Question 1

An IAM user at Larkspur Media belongs to a group with this policy: {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::larkspur-reports/*"}]}. The user also has this inline policy: {"Version": "2012-10-17", "Statement": [{"Effect": "Deny", "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::larkspur-reports/*"}]}. No other policies apply. What happens when the user tries to delete an object in the larkspur-reports bucket?

Accepted Answer

The request is denied because an explicit Deny overrides any Allow. In IAM policy evaluation, an explicit Deny in any applicable policy always overrides an Allow, so the delete is refused even though the group policy allows s3:*. There is no precedence of group policies over inline policies, and versioning does not affect how IAM evaluates the request.

Question 2

Users report that an application server at Birchfield Clinics intermittently cannot reach a database in another subnet of the same VPC. The network team wants to see whether the traffic is being accepted or rejected by security groups or network ACLs, including source and destination IPs and ports. Which feature should they enable?

Accepted Answer

VPC Flow Logs on the relevant subnets or network interfaces. VPC Flow Logs capture metadata about IP traffic to and from network interfaces, including addresses, ports, and whether traffic was accepted or rejected. CloudTrail records API calls rather than packet flows, Resolver query logs show DNS queries, and load balancer access logs only cover requests that pass through a load balancer.

Question 3

Marston Group has 25 VPCs in one Region and has connected them with a growing mesh of VPC peering connections. Engineers are frustrated that traffic does not pass from one VPC through a peered VPC to a third VPC, and the number of peering connections is becoming hard to manage. Which solution simplifies connectivity for all VPCs?

Accepted Answer

Attach all VPCs to an AWS Transit Gateway and use its route tables to control routing. A Transit Gateway acts as a regional hub that VPCs attach to once, and its route tables control which attachments can reach each other, replacing a complex peering mesh. VPC peering is non-transitive and has no setting to make it transitive, a full mesh grows quadratically, and per-pair VPNs add even more overhead.

Question 4

Traffic to the payroll portal at Kellerman Services rises sharply every weekday at 8:00 AM and falls at 6:00 PM, following the same pattern every week. Reactive scaling adds instances too slowly, so employees see slow responses in the first minutes of each morning. What should a solutions architect configure for the Auto Scaling group?

Accepted Answer

Scheduled scaling actions that raise capacity shortly before 8:00 AM and lower it after 6:00 PM on weekdays. Scheduled scaling changes capacity at specified times, so the group can scale out before a known daily surge instead of reacting to it. A lower alarm threshold still reacts after load begins, and health check grace periods and warmup settings affect how new instances are evaluated rather than when they are launched.

Question 5

At 2:47 PM, a faulty deployment at Quimby Travel corrupted rows in an Amazon RDS for MySQL database that has automated backups enabled with a 7-day retention period. The team wants to recover the database to its state at 2:45 PM. What should they do?

Accepted Answer

Perform a point-in-time restore to 2:45 PM, which creates a new DB instance, and point the application to it. Automated backups plus transaction logs allow a point-in-time restore to any second within the retention period, and the restore creates a new DB instance that the application must be pointed to. A read replica would already have received the corrupting changes, snapshot restores cannot overwrite an existing instance and return only to the snapshot time, and a Multi-AZ standby is synchronously replicated so it holds the same corrupted data.

AWS Solutions Architect Associate (SAA-C03) Practice Exam

Free sample questions

Other practice exams