The AWS Certified Solutions Architect – Associate (SAA-C03) exam tests secure architectures (30%), resilient architectures (26%), high-performing architectures (24%), and cost-optimized architectures (20%). These domains ask you to match access, recovery, performance, and spending decisions to business requirements. These SAA-C03 mixed review questions bring all four domains together.
This is the tenth and final set in our AWS Certified Solutions Architect – Associate SAA-C03 series (Questions 91-100). It follows SAA-C03 Questions 81-90 on storage security and cost controls. Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.
Identify the exact control or bottleneck before comparing options. In the recovery exercise, calculate downtime and the data-loss window separately rather than treating them as one measurement.
Question 91: Restricting a Service Publisher
An S3 bucket sends object-created notifications to an unencrypted SNS topic in the same Region. The topic policy already allows s3.amazonaws.com to perform SNS:Publish on that topic, but its statement has no conditions. The architect must restrict this permission to the designated bucket owned by the designated account. Which condition pair should be added?
A) Set aws:SourceArn to the topic ARN and aws:SourceAccount to the bucket owner’s account ID.
B) Set aws:SourceArn to the bucket ARN and aws:SourceAccount to the topic’s full ARN.
C) Set aws:SourceArn to the bucket ARN and aws:SourceAccount to the bucket owner’s account ID.
D) Set aws:SourceArn to an object ARN and aws:SourceAccount to the bucket owner’s account ID.
👁 Reveal Answer
Correct Answer: C
Explanation: The SNS destination policy can limit the S3 service principal with the source bucket ARN and the account that owns that bucket. Use an ARN equality condition for the bucket and string equality for the account ID. A identifies the destination instead of the source. B supplies an ARN where an account ID is required. D identifies an individual object rather than the bucket used as the notification source.
Reference: Granting permissions to publish event notification messages to a destination
Question 92: Permissions That Follow Project Membership
Employees federate into AWS through a corporate identity provider. They need access only to resources tagged for their project, including newly created resources. The relevant services and actions support tag-based authorization. Administrators control project attributes and resource tags. Which design avoids updating resource ARN lists whenever a project adds resources?
A) Pass trusted project attributes as session tags and match principal tags to resource tags in policies.
B) Pass trusted project attributes as session tags and allow the actions without resource-tag conditions.
C) Assign project roles whose policies list individual resource ARNs and revise those lists after each creation.
D) Tag each project resource consistently and leave the federated role without any applicable permission policy.
👁 Reveal Answer
Correct Answer: A
Explanation: Attribute-based access control can compare a principal’s project tag with the resource’s project tag. Federated identity providers can pass employee attributes as session tags, letting one policy cover newly tagged resources. B collects attributes but does not enforce the project boundary. C can enforce access but requires the repeated policy maintenance the scenario excludes. D is insufficient because resource tags alone do not grant permissions; an applicable authorization policy must use them.
Reference: Define permissions based on attributes with ABAC authorization
Question 93: Removing Superseded Data Versions
A versioning-enabled S3 bucket stores frequently revised internal documents. Policy permits permanent deletion of superseded versions after they have been noncurrent for 30 days, but current versions must remain. There are no retention locks, legal holds, or replication constraints. Which lifecycle action makes the old versions eligible for deletion without expiring current documents?
A) Configure current-version expiration with Days set to 30.
B) Configure noncurrent-version transition with NoncurrentDays set to 30.
C) Configure expired-delete-marker removal with ExpiredObjectDeleteMarker set to true.
D) Configure noncurrent-version expiration with NoncurrentDays set to 30.
👁 Reveal Answer
Correct Answer: D
Explanation: Noncurrent-version expiration permanently removes eligible older versions based on how long they have been noncurrent. It does not expire the current document, and lifecycle processing is not an exact-time deletion guarantee. A applies to current versions and can add delete markers instead of removing older versions. B changes storage class rather than deleting data. C removes eligible delete markers, not superseded document versions that still contain data.
Reference: Lifecycle configuration elements
Question 94: Limiting Pressure on a Shared Dependency
A Lambda function calls a legacy service that can safely handle at most 20 simultaneous requests from this function. Each invocation makes at most one request at a time. Cold starts are acceptable, and the account has enough available concurrency for a reservation. Which function setting imposes a hard ceiling of 20 concurrent invocations without changing code?
A) Configure provisioned concurrency of 20 without a reserved-concurrency limit.
B) Configure reserved concurrency of 20 on the function.
C) Configure a function timeout of 20 seconds per invocation.
D) Configure additional function memory while leaving concurrency unreserved.
👁 Reveal Answer
Correct Answer: B
Explanation: Reserved concurrency limits how many invocations can run simultaneously and sets aside that concurrency for the function. A limit of 20 directly addresses the dependency’s stated capacity. Option A preinitializes environments to reduce cold starts but does not by itself impose this ceiling. C limits an invocation’s duration, not the number running together. D changes execution resources rather than establishing a concurrency limit. Callers must still handle throttling when demand exceeds the ceiling.
Reference: Configuring reserved concurrency
Question 95: Evaluating a Recovery Exercise
An application has a recovery time objective of 45 minutes and a recovery point objective of five minutes. During an exercise, service stops at 14:00 and resumes at 14:35. The restored data includes all transactions through 13:52, but none after that time. Which conclusion correctly evaluates this exercise against both objectives?
A) The recovery time objective is met; the recovery point objective is missed.
B) The recovery time objective is missed; the recovery point objective is met.
C) Both objectives are met because service resumes within the allowed downtime.
D) Both objectives are missed because the recovery takes longer than five minutes.
👁 Reveal Answer
Correct Answer: A
Explanation: Service is unavailable for 35 minutes, which is within the 45-minute RTO. The recovery point is eight minutes before the interruption, exceeding the five-minute RPO. B reverses the two results. C ignores the unacceptable data-loss window. D incorrectly treats the five-minute RPO as a downtime limit. These objectives measure different intervals: RTO concerns service restoration after interruption, while RPO concerns how much recent data may be lost.
Reference: Disaster Recovery objectives
Question 96: Work Becomes Visible Too Soon
EC2 workers receive messages from an SQS standard queue with a 60-second visibility timeout. Valid jobs take between two and eight minutes, and workers delete messages only after successful processing. Logs show messages becoming available again while their original workers are still healthy. The team wants to avoid premature redelivery while allowing recovery if a worker crashes. Which change best fits?
A) Delete each message immediately after receipt, before the worker starts processing it.
B) Increase the queue’s delivery delay while leaving the received message’s visibility unchanged.
C) Extend visibility periodically during processing, then delete the message after successful completion.
D) Increase the message retention period while leaving the received message’s visibility unchanged.
👁 Reveal Answer
Correct Answer: C
Explanation: A heartbeat can use ChangeMessageVisibility before the current timeout expires to keep a valid job hidden while it runs. If the worker crashes and stops extending visibility, the message can become available for another attempt. A risks losing unfinished work after a crash. B changes initial delivery timing rather than the processing window. D changes how long messages are retained, not when in-flight messages reappear. Standard-queue consumers must still tolerate duplicate delivery.
Reference: Amazon SQS visibility timeout
Question 97: Packet Loss Below the Bandwidth Ceiling
An EC2 service exchanges many small, unfragmented packets and experiences packet loss during bursts. CPU utilization is low, and byte throughput remains below the instance’s bandwidth allowance. During the bursts, the ENA counter pps_allowance_exceeded increases; bandwidth, connection-tracking, and link-local allowance-exceeded counters remain unchanged. Which bottleneck should drive the architect’s scaling decision?
A) The instance’s aggregate inbound byte-bandwidth allowance is being exceeded.
B) The instance’s aggregate bidirectional packet-per-second allowance is being exceeded.
C) The instance’s maximum tracked-connection allowance is being exceeded.
D) The interface’s link-local service packet allowance is being exceeded.
👁 Reveal Answer
Correct Answer: B
Explanation: The increasing PPS counter identifies packets queued or dropped because the instance exceeds its bidirectional packets-per-second allowance. Small packets can exhaust that allowance without exhausting byte bandwidth. A would correspond to the inbound bandwidth counter. C would correspond to the connection-tracking counter. D would correspond to the link-local counter for services such as the Amazon DNS service. Size or distribute the workload for packet-processing demand instead of relying only on CPU and byte-throughput graphs.
Reference: Monitor network performance for ENA settings on your EC2 instance
Question 98: Independent Readers Compete for Throughput
Several applications independently read every record from a provisioned Kinesis data stream using shared-throughput consumers. Their combined reads hit the per-shard shared read limit, although each application alone can keep up. Processing resources and write capacity are sufficient. The team wants dedicated read throughput per application without increasing the shard count. Which change meets the requirement?
A) Increase each application’s polling frequency while keeping all consumers on shared throughput.
B) Increase stream retention while keeping each application’s existing shared-throughput consumer.
C) Add more workers to each application while retaining the same shared-throughput reads.
D) Register each application as an enhanced fan-out consumer and use dedicated subscriptions.
👁 Reveal Answer
Correct Answer: D
Explanation: Enhanced fan-out gives each registered consumer dedicated read throughput per shard, so applications do not compete for the shared read allocation. Kinesis pushes records through subscriptions instead of requiring shared-throughput polling. A increases polling without removing the shared limit. B preserves records longer but does not increase read throughput. C adds processing workers to a workload whose stated bottleneck is shared reads, not processing capacity. Evaluate the additional enhanced fan-out charges when making this tradeoff.
Reference: Develop enhanced fan-out consumers with dedicated throughput
Question 99: Choosing the Scope of a Commitment
A company has decided to purchase EC2 Reserved Instances for a steady workload with a fixed instance type and size. In addition to the discount, it requires a capacity reservation in one specified Availability Zone. The workload does not need zone or size flexibility. Which scope and behavior should the architect select?
A) Regional scope, which reserves capacity in every Availability Zone of the Region.
B) Regional scope, which reserves capacity only in the workload’s currently used Availability Zone.
C) Zonal scope, which reserves capacity and limits the discount to the specified Availability Zone.
D) Zonal scope, which reserves capacity and applies the discount across all Availability Zones.
👁 Reveal Answer
Correct Answer: C
Explanation: Zonal Reserved Instances reserve capacity in the selected Availability Zone and apply the discount to matching usage in that zone. This meets the requirement because zone and size flexibility are unnecessary. A and B incorrectly assign capacity-reservation behavior to regional Reserved Instances, which do not reserve capacity. D correctly identifies the reservation but incorrectly extends its discount across zones. The scope decision separates capacity assurance from the broader discount flexibility of a regional reservation.
Reference: Regional and zonal Reserved Instances
Question 100: Paying for Abandoned Uploads
A media service uploads large files to S3 using multipart uploads. Failed clients sometimes leave uploaded parts behind. Successful uploads always finish within one day, and the business permits discarding any upload still incomplete after seven days. Completed objects must remain unchanged. Which approach removes this unnecessary storage with the least ongoing administration?
A) Add a lifecycle action to abort incomplete multipart uploads seven days after initiation.
B) Add a lifecycle action to expire current objects seven days after object creation.
C) Add a lifecycle action to expire noncurrent versions seven days after becoming noncurrent.
D) Run a daily custom cleanup program that lists and aborts uploads older than seven days.
👁 Reveal Answer
Correct Answer: A
Explanation: The AbortIncompleteMultipartUpload lifecycle action automatically stops eligible unfinished uploads after the configured interval and deletes their uploaded parts. It does not delete completed objects. B targets completed current objects rather than the unfinished uploads and violates the preservation requirement. C targets older object versions, not incomplete upload parts. D can implement the cleanup but requires maintaining custom code and scheduling instead of using the built-in lifecycle action.
Reference: Configuring a bucket lifecycle configuration to delete incomplete multipart uploads
Study Tips for Mixed Architecture Review
- Match the authorization context. Source conditions constrain service publishers, while trusted principal and resource tags can define project access.
- Separate recovery measurements. RTO limits downtime; RPO limits the time window of acceptable data loss.
- Find the specific bottleneck. Concurrency, packets per second, and shared stream reads require different controls.
- Identify what is being retained. Current objects, noncurrent versions, and incomplete upload parts need different lifecycle actions.
Keep Practicing for AWS Solutions Architect Associate
Revisit SAA-C03 Questions 81-90 for storage controls, then use these SAA-C03 mixed review questions to identify topics that need another pass. This completes the planned 100-question series. Return to SAA-C03 Questions 1-10 to review compute and Auto Scaling.