AWS Certified Solutions Architect Associate (SAA-C03)

Exam practice questions

15 / 202 questions

Original, unofficial SAA-C03 practice material. Questions and results are for independent exam preparation.

Free preview · Answers and explanations includedPage 1 of 2

Design Cost-Optimized ArchitecturesSAA-C03 practice

A regional origin serves the same large public downloads to users worldwide. The team wants to reduce repeated origin delivery and evaluate the total cost of an edge-cache design. Which approach fits?

Select one answerARemove the durable origin and rely only on evictable caches.BEvaluate CloudFront caching using measured reuse and total delivery costs.CDisable caching so identical downloads always reach the origin.DAssume a CDN has no charges and always reduces total cost.

Design Resilient ArchitecturesSAA-C03 practice

A legacy application must retain its supported ActiveMQ client behavior during migration. It also needs a managed broker deployment that can survive a broker failure with client reconnection. Which approach is appropriate?

Select one answerAAdd a DNS alias and assume it synchronizes broker messages.BDeploy unrelated brokers without supported state replication or client failover.CUse Amazon MQ ActiveMQ active/standby with the client failover connection.DUse one self-managed nonpersistent broker.

Design Secure ArchitecturesSAA-C03 practice

An application subnet uses IPv6. Instances need to initiate IPv6 connections to internet services, but the network design must prevent internet hosts from initiating connections to the instances. Which gateway should its IPv6 default route target?

Select one answerAUse an S3 gateway endpoint as the default route for all IPv6 internet traffic.BUse an IPv4-only NAT design for the required native IPv6 connections.CUse an ordinary internet gateway with unrestricted inbound IPv6 rules.DAn egress-only internet gateway.

Design Cost-Optimized ArchitecturesSAA-C03 practice

A utility runs a short stateless transformation a few times each hour. It fits within Lambda's supported runtime and resource limits. The team wants to avoid paying for an always-running server dedicated to this utility. Which option fits?

Select one answerARun the transformation in appropriately sized Lambda functions.BKeep a large dedicated instance running continuously for the sparse utility.CMove the job to a continuously provisioned database server used only as compute.DProvision a permanent peak-sized cluster without utilization analysis.

Design Secure ArchitecturesSAA-C03 practice

Several analytics teams query a shared data lake through supported AWS analytics services. One team should read only approved columns in registered tables. The company wants centralized table-level and column-level permissions rather than separate copies of each dataset. Which service fits?

Select one answerAUse only bucket-level permissions to distinguish columns within the same object.BShare the encryption key with everyone and treat decryption permission as column filtering.CUse Lake Formation permissions with the supported query integrations.DGrant all analysts direct raw-object access and rely only on dashboard filters.

Design Resilient ArchitecturesSAA-C03 practice

A three-tier application has a CPU-heavy API tier and a separately deployed background-processing tier. They have different demand patterns and deployment schedules. Which design best supports independent scaling and replacement?

Select one answerADeploy every component on every instance and scale only as one combined fleet.BUse one fixed background instance with no replacement configuration.CScale tiers independently, with explicit interfaces and externalized shared state.DKeep durable state on disposable instances in both tiers.

Design High-Performing ArchitecturesSAA-C03 practice

A global web application has static files in S3 and dynamic HTTP responses from an ALB. It wants one public hostname and edge delivery with different caching rules for static and dynamic paths. Which architecture fits?

Select one answerAUse CloudFront path behaviors with S3 and ALB origins under the hostname.BUse Global Accelerator with S3 as a directly supported accelerator endpoint.CUse one cache policy that shares all personalized dynamic responses across users.DUse only an S3 bucket policy to route dynamic HTTP paths to an ALB.

Design High-Performing ArchitecturesSAA-C03 practice

An HTTP service behind an ALB has roughly consistent processing cost per request. CPU usage is a weak signal because instances spend time waiting on I/O. The team wants a managed target-tracking policy tied to load per instance. Which metric is suitable?

Select one answerAUse ALB request count per target, calibrated through load testing.BUse only average CPU despite evidence it poorly represents request capacity.CUse the total fleet request count without relating it to current target capacity.DUse a metric from an unrelated background queue.

Design Secure ArchitecturesSAA-C03 practice

A developer role has an identity policy allowing s3:DeleteObject on a project bucket. The bucket policy explicitly denies that action for the same role during a retention period. What happens when the role tries to delete an object during that period?

Select one answerAThe identity-policy allow takes precedence over the bucket-policy deny.BThe explicit deny overrides the allow, so the delete request is rejected.CThe request succeeds if the IAM policy was edited more recently.DThe request succeeds because assumed roles are exempt from resource-policy denies.

Design Cost-Optimized ArchitecturesSAA-C03 practice

A company keeps years of rarely queried historical transactions on an expensive operational database solely for monthly aggregate analysis. Current transactions still require the operational engine. Which design should it evaluate?

Select one answerADelete the history despite required monthly analysis.BMove eligible history to S3/Athena or a suitable analytical warehouse.CMove the live transaction path to an untested archive format without application changes.DIncrease the operational instance indefinitely without separating access patterns.

Design High-Performing ArchitecturesSAA-C03 practice

A Linux content-management service adds many files unpredictably and runs across multiple Availability Zones. The team wants shared NFS access without preprovisioning a fixed-capacity file server. Which design fits?

Select one answerAAllocate independent fixed EBS volumes and assume their namespaces synchronize.BUse Regional EFS with suitable performance and throughput settings.CUse instance store as the sole durable shared file repository.DUse one manually expanded NFS server despite the no-fixed-capacity requirement.

Design Resilient ArchitecturesSAA-C03 practice

A company is migrating a stateless containerized API to AWS. It wants ECS orchestration but does not want to patch or scale a fleet of container-host EC2 instances. Which compute option fits?

Select one answerARun the ECS service on AWS Fargate and configure service scaling and load balancing.BUse Lambda for containers requiring an always-running API server process without adapting them.CRun containers manually on one EC2 instance without orchestration.DRun ECS on an unmanaged EC2 host fleet that the team must patch.

Design Secure ArchitecturesSAA-C03 practice

An S3 bucket contains confidential reports. The company wants the bucket policy to reject requests that do not use TLS, regardless of whether a caller otherwise has object permissions. Which policy condition should be used in an explicit deny?

Select one answerADeny aws:SecureTransport=false, with necessary AWS service exceptions.BEnable versioning as the transport-encryption mechanism.CRequire a caller-provided User-Agent containing HTTPS.DEnable only at-rest encryption without a secure-transport policy.

Design Resilient ArchitecturesSAA-C03 practice

A company has configuration drift because administrators patch application instances manually. It wants repeatable replacement and a reliable way to roll back a bad application release. Which deployment approach fits?

Select one answerAKeep release artifacts only in one instance's temporary directory.BContinue undocumented SSH changes to long-lived instances.CDisable instance replacement to preserve manually configured servers.DReplace instances through a controlled rollout using versioned immutable images.

Design Secure ArchitecturesSAA-C03 practice

A private analytics subnet uses an S3 gateway endpoint. The workload role accidentally has broad S3 permissions. Security wants requests through this endpoint restricted to approved buckets as an additional control. Which change directly adds that restriction?

Select one answerAApply an endpoint policy allowing only the necessary S3 actions and approved bucket resources.BRestrict only the endpoint's display name while leaving its policy unrestricted.CAdd an internet default route as the exfiltration control.DGrant broader IAM permissions and assume endpoint routing limits bucket authorization automatically.

Complete your exam preparation

Continue with the full question bank

Practise free with answers, explanations, and Community discussions. Join Community to unlock the complete question bank and timed mock exams.

Join Community Choose access for your certification

AWS Certified Solutions Architect Associate (SAA-C03)

Exam practice questions

15 / 202 questions

Original, unofficial SAA-C03 practice material. Questions and results are for independent exam preparation.

Free preview · Answers and explanations includedPage 1 of 2

Design Cost-Optimized ArchitecturesSAA-C03 practice

A regional origin serves the same large public downloads to users worldwide. The team wants to reduce repeated origin delivery and evaluate the total cost of an edge-cache design. Which approach fits?

Design Resilient ArchitecturesSAA-C03 practice

A legacy application must retain its supported ActiveMQ client behavior during migration. It also needs a managed broker deployment that can survive a broker failure with client reconnection. Which approach is appropriate?

Design Secure ArchitecturesSAA-C03 practice

An application subnet uses IPv6. Instances need to initiate IPv6 connections to internet services, but the network design must prevent internet hosts from initiating connections to the instances. Which gateway should its IPv6 default route target?

Design Cost-Optimized ArchitecturesSAA-C03 practice

A utility runs a short stateless transformation a few times each hour. It fits within Lambda's supported runtime and resource limits. The team wants to avoid paying for an always-running server dedicated to this utility. Which option fits?

Design Secure ArchitecturesSAA-C03 practice

Several analytics teams query a shared data lake through supported AWS analytics services. One team should read only approved columns in registered tables. The company wants centralized table-level and column-level permissions rather than separate copies of each dataset. Which service fits?

Design Resilient ArchitecturesSAA-C03 practice

A three-tier application has a CPU-heavy API tier and a separately deployed background-processing tier. They have different demand patterns and deployment schedules. Which design best supports independent scaling and replacement?

Design High-Performing ArchitecturesSAA-C03 practice

A global web application has static files in S3 and dynamic HTTP responses from an ALB. It wants one public hostname and edge delivery with different caching rules for static and dynamic paths. Which architecture fits?

Design High-Performing ArchitecturesSAA-C03 practice

An HTTP service behind an ALB has roughly consistent processing cost per request. CPU usage is a weak signal because instances spend time waiting on I/O. The team wants a managed target-tracking policy tied to load per instance. Which metric is suitable?

Design Secure ArchitecturesSAA-C03 practice

A developer role has an identity policy allowing s3:DeleteObject on a project bucket. The bucket policy explicitly denies that action for the same role during a retention period. What happens when the role tries to delete an object during that period?

Design Cost-Optimized ArchitecturesSAA-C03 practice

A company keeps years of rarely queried historical transactions on an expensive operational database solely for monthly aggregate analysis. Current transactions still require the operational engine. Which design should it evaluate?

Design High-Performing ArchitecturesSAA-C03 practice

A Linux content-management service adds many files unpredictably and runs across multiple Availability Zones. The team wants shared NFS access without preprovisioning a fixed-capacity file server. Which design fits?

Design Resilient ArchitecturesSAA-C03 practice

A company is migrating a stateless containerized API to AWS. It wants ECS orchestration but does not want to patch or scale a fleet of container-host EC2 instances. Which compute option fits?

Design Secure ArchitecturesSAA-C03 practice

An S3 bucket contains confidential reports. The company wants the bucket policy to reject requests that do not use TLS, regardless of whether a caller otherwise has object permissions. Which policy condition should be used in an explicit deny?

Design Resilient ArchitecturesSAA-C03 practice

A company has configuration drift because administrators patch application instances manually. It wants repeatable replacement and a reliable way to roll back a bad application release. Which deployment approach fits?

Design Secure ArchitecturesSAA-C03 practice

A private analytics subnet uses an S3 gateway endpoint. The workload role accidentally has broad S3 permissions. Security wants requests through this endpoint restricted to approved buckets as an additional control. Which change directly adds that restriction?

Complete your exam preparation

Continue with the full question bank

Practise free with answers, explanations, and Community discussions. Join Community to unlock the complete question bank and timed mock exams.

Join Community Choose access for your certification