AWS Certified Solutions Architect – Associate: study guide and free practice questions The ideas the Solutions Architect – Associate (SAA-C03) exam tests, one page each: what the AWS docs say, the traps the questions set, and real practice questions to try. Every page is written from AWS's own documentation and links to it.
Topics Design secure architectures Design resilient architectures Design high-performing architectures Design cost-optimized architectures 10 free practice questions Drawn from every domain. Pick an answer to see why each option is right or wrong.
A company uses AWS Organizations with all features enabled. The company must stop every IAM user and role in its member accounts, including each member account's root user, from stopping or deleting AWS CloudTrail trails. The control must be set once, centrally, and must also apply to accounts that are added to the workloads OU later.
Which solution meets these requirements? Right. In the game that’s Renown for your Design Secure Architectures building.
Not that one: D is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.
Your answer A. Create an IAM group in each member account with a policy that denies cloudtrail:StopLogging, and add every IAM user to that group.Covers IAM users only. Roles and the root user are outside the group, and each new account would need the group created again. Your answer B. Attach a service control policy that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail to the organization's management account, where the organization is administered.Targets the one account an SCP does not affect. SCPs apply to member accounts, so the member accounts stay unrestricted. Your answer C. Attach a permissions boundary that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail to every IAM role in each member account.Covers roles only, one account at a time. A permissions boundary does not reach the root user, and new accounts would need their own boundaries. The answer D. Attach a service control policy that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail to the workloads OU that holds the member accounts.An SCP attached to the OU is the central guardrail, and it reaches the root user. "An SCP restricts permissions for IAM users and roles in member accounts, including the member account's root user." Because "Any account has only those permissions permitted by every parent above it", an account added to the OU later inherits the deny with no further action. Attaching the policy to the management account would do nothing for the member accounts: "SCPs don't affect users or roles in the management account."
A company is creating an Amazon Redshift provisioned cluster for a reporting application. If the cluster's Availability Zone has an issue, Amazon Redshift must be able to move the cluster to another Availability Zone in the same Region, keeping the same endpoint. The company wants no configuration steps after the cluster is created.
Which solution meets these requirements? Right. In the game that’s Renown for your Design Resilient Architectures building.
Not that one: D is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.
Your answer A. Create an RA3 cluster in a cluster subnet group whose subnets are all in one Availability Zone, which turns on relocation by default.Misstates the default. Relocation is on by default only when the cluster's subnet group includes multiple Availability Zones. Your answer B. Create a DC2 cluster in a cluster subnet group that includes subnets in multiple Availability Zones, and then turn on relocation.Picks a node type that relocation does not support. Relocation is not available for DC2, and turning it on is a step after creation. Your answer C. Create an RA3 cluster with cross-Region snapshot copy so that it can relocate across Regions.Uses a path relocation does not take. A cluster cannot be relocated across AWS Regions, and a snapshot copy is not relocation. The answer D. Create an RA3 cluster in a cluster subnet group that includes subnets in multiple Availability Zones.An RA3 cluster in a multi-zone subnet group gets relocation without any further step. The page states: "Cluster relocation is enabled by default on newly created or restored RG or RA3 clusters whose subnet group includes multiple Availability Zones."
A company is creating an Amazon DynamoDB table in provisioned capacity mode. Its steady write traffic totals about 450 writes per second of 1 KB items, and most writes go to a few partition key values, none of which receives more than 300 writes per second. The key design cannot change. The company must avoid throttling on the busy partitions at the lowest cost.
Which solution meets these requirements? Right. In the game that’s Renown for your Design High-Performing Architectures building.
Not that one: D is right. In the game your Design High-Performing Architectures building would lose a little Renown, and this question would come back later.
Your answer A. Provision several times the table's total write rate, so that an even share of capacity on each partition covers the busiest keys.Pays for capacity that adaptive capacity makes unnecessary. Busy partitions can exceed an even share as long as the table's total provisioned capacity is not exceeded. Your answer B. Provision about 500 write capacity units, and add a random suffix to the busy partition key values to spread their writes.Changes the key design, which the company cannot do. Write sharding is also unnecessary while each key stays below the partition maximum. Your answer C. Provision about 500 write capacity units, and call UpdateTable to turn on adaptive capacity for the table's busy partitions.There is nothing to turn on. Adaptive capacity is enabled automatically for every table, and it does not need to be explicitly enabled or disabled. The answer D. Provision about 500 write capacity units for the table, and rely on the adaptive capacity that DynamoDB applies to every table.Provision for the total and let adaptive capacity move it to the busy partitions.
Show the full explanation and doc quotes The DynamoDB page says adaptive capacity "enables your application to continue reading and writing to hot partitions without being throttled, provided that traffic does not exceed your table's total provisioned capacity or the partition maximum capacity." About 500 WCUs covers the 450 writes per second, and no key comes near the partition maximum of 1,000 WCUs. It costs nothing extra: "Adaptive capacity is enabled automatically for every DynamoDB table, at no additional cost."
Written from docs.aws.amazon.com/amazondynamodb/latest/developerguide/burst-adaptive-capacity.html
A company writes application log files of about 5 MB each to Amazon S3. A batch process indexes each file and deletes it about ten days after it is written. Each file is read only during indexing and must be returned in milliseconds when it is read. The company must store the log files at the lowest cost for their ten-day life.
Which solution meets these requirements? Right. In the game that’s Renown for your Design Cost-Optimized Architectures building.
Not that one: A is right. In the game your Design Cost-Optimized Architectures building would lose a little Renown, and this question would come back later.
The answer A. Write the log files to S3 Standard, and have the batch process delete each file as soon as its indexing is complete.A ten-day object belongs in a class with no minimum storage duration. Your answer B. Write the log files to S3 Glacier Instant Retrieval, which still returns each file in milliseconds when the indexing process reads it.S3 Glacier Instant Retrieval has a 90-day minimum storage duration and per-GB retrieval fees. Your answer C. Write the log files to S3 One Zone-IA, since the application can re-create any lost logs.S3 One Zone-IA has the same 30-day minimum storage duration and per-GB retrieval fee as S3 Standard-IA. Your answer D. Write the log files to S3 Standard-IA, whose storage price is lower for files that are read only once after they are written.S3 Standard-IA bills a 30-day minimum storage duration and a per-GB retrieval fee, so a ten-day file costs more.
Show the full explanation and doc quotes S3 Standard has none, while for the IA classes "If you delete an object before the end of the 30-day minimum storage duration period, you are charged for 30 days." Both IA classes "are suitable for objects larger than 128 KB that you plan to store for at least 30 days." S3 Glacier Instant Retrieval has a 90-day minimum. Each alternative bills a ten-day file for at least three times its life, plus a retrieval fee on the one read.
Written from docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html
A company creates an interface VPC endpoint in its VPC to a partner's SaaS endpoint service. Only the instances in the VPC's finance subnet may send traffic to the partner service through the endpoint. Instances in the VPC's other subnets must not reach it. The company must enforce this in its own VPC.
Which solution meets these requirements? Right. In the game that’s Renown for your Design Secure Architectures building.
Not that one: D is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.
Your answer A. Attach an endpoint policy that allows access only for the IAM role that the finance instances use.Uses a control that does not restrict this endpoint. For a VPC endpoint to an endpoint service other than an AWS service, full access to the endpoint is allowed. Your answer B. Keep the default endpoint policy, because it allows traffic only from principals in the subnets where the endpoint has network interfaces.Misreads the default. The default endpoint policy grants full access to the endpoint, with Principal set to * and no subnet limit. Your answer C. Ask the partner to attach an endpoint policy to its endpoint service that names the finance subnet as the only allowed source.Puts the policy in the wrong place. An endpoint policy is a resource-based policy that is attached to a VPC endpoint, not to an endpoint service. The answer D. Associate a security group with the endpoint network interfaces that allows inbound traffic only from the finance subnet's CIDR range.The network control applies where the policy cannot. For this kind of endpoint the policy has no effect: "When you create a VPC endpoint for an endpoint service other than an AWS service, we allow full access to the endpoint."
Show the full explanation and doc quotes Security groups are what govern reachability of the endpoint: "The security group rules control the traffic that is allowed to the endpoint network interface from the resources in your VPC" (https://docs.aws.amazon.com/vpc/latest/privatelink/interface-endpoints.html). A rule that allows only the finance subnet's CIDR range keeps the other subnets out.
Written from docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html
A company runs an interactive Lambda function behind Amazon API Gateway. Users report that the first requests after a quiet period are slow, while later requests are fast. The company wants the function to respond immediately at all times and accepts an additional charge for doing so.
Which solution meets these requirements? Right. In the game that’s Renown for your Design Resilient Architectures building.
Not that one: A is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.
The answer A. Configure provisioned concurrency so that a set number of execution environments are initialised before requests arrive.Provisioned concurrency is defined as "the number of pre-initialized execution environments allocated to your function", which are "ready to respond immediately to incoming function requests", and AWS names interactive workloads as the ones that benefit most. The contrast with reserved concurrency is explicit: under a reserve "Lambda might completely terminate an environment after a period of inactivity", so the next request initialises a new one. Provisioned concurrency is charged for, which the company has accepted, and Lambda keeps the number of pre-initialised environments equal to the setting. Your answer B. Configure reserved concurrency on the function so that the execution environments it is allotted are held ready between requests.Reserves capacity without pre-initialising it. Lambda may terminate an idle environment under a reserve, and the next request pays the same cold start. Your answer C. Increase the function's memory setting so that each execution environment initialises faster after a period of inactivity.Shortens initialisation without removing it. A larger memory setting speeds the Init phase but does not make an environment exist in advance. Your answer D. Configure an Amazon EventBridge scheduled rule to invoke the function every minute so that at least one execution environment is kept from being recycled.Scheduled pings were the workaround before provisioned concurrency existed. They are unreliable under concurrency and are not a documented mechanism.
A company runs an Amazon ElastiCache for Valkey cluster mode enabled cluster with four shards and no read replicas, to keep costs down. Writes are spread across the four shards. The company now requires that the failure of any single node must not lose cached data, and writes must stay partitioned across shards.
Which solution meets these requirements? Right. In the game that’s Renown for your Design High-Performing Architectures building.
Not that one: C is right. In the game your Design High-Performing Architectures building would lose a little Renown, and this question would come back later.
Your answer A. Migrate to a cluster mode disabled cluster with five read replicas, so that the failure of one node cannot lose any data.Replicas would protect the data, but a cluster mode disabled cluster always has a single shard and does not partition data. Your answer B. Keep the shards without replicas, and rely on the other shards to rebuild the failed shard's data from the keys that they hold.Shards partition the data, so the other shards hold different keys. Nothing in them can rebuild a shard that had no replica. The answer C. Add at least one read replica to each shard of the existing cluster mode enabled cluster, and keep the four shards.Replicas protect each shard, and cluster mode enabled keeps the partitioning. For this cluster type the documentation warns: "If you have no replicas and a node fails, you experience loss of all data in that shard." Your answer D. Increase the shard count to eight, so that a node failure loses a smaller share of the data.More shards shrink each shard but do not protect it. With no replicas, a failed node still loses all of the data in its shard.
A company runs a busy Amazon RDS for MySQL DB instance in us-east-1. Business analysts, who also work in us-east-1, run heavy reporting queries against it every afternoon, and the application slows down. The company must move the reporting queries off the DB instance at the lowest cost.
Which solution meets these requirements? Right. In the game that’s Renown for your Design Cost-Optimized Architectures building.
Not that one: D is right. In the game your Design Cost-Optimized Architectures building would lose a little Renown, and this question would come back later.
Your answer A. Convert the DB instance to a Multi-AZ DB instance deployment, and point the analysts' reporting tool at the standby replica.The standby cannot serve reads. A Multi-AZ DB instance deployment's standby replica is for failover, not read traffic. Your answer B. Create a read replica of the DB instance in a second AWS Region, and point the analysts' reporting tool at the read replica's endpoint.Adds a transfer charge for nothing. Cross-Region replication incurs data transfer charges, and the analysts are in us-east-1 already. Your answer C. Modify the DB instance to a larger DB instance class, so that one instance has room for both the application and the reports.A bigger instance keeps the reports on the primary and costs more every hour, including the hours with no reports. The answer D. Create a read replica of the DB instance in us-east-1, and point the analysts' reporting tool at the read replica's endpoint.Offloading reports is what a read replica is for, and keeping it in the same Region avoids a transfer charge.
Show the full explanation and doc quotes RDS lists "Business reporting or data warehousing scenarios where you might want business reporting queries to run against a read replica, rather than your production DB instance." On cost: "Read replicas are billed as standard DB instances at the same rates as the DB instance class used for the replica. You aren't charged for the data transfer incurred in replicating data between the source DB instance and a read replica within the same AWS Region."
Written from docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html
A company stores files for several tenants on one Amazon EFS file system. Each tenant's containers mount through an access point whose root directory is that tenant's directory. Some tenants can also use a shared reporting access point. The company must ensure that no tenant can read another tenant's files, even through a file handle obtained outside its own access point.
Which solution meets these requirements? Right. In the game that’s Renown for your Design Secure Architectures building.
Not that one: D is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.
Your answer A. Set each tenant directory's permissions to 777 so that every access point user can mount it, and rely on the root directory override for isolation.Removes the control that still applies. Ownership and permissions are always enforced inside and outside the access point root, and mode 777 grants every user access. Your answer B. Rely on the root directory of each access point, because Amazon EFS never lets a client reach a file outside its access point root directory.Overstates the root directory override. It hides file handles, but a user can get a handle for a file outside the access point by an out-of-band mechanism, such as a second access point, and then read and write it. Your answer C. Set each access point's Path five subdirectories deep with a long random directory name at each level, so that no tenant can guess or list another tenant's directory path.Is not allowed and does not isolate. The Path can include up to four subdirectories, and a hidden path is not a permission check. The answer D. Set POSIX ownership and permissions on each tenant directory so that only that tenant's user ID can read it, in addition to the access point root directories.The permissions are the control that holds everywhere. The override limits what is disclosed: "When a root directory override is in place, Amazon EFS doesn't disclose file handles for files outside the specified root directory."
Show the full explanation and doc quotes It is not a boundary on its own, because a user "might get a file handle for a file outside of their access point by using an out-of-band mechanism. For example, they might do so if they have access to a second access point." What stops the read is: "File ownership and access permissions are always enforced, for access to files within and outside of a user's access point root directory."
Written from docs.aws.amazon.com/efs/latest/ug/enforce-root-directory-access-point.html
A company is choosing a deployment type for an FSx for Windows File Server file system that holds a production line-of-business application. The application cannot tolerate half an hour of unavailability during a monthly maintenance window, and there is no replication built into the application.
Which solution meets these requirements? Right. In the game that’s Renown for your Design Resilient Architectures building.
Not that one: D is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.
Your answer A. A Multi-AZ file system with HDD storage rather than SSD storage, because the failover completes faster when each terabyte of the volume holds less data.Storage type does not speed failover, and HDD makes the post-failover synchronisation slower rather than faster. Your answer B. A Single-AZ file system whose automatic daily backups are restored when maintenance begins.Backups are recovery from a lost file system, not continuity through maintenance, and nothing restores them automatically. Your answer C. A Single-AZ file system in two subnets, which spreads the file server's storage volumes across two Availability Zones.Multi-AZ requires two subnets in different Availability Zones; Single-AZ requires one and defines the zone by it. The answer D. A Multi-AZ file system, which fails over to a standby file server in another Availability Zone in under 30 seconds.The documented downtime figures decide it. "Single-AZ file systems usually experience about 30 minutes of downtime during failure recovery events, and during the planned maintenance window that you configure for your file system", while Multi-AZ file systems fail over automatically to a standby in a second Availability Zone with a failover that "typically completes in less than 30 seconds". AWS's own recommendation matches the requirement: "we recommend using Multi-AZ file systems for most production workloads", with Single-AZ "designed as a cost-efficient solution for test and development workloads, certain production workloads that have replication built into the application layer... and production workloads that have relaxed availability and Recovery Point Objective (RPO) needs."
Certopolis is an independent study game. It is not affiliated with, endorsed by or sponsored by Amazon Web Services, and its questions are not the exams' questions. Exam names are trademarks of their owners.