Amazon AWS SAA-C03: Practice Architecture Scenarios
Amazon AWS SAA-C03: Practice Architecture Scenarios
The SAA-C03 exam does not reward choosing the most elaborate architecture. It asks whether a design satisfies security, resilience, performance and cost requirements with appropriate AWS services. The scenarios below are original practice exercises built around those four domains, not recalled or purported live certification questions. Each question includes an explicit constraint intended to distinguish one defensible design from alternatives that might work in a different situation.
Use these questions diagnostically. Before looking at the choices, identify the workload, the strongest requirement, the relevant failure or trust boundary, and any instruction about operating effort. After you choose, explain why the other options are weaker. If you miss a question because you did not know a service, study that capability; if you miss it because you overlooked one word such as “private” or “automatically,” practise scenario reading rather than repeating every service fact.
How to use the questions without memorizing answers
For every question, mark the strongest constraint before reading the choices. Multiple-response questions state how many responses to select. Incorrect explanations focus on the missing requirement, not simply that another service exists.
Secure architecture: identities, access and encryption
The first three exercises test whether you can separate permission from network location and explain the trust boundary. For policy-layer context, compare SCPs and IAM policies; these controls are complementary, not interchangeable.
Question 1. An application running on EC2 must upload reports to one S3 bucket. The security team prohibits credentials stored in configuration files or code. The application should automatically receive renewable credentials without a manual rotation process. Which approach best meets the requirement?
A: Create an IAM user access key and encrypt it in a local file.
B: Attach an IAM role with restricted S3 permissions to the EC2 instance profile.
C: Allow public writes to the bucket and restrict them by source IP only.
D: Place an access key in instance user data so it is available at boot.
Correct Answer: B
Why this answer is correct: An instance profile lets the EC2 workload obtain temporary role credentials without maintaining static keys. The role policy can permit only the needed bucket operations and prefixes. The application code uses the standard AWS credential provider chain while the environment refreshes credentials. The design minimizes secret-handling work and keeps authorization tied to the workload identity rather than a permanent access key.
Incorrect Answers:
A: A local long-lived key still creates storage and rotation work and can be exposed through host access.
C: Public bucket writes do not establish the workload-specific least privilege and unnecessarily expose data operations.
D: User data may be inspected through instance-management channels and does not supply automatic credential renewal.
Question 2. A service in private VPC subnets downloads objects from S3. Security policy requires traffic to stay on AWS private networking, and the team wants to avoid introducing a billable NAT data-processing path solely for these downloads. What is the most direct solution?
A: Put the application in a public subnet and assign a public IP.
B: Deploy an internet gateway directly on each private subnet.
C: Create an S3 gateway VPC endpoint and associate it with the applicable route tables.
D: Route all S3 requests through a public web proxy hosted on EC2.
Correct Answer: C
Why this answer is correct: An S3 gateway endpoint provides a VPC route for supported S3 traffic without requiring an internet gateway or NAT gateway for those requests. It can be associated with the relevant private-subnet route tables and controlled with endpoint and bucket policies. This addresses the stated network path and cost requirement; normal S3 authorization still applies because private connectivity does not grant permission to read an object.
Incorrect Answers:
A: A public IP violates the private-network requirement and does not remove the need for object authorization.
B: An internet gateway attaches at VPC level; it is not a per-subnet S3 private-access mechanism.
D: Operating a public proxy adds unnecessary capacity, exposure and support burden for an eligible gateway endpoint use case.
Question 3. A cross-account analytics role can reach an S3 bucket containing objects encrypted with a customer-managed KMS key, but decrypt attempts fail. The IAM role has a matching S3 read allow. Which additional permissions must the architect evaluate? Select TWO.
A: The KMS key policy and any relevant grants for the consuming principal.
B: Whether the S3 bucket is configured for public anonymous access.
C: The consuming role’s IAM permissions to use KMS for decryption.
D: Whether a load balancer listener is using the same KMS key.
E: Whether the bucket has a lifecycle transition rule.
Correct Answer: A, C
Why this answer is correct: S3 object access and KMS use are separate authorization decisions. For a cross-account principal, the key policy (and any applicable grants) must permit the relevant key operation, while the consuming principal also needs appropriate IAM permissions. The architecture should evaluate explicit denies and resource boundaries rather than “fixing” decryption by exposing data or changing unrelated infrastructure.
Incorrect Answers:
B: Anonymous public access is unrelated to authorized cross-account KMS decryption and would weaken the data boundary.
D: Load balancer listener TLS configuration is not the authorization path for decrypting these stored S3 objects.
E: Lifecycle transitions control object retention and class, not whether the consuming principal can use the KMS key.
Resilient architecture: failures and decoupling
Resilience questions are easier when you name the outage to be survived. Multi-AZ and multi-Region patterns illustrate why instance replacement, AZ continuity and regional recovery are distinct commitments.
Question 4. A stateless HTTPS application must remain available if one Availability Zone loses its application instances. Traffic is distributed across two AZs and the backend supports the same failure tolerance. Which web-tier design best fits?
A: One large EC2 instance with daily snapshots in a single AZ.
B: An Application Load Balancer routing to an Auto Scaling group spread across the two AZs.
C: A manually maintained list of instance IP addresses in the browser application.
D: A second instance in the same AZ with no health-aware traffic distribution.
Correct Answer: B
Why this answer is correct: An ALB can route requests to healthy targets, while a multi-AZ Auto Scaling group maintains available application capacity when instances fail. The question makes the application stateless and the backend similarly resilient, removing two common hidden single points of failure. Health checks and target replacement support the specified AZ-level web-tier requirement without requiring an unnecessary regional disaster-recovery platform.
Incorrect Answers:
A: A single AZ has no independent healthy target when that zone fails; snapshots are a restoration tool, not continuous service.
C: Static IP lists have no automatic target-health and replacement behavior and place complexity on clients.
D: Two instances sharing one failure domain still disappear together and have no robust health-aware distribution.
Question 5. Customers submit images for processing. Processing can take several minutes, but the upload API must acknowledge requests quickly and remain usable when workers temporarily fail. Jobs may be retried safely. Which pattern is most appropriate?
A: Have the request thread wait synchronously until the processing worker finishes.
B: Send job descriptions to SQS and process them using independently scaled workers with a dead-letter strategy.
C: Increase the API timeout to the maximum allowed and keep one permanent worker.
D: Store all jobs only in the web server’s in-memory queue.
Correct Answer: B
Why this answer is correct: A durable queue decouples request intake from processing, lets API responses remain fast and gives workers a mechanism for retrying work after transient failures. A dead-letter strategy and idempotent processing protect against repeated poison messages and duplicate delivery. Scaling queue consumers separately also prevents workload spikes from forcing unnecessarily large always-on capacity in the web tier.
Incorrect Answers:
A: Synchronous waiting propagates worker failures and long processing time into the customer-facing request.
C: A longer timeout does not decouple processing and still leaves one worker as a bottleneck.
D: In-memory jobs vanish during instance failure and do not provide the required durable retry boundary.
Question 6. A small regional transactional database must automatically remain available after a single AZ failure with minimal manual intervention. The business can tolerate brief failover but not restoring the last nightly backup. Which feature best addresses this?
A: Enable automated nightly backups only and document manual restore steps.
B: Use an appropriate Multi-AZ managed database deployment with automatic failover.
C: Add a read replica in the same AZ and direct all writes to it.
D: Store a second copy of application files on an instance volume.
Correct Answer: B
Why this answer is correct: An eligible managed Multi-AZ deployment provides a standby or architecture designed for AZ-level continuity and supported failover, which fits the explicit recovery requirement better than a backup-only plan. Backups remain important for corruption and other restoration needs, but they are not a substitute for automated availability. A read replica is not automatically an equivalent synchronous failover target, and instance files do not solve database recovery.
Incorrect Answers:
A: Nightly restoration can lose too much recent data and requires operator work contrary to the automatic continuity objective.
C: A same-AZ read replica does not independently survive the stated outage or automatically become a writable primary.
D: A second instance file copy is unrelated to database replication and managed failover behavior.
High-performing architecture: bottlenecks and access patterns
Performance answers depend on the actual constraint. A service can be highly scalable and still be the wrong fit if its access pattern or operating model conflicts with the application.
Question 7. A catalog web application is stateless. Request traffic varies widely during promotions; a managed relational data tier is adequately sized, but web requests saturate individual EC2 instances. What improvement most directly addresses the measured bottleneck?
A: Move every catalog image into a relational database.
B: Use an ALB and EC2 Auto Scaling based on suitable load and health metrics.
C: Increase database backup frequency.
D: Replace the entire application with a cross-Region active-active deployment.
Correct Answer: B
Why this answer is correct: The stated bottleneck is application compute, so distributing traffic across healthy web targets and scaling them with demand directly addresses it. The database is explicitly not saturated. Backup frequency changes recoverability rather than request capacity, and regional duplication adds complexity that has no demonstrated relationship to this web-tier load problem.
Incorrect Answers:
A: Putting images in the database changes storage without relieving the saturated application compute layer.
C: Backup timing concerns recoverability rather than web request throughput in a healthy data tier.
D: A second Region adds major complexity without addressing the measured local web-instance saturation.
Question 8. An e-commerce workload performs millions of predictable key-based lookups on shopping-cart state, needs consistent low-latency access, and does not rely on multi-table joins. The team wants managed scaling. Which data model deserves strongest consideration?
A: A DynamoDB table designed around the known access keys and consistency requirements.
B: A single EC2 instance with a local CSV file.
C: A relational warehouse optimized for long-running analytical scans.
D: An S3 bucket that clients query using SQL-style row updates.
Correct Answer: A
Why this answer is correct: DynamoDB is designed for high-scale key-value and document access. With well-defined partition keys and access patterns, it can meet the specified lookup and managed scaling needs. This is not a claim that DynamoDB is universally better than a relational database: the absence of complex joins and the predictable keys are the differentiators. Capacity mode and required read consistency still need to be selected deliberately.
Incorrect Answers:
B: A local CSV does not provide appropriate durability, safe concurrency or managed scaling for high-volume state.
C: An analytical warehouse is not designed as the low-latency mutable key-value backend described.
D: Object storage does not supply the direct transactional row-update interface implied by the proposed use.
Question 9. A media site serves mostly immutable images and stylesheets to customers on several continents. The origin is healthy, but distant users experience unnecessary network latency. Which TWO changes are most directly aligned with the workload?
A: Place cacheable static assets behind CloudFront.
B: Disable cache-control headers so every request reaches the origin.
C: Choose cache policies and origin behavior that reflect the assets’ update frequency.
D: Move the only database instance to a public subnet.
E: Force all traffic through an application server in one faraway AZ.
Correct Answer: A, C
Why this answer is correct: CloudFront can cache suitable static objects at edge locations, reducing repeated long-distance origin requests. Correct cache-control and distribution policies determine how frequently content is refreshed and protect against serving stale updates longer than intended. Simply turning caching off or moving unrelated database networking does not address the measured global static-content latency.
Incorrect Answers:
B: Disabling caching forces long-distance origin trips and does not address the latency problem.
D: Publicly exposing the database neither improves static delivery nor respects normal network boundaries.
E: Forcing traffic to a distant single AZ increases dependence on the origin and removes useful edge delivery.
Cost-optimized architecture: capacity and data lifecycle
A low price is not a correct answer if the design violates security or availability requirements. Evaluate cost only after those nonnegotiable constraints are satisfied.
Question 10. A log archive is retained for seven years and is almost never read after the first month. The compliance team accepts hours of retrieval delay for old objects. Which approach most appropriately reduces storage costs?
A: Keep every object in a frequently accessed S3 storage class forever.
B: Use S3 lifecycle transitions to an appropriate lower-cost archival class after the active period.
C: Copy objects to the root volume of one EC2 instance and delete them from S3.
D: Disable retention tracking and remove the archive after 30 days.
Correct Answer: B
Why this answer is correct: Lifecycle transitions let objects move to archival storage once their access pattern changes. The choice of archival class must respect retrieval-time, minimum-storage-duration and retrieval-cost characteristics, but the scenario explicitly allows slower access for old records. A single instance volume is not a suitable seven-year archival strategy, and deleting required records would violate the compliance obligation.
Incorrect Answers:
A: Paying for frequently accessed storage over seven years ignores the known archival access pattern.
C: A lone instance volume lacks an appropriate long-term durability and retention design.
D: Deleting the data violates the explicitly stated legal retention period.
Question 11. A service uses steady baseline EC2 capacity all year, plus short unpredictable promotional spikes. Reliability requirements do not allow Spot interruption for the baseline. Which capacity strategy is most defensible?
A: Purchase all peak capacity as a year-round fixed commitment.
B: Run the entire steady application only on interruptible Spot capacity.
C: Apply suitable capacity commitments to the predictable baseline while using flexible On-Demand capacity for variable peaks.
D: Turn off required production instances outside office hours, regardless of customer demand.
Correct Answer: C
Why this answer is correct: Separating stable baseline usage from variable demand avoids committing to the full peak while allowing the business to retain its noninterruptible minimum. Depending on the workload, Savings Plans or other eligible commitments can reduce predictable spending, with On-Demand or other flexible capacity serving bursts. The cost strategy follows measured demand and reliability requirements rather than assuming one purchase model works for every hour.
Incorrect Answers:
A: A full peak commitment pays for idle capacity during routine periods without a corresponding demand requirement.
B: The baseline explicitly cannot tolerate interruption, so Spot-only capacity fails reliability.
D: Customer traffic continues outside office hours; this cuts required availability rather than costs safely.
Question 12. A workload transfers large datasets between AZs every minute despite both processing stages using the same data frequently. Performance requirements permit an architecture redesign. What should be reviewed first to lower recurring network charges without harming availability?
A: Increase cross-AZ transfer volume to simplify monitoring.
B: Co-locate latency-sensitive stages where appropriate and examine caching or data-placement changes, while keeping required redundancy.
C: Remove all redundant AZ capacity even though the SLA requires AZ continuity.
D: Use public internet routing for every internal transfer.
Correct Answer: B
Why this answer is correct: Data movement can become a major cost driver, so reviewing placement, transfer frequency, reuse and caching is a legitimate optimization. The response preserves the necessary AZ redundancy while looking for avoidable repetitive transfers. Removing fault tolerance or directing internal traffic through the public internet changes the service’s design contract rather than solving the stated problem.
Incorrect Answers:
A: Increasing transfers without analyzing their purpose adds cost and does not improve the given performance objective.
C: Removing all AZ redundancy violates the stated availability agreement.
D: Unnecessary internet routing changes security and network behavior without addressing repeated inter-AZ movement.
Review the decision that changed the answer
When reviewing your answers, write down the exact phrase that justified each architecture choice. Questions one through three depend on identity and trust, four through six on the intended failure behavior, seven through nine on access patterns and bottlenecks, and ten through twelve on the cost of meeting the design contract. If a distractor looks attractive, alter one constraint and ask when it could become correct. That is a stronger learning exercise than memorizing letters.
Use current AWS exam objectives as your coverage reference. Revisit weak categories with small, observable labs, and avoid assuming that these practice scenarios predict actual examination items. An associate architect should be able to articulate the requirement, the selected mechanism, the operational consequence and a credible alternative. If you can do that across the four domains, your preparation is becoming architecture practice.
