AWS SAA-C03: Solutions Architect Associate Practice Exam

What the AWS SAA-C03 exam covers

• Design Secure Architectures202 questions
• Design Resilient Architectures176 questions
• Design High-Performing Architectures158 questions
• Design Cost-Optimized Architectures138 questions

Free AWS SAA-C03 practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 674-question bank.

1. Question 1Design Secure Architectures

   A financial services company stores sensitive customer documents in Amazon S3. A recent compliance audit requires that all objects be encrypted at rest using keys managed by the company's security team, with full control over key rotation schedules and the ability to audit key usage. The company also needs to disable keys immediately if a breach is suspected. Which encryption approach meets these requirements?

   • AImplement client-side encryption using the AWS Encryption SDK with keys stored in AWS Secrets Manager
   • BEnable SSE-S3 default encryption on the S3 bucket
   • CEnable SSE-KMS encryption using an AWS managed key (aws/s3)
   • DEnable SSE-KMS encryption using a customer managed key (CMK) in AWS KMSCorrect
   ✓ Correct answer: D

   A customer managed KMS key provides the company with full control over key rotation schedules, audit trails of key usage, and the ability to disable the key immediately during a suspected breach. Unlike AWS managed keys (aws/s3), CMKs allow organizations to define their own key rotation policies and access the AWS CloudTrail logs that record every time the key is used. The compliance audit specifically requires company control, which only a CMK provides.

   Why the other options are wrong

   • AImplement client-side encryption using the AWS Encryption SDK with keys stored in AWS Secrets Manager is incorrect because Secrets Manager is not designed for managing CMKs and does not provide the same audit capabilities or immediate key disabling functionality required by the compliance framework.
   • BEnable SSE-S3 default encryption on the S3 bucket is incorrect because SSE-S3 uses AWS-managed keys that the company cannot control, rotate on their own schedule, or disable independently.
   • Cenable SSE-KMS encryption using an AWS managed key (aws/s3) is incorrect because AWS managed keys do not allow the company to control key rotation schedules or immediately disable the key if a breach is suspected.
2. Question 2Design Secure Architectures

   StellarTech operates EC2 instances in private subnets that need to access AWS Systems Manager for patch management. The company's security policy prohibits any internet access from the private subnets, including through NAT gateways. How should the solutions architect provide access to Systems Manager?

   • AConfigure a forward proxy server in a public subnet to relay all of the private instances' Systems Manager traffic out to the service on their behalf.
   • BInstall the SSM Agent on each instance and configure it to route its control-plane calls through an S3 bucket acting as an intermediary for the traffic.
   • CCreate VPC interface endpoints (PrivateLink) for ssm, ssmmessages, and ec2messages.Correct
   • DDeploy a NAT instance in a public subnet and allow only the Systems Manager service endpoints outbound in that NAT instance's security group rules.
   ✓ Correct answer: C

   AWS PrivateLink interface endpoints create an elastic network interface inside the VPC that routes traffic to the Systems Manager service endpoints over the private AWS network, with no internet connectivity required. Three endpoints are needed for full SSM Session Manager and patch management functionality: com.amazonaws.<region>.ssm, com.amazonaws.<region>.ssmmessages, and com.amazonaws.<region>.ec2messages. This satisfies the policy that prohibits any internet access including NAT gateways.

   Why the other options are wrong

   • AA proxy server in a public subnet still routes traffic through the internet gateway on the outbound leg, which violates the security policy prohibiting internet access from private subnets.
   • BThe SSM Agent does not support S3 as an intermediary for its control-plane API calls; SSM requires direct HTTPS connectivity to its service endpoints, which is what VPC endpoints provide.
   • DA NAT instance in a public subnet routes traffic to the internet before reaching AWS service endpoints, which violates the company's prohibition on any internet access from private subnets.
3. Question 3Design Resilient ArchitecturesSelect all that apply

   RapidScale Technologies needs to deploy a highly available web application across multiple Availability Zones. The application uses an Application Load Balancer and Auto Scaling. Which THREE configurations are essential for achieving high availability? (Select THREE.)

   • ASet the minimum capacity of the Auto Scaling group to at least 2 instances.Correct
   • BConfigure the ALB to use a single Availability Zone for simplified management.
   • CConfigure the Auto Scaling group to span at least two Availability Zones.Correct
   • DConfigure ALB health checks to route traffic only to healthy instances.Correct
   • EUse a single large instance type instead of multiple smaller instances.
   ✓ Correct answer: A, C, D

   A minimum of two instances in the Auto Scaling group ensures capacity survives one failure. Spreading the group across Availability Zones survives a single-AZ failure. Load balancer health checks route traffic only to instances that pass them. Together, these three provide high availability.

   Why the other options are wrong

   • BConfigure the ALB to use a single Availability Zone for simplified management is incorrect because single-AZ is not highly available.
   • EUse a single large instance type instead of multiple smaller instances is incorrect because a single large instance has a single point of failure.
4. Question 4Design High-Performing Architectures

   A company has a multi-Region architecture with application servers in us-east-1 and eu-west-1. The application uses Amazon DynamoDB and must provide single-digit millisecond read performance in both Regions. Data written in one Region must be available in the other Region within seconds. Which DynamoDB feature should the solutions architect use?

   • ADynamoDB Streams with a Lambda function to replicate data.
   • BDynamoDB Global Tables.Correct
   • CDynamoDB on-demand backups restored in the second Region.
   • DDynamoDB with a DAX cluster in each Region reading from a single-Region table.
   ✓ Correct answer: B

   DynamoDB Global Tables is a fully managed multi-Region, multi-active replication feature. It automatically replicates data across selected AWS Regions using DynamoDB Streams under the hood, achieving typically sub-second replication latency between regions. Each replica is a full active table, so reads and writes in both us-east-1 and eu-west-1 achieve single-digit millisecond performance without any custom replication logic.

   Why the other options are wrong

   • ADynamoDB Streams with a Lambda function to replicate data is essentially what Global Tables does internally, but building it manually introduces operational complexity, potential replication lag, and conflict resolution challenges that Global Tables handles automatically.
   • CDynamoDB on-demand backups are point-in-time snapshots for disaster recovery purposes - restoring a backup in a second Region creates a static copy at a point in time and does not provide ongoing synchronization.
   • DDAX clusters provide in-memory caching for reads in a single Region, but a DAX cluster reading from a single-Region table means eu-west-1 reads would cross the Atlantic to the source table, adding significant latency rather than reducing it.
5. Question 5Design High-Performing Architectures

   What does Amazon Kinesis Data Streams provide?

   • AReal-time streaming data ingestion and processingCorrect
   • BDurable static object and file storage
   • CScheduled batch data processing
   • DManaged transactional email delivery
   ✓ Correct answer: A

   Amazon Kinesis Data Streams is a scalable and durable real-time streaming data service that captures gigabytes of data per second from thousands of sources. Producers such as web applications, IoT devices, and log agents write records to shards, and consumers like Lambda, Amazon Managed Service for Apache Flink, or custom applications process the records in real time - enabling use cases like real-time dashboards, anomaly detection, and dynamic pricing.

   Why the other options are wrong

   • BDurable object and file storage is the role of Amazon S3, not Kinesis Data Streams.
   • CScheduled batch processing is handled by services like AWS Batch or EMR, not the real-time Kinesis Data Streams.
   • DTransactional email delivery is provided by Amazon SES, not Kinesis Data Streams.
6. Question 6Design Cost-Optimized Architectures

   A data lake stores 500 TB of data in Amazon S3. Analysts run ad-hoc SQL queries against this data about once per week. Which querying approach is most cost-effective?

   • ALoad all data into Amazon Redshift and keep the cluster running
   • BCopy data to Amazon RDS for SQL querying
   • CUse Amazon Athena to query data directly in S3, paying only per queryCorrect
   • DDeploy a Hadoop cluster on EC2 instances for querying
   ✓ Correct answer: C

   Amazon Athena enables querying data directly in S3 using standard SQL without requiring data movement or cluster provisioning. Cost is based only on data scanned, not on cluster provisioning or running time. For infrequent ad-hoc queries against large data lakes, Athena is significantly more cost-effective than maintaining dedicated analytical infrastructure.

   Why the other options are wrong

   • ALoad all data into Amazon Redshift and keep the cluster running is incorrect because maintaining provisioned clusters 24/7 incurs constant costs even during idle periods.
   • BCopying 500 TB into Amazon RDS means paying for that storage and a running instance continuously, and RDS is sized for transactional workloads rather than scans of a data lake, so the weekly ad-hoc queries would be both slow and expensive.
   • DDeploy a Hadoop cluster on EC2 instances for querying is incorrect because maintaining dedicated clusters requires provisioning, management, and idle time costs.
7. Question 7Design Secure Architectures

   A mobile application needs to let end users sign in with their existing Google, Facebook, or Apple accounts, and then call an API backed by API Gateway and Lambda. The company wants a managed service to handle user authentication and to issue tokens the API can validate, without building its own identity store. Which service should the architect use?

   • AAmazon Cognito user pools with federated identity providersCorrect
   • BAWS IAM Identity Center for workforce single sign-on to AWS accounts
   • CCreate an IAM user for each end user and distribute access keys
   • DAWS Directory Service for Microsoft Active Directory
   ✓ Correct answer: A

   A Cognito user pool provides a managed user directory that can federate Google, Facebook, and Apple sign-in. After authentication it issues JWT tokens that API Gateway can validate with a Cognito authorizer before invoking Lambda. This removes the need to build a custom identity store.

   Why the other options are wrong

   • BIAM Identity Center is for workforce single sign-on to AWS accounts and business apps, not for consumer app end-user sign-in.
   • CIAM users and access keys are for AWS principals, do not scale to app end users, and cannot federate social logins.
   • DDirectory Service provides managed Active Directory for enterprise workloads, not consumer social federation for a mobile app.
8. Question 8Design Secure Architectures

   A company wants to provide temporary, time-limited download access to a single private S3 object for an external user who has no AWS account. Which mechanism is most appropriate?

   • AGenerate an S3 pre-signed URL with a short expirationCorrect
   • BMake the object public with a bucket ACL
   • CCreate an IAM user for the external person
   • DAdd the external user's email to the bucket policy
   ✓ Correct answer: A

   A pre-signed URL embeds the signature of an authorized principal and an expiration time, letting anyone with the URL perform the specific operation (such as GET) on the object until it expires. This is ideal for one-off external downloads without provisioning accounts.

   Why the other options are wrong

   • BMaking the object public exposes it indefinitely to everyone, not time-limited access.
   • CCreating an IAM user for a one-time external download is heavyweight and not best practice.
   • DBucket policies identify AWS principals or conditions, not arbitrary email addresses of users without AWS accounts.
9. Question 9Design Resilient ArchitecturesSelect all that apply

   A company is building a serverless API that must remain available even if an entire AWS Region becomes unavailable. Which TWO capabilities help achieve multi-Region resilience for this API? (Choose two.)

   • ADeploy API Gateway and Lambda in two Regions with Route 53 failover or health-checked routing.Correct
   • BUse Amazon DynamoDB global tables to replicate the data layer across the two RegionsCorrect
   • CEnable provisioned concurrency on the Lambda functions in a single Region to cut cold starts.
   • DIncrease the API Gateway throttling burst limit in the primary Region to handle more traffic.
   ✓ Correct answer: A, B

   Running API Gateway and Lambda in a second Region with Route 53 health-checked or failover routing lets traffic shift away from a failed Region, while DynamoDB global tables keep the data layer replicated and writable in each Region. Together they enable the API to survive a full regional outage.

   Why the other options are wrong

   • CProvisioned concurrency improves cold-start latency in a single Region but offers no protection if that Region fails.
   • DRaising throttling limits affects request capacity, not regional availability or failover.
10. Question 10Design Cost-Optimized Architectures

    A company has provisioned 100 EBS gp2 volumes for general-purpose workloads. After review, they find most volumes never exceed the baseline IOPS that gp3 provides at lower cost, and gp3 also allows independent IOPS and throughput tuning. What is the most cost-effective action?

    • AMigrate the gp2 volumes to gp3 volumesCorrect
    • BMigrate the gp2 volumes to io2 Block Express volumes
    • CTake snapshots and delete the volumes to save cost
    • DMigrate the volumes to Throughput Optimized HDD (st1)
    ✓ Correct answer: A

    gp3 is roughly 20% cheaper per GB than gp2 and decouples performance from volume size, so workloads that fit within its baseline performance see immediate savings. The migration can be done in place via volume modification with no downtime, directly addressing the over-paying scenario.

    Why the other options are wrong

    • Bio2 Block Express is a high-performance, higher-cost class meant for mission-critical I/O-intensive databases, not for cost reduction.
    • CDeleting volumes that are in active use would break the workloads; the goal is cost optimization, not data loss.
    • Dst1 is HDD-backed for large sequential workloads and cannot meet random-access general-purpose performance needs.

Who this AWS SAA-C03 practice exam is for

This practice set is for anyone preparing for the AWS SAA-C03: Solutions Architect Associate exam at the intermediate level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS SAA-C03 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS SAA-C03 exam.

Related AWS resources

• AWS SAA-C03 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Best AWS SAA-C03 Practice Exams (2026)Comparison
• AWS CLF-C02 vs SAA-C03Comparison
• AWS SAA-C03 vs DVA-C02Comparison
• AWS SAA-C03 vs SAP-C02Comparison
• Design Secure Architectures practice questions202 questions
• Design Resilient Architectures practice questions176 questions
• Design High-Performing Architectures practice questions158 questions
• Design Cost-Optimized Architectures practice questions138 questions
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS Certified CloudOps Engineer - Associate (SOA-C03) practice examRelated

AWS SAA-C03 practice exam FAQ