500 scenario-based practice questions covering secure, resilient, high-performing, and cost-optimized architectures. Built to match the depth and trade-off reasoning of the real SAA-C03 exam.
No credit card required · Upgrade to 500 questions for $11.99
500 Exam-Style Questions
7-Day Money-Back Guarantee
Is this for you?
Your SAA-C03 exam is in the next 2–4 weeks
You've studied the concepts but aren't sure you'll pass
You want questions harder than the real exam
You want to understand why answers are correct, not just memorize
Not for you if:
You're looking for braindumps or exam leaks
You haven't started studying the concepts yet
The AWS Certified Solutions Architect – Associate (SAA-C03) is a associate-level AWS certification. The exam has 65 questions, runs 130 minutes, costs $150, and requires a passing score of 720/1000. CertSharp provides 500 exam-style SAA-C03 practice questions — 30 free with no credit card — each with a detailed explanation.
Study guides teach concepts. We prepare you for the actual SAA-C03 exam.
1
Scenario questions force the real SAA-C03 skill: choosing between multiple working solutions on cost, resilience, and performance constraints
2
Every explanation contrasts the right service against its closest alternatives — Aurora vs RDS, SQS vs Kinesis, NLB vs ALB — so trade-offs become second nature
3
Calibrated harder than the live exam: a steady 80% here predicts a comfortable SAA-C03 pass
4
Updated for 2026 — current multi-AZ, Graviton, S3 storage classes, and cost-optimization guidance
Free Sample Questions
SAA-C03 Practice Questions (Free Sample)
Real SAA-C03 exam-style questions from our 500-question AWS Certified Solutions Architect – Associate bank, each with the correct answer and a detailed explanation.
Question 1 — SAA-C03
A company runs a read-heavy application on Amazon RDS for MySQL. Read latency spikes during peak hours while the primary instance stays under 40% CPU. The team needs to scale reads without changing the application connection logic significantly. What is the most cost-effective solution?
A
Migrate the database to Amazon DynamoDB
B
Add Amazon RDS read replicas and direct read traffic to the reader endpoint
C
Increase the primary instance to a larger instance class
D
Enable Multi-AZ deployment for the RDS instance
Correct answer: B — Explanation
Read replicas offload read traffic and scale horizontally at lower cost than vertically scaling the primary; applications route reads to the replica/reader endpoint. Vertical scaling (C) is more expensive and does not separate read load. Multi-AZ (D) provides high availability, not read scaling — the standby does not serve reads. Migrating to DynamoDB (A) is a major re-architecture, not a low-effort fix.
Question 2Secure access to AWS resourcesEasy
A company wants its EC2 instances to read objects from an S3 bucket without storing any long-term credentials on the instances. What should a solutions architect recommend?
A
Attach an IAM role to the EC2 instances with an S3 read policy
B
Store IAM user access keys in the application config file
C
Embed root account credentials in the instance user data
D
Create an S3 bucket policy that allows anonymous read access
Show answer & explanation
Correct answer: A — Attach an IAM role to the EC2 instances with an S3 read policy
IAM roles deliver temporary, automatically rotated credentials to EC2 instances through the instance metadata service, so no long-term keys are stored. Embedding access keys or root credentials on the instance creates a leak risk, and an anonymous bucket policy would expose the data publicly.
Question 3Secure workloads and applicationsEasy
Traffic to an EC2 instance must be limited to HTTPS coming only from a specific Application Load Balancer. What achieves this most precisely?
A
A network ACL that permits broad inbound traffic
B
A route table entry pointing to the load balancer
C
An IAM policy attached to the instance profile
D
A security group rule allowing port 443 from the load balancer security group
Show answer & explanation
Correct answer: D — A security group rule allowing port 443 from the load balancer security group
Security groups are stateful instance-level firewalls and can reference the load balancer security group as the source, permitting HTTPS only from it. Network ACLs are subnet level, while route tables and IAM policies do not filter instance traffic.
Question 4Data security controlsEasy
For compliance, objects in S3 must not be deleted or overwritten for a fixed retention period, even by administrators. Which feature enforces this?
A
S3 Versioning by itself
B
A restrictive bucket policy that can be edited later
C
Lifecycle rules that transition objects to Glacier
D
S3 Object Lock in compliance mode
Show answer & explanation
Correct answer: D — S3 Object Lock in compliance mode
S3 Object Lock in compliance mode enforces write-once-read-many retention so objects cannot be deleted or changed until the period expires. Versioning alone, editable policies, and lifecycle transitions do not provide immutability.
Question 5Secure access to AWS resourcesMedium
Developers need temporary AWS access mapped from their corporate Active Directory identities without creating per-user IAM users. What should be used?
A
Use IAM Identity Center integrated with the corporate directory for SSO
B
Create an IAM user for each employee and rotate keys weekly
C
Share a single IAM user across the development team
D
Issue long-term access keys mapped to each AD account
Show answer & explanation
Correct answer: A — Use IAM Identity Center integrated with the corporate directory for SSO
IAM Identity Center connects an external identity source such as Active Directory and grants federated, temporary access through permission sets, avoiding per-user IAM users and long-term keys. Creating or sharing IAM users and distributing long-term keys does not scale and raises credential risk.
Question 6Secure workloads and applicationsMedium
A company needs centralized, stateful filtering of VPC traffic including domain allow-listing across multiple VPCs. Which service should be used?
A
Security groups on each instance
B
Amazon GuardDuty
C
AWS Network Firewall
D
A single NAT gateway
Show answer & explanation
Correct answer: C — AWS Network Firewall
AWS Network Firewall provides managed, stateful network filtering including domain allow-listing and intrusion prevention for VPC traffic. Security groups are instance level, GuardDuty is detection only, and a NAT gateway offers connectivity without content filtering.
Question 7Data security controlsMedium
A solutions architect must encrypt an existing unencrypted EBS volume. What is the correct approach?
A
Create a snapshot, copy it with encryption, and restore a new volume
B
Toggle an encrypt flag on the running volume in place
C
Move the volume to a different Availability Zone to encrypt it
D
Attach the volume to a Windows instance to use BitLocker
Show answer & explanation
Correct answer: A — Create a snapshot, copy it with encryption, and restore a new volume
EBS volumes cannot be encrypted in place, so you snapshot the volume, copy the snapshot with encryption enabled, then create a new encrypted volume from it. There is no in-place toggle, and moving Availability Zones or using guest tools does not provide EBS encryption.
Question 8Secure access to AWS resourcesHard
A company must manage permissions for hundreds of users by job function using reusable permission sets. What is the best practice?
A
Attach inline policies to each individual user
B
Use one administrator policy for the whole company
C
Assign users to IAM groups with managed policies by job function
D
Embed credentials in each application instead
Show answer & explanation
Correct answer: C — Assign users to IAM groups with managed policies by job function
IAM groups with attached managed policies let you manage permissions by job function and apply them consistently to many users. Inline per-user policies do not scale, a single broad policy violates least privilege, and embedding credentials is insecure.
Question 9Secure workloads and applicationsHard
A company wants to expose an internal application to consumers in other VPCs privately, without exposing it to the internet. Which approach is best?
A
VPC peering to each consumer VPC
B
A public Network Load Balancer
C
AWS PrivateLink with an interface VPC endpoint service
D
A Transit Gateway attachment for each consumer
Show answer & explanation
Correct answer: C — AWS PrivateLink with an interface VPC endpoint service
PrivateLink publishes a service behind a Network Load Balancer as an endpoint service, and consumers connect through interface endpoints using private IPs. VPC peering and Transit Gateway join whole networks, and a public NLB exposes the service to the internet.
Question 10Data security controlsHard
A security team must automatically discover and classify sensitive PII stored across many S3 buckets in the organization. Which service is purpose-built for this?
A
AWS Config rules
B
Amazon Inspector
C
AWS CloudTrail data events
D
Amazon Macie
Show answer & explanation
Correct answer: D — Amazon Macie
Macie uses machine learning to discover, classify, and report on sensitive data such as PII in S3. Config evaluates resource configuration, Inspector scans workloads for vulnerabilities, and CloudTrail records API activity rather than classifying object contents.
Want more SAA-C03 practice questions?
Take the free SAA-C03 practice test: 30 questions per session with instant explanations. Unlock all 500 questions plus timed exam mode for $11.99 one-time.
Everything you need to know about AWS Certified Solutions Architect – Associate
What is the SAA-C03 exam?
SAA-C03 is the AWS Certified Solutions Architect – Associate exam. It validates designing secure, resilient, high-performing, and cost-optimized AWS architectures. The exam costs $150, contains 65 questions, and requires a passing score of 720 out of 1000.
Is the AWS Solutions Architect Associate worth it?
Yes — SAA-C03 is one of the highest-value IT certifications and consistently ranks among the top-paying cloud credentials. It signals practical AWS design skills to employers and is the natural next step after Cloud Practitioner for engineers and architects.
How hard is SAA-C03?
SAA-C03 is moderately challenging. Questions are scenario-based and often have multiple technically correct answers, so you must pick the best fit given cost, performance, and resilience constraints. Most candidates need 8–12 weeks of study and hands-on practice.
Do I need experience for SAA-C03?
AWS recommends about one year of hands-on AWS experience, but it is not required. Many candidates pass with focused study and lab practice. Familiarity with core services — EC2, S3, VPC, RDS, IAM, and Auto Scaling — is essential.
How many questions are on SAA-C03?
The SAA-C03 exam has 65 questions (50 scored, 15 unscored) with a 130-minute time limit. Questions are multiple-choice and multiple-response. The passing score is 720 out of 1000.
What is the SAA-C03 passing score?
The SAA-C03 passing score is 720 out of 1000 — slightly higher than foundational exams. AWS uses scaled scoring across the four domains, so the exact count of correct answers needed is not published.
How long does it take to prepare for SAA-C03?
Most candidates prepare in 8–12 weeks studying 1–2 hours per day. Build hands-on familiarity with VPC, IAM, EC2, S3, RDS, and serverless services, study the Well-Architected Framework, and complete several full-length mock exams.
How long is the SAA-C03 certification valid?
AWS Solutions Architect – Associate is valid for 3 years. You can recertify by passing a higher-level exam in the track or by retaking the current SAA exam before expiry.
How much does the SAA-C03 exam cost?
The AWS Certified Solutions Architect – Associate (SAA-C03) exam costs $150 USD, plus applicable taxes. It has 65 questions, a 130-minute time limit, and a passing score of 720 out of 1000.
Is there a free SAA-C03 practice test?
Yes. CertSharp offers a free SAA-C03 practice test for the AWS Solutions Architect – Associate exam: 30 questions per session with detailed explanations, no credit card required. The full 500-question SAA-C03 bank, including timed exam mode, is $11.99 one-time with lifetime access.