50 Free AWS Solutions Architect Associate Practice Questions (SAA-C03)

Answer: b) Permission boundaries

Explanation: Permission boundaries set the maximum permissions that an IAM entity can have. They don't grant permissions themselves but define the upper boundary. SCPs work at the organization level.

Answer: b) S3 bucket policy with aws:SourceIp condition

Explanation: S3 bucket policies can include condition keys like aws:SourceIp to restrict access to specific IP ranges. This is more flexible than ACLs and allows granular control.

Answer: b) Use an IAM role with an instance profile

Explanation: IAM roles with instance profiles provide temporary credentials automatically rotated by AWS. This eliminates the need for hard-coded or stored credentials.

Answer: b) AWS WAF

Explanation: AWS WAF protects web applications from common exploits like SQL injection and XSS. It integrates with CloudFront, ALB, API Gateway, and AppSync.

Answer: b) SSE-S3 (AES-256)

Explanation: S3 automatically encrypts all new objects with SSE-S3 using AES-256 at no additional cost. This is enabled by default since January 2023.

Answer: b) AWS Shield Advanced

Explanation: AWS Shield Advanced provides enhanced DDoS protection with 24/7 access to the DDoS Response Team (DRT), cost protection, and advanced detection.

Answer: b) Encrypting data with a data key, then encrypting the data key with a KMS key

Explanation: Envelope encryption encrypts data with a data key, then encrypts that data key with a KMS customer master key. This provides performance benefits for large data volumes.

Answer: b) To privately connect to AWS services without traversing the internet

Explanation: VPC endpoints (Gateway or Interface) allow private connectivity to AWS services (S3, DynamoDB, etc.) without using internet gateways, NAT devices, or VPN connections.

Answer: a) AWS Organizations

Explanation: AWS Organizations centrally governs multiple AWS accounts with service control policies (SCPs), consolidated billing, and account management.

Answer: b) A networking connection between two VPCs using private IP addresses

Explanation: VPC peering connects two VPCs using private IP addresses, enabling traffic to route between them as if they're on the same network. No gateways or VPN connections needed.

Answer: b) AWS Config

Explanation: AWS Config evaluates your resource configurations against desired configurations using managed or custom rules. It provides compliance dashboards and remediation actions.

Answer: a) To control access to a resource without using IAM roles

Explanation: Resource-based policies attach directly to resources (S3 buckets, SQS queues, KMS keys) and define who can access the resource. They're used in cross-account access scenarios.

Answer: b) AWS Config with managed rules

Explanation: AWS Config can enforce tagging rules (e.g., "required-tags" rule) and automatically remediate non-compliant resources using Systems Manager Automation.

Answer: b) AWS manages OS and database engine; customer manages data and access

Explanation: For RDS, AWS manages the underlying infrastructure and database engine (patching, backups). The customer is responsible for data, IAM access, encryption configuration, and security groups.

Answer: a) AWS CloudTrail

Explanation: CloudTrail logs all API calls across your AWS account for auditing, security analysis, and operational troubleshooting. It's enabled by default with 90-day retention.

Answer: c) DynamoDB Global Tables

Explanation: DynamoDB Global Tables provide multi-region, multi-active replication for globally distributed applications with ~1-second replication latency.

Answer: b) 2

Explanation: A minimum of two Availability Zones (AZs) provides high availability. If one AZ fails, the application continues running in the other AZ.

Answer: b) Application Load Balancer

Explanation: ALB operates at Layer 7 and supports content-based routing (host, path, headers), HTTP/2, WebSocket, and integrates with WAF and Lambda.

Answer: a) Applications running at minimum capacity in another region

Explanation: Warm standby runs a scaled-down version of production in the DR region. On failover, the environment scales up. RTO is minutes; RPO is seconds.

Answer: c) S3 Glacier Deep Archive

Explanation: Glacier Deep Archive is the lowest-cost S3 storage class at ~$1/TB/month, designed for data accessed less than once a year with retrieval times of 12 hours.

Answer: b) Route traffic to a secondary endpoint if the primary is unhealthy

Explanation: Failover routing policy routes traffic to a primary resource (e.g., active region) and automatically directs traffic to a secondary if health checks fail.

Answer: a) Multi-AZ is for high availability; Read Replicas are for read scaling

Explanation: Multi-AZ provides synchronous standby for failover (HA). Read Replicas provide asynchronous read copies for performance scaling.

Answer: b) AWS Database Migration Service (DMS)

Explanation: DMS migrates databases to AWS with minimal downtime using continuous replication. It supports homogeneous (MySQL→MySQL) and heterogeneous (Oracle→Aurora) migrations.

Answer: a) To pause instance termination for custom actions

Explanation: Lifecycle hooks let you perform custom actions (e.g., download logs, take snapshots) before instances are launched or terminated during Auto Scaling events.

Answer: b) C5 (compute optimized)

Explanation: C5 instances offer the best price-performance for compute-intensive workloads like batch processing, scientific modeling, and gaming.

Answer: b) DynamoDB Accelerator (DAX)

Explanation: DAX is a fully managed, highly available in-memory cache for DynamoDB that delivers up to 10x performance improvement for read-heavy workloads.

Answer: c) EFS

Explanation: Amazon EFS provides scalable, elastic NFS file storage for Linux-based workloads. It supports POSIX permissions and can scale to petabytes automatically.

Answer: b) Network Load Balancer

Explanation: NLB operates at Layer 4 with ultra-low latency (millions of requests/second). It's ideal for TCP/UDP traffic and supports static IPs and preservation of client IPs.

Answer: a) Faster uploads to S3 over long distances

Explanation: S3 Transfer Acceleration uses AWS edge locations to accelerate uploads over long distances by routing traffic through the AWS global network.

Answer: a) Amazon Kinesis Data Streams

Explanation: Kinesis Data Streams is designed for real-time streaming data at scale (ingest gigabytes/second). Kinesis Data Analytics enables SQL-based real-time processing.

Answer: b) FIFO queue

Explanation: FIFO queues guarantee exactly-once processing and first-in-first-out delivery. Standard queues provide at-least-once delivery with best-effort ordering.

Answer: a) Reduced latency for end users

Explanation: CloudFront caches content at 600+ edge locations worldwide, reducing latency by serving content from the nearest edge location to the user.

Answer: b) On-demand capacity

Explanation: On-demand mode automatically scales up/down based on traffic, paying per request. It's best for unpredictable workloads but costs more than provisioned.

Answer: b) Amazon MWAA

Explanation: MWAA provides managed Apache Airflow environments for orchestrating complex workflows and data pipelines with automatic scaling and built-in security.

Answer: b) 14 days

Explanation: SQS messages can be retained for up to 14 days (minimum 60 seconds, maximum 14 days). Default is 4 days.

Answer: b) Amazon EKS

Explanation: Amazon EKS (Elastic Kubernetes Service) provides a managed Kubernetes control plane with automatic upgrades, scaling, and integration with AWS services.

Answer: a) Connecting VPCs and on-premises networks through a central hub

Explanation: Transit Gateway acts as a central hub connecting VPCs, VPN connections, and Direct Connect. It simplifies network management and reduces peering complexity.

Answer: c) Spot Instances

Explanation: Spot Instances offer up to 90% discount and are ideal for batch jobs, CI/CD, and stateless applications. They can be interrupted with a 2-minute warning.

Answer: b) S3 Intelligent-Tiering

Explanation: S3 Intelligent-Tiering automatically moves data between access tiers based on changing access patterns, optimizing costs without performance impact or operational overhead.

Answer: b) AWS Cost Explorer

Explanation: Cost Explorer provides easy-to-use visualization of cost and usage data, with custom reports, forecasts, and RI/Savings Plan recommendations.

Answer: b) DynamoDB

Explanation: DynamoDB is a NoSQL key-value/ document database optimized for high throughput at any scale. It's more cost-effective than RDS for key-value workloads.

Answer: b) For steady-state workloads with 1-3 year commitments

Explanation: Reserved Instances (up to 72% discount) are best for predictable, steady-state workloads. On-Demand is for spiky workloads, and Spot is for fault-tolerant workloads.

Answer: a) Organizing resources for cost allocation, automation, and management

Explanation: Tags (key-value pairs) enable cost allocation tracking, automation (starting/stopping instances), and resource management across accounts.

Answer: a) S3 Lifecycle policy

Explanation: S3 lifecycle policies can automatically abort incomplete multipart uploads after a specified number of days, preventing storage cost accumulation.

Answer: d) All of the above

Explanation: Trusted Advisor (cost checks), Compute Optimizer (instance right-sizing), and Cost Explorer (RI/Savings Plan recommendations) all provide cost optimization guidance.

Answer: a) EBS Snapshots

Explanation: EBS snapshots are incremental and stored in S3, making them cost-effective for backups. You only pay for changed data after the initial snapshot.

Answer: a) TTL (Time to Live)

Explanation: DynamoDB TTL automatically deletes expired items without consuming write capacity, reducing storage costs for session data, logs, and event data.

Answer: b) NAT Gateway

Explanation: NAT Gateways incur hourly and data processing charges. For cost optimization, use NAT instances (less reliable but cheaper) or VPC endpoints for specific AWS services.

Answer: a) No servers to manage — pay per task

Explanation: Fargate is serverless compute for containers — you define tasks and pay per vCPU/memory used without managing EC2 instances, reducing operational overhead.

Answer: a) S3 Lifecycle policies to transition data to colder tiers

Explanation: Lifecycle policies automatically transition objects to lower-cost storage classes (Standard-IA, One Zone-IA, Glacier, Glacier Deep Archive) as data ages, reducing storage costs.