Sample AWS Solutions Architect SAA-C03 Practice Questions
Q: Which AWS service allows you to create and manage encryption keys used to encrypt your data?
A: AWS KMS — AWS Key Management Service (KMS) is the primary service for creating and managing encryption keys. CloudHSM provides dedicated hardware security modules but KMS is the standard managed key service for most use cases.
Q: Which AWS feature ensures that an RDS database automatically fails over to a standby replica in a different Availability Zone?
A: Multi-AZ deployment — RDS Multi-AZ deployment maintains a synchronous standby replica in a different AZ. If the primary instance fails, RDS automatically fails over to the standby, typically within 60-120 seconds, with no manual intervention required.
Q: Which EC2 instance family is optimized for compute-intensive tasks such as batch processing, scientific modeling, and high-performance computing?
A: C-family (compute optimized) — C-family instances (C5, C6g, C7g) are compute-optimized with a high ratio of vCPUs to memory. They are ideal for batch processing, scientific modeling, gaming servers, and HPC workloads that require sustained high CPU performance.
Q: Which EC2 pricing model offers the LOWEST cost for workloads that can tolerate interruptions?
A: Spot Instances — Spot Instances offer up to 90% discount compared to On-Demand pricing. They are ideal for fault-tolerant workloads like batch processing, data analysis, and CI/CD. However, AWS can reclaim them with a two-minute notification when capacity is needed.
Q: What is the default behavior of an IAM policy if no explicit allow or deny is present for an action?
A: The action is implicitly denied — IAM follows a default deny model. Unless there is an explicit Allow statement in a policy, the action is implicitly denied. An explicit Deny always overrides any Allow.
Q: Which IAM entity should be used to grant permissions to an EC2 instance to access other AWS services?
A: IAM role — IAM roles are the recommended way to grant permissions to AWS services like EC2. Instance profiles attach roles to EC2 instances, providing temporary credentials that are automatically rotated, unlike static access keys.
Q: A company wants to enforce multi-factor authentication for all IAM users. Which policy condition key should they use?
A: aws:MultiFactorAuthPresent — The aws:MultiFactorAuthPresent condition key checks whether the IAM user has authenticated with MFA. This can be used in IAM policies to deny access unless MFA is present.
Q: What is the maximum number of IAM users that can be created per AWS account by default?
A: 5,000 — The default limit is 5,000 IAM users per AWS account. This is a hard limit that can be increased by contacting AWS Support. For larger organizations, consider using IAM Identity Center (formerly AWS SSO).
Q: Which type of IAM policy is attached directly to a single user, group, or role?
A: Inline policy — Inline policies are embedded directly in a single user, group, or role. AWS managed and customer managed policies are standalone policies that can be attached to multiple identities. SCPs belong to AWS Organizations.
Q: Which VPC component acts as a stateless firewall at the subnet level?
A: Network ACL — Network ACLs (NACLs) are stateless firewalls that operate at the subnet level. They evaluate both inbound and outbound rules independently. Security groups are stateful and operate at the instance level.