requirements with the least operational overhead?

• AAmazon FSx for Windows File Server, joined to the Active Directory domain so the application uses SMB shares with native NTFS access control lists.check_circle Correct
• BAmazon Elastic File System, mounted on the application hosts so the Windows servers share a single managed file system over the network.
• CAmazon S3 with the objects exposed through a file gateway so the application reads and writes files using the SMB protocol against the bucket.
• DAmazon FSx for Lustre, provisioned in the same Availability Zone as the application so the Windows servers gain a high-performance shared file system.

Why A is correct: FSx for Windows File Server is a fully managed Windows file system that natively serves SMB, enforces NTFS access control lists, and joins Active Directory, matching every stated requirement with no servers to patch.

Why B is wrong: EFS is a managed NFS file system built for Linux POSIX workloads and does not natively serve SMB with NTFS access control lists or join an Active Directory domain, so it does not fit the Windows requirement.

Why C is wrong: A file gateway can present SMB shares backed by S3, but it adds a gateway appliance to operate and does not deliver the low-latency native Windows file semantics the migrated application expects.

Why D is wrong: FSx for Lustre is a high-performance file system aimed at Linux compute and HPC workloads, and it does not provide native SMB access, NTFS permissions, or Active Directory integration for Windows.

A research team runs a high-performance computing job on a large fleet of Linux EC2 instances that must read and write a shared dataset with sub-millisecond latency and hundreds of gigabytes per second of aggregate throughput. The source data already lives in an Amazon S3 bucket, and results should be written back to S3 when the job finishes. Which storage service gives the compute fleet the best performance for this workload?

• AAmazon Elastic File System in General Purpose mode, mounted on every instance so the fleet shares one elastic POSIX file system.
• BAmazon FSx for Lustre linked to the S3 bucket, presenting the data as a high-throughput parallel file system to the Linux compute fleet.check_circle Correct
• CAmazon S3 accessed directly by every instance using the SDK, relying on parallel multipart requests to reach the required throughput.
• DAmazon EBS Provisioned IOPS volumes attached one per instance, with the dataset copied to each volume before the compute job begins.

Why A is wrong: EFS offers shared POSIX storage, but its latency and throughput profile suits general workloads rather than HPC jobs needing sub-millisecond access and hundreds of gigabytes per second of aggregate throughput.

Why B is correct: FSx for Lustre is purpose-built for high-performance computing, delivering sub-millisecond latency and very high aggregate throughput, and it can link to an S3 bucket to load source data and export results.

Why C is wrong: S3 gives durable object storage and high parallel throughput, but it is not a low-latency POSIX file system, so it cannot meet the sub-millisecond shared-file access the HPC job requires.

Why D is wrong: EBS volumes attach to a single instance and are not shared, so the fleet cannot use one consistent dataset and copying to every volume wastes time and storage.

A SaaS company stores user-uploaded documents in Amazon S3. Some objects are downloaded many times in the first week, others are never touched again, and the access pattern for any given object is impossible to predict. The team wants to minimise storage cost without writing code to track access, and it cannot accept per-object retrieval fees or any change to how the application reads objects. Which storage approach meets these requirements?

• AKeep every object in S3 Standard and rely on volume discounts to reduce the monthly storage charge as the bucket grows over time.
• BPlace all objects in S3 Standard-Infrequent Access on upload, accepting the lower storage rate in exchange for the per-gigabyte retrieval charge on each read.
• CWrite a lifecycle rule that moves every object to S3 Glacier Flexible Retrieval seven days after upload to capture the lowest possible storage price.
• DStore all objects in S3 Intelligent-Tiering so the service automatically moves each object between access tiers based on its observed usage.check_circle Correct

Why A is wrong: Tempting because S3 Standard needs no changes and avoids retrieval fees, but it applies the full frequent-access price to cold objects, so it does not minimise cost for data that is rarely read.

Why B is wrong: Tempting because Standard-IA is cheaper to store, but objects read many times in the first week incur per-gigabyte retrieval fees, which the requirement explicitly forbids.

Why C is wrong: Tempting because Glacier storage is cheap, but objects still read after seven days would need a retrieval job and wait, breaking the no-retrieval-fee and no-application-change constraints.

Why D is correct: Intelligent-Tiering monitors each object and shifts it between frequent and infrequent tiers automatically with no retrieval fees and no application change, which fits an unpredictable per-object access pattern.

An application writes audit log files to Amazon S3. The logs are queried heavily for the first 30 days, after which they are almost never read but must be retained for 7 years to satisfy a compliance policy. On the rare occasions an old log is needed, a retrieval that completes within a few hours is acceptable. The team wants the lowest long-term storage cost. Which configuration should the solutions architect implement?

• AApply a lifecycle rule that transitions each log object to S3 Glacier Flexible Retrieval 30 days after creation and expires it after 7 years.check_circle Correct
• BLeave the logs in S3 Standard for the full 7 years and use S3 Storage Lens dashboards to track how much the retained data is costing each month.
• CApply a lifecycle rule that expires and deletes each log object 30 days after creation once the heavy query window has ended for that file.
• DConfigure S3 Intelligent-Tiering on the bucket and let the archive access tiers move the logs as their access frequency drops over the retention period.

Why A is correct: A lifecycle transition to Glacier Flexible Retrieval at 30 days matches the known shift to cold access, and the few-hour retrieval allowance fits its retrieval model while the 7-year expiry enforces the policy at lowest cost.

Why B is wrong: Tempting because Standard keeps the logs instantly available, but paying the frequent-access rate for 7 years of rarely read data is far more expensive than archiving it after the active window.

Why C is wrong: Tempting because deletion gives the lowest possible storage bill, but removing the logs at 30 days violates the mandatory 7-year retention requirement and is not an option.

Why D is wrong: Tempting because Intelligent-Tiering can archive cold data, but the access pattern here is already known, so a direct lifecycle transition to Glacier avoids the per-object monitoring charge and costs less.

A photo-sharing service generates image thumbnails and stores them in Amazon S3. The thumbnails are accessed infrequently after the first day, but when requested they must be returned immediately with no retrieval delay. They can be regenerated from the original images at any time if lost, and the team wants the lowest storage cost for this reproducible, infrequently accessed data. Which S3 storage class should the solutions architect choose?

• AS3 Standard-Infrequent Access, which stores the thumbnails across three Availability Zones at the standard infrequent-access storage rate.
• BS3 One Zone-Infrequent Access, which stores the thumbnails in a single Availability Zone at a lower rate than the multi-AZ infrequent-access class.check_circle Correct
• CS3 Glacier Instant Retrieval, which archives the thumbnails at an archive storage rate while still serving each request with millisecond access.
• DS3 Standard, which stores the thumbnails across multiple Availability Zones and is priced for data that is accessed many times every day.

Why A is wrong: Tempting because Standard-IA suits infrequent access with immediate reads, but its three-AZ redundancy costs more than One Zone-IA and that durability is unnecessary for data that can be regenerated.

Why B is correct: One Zone-IA gives the lowest infrequent-access storage rate by using a single Availability Zone, and the reduced durability is acceptable because the thumbnails can be regenerated, while reads stay immediate.

Why C is wrong: Tempting because it offers immediate reads at an archive price, but Glacier Instant Retrieval adds a per-gigabyte retrieval charge and a longer minimum storage duration that raise the cost for regularly served thumbnails.

Why D is wrong: Tempting because Standard guarantees immediate reads and high durability, but it is priced for frequent access and is the most expensive choice for thumbnails that are rarely read after the first day.