AWS SAP-C03: Solutions Architect Professional Practice Exam

What the AWS SAP-C03 exam covers

• Architecture Design and Implementation Built for the Cloud226 questions
• Security, Compliance, and Governance167 questions
• Cost-Optimized Architecture Design98 questions
• Resilience, Migration, and Business Continuity120 questions
• Operational Excellence and Automation70 questions

Free AWS SAP-C03 practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 681-question bank.

1. Question 1Security, Compliance, and Governance

   Which AWS service lets you centrally govern many accounts and apply guardrails that RESTRICT the maximum permissions in member accounts?

   • AAmazon Inspector
   • BIAM groups in a single account
   • CSecurity groups
   • DAWS Organizations with SCPsCorrect
   ✓ Correct answer: D

   AWS Organizations with Service Control Policies is the governance layer for a multi-account estate. An SCP attached to the root or to an organizational unit sets the maximum permissions any principal in a member account can ever hold, so even an account administrator cannot exceed the guardrail. SCPs filter permissions and never grant them, so each account still needs its own IAM policies.

   Why the other options are wrong

   • AAmazon Inspector scans EC2 instances, container images and Lambda functions for software vulnerabilities and unintended network exposure. It reports findings and can cap nothing that a member account's principals are permitted to do.
   • BIAM groups attach policies to users inside one account only, so they cannot reach the other member accounts, and a group grants permissions rather than setting a ceiling an account administrator is unable to exceed.
   • CSecurity groups are stateful virtual firewalls that filter network traffic to and from an elastic network interface. They govern packets, not API permissions, so they place no limit on which actions an account may call.
2. Question 2Architecture Design and Implementation Built for the Cloud

   Which approach decouples a producer from a slower consumer to absorb spikes?

   • AIncrease the producer instance size only
   • BPlace an SQS queue between themCorrect
   • CDisable retries
   • DCall the consumer synchronously
   ✓ Correct answer: B

   An SQS queue between the two components turns a spike into a backlog. The producer enqueues at its own pace, messages are stored durably for up to fourteen days, and the consumer pulls only as many as it can handle. Visibility timeout and a dead-letter queue stop failed messages from being lost or retried forever.

   Why the other options are wrong

   • AIncreasing the producer instance size makes the producer faster, which pushes even more load at the consumer that is already the bottleneck.
   • CDisabling retries means work the slower consumer could not take is simply lost, which hides the spike by dropping requests rather than absorbing them.
   • DCalling the consumer synchronously couples the two tightly, so the producer blocks at the consumer's pace and a spike turns straight into timeouts.
3. Question 3Resilience, Migration, and Business ContinuitySelect all that apply

   An existing single-Region, three-tier application must be improved to meet an RTO of minutes and an RPO of seconds against a full-Region outage, while controlling cost. Which TWO measures together best achieve this? (Choose TWO)

   • ARun an identical full-scale active-active deployment across four Regions regardless of the cost involved
   • BTake weekly EBS snapshots as the only recovery mechanism
   • CDeploy a warm standby in a second Region with a scaled-down but running stack ready to scale up on failoverCorrect
   • DUse cross-Region data replication (e.g., Aurora Global Database or DynamoDB Global Tables) to keep RPO lowCorrect
   ✓ Correct answer: C, D

   An RTO of minutes needs compute already running in the second Region, which is what a scaled-down warm standby provides: the stack is live and only has to be scaled up with traffic pointed at it. An RPO of seconds needs continuous data replication, supplied by Aurora Global Database or DynamoDB global tables. Neither measure on its own meets both targets.

   Why the other options are wrong

   • AA full-scale active-active deployment across four Regions would meet both targets, but the requirement is explicit that cost has to be controlled, and this pays for three idle copies of production to get there.
   • BA weekly EBS snapshot leaves up to a week of writes unprotected, so the recovery point is measured in days rather than seconds, and restoring from it takes far longer than minutes.
4. Question 4Cost-Optimized Architecture Design

   A high-traffic website serves the same dynamic API responses to many users for short periods. The team wants to reduce origin load and latency at lowest incremental cost. Which approach is best?

   • AMove the origin servers onto Dedicated Hosts to increase capacity
   • BPlace Amazon CloudFront in front of the origin and cache responsesCorrect
   • CVertically scale the origin database to the largest available instance type
   • DAdd more On-Demand EC2 origin instances and keep them running permanently
   ✓ Correct answer: B

   Placing Amazon CloudFront in front of the origin and configuring a short TTL for dynamic API responses allows CloudFront edge locations to serve repeated requests for the same response from cache, dramatically reducing the number of requests reaching the origin. Even a 10-60 second TTL absorbs a large fraction of traffic during high-traffic periods for responses that many users request simultaneously, lowering origin compute load and response latency at minimal incremental cost.

   Why the other options are wrong

   • ADedicated Hosts raise cost without caching repeated responses, so origin load and latency are not reduced.
   • CScaling the database up does not cache repeated identical responses and adds significant ongoing cost.
   • DPermanently adding On-Demand origins increases cost and still serves every request from the origin.
5. Question 5Security, Compliance, and Governance

   During migration, an application moving to AWS must continue authenticating users against the company's existing on-premises Active Directory with minimal changes, and AWS-side resources (e.g., EC2 Windows instances) should join that directory. Which service supports this with a trust to on-prem AD?

   • AAmazon Cognito user pools federated to the on-prem Active Directory
   • BAWS Directory Service for Microsoft Active DirectoryCorrect
   • CAWS Directory Service Simple AD with a forest trust to on-prem AD
   • DAD Connector proxying authentication without joining Windows instances
   ✓ Correct answer: B

   AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) runs actual Microsoft AD domain controllers in AWS managed by AWS. Establishing a forest or external trust between AWS Managed Microsoft AD and the on-premises AD domain allows EC2 Windows instances to domain-join the AWS directory while still authenticating users from the on-premises domain through the trust. This enables seamless single sign-on, Group Policy application, and Kerberos authentication with minimal application changes.

   Why the other options are wrong

   • ACognito user pools handle app sign-in and cannot let Windows EC2 instances domain-join or trust on-prem AD.
   • CSimple AD is a Samba-based directory that does not support establishing a trust relationship with an on-prem AD.
   • DAD Connector only proxies authentication to on-prem AD and does not let AWS resources domain-join a managed directory.
6. Question 6Architecture Design and Implementation Built for the Cloud

   An existing AWS Lambda function processes S3 event notifications and occasionally hits the 15-minute execution limit for large files. The team wants to refactor to remove the timeout constraint without changing the trigger mechanism. Which architectural change achieves this?

   • AIncrease Lambda memory to the maximum (10,240 MB) to speed up processing and avoid the timeout.
   • BHave the Lambda function start an AWS Fargate task (or ECS task) passing the S3 object key, and return immediately.Correct
   • CConfigure the Lambda function as a destination for the S3 event and add a 15-minute SQS visibility timeout to delay retries.
   • DEnable Lambda Provisioned Concurrency to reduce cold starts and ensure the function always finishes within the time limit.
   ✓ Correct answer: B

   Lambda's maximum execution duration is 15 minutes and cannot be extended. The standard pattern for processing that may exceed this limit is to have Lambda act as a lightweight orchestrator: receive the S3 event, extract the object key, submit an ECS/Fargate task (via RunTask) or an AWS Batch job with the work parameters, and return. Fargate tasks have no execution time limit and can run as long as needed.

   Why the other options are wrong

   • AIncreasing memory also increases CPU proportionally and may speed up processing, but it does not raise the 15-minute hard timeout ceiling - files that inherently require more than 15 minutes to process will still fail.
   • CSQS visibility timeout controls how long a message is hidden during processing - it does not extend Lambda's execution limit, and setting it to 15 minutes does not help if the Lambda itself times out before finishing.
   • DProvisioned Concurrency eliminates cold start latency by keeping instances initialized - it does not change the 15-minute maximum execution duration limit.
7. Question 7Security, Compliance, and Governance

   A company uses IAM Identity Center for workforce access. They must ensure that the same set of permissions is consistently applied to a group of users across 50 accounts, and that updates to those permissions propagate automatically. Which Identity Center construct should they use?

   • AA permission set assigned to the group across the target accountsCorrect
   • BAn inline IAM policy duplicated in each account
   • CA separate IAM user in each account synchronized via SCIM
   • DA resource-based policy on each account's resources
   ✓ Correct answer: A

   Permission sets define a collection of policies that Identity Center provisions as IAM roles in each assigned account. Assigning a permission set to a group across accounts ensures consistency, and editing the permission set re-provisions the roles automatically across all assigned accounts.

   Why the other options are wrong

   • BDuplicated inline IAM policies are not centrally managed and drift over time.
   • CIAM users per account contradict the federated model and do not auto-propagate permission changes.
   • DResource-based policies grant access to specific resources, not consistent workforce permissions across accounts.
8. Question 8Architecture Design and Implementation Built for the Cloud

   A new global API must present a single static anycast IP address to clients and route each request to the nearest healthy AWS Region, providing fast failover at the network edge for a TCP application fronted by Network Load Balancers. Which service should the architect place in front of the regional endpoints?

   • AAmazon CloudFront
   • BAWS Global AcceleratorCorrect
   • CRoute 53 latency-based routing
   • DAmazon API Gateway edge-optimized endpoint
   ✓ Correct answer: B

   Global Accelerator assigns two static anycast IP addresses and uses the AWS global network to direct clients to the optimal healthy endpoint, performing near-instant failover based on health checks. It is the correct choice for non-HTTP TCP applications behind NLBs that need fixed entry IPs.

   Why the other options are wrong

   • ACloudFront is a content delivery network optimized for HTTP/HTTPS and does not provide static anycast IPs for arbitrary TCP applications.
   • CRoute 53 latency routing relies on DNS and is subject to client DNS caching, giving slower failover and no static IP.
   • DAn edge-optimized API Gateway endpoint targets HTTP APIs and does not present static anycast IPs for an NLB-based TCP service.
9. Question 9Architecture Design and Implementation Built for the Cloud

   A global application uses Amazon DynamoDB in a single Region. The business now requires multi-Region active-active writes with conflict resolution and an RPO measured in seconds. Which change best satisfies this requirement?

   • AEnable DynamoDB global tables across the required RegionsCorrect
   • BSchedule hourly on-demand backups and copy them to a second Region
   • CEnable point-in-time recovery on the existing single-Region table
   • DUse DynamoDB Accelerator (DAX) in front of the table
   ✓ Correct answer: A

   Global tables replicate data asynchronously across selected Regions, allowing reads and writes in every Region with built-in last-writer-wins conflict resolution and typically sub-second replication latency, meeting an active-active, seconds-level RPO requirement.

   Why the other options are wrong

   • BHourly backup copies give an RPO of up to an hour and provide no active-active write capability.
   • CPITR enables restore to a past point within one Region; it does not add multi-Region active-active writes.
   • DDAX is an in-memory read cache and does nothing for cross-Region replication or write availability.
10. Question 10Cost-Optimized Architecture Design

    A company's existing Amazon DynamoDB table backs a feature with unpredictable, spiky traffic and frequent long idle periods. It is provisioned with high RCUs/WCUs to avoid throttling, leading to wasted spend. Which change reduces cost while preventing throttling during spikes?

    • ASwitch the table to on-demand (pay-per-request) capacity modeCorrect
    • BReduce provisioned capacity and add a DAX cluster in front
    • CEnable auto scaling with a low minimum and high maximum on provisioned capacity
    • DConvert the table to DynamoDB Standard-IA table class
    ✓ Correct answer: A

    On-demand mode removes capacity planning, instantly accommodates spikes without throttling, and charges only for actual reads/writes, eliminating waste during long idle periods. This directly addresses both cost and throttling.

    Why the other options are wrong

    • BDAX accelerates reads but does not address write throttling or the cost of over-provisioning, and adds its own cost.
    • CAuto scaling reacts on a delay and can still throttle during sudden spikes; on-demand handles abrupt bursts better for truly unpredictable traffic.
    • DThe Standard-IA table class lowers storage cost for infrequently accessed data, not request/throughput cost for spiky traffic.

Who this AWS SAP-C03 practice exam is for

This practice set is for anyone preparing for the AWS SAP-C03: Solutions Architect Professional exam at the advanced level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS SAP-C03 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS SAP-C03 exam.

Related AWS resources

• AWS SAP-C03 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• AWS SAA-C03 vs SAP-C03Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS Certified CloudOps Engineer - Associate (SOA-C03) practice examRelated

AWS SAP-C03 practice exam FAQ