25 Most Important Practice Questions
Important: these are original practice questions, not leaked or copied real exam questions. Use them to practice the same decision patterns tested in SAA-C03.
1. A web app must run across two Availability Zones and replace unhealthy instances automatically. Which design fits best?
Answer: Application Load Balancer + Auto Scaling group across two AZs.
Why: ALB distributes traffic and health checks targets; Auto Scaling replaces unhealthy instances and maintains desired capacity.
2. A private EC2 instance needs to download operating system updates from the internet. It must not accept inbound internet traffic. What should you use?
Answer: NAT Gateway in a public subnet with routes from private subnets.
Why: NAT Gateway supports outbound internet access for private resources while blocking inbound sessions initiated from the internet.
3. An application needs shared Linux file storage mounted by multiple EC2 instances at the same time. Which service should you choose?
Answer: Amazon EFS.
Why: EFS is managed shared file storage for Linux workloads. EBS attaches to one instance at a time in most normal use cases; S3 is object storage.
4. A company stores old audit logs that are rarely accessed but must be retained for years at low cost. Which option is best?
Answer: S3 lifecycle transition to an S3 Glacier storage class.
Why: Glacier classes are designed for low-cost archival storage with different retrieval-time tradeoffs.
5. A database needs automatic failover inside one Region. Read scaling is not the main goal. What should you enable?
Answer: RDS Multi-AZ.
Why: Multi-AZ improves availability and failover. Read replicas are mainly for read scaling.
6. A workload has millions of predictable key-value lookups per second and does not require SQL joins. Which database is usually best?
Answer: DynamoDB.
Why: DynamoDB is serverless NoSQL built for high-scale key-value and document access patterns.
7. Users worldwide download static images and JavaScript files. Latency must be reduced. What should be added?
Answer: CloudFront.
Why: CloudFront caches content at edge locations close to users and reduces origin load.
8. A team needs HTTP path-based routing such as /api and /images. Which load balancer should be used?
Answer: Application Load Balancer.
Why: ALB supports Layer 7 HTTP/HTTPS routing by path, host, headers, and more.
9. A TCP application needs very high performance and static IP support. Which load balancer fits best?
Answer: Network Load Balancer.
Why: NLB works at Layer 4 and is designed for high-performance TCP, UDP, and TLS workloads.
10. An EC2 application must access S3 securely without storing access keys on the instance. What is the best approach?
Answer: Attach an IAM role to the EC2 instance.
Why: IAM roles provide temporary credentials and avoid long-term keys in code or on servers.
11. A company wants to know who changed a security group rule last night. Which service should they check?
Answer: CloudTrail.
Why: CloudTrail records AWS API activity, including security group changes.
12. An operations team wants CPU alarms, application logs, and dashboards. Which service is the primary choice?
Answer: CloudWatch.
Why: CloudWatch handles metrics, logs, alarms, dashboards, and operational events.
13. A public web app needs protection from SQL injection and request rate abuse. Which service helps most directly?
Answer: AWS WAF.
Why: WAF filters Layer 7 web requests with managed rules, custom rules, and rate-based rules.
14. A system must decouple order intake from order processing because traffic arrives in spikes. Which service should buffer work?
Answer: Amazon SQS.
Why: SQS stores messages durably so workers can process them at their own pace.
15. One event must notify email, inventory, and analytics systems at the same time. Which service pattern is best?
Answer: SNS fanout, often to SQS queues or Lambda functions.
Why: SNS publishes one message to multiple subscribers.
16. A workflow has multiple steps, retries, approvals, and branching logic. Which service should coordinate it?
Answer: Step Functions.
Why: Step Functions orchestrates workflows with state, retries, branching, and service integrations.
17. A company needs private connectivity from a VPC to S3 without using the public internet path. What should be used?
Answer: VPC endpoint for S3.
Why: VPC endpoints provide private connectivity to supported AWS services.
18. A business wants the lowest-cost disaster recovery option and can tolerate hours of recovery time. Which DR strategy fits?
Answer: Backup and restore.
Why: It has the lowest standby cost but usually the highest RTO.
19. A workload needs a small but running copy in another Region for faster recovery than backup-only. Which DR strategy fits?
Answer: Warm standby.
Why: A scaled-down full environment runs continuously and can scale up during disaster.
20. A company needs centralized billing and policy guardrails across many AWS accounts. Which service should be used?
Answer: AWS Organizations.
Why: Organizations supports consolidated billing, organizational units, and service control policies.
21. A database password must be stored securely and rotated automatically. Which service is best?
Answer: AWS Secrets Manager.
Why: Secrets Manager stores, encrypts, retrieves, and rotates secrets.
22. A serverless API needs an HTTPS front door, throttling, and Lambda integration. Which service should receive client requests?
Answer: API Gateway.
Why: API Gateway provides managed API endpoints, throttling, authorization options, stages, and Lambda integration.
23. A company wants SQL queries directly over CSV and Parquet files stored in S3 without managing servers. Which service should be used?
Answer: Athena.
Why: Athena is serverless SQL query service for data stored in S3.
24. A read-heavy application repeatedly queries the same data from a relational database. Latency must be reduced. Which option can help?
Answer: ElastiCache or RDS read replicas, depending on the access pattern.
Why: ElastiCache reduces repeated read latency with in-memory caching; read replicas offload relational read queries.
25. A question asks for "least operational overhead" for running containers without managing servers. Which option usually fits?
Answer: ECS with Fargate.
Why: Fargate runs containers without managing EC2 worker nodes. EKS may be right when Kubernetes is required, but it adds platform complexity.
