SAA-C03 practice questions with answers

null Design secure access to AWS resources

A company uses a customer managed symmetric AWS KMS key to encrypt sensitive application records. An application uses an IAM role to call the KMS Decrypt API directly. The role's identity-based policy allows kms:Decrypt on the key, but requests fail with AccessDeniedException. The key policy grants a security administrator role permission to manage the key. It does not grant cryptographic permissions, enable IAM policies to authorize key access, or name the application role. No KMS grants or explicit denies apply. The company must allow the application to decrypt records without allowing it to administer the key or allowing the security administrator to decrypt records. Which change meets these requirements?

null Design scalable and loosely coupled architectures

An engineering company receives diagnostic bundles that contain 5–20 MiB of already-compressed data. An ingestion service must acknowledge each submission after durably accepting it, without waiting for analysis. A fleet of workers analyzes bundles independently and can be unavailable for up to 72 hours. Accepted bundles must remain available for at least 7 days, and unfinished analysis must be retried if a worker crashes. Workers already handle duplicate jobs safely, and processing order is not important. Which solution meets these requirements with the least operational overhead?

null Determine high-performing data ingestion and transformation solutions

A company has hundreds of tables in an Amazon S3 data lake cataloged in the AWS Glue Data Catalog. Analysts query the tables through Amazon Athena. The lake already enforces centrally managed permissions, and analysts cannot read the S3 objects directly. No existing grants give analysts access to the tables. An ingestion workflow assigns each new table a department and a sensitivity classification. Finance analysts must automatically receive query access to tables classified as both department=finance and sensitivity=internal, including tables created in the future. They must not receive access to other tables. Administrators want to avoid maintaining individual table grants. Which solution meets these requirements with the LEAST ongoing administrative effort?

null Design cost-optimized compute solutions

A company is designing the compute tier for an internal reporting application on Amazon EC2. The business requires 99.9% time-based availability during each 30-day month, measured continuously from the user's perspective. Planned maintenance counts as downtime. There is no separate requirement for uninterrupted service during an Availability Zone failure. The application stores its state outside the instances. Failure testing and operational modeling produce the monthly downtime estimates in the proposed designs below, including maintenance and recovery. The company has approved these estimates for architecture planning. All designs use the same instance type and maintain their stated instance count continuously. Costs outside EC2 compute are identical. Which design meets the availability objective at the LOWEST EC2 compute cost?