AWS SAA-C03: Solutions Architect Associate Practice Exam

What the AWS SAA-C03 exam covers

• Design Secure Architectures202 questions
• Design Resilient Architectures176 questions
• Design High-Performing Architectures159 questions
• Design Cost-Optimized Architectures138 questions

Free AWS SAA-C03 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 675.

1. Question 1Design Secure Architectures

   A financial services company stores sensitive customer documents in Amazon S3. A recent compliance audit requires that all objects be encrypted at rest using keys managed by the company's security team, with full control over key rotation schedules and the ability to audit key usage. The company also needs to disable keys immediately if a breach is suspected. Which encryption approach meets these requirements?

   • AImplement client-side encryption using the AWS Encryption SDK with keys stored in AWS Secrets Manager
   • BEnable SSE-S3 default encryption on the S3 bucket
   • CEnable SSE-KMS encryption using an AWS managed key (aws/s3)
   • DEnable SSE-KMS encryption using a customer managed key (CMK) in AWS KMSCorrect
   ✓ Correct answer: D

   A customer managed KMS key provides the company with full control over key rotation schedules, audit trails of key usage, and the ability to disable the key immediately during a suspected breach. Unlike AWS managed keys (aws/s3), CMKs allow organizations to define their own key rotation policies and access the AWS CloudTrail logs that record every time the key is used. The compliance audit specifically requires company control, which only a CMK provides.

   Why the other options are wrong

   • AImplement client-side encryption using the AWS Encryption SDK with keys stored in AWS Secrets Manager is incorrect because Secrets Manager is not designed for managing CMKs and does not provide the same audit capabilities or immediate key disabling functionality required by the compliance framework.
   • BEnable SSE-S3 default encryption on the S3 bucket is incorrect because SSE-S3 uses AWS-managed keys that the company cannot control, rotate on their own schedule, or disable independently.
   • Cenable SSE-KMS encryption using an AWS managed key (aws/s3) is incorrect because AWS managed keys do not allow the company to control key rotation schedules or immediately disable the key if a breach is suspected.
2. Question 2Design Secure Architectures

   StellarTech operates EC2 instances in private subnets that need to access AWS Systems Manager for patch management. The company's security policy prohibits any internet access from the private subnets, including through NAT gateways. How should the solutions architect provide access to Systems Manager?

   • AConfigure a forward proxy server in a public subnet to relay all of the private instances' Systems Manager traffic out to the service on their behalf.
   • BInstall the SSM Agent on each instance and configure it to route its control-plane calls through an S3 bucket acting as an intermediary for the traffic.
   • CCreate VPC interface endpoints (PrivateLink) for ssm, ssmmessages, and ec2messages.Correct
   • DDeploy a NAT instance in a public subnet and allow only the Systems Manager service endpoints outbound in that NAT instance's security group rules.
   ✓ Correct answer: C

   AWS PrivateLink interface endpoints create an elastic network interface inside the VPC that routes traffic to the Systems Manager service endpoints over the private AWS network, with no internet connectivity required. Three endpoints are needed for full SSM Session Manager and patch management functionality: com.amazonaws.<region>.ssm, com.amazonaws.<region>.ssmmessages, and com.amazonaws.<region>.ec2messages. This satisfies the policy that prohibits any internet access including NAT gateways.

   Why the other options are wrong

   • AA proxy server in a public subnet still routes traffic through the internet gateway on the outbound leg, which violates the security policy prohibiting internet access from private subnets.
   • BThe SSM Agent does not support S3 as an intermediary for its control-plane API calls; SSM requires direct HTTPS connectivity to its service endpoints, which is what VPC endpoints provide.
   • DA NAT instance in a public subnet routes traffic to the internet before reaching AWS service endpoints, which violates the company's prohibition on any internet access from private subnets.
3. Question 3Design Resilient ArchitecturesSelect all that apply

   RapidScale Technologies needs to deploy a highly available web application across multiple Availability Zones. The application uses an Application Load Balancer and Auto Scaling. Which THREE configurations are essential for achieving high availability? (Select THREE.)

   • ASet the minimum capacity of the Auto Scaling group to at least 2 instances.Correct
   • BConfigure the ALB to use a single Availability Zone for simplified management.
   • CConfigure the Auto Scaling group to span at least two Availability Zones.Correct
   • DConfigure ALB health checks to route traffic only to healthy instances.Correct
   • EUse a single large instance type instead of multiple smaller instances.
   ✓ Correct answer: A, C, D

   Option A ensures at least 2 instances are always running (assuming 1 can fail). Option C spreads instances across AZs to survive single-AZ failure. Option D routes traffic only to instances that pass health checks. Together, these three provide high availability.

   Why the other options are wrong

   • BConfigure the ALB to use a single Availability Zone for simplified management is incorrect because single-AZ is not highly available.
   • EUse a single large instance type instead of multiple smaller instances is incorrect because a single large instance has a single point of failure.
4. Question 4Design High-Performing Architectures

   A company has a multi-Region architecture with application servers in us-east-1 and eu-west-1. The application uses Amazon DynamoDB and must provide single-digit millisecond read performance in both Regions. Data written in one Region must be available in the other Region within seconds. Which DynamoDB feature should the solutions architect use?

   • ADynamoDB Streams with a Lambda function to replicate data.
   • BDynamoDB Global Tables.Correct
   • CDynamoDB on-demand backups restored in the second Region.
   • DDynamoDB with a DAX cluster in each Region reading from a single-Region table.
   ✓ Correct answer: B

   DynamoDB Global Tables is a fully managed multi-Region, multi-active replication feature. It automatically replicates data across selected AWS Regions using DynamoDB Streams under the hood, achieving typically sub-second replication latency between regions. Each replica is a full active table, so reads and writes in both us-east-1 and eu-west-1 achieve single-digit millisecond performance without any custom replication logic.

   Why the other options are wrong

   • ADynamoDB Streams with a Lambda function to replicate data is essentially what Global Tables does internally, but building it manually introduces operational complexity, potential replication lag, and conflict resolution challenges that Global Tables handles automatically.
   • CDynamoDB on-demand backups are point-in-time snapshots for disaster recovery purposes - restoring a backup in a second Region creates a static copy at a point in time and does not provide ongoing synchronization.
   • DDAX clusters provide in-memory caching for reads in a single Region, but a DAX cluster reading from a single-Region table means eu-west-1 reads would cross the Atlantic to the source table, adding significant latency rather than reducing it.
5. Question 5Design High-Performing Architectures

   Which EBS volume type provides the highest IOPS for transaction-intensive workloads?

   • Aio2 Block ExpressCorrect
   • Bsc1
   • Cst1
   • Dgp3 (General Purpose SSD, up to 16,000 IOPS)
   ✓ Correct answer: A

   Amazon EBS io2 Block Express is the highest-performance EBS volume type, supporting up to 256,000 IOPS per volume and sub-millisecond I/O latency. It is built on the next-generation EBS architecture and designed for the most demanding I/O-intensive workloads such as large relational or NoSQL databases, SAP HANA, and critical business applications requiring consistent high IOPS.

   Why the other options are wrong

   • Bsc1 (Cold HDD) is the lowest-cost EBS volume type optimized for infrequently accessed, large sequential workloads; it delivers low IOPS and is not suitable for transaction-intensive databases.
   • Cst1 (Throughput Optimized HDD) is designed for frequently accessed, large sequential workloads like data warehouses and log processing, providing high throughput but low IOPS compared to SSD-backed volumes.
   • Dgp3 is a general-purpose SSD volume supporting up to 16,000 IOPS, suitable for most workloads; however, io2 Block Express delivers significantly higher IOPS for the most demanding transaction-intensive applications.
6. Question 6Design Cost-Optimized Architectures

   A company uses Amazon EC2 instances for a stateless web application. They have predictable baseline traffic with occasional unpredictable spikes. Which combination of purchasing options provides the best cost optimization?

   • AAll Reserved Instances sized for the peak capacity of the workload
   • BAll Spot Instances covering the entire application workload end to end
   • CAll On-Demand Instances covering the entire application workload
   • DSavings Plans for baseline, On-Demand or Spot for spikesCorrect
   ✓ Correct answer: D

   Matching purchasing options to traffic patterns is the cost-optimization principle here. A Compute Savings Plan discounts the steady baseline usage that is always present, while On-Demand or Spot handles the occasional spikes without a long-term commitment. This blends deep discounts on predictable load with elastic capacity for bursts, minimizing overall spend.

   Why the other options are wrong

   • AReserving for peak pays for the maximum capacity around the clock, so the reserved headroom sits idle and wasted during normal baseline traffic.
   • BAll Spot risks capacity reclamation that could take down the steady baseline, and Spot is unreliable for the always-needed portion of the workload.
   • CAll On-Demand pays full price for the predictable baseline, missing the substantial discount a Savings Plan provides for that steady usage.
7. Question 7Design Secure Architectures

   A mobile application needs to let end users sign in with their existing Google, Facebook, or Apple accounts, and then call an API backed by API Gateway and Lambda. The company wants a managed service to handle user authentication and to issue tokens the API can validate, without building its own identity store. Which service should the architect use?

   • AAmazon Cognito user pools with federated identity providersCorrect
   • BAWS IAM Identity Center for workforce single sign-on to AWS accounts
   • CCreate an IAM user for each end user and distribute access keys
   • DAWS Directory Service for Microsoft Active Directory
   ✓ Correct answer: A

   A Cognito user pool provides a managed user directory that can federate Google, Facebook, and Apple sign-in. After authentication it issues JWT tokens that API Gateway can validate with a Cognito authorizer before invoking Lambda. This removes the need to build a custom identity store.

   Why the other options are wrong

   • BIAM Identity Center is for workforce single sign-on to AWS accounts and business apps, not for consumer app end-user sign-in.
   • CIAM users and access keys are for AWS principals, do not scale to app end users, and cannot federate social logins.
   • DDirectory Service provides managed Active Directory for enterprise workloads, not consumer social federation for a mobile app.
8. Question 8Design Secure Architectures

   A company wants to provide temporary, time-limited download access to a single private S3 object for an external user who has no AWS account. Which mechanism is most appropriate?

   • AGenerate an S3 pre-signed URL with a short expirationCorrect
   • BMake the object public with a bucket ACL
   • CCreate an IAM user for the external person
   • DAdd the external user's email to the bucket policy
   ✓ Correct answer: A

   A pre-signed URL embeds the signature of an authorized principal and an expiration time, letting anyone with the URL perform the specific operation (such as GET) on the object until it expires. This is ideal for one-off external downloads without provisioning accounts.

   Why the other options are wrong

   • BMaking the object public exposes it indefinitely to everyone, not time-limited access.
   • CCreating an IAM user for a one-time external download is heavyweight and not best practice.
   • DBucket policies identify AWS principals or conditions, not arbitrary email addresses of users without AWS accounts.
9. Question 9Design Resilient ArchitecturesSelect all that apply

   A company is building a serverless API that must remain available even if an entire AWS Region becomes unavailable. Which TWO capabilities help achieve multi-Region resilience for this API? (Choose two.)

   • ADeploy API Gateway and Lambda in two Regions with Route 53 failover or health-checked routing.Correct
   • BUse Amazon DynamoDB global tables to replicate the data layer across the two RegionsCorrect
   • CEnable provisioned concurrency on the Lambda functions in a single Region to cut cold starts.
   • DIncrease the API Gateway throttling burst limit in the primary Region to handle more traffic.
   ✓ Correct answer: A, B

   Running API Gateway and Lambda in a second Region with Route 53 health-checked or failover routing lets traffic shift away from a failed Region, while DynamoDB global tables keep the data layer replicated and writable in each Region. Together they enable the API to survive a full regional outage.

   Why the other options are wrong

   • CProvisioned concurrency improves cold-start latency in a single Region but offers no protection if that Region fails.
   • DRaising throttling limits affects request capacity, not regional availability or failover.
10. Question 10Design Cost-Optimized Architectures

    A company has provisioned 100 EBS gp2 volumes for general-purpose workloads. After review, they find most volumes never exceed the baseline IOPS that gp3 provides at lower cost, and gp3 also allows independent IOPS and throughput tuning. What is the most cost-effective action?

    • AMigrate the gp2 volumes to gp3 volumesCorrect
    • BMigrate the gp2 volumes to io2 Block Express volumes
    • CTake snapshots and delete the volumes to save cost
    • DMigrate the volumes to Throughput Optimized HDD (st1)
    ✓ Correct answer: A

    gp3 is roughly 20% cheaper per GB than gp2 and decouples performance from volume size, so workloads that fit within its baseline performance see immediate savings. The migration can be done in place via volume modification with no downtime, directly addressing the over-paying scenario.

    Why the other options are wrong

    • Bio2 Block Express is a high-performance, higher-cost class meant for mission-critical I/O-intensive databases, not for cost reduction.
    • CDeleting volumes that are in active use would break the workloads; the goal is cost optimization, not data loss.
    • Dst1 is HDD-backed for large sequential workloads and cannot meet random-access general-purpose performance needs.

Who this AWS SAA-C03 practice exam is for

This practice set is for anyone preparing for the AWS SAA-C03: Solutions Architect Associate exam at the intermediate level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS SAA-C03 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS SAA-C03 exam.

Related AWS resources

• AWS SAA-C03 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Best AWS SAA-C03 Practice Exams (2026)Comparison
• AWS CLF-C02 vs SAA-C03Comparison
• AWS SAA-C03 vs DVA-C02Comparison
• AWS SAA-C03 vs SAP-C02Comparison
• Design Secure Architectures practice questions202 questions
• Design Resilient Architectures practice questions176 questions
• Design High-Performing Architectures practice questions159 questions
• Design Cost-Optimized Architectures practice questions138 questions
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AWS SAP-C02 practice examRelated
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated

AWS SAA-C03 practice exam FAQ