SAA-C03 — AWS Certified Solutions Architect - Associate
Amazon

AWS Certified Solutions Architect - Associate (SAA-C03) Practice Questions

★★★★★★ 4.9 404 verified reviews
120 questions
June 10, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Design Secure Architectures (30%)
  • Design Resilient Architectures (26%)
  • Design High-Performing Architectures (24%)
  • Design Cost-Optimized Architectures (20%)

Sample Questions (12 of 120 shown)

Q1 Design Secure Architectures (30%)
A company is deploying a web application that requires encryption of data at rest for compliance purposes. The application uses Amazon S3 to store user documents. Which approach provides server-side encryption with the LEAST operational overhead?
  1. Enable Amazon S3 server-side encryption with Amazon S3-managed keys (SSE-S3)
  2. Enable Amazon S3 server-side encryption with AWS KMS keys (SSE-KMS) and create a custom KMS key
  3. Implement client-side encryption using AWS Encryption SDK before uploading to S3
  4. Use Amazon S3 server-side encryption with customer-provided keys (SSE-C)
✓ Correct Answer: A
SSE-S3 uses keys fully managed by AWS with zero operational overhead — just enable it and S3 handles everything. SSE-KMS provides more control (key rotation, audit trail) but adds management overhead. SSE-C requires you to manage and provide keys with every request. Client-side encryption requires application changes. For least operational overhead, SSE-S3 is the answer.
Q2 Design Secure Architectures (30%)
A company needs to grant temporary access to external auditors to view specific S3 bucket contents without creating permanent IAM users. What is the MOST secure approach?
  1. Create IAM roles with appropriate permissions and provide temporary security credentials using AWS STS
  2. Create IAM users with passwords and delete them after the audit
  3. Make the S3 bucket public with a time-limited bucket policy
  4. Share the root account credentials with the auditors
✓ Correct Answer: A
AWS STS (Security Token Service) with IAM roles provides temporary, time-limited credentials for external access. The IAM role has a trust policy allowing the auditor's AWS account to assume it. Temporary credentials auto-expire. Creating IAM users adds permanent accounts to manage. Making buckets public is a security risk. Sharing root credentials should never happen.
Q3 Design Secure Architectures (30%)
A company runs a data analytics application on EC2 instances that needs to access S3 buckets. What is the MOST secure way to grant the EC2 instances access to S3?
  1. Create an IAM role with S3 permissions and attach it to the EC2 instances
  2. Store AWS access keys in the application configuration file on the EC2 instances
  3. Create an IAM user and store the credentials in AWS Systems Manager Parameter Store
  4. Use S3 bucket policies to allow access from the EC2 instance IP addresses
✓ Correct Answer: A
IAM roles for EC2 provide temporary credentials automatically rotated by the instance metadata service — no key management needed. Storing access keys on instances (Option B) is a security anti-pattern. IAM users with stored credentials (Option C) can be leaked. IP-based access control (Option D) is fragile (IPs change) and less secure than IAM.
Q4 Design Secure Architectures (30%)
A company needs to ensure all EBS volumes are encrypted and maintain control over encryption keys, including key rotation. Which solution meets these requirements?
  1. Use EBS encryption with AWS KMS customer managed keys (CMKs)
  2. Use EBS encryption with AWS managed keys
  3. Enable EBS encryption with Amazon S3-managed keys
  4. Implement application-level encryption before writing data to EBS
✓ Correct Answer: A
AWS KMS customer managed keys (CMKs) give you full control — create, rotate, disable, and audit key usage via CloudTrail. AWS managed keys (Option B) automatically rotate but you don't control the key lifecycle. S3-managed keys (Option C) don't exist for EBS. Application-level encryption (Option D) requires application changes and you'd still need key management.
Q5 Design Secure Architectures (30%)
A financial services company must ensure S3 buckets are never publicly accessible and wants to prevent accidental public exposure. Which combination provides defense in depth?
  1. Enable S3 Block Public Access at the account level and use AWS Config rules to detect non-compliant buckets
  2. Use S3 bucket policies to deny public access only
  3. Enable S3 Block Public Access at the bucket level only
  4. Use IAM policies to restrict who can modify bucket permissions
✓ Correct Answer: A
Account-level Block Public Access prevents any bucket from being made public. AWS Config rules (like s3-bucket-public-read-prohibited) detect violations if someone bypasses BPA or adjusts settings. Together they provide defense in depth — preventive (BPA) and detective (Config). Bucket-level only (Option C) requires per-bucket configuration. IAM policies (Option D) control who can modify permissions but don't prevent misconfigurations.
Q6 Design Secure Architectures (30%)
A company has a VPC with private subnets containing EC2 instances that need to access S3 and DynamoDB without traversing the internet. What solution should they implement?
  1. Create VPC Gateway Endpoints for S3 and DynamoDB
  2. Set up a NAT Gateway in a public subnet
  3. Configure an Internet Gateway and use security groups
  4. Use AWS PrivateLink for all AWS service connections
✓ Correct Answer: A
Gateway Endpoints provide private, free access to S3 and DynamoDB from VPC resources. They use route table entries (not ENIs) and keep traffic on the AWS backbone. NAT Gateway (Option B) routes through the internet. Internet Gateway (Option C) exposes traffic. PrivateLink (Option D) creates Interface Endpoints (ENI-based) which cost money — Gateway Endpoints are the right choice for S3/DynamoDB specifically.
Q7 Design Secure Architectures (30%)
A company is migrating their on-premises Active Directory to AWS. They need on-premises users to access AWS resources using existing AD credentials with federation to the AWS Console and CLI. What solution provides this?
  1. AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) with AWS IAM Identity Center for federation
  2. Migrate all users to IAM users and use IAM policies
  3. Use Amazon Cognito User Pools to store Active Directory credentials
  4. Install Active Directory on EC2 instances and use IAM database authentication
✓ Correct Answer: A
AWS Managed Microsoft AD provides a managed Active Directory in AWS. IAM Identity Center (formerly AWS SSO) enables federation — users authenticate with AD and receive temporary AWS credentials through SAML 2.0. This preserves existing AD investment. Migrating to IAM users (Option B) is manual and doesn't federate. Cognito (Option C) is for customer-facing apps, not workforce federation.
Q8 Design Secure Architectures (30%)
A solutions architect needs to control traffic between tiers of a three-tier web application. The web tier should only accept HTTP/HTTPS, the application tier should only accept traffic from the web tier, and the database tier should only accept traffic from the application tier. What should they use?
  1. Security groups with rules referencing other security groups as sources
  2. Network ACLs with allow/deny rules
  3. A single security group applied to all tiers
  4. IAM policies restricting network access
✓ Correct Answer: A
Security groups support referencing other security groups as sources. Create: web-sg (allows 0.0.0.0/0:443), app-sg (allows web-sg:8080), db-sg (allows app-sg:3306). Security groups are stateful — return traffic automatically flows. NACLs (Option B) are stateless and require managing ephemeral ports. A single SG (Option C) can't enforce tier-specific rules.
Q9 Design Secure Architectures (30%)
Which AWS service helps detect when an S3 bucket policy or ACL grants public access to a bucket?
  1. IAM Access Analyzer
  2. Amazon GuardDuty
  3. AWS Shield
  4. AWS Trusted Advisor
✓ Correct Answer: A
IAM Access Analyzer continuously monitors resource policies and generates findings when resources (S3 buckets, IAM roles, KMS keys, Lambda functions) are shared with external entities. It identifies unintended public or cross-account access. GuardDuty (Option B) detects threats. Shield (Option C) provides DDoS protection. Trusted Advisor (Option D) has some S3 checks but Access Analyzer is purpose-built for this.
Q10 Design Secure Architectures (30%)
What is the primary difference between an IAM role and an IAM user?
  1. IAM users have permanent long-term credentials; IAM roles provide temporary credentials assumed by trusted entities
  2. IAM roles can only be used by EC2 instances
  3. IAM users can't access S3
  4. IAM roles require Multi-Factor Authentication
✓ Correct Answer: A
IAM users have permanent credentials (password/access keys). IAM roles provide temporary credentials via STS with automatic rotation. This is the fundamental security advantage of roles — no long-lived credentials to manage, leak, or rotate. Roles can be assumed by many entities (EC2, Lambda, cross-account, federated users). Neither users nor roles inherently require MFA (Option D) — MFA is an additional authentication factor.
Q11 Design Secure Architectures (30%)
A company must ensure API calls to all AWS services are logged for auditing. Which service should be enabled?
  1. AWS CloudTrail with a multi-region trail and log file validation
  2. Amazon CloudWatch Logs
  3. VPC Flow Logs
  4. AWS Config
✓ Correct Answer: A
AWS CloudTrail records all API calls (who, what, when, from where) across AWS services. Create a multi-region trail to capture events from all regions into a single S3 bucket. Enable log file validation for integrity. CloudWatch Logs (Option B) stores application logs. VPC Flow Logs (Option C) capture network traffic metadata. AWS Config (Option D) records resource configurations and compliance.
Q12 Design Secure Architectures (30%)
How can you enforce that developers cannot create S3 buckets without encryption enabled?
  1. Use AWS Organizations Service Control Policies (SCPs) to deny s3:CreateBucket unless encryption parameters are specified
  2. Send weekly email reminders about encryption
  3. Check CloudTrail logs and ask developers to fix non-compliant buckets
  4. Rely on default S3 encryption settings only
✓ Correct Answer: A
SCPs at the AWS Organizations level can enforce preventive controls — deny the s3:CreateBucket API call unless the request includes encryption configuration. This is enforced at the API level, not advisory. Default encryption (Option D) is a safety net but doesn't prevent developers from overriding it. Email reminders and log checks are detective, not preventive.

You've viewed 3 of 120 questions. Start the free practice exam to answer all questions with instant feedback.

What Our Customers Say 404 verified reviews

4.9 ★★★★★★ Based on 404 reviews
★★★★★★
The SAA-C03 explanations are where this really stands out. Not just which answer is right but WHY the others are wrong.
— Aria H.
★★★★★★
I let my coworker borrow my SAA-C03 account to study — he passed too. These questions are legit.
— Grayson P.
★★★★★★
Solid prep material for SAA-C03. The questions feel like they were written by someone who actually teaches this stuff.
— Brooklyn T.
★★★★★★
I liked how the SAA-C03 questions are tied to specific domains from the official exam guide. Made studying much more structured.
— Joseph L.
★★★★★★
The SAA-C03 practice exam was crucial to my success. The domains map perfectly to the official exam blueprint.
— Jennifer F.
★★★★★★
I liked that the SAA-C03 questions update regularly. Felt current and aligned with what I actually saw on the test.
— Dylan P.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

The SAA-C03 is widely regarded as the cornerstone AWS certification because it covers the broadest range of AWS services and architectural patterns across compute, storage, database, networking, security, and cost optimization. Unlike specialized certifications that focus on specific domains (developer, DevOps, data engineering), the Solutions Architect - Associate provides a comprehensive foundation applicable to virtually all cloud roles. Many employers list SAA-C03 as a prerequisite for cloud architecture, engineering, and consulting positions. It also serves as a prerequisite for Professional-level certifications (SAP-C02) and many Specialty certifications.

Each Associate certification has a distinct focus: SAA-C03 (Solutions Architect) focuses on designing architectures across all AWS services considering the Well-Architected Framework pillars; DVA-C02 (Developer) focuses on building applications using AWS SDKs, Lambda, and CI/CD; SOA-C03 (SysOps Administrator) focuses on operating and managing AWS workloads; DEA-C01 (Data Engineer) focuses on building and operating data pipelines; and MLA-C01 (ML Engineer) focuses on ML engineering with SageMaker. SAA-C03 is the broadest and most architecture-focused — think of it as the "big picture" certification, while the others dive deep into specific job roles.

The SAA-C03 is a challenging exam for beginners but manageable with structured preparation. AWS recommends at least 1 year of hands-on experience designing cloud solutions. The exam requires you to understand detailed service capabilities, make architectural tradeoff decisions, and select optimal solutions from multiple plausible options — often with subtle differences. Candidates without AWS experience typically need 3-4 months of dedicated study (120-160 hours). Our practice tests are designed to build your architectural decision-making skills progressively, regardless of your starting level.

Our product delivers 500+ practice questions organized across all four domains with accurate weightings. Each question includes detailed explanations that explain the correct answer and why each distractor is wrong — building the architectural thinking needed for real-world solution design. You get full-length simulation exams (65 questions, 130 minutes), domain-wise practice modules covering security, resilience, performance, and cost optimization, and a downloadable PDF study guide featuring AWS service comparison tables, Well-Architected Framework review checklists, and architecture decision trees for rapid offline review.

Study time varies by experience. Candidates with 1+ year of AWS hands-on experience typically need 6-8 weeks (80-100 hours). Those with general IT experience but new to AWS may need 10-14 weeks (120-160 hours). We recommend: (1) Review the official exam guide and in-scope services list; (2) Complete AWS Skill Builder's SAA-C03 Exam Prep digital course; (3) Build hands-on experience with core AWS services (EC2, S3, RDS, VPC, IAM); (4) Use our practice tests for domain-wise assessment; (5) Take full-length simulation exams to build time management; (6) Focus final review on weaker domains using our PDF study guide.

The exam covers over 100 AWS services, but some are critical: Compute — EC2 (all instance families, purchasing options), Lambda, Auto Scaling, ELB; Storage — S3 (classes, lifecycle, versioning, encryption), EBS, EFS, S3 Glacier; Database — RDS, Aurora, DynamoDB, ElastiCache, Redshift; Networking — VPC (subnets, route tables, NAT, endpoints, peering, Transit Gateway), CloudFront, Route 53, Direct Connect, VPN; Security — IAM, KMS, Cognito, WAF, Shield, GuardDuty; Integration — SQS, SNS, Step Functions, EventBridge, API Gateway. You should understand when to use each service and how services combine to solve architectural challenges.

The SAA-C03 is consistently ranked among the highest-paying and most in-demand IT certifications globally. Certified professionals are positioned for roles such as Solutions Architect, Cloud Architect, Cloud Consultant, Infrastructure Architect, and Technical Lead. The certification demonstrates comprehensive AWS knowledge and architectural design skills, making it a powerful career accelerator. It also unlocks the AWS Certified Solutions Architect - Professional (SAP-C02) path and provides discounts on subsequent AWS exams. Many certified professionals report significant salary increases and broader job opportunities after earning this credential.

Free Study Resources

Community-verified analysis of 335 topics from real test-taker discussions — 42 deep analyses and 0 FAQs.

Full Study Guide 335 topics, exam overview & domain breakdown Most Debated Topics Ranked by community disagreement