View Full Amazon AWS Certified Solutions Architect – Associate SAA-C03 Exam Dumps and Practice Test Dumps

 

Question 61

Which AWS feature allows an EC2 instance to receive temporary credentials without storing long-term access keys on the instance?

1. IAM user
2. IAM group
3. IAM role
4. IAM password policy

Correct Answer: 3

Explanation

An IAM role allows AWS resources such as EC2 instances to obtain temporary security credentials for accessing other AWS services. When an IAM role is attached to an EC2 instance through an instance profile, applications can use the temporary credentials without storing permanent access keys in configuration files. This improves security and supports the principle of least privilege. IAM users are intended for identities, groups organize users, and password policies control user password requirements. IAM roles are therefore the preferred solution for granting temporary permissions to AWS workloads.

Question 62

A company needs private access from resources in a VPC to Amazon S3 without routing traffic through a NAT Gateway or the public internet. Which solution should be used?

1. VPC Gateway Endpoint
2. Internet Gateway
3. NAT Gateway
4. VPC Peering

Correct Answer: 1

Explanation

A VPC Gateway Endpoint provides private connectivity from a VPC to supported AWS services such as Amazon S3 without requiring an Internet Gateway, NAT Gateway, or public IP address. Route tables can be configured to direct S3 traffic through the endpoint. This approach can improve security and reduce networking costs because traffic remains within the AWS network. Internet Gateways and NAT Gateways provide internet connectivity, while VPC Peering connects separate VPCs. A Gateway Endpoint is therefore the appropriate solution for private S3 access from a VPC.

Question 63

Which AWS service is designed to run code in response to events without requiring the customer to provision or manage servers?

1. Amazon ECS
2. Amazon EC2
3. AWS Lambda
4. Amazon EKS

Correct Answer: 3

Explanation

AWS Lambda is a serverless compute service that executes code in response to events without requiring customers to provision or manage servers. Lambda automatically handles the underlying infrastructure and can scale execution based on incoming requests or events. It integrates with many AWS services, including S3, EventBridge, API Gateway, and DynamoDB. EC2 requires server management, while ECS and EKS are container orchestration services. Lambda is therefore the most appropriate choice when an application needs event-driven compute without managing server infrastructure.

Question 64

Which Route 53 routing policy directs users to the AWS Region that provides the lowest network latency?

1. Failover routing
2. Latency-based routing
3. Weighted routing
4. Geolocation routing

Correct Answer: 2

Explanation

Amazon Route 53 latency-based routing directs DNS requests toward the Region that provides the lowest network latency among configured resources. This can improve application responsiveness for users distributed across different geographic locations. Failover routing is primarily used for active-passive disaster recovery, weighted routing distributes traffic according to assigned percentages, and geolocation routing bases decisions on the user’s geographic location. When the primary requirement is directing users to the endpoint expected to provide the best network latency, latency-based routing is the appropriate choice.

Question 65

A company wants to distribute traffic between two application environments, sending 80% of requests to one environment and 20% to another. Which Route 53 policy should be used?

1. Failover routing
2. Geolocation routing
3. Weighted routing
4. Latency-based routing

Correct Answer: 3

Explanation

Route 53 weighted routing allows administrators to assign relative weights to multiple resources. DNS responses are distributed according to those weights, making the policy useful for controlled traffic distribution, testing, and gradual application deployments. For example, assigning weights of 80 and 20 can approximately distribute traffic according to those proportions. Failover routing focuses on primary and secondary resources, geolocation routing uses geographic location, and latency-based routing considers network latency. Weighted routing is therefore the most suitable choice for percentage-based traffic distribution.

Question 66

Which AWS storage service provides persistent block storage that can be attached to an EC2 instance?

1. Amazon EBS
2. Amazon S3
3. Amazon EFS
4. Amazon SQS

Correct Answer: 1

Explanation

Amazon Elastic Block Store (EBS) provides persistent block-level storage volumes designed for use with EC2 instances. EBS volumes remain available independently from the lifecycle of an individual EC2 instance and support snapshots for backup and recovery. They are commonly used for operating systems, databases, and applications that require block storage. S3 provides object storage, EFS provides shared file storage, and SQS provides message queuing. EBS is therefore the correct choice when an EC2 workload requires persistent block storage.

Question 67

Which AWS service is best suited for orchestrating multiple serverless tasks in a defined workflow with branching and error handling?

1. Amazon EventBridge
2. Amazon SQS
3. AWS Step Functions
4. Amazon SNS

Correct Answer: 3

Explanation

AWS Step Functions provides workflow orchestration for coordinating multiple AWS services and application tasks. It can define sequential steps, parallel processing, conditional branching, retries, and error handling using state machines. This makes it useful for complex serverless workflows where several Lambda functions or other AWS services must operate in a controlled sequence. EventBridge primarily routes events, SQS provides message queues, and SNS provides pub/sub messaging. Step Functions is therefore the appropriate service for managing multi-step workflows with built-in execution tracking and error-handling capabilities.

Question 68

Which AWS security control is stateful, meaning return traffic is automatically allowed when the original outbound traffic was permitted?

1. Network ACL
2. Security group
3. Route table
4. VPC Flow Logs

Correct Answer: 2

Explanation

Security groups are stateful virtual firewalls associated with resources such as EC2 instances. When an outbound connection is allowed by a security group, the corresponding return traffic is automatically permitted, regardless of inbound rules. Network ACLs are stateless and require explicit rules for both inbound and outbound traffic. Route tables determine where network traffic is directed, while VPC Flow Logs record network traffic metadata. Security groups are therefore the correct answer when stateful traffic filtering is required for resources within a VPC.

Question 69

Which AWS service allows applications to send notifications to multiple subscribers using a publish/subscribe model?

1. Amazon SQS
2. AWS Step Functions
3. Amazon SNS
4. Amazon MQ

Correct Answer: 3

Explanation

Amazon Simple Notification Service (SNS) is a managed publish/subscribe messaging service. A publisher sends a message to an SNS topic, and the service can distribute that message to multiple subscribers or endpoints. This supports application fanout patterns, where one event needs to reach multiple independent consumers. SQS is primarily a message queue, Step Functions manages workflows, and Amazon MQ provides managed traditional message brokers. SNS is therefore the appropriate service when an application needs to publish a notification once and distribute it to multiple subscribers.

Question 70

A company needs to encrypt data stored in Amazon S3 using customer-managed encryption keys. Which AWS service should provide the encryption keys?

1. AWS IAM
2. AWS KMS
3. Amazon CloudWatch
4. AWS Config

Correct Answer: 2

Explanation

AWS Key Management Service (KMS) provides centralized management of cryptographic keys that can be used to encrypt data across AWS services. When Amazon S3 uses KMS-based server-side encryption, organizations can control key permissions, auditing, rotation settings, and access policies. IAM manages identities and permissions but does not itself provide encryption keys. CloudWatch provides monitoring capabilities, while AWS Config evaluates resource configurations. AWS KMS is therefore the appropriate service when customer-managed encryption keys are required for S3 data.

Question 71

Which AWS service provides managed container orchestration using Kubernetes?

1. Amazon ECS
2. AWS Lambda
3. Amazon EKS
4. AWS Fargate

Correct Answer: 3

Explanation

Amazon Elastic Kubernetes Service (EKS) is a managed AWS service for running Kubernetes clusters. AWS manages much of the Kubernetes control plane infrastructure, while customers can deploy and manage containerized applications using standard Kubernetes capabilities. Amazon ECS is AWS’s own container orchestration service, Lambda provides serverless function execution, and Fargate provides serverless compute for containers but is not itself a container orchestration platform. EKS is therefore the correct choice when an organization specifically requires managed Kubernetes for containerized workloads.

Question 72

A company needs to automatically route application traffic to a backup endpoint when the primary endpoint becomes unhealthy. Which Route 53 routing policy should be used?

1. Weighted routing
2. Failover routing
3. Latency-based routing
4. Geolocation routing

Correct Answer: 2

Explanation

Route 53 failover routing is designed for active-passive architectures where traffic normally goes to a primary resource and switches to a secondary resource when the primary becomes unhealthy. Route 53 health checks can monitor the primary endpoint and help determine when failover should occur. Weighted routing distributes traffic according to assigned weights, latency-based routing selects endpoints based on network latency, and geolocation routing uses geographic information. Failover routing is therefore the appropriate choice for automatic DNS-based disaster recovery between primary and backup endpoints.

Question 73

Which EC2 purchasing option is generally appropriate for a workload that runs continuously for one or three years with predictable usage?

1. Spot Instances
2. On-Demand Instances
3. Reserved Instances
4. Dedicated Hosts

Correct Answer: 3

Explanation

Amazon EC2 Reserved Instances can provide significant pricing discounts for workloads with predictable, long-term usage compared with On-Demand pricing. They are commonly considered when an organization expects an instance usage pattern to remain consistent over a commitment period. Spot Instances are suitable for flexible workloads that can tolerate interruptions, while On-Demand Instances provide flexibility without a long-term commitment. Dedicated Hosts provide dedicated physical server capacity for specific licensing or compliance requirements. Reserved Instances are therefore a suitable cost-optimization option for predictable long-running workloads.

Question 74

Which AWS service provides a managed message broker compatible with protocols and technologies such as ActiveMQ and RabbitMQ?

1. Amazon MQ
2. Amazon SQS
3. Amazon SNS
4. Amazon EventBridge

Correct Answer: 1

Explanation

Amazon MQ is a managed message broker service that supports established messaging technologies such as Apache ActiveMQ and RabbitMQ. It is useful when organizations are migrating existing applications that depend on traditional messaging protocols and want to reduce the operational burden of managing broker infrastructure. SQS provides managed queues using AWS-native messaging capabilities, SNS provides publish/subscribe messaging, and EventBridge provides event routing. Amazon MQ is therefore particularly suitable for applications that require compatibility with traditional message broker technologies.

Question 75

Which AWS service can be used to detect suspicious activity and potentially compromised resources within an AWS account?

1. AWS Config
2. Amazon GuardDuty
3. Amazon Inspector
4. AWS CloudFormation

Correct Answer: 2

Explanation

Amazon GuardDuty is a managed threat detection service that continuously analyzes relevant AWS account, workload, and network activity to identify suspicious or potentially malicious behavior. It can generate findings related to threats such as unusual API activity, compromised credentials, and potentially malicious network behavior. AWS Config focuses on resource configuration compliance, Inspector evaluates workloads for vulnerabilities, and CloudFormation provisions infrastructure. GuardDuty is therefore the appropriate service when an organization needs continuous threat detection across its AWS environment.

Question 76

Which AWS service is designed to provide a managed, scalable NoSQL database with multi-Region active-active replication?

1. Amazon RDS
2. Amazon Redshift
3. Amazon DynamoDB Global Tables
4. Amazon ElastiCache

Correct Answer: 3

Explanation

Amazon DynamoDB Global Tables provide a multi-Region, multi-active database architecture for applications requiring low-latency access and high availability across geographic locations. Data can be replicated automatically between participating Regions, allowing applications to read and write locally while supporting resilient global architectures. RDS provides relational databases, Redshift is designed for analytical workloads, and ElastiCache provides in-memory caching. DynamoDB Global Tables are therefore appropriate when a globally distributed NoSQL application requires multi-Region replication and high availability.

Question 77

Which AWS service allows a company to centrally manage multiple AWS accounts and apply organization-wide policies?

1. AWS Organizations
2. AWS IAM Identity Center
3. Amazon Cognito
4. AWS Control Tower only

Correct Answer: 1

Explanation

AWS Organizations provides centralized management of multiple AWS accounts within an organization. It enables administrators to organize accounts into organizational units, apply Service Control Policies, and manage consolidated billing. This helps organizations establish consistent governance and security controls across accounts. IAM Identity Center focuses primarily on centralized workforce access, Cognito provides authentication for application users, and Control Tower helps establish a governed multi-account environment but relies on AWS Organizations as a core component. AWS Organizations is therefore the fundamental service for centralized multi-account management.

Question 78

A company wants to protect its web application from common attacks such as SQL injection and cross-site scripting. Which AWS service should be used?

1. AWS Shield
2. Amazon GuardDuty
3. AWS WAF
4. Amazon Inspector

Correct Answer: 3

Explanation

AWS WAF is a web application firewall that helps protect applications from common web exploits such as SQL injection and cross-site scripting. Administrators can create rules that allow, block, or count requests based on characteristics such as IP addresses, request patterns, headers, and known attack signatures. AWS Shield primarily provides DDoS protection, GuardDuty detects suspicious activity, and Inspector assesses workloads for vulnerabilities. AWS WAF is therefore the most appropriate service for filtering and controlling potentially malicious HTTP and HTTPS requests.

Question 79

Which disaster recovery strategy maintains a scaled-down but operational environment that can be expanded when a disaster occurs?

1. Backup and restore
2. Pilot light
3. Warm standby
4. Multi-site active-active

Correct Answer: 3

Explanation

A warm standby disaster recovery strategy maintains a smaller but functional version of the production environment. During a disaster, the organization can scale the standby environment to handle the required workload. This generally provides faster recovery than backup and restore because core infrastructure is already running. A pilot light maintains only essential components and usually requires more expansion before serving production traffic. Multi-site active-active maintains fully operational environments in multiple locations. Warm standby therefore provides a practical balance between recovery speed and disaster recovery cost.

Question 80

Which AWS architectural principle helps applications remain available when one component fails by avoiding a single critical point of failure?

1. Loose coupling
2. Vertical scaling
3. Single-AZ deployment
4. Elimination of redundancy

Correct Answer: 1

Explanation

Loose coupling reduces dependencies between application components so that a failure or slowdown in one component has less impact on others. Services such as Amazon SQS can help decouple producers and consumers, allowing components to operate independently and absorb temporary failures. Highly available architectures also use redundancy across Availability Zones and multiple components to avoid single points of failure. Vertical scaling and single-AZ deployment do not inherently provide fault isolation, while eliminating redundancy can reduce resilience. Loose coupling is therefore an important principle for building reliable and fault-tolerant applications.