Free SAA-C03 practice exam questions

What the 20 questions cover

Every question here passed the same checks as the full bank: the quoted sentence was found on the live official page, and an independent blind reviewer matched the answer. How we check questions.

The questions

Answers are hidden. Open “Show answer and source” under a question after you have picked yours.

1. Question 1 of 20 · D1: Design Secure Architectures · saa-d1-001

   A three-person startup created its AWS account a year ago. An audit finds that the root user still has an active access key, which a nightly backup script uses, and that the root user has no MFA device. The founders want to close the gap this week without breaking the backup job. What should a solutions architect recommend?

   • A. Option A: Attach an SCP that denies all actions to the root user, then let the script keep using the root access key until it is rewritten
   • B. Option B: Create an IAM user with AdministratorAccess for the script, store its key in Parameter Store, and leave the root user as it is
   • C. Option C: Move the script to a least-privilege IAM role, delete the root access key, and add MFA to the root user
   • D. Option D: Keep the root key for the script, rotate it every 30 days, and add MFA to the root user
   Show answer and source

   Answer: C. AWS's root user guidance says not to create root access keys at all, because the root user has full access to everything, and to protect root sign-in with MFA. Workloads should use temporary credentials from a role.

   • A (incorrect): An SCP only affects member accounts of an organization, and if it did apply it would break the script immediately rather than fix it.
   • B (incorrect): This trades one over-privileged long-term key for another and does nothing about the root user missing MFA.
   • C (correct): Correct. The job keeps running on temporary role credentials, the long-lived root key disappears, and MFA protects the root sign-in that remains for the few tasks that need it.
   • D (incorrect): Rotation shortens exposure but leaves a key that can do anything in the account. Root keys should not exist for routine automation at all.

   Official sourcedocs.aws.amazon.com

   We strongly recommend that you do not create access keys for your root user because the root user has full access to all AWS services

   docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html (official page)

2. Question 2 of 20 · D1: Design Secure Architectures · saa-d1-002

   An order-processing application runs on Amazon EC2 instances in an Auto Scaling group and writes to an Amazon DynamoDB table. The developers currently bake an IAM user's access key into the AMI and rotate it by hand each quarter. Security now forbids long-term credentials on any instance, and operations wants no rotation work at all. Which solution meets both requirements?

   • A. Option A: Store the access key as a SecureString parameter in Parameter Store and grant the instances permission to read it
   • B. Option B: Encrypt the access key with AWS KMS, pass it in EC2 user data, and decrypt it in the application at boot
   • C. Option C: Store the access key in AWS Secrets Manager with automatic rotation and have the application read it at startup
   • D. Option D: Attach an IAM role through an instance profile in the launch template and use its temporary credentials
   Show answer and source

   Answer: D. Roles for EC2 deliver temporary credentials through the instance profile. The application never stores or rotates keys.

   • A (incorrect): Parameter Store hides the value but does not change what it is: a static key that must be rotated by hand.
   • B (incorrect): The key is still a long-term credential, user data is readable from the instance, and someone still has to rotate it.
   • C (incorrect): Secrets Manager removes the key from the AMI, but the application still uses a long-term IAM user key, which the security rule forbids.
   • D (correct): Correct. The instance metadata service hands the SDK short-lived credentials that AWS rotates automatically, so nothing long-lived ever lands on disk.

   Official sourcedocs.aws.amazon.com

   you can and should use an IAM role to manage temporary credentials for applications that run on an Amazon EC2 instance

   docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html (official page)

3. Question 3 of 20 · D1: Design Secure Architectures · saa-d1-003

   A company is onboarding a third-party cost-monitoring SaaS vendor. The vendor serves thousands of customers from its own AWS account and needs read-only access to the company's billing data. The security team is worried that another of the vendor's customers could trick the vendor into reading the company's data. Which design addresses this concern?

   • A. Option A: Create an IAM user for the vendor with read-only billing permissions and send the access key to the vendor through a secure channel
   • B. Option B: Create a role that trusts the vendor's account and requires the vendor-assigned external ID in its trust policy
   • C. Option C: Create a role that trusts the entire vendor account and limit the session duration to 15 minutes to reduce the exposure window
   • D. Option D: Create a role that trusts the vendor's account and requires MFA when the role is assumed
   Show answer and source

   Answer: B. The external ID in a cross-account trust policy exists to stop the confused deputy problem in multi-tenant vendor integrations.

   • A (incorrect): This creates a long-term credential held by a third party and does nothing about the confused deputy problem.
   • B (correct): Correct. The vendor must pass the external ID it assigned to this company when it assumes the role, so it cannot be steered into this account on behalf of someone else.
   • C (incorrect): A short session limits how long access lasts but not who it is used for, so the vendor could still be misused across customers.
   • D (incorrect): The vendor's software assumes the role programmatically; MFA does not distinguish which of the vendor's customers triggered the call.

   Official sourcedocs.aws.amazon.com

   The primary function of the external ID is to address and prevent the confused deputy problem.

   docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html (official page)

4. Question 4 of 20 · D1: Design Secure Architectures · saa-d1-004

   A platform team wants application developers to create their own IAM roles for AWS Lambda functions, so that the team stops being a bottleneck. The roles developers create must never be able to exceed a fixed set of approved permissions, even if a developer writes an overly broad policy. Which approach meets this requirement with the least effect on other users of the account?

   • A. Option A: Require a specific permissions boundary on every role that developers create, enforced with the iam:PermissionsBoundary condition
   • B. Option B: Attach a service control policy to the account that denies every action outside the approved set for all principals
   • C. Option C: Give developers an IAM Identity Center permission set that includes iam:CreateRole and the approved Lambda permissions
   • D. Option D: Turn on IAM Access Analyzer policy validation and ask developers to fix every finding before they deploy a function
   Show answer and source

   Answer: A. Permissions boundaries cap what an identity-based policy can grant to a user or role, which makes them the standard tool for safely delegating role creation.

   • A (correct): Correct. Whatever policy a developer attaches, the role can only use actions that the boundary also allows, and the condition stops anyone creating a role without it.
   • B (incorrect): An SCP would cap every user and role in the account, including the platform team itself, which is far broader than the requirement.
   • C (incorrect): This lets developers create roles but places no ceiling on what those new roles can be granted, so privilege escalation stays possible.
   • D (incorrect): Validation gives advice; it does not prevent a role from being created with broader permissions.

   Official sourcedocs.aws.amazon.com

   set the maximum permissions that an identity-based policy can grant to an IAM entity

   docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html (official page)

5. Question 5 of 20 · D1: Design Secure Architectures · saa-d1-005

   A company uses AWS Organizations. The security team attached a service control policy to the organization root that denies all actions outside two approved AWS Regions. A week later, an administrator signed in to the management account successfully launches Amazon EC2 instances in a third Region. What explains this behavior?

   • A. Option A: SCPs attached to the root apply only to new accounts that join the organization later
   • B. Option B: The administrator's AdministratorAccess policy overrides any deny statement in an SCP
   • C. Option C: The SCP takes effect only after every member account has accepted the policy change
   • D. Option D: SCPs never restrict users or roles in the management account, only member accounts
   Show answer and source

   Answer: D. SCPs set guardrails for member accounts only. Keep the management account for organization tasks and run workloads in member accounts.

   • A (incorrect): An SCP on the root applies to all member accounts below it, both existing and new.
   • B (incorrect): For member accounts an explicit deny in an SCP wins over any allow in identity policies. The cause here is the account type.
   • C (incorrect): There is no acceptance step. An attached SCP applies to the affected member accounts immediately.
   • D (correct): Correct. The management account is outside the reach of SCPs, which is one reason AWS advises running no workloads there.

   Official sourcedocs.aws.amazon.com

   SCPs don't affect users or roles in the management account. They affect only the member accounts in your organization.

   docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html (official page)

6. Question 6 of 20 · D1: Design Secure Architectures · saa-d1-006

   A new member account sits in an organizational unit whose only service control policy allows all Amazon S3 actions. A developer in that account has an IAM user with no policies attached. The developer reports that every S3 call returns AccessDenied, and expects the SCP to have granted access. What should the administrator do?

   • A. Option A: Add the developer's IAM user ARN as the principal in the SCP's Allow statement
   • B. Option B: Move the SCP from the organizational unit to the organization root so that it is inherited correctly
   • C. Option C: Attach an identity-based policy that grants the needed S3 actions to the developer's IAM user or group
   • D. Option D: Enable all features in AWS Organizations so that SCP allow statements begin to grant access
   Show answer and source

   Answer: C. SCPs are guardrails. Effective permissions are the intersection of what the SCP allows and what account policies grant.

   • A (incorrect): SCPs do not support naming principals to grant access to; they filter what accounts can do, they don't grant anything.
   • B (incorrect): Where the SCP is attached does not matter here. No SCP grants permissions, wherever it sits.
   • C (correct): Correct. An SCP only sets the maximum. Access still has to be granted by an identity-based or resource-based policy inside the account.
   • D (incorrect): All features is required for SCPs to work at all, but even then an SCP never grants permissions.

   Official sourcedocs.aws.amazon.com

   SCPs do not grant permissions to the IAM users and IAM roles in your organization. No permissions are granted by an SCP.

   docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html (official page)

7. Question 7 of 20 · D2: Design Resilient Architectures · saa-d2-001

   An image-processing service pulls jobs from an Amazon SQS standard queue. Most jobs finish in 40 seconds, but large images take up to 4 minutes. The team notices that large images are often processed two or three times by different workers, wasting compute. The queue uses the default settings. What should a solutions architect change first?

   • A. Option A: Enable long polling on the queue by setting the receive message wait time to 20 seconds
   • B. Option B: Raise the visibility timeout above the longest processing time, for example to 5 minutes
   • C. Option C: Add a dead-letter queue with a maximum receive count of 1 so that duplicates are moved aside
   • D. Option D: Convert the queue to a FIFO queue so that each message is delivered exactly once to a single worker
   Show answer and source

   Answer: B. The visibility timeout hides a received message from other consumers; set it longer than the processing time so it is not redelivered mid-job.

   • A (incorrect): Long polling reduces empty receives and cost; it does not stop in-flight messages from reappearing.
   • B (correct): Correct. With the default 30-second timeout, a message becomes visible again while the first worker is still busy, so another worker picks it up.
   • C (incorrect): That would push legitimate slow jobs to the DLQ after their first timeout instead of letting them finish.
   • D (incorrect): FIFO deduplication prevents duplicate sends, but a message whose visibility timeout expires is still redelivered; the root cause stays.

   Official sourcedocs.aws.amazon.com

   This invisibility is controlled by the visibility timeout, which ensures that other consumers cannot process the same message while you are working on it.

   docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-visibility-timeout.html (official page)

8. Question 8 of 20 · D2: Design Resilient Architectures · saa-d2-002

   A payment service sends charge requests to a queue. Network retries in the producer sometimes send the same request twice, and the accounting team has found double charges. Requests for the same customer must be processed in the order they were sent, while different customers should still be processed in parallel. Which TWO design choices meet these requirements with the least custom code? (Select TWO.)

   • A. Option A: Set the message group ID of each request to the customer ID
   • B. Option B: Use an SQS FIFO queue with content-based deduplication or a deduplication ID on each request
   • C. Option C: Use an SQS standard queue and record processed request IDs in DynamoDB to skip repeats
   • D. Option D: Enable long polling with a 20-second wait time so that consumers receive messages in order
   • E. Option E: Add a 5-minute delivery delay to the queue so retries arrive after the original is processed
   Show answer and source

   Answer: A, B. SQS FIFO queues combine deduplication with ordering per message group ID, which keeps per-customer order while allowing parallelism across customers.

   • A (correct): Correct. Ordering is kept within a message group, and different groups can be consumed in parallel.
   • B (correct): Correct. FIFO queues drop duplicate sends that arrive within the deduplication interval, so producer retries do not create second charges.
   • C (incorrect): This is custom deduplication code, and a standard queue still does not guarantee per-customer order.
   • D (incorrect): Long polling reduces empty receives; it has no effect on ordering or duplicates.
   • E (incorrect): A delay postpones the duplicate; it does not stop it from being processed.

   Official sourcedocs.aws.amazon.com

   Amazon SQS FIFO queues preserve message order using unique deduplication IDs and message group IDs.

   docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/FIFO-queues-understanding-logic.html (official page)

9. Question 9 of 20 · D2: Design Resilient Architectures · saa-d2-003

   Workers consume orders from an Amazon SQS queue. A few malformed messages fail every time and keep returning to the queue, wasting worker time and hiding healthy messages behind them. The team wants failed messages set aside automatically after five attempts so that engineers can inspect them later. What should a solutions architect configure?

   • A. Option A: A visibility timeout of 5 seconds so that failing messages return to other workers faster
   • B. Option B: A delay queue of 5 minutes so that failing messages wait before being retried
   • C. Option C: A dead-letter queue with a redrive policy whose maximum receive count is 5
   • D. Option D: A message retention period of 5 minutes so that failing messages expire quickly
   Show answer and source

   Answer: C. Dead-letter queues isolate messages that are not processed successfully after a set number of receives.

   • A (incorrect): Failing messages would just cycle faster; nothing sets them aside.
   • B (incorrect): Delay applies to new messages and does not isolate the ones that keep failing.
   • C (correct): Correct. After five receives without deletion, SQS moves the message to the DLQ, where it can be inspected and redriven later.
   • D (incorrect): Short retention would also delete healthy messages that wait in the queue during a backlog.

   Official sourcedocs.aws.amazon.com

   DLQs are useful for debugging your application because you can isolate unconsumed messages to determine why processing did not succeed.

   docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html (official page)

10. Question 10 of 20 · D2: Design Resilient Architectures · saa-d2-004

    When an order is placed, an e-commerce platform must update inventory, send a confirmation email, and feed the fraud model. Each consumer is owned by a different team, scales differently, and must keep receiving orders even if another consumer is down for an hour. Which design meets these requirements?

    • A. Option A: Publish each order to an Amazon SNS topic with the three consumers subscribed through HTTPS endpoints
    • B. Option B: Send each order to one Amazon SQS queue that all three consumers poll
    • C. Option C: Have the order service call the three consumers' APIs synchronously and retry on failure
    • D. Option D: Publish orders to an SNS topic that fans out to a separate SQS queue for each consumer
    Show answer and source

    Answer: D. SNS-to-SQS fanout delivers one event to many independent consumers, each with its own durable queue.

    • A (incorrect): SNS retries HTTPS delivery for a limited time, but there is no durable buffer for a consumer that is down for an hour.
    • B (incorrect): Each message would go to only one consumer; the other two would never see that order.
    • C (incorrect): This couples the order service to every consumer; one hour of downtime means lost orders or blocked checkouts.
    • D (correct): Correct. SNS pushes each order to every subscribed queue, and each queue buffers messages so a consumer that is down can catch up later.

    Official sourcedocs.aws.amazon.com

    Amazon SNS lets applications send time-critical messages to multiple subscribers through a “push” mechanism.

    docs.aws.amazon.com/sns/latest/dg/sns-sqs-as-subscriber.html (official page)

11. Question 11 of 20 · D2: Design Resilient Architectures · saa-d2-005

    A SaaS company wants to react to events from its own microservices and from AWS services, such as an EC2 instance state change, and route each event to different targets, including Lambda functions and Step Functions workflows, based on the event's content. The team does not want to write routing code. Which service meets this requirement?

    • A. Option A: Amazon EventBridge rules that match event patterns and route to targets
    • B. Option B: Amazon SQS with a Lambda function that reads each message and calls the right target
    • C. Option C: Amazon Kinesis Data Streams with a consumer application per target
    • D. Option D: Amazon MQ with a RabbitMQ broker and topic exchanges for each event type
    Show answer and source

    Answer: A. EventBridge rules match incoming events and send them to targets, without custom routing code.

    • A (correct): Correct. EventBridge rules match on event data and route to multiple targets in parallel; AWS services already publish events to the default bus.
    • B (incorrect): That works, but the Lambda function is exactly the routing code the team wants to avoid.
    • C (incorrect): Kinesis is built for high-throughput ordered streams; content-based routing would still need consumer code.
    • D (incorrect): A broker can route messages, but AWS service events are not delivered there natively and the broker must be managed.

    Official sourcedocs.aws.amazon.com

    A rule specifies which events to send to which targets for processing. A single rule can send an event to multiple targets

    docs.aws.amazon.com/eventbridge/latest/userguide/eb-rules.html (official page)

12. Question 12 of 20 · D3: Design High-Performing Architectures · saa-d3-001

    A database on EC2 uses a 200 GiB gp2 EBS volume and needs a steady 12,000 IOPS. To get that performance on gp2 the team would have to grow the volume to 4 TiB, paying for storage it will never use. Latency in the low single-digit milliseconds is acceptable. What should a solutions architect recommend?

    • A. Option A: Change the volume to io2 Block Express and provision 12,000 IOPS at 200 GiB
    • B. Option B: Change the volume to st1 Throughput Optimized HDD and increase its size to 2 TiB
    • C. Option C: Keep gp2 and stripe two 2 TiB volumes together with RAID 0 on the instance
    • D. Option D: Change the volume to gp3 and provision 12,000 IOPS at the same 200 GiB size
    Show answer and source

    Answer: D. gp3 decouples performance from capacity, so IOPS can be provisioned without buying extra storage.

    • A (incorrect): That meets the IOPS but pays for sub-millisecond, high-durability storage the workload does not need.
    • B (incorrect): st1 is built for large sequential throughput, not small random IOPS for a database.
    • C (incorrect): This still buys several terabytes of unneeded storage to get the IOPS and adds complexity.
    • D (correct): Correct. gp3 lets you provision IOPS and throughput independently of size, and it costs less per GiB than gp2.

    Official sourcedocs.aws.amazon.com

    It also helps you to scale volume performance independently of volume size.

    docs.aws.amazon.com/ebs/latest/userguide/general-purpose.html (official page)

13. Question 13 of 20 · D3: Design High-Performing Architectures · saa-d3-002

    A trading system's database on a Nitro-based EC2 instance requires consistent sub-millisecond storage latency, very high IOPS from a single volume, and the highest durability EBS offers, because a volume failure would halt trading. Which EBS volume type should a solutions architect choose?

    • A. Option A: Throughput Optimized HDD st1
    • B. Option B: General Purpose SSD gp3 with maximum provisioned IOPS
    • C. Option C: Provisioned IOPS SSD io2 Block Express
    • D. Option D: General Purpose SSD gp2 sized large enough for the needed IOPS
    Show answer and source

    Answer: C. io2 Block Express is the EBS choice for the most demanding, latency-sensitive I/O workloads.

    • A (incorrect): HDD volumes are for sequential throughput and have far higher latency.
    • B (incorrect): gp3 offers single-digit millisecond latency and lower durability, which does not meet the stated latency goal.
    • C (correct): Correct. io2 Block Express is designed for consistent sub-millisecond latency, higher IOPS and throughput than gp3, and 99.999 percent durability.
    • D (incorrect): gp2 ties IOPS to size and does not provide sub-millisecond latency or io2 durability.

    Official sourcedocs.aws.amazon.com

    io2 Block Express volumes are suited for workloads that benefit from a single volume that provides consistent sub-millisecond latency

    docs.aws.amazon.com/ebs/latest/userguide/provisioned-iops.html (official page)

14. Question 14 of 20 · D3: Design High-Performing Architectures · saa-d3-003

    A video rendering fleet on EC2 writes large temporary frame files during each job. The files are discarded when the job ends, can be regenerated if lost, and need the highest possible local I/O performance at no extra storage cost. Which storage should a solutions architect use for the scratch data?

    • A. Option A: Instance store volumes on an instance type that includes local NVMe SSD disks
    • B. Option B: An Amazon EFS file system in Max I/O mode shared by all instances
    • C. Option C: A gp3 EBS volume with maximum IOPS and throughput attached to each instance
    • D. Option D: An Amazon S3 bucket mounted with Mountpoint for Amazon S3
    Show answer and source

    Answer: A. Instance store gives fast temporary block storage for data such as buffers, caches and scratch files.

    • A (correct): Correct. Instance store is physically attached to the host, very fast, included in the instance price, and suits temporary data that can be lost.
    • B (incorrect): EFS is network file storage with higher latency per operation, and shared access is not required.
    • C (incorrect): gp3 is persistent network storage that adds cost; persistence is not needed for scratch files.
    • D (incorrect): Object storage over the network is slower for random scratch I/O and adds request costs.

    Official sourcedocs.aws.amazon.com

    Instance store is ideal for temporary storage of information that changes frequently, such as buffers, caches,

    docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html (official page)

15. Question 15 of 20 · D3: Design High-Performing Architectures · saa-d3-004

    A genomics team keeps 400 TB of input data in Amazon S3. Each analysis runs on hundreds of Linux instances for a few days and needs a POSIX file system with hundreds of GB/s of throughput, after which results go back to S3. Which storage solution fits best?

    • A. Option A: Amazon EFS Regional file system with Elastic throughput, loaded with the data before each run
    • B. Option B: Amazon FSx for Lustre linked to the S3 bucket as a data repository
    • C. Option C: A copy of the data on io2 volumes attached to each instance
    • D. Option D: Amazon FSx for Windows File Server with SSD storage and maximum throughput capacity
    Show answer and source

    Answer: B. FSx for Lustre is built for speed-sensitive workloads such as HPC and integrates with S3.

    • A (incorrect): EFS scales well, but copying 400 TB in and out for each run is slow, and Lustre is designed for this level of parallel HPC throughput.
    • B (correct): Correct. FSx for Lustre is a high-performance POSIX file system for HPC, and its S3 integration presents bucket data as files and writes results back.
    • C (incorrect): Copying the dataset to every instance multiplies storage cost and preparation time.
    • D (incorrect): This is an SMB file system for Windows workloads, not a POSIX parallel file system for Linux HPC.

    Official sourcedocs.aws.amazon.com

    You use Lustre for workloads where speed matters, such as machine learning, high performance computing (HPC), video processing, and financial modeling.

    docs.aws.amazon.com/fsx/latest/LustreGuide/what-is.html (official page)

16. Question 16 of 20 · D3: Design High-Performing Architectures · saa-d3-005

    A company is moving a Windows-based document management application to AWS. It relies on SMB file shares, NTFS permissions and Active Directory integration, and the team wants a fully managed service rather than running Windows file servers on EC2. Which service should a solutions architect choose?

    • A. Option A: Amazon FSx for Windows File Server joined to Active Directory
    • B. Option B: Amazon FSx for Lustre with a Windows SMB gateway in front of it
    • C. Option C: Amazon EFS with an NFS client installed on each Windows server
    • D. Option D: Amazon S3 with S3 File Gateway presenting buckets as SMB shares
    Show answer and source

    Answer: A. FSx for Windows File Server provides fully managed native Windows file servers for lift-and-shift.

    • A (correct): Correct. FSx for Windows File Server provides fully managed Windows file servers with native SMB, NTFS and AD integration.
    • B (incorrect): Lustre is a Linux HPC file system and does not provide Windows-native shares.
    • C (incorrect): EFS is an NFS file system for Linux and is not supported on Windows clients.
    • D (incorrect): File Gateway is meant for hybrid access to S3 from on premises, not as the primary managed Windows file server in AWS.

    Official sourcedocs.aws.amazon.com

    Amazon FSx for Windows File Server provides fully managed Microsoft Windows file servers, backed by a fully native Windows file system.

    docs.aws.amazon.com/fsx/latest/WindowsGuide/what-is.html (official page)

17. Question 17 of 20 · D4: Design Cost-Optimized Architectures · saa-d4-001

    A media startup stores 800 TB of user-uploaded files in S3 Standard. Some files are viewed constantly for years, others are never opened again after the first week, and the team cannot predict which will be which. It wants lower storage costs without retrieval fees or lifecycle rules to tune. Which storage class should a solutions architect recommend?

    • A. Option A: S3 One Zone-IA for all new uploads
    • B. Option B: S3 Standard-IA with a lifecycle rule after 30 days
    • C. Option C: S3 Glacier Instant Retrieval with a lifecycle rule after 7 days
    • D. Option D: S3 Intelligent-Tiering for all uploaded files
    Show answer and source

    Answer: D. Intelligent-Tiering suits data with unknown or changing access patterns; it automates tiering for a small monitoring fee.

    • A (incorrect): One Zone-IA stores a single AZ copy of irreplaceable user data and charges retrieval fees.
    • B (incorrect): Files that stay popular would pay retrieval fees on every access, and the rule cannot tell popular files from idle ones.
    • C (incorrect): Popular files would incur retrieval charges, and Glacier Instant Retrieval has a 90-day minimum storage duration.
    • D (correct): Correct. Intelligent-Tiering monitors access and moves each object between frequent, infrequent and archive instant access tiers automatically, with no retrieval fees.

    Official sourcedocs.aws.amazon.com

    The Amazon S3 Intelligent-Tiering storage class automatically stores objects in three access tiers.

    docs.aws.amazon.com/AmazonS3/latest/userguide/intelligent-tiering-overview.html (official page)

18. Question 18 of 20 · D4: Design Cost-Optimized Architectures · saa-d4-002

    A hospital keeps medical images that are rarely opened after the first month, roughly once a quarter for follow-up appointments, but when a doctor opens one it must load in milliseconds. Images are kept for ten years. Which S3 storage class is most cost-effective for images older than 30 days?

    • A. Option A: S3 Standard-IA
    • B. Option B: S3 Glacier Instant Retrieval
    • C. Option C: S3 Glacier Flexible Retrieval
    • D. Option D: S3 Glacier Deep Archive
    Show answer and source

    Answer: B. S3 Glacier Instant Retrieval targets quarterly access with millisecond retrieval.

    • A (incorrect): This gives millisecond access but costs more per GB stored than Glacier Instant Retrieval for quarterly access.
    • B (correct): Correct. It is designed for long-lived data accessed about once a quarter that still needs millisecond retrieval, at a lower storage price than Standard-IA.
    • C (incorrect): Retrievals take minutes to hours, which does not meet the millisecond requirement.
    • D (incorrect): The lowest storage cost, but retrievals take hours.

    Official sourcedocs.aws.amazon.com

    We recommend using S3 Glacier Instant Retrieval for long-term data that's accessed once per quarter and requires millisecond retrieval times.

    docs.aws.amazon.com/AmazonS3/latest/userguide/glacier-storage-classes.html (official page)

19. Question 19 of 20 · D4: Design Cost-Optimized Architectures · saa-d4-003

    A company is reviewing which of its S3 data could move to S3 One Zone-IA to save money. All candidates are accessed rarely but need millisecond access when requested. Which TWO data sets are appropriate for One Zone-IA? (Select TWO.)

    • A. Option A: Medical images that doctors open several times a day during treatment
    • B. Option B: Replica copies created by S3 Cross-Region Replication, where the source bucket keeps the primary copy
    • C. Option C: The only copy of signed customer contracts that must be kept for seven years
    • D. Option D: Database backups that are the company's sole disaster recovery copy
    • E. Option E: Thumbnails that can be regenerated from originals stored elsewhere if an Availability Zone is lost
    Show answer and source

    Answer: B, E. S3 One Zone-IA suits re-creatable data and secondary copies such as CRR replicas; primary irreplaceable data belongs in multi-AZ classes.

    • A (incorrect): Frequent access makes IA retrieval fees expensive; this data belongs in S3 Standard.
    • B (correct): Correct. AWS lists CRR replicas as a fit for One Zone-IA because another copy exists in the source Region.
    • C (incorrect): A primary copy that cannot be re-created belongs in a multi-AZ class such as Standard-IA.
    • D (incorrect): Losing the AZ would lose the only backup, which defeats the purpose of a DR copy.
    • E (correct): Correct. One Zone-IA is meant for infrequently accessed data that can be re-created if the AZ fails.

    Official sourcedocs.aws.amazon.com

    Use if you can re-create the data if the Availability Zone fails, for object replicas when configuring S3 Cross-Region Replication (CRR).

    docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html (official page)

20. Question 20 of 20 · D4: Design Cost-Optimized Architectures · saa-d4-004

    A bank must keep closed-account records for ten years. Regulators may ask for a record perhaps once a year, and the bank has two days to produce it. The data is 2 PB and the bank wants the lowest possible storage cost. Which S3 storage class and retrieval approach meets the requirements?

    • A. Option A: S3 Glacier Deep Archive, restoring requested records with a Standard retrieval
    • B. Option B: S3 Glacier Flexible Retrieval, restoring requested records with an Expedited retrieval
    • C. Option C: S3 Standard-IA with a lifecycle expiration after ten years
    • D. Option D: S3 Glacier Instant Retrieval, reading requested records directly
    Show answer and source

    Answer: A. Glacier Deep Archive is the lowest-cost class for data that can wait hours for retrieval.

    • A (correct): Correct. Deep Archive has the lowest storage price, and Standard retrievals typically finish within 12 hours, well inside the two-day window.
    • B (incorrect): This works but costs more to store than Deep Archive, and expedited speed is unnecessary.
    • C (incorrect): Standard-IA is for data that needs millisecond access, which costs far more for an annual request.
    • D (incorrect): Millisecond access is not needed, and the storage price is much higher than Deep Archive at 2 PB.

    Official sourcedocs.aws.amazon.com

    Standard retrievals typically finish within 12 hours for the S3 Glacier Deep Archive storage class

    docs.aws.amazon.com/AmazonS3/latest/userguide/restoring-objects-retrieval-options.html (official page)