Free SAA-C03 practice questions

A company runs an application on Amazon EC2 instances that must read objects from a specific Amazon S3 bucket. Developers currently store long-lived IAM user access keys in the application configuration file. A solutions architect must remove the static credentials while granting only the access the application needs. Which approach best meets these requirements?

• AAttach an IAM role to the EC2 instances with a policy that allows the s3:GetObject action on the specific bucket, and have the application use the role credentials.check_circle Correct
• BCreate an IAM user with an S3 read-only managed policy and embed its access key and secret key in the EC2 instance user data at launch.
• CAttach an IAM role to the EC2 instances that grants the AdministratorAccess managed policy so the application can reach the bucket without stored keys.
• DStore the IAM user access keys in AWS Secrets Manager and have the running application retrieve the same long-lived keys at startup.

Why A is correct: An instance profile role supplies automatically rotated temporary credentials and a scoped GetObject policy on one bucket grants least privilege without any static keys.

Why B is wrong: Moving the key to user data still relies on long-lived static credentials that can leak, so it fails the requirement to remove static credentials entirely.

Why C is wrong: A role does remove static keys, but AdministratorAccess grants far more than the read access needed and violates the least-privilege requirement badly.

Why D is wrong: Secrets Manager protects the keys at rest, but the application still authenticates with long-lived IAM user credentials rather than removing them as required.

An identity-based policy attached to a developer grants s3:DeleteObject on a bucket, while a bucket policy on the same bucket contains an explicit Deny for s3:DeleteObject from any principal outside the production account. The developer belongs to the production account. When the developer attempts to delete an object, what is the result of IAM policy evaluation?

• AThe request is denied because an explicit Deny in any applicable policy always overrides any Allow during evaluation.
• BThe request is allowed because the identity-based Allow applies and the explicit Deny condition does not match an in-account principal.check_circle Correct
• CThe request is denied because a resource-based policy always takes precedence over an identity-based policy in cross-policy evaluation.
• DThe request is denied by implicit Deny because two conflicting statements remove the developer permission to act on the object.

Why A is wrong: Explicit Deny does win over Allow, but the Deny here is conditioned on principals outside the production account, so it does not apply to this in-account developer.

Why B is correct: The Deny targets only external principals, so it is not triggered for an in-account developer, and the matching identity-based Allow with no other Deny permits the action.

Why C is wrong: Resource and identity policies are evaluated together as a union of Allows rather than one type overriding the other, so this stated precedence rule is incorrect.

Why D is wrong: Implicit Deny applies only when no Allow exists, but an explicit Allow is present here, so the implicit Deny reasoning does not hold for this request.

A company has 60 engineers who each need identical permissions to manage Amazon EC2 and Amazon RDS resources in a development account. The security team wants to manage these permissions in one place and apply future permission changes once rather than editing each identity. How should a solutions architect grant the access?

• AAttach the EC2 and RDS managed policies directly to each of the 60 IAM users so every engineer holds an independent copy of the permissions.
• BCreate one shared IAM user with the EC2 and RDS permissions and distribute its access keys to all 60 engineers for daily use.
• CCreate an IAM group with the EC2 and RDS policies attached and add all 60 engineers to that group as members.check_circle Correct
• DCreate a federated identity provider and require every engineer to assume a unique role per session before they can touch any resource.

Why A is wrong: Direct per-user attachment works initially but forces 60 separate edits for any future change, which is exactly the management burden the team wants to avoid.

Why B is wrong: A shared identity removes individual accountability and spreads long-lived keys widely, so it is an insecure and untraceable way to grant the access.

Why C is correct: An IAM group centralises the policy set so future changes are made once on the group, while each engineer keeps a distinct, auditable individual identity.

Why D is wrong: Federation is valid for external identities, but it adds setup overhead and does not by itself centralise editing the shared permission set as a group would.

An order-processing web tier writes directly to a fleet of EC2 worker instances over HTTP. During flash sales the workers are overwhelmed and requests are dropped, but at night the workers sit idle. The team wants to absorb traffic spikes, let the workers pull work at their own pace, and stop losing orders, with the least operational effort. Which change best meets these requirements?

• APlace an Application Load Balancer in front of the worker fleet and enable connection draining so that surplus order requests queue at the load balancer until a worker becomes available.
• BSend each order to an Amazon SQS standard queue and have the worker instances poll the queue, so messages persist until a worker is free to process them.check_circle Correct
• CPublish each order to an Amazon SNS topic and subscribe every worker instance so that all workers receive the same order and the fastest worker processes it first.
• DRoute every order through an Amazon EventBridge bus with a rule that invokes the worker fleet directly, relying on EventBridge to retain orders the workers cannot yet accept.

Why A is wrong: An ALB distributes synchronous requests but does not durably buffer them; when no healthy target can respond the requests time out, so orders are still lost during a spike.

Why B is correct: An SQS queue durably buffers messages and lets consumers poll at their own rate, smoothing spikes and preventing dropped orders with minimal operational effort.

Why C is wrong: SNS pushes a copy to every subscriber, so all workers would process the same order, and it does not buffer messages for slow consumers to pull later.

Why D is wrong: EventBridge routes and filters events to targets but is built for push-style delivery, not for letting a worker pool pull buffered work at its own pace.

A photo-sharing platform must react to every new image upload by triggering three independent tasks at the same time: generate thumbnails, update a search index, and run content moderation. Each task is owned by a separate team and may be added or removed over time without changing the uploader code. Which messaging design best satisfies these requirements?

• AWrite each upload event to a single Amazon SQS standard queue that all three tasks poll, so every task competes to read the same message and processes its share.
• BHave the uploader invoke each task's API endpoint in sequence so the thumbnail, index, and moderation services run one after another for every uploaded image.
• CPublish an upload event to an Amazon SNS topic and subscribe one Amazon SQS queue per task, letting each team consume its own queue independently of the others.check_circle Correct
• DPublish the upload event to an Amazon SNS topic and subscribe the three task functions directly, accepting that a failed delivery to one subscriber drops that event for that task.

Why A is wrong: A single SQS queue delivers each message to only one consumer, so the three tasks would compete and most events would reach just one task rather than all three.

Why B is wrong: Direct synchronous calls couple the uploader to every task, force sequential rather than parallel processing, and require uploader code changes whenever a task is added or removed.

Why C is correct: The SNS fan-out pattern delivers each event to multiple SQS queues, so each task gets its own durable copy and teams can be added or removed by managing subscriptions, not uploader code.

Why D is wrong: Subscribing compute directly to SNS works for parallel fan-out, but without an intermediate queue a delivery failure can lose the event, unlike a durable per-task queue.

A company receives events from a third-party SaaS provider and from several of its own microservices. It wants to route each event to different targets such as a Lambda function, a Step Functions workflow, or an SQS queue based on the event's content, and apply these routing rules without writing custom dispatch code. Which AWS service is the best fit?

• AAmazon EventBridge, using rules that match event content with patterns and route each matching event to the appropriate target, including the SaaS partner event source.check_circle Correct
• BAmazon SQS, using one queue per target and a custom poller that reads each message, inspects its body, and forwards it to the correct downstream service.
• CAmazon SNS, creating a topic per event type and using subscription filter policies on message attributes to push each event to the matching subscriber.
• DAWS Lambda, with a single function that receives every event, contains the routing logic in code, and invokes the correct downstream service for each event type.

Why A is correct: EventBridge ingests AWS, custom, and SaaS partner events and uses content-based rule patterns to route them to many target types natively, with no custom dispatch code.

Why B is wrong: SQS only stores and delivers messages to pollers; the content-based routing to many target types would have to be built and maintained as custom dispatch code.

Why C is wrong: SNS filtering works on message attributes for pub/sub fan-out but lacks native SaaS partner sources and the broad target catalogue and rule routing EventBridge provides.

Why D is wrong: A central Lambda router can work but pushes all routing into custom code that the team must maintain, which is exactly the dispatch logic they want to avoid.

A company is migrating a Windows-based application that relies on a shared file system accessed over the SMB protocol, with support for NTFS access control lists and integration with the existing Microsoft Active Directory domain. The team wants a fully managed file storage service so they do not run and patch their own file servers. Which AWS storage service meets these requirements with the least operational overhead?

• AAmazon FSx for Windows File Server, joined to the Active Directory domain so the application uses SMB shares with native NTFS access control lists.check_circle Correct
• BAmazon Elastic File System, mounted on the application hosts so the Windows servers share a single managed file system over the network.
• CAmazon S3 with the objects exposed through a file gateway so the application reads and writes files using the SMB protocol against the bucket.
• DAmazon FSx for Lustre, provisioned in the same Availability Zone as the application so the Windows servers gain a high-performance shared file system.

Why A is correct: FSx for Windows File Server is a fully managed Windows file system that natively serves SMB, enforces NTFS access control lists, and joins Active Directory, matching every stated requirement with no servers to patch.

Why B is wrong: EFS is a managed NFS file system built for Linux POSIX workloads and does not natively serve SMB with NTFS access control lists or join an Active Directory domain, so it does not fit the Windows requirement.

Why C is wrong: A file gateway can present SMB shares backed by S3, but it adds a gateway appliance to operate and does not deliver the low-latency native Windows file semantics the migrated application expects.

Why D is wrong: FSx for Lustre is a high-performance file system aimed at Linux compute and HPC workloads, and it does not provide native SMB access, NTFS permissions, or Active Directory integration for Windows.

A media company stores millions of objects in a single Amazon S3 bucket. A new batch pipeline issues a very high volume of concurrent GET and PUT requests against objects that all share the key prefix uploads/2026/, and the team observes elevated latency and HTTP 503 slow-down responses. They need the request throughput to scale higher without moving to a different storage service. Which change best increases the achievable request rate for this workload?

• AEnable S3 Versioning on the bucket so each request targets a distinct object version and the additional version metadata spreads the load.
• BSwitch the bucket to the S3 Intelligent-Tiering storage class so frequently accessed objects move to a tier that serves a higher request rate.
• CTurn on S3 Transfer Acceleration so requests route through edge locations and the bucket sustains a higher concurrent request rate per prefix.
• DSpread the objects and requests across several key prefixes, since S3 scales to thousands of requests per second per prefix and parallel prefixes multiply the throughput.check_circle Correct

Why A is wrong: Versioning keeps prior copies of an object for recovery, but it does not change how S3 partitions request capacity by prefix, so the throughput ceiling on the hot prefix is unchanged.

Why B is wrong: Intelligent-Tiering moves objects between access tiers to optimise storage cost, but all tiers share the same per-prefix request model, so it does not lift the throughput limit on a hot prefix.

Why C is wrong: Transfer Acceleration speeds long-distance transfers over the AWS edge network, but it does not raise the per-prefix request rate, so the 503 slow-down responses on the hot prefix persist.

Why D is correct: S3 request capacity scales per prefix, so distributing keys across many prefixes lets the workload run many parallel prefix limits at once and removes the single-prefix bottleneck causing the slow-down responses.

A research team runs a high-performance computing job on a large fleet of Linux EC2 instances that must read and write a shared dataset with sub-millisecond latency and hundreds of gigabytes per second of aggregate throughput. The source data already lives in an Amazon S3 bucket, and results should be written back to S3 when the job finishes. Which storage service gives the compute fleet the best performance for this workload?

• AAmazon Elastic File System in General Purpose mode, mounted on every instance so the fleet shares one elastic POSIX file system.
• BAmazon FSx for Lustre linked to the S3 bucket, presenting the data as a high-throughput parallel file system to the Linux compute fleet.check_circle Correct
• CAmazon S3 accessed directly by every instance using the SDK, relying on parallel multipart requests to reach the required throughput.
• DAmazon EBS Provisioned IOPS volumes attached one per instance, with the dataset copied to each volume before the compute job begins.

Why A is wrong: EFS offers shared POSIX storage, but its latency and throughput profile suits general workloads rather than HPC jobs needing sub-millisecond access and hundreds of gigabytes per second of aggregate throughput.

Why B is correct: FSx for Lustre is purpose-built for high-performance computing, delivering sub-millisecond latency and very high aggregate throughput, and it can link to an S3 bucket to load source data and export results.

Why C is wrong: S3 gives durable object storage and high parallel throughput, but it is not a low-latency POSIX file system, so it cannot meet the sub-millisecond shared-file access the HPC job requires.

Why D is wrong: EBS volumes attach to a single instance and are not shared, so the fleet cannot use one consistent dataset and copying to every volume wastes time and storage.

A company stores customer invoices in Amazon S3. Each invoice is read frequently for the first 30 days, only occasionally over the following year, and after that it is needed only on rare audit requests where a retrieval delay of several hours is acceptable. Invoices must be retained for exactly seven years and then permanently removed to satisfy a data-minimisation policy. The team wants the lowest storage cost achieved entirely through a single S3 Lifecycle configuration, with no application changes. Which two lifecycle actions should the solutions architect include? Select TWO.

• AAdd a transition action moving objects to S3 Glacier Flexible Retrieval after one year, where a multi-hour retrieval is acceptable for rare audits.check_circle Correct
• BAdd a transition action moving objects to S3 Standard within the first day to guarantee the lowest cost during the frequent-access window.
• CEnable S3 Intelligent-Tiering with the Deep Archive Access tier and rely on it to delete objects after seven years.
• DAdd a transition action moving objects to S3 One Zone-Infrequent Access after seven years to cut the cost of the final archived copies.
• EAdd an expiration action that deletes objects seven years after creation so the invoices are removed once the retention period ends.check_circle Correct

Why A is correct: A timed transition to Glacier Flexible Retrieval matches the rare, delay-tolerant audit access and gives the lowest archival storage rate for the later years.

Why B is wrong: Objects already land in S3 Standard by default, so transitioning to it is a no-op that adds a request charge and saves nothing during the hot window.

Why C is wrong: Intelligent-Tiering is tempting for shifting access but it never deletes objects, so it cannot enforce the mandated seven-year removal the policy requires.

Why D is wrong: A transition timed at seven years is pointless because expiration removes the objects then, and One Zone-IA also drops the multi-AZ durability compliance copies need.

Why E is correct: An expiration action enforces the seven-year retention and the mandated deletion automatically, satisfying the data-minimisation requirement without manual cleanup.

An application writes audit log files to Amazon S3. The logs are queried heavily for the first 30 days, after which they are almost never read but must be retained for 7 years to satisfy a compliance policy. On the rare occasions an old log is needed, a retrieval that completes within a few hours is acceptable. The team wants the lowest long-term storage cost. Which configuration should the solutions architect implement?

• AApply a lifecycle rule that transitions each log object to S3 Glacier Flexible Retrieval 30 days after creation and expires it after 7 years.check_circle Correct
• BLeave the logs in S3 Standard for the full 7 years and use S3 Storage Lens dashboards to track how much the retained data is costing each month.
• CApply a lifecycle rule that expires and deletes each log object 30 days after creation once the heavy query window has ended for that file.
• DConfigure S3 Intelligent-Tiering on the bucket and let the archive access tiers move the logs as their access frequency drops over the retention period.

Why A is correct: A lifecycle transition to Glacier Flexible Retrieval at 30 days matches the known shift to cold access, and the few-hour retrieval allowance fits its retrieval model while the 7-year expiry enforces the policy at lowest cost.

Why B is wrong: Tempting because Standard keeps the logs instantly available, but paying the frequent-access rate for 7 years of rarely read data is far more expensive than archiving it after the active window.

Why C is wrong: Tempting because deletion gives the lowest possible storage bill, but removing the logs at 30 days violates the mandatory 7-year retention requirement and is not an option.

Why D is wrong: Tempting because Intelligent-Tiering can archive cold data, but the access pattern here is already known, so a direct lifecycle transition to Glacier avoids the per-object monitoring charge and costs less.

A research platform stores millions of datasets in Amazon S3 where the access pattern for any given object is impossible to forecast: some are read daily for months, others go untouched for over a year and may never be read again. The team wants automatic movement between frequent and infrequent access rates with no per-object tracking code and no change to how the application reads objects, and it also wants the coldest datasets to reach archive-level rates automatically. Which two configuration choices meet these requirements most cost-effectively? Select TWO.

• AWrite all objects to S3 Standard-Infrequent Access from the start to guarantee the lowest rate regardless of how often each object is read.
• BStore the objects in the S3 Intelligent-Tiering storage class so AWS moves them between frequent and infrequent access tiers automatically based on observed access.check_circle Correct
• CActivate the optional Deep Archive Access tier within Intelligent-Tiering so objects untouched for the configured period drop to archive-level rates automatically.check_circle Correct
• DAdd a lifecycle rule transitioning every object to S3 Glacier Flexible Retrieval after 30 days to force the coldest rate on the whole bucket.
• EEnable S3 Versioning and a noncurrent-version expiration rule so older copies are removed and storage tracks current usage.

Why A is wrong: Standard-IA charges per-GB retrieval fees and a minimum duration, so frequently read datasets become more expensive, and it does no automatic movement at all.

Why B is correct: Intelligent-Tiering automates frequent and infrequent tier movement with no tracking code and no retrieval fees, fitting the unpredictable, application-transparent requirement exactly.

Why C is correct: The optional asynchronous archive tiers let Intelligent-Tiering reach archive rates for long-idle objects automatically, meeting the coldest-data goal without a separate lifecycle rule.

Why D is wrong: A blanket timed transition ignores the actual access pattern, so datasets still read daily would incur Glacier retrieval delays and fees, contradicting the requirements.

Why E is wrong: Versioning controls old object copies but does nothing to tier objects by access frequency, so it fails to address the unpredictable hot and cold access pattern described.