AWS Certified Solutions Architect - Associate (SAA-C03) #16 Full-Scale Multiple-Choice Practice Exam — 50 Questions + Explanations
18 min read
This is the step that checks whether everything from #1 through #15 is locked into your head. You solve 50 questions at the same domain weights as the real exam.
How to Take It #
- Solve within 90–100 minutes (the real exam is 65 questions/130 minutes, but this practice exam is based on 50 questions).
- Don’t check each explanation immediately; solve all the way through, then score.
- Getting 36 or more (72%) puts you safely in the passing range.
- If a domain looks weak, go back to its post and review it.
Domain Distribution #
| Domain | Questions | Range |
|---|---|---|
| Domain 1 — Security (30%) | 15 | Q1 ~ Q15 |
| Domain 2 — Resilience (26%) | 13 | Q16 ~ Q28 |
| Domain 3 — High Performance (24%) | 12 | Q29 ~ Q40 |
| Domain 4 — Cost Optimization (20%) | 10 | Q41 ~ Q50 |
Domain 1 — Secure Architectures #
Q1. An application running on EC2 needs to access an S3 bucket. What is the most secure method?
Explanation
Giving EC2 an IAM Role automatically supplies temporary credentials, so there’s no need to store long-lived keys. Every key-storage approach is wrong.
Q2. Multiple policies apply at once and one of them has an explicit Deny. What is the final result?
Explanation
An explicit Deny takes precedence over any Allow. If even one Deny exists, the final result is deny.
Q3. A user in account B must control a resource in account A. What is the most appropriate design?
Explanation
The standard for cross-account access is Role delegation. Create a Role in A, put B in the trust policy, and have B AssumeRole.
Q4. You must block one specific malicious IP at the subnet level. What is appropriate?
Explanation
Security groups support allow rules only. Blocking a specific IP (Deny) is handled by a NACL (Network ACL). A security group is a stateful firewall at the instance (ENI) level, while a NACL is a stateless firewall at the subnet level that supports Deny rules.
Q5. You want to delegate permissions to a developer while limiting the maximum permissions they can hold. What is appropriate?
Explanation
The cap on the maximum permissions of an individual IAM identity is a Permission Boundary. An SCP (Service Control Policy) is an account/OU (Organizational Unit)-level cap, a trust policy defines who can assume a Role, and a session token is the temporary credential issued by AssumeRole.
Q6. You must prevent any account in the entire organization from using a specific region. What is appropriate?
Explanation
An organization-wide (Organizations) permission cap (guardrail) is an SCP (Service Control Policy). An SCP doesn’t grant permissions; it limits the allowed scope. A Permission Boundary is the permission cap on a single individual IAM identity, not the whole organization, so it doesn’t fit blocking all accounts.
Q7. You want to encrypt an already-running, unencrypted RDS instance. What is the correct procedure?
Explanation
RDS encryption can only be enabled at creation time. An existing instance goes through the snapshot → encrypted copy → restore path.
Q8. You must be able to audit who decrypted an S3 object and when. What is the appropriate encryption method?
Explanation
SSE-KMS lets you audit KMS (Key Management Service) key usage with CloudTrail, so you can trace “who decrypted it.” SSE-S3 has S3 manage the keys entirely, so it leaves no audit log of individual key usage.
Q9. Regulations require that key material be controlled solely on dedicated hardware. What is appropriate?
Explanation
When keys must be controlled fully and solely on a dedicated (single-tenant) HSM (Hardware Security Module), it’s CloudHSM. KMS managed keys are a multi-tenant environment, and Secrets Manager , Parameter Store are services for storing secrets and configuration values, not for dedicated control of key material.
Q10. An instance in a private subnet must access S3 without going through the internet. What is the most cost-effective method?
Explanation
S3 , DynamoDB get private access via the free Gateway VPC (Virtual Private Cloud) Endpoint. NAT incurs cost and the traffic takes an internet path. An Interface Endpoint can also be used for S3, but it’s billed per hour and per data, so for cost efficiency the free Gateway Endpoint is the answer.
Q11. A private instance must access SQS over a private path. What is appropriate?
Explanation
Services other than S3 , DynamoDB (such as SQS) get private access via an Interface Endpoint (PrivateLink). A Gateway Endpoint is used only for the two services S3 , DynamoDB, and VPC peering , Transit Gateway are for connecting VPCs to each other, which is different from private access to AWS managed services.
Q12. You must provide your service into a customer’s VPC without VPC peering and without public exposure. What is appropriate?
Explanation
PrivateLink registers a service behind an NLB (Network Load Balancer) as an endpoint service, exposing only that specific service privately without peering. VPC peering connects both VPCs in their entirety, so the exposure scope is broad, and Direct Connect is a dedicated on-premises〜AWS line, which serves a different purpose.
Q13. You must protect a web application from SQL injection and XSS. What is appropriate?
Explanation
Blocking Layer 7 web attacks (SQLi/XSS) is WAF (Web Application Firewall). You attach it to CloudFront/ALB/API Gateway. Shield Standard is L3/L4 DDoS (Distributed Denial of Service) defense, and GuardDuty is threat detection only — it doesn’t block inline.
Q14. Mobile app users must, after logging in, receive temporary AWS credentials to upload directly to S3. What is appropriate?
Explanation
Issuing temporary AWS credentials is the role of the Identity Pool. The User Pool goes only as far as authentication (login , tokens).
Q15. You must automatically rotate RDS database credentials on a schedule. What is appropriate?
Explanation
Built-in automatic rotation is Secrets Manager, and it integrates with RDS. Parameter Store does not provide automatic rotation out of the box.
Domain 2 — Resilient Architectures #
Q16. You must route to different target groups based on the HTTP path (
/api, /img). What is the appropriate load balancer?Explanation
Path- and host-based L7 routing is the ALB (Application Load Balancer). The NLB (Network Load Balancer) is L4, so it can’t see the HTTP path, and the GLB (Gateway Load Balancer) is for fronting security appliances such as firewalls.
Q17. You need ultra-high-performance TCP handling and a static IP. What is the appropriate load balancer?
Explanation
L4 ultra-high performance , ultra-low latency with a static IP (Elastic IP) is the NLB’s (Network Load Balancer) characteristic. The ALB has no static IP, and the GLB is for security appliances.
Q18. You must automatically increase and decrease the number of EC2 instances based on CPU utilization. What is appropriate?
Explanation
Demand-based horizontal scaling is the ASG’s (Auto Scaling Group) Target Tracking policy. Replacing with a larger instance is vertical scaling, not automatic scale in/out.
Q19. Traffic surges predictably every day at 9 a.m. What is the most appropriate scaling?
Explanation
A pattern with a known time is handled by adjusting capacity in advance with Scheduled Scaling. Simple Scaling reacts only after a metric crosses a threshold, so it’s a step behind for a predicted surge.
Q20. You must detect and replace cases where the instance is alive but the application doesn’t respond. What is appropriate?
Explanation
Application-level failures (HTTP 200, etc.) are detected with ELB health checks. EC2 status checks only look at instance status.
Q21. You want to provide the highest level of high availability for the web tier. What is the appropriate combination?
Explanation
The combination of distributing across multiple AZs + ALB + ASG absorbs both instance failures and AZ failures.
Q22. You want to minimize DR cost, and a long recovery time is acceptable. What is the appropriate strategy?
Explanation
The cheapest strategy, but the slowest to recover, is Backup & Restore. Pilot Light , Warm Standby keep some resources always on, so they’re faster but cost more.
Q23. For DR, you keep the database always replicated and start the application servers at disaster time. Which strategy is this?
Explanation
Keeping only the core (DB) minimally running and starting the rest at disaster time is Pilot Light. Warm Standby is more expensive in that it keeps a scaled-down full stack always running, and Backup & Restore has no always-on replication.
Q24. You require near-zero downtime (RTO/RPO ≈ 0) and cost is not a concern. What is the appropriate strategy?
Explanation
Multi-Site Active/Active, where two regions take production traffic simultaneously, brings RTO (Recovery Time Objective)/RPO (Recovery Point Objective) to nearly zero. All the other strategies take time to recover, so they don’t meet a near-zero-downtime requirement.
Q25. On a regional failure, you must automatically switch DNS to another region. What is appropriate?
Explanation
Health-check-based automatic DNS failover is Route 53 Failover routing.
Q26. You must be able to restore RDS to any point within the last 30 days. What is appropriate?
Explanation
RDS automated backups provide point-in-time recovery (PITR) within the retention period (up to 35 days). A manual snapshot only restores to the moment it was taken, so point-in-time recovery isn’t possible.
Q27. You want to centrally manage EBS , RDS , DynamoDB backups with a single policy. What is appropriate?
Explanation
The service that manages backups across multiple services with a central policy is AWS Backup.
Q28. For compliance, you must keep backups so they cannot be deleted or changed (immutable). What is appropriate?
Explanation
Locking backups as WORM (Write Once Read Many, immutable) is Backup Vault Lock. S3 handles the same thing with Object Lock.
Domain 3 — High-Performing Architectures #
Q29. You want to run interruption-tolerant, large-scale batch processing at the lowest cost. What is the appropriate purchasing option?
Explanation
Interruptible stateless , batch workloads suit Spot, which is up to 90% cheaper. RI (Reserved Instance) is a commitment discount for always-on workloads, and Dedicated Host is for licensing , isolation requirements, which differ from the goal of minimizing cost.
Q30. It runs only briefly when an event occurs, and you don’t want to manage servers. What is appropriate?
Explanation
For event-driven short runs (up to 15 minutes) with no server management, the choice is Lambda.
Q31. An in-memory database workload needs a very large amount of memory. What is the appropriate instance family?
Explanation
In-memory DB , large-memory workloads are the memory-optimized family (R/X).
Q32. You want to reduce database read load with an in-memory cache, and you need replication and persistence. What is appropriate?
Explanation
An in-memory cache that needs persistence , replication , Multi-AZ is Redis. Memcached is a multithreaded simple cache with no replication or persistence, and DAX is a DynamoDB-only cache.
Q33. You must lower DynamoDB read responses to the microsecond level. What is appropriate?
Explanation
DAX (DynamoDB Accelerator), the DynamoDB-only in-memory cache, lowers reads to microseconds. ElastiCache is a general-purpose cache that doesn’t integrate automatically with DynamoDB, so the application must handle the caching logic itself.
Q34. You want to deliver content to users worldwide with low latency. What is appropriate?
Explanation
The CDN (Content Delivery Network) that caches content at the edge and delivers it close to users is CloudFront. Global Accelerator accelerates traffic over the AWS backbone without caching, so it serves a different purpose than cached content delivery.
Q35. Multiple Linux EC2 instances across multiple AZs must share the same files simultaneously. What is appropriate?
Explanation
The Linux file system shared by multiple instances across multiple AZs is EFS. EBS is for a single AZ , single instance.
Q36. Windows servers must use a shared file system over SMB. What is appropriate?
Explanation
Windows SMB (Server Message Block) shares are FSx for Windows File Server. EFS is Linux NFS (Network File System), and FSx for Lustre is a high-performance parallel file system for HPC , machine learning.
Q37. You can’t predict the access pattern of data to store in S3 and want to optimize cost automatically. What is the appropriate class?
Explanation
When you don’t know the access pattern, the one that moves tiers automatically to optimize cost is Intelligent-Tiering. One Zone-IA is single AZ, so its durability is lower, and Glacier Deep Archive isn’t immediately accessible, so neither fits data with an unknown pattern.
Q38. You want to keep rarely accessed data for the long term at the lowest cost, and a 12-hour retrieval is acceptable. What is the appropriate class?
Explanation
For lowest-cost long-term storage where a long retrieval time is acceptable, it’s Glacier Deep Archive. Glacier Instant Retrieval allows immediate lookups but costs more, and Standard-IA has a much higher storage unit price.
Q39. You must distribute the read load of a relational database. What is appropriate?
Explanation
Read scaling is the read replica. Multi-AZ is for high availability, and the standby doesn’t take reads.
Q40. You need a key-value model with millisecond responses, virtually unlimited scaling, and no server management. What is appropriate?
Explanation
The serverless NoSQL key-value DB that scales without limit is DynamoDB. Aurora , RDS are managed but relational, and Redshift is an OLAP (Online Analytical Processing) data warehouse, not for low-latency key-value lookups.
Domain 4 — Cost Optimization #
Q41. It’s a steady workload, but the instance family must be changeable and you also use Fargate , Lambda. What is the most appropriate savings option?
Explanation
The flexible commitment that applies regardless of instance family , region and even to Fargate , Lambda is Compute Savings Plans. EC2 Instance Savings Plans , Standard RI (Reserved Instance) are tied to a specific instance family , region, so they’re less flexible and don’t apply to Fargate , Lambda.
Q42. You deliver content to users worldwide and want to reduce the origin’s data transfer cost. What is appropriate?
Explanation
CloudFront caches responses at the edge, reducing origin outbound transfer and load.
Q43. You want to visualize and analyze the past few months’ cost and forecast future cost. What is appropriate?
Explanation
Cost visualization , analysis , forecasting is Cost Explorer. AWS Budgets is for threshold alerts, and CloudWatch is for monitoring resource metrics, so neither is a cost-trend analysis tool.
Q44. You want to be alerted when monthly cost exceeds a set threshold. What is appropriate?
Explanation
Threshold-overrun alerting is AWS Budgets. Cost Explorer is an analysis , forecasting tool, CUR (Cost and Usage Report) is a detailed billing-data export, and Compute Optimizer is for resource right-sizing recommendations, so none of them is for alerting.
Q45. You want to find idle , underutilized resources across the account to reduce cost. What is appropriate?
Explanation
The one that comprehensively checks cost , security , performance , limits and identifies idle resources is Trusted Advisor. CloudTrail is an API-call audit log, Config tracks configuration changes , evaluates compliance, and Inspector scans for vulnerabilities (CVEs), so they differ from identifying cost savings.
Q46. You want right-sizing recommendations for EC2 , EBS , Lambda. What is appropriate?
Explanation
The tool specialized in usage-metric-based right-sizing recommendations is Compute Optimizer. Trusted Advisor also points out idle resources, but ML-based instance right-sizing recommendations are Compute Optimizer’s exclusive role, and Cost Explorer is a cost-analysis tool.
Q47. You want to combine billing across multiple accounts to get a volume discount and manage it with one invoice. What is appropriate?
Explanation
Multi-account billing consolidation and volume discounts are Organizations’ Consolidated Billing. Cost allocation tags are for breaking down a bill, and Savings Plans are a commitment discount, so neither is a single-invoice consolidation feature.
Q48. You want to break down cost by team , project. What is appropriate?
Explanation
Attaching tags to resources to break down cost is cost allocation tags.
Q49. You want to store regenerable data in S3 as cheaply as possible, and single-AZ storage is acceptable. What is the appropriate class?
Explanation
One Zone-IA, cheaper because it’s single AZ (Availability Zone), suits data that can be regenerated if lost. Standard-IA is stored across multiple AZs, so it’s more expensive, and Glacier Instant Retrieval is for infrequently used archives, which is a different nature.
Q50. You want to receive the most detailed line-item billing , usage data for analysis. What is appropriate?
Explanation
The one that exports the most granular billing data to S3 for analysis with Athena/QuickSight is CUR (Cost and Usage Report). Cost Explorer is summary-level analysis at the console-graph level, so it doesn’t provide line-item-level raw data.
Scoring and Wrap-up #
Total Score
Correct 0 / 0
Answered 0 / 0
36 or more (72%) puts you safely in the passing range. For missed questions, don’t just memorize the answer; review until you can explain “what the constraint keyword was and why that option is best” by the criteria of #15. In particular, lock down the heavily weighted security domain and the frequently confused pairs (Multi-AZ vs. read replica, SG vs. NACL, Gateway vs. Interface Endpoint) to the very end.
Closing the Series #
Starting from #1 Exam Introduction, we made a full pass over the four domains — security (30%) → resilience (26%) → high performance (24%) → cost (20%) — and finished with exam strategy and a practice exam. If you remember that SAA-C03 isn’t about rote memorization but about choosing a design that fits the requirements, you won’t be shaken even by a scenario you’ve never seen.
After passing, the developer-oriented Developer Associate (DVA-C02) track or the operations-oriented SysOps Administrator Associate (SOA-C02) track follows naturally as the next step. If you want more hands-on instinct, going back to the 27-part AWS hands-on track and working through things directly in the console makes for good review. Wishing you success on the exam.