Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Amazon
  5. SAA-C03

Amazon SAA-C03 Exam Questions
AWS Certified Solutions Architect - Associate SAA-C03 (Page 26 )

Updated On: 18-Mar-2026
Page 26 of 205
PDF with 824 Questions

A company is running an online transaction processing (OLTP) workload on AWS. This workload uses an unencrypted Amazon RDS DB instance in a Multi-AZ deployment. Daily database snapshots are taken from this instance.
What should a solutions architect do to ensure the database and snapshots are always encrypted moving forward?

  1. Encrypt a copy of the latest DB snapshot. Replace existing DB instance by restoring the encrypted snapshot.
  2. Create a new encrypted Amazon Elastic Block Store (Amazon EBS) volume and copy the snapshots to it. Enable encryption on the DB instance.
  3. Copy the snapshots and enable encryption using AWS Key Management Service (AWS KMS) Restore encrypted snapshot to an existing DB instance.
  4. Copy the snapshots to an Amazon S3 bucket that is encrypted using server-side encryption with AWS Key Management Service (AWS KMS) managed keys (SSE-KMS).

Answer(s): A

Explanation:

Encrypting the latest DB snapshot ensures all future restores originate from an encrypted source, meeting the requirement to have encrypted backups and DB instances moving forward in an OLTP Multi-AZ setup.
A) Correct: Encrypting a copy of the latest DB snapshot and replacing the instance ensures encryption applies to both the snapshot history and the restored instance, satisfying encryption for backups and data at rest.
B) Incorrect: EBS encryption on a new volume does not encrypt existing snapshots or automatically encrypt the RDS automated backups or DB instance storage.
C) Incorrect: You cannot encrypt an existing unencrypted snapshot by copying and enabling encryption to restore into an existing DB instance; encryption must be applied at restore time, not retroactively here.
D) Incorrect: Storing snapshots in S3 with SSE-KMS is not how RDS backups are managed; RDS backups remain within RDS and snapshots are not copied to S3 for encryption.



A company wants to build a scalable key management infrastructure to support developers who need to encrypt data in their applications.
What should a solutions architect do to reduce the operational burden?

  1. Use multi-factor authentication (MFA) to protect the encryption keys.
  2. Use AWS Key Management Service (AWS KMS) to protect the encryption keys.
  3. Use AWS Certificate Manager (ACM) to create, store, and assign the encryption keys.
  4. Use an IAM policy to limit the scope of users who have access permissions to protect the encryption keys.

Answer(s): B

Explanation:

AWS KMS provides a managed, scalable key management service that handles key storage, rotation, policy enforcement, and access control, reducing operational burden for developers. A) MFA protects access but does not reduce management tasks for keys. C) ACM manages certificates, not general data encryption keys for application data. D) IAM policies control permissions but do not reduce key management operations or provide key lifecycle automation. Therefore, B is the correct choice.



A company has a dynamic web application hosted on two Amazon EC2 instances. The company has its own SSL certificate, which is on each instance to perform SSL termination.
There has been an increase in traffic recently, and the operations team determined that SSL encryption and decryption is causing the compute capacity of the web servers to reach their maximum limit.
What should a solutions architect do to increase the application's performance?

  1. Create a new SSL certificate using AWS Certificate Manager (ACM). Install the ACM certificate on each instance.
  2. Create an Amazon S3 bucket Migrate the SSL certificate to the S3 bucket. Configure the EC2 instances to reference the bucket for SSL termination.
  3. Create another EC2 instance as a proxy server. Migrate the SSL certificate to the new instance and configure it to direct connections to the existing EC2 instances.
  4. Import the SSL certificate into AWS Certificate Manager (ACM). Create an Application Load Balancer with an HTTPS listener that uses the SSL certificate from ACM.

Answer(s): D

Explanation:

The correct approach offloads SSL termination to a managed service and distributes load via a load balancer, freeing EC2 instances to serve requests. D uses ACM to manage the certificate and an Application Load Balancer with HTTPS listener, performing TLS termination at the ALB and routing to the EC2 fleet, improving scalability and performance.
A is wrong because ACM certificates cannot be installed directly on EC2 to terminate TLS; ACM is for AWS-managed termination at ELB/CloudFront, not manual installation on instances.
B is wrong because S3 is not a web TLS termination target and cannot serve HTTPS for dynamic web traffic; SSL termination would not occur there.
C is wrong because adding a proxy adds another hop and single point of scaling challenges; it does not offload TLS at the edge and is less scalable than an ALB with ACM.



A company has a highly dynamic batch processing job that uses many Amazon EC2 instances to complete it. The job is stateless in nature, can be started and stopped at any given time with no negative impact, and typically takes upwards of 60 minutes total to complete. The company has asked a solutions architect to design a scalable and cost-effective solution that meets the requirements of the job.
What should the solutions architect recommend?

  1. Implement EC2 Spot Instances.
  2. Purchase EC2 Reserved Instances.
  3. Implement EC2 On-Demand Instances.
  4. Implement the processing on AWS Lambda.

Answer(s): A

Explanation:

Spot Instances provide cost savings for a highly dynamic, fault-tolerant batch job that can be started and stopped at any time, with no state. They enable large-scale parallel processing at significantly lower price, suitable for stateless long-running tasks. Reserved Instances are fixed and require commitment, not ideal for dynamic workloads. On-Demand Instances are more expensive for long-running batch without need for flexibility. Lambda is unsuitable for long (60+ minutes) and potentially high-compute workloads due to execution limits and scaling model. Therefore A is correct; B, C, D are not cost- or fit-appropriate.



A company runs its two-tier ecommerce website on AWS. The web tier consists of a load balancer that sends traffic to Amazon EC2 instances. The database tier uses an Amazon RDS DB instance. The EC2 instances and the RDS DB instance should not be exposed to the public internet. The EC2 instances require internet access to complete payment processing of orders through a third-party web service. The application must be highly available.
Which combination of configuration options will meet these requirements? (Choose two.)

  1. Use an Auto Scaling group to launch the EC2 instances in private subnets. Deploy an RDS Multi-AZ DB instance in private subnets.
  2. Configure a VPC with two private subnets and two NAT gateways across two Availability Zones. Deploy an Application Load Balancer in the private subnets.
  3. Use an Auto Scaling group to launch the EC2 instances in public subnets across two Availability Zones. Deploy an RDS Multi-AZ DB instance in private subnets.
  4. Configure a VPC with one public subnet, one private subnet, and two NAT gateways across two Availability Zones. Deploy an Application Load Balancer in the public subnet. Configure a VPC with two public subnets, two private subnets, and two NAT gateways across two Availability Zones. Deploy an Application Load Balancer in the public subnets.

Answer(s): A,D

Explanation:

The correct options ensure HA while keeping DB/EC2 private from the internet and enabling outbound internet access for EC2.
A) EC2 in private subnets with ASG and RDS Multi-AZ in private subnets provides private->private architecture for web tier and resilient database, meeting HA and isolation requirements.
D) VPC with two public subnets, two private subnets, and two NAT gateways across AZs, with an Application Load Balancer in the public subnets, gives internet-facing load balancing for the web tier while backend resources remain private; NAT gateways allow EC2 instances in private subnets to access the internet for payment processing.
B) ALB in private subnets prevents external access to the web tier; but the requirement is a publicly accessible web tier, and two NAT gateways alone do not ensure public ALB placement.
C) EC2 in public subnets exposes instances to the internet; RDS private is fine, but public EC2 undermines the security requirement.



Viewing page 26 of 205
Viewing questions 126 - 130 out of 824 questions



Post your Comments and Discuss Amazon SAA-C03 exam dumps with other Community members:

SAA-C03 Exam Discussions & Posts

AI Tutor 👋 I’m here to help!