AWS Solutions Architect Associate (SAA-C03-aligned) Practice Exams

Three 50-question scenario-led practice papers on designing secure, resilient, high-performing and cost-optimised architectures, weighted to the published SAA-C03 exam guide.

3 practice papers · 150 questions · 100 minutes each · pass mark 70% · ₹196 for all papers

What the SAA-C03 practice exams cover

Written from the published AWS Certified Solutions Architect – Associate (SAA-C03) exam guide domains.

Practice papers

Free SAA-C03 sample questions

Sample question 1 (Secure architectures)

A company has a three-tier web application in a VPC with public subnets hosting an Application Load Balancer, private subnets hosting EC2 application servers, and private subnets hosting an RDS database. Security policy requires that the database tier accept connections only from the app tier. Which two approaches can enforce this restriction? (Select two.)

  1. Configure the RDS security group to allow inbound traffic on the database port sourced from the app tier security group ID.
  2. Configure a NACL on the data subnets to allow inbound traffic on the database port from the app subnet CIDR and deny inbound from the public subnet CIDR.
  3. Configure the RDS security group to allow inbound traffic on the database port from 0.0.0.0/0.
  4. Configure the app server security group to allow outbound traffic on the database port to the RDS security group ID.
  5. Enable VPC Flow Logs on the data subnets and create a CloudWatch alarm for connections from public subnets.

Answer: A. Configure the RDS security group to allow inbound traffic on the database port sourced from the app tier security group ID.; B. Configure a NACL on the data subnets to allow inbound traffic on the database port from the app subnet CIDR and deny inbound from the public subnet CIDR.

Option A is correct because security groups can reference other security group IDs as a source, so the RDS security group can allow inbound database traffic only from the app tier security group without managing IP addresses. Option B is correct because NACLs operate at the subnet level and can use CIDR-based rules to allow inbound database traffic from the app subnet CIDR while explicitly denying it from the public subnet CIDR. Option C is wrong because allowing 0.0.0.0/0 on the database port opens the database to the entire internet, which violates the requirement. Option D is wrong because configuring an outbound rule on the app server security group controls what the app servers can send, not what the database tier accepts; the restriction must be applied at the database side. Option E is wrong because VPC Flow Logs are a monitoring and auditing tool, not an enforcement mechanism, so they cannot block unwanted connections.

Sample question 2 (Resilient architectures)

An e-commerce company has an order processing system where the web frontend writes order messages to an Amazon SQS queue. Worker instances pull messages from the queue and process them. During a holiday sale, the queue grows faster than the workers can drain it. The company wants to scale the worker fleet automatically based on how much work is waiting. Which approach meets this requirement?

  1. Configure an EC2 Auto Scaling target tracking policy on the CPU utilization metric of the worker instances.
  2. Configure an EC2 Auto Scaling target tracking policy on the ApproximateNumberOfMessagesVisible CloudWatch metric for the SQS queue.
  3. Subscribe an SNS topic to the SQS queue and use SNS message fan-out to add more worker instances.
  4. Increase the SQS visibility timeout so that each worker holds messages longer and fewer instances are needed.

Answer: B. Configure an EC2 Auto Scaling target tracking policy on the ApproximateNumberOfMessagesVisible CloudWatch metric for the SQS queue.

Option B is correct because Amazon EC2 Auto Scaling supports a target tracking policy based on the ApproximateNumberOfMessagesVisible Amazon CloudWatch metric for SQS, which scales the worker fleet up or down to keep the queue backlog at a desired level. Option A is wrong because scaling on CPU utilization does not reflect queue depth and would not add capacity if the workers are idle waiting on external dependencies. Option C is wrong because SNS does not auto-scale EC2 instances; it is a pub/sub service for fan-out, not a scaling mechanism. Option D is wrong because SQS visibility timeouts control how long a message is hidden after being read, not how many consumers exist, and changing it does not trigger auto scaling.

Sample question 3 (High-performing architectures)

A company runs a video transcoding service where users upload videos and receive processed output files. Transcoding jobs are submitted to an Amazon SQS queue. EC2 instances in an Auto Scaling group pull jobs from the queue. The workload is highly variable, with long idle periods followed by sudden spikes of hundreds of jobs. The company wants to minimize costs during idle periods while ensuring jobs are processed quickly during spikes. Which two actions should the solutions architect take? (Select two.)

  1. Configure the Auto Scaling group to scale based on the ApproximateNumberOfMessagesVisible SQS queue metric
  2. Replace the On-Demand instances in the Auto Scaling group with Spot Instances to reduce costs during processing
  3. Use a target tracking scaling policy based on CPU utilization set to 40 percent
  4. Replace the SQS queue with an Amazon SNS topic to decouple job submission from processing
  5. Use Reserved Instances for the entire Auto Scaling group to get the lowest hourly rate

Answer: A. Configure the Auto Scaling group to scale based on the ApproximateNumberOfMessagesVisible SQS queue metric; B. Replace the On-Demand instances in the Auto Scaling group with Spot Instances to reduce costs during processing

Option A is correct because the ApproximateNumberOfMessagesVisible metric directly reflects how many transcoding jobs are waiting, which is the most responsive signal for a pull-based worker architecture. Option B is correct because transcoding jobs are fault-tolerant batch workloads; if a Spot Instance is reclaimed, the SQS message becomes visible again and another worker picks it up, yielding significant cost savings over On-Demand. Option C is incorrect because CPU utilization is a lagging indicator for queue-based workloads; instances may sit at low CPU while a large backlog accumulates. Option D is incorrect because SNS is a pub/sub service, not a durable queue, and messages could be lost if no workers are available at delivery time. Option E is incorrect because Reserved Instances commit to continuous capacity, which is wasteful when the workload has long idle periods.

Sample question 4 (Cost-optimised architectures)

A company stores application audit logs in an Amazon S3 Standard bucket. The logs are actively queried for the first 30 days, then accessed only a few times per quarter for the next 60 days, and almost never accessed after 90 days. All logs must be retained for 5 years for compliance. The solutions architect wants to apply an S3 lifecycle policy that minimizes storage cost without compromising retention. Which two lifecycle transition actions should the policy include? (Select two.)

  1. Transition to S3 Standard-IA after 30 days
  2. Transition to S3 Glacier Instant Retrieval after 30 days
  3. Transition to S3 Glacier Deep Archive after 90 days
  4. Transition to S3 Intelligent-Tiering after 60 days
  5. Transition to S3 One Zone-IA after 90 days

Answer: A. Transition to S3 Standard-IA after 30 days; C. Transition to S3 Glacier Deep Archive after 90 days

Option A is correct because after 30 days the logs are accessed only a few times per quarter, making S3 Standard-IA the appropriate cost-optimized class while preserving the same multi-AZ durability as Standard. Option C is correct because after 90 days the data is almost never accessed yet must be retained for years; S3 Glacier Deep Archive offers the lowest storage cost per GB and meets long-term retention needs. Option B is wrong because Glacier Instant Retrieval charges more per GB than Standard-IA and provides millisecond access that the quarterly access pattern does not justify. Option D is wrong because Intelligent-Tiering adds monitoring and auto-tiering fees and is designed for unpredictable access patterns, not a known lifecycle with well-defined access stages. Option E is wrong because One Zone-IA stores data in a single Availability Zone, reducing durability and making it unsuitable for compliance retention that must survive an AZ failure.

Sample question 5 (Secure architectures)

A financial services company stores large files in Amazon S3 and encrypts each object using AWS KMS. The security team wants to minimize the number of KMS API calls and reduce the risk of hitting KMS request rate limits while still maintaining strong encryption for every object. Which approach best meets these requirements?

  1. Use S3 server-side encryption with KMS keys and let S3 make a KMS API call for every object upload.
  2. Generate a unique KMS customer master key for each object to avoid reusing keys.
  3. Use envelope encryption: generate a data key using KMS, encrypt the object with the data key locally, and store the encrypted data key alongside the object.
  4. Generate a data key using KMS and store the plaintext data key in an encrypted DynamoDB table for retrieval.

Answer: C. Use envelope encryption: generate a data key using KMS, encrypt the object with the data key locally, and store the encrypted data key alongside the object.

Option C is correct because envelope encryption generates a unique data key through KMS, encrypts the object locally with that data key, and stores the encrypted data key alongside the object; this means KMS is only called to decrypt the small data key, not the entire object, drastically reducing KMS API calls. Option A is wrong because using S3 server-side encryption with KMS for every object upload results in a KMS API call per object, increasing the risk of rate limits. Option B is wrong because creating a unique KMS customer master key for each object would be extremely expensive, hard to manage, and would actually increase KMS overhead. Option D is wrong because storing plaintext data keys anywhere defeats the purpose of encryption and creates a significant security vulnerability.

About these papers

Unofficial practice material. Every question is original, written from the vendor's publicly published exam objectives, and no real exam item is reproduced or paraphrased. This paper is not affiliated with, endorsed by, sponsored by or certified by the certification owner, and passing it does not confer any certification.

More certification practice exams