• 65 questions

AWS Solutions Architect Practice Test

Design scenarios for exam SAA-C03, each answer linked to the AWS documentation page behind it.

A mobile app needs sign-up and sign-in for its customers. Which service provides the user directory?

Pick an answer, then press Check answer. Then you see Correct or Not quite, with the reason. Keys: A to D pick, Enter checks.

Print covers the next 65 questions. Share this set copies a link to the same questions in the same order.

Exam mode: 65 questions, 130 minutes.

More options

Unofficial practice questions, not affiliated with Amazon Web Services, Inc. Bank checked October 9, 2026.

Next step Weak on security? Try Security+Next: AWS Developer Associate

All 65 questions

Design Secure Architectures 20

  • A company must be sure that no bucket policy or ACL in an account can make S3 data public. Which feature overrides such policies? Amazon S3 User Guide: Blocking public access to your Amazon S3 storage
  • A compliance rule says the company must have full control over the lifecycle and use of the keys that encrypt its data. Which kind of KMS key meets it? AWS KMS Developer Guide: AWS KMS keys
  • A mobile app needs sign-up and sign-in for its customers. Which service provides the user directory? Amazon Cognito Developer Guide: Authenticating users with Amazon Cognito user pools
  • A network ACL has rule 100, which allows TCP 443 from anywhere, and rule 200, which denies TCP 443 from 203.0.113.0/24. What happens to HTTPS traffic from 203.0.113.7? Amazon VPC User Guide: Control subnet traffic with network access control lists
  • A reporting service in a private subnet must call a partner's public API over IPv4. The internet must not be able to start a connection to the service. What should the architect add? Amazon VPC User Guide: NAT gateways
Show all 65 questions (60 more)

Design Secure Architectures, continued

  • A security group allows inbound HTTPS from anywhere and has no outbound rules. Can the instance answer its clients? Amazon VPC User Guide: Control traffic to your AWS resources using security groups
  • A security team applies restrictive service control policies at the root of its organization. Which account is not affected by them? AWS Organizations User Guide: Service control policies (SCPs)
  • A software vendor offers its service through AWS PrivateLink. What does a customer create in its own VPC to send traffic to that endpoint service? AWS PrivateLink guide: AWS PrivateLink concepts
  • A static website sits in an S3 bucket behind Amazon CloudFront. Viewers must not be able to fetch objects from the bucket directly. What does CloudFront recommend? Amazon CloudFront Developer Guide: Restrict access to an Amazon S3 origin
  • A subnet must refuse traffic from one hostile address range and accept everything else. Which VPC feature can deny specific traffic at the subnet level? Amazon VPC User Guide: Control subnet traffic with network access control lists
  • A user's identity-based policy allows s3:DeleteObject on a bucket. The bucket policy explicitly denies that action to the same user. What happens to a delete request? IAM User Guide: Policy evaluation logic
  • An Amazon EC2 instance runs an application that must read objects from Amazon S3. How should it get AWS credentials? IAM User Guide: Use an IAM role to grant permissions to applications running on Amazon EC2 instances
  • An application keeps its database credentials in AWS Secrets Manager, not in its source code. How does the code get them, by the Secrets Manager guide? AWS Secrets Manager: What is AWS Secrets Manager?
  • An organization attaches a service control policy that allows Amazon S3 to an OU. A developer in a member account, whose IAM policies say nothing about S3, still cannot list buckets. Why? AWS Organizations User Guide: Service control policies (SCPs)
  • Auditors work in their own AWS account and need read access to resources in a production account. Which design gives them temporary credentials and no new long-term keys? AWS STS API Reference: AssumeRole
  • Financial records in Amazon S3 must be kept for seven years, and nobody, the account's root user included, may delete them early. Which configuration meets this? Amazon S3 User Guide: Locking objects with Object Lock
  • Instances in a private subnet must reach Amazon S3, and the VPC may have no internet gateway and no NAT device. Which component provides the access? AWS PrivateLink guide: Gateway endpoints
  • IPv6-only instances need outbound access to the internet, and the internet must not be able to start connections to them. Which component fits? Amazon VPC User Guide: Enable outbound IPv6 traffic using an egress-only internet gateway
  • Team leads may create IAM roles for their developers, but no role they create may exceed a fixed set of permissions. Which IAM feature sets that ceiling? IAM User Guide: Permissions boundaries for IAM entities
  • Which server-side encryption does Amazon S3 apply to every bucket as its base level, with no action by the customer? Amazon S3 User Guide: Protecting data with server-side encryption

Design Resilient Architectures 17

  • A business says it can lose at most 15 minutes of data in a disaster. Which objective states this? Disaster Recovery of Workloads on AWS: Recovery in the Cloud: Business Continuity Plan (BCP)
  • A CloudFront distribution should fetch from a second origin when the first is unavailable or returns error status codes. What should the architect create? Amazon CloudFront Developer Guide: Optimize high availability with CloudFront origin failover
  • A few malformed messages fail again and again and keep a queue's consumers busy. What moves them aside after a set number of receives? Amazon SQS Developer Guide: Using dead-letter queues in Amazon SQS
  • A game stores player state in DynamoDB and needs fast local reads and writes in three Regions. Which feature fits? Amazon DynamoDB Developer Guide: Global tables - multi-active, multi-Region replication
  • A primary site runs in one Region and a standby in another. DNS should answer with the standby only when the primary fails its health check. Which Route 53 routing policy does this? Amazon Route 53 Developer Guide: Choosing a routing policy
  • A production Amazon RDS database must survive the loss of an Availability Zone, with a standby ready to take over. Which feature provides this? Amazon RDS User Guide: Multi-AZ DB instance deployments for Amazon RDS
  • A relational database must serve readers on other continents and recover quickly if a whole Region fails. Which Aurora feature is built for this? Amazon Aurora User Guide: Using Amazon Aurora Global Database
  • A web tier calls a worker tier directly, and orders are lost whenever the workers are down. Which change decouples the two tiers? Amazon SQS Developer Guide: What is Amazon Simple Queue Service?
  • An Auto Scaling group's instance terminates unexpectedly. What does Amazon EC2 Auto Scaling do? Amazon EC2 Auto Scaling User Guide: Health checks for instances in an Auto Scaling group
  • For disaster recovery, a company keeps a smaller but fully working copy of production running in a second Region. Which strategy is this? Disaster Recovery of Workloads on AWS: Recovery in the Cloud: Disaster recovery options in the cloud
  • How does an Amazon Aurora cluster volume protect data against the loss of an Availability Zone? Amazon Aurora User Guide: Amazon Aurora storage
  • In a second Region, a company replicates its data and keeps databases on, but leaves application servers switched off until a disaster. Which strategy is this? Disaster Recovery of Workloads on AWS: Recovery in the Cloud: Disaster recovery options in the cloud
  • One "order placed" message must reach three services, each of which processes it at its own pace. Which design does this? Amazon SNS Developer Guide: Fanout Amazon SNS notifications to Amazon SQS queues for asynchronous processing
  • Payment instructions for one account must be processed in the order they were sent, and never twice. Which should carry them? Amazon SQS Developer Guide: Amazon SQS FIFO queues
  • Reporting queries slow down an RDS for MySQL primary instance. Which feature takes the reads, and how does data reach it? Amazon RDS User Guide: Working with DB instance read replicas
  • Users sometimes overwrite or delete objects in a bucket by mistake. Which S3 feature keeps earlier copies so they can be restored? Amazon S3 User Guide: Retaining multiple versions of objects with S3 Versioning
  • What does a load balancer do when it detects that a registered target is unhealthy? Elastic Load Balancing User Guide: How Elastic Load Balancing works

Design High-Performing Architectures 15

  • A database needs sustained performance above 80,000 IOPS with sub-millisecond latency. Which EBS volume type do the volume tables point to? Amazon EBS User Guide: Amazon EBS volume types
  • A global application needs fixed entry-point IP addresses, with traffic carried over the AWS global network to the endpoint nearest each user. Which service fits? AWS Global Accelerator: What is AWS Global Accelerator?
  • A read-heavy DynamoDB application needs response times in microseconds and accepts eventually consistent data. What should be added? Amazon DynamoDB Developer Guide: In-memory acceleration with DynamoDB Accelerator (DAX)
  • A render job needs very fast scratch space for temporary files that can be lost when the instance stops. Which storage fits? Amazon EC2 User Guide: Instance store temporary block storage for EC2 instances
  • A research group runs high performance computing jobs that need a very fast parallel file system. Which service is built for this? FSx for Lustre: What is Amazon FSx for Lustre?
  • A TCP service must handle millions of requests per second with very low latency. Which load balancer type works at layer 4 for this? Elastic Load Balancing User Guide: What is a Network Load Balancer?
  • An application runs in three Regions. DNS should send each user to the Region that gives the fastest response. Which Route 53 routing policy does this? Amazon Route 53 Developer Guide: Choosing a routing policy
  • An Auto Scaling group should keep average CPU utilization near 50 percent as load changes. Which scaling policy type is designed for this? Amazon EC2 Auto Scaling User Guide: Target tracking scaling policies for Amazon EC2 Auto Scaling
  • Clickstream records must be loaded into Amazon S3 and Amazon Redshift continuously, with no consumer application to write. Which service delivers them? Amazon Data Firehose: What is Amazon Data Firehose?
  • Forty VPCs and two on-premises networks must all reach one another. Which service acts as one hub so that the team avoids a mesh of peering connections? AWS Transit Gateway guide: What is AWS Transit Gateway for Amazon VPC?
  • Linux instances in several Availability Zones must all mount the same file system over NFS. Which service provides it? Amazon Elastic File System: What is Amazon Elastic File System?
  • One load balancer must send requests for /api to one group of targets and requests for /images to another. Which load balancer type supports this? Elastic Load Balancing User Guide: What is an Application Load Balancer?
  • Tightly coupled compute nodes exchange messages constantly and need the lowest network latency between them. How should the instances be placed? Amazon EC2 User Guide: Placement strategies for your placement groups
  • Traffic follows a daily and weekly pattern. The team wants capacity added ahead of each peak from a forecast, with no schedule to maintain. Which kind of scaling does this? Amazon EC2 Auto Scaling User Guide: Predictive scaling for Amazon EC2 Auto Scaling
  • Which EBS volume type do the EBS volume tables list for big data, data warehouses and log processing? Amazon EBS User Guide: Amazon EBS volume types

Design Cost-Optimized Architectures 13

  • A bucket holds objects whose access patterns are unknown and keep changing. Which storage class moves objects between access tiers by itself? Amazon S3 User Guide: How S3 Intelligent-Tiering works
  • A company owns per-socket database licenses and wants to reuse them on AWS. Which EC2 purchasing option is meant for this? Amazon EC2 User Guide: Amazon EC2 billing and purchasing options
  • A company runs a steady mix of EC2 instances, AWS Fargate tasks and Lambda functions. Which commitment lowers the price of all three? Savings Plans: What are Savings Plans?
  • A development database sits idle most of the day and sees short bursts of load. Which Aurora configuration adjusts capacity to demand? Amazon Aurora User Guide: Using Aurora serverless
  • A fleet of EC2 instances looks oversized. Which service analyzes utilization metrics and gives rightsizing recommendations? AWS Compute Optimizer: What is AWS Compute Optimizer?
  • A new application has unknown, spiky traffic to its DynamoDB table. Which capacity mode charges per request with no throughput to specify? Amazon DynamoDB Developer Guide: DynamoDB throughput capacity
  • A steady workload will run for three years, but the team expects to change instance families along the way. Which Reserved Instance class can be exchanged? Amazon EC2 User Guide: Types of Reserved Instances (offering classes)
  • Log files should move to S3 Standard-IA after 30 days and be deleted after a year, with no scripts to run. What should the architect configure? Amazon S3 User Guide: Managing the lifecycle of objects
  • Private instances send large volumes of data to Amazon S3 through a NAT gateway, and the processing charges are high. Which change removes that cost for S3 traffic? AWS PrivateLink guide: Gateway endpoints
  • Several project teams share one AWS account, and finance wants costs broken down by project. What should the architect put in place? AWS Billing: Organizing and tracking costs using AWS cost allocation tags
  • Thumbnails that can be generated again are read rarely but must open in milliseconds. Which S3 storage class costs less than S3 Standard-IA by keeping data in one Availability Zone? Amazon S3 User Guide: Understanding and managing Amazon S3 storage classes
  • What is the trade-off for the low price of Spot Instances? Amazon EC2 User Guide: Spot Instance interruptions
  • Which S3 storage classes are built for cheap long-term archiving, with minimum storage durations and fees for retrieval? Amazon S3 User Guide: Understanding and managing Amazon S3 storage classes

How this list was compiled: Own questions, written to the four content domains and weightings of the exam guide Amazon Web Services publishes for AWS Certified Solutions Architect - Associate (SAA-C03) at https://docs.aws.amazon.com/aws-certification/latest/solutions-architect-associate-03/solutions-architect-associate-03.html (read 2026-10-09, with its four domain pages), with the exam length from https://aws.amazon.com/certification/certified-solutions-architect-associate/ (read 2026-10-09). Facts were read on 2026-10-09 in AWS's public documentation at docs.aws.amazon.com and, where named, on aws.amazon.com. Each question names the page it was written from and links to it. Licence: Own work. Every question, wrong choice and explanation was written for this site from the task statements of the exam guide and the public AWS pages named in each question. Nothing is copied or reworded from an AWS exam, an AWS sample question or official practice question set, a practice product or a question dump.

How it works

This unofficial AWS Solutions Architect Associate practice test holds 65 of our own design scenarios across the four SAA-C03 domains. It is not affiliated with Amazon Web Services, Inc., and no question comes from the real exam.

Read the full guide

What the SAA-C03 exam asks

AWS's exam guide, read on October 9, 2026, weights four domains: design secure architectures 30%, resilient architectures 26%, high-performing architectures 24% and cost-optimized architectures 20%.

What this bank leaves out

Each question here has one right answer of four. The real exam also has multiple-response questions with two or more right answers, and those are not here. Neither are prices or quotas, which AWS changes often.

  • A network ACL applies its lowest-numbered matching rule and stops, so the rule numbers decide the outcome.
  • A Multi-AZ standby DB instance cannot serve read traffic. A read replica can.
  • Gateway endpoints connect a VPC to Amazon S3 and DynamoDB at no additional charge.

Questions and answers

How many questions are on the AWS Solutions Architect Associate exam?

65, by AWS's certification page, each multiple choice or multiple response, in 130 minutes. The exam guide says 50 of them affect your score and 15 are unscored and not identified.

What is the passing score for SAA-C03?

720 on a scaled score of 100 to 1,000, by the exam guide. A scaled score is not a percent, so exam mode here shows your percent right in each domain and gives no verdict.

Is this a free AWS Solutions Architect practice test?

Yes. All 65 questions and their explanations are free, with no account.

Are these real AWS exam questions?

No. Every question was written for this site from the exam guide's task statements and AWS's public documentation.

More tests

Show 7 more

Browse Safety and Trades