Практика: SAA-C03 (AWS)

Вопросы для практики — SAA-C03 — из наборов курса «AWS», доступных без аккаунта: по несколько из каждой части с ответом и объяснением, а также тест по этим наборам.

начать практику

начать практику

Откроет карту курса «AWS»: одно нажатие, без регистрации.

Тренировать вопросы: SAA-C03 →

Посмотрите ответ, чтобы проверить себя. Это вопросы для практики в формате экзамена, а не работы самого организатора; тест работает без аккаунта.

коротко о курсе

экзамены
SAA-C03
вопросы
648 вопросов
карточки
352 карточки
без аккаунта
все 83 набора
части
4 части
примеры вопросов
12 примеров вопросов

SAA-C03

4 части; без аккаунта — 83 набора · 648 вопросов · 352 карточки. На странице 12 примеров вопросов с ответами — по несколько из каждой части.

Тренировать вопросы: SAA-C03 →

Безопасность

25 наборов · 182 вопроса · 26 карточек

Тренировать: Безопасность

  1. из набора IAM, роли и управление доступом

    A game studio organizes its developers into squads, each responsible for its own fleet of EC2 instances. Every instance is tagged with the squad's name, and each developer's IAM principal carries a matching team tag. The studio wants every squad limited to managing only its own tagged instances, and new squads join every quarter. Which approach meets these requirements with the LEAST operational overhead?
    1. A separate AWS account per squad with instances migrated into it
    2. An IAM permissions boundary on each developer that lists the squad's instance IDs
    3. Attribute-based access control with policy conditions on resource tags
    4. A separate customer managed policy per squad, cloned for each new squad
    показать ответ

    ответ C. Attribute-based access control with policy conditions on resource tags

    ABAC compares the principal's tag with the resource's tag in a condition such as aws:ResourceTag/Team equal to aws:PrincipalTag/Team, so one policy covers every squad and onboarding a squad is a tagging exercise. Cloning a policy per squad, or enumerating instance IDs in a permissions boundary, means editing IAM every quarter — and a boundary caps permissions rather than granting them. Splitting squads into separate accounts isolates them but migrating fleets is far more work than tagging.

    официальная документация

  2. из набора Шифрование и управление ключами

    A payment card processor stores transaction records in an Amazon RDS for PostgreSQL database. To pass an upcoming PCI DSS assessment, the company must ensure that data is encrypted while stored on disk and that every connection between the application servers and the database is encrypted in transit. How can the company meet both requirements?
    1. Require SSL/TLS connections and enable RDS encryption at rest with a KMS key
    2. Enable RDS storage encryption with a KMS key and restrict the database to the application's security group
    3. Set the rds.force_ssl parameter to 1 and enable automated backups
    4. Store the connection string in AWS Secrets Manager and place the database in a private subnet
    показать ответ

    ответ A. Require SSL/TLS connections and enable RDS encryption at rest with a KMS key

    Two separate controls are required: storage encryption with a KMS key, chosen at creation or adopted by restoring an encrypted snapshot copy, covers data at rest, and rds.force_ssl with clients that verify the RDS CA covers data in transit. Storage encryption alone leaves the wire in the clear; force_ssl alone leaves the disk unencrypted, and automated backups merely inherit whatever encryption the instance has. Security groups, private subnets and a secret store decide who can reach the database, not whether the bytes are encrypted.

    официальная документация

  3. из набора Защита сети и периметра

    A telecommunications company runs its billing application on EC2 instances in private subnets with no public IP addresses. Administrators occasionally need an interactive shell on these instances for troubleshooting. The security team has banned bastion hosts, refuses to open any inbound SSH ports, and does not want to distribute or manage SSH key pairs. Which solution gives administrators the required access?
    1. AWS Systems Manager Session Manager
    2. A public IP plus an inbound SSH rule
    3. AWS Systems Manager Run Command
    4. An AWS Client VPN endpoint plus SSH keys
    показать ответ

    ответ A. AWS Systems Manager Session Manager

    Session Manager brokers an interactive shell over the SSM agent's outbound connection, authorised by IAM and logged to CloudTrail, so the instances need no inbound rule, no public address, no bastion and no key pair. Run Command executes documents but never gives an interactive session. A public IP with an SSH rule, or a Client VPN plus distributed SSH keys, reintroduces exactly what the security team banned.

    официальная документация

Отказоустойчивость

28 наборов · 154 вопроса · 17 карточек

Тренировать: Отказоустойчивость

  1. из набора Высокая доступность и переключение при отказе

    An online travel agency runs its booking application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. Occasionally a server process stays up while the application it hosts stops responding to requests, yet the Auto Scaling group never replaces the instance because the underlying hardware and operating system appear healthy. The team wants such hung instances replaced automatically. Which configuration change achieves this?
    1. Shorten the target group's health check interval and lower its unhealthy threshold
    2. An Auto Scaling lifecycle hook that runs a script to restart the application
    3. Set the ASG health check type to ELB so failing target health checks trigger replacement
    4. A CloudWatch alarm on the ALB's UnHealthyHostCount metric that pages the on-call engineer
    показать ответ

    ответ C. Set the ASG health check type to ELB so failing target health checks trigger replacement

    With health check type EC2 the group reacts only to hypervisor and instance status checks, which stay green while the application is hung. Health check type ELB makes the group honour the target group's HTTP check, so a target that fails it is marked unhealthy, terminated and replaced. Tightening the health check interval or alarming on UnHealthyHostCount makes the failure visible sooner without replacing anything, and lifecycle hooks run only during launch and terminate events.

    официальная документация

  2. из набора Слабая связанность и обмен сообщениями

    When a file lands in S3 it must trigger asynchronous processing that scales to zero when idle. Which is the simplest event-driven design?
    1. An S3 Lifecycle rule that starts processing when an object is created
    2. An EC2 Auto Scaling group that lists the bucket every minute and processes new keys
    3. An S3 event notification that invokes a Lambda function directly
    4. A nightly AWS Batch job that processes every object added that day
    показать ответ

    ответ C. An S3 event notification that invokes a Lambda function directly

    An S3 event notification invokes the Lambda function the moment the object is created; concurrency follows the event rate and costs nothing while the bucket is idle, and an SQS queue in between adds buffering and retries. An Auto Scaling group that lists the bucket pays for instances during idle hours and never reaches zero. A nightly Batch job adds up to a day of latency. S3 Lifecycle rules only transition or expire objects; they cannot invoke compute at all.

    официальная документация

  3. из набора Резервное копирование, DR и долговечность данных

    A media company must keep master recordings in object storage that is designed for 99.999999999% (11 nines) durability across multiple facilities by default. Which service provides this?
    1. Amazon EFS One Zone
    2. Amazon S3 object storage
    3. S3 One Zone-IA
    4. Amazon EBS with daily snapshot copies
    показать ответ

    ответ B. Amazon S3 object storage

    The S3 standard classes store every object redundantly across at least three Availability Zones and are designed for 99.999999999% durability with nothing to configure. S3 One Zone-IA keeps its copies in a single AZ, so it fails the multiple-facilities requirement. An EBS volume lives in one AZ; snapshots help recovery but the volume itself is not multi-facility storage. EFS One Zone is likewise single-AZ by design.

    официальная документация

Производительность

30 наборов · 182 вопроса · 17 карточек

Тренировать: Производительность

  1. из набора Вычисления и сеть

    An HPC job needs the lowest possible network latency and highest packet-per-second performance between a group of instances. Which placement strategy fits?
    1. Spread instances across all AZs
    2. A spread placement group
    3. A partition placement group
    4. A cluster placement group
    показать ответ

    ответ D. A cluster placement group

    A cluster placement group packs instances close together in one AZ for the lowest latency and highest throughput. Spread/partition groups prioritize fault isolation; spreading across AZs adds latency.

    официальная документация

  2. из набора Хранилища и базы данных

    A ticketing platform's serverless backend invokes thousands of concurrent Lambda functions during on-sale events. Each invocation opens a short-lived connection to an RDS for PostgreSQL database, and sales spikes now exhaust the database's connection limit, causing errors even though CPU and memory remain low. Which solution fixes this MOST efficiently?
    1. Reusing the database connection in the Lambda execution context
    2. A larger DB instance class with a higher max_connections
    3. Amazon RDS Proxy to pool and reuse connections
    4. More read replicas behind a reader endpoint
    показать ответ

    ответ C. Amazon RDS Proxy to pool and reuse connections

    RDS Proxy sits between Lambda and the database and holds a pool of established connections that thousands of short-lived invocations share, so the connection count stays bounded and failover is faster as well. A larger instance class with a higher max_connections buys a few thousand more connections at much higher cost and breaks again at the next on-sale. Read replicas add read capacity while every invocation still opens its own connection to the writer. Reusing the connection inside the execution context helps within one environment, and a burst creates hundreds of environments at once.

    официальная документация

  3. из набора Приём данных и аналитика

    A marketing team lands about 2 TB of .csv extracts in Amazon S3 every night, and the Athena queries over them scan whole files and cost far more than budgeted. Before analysts arrive each morning, a managed job must rewrite the night's files into a columnar format, and nobody wants to operate a cluster to do it. Which service should the team use?
    1. Amazon Redshift Spectrum
    2. Amazon Data Firehose record format conversion
    3. AWS Glue ETL jobs writing Parquet output
    4. Amazon EMR with a transient Spark cluster
    показать ответ

    ответ C. AWS Glue ETL jobs writing Parquet output

    A Glue job reads the nightly .csv objects and writes Parquet, a columnar format that lets Athena skip columns it does not need and scan far fewer bytes; Glue provisions the Spark capacity per run, so nothing is left running afterwards. Redshift Spectrum reads the .csv files in place and converts nothing, and it needs a Redshift warehouse behind it. Firehose record format conversion applies to JSON records passing through a delivery stream, not to files already sitting in a bucket. EMR can do the rewrite but puts a Spark cluster back under the team's care.

    официальная документация

Экономичность

30 наборов · 130 вопросов · 17 карточек

Тренировать: Экономичность

  1. из набора Оптимизация хранения

    A photo-sharing app generates thumbnail renditions from original images and stores them in S3. Thumbnails are regenerated on demand from originals if ever lost, are accessed only occasionally after the first month, and must still be served in milliseconds when requested. The team can tolerate losing an Availability Zone's copies. Which S3 storage class is MOST cost-effective for the thumbnails?
    1. S3 Glacier Deep Archive
    2. S3 One Zone-IA
    3. S3 Standard
    4. S3 Standard-IA
    показать ответ

    ответ B. S3 One Zone-IA

    One Zone-IA stores data in a single AZ at lower cost — acceptable for easily reproducible, non-critical data. Standard/Standard-IA are multi-AZ (pricier); Glacier adds retrieval latency.

    официальная документация

  2. из набора Вычисления и базы данных

    A backend runs short, event-driven tasks with spiky invocation and long idle periods. Which compute model minimizes cost?
    1. An EC2 Auto Scaling group with a minimum of two instances
    2. AWS Lambda, billed per request and duration
    3. A three-year Reserved Instance for the busiest hour
    4. An ECS service sized for peak
    показать ответ

    ответ B. AWS Lambda, billed per request and duration

    Lambda charges only for invocations and execution time, so idle costs nothing — ideal for spiky, event-driven work. Always-on or peak-sized capacity pays for idle time.

    официальная документация

  3. из набора Сеть и контроль расходов

    Finance wants to be alerted when monthly spend is forecast to exceed a threshold. Which tool fits?
    1. AWS Cost Explorer
    2. AWS CloudTrail
    3. AWS Budgets
    4. AWS Config
    показать ответ

    ответ C. AWS Budgets

    AWS Budgets sets cost/usage thresholds and sends alerts (including on forecasts). Cost Explorer is for analysis/visualization, not threshold alerting.

    официальная документация

как это работает

В каждой части — несколько вопросов, выбранных в постоянном порядке, поэтому страница читается одинаково при каждом визите. Посмотрите ответ — там верный вариант и объяснение.

Тренировка части запускает тест по наборам, целиком посвящённым этой части (до 12 наборов); тренировка всего экзамена берёт до 12 случайных наборов, в том числе тех, где части смешаны, и при каждом запуске выбирает их заново. Ни один набор этого экзамена не требует аккаунта. Каждый ответ проверяется сразу, а ошибки возвращаются. Бесплатный аккаунт сохраняет прогресс и позволяет пройти пробный экзамен.

частые вопросы

SAA-C03: это настоящие вопросы?

Нет. 12 примеров вопросов на этой странице и 648 вопросов, из которых они взяты, — вопросы для практики в формате экзамена, написанные для wspell. Сами работы принадлежат организатору экзамена; страница экзамена на wspell ведёт на официальные источники.

SAA-C03: нужен ли аккаунт для практики?

Нет. Тест на странице «SAA-C03» работает без аккаунта (все 83 набора), а ссылка тренировки начинает курс за вас тем же нажатием. Бесплатный аккаунт сохраняет прогресс и позволяет пройти пробный экзамен.

Названия экзаменов и товарные знаки на этой странице принадлежат организациям, которые владеют этими экзаменами и проводят их. wspell — независимая платформа, не связанная ни с одной из этих организаций и не одобренная ими.

начать практику →