AWS SAA-C03: Solutions Architect Associate Practice Exam

What the AWS SAA-C03 exam covers

• Design Secure Architectures195 questions
• Design Resilient Architectures169 questions
• Design High-Performing Architectures153 questions
• Design Cost-Optimized Architectures133 questions

Free AWS SAA-C03 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 650.

1. Question 1Design Secure Architectures

   A financial services company stores sensitive customer documents in Amazon S3. A recent compliance audit requires that all objects be encrypted at rest using keys managed by the company's security team, with full control over key rotation schedules and the ability to audit key usage. The company also needs to disable keys immediately if a breach is suspected. Which encryption approach meets these requirements?

   • AImplement client-side encryption using the AWS Encryption SDK with keys stored in AWS Secrets Manager
   • BEnable SSE-S3 default encryption on the S3 bucket
   • CEnable SSE-KMS encryption using an AWS managed key (aws/s3)
   • DEnable SSE-KMS encryption using a customer managed key (CMK) in AWS KMSCorrect
   ✓ Correct answer: D

   A customer managed KMS key provides the company with full control over key rotation schedules, audit trails of key usage, and the ability to disable the key immediately during a suspected breach. Unlike AWS managed keys (aws/s3), CMKs allow organizations to define their own key rotation policies and access the AWS CloudTrail logs that record every time the key is used. The compliance audit specifically requires company control, which only a CMK provides.

   Why the other options are wrong

   • AImplement client-side encryption using the AWS Encryption SDK with keys stored in AWS Secrets Manager is incorrect because Secrets Manager is not designed for managing CMKs and does not provide the same audit capabilities or immediate key disabling functionality required by the compliance framework.
   • BEnable SSE-S3 default encryption on the S3 bucket is incorrect because SSE-S3 uses AWS-managed keys that the company cannot control, rotate on their own schedule, or disable independently.
   • Cenable SSE-KMS encryption using an AWS managed key (aws/s3) is incorrect because AWS managed keys do not allow the company to control key rotation schedules or immediately disable the key if a breach is suspected.
2. Question 2Design Secure ArchitecturesSelect all that apply

   A solutions architect must ensure that an Amazon S3 bucket used for storing compliance documents meets the following requirements: (1) all objects must be encrypted at rest with a customer managed KMS key, (2) any unencrypted upload attempts must be denied, and (3) the bucket must not be publicly accessible under any circumstances. Which THREE actions should the architect take? (Select THREE.)

   • AConfigure a bucket policy that denies s3:PutObject requests that do not include the x-amz-server-side-encryption header with the value aws:kms.Correct
   • BEnable S3 Block Public Access at the account level and the bucket level.Correct
   • CEnable Amazon Macie to automatically detect and classify the compliance documents.
   • DSet the default encryption on the bucket to SSE-KMS with the customer managed key.Correct
   • EConfigure a bucket policy that allows s3:GetObject for the principal *.
   • FEnable S3 Versioning on the bucket to prevent unauthorized modifications.
   ✓ Correct answer: A, B, D

   Option A forces any upload without KMS encryption to be denied at the API level. Option B prevents any public access configuration changes and blocks all public access. Option D ensures all objects are encrypted by default. Together, these three controls ensure encryption is mandatory, public access is impossible, and the bucket policy enforces encryption on every upload attempt.

   Why the other options are wrong

   • CEnable Amazon Macie to automatically detect and classify the compliance documents is incorrect because Macie is for data discovery and classification, not for enforcing encryption or preventing public access.
   • EConfigure a bucket policy that allows s3:GetObject for the principal * is incorrect because this allows public access, directly violating the requirement.
   • FEnable S3 Versioning on the bucket to prevent unauthorized modifications is incorrect because versioning allows recovery from accidental deletion but doesn't prevent public access or enforce encryption.
3. Question 3Design Resilient Architectures

   A company runs an Amazon RDS Multi-AZ deployment. How is the standby instance kept up to date with the primary?

   • AAsynchronous replication that may lag behind the primary during peak load.
   • BSynchronous replication that commits writes to the standby before acknowledging.Correct
   • CScheduled snapshots copied to the standby instance every few minutes.
   • DThe standby serves read traffic and replicates its changes back to the primary.
   ✓ Correct answer: B

   In a Multi-AZ deployment, every committed write is synchronously replicated to a standby in a different Availability Zone before it is acknowledged, ensuring no data loss on failover. If the primary fails, RDS automatically promotes the standby and updates the DNS endpoint. The standby does not serve read traffic.

   Why the other options are wrong

   • AMulti-AZ uses synchronous replication, not asynchronous replication that can lag.
   • CReplication is continuous and synchronous, not periodic snapshot copies.
   • DThe Multi-AZ standby is for failover only and does not serve reads.
4. Question 4Design High-Performing ArchitecturesSelect all that apply

   A company is designing a new architecture for a high-traffic API that must handle 100,000 requests per second with sub-10ms response times. The API reads data from a key-value store. Which TWO design choices help achieve this performance target? (Select TWO.)

   • AUse Amazon ElastiCache for Redis as a caching layer for the key-value data.Correct
   • BUse Amazon DynamoDB with DynamoDB Accelerator (DAX) for microsecond read latency.Correct
   • CUse Amazon API Gateway with edge-optimized endpoints.
   • DUse Amazon RDS for PostgreSQL with a db.r5.xlarge instance.
   • EUse AWS Lambda with provisioned concurrency to eliminate cold starts.
   ✓ Correct answer: A, B

   Achieving 100,000 requests per second with sub-10ms response times requires in-memory data access. ElastiCache for Redis delivers microsecond read latency at massive scale for key-value workloads, while DynamoDB with DAX (DynamoDB Accelerator) adds an in-memory caching layer directly in front of DynamoDB that reduces read latency from single-digit milliseconds to microseconds. Both options are designed for extreme throughput with key-value access patterns.

   Why the other options are wrong

   • CAmazon API Gateway with edge-optimized endpoints reduces geographic routing latency for API calls but does not address the data-layer read performance needed to hit sub-10ms response times at 100,000 RPS.
   • DAmazon RDS for PostgreSQL, even on a db.r5.xlarge, is a relational database limited by connection counts and single-node I/O - it cannot sustain 100,000 requests per second with sub-10ms latency.
   • EAWS Lambda with provisioned concurrency eliminates cold starts in the compute layer but does not reduce data-layer latency - the bottleneck for key-value read performance is at the database, not the function invocation overhead.
5. Question 5Design High-Performing Architectures

   A company needs to ensure that their ALB-fronted application can handle sudden traffic spikes from 1,000 to 100,000 concurrent users within minutes. The application is stateless and runs on EC2 instances. Which Auto Scaling policy type responds fastest to sudden spikes?

   • AScheduled scaling at specific times of day
   • BTarget tracking scaling with a target of 70% average CPU utilization
   • CStep scaling with CloudWatch alarms based on ALB request countCorrect
   • DSimple scaling with a cooldown period of 300 seconds
   ✓ Correct answer: C

   Step scaling policies trigger immediately when a CloudWatch alarm breaches a threshold and add capacity in defined steps based on the magnitude of the alarm breach. By using ALB request count as the metric, the policy reacts to the actual incoming request load rather than a lagging indicator like CPU. This allows the Auto Scaling group to scale out rapidly in response to sudden traffic spikes, faster than target tracking (which smooths over short bursts) or simple scaling (which waits for a cooldown period).

   Why the other options are wrong

   • AScheduled scaling at specific times of day requires knowing when spikes will occur in advance; it cannot respond to unexpected sudden spikes that arise outside the scheduled windows.
   • BTarget tracking scaling with CPU utilization reacts to CPU rising after the spike has already begun processing requests, introducing a lag before new instances are provisioned and causing slower initial response.
   • DSimple scaling with a 300-second cooldown waits for the full cooldown period after each scaling action before evaluating whether more capacity is needed, making it the slowest policy for responding to rapid traffic surges.
6. Question 6Design Cost-Optimized Architectures

   WiseByte Technologies has a data warehouse on Amazon Redshift that runs complex analytical queries. The cluster is active only during business hours on weekdays. On weekends, no queries are run. How can the architect optimize costs?

   • AUse Redshift Serverless and pay only for compute used by queries.Correct
   • BRun the analytical queries directly on S3 using Amazon EMR clusters kept running permanently.
   • CMigrate the data warehouse from Redshift to Amazon RDS for the analytical queries.
   • DKeep the provisioned Redshift cluster running 24/7 and cover it with Reserved Nodes.
   ✓ Correct answer: A

   Redshift Serverless automatically provisions and scales data-warehouse capacity and bills only for the compute consumed while queries run. Because the cluster is active only during weekday business hours and idle on weekends, Serverless removes the cost of idle provisioned capacity without requiring any change to the analytical query patterns.

   Why the other options are wrong

   • BA permanently running EMR cluster incurs continuous cost even when idle on weekends, so it does not save money over the current setup and adds operational overhead.
   • CRDS is an OLTP database not built for complex data-warehouse analytics, so migrating there would hurt query performance rather than optimize cost.
   • DReserved Nodes discount 24/7 usage, but the cluster is idle evenings and weekends, so paying for full-time capacity leaves most of it wasted.
7. Question 7Design High-Performing Architectures

   A data pipeline must ingest a continuous high-volume stream of clickstream events from thousands of sources and allow multiple downstream applications to process the same events in real time and replay them for up to 24 hours. Which AWS service best fits these requirements?

   • AAmazon Kinesis Data StreamsCorrect
   • BAmazon SQS standard queue
   • CAmazon SNS standard topic
   • DAmazon MQ broker
   ✓ Correct answer: A

   Kinesis Data Streams ingests high-volume, real-time streaming data and retains records so multiple consumer applications can independently read the same stream and replay records within the retention window, which defaults to 24 hours. This matches the clickstream fan-out and reprocessing requirements. It is purpose-built for ordered, high-throughput event streaming.

   Why the other options are wrong

   • BAn SQS standard queue deletes a message once consumed and does not support replay or multiple independent readers of the same message.
   • CSNS pushes messages to subscribers with no retention or replay capability.
   • DAmazon MQ suits migrating existing message brokers, not high-scale streaming with replay.
8. Question 8Design Secure Architectures

   A solutions architect needs an immutable retention control on S3 objects so that compliance records cannot be deleted or modified by anyone, including the account root, for a fixed period. Which feature should be configured?

   • AS3 Versioning alone
   • BS3 Object Lock in Compliance mode with a retention periodCorrect
   • CS3 Lifecycle policy transitioning to Glacier
   • DMFA Delete on the bucket
   ✓ Correct answer: B

   Object Lock Compliance mode prevents any user, including the account root, from overwriting or deleting a locked object version until the retention period expires. This provides write-once-read-many (WORM) protection required for regulatory record-keeping.

   Why the other options are wrong

   • AVersioning preserves prior versions but does not prevent deletion or enforce retention.
   • CLifecycle transitions change storage class and can even expire objects; they do not enforce immutability.
   • DMFA Delete adds a step to delete operations but can still be bypassed by privileged users and is not a WORM control.
9. Question 9Design Resilient Architectures

   A SaaS provider runs an internal microservice on Amazon EC2 instances behind a Network Load Balancer (NLB). The architecture team wants the NLB to automatically stop routing traffic to instances that are running but have an unhealthy application process, and to do so based on an HTTP path that returns the application status. Which configuration achieves this?

   • AEnable cross-zone load balancing on the NLB and rely on its default TCP connectivity checks
   • BConfigure the NLB target group with an HTTP health check pointing to the application status pathCorrect
   • CAttach an Amazon Route 53 health check to each EC2 instance's private IP address
   • DReplace the NLB with an EC2 instance running HAProxy that performs HTTP checks
   ✓ Correct answer: B

   Network Load Balancers support TCP, HTTP, and HTTPS health checks. By selecting an HTTP health check and specifying the application status path, the NLB will mark targets unhealthy when the application process fails even if the TCP port is still open, and it will stop routing new connections to them.

   Why the other options are wrong

   • ADefault TCP checks only verify port connectivity, not the application-level status path, so an unhealthy application process would still receive traffic.
   • CRoute 53 health checks operate at the DNS level and cannot remove individual targets from an NLB target group.
   • DReplacing a managed, highly available NLB with a single HAProxy instance introduces a single point of failure and unnecessary operational overhead.
10. Question 10Design High-Performing Architectures

    A startup runs a serverless backend with AWS Lambda functions that connect to an Amazon RDS for MySQL database. During traffic spikes, the database reports 'too many connections' errors because thousands of concurrent Lambda invocations each open a database connection. Which AWS feature directly resolves the connection exhaustion with minimal code changes?

    • AAmazon RDS ProxyCorrect
    • BLambda reserved concurrency set to a fixed low value
    • CA larger RDS instance class with more vCPUs
    • DAmazon ElastiCache for Memcached in front of the database
    ✓ Correct answer: A

    RDS Proxy maintains a pool of established connections and multiplexes the many short-lived Lambda connections onto a smaller set of database connections. This eliminates 'too many connections' errors during spikes and requires only repointing the connection endpoint, with minimal code change.

    Why the other options are wrong

    • BCapping reserved concurrency throttles the application and increases latency rather than properly scaling the connection layer.
    • CA larger instance raises the max_connections ceiling somewhat but does not fundamentally pool connections and is far less efficient than RDS Proxy.
    • DMemcached caches query results but does not manage or pool the database connections that are being exhausted.

Related AWS resources

• AWS SAA-C03 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS CLF-C02 practice examRelated

AWS SAA-C03 practice exam FAQ