Free AWS SAA-C03 Actual Exam Questions – Solutions Architect Questions

Maybe B makes the most sense since the ALB has to be internet-facing, but the EC2 and RDS should stay private to minimize exposure. A and C expose too many resources publicly, and D sounds unrealistic.

B imo. The ALB needs to be public-facing for internet traffic, while EC2 and RDS stay private to limit exposure. D sounds off since ALBs run inside VPCs, so placing it outside seems unlikely.

A, since interface endpoints keep traffic private without extra public IPs or big costs.

Actually, option B can be ruled out because NAT gateways assign public IPs to the traffic, which violates the no public IP requirement. So, A is better since it keeps traffic private and avoids extra costs.

A is out since you can’t really disable root, right?

Makes sense to avoid using root entirely for daily work—that’s why creating IAM users is key. So B fits best since it adds MFA to root without suggesting disabling it, which isn’t an option. B

C imo, because partial upfront still offers a decent discount compared to no upfront, which might balance cost savings without full commitment. It keeps flexibility and reduces overall spend better than just no upfront.

B vs C, partial upfront is less flexible and they want no long commitments.

C imo since scheduled scaling keeps costs predictable without cross-AZ data charges.

It’s C because keeping instances in the same AZ can reduce data transfer costs and complexity, plus scheduled scaling helps control expenses without over-provisioning across multiple AZs.

B imo, it’s the only option that does health checks and can return multiple healthy endpoints. A doesn’t exclude unhealthy Regions, and C/D don’t support cross-Region load balancing.

Maybe B makes the most sense since it can do health checks and return multiple IPs, helping distribute traffic across healthy Regions. C and D don't really work across Regions anyway.

D feels best since it keeps latency low and offloads read traffic without cross-region costs.

I agree with going local on this one. Option D makes the most sense because a same-region read replica handles read traffic without the cross-region latency or extra costs from A. Multi-AZ (B) won’t help since it’s for failover, not performance. AWS DMS (C) sounds complicated and expensive just to offload reads. So yeah, sticking with D seems like the simplest, cheapest fix to improve read performance during busy hours.

D imo, setting up a new domain controller and trust sounds like overkill just for DNS resolution. That adds complexity and ongoing admin work. A also feels heavy since you’re managing EC2 instances as DNS servers yourself. Between B and C, B looks simpler since it just uses Route 53 private hosted zones with NS records pointing to on-prem DNS—no extra endpoints or rules to manage. C might be nice but could require more setup and maintenance with resolver endpoints and conditional forwarders. So overall, B probably has the least overhead while still meeting the requirement.

Maybe B, since it avoids managing extra servers or complex trusts and just forwards DNS.

It’s A because only that option combines Auto Scaling with an ALB, which supports routing by URL path and can handle unexpected traffic spikes smoothly. The others either lack proper scaling or routing flexibility.

B tbh also works well since it uses ECS with managed scaling, which is great for unpredictable traffic, plus containers can spin up faster than full EC2 instances. The Network Load Balancer is a bit lower-level than ALB but still effective for distributing traffic. C and D don’t offer true auto scaling—just adding instances or alarms won’t handle sudden spikes as smoothly. A and B both scale automatically, but B’s container approach might provide quicker response times during bursts.

Maybe B makes sense here because it uses DynamoDB Streams with Kinesis and KCL, which can handle multi-region replication in a pretty controlled way. It’s a bit more custom than C or D but can give you precise control over the data flow.

Also, compared to D, using Lambda might add some scaling or latency concerns if the load spikes, while Kinesis is built for streaming at scale, which could be better for an ecommerce app with lots of writes and reads across regions.

D imo, even though C is the usual go-to for global tables, the question doesn’t say the existing table is already a global table. Setting up a Lambda with DynamoDB Streams (option D) can be a straightforward way to replicate data between Regions while keeping writes low latency and active in both places. It adds some operational overhead, but it’s flexible and doesn’t require converting the existing table upfront. Options B and A seem more complex or less efficient, so D might actually fit better if global tables aren’t already in place.

Option A is solid since Global Accelerator routes traffic via the best network paths globally, minimizing latency. CloudFront (B) also helps by caching static assets nearby, which speeds up content delivery for users everywhere.

A/B? Global Accelerator (A) optimizes routing at the network level, while CloudFront (B) reduces latency by caching. The other options rely too much on user choice or don’t directly address global latency.

Actually, D and E don’t make sense—root user access keys are risky and you can’t set IAM roles for the root user. So that leaves A and B as the only viable options to secure the root user properly.

Maybe A and B since changing password plus MFA on root is key.

Option B could work too since Step Functions help manage workflows and can throttle requests by controlling the execution flow, which might reduce Lambda overload without relying solely on concurrency limits.

D, because reserved concurrency directly controls max Lambda instances, avoiding throttling.

Makes sense to go with D and E here. D is key because it directly links the Kubernetes service accounts to specific IAM roles, giving that granular control. E is essential since without establishing the trust via the OIDC identity provider, those IAM roles won’t be assumable by the service accounts. Options A and C are too broad or don’t leverage the IRSA mechanism properly, and B is unrelated to IAM permissions. So, D plus E cover both the role definition and the trust setup needed for secure, fine-grained AWS access from the pods.

It’s D and E for me too. D ties the IAM role to the Kubernetes service account directly, and E sets up the trust with OIDC so the role can actually be assumed. Without E, IRSA just won’t function.

I agree with the focus on cost efficiency and network access. Option C stands out because the Compute Savings Plan covers both Lambda and EC2, which makes it cheaper as Lambda usage grows over the year. Plus, connecting Lambda functions to the private subnets ensures direct access to EC2 instances without exposing them publicly. Options A and B only cover EC2 discounts or mess with subnet types, which won’t meet the network requirements or cost goals as well. D doesn’t address direct network access since keeping Lambda in the service VPC won’t reach private EC2 instances properly. So, C seems

B tbh doesn’t work because public subnets won’t allow direct private IP access to EC2 in private subnets. The Lambda functions must be in private subnets or connected via VPC for that communication.