AWS Certified Solutions Architect - Associate (SAA-C03) Practice Exam
Unlock your potential with the AWS Certified Solutions Architect - Associate Practice Exam Simulator. This comprehensive tool is designed to prepare you thoroughly and assess your readiness for the most sought-after AWS associate certification.
Exam domains
The SAA-C03 questions are grouped into 4 domains divided into 14 tasks.
SAA-C03 example questions
One example question per domain from the SAA-C03 question bank, with the correct answer and its explanation. Sign in to the simulator to answer them with all answer options.
A company uses a customer managed symmetric AWS KMS key to encrypt sensitive application records. An application uses an IAM role to call the KMS Decrypt API directly. The role's identity-based policy allows kms:Decrypt on the key, but requests fail with AccessDeniedException. The key policy grants a security administrator role permission to manage the key. It does not grant cryptographic permissions, enable IAM policies to authorize key access, or name the application role. No KMS grants or explicit denies apply. The company must allow the application to decrypt records without allowing it to administer the key or allowing the security administrator to decrypt records. Which change meets these requirements?
Show answer
CORRECT ANSWERAdd a statement to the key policy that allows the application role to perform kms:Decrypt, leaving the administrator's existing permissions unchanged.
A KMS key policy can directly authorize an IAM role in the same account to use the key. Granting only kms:Decrypt to the application role enables the required operation while preserving the separation between key administration and cryptographic use.
An engineering company receives diagnostic bundles that contain 5–20 MiB of already-compressed data. An ingestion service must acknowledge each submission after durably accepting it, without waiting for analysis. A fleet of workers analyzes bundles independently and can be unavailable for up to 72 hours. Accepted bundles must remain available for at least 7 days, and unfinished analysis must be retried if a worker crashes. Workers already handle duplicate jobs safely, and processing order is not important. Which solution meets these requirements with the least operational overhead?
Show answer
CORRECT ANSWERStore each bundle in Amazon S3 and send its object reference and job ID to an Amazon SQS standard queue with a 7-day retention period. Acknowledge the submission after both operations succeed. Retain the object for at least 7 days, and have workers delete the message only after successful analysis, maintaining visibility while processing.
S3 stores the large payload while SQS durably buffers a small work message. This decouples ingestion from worker availability. Retaining both the object and message supports the outage requirement. Deleting the message only after success allows an unfinished job to become available again if its worker crashes.
A company has hundreds of tables in an Amazon S3 data lake cataloged in the AWS Glue Data Catalog. Analysts query the tables through Amazon Athena. The lake already enforces centrally managed permissions, and analysts cannot read the S3 objects directly. No existing grants give analysts access to the tables. An ingestion workflow assigns each new table a department and a sensitivity classification. Finance analysts must automatically receive query access to tables classified as both department=finance and sensitivity=internal, including tables created in the future. They must not receive access to other tables. Administrators want to avoid maintaining individual table grants. Which solution meets these requirements with the LEAST ongoing administrative effort?
Show answer
CORRECT ANSWERDefine department and sensitivity as AWS Lake Formation LF-Tags and have the ingestion workflow assign the appropriate values to each table. Grant the finance analyst role SELECT through an LF-Tag expression that requires department=finance AND sensitivity=internal.
Lake Formation tag-based access control grants permissions based on LF-Tag expressions. The expression requires both classifications to match, so it covers eligible existing tables and future tables when the workflow assigns their tags, without individual table grants.
A company is designing the compute tier for an internal reporting application on Amazon EC2. The business requires 99.9% time-based availability during each 30-day month, measured continuously from the user's perspective. Planned maintenance counts as downtime. There is no separate requirement for uninterrupted service during an Availability Zone failure. The application stores its state outside the instances. Failure testing and operational modeling produce the monthly downtime estimates in the proposed designs below, including maintenance and recovery. The company has approved these estimates for architecture planning. All designs use the same instance type and maintain their stated instance count continuously. Costs outside EC2 compute are identical. Which design meets the availability objective at the LOWEST EC2 compute cost?
Show answer
CORRECT ANSWERRun one instance in an EC2 Auto Scaling group with desired capacity 1, automatic replacement of unhealthy instances, and automated maintenance. Estimated total downtime is 35 minutes per month.
A 30-day month contains 43,200 minutes. An availability objective of 99.9% permits 43.2 minutes of downtime. The estimated 35 minutes stays within this budget while requiring only one continuously running instance. Additional redundancy is not required by the stated business requirements.
Exam mode and practice mode
| Exam mode | Practice mode | |
|---|---|---|
| Questions count | 65 | 1 - 75 |
| Time limit | 130 minutes | Optional, 10 - 200 minutes |
| Exam scope | 4 domains with the official questions ratio | Selected domains with the official questions ratio |
| Correct answers | After exam submission | After exam submission or after each answer |
| Question types | Mix of single and multiple correct answers | Single, multiple or both |
| Question hints | Never | Optional |
| Question domain | Revealed after exam submission | Revealed after submission or during the exam |
| Scoring | 15 of 65 questions do not count towards the result | Official AWS method or mathematical mean |
See all simulator features on the AWS Exam Simulator page.
About the SAA-C03 exam
The AWS Certified Solutions Architect - Associate exam's difficulty is significantly influenced by the extensive scope of topics it covers. This wide-ranging content demands a thorough understanding of many AWS services and their integration, which can be daunting, especially for those new to AWS or cloud computing.
The exam covers key areas including compute, storage, databases, networking, security, and application architecture. For compute, you need to understand services like EC2, which involves knowledge of instance types, pricing models, and scaling strategies. You must also be familiar with Lambda, which introduces a serverless paradigm that requires a different approach to architecture and deployment compared to traditional server-based models.
Storage is another critical domain, with services like S3 and EBS. Understanding S3 includes grasping its storage classes, bucket policies, and lifecycle management, while EBS requires knowledge of volume types, performance characteristics, and backup solutions. Databases on AWS span both relational (RDS) and non-relational (DynamoDB) systems, each with its own configuration, scaling, and maintenance considerations.
Networking on AWS involves VPC, subnets, routing tables, and gateways, which are foundational to designing secure and efficient cloud architectures. You must understand how to set up and manage these components to ensure proper isolation, connectivity, and security. Security itself is a vast topic, covering IAM (Identity and Access Management), encryption, and compliance requirements. Mastery of these elements is crucial, as security misconfigurations can lead to vulnerabilities.
The application architecture domain requires knowledge of how to design distributed systems that are highly available, fault-tolerant, and scalable. This involves using load balancers, auto-scaling groups, and designing stateless applications. Moreover, understanding the cost implications of architectural decisions is vital for optimizing performance while managing expenses.
The interrelated nature of these topics adds to the complexity. For instance, designing a fault-tolerant application involves not just compute and storage considerations but also networking and security configurations.
Effective preparation for the exam requires an integrated understanding of how these services work together to build robust, efficient, and secure solutions.
The breadth and depth of knowledge required across these domains, coupled with the need to stay updated with AWS’s frequent service updates and enhancements, contribute significantly to the exam's difficulty.
Technologies and concepts
Compute
In the cloud, compute provides on-demand CPU, memory, and optional accelerators through virtual machines, containers, and managed execution environments. Choosing an appropriate compute model helps engineers balance performance, cost, scaling behavior, and operational responsibility.
Cost management
In the cloud, cost management connects resource consumption and pricing choices to business outcomes. It helps engineers compare deployment options, eliminate waste, and balance spending against performance, availability, security, and operational effort.
Database
Databases give applications controlled access to persistent information, such as customer records, orders, and device readings. Choosing the right database model and operating approach affects correctness, performance, availability, security, and cost.
Disaster recovery
Disaster recovery combines recoverable data, replacement infrastructure, documented procedures, and testing to restore technology services after failures, attacks, or operational mistakes. In the cloud, it uses capabilities such as backups, replication, automated provisioning, and geographically separate deployments to balance recovery requirements against cost and complexity.
High performance
High performance depends on how effectively an application uses compute, memory, storage, and networking to deliver useful work. In the cloud, it requires measurable targets, appropriate resource choices, and continuous tuning rather than simply selecting larger instances.
Management and governance
Management handles activities such as provisioning, monitoring, configuration, and remediation, while governance defines who may act, which standards apply, and how compliance is demonstrated. Together, they help organizations give engineers useful autonomy without losing accountability, cost visibility, or control over risk.
Microservices and component delivery
Microservices divide an application into services organized around business capabilities, while component delivery provides the processes and automation needed to release those services safely. This approach supports independent team ownership and targeted scaling, but introduces distributed-system complexity and requires disciplined interface design, observability, and deployment practices.
Migration and data transfer
Cloud migration combines workload placement, application changes, and data movement to achieve business and technical goals. Engineers must choose an appropriate migration strategy, maintain data consistency, and account for transfer charges that depend on traffic direction, network path, and location.
Networking, connectivity, and content delivery
This concept combines network isolation, addressing, routing, name resolution, hybrid connectivity, traffic distribution, and delivery from geographically distributed edge locations. Engineers use these capabilities to balance reachability, security, latency, availability, and cost across public-facing applications and private systems.
Resiliency
Resiliency combines failure isolation, redundant resources, controlled recovery, and operational testing to limit the impact of failures. In the cloud, it requires deliberate architecture across independent failure domains rather than assuming that provider-managed infrastructure makes an application immune to outages.
Security
Security combines technical controls, operational processes, and clearly assigned responsibilities to preserve confidentiality, integrity, and availability. In the cloud, providers secure the underlying infrastructure while customers configure and operate their workloads securely, using capabilities such as identity controls, encryption, network protection, and threat detection.
Serverless
Serverless shifts infrastructure operations to the cloud provider so engineers can focus on application behavior, data, and configuration. It can reduce operational work and align costs with usage, but scaling behavior, billing, execution limits, and customer responsibilities vary by service.
Storage
Cloud storage provides data capacity through managed services rather than requiring engineers to operate all underlying disks and storage systems. Choosing an appropriate storage model and tier requires balancing access patterns, performance, resilience, retention requirements, and total cost.
Services on the exam
All 126 AWS services that can appear on the SAA-C03 exam.