AWS Certified Solutions Architect - Associate (SAA-C03) practice questions

Domain coverage 4 domains

• Design Secure Architectures (30%)
• Design Resilient Architectures (26%)
• Design High-Performing Architectures (24%)
• Design Cost-Optimized Architectures (20%)

Sample questions 12 of 120 shown

1. Q1 Design Secure Architectures (30%)

   A company is deploying a web application that requires encryption of data at rest for compliance purposes. The application uses Amazon S3 to store user documents. Which approach provides server-side encryption with the LEAST operational overhead?

   1. Enable Amazon S3 server-side encryption with Amazon S3-managed keys (SSE-S3)
   2. Enable Amazon S3 server-side encryption with AWS KMS keys (SSE-KMS) and create a custom KMS key
   3. Implement client-side encryption using AWS Encryption SDK before uploading to S3
   4. Use Amazon S3 server-side encryption with customer-provided keys (SSE-C)

   SSE-S3 uses keys fully managed by AWS with zero operational overhead — just enable it and S3 handles everything. SSE-KMS provides more control (key rotation, audit trail) but adds management overhead. SSE-C requires you to manage and provide keys with every request. Client-side encryption requires application changes. For least operational overhead, SSE-S3 is the answer.
2. Q2 Design Secure Architectures (30%)

   A company needs to grant temporary access to external auditors to view specific S3 bucket contents without creating permanent IAM users. What is the MOST secure approach?

   1. Create IAM roles with appropriate permissions and provide temporary security credentials using AWS STS
   2. Create IAM users with passwords and delete them after the audit
   3. Make the S3 bucket public with a time-limited bucket policy
   4. Share the root account credentials with the auditors

   AWS STS (Security Token Service) with IAM roles provides temporary, time-limited credentials for external access. The IAM role has a trust policy allowing the auditor's AWS account to assume it. Temporary credentials auto-expire. Creating IAM users adds permanent accounts to manage. Making buckets public is a security risk. Sharing root credentials should never happen.
3. Q3 Design Secure Architectures (30%)

   A company runs a data analytics application on EC2 instances that needs to access S3 buckets. What is the MOST secure way to grant the EC2 instances access to S3?

   1. Create an IAM role with S3 permissions and attach it to the EC2 instances
   2. Store AWS access keys in the application configuration file on the EC2 instances
   3. Create an IAM user and store the credentials in AWS Systems Manager Parameter Store
   4. Use S3 bucket policies to allow access from the EC2 instance IP addresses

   IAM roles for EC2 provide temporary credentials automatically rotated by the instance metadata service — no key management needed. Storing access keys on instances (Option B) is a security anti-pattern. IAM users with stored credentials (Option C) can be leaked. IP-based access control (Option D) is fragile (IPs change) and less secure than IAM.
4. Q4 Design Secure Architectures (30%)

   A company needs to ensure all EBS volumes are encrypted and maintain control over encryption keys, including key rotation. Which solution meets these requirements?

   1. Use EBS encryption with AWS KMS customer managed keys (CMKs)
   2. Use EBS encryption with AWS managed keys
   3. Enable EBS encryption with Amazon S3-managed keys
   4. Implement application-level encryption before writing data to EBS

   AWS KMS customer managed keys (CMKs) give you full control — create, rotate, disable, and audit key usage via CloudTrail. AWS managed keys (Option B) automatically rotate but you don't control the key lifecycle. S3-managed keys (Option C) don't exist for EBS. Application-level encryption (Option D) requires application changes and you'd still need key management.
5. Q5 Design Secure Architectures (30%)

   A financial services company must ensure S3 buckets are never publicly accessible and wants to prevent accidental public exposure. Which combination provides defense in depth?

   1. Enable S3 Block Public Access at the account level and use AWS Config rules to detect non-compliant buckets
   2. Use S3 bucket policies to deny public access only
   3. Enable S3 Block Public Access at the bucket level only
   4. Use IAM policies to restrict who can modify bucket permissions

   Account-level Block Public Access prevents any bucket from being made public. AWS Config rules (like s3-bucket-public-read-prohibited) detect violations if someone bypasses BPA or adjusts settings. Together they provide defense in depth — preventive (BPA) and detective (Config). Bucket-level only (Option C) requires per-bucket configuration. IAM policies (Option D) control who can modify permissions but don't prevent misconfigurations.
6. Q6 Design Secure Architectures (30%)

   A company has a VPC with private subnets containing EC2 instances that need to access S3 and DynamoDB without traversing the internet. What solution should they implement?

   1. Create VPC Gateway Endpoints for S3 and DynamoDB
   2. Set up a NAT Gateway in a public subnet
   3. Configure an Internet Gateway and use security groups
   4. Use AWS PrivateLink for all AWS service connections

   Gateway Endpoints provide private, free access to S3 and DynamoDB from VPC resources. They use route table entries (not ENIs) and keep traffic on the AWS backbone. NAT Gateway (Option B) routes through the internet. Internet Gateway (Option C) exposes traffic. PrivateLink (Option D) creates Interface Endpoints (ENI-based) which cost money — Gateway Endpoints are the right choice for S3/DynamoDB specifically.
7. Q7 Design Secure Architectures (30%)

   A company is migrating their on-premises Active Directory to AWS. They need on-premises users to access AWS resources using existing AD credentials with federation to the AWS Console and CLI. What solution provides this?

   1. AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) with AWS IAM Identity Center for federation
   2. Migrate all users to IAM users and use IAM policies
   3. Use Amazon Cognito User Pools to store Active Directory credentials
   4. Install Active Directory on EC2 instances and use IAM database authentication

   AWS Managed Microsoft AD provides a managed Active Directory in AWS. IAM Identity Center (formerly AWS SSO) enables federation — users authenticate with AD and receive temporary AWS credentials through SAML 2.0. This preserves existing AD investment. Migrating to IAM users (Option B) is manual and doesn't federate. Cognito (Option C) is for customer-facing apps, not workforce federation.
8. Q8 Design Secure Architectures (30%)

   A solutions architect needs to control traffic between tiers of a three-tier web application. The web tier should only accept HTTP/HTTPS, the application tier should only accept traffic from the web tier, and the database tier should only accept traffic from the application tier. What should they use?

   1. Security groups with rules referencing other security groups as sources
   2. Network ACLs with allow/deny rules
   3. A single security group applied to all tiers
   4. IAM policies restricting network access

   Security groups support referencing other security groups as sources. Create: web-sg (allows 0.0.0.0/0:443), app-sg (allows web-sg:8080), db-sg (allows app-sg:3306). Security groups are stateful — return traffic automatically flows. NACLs (Option B) are stateless and require managing ephemeral ports. A single SG (Option C) can't enforce tier-specific rules.
9. Q9 Design Secure Architectures (30%)

   Which AWS service helps detect when an S3 bucket policy or ACL grants public access to a bucket?

   1. IAM Access Analyzer
   2. Amazon GuardDuty
   3. AWS Shield
   4. AWS Trusted Advisor

   IAM Access Analyzer continuously monitors resource policies and generates findings when resources (S3 buckets, IAM roles, KMS keys, Lambda functions) are shared with external entities. It identifies unintended public or cross-account access. GuardDuty (Option B) detects threats. Shield (Option C) provides DDoS protection. Trusted Advisor (Option D) has some S3 checks but Access Analyzer is purpose-built for this.
10. Q10 Design Secure Architectures (30%)

    What is the primary difference between an IAM role and an IAM user?

    1. IAM users have permanent long-term credentials; IAM roles provide temporary credentials assumed by trusted entities
    2. IAM roles can only be used by EC2 instances
    3. IAM users can't access S3
    4. IAM roles require Multi-Factor Authentication

    IAM users have permanent credentials (password/access keys). IAM roles provide temporary credentials via STS with automatic rotation. This is the fundamental security advantage of roles — no long-lived credentials to manage, leak, or rotate. Roles can be assumed by many entities (EC2, Lambda, cross-account, federated users). Neither users nor roles inherently require MFA (Option D) — MFA is an additional authentication factor.
11. Q11 Design Secure Architectures (30%)

    A company must ensure API calls to all AWS services are logged for auditing. Which service should be enabled?

    1. AWS CloudTrail with a multi-region trail and log file validation
    2. Amazon CloudWatch Logs
    3. VPC Flow Logs
    4. AWS Config

    AWS CloudTrail records all API calls (who, what, when, from where) across AWS services. Create a multi-region trail to capture events from all regions into a single S3 bucket. Enable log file validation for integrity. CloudWatch Logs (Option B) stores application logs. VPC Flow Logs (Option C) capture network traffic metadata. AWS Config (Option D) records resource configurations and compliance.
12. Q12 Design Secure Architectures (30%)

    How can you enforce that developers cannot create S3 buckets without encryption enabled?

    1. Use AWS Organizations Service Control Policies (SCPs) to deny s3:CreateBucket unless encryption parameters are specified
    2. Send weekly email reminders about encryption
    3. Check CloudTrail logs and ask developers to fix non-compliant buckets
    4. Rely on default S3 encryption settings only

    SCPs at the AWS Organizations level can enforce preventive controls — deny the s3:CreateBucket API call unless the request includes encryption configuration. This is enforced at the API level, not advisory. Default encryption (Option D) is a safety net but doesn't prevent developers from overriding it. Email reminders and log checks are detective, not preventive.

Answer all 120 questions with instant feedback →

Reader reviews 419 ratings

• I bought the SAA-C03 question bank a week before my exam and passed with 90%+. The questions are that good.

  ★★★★★ Maria V.

• I studied for SAA-C03 with this bank and passed comfortably. The questions are well-organized and the UI is clean.

  ★★★★★★ Lauren C.

• Used the SAA-C03 test bank for two weeks before my exam date. Felt very prepared going in and the results showed.

  ★★★★★★ Luke M.

• Had to renew my SAA-C03 certification and used this to refresh. Way more efficient than re-reading the official study guide.

  ★★★★★★ Leo D.

• I was struggling with SAA-C03 until I found this. The domain-based organization and instant feedback helped me identify weak areas quickly.

  ★★★★★★ David L.

• I liked how the SAA-C03 questions are tied to specific domains from the official exam guide. Made studying much more structured.

  ★★★★★★ Joseph L.

Frequently asked questions

Free study resources

Community-verified analysis of 351 questions from real test-taker discussions — 155 deep analyses and 0 FAQs.

More Amazon exams