SAA-C03 sample exam questions

15 exam-style questions for AWS SAA-C03: Solutions Architect Associate, with answers and explanations. Take them as a timed practice exam first if you want a score out of 1000.

Take the free practice exam SAA-C03 exam guide
  1. Question 1Single choiceDesign Secure Architectures
    A company's containerized application runs on an Amazon EC2 instance. The application needs to download security certificates before it can communicate with other business applications. The company wants a highly secure solution to encrypt and decrypt the certificates in near real time. The solution also needs to store data in highly available storage after the data is encrypted.
    Which solution will meet these requirements with the LEAST operational overhead?
    1. A
      Create AWS Secrets Manager secrets for encrypted certificates. Manually update the certificates as needed. Control access to the data by using fine-grained IAM access.
    2. B
      Create an AWS Lambda function that uses the Python cryptography library to receive and perform encryption operations. Store the function in an Amazon S3 bucket.
    3. C
      Create an AWS Key Management Service (AWS KMS) customer managed key. Allow the EC2 role to use the KMS key for encryption operations. Store the encrypted data on Amazon S3.
    4. D
      Create an AWS Key Management Service (AWS KMS) customer managed key. Allow the EC2 role to use the KMS key for encryption operations. Store the encrypted data on Amazon Elastic Block Store (Amazon EBS) volumes.
    Show answer

    Correct answer: C

    Why

    A KMS customer managed key handles encryption operations with no key infrastructure to run, and S3 is highly available storage. Secrets Manager relies on manual updates here, a custom Lambda function takes more work, and an EBS volume is limited to one Availability Zone.

  2. Question 2Single choiceDesign Resilient Architectures
    A company has a multi-tier application that runs six front-end web servers in an Amazon EC2 Auto Scaling group in a single Availability Zone behind an Application Load Balancer (ALB). A solutions architect needs to modify the infrastructure to be highly available without modifying the application.

    Which architecture should the solutions architect choose that provides high availability?
    1. A
      Create an Auto Scaling group that uses three instances across each of two Regions.
    2. B
      Modify the Auto Scaling group to use three instances across each of two Availability Zones.
    3. C
      Create an Auto Scaling template that can be used to quickly create more instances in another Region.
    4. D
      Change the ALB in front of the Amazon EC2 instances in a round-robin configuration to balance traffic to the web tier.
    Show answer

    Correct answer: B

    Why

    Spreading instances across two Availability Zones provides high availability with no application change. An Auto Scaling group cannot span Regions, a template alone gives no failover, and changing the routing algorithm does not add availability.

  3. Question 3Multiple responseDesign High-Performing Architectures
    A company recently announced the deployment of its retail website to a global audience. The website runs on multiple Amazon EC2 instances behind an Elastic Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones.

    The company wants to provide its customers with different versions of content based on the devices that the customers use to access the website.

    Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)
    1. A
      Configure Amazon CloudFront to cache multiple versions of the content.
    2. B
      Configure a host header in a Network Load Balancer to forward traffic to different instances.
    3. C
      Configure a Lambda@Edge function to send specific objects to users based on the User-Agent header.
    4. D
      Configure AWS Global Accelerator. Forward requests to a Network Load Balancer (NLB). Configure the NLB to set up host-based routing to different EC2 instances.
    5. E
      Configure AWS Global Accelerator. Forward requests to a Network Load Balancer (NLB). Configure the NLB to set up path-based routing to different EC2 instances.
    Show answer

    Correct answer: A, C

    Why

    CloudFront can cache multiple versions of content, and Lambda@Edge can choose them based on the User-Agent header. NLBs work at the connection level and do not support host-based or path-based routing.

  4. Question 4Single choiceOther
    A solutions architect configured a VPC that has a small range of IP addresses. The number of Amazon EC2 instances that are in the VPC is increasing, and there is an insufficient number of IP addresses for future workloads.

    Which solution resolves this issue with the LEAST operational overhead?
    1. A
      Add an additional IPv4 CIDR block to increase the number of IP addresses and create additional subnets in the VPC. Create new resources in the new subnets by using the new CIDR.
    2. B
      Create a second VPC with additional subnets. Use a peering connection to connect the second VPC with the first VPC Update the routes and create new resources in the subnets of the second VPC.
    3. C
      Use AWS Transit Gateway to add a transit gateway and connect a second VPC with the first VPUpdate the routes of the transit gateway and VPCs. Create new resources in the subnets of the second VPC.
    4. D
      Create a second VPC. Create a Site-to-Site VPN connection between the first VPC and the second VPC by using a VPN-hosted solution on Amazon EC2 and a virtual private gateway. Update the route between VPCs to the traffic through the VPN. Create new resources in the subnets of the second VPC.
    Show answer

    Correct answer: A

    Why

    Adding a secondary IPv4 CIDR block to the VPC and creating subnets from it requires little work. A second VPC with peering, a transit gateway or a VPN adds connections and routes to manage.

  5. Question 5Single choiceDesign Resilient Architectures
    A company is making a prototype of the infrastructure for its new website by manually provisioning the necessary infrastructure. This infrastructure includes an Auto Scaling group, an Application Load Balancer and an Amazon RDS database. After the configuration has been thoroughly validated, the company wants the capability to immediately deploy the infrastructure for development and production use in two Availability Zones in an automated fashion.

    What should a solutions architect recommend to meet these requirements?
    1. A
      Use AWS Systems Manager to replicate and provision the prototype infrastructure in two Availability Zones
    2. B
      Define the infrastructure as a template by using the prototype infrastructure as a guide. Deploy the infrastructure with AWS CloudFormation.
    3. C
      Use AWS Config to record the inventory of resources that are used in the prototype infrastructure. Use AWS Config to deploy the prototype infrastructure into two Availability Zones.
    4. D
      Use AWS Elastic Beanstalk and configure it to use an automated reference to the prototype infrastructure to automatically deploy new environments in two Availability Zones.
    Show answer

    Correct answer: B

    Why

    A CloudFormation template repeatedly deploys the same infrastructure in an automated way. Systems Manager and AWS Config do not deploy infrastructure like this, and Elastic Beanstalk cannot reference a prototype to create environments.

  6. Question 6Single choiceDesign Cost-Optimized Architectures
    A company wants to build a logging solution for its multiple AWS accounts. The company currently stores the logs from all accounts in a centralized account. The company has created an Amazon S3 bucket in the centralized account to store the VPC flow logs and AWS CloudTrail logs. All logs must be highly available for 30 days for frequent analysis, retained for an additional 60 days for backup purposes, and deleted 90 days after creation.

    Which solution will meet these requirements MOST cost-effectively?
    1. A
      Transition objects to the S3 Standard storage class 30 days after creation. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
    2. B
      Transition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class 30 days after creation. Move all objects to the S3 Glacier Flexible Retrieval storage class after 90 days. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
    3. C
      Transition objects to the S3 Glacier Flexible Retrieval storage class 30 days after creation. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
    4. D
      Transition objects to the S3 One Zone-Infrequent Access (S3 One Zone-IA) storage class 30 days after creation. Move all objects to the S3 Glacier Flexible Retrieval storage class after 90 days. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
    Show answer

    Correct answer: C

    Why

    Logs stay in S3 Standard for 30 days of frequent use, then S3 Glacier Flexible Retrieval is the cheapest for backup, and they expire at 90 days. Transitioning to Standard does nothing, and options B and D transition again at the same time they expire, while keeping costs higher.

  7. Question 7Single choiceDesign Cost-Optimized Architectures
    A company has two VPCs that are located in the us-west-2 Region within the same AWS account. The company needs to allow network traffic between these VPCs. Approximately 500 GB of data transfer will occur between the VPCs each month.

    What is the MOST cost-effective solution to connect these VPCs?
    1. A
      Implement AWS Transit Gateway to connect the VPCs. Update the route tables of each VPC to use the transit gateway for inter-VPC communication.
    2. B
      Implement an AWS Site-to-Site VPN tunnel between the VPCs. Update the route tables of each VPC to use the VPN tunnel for inter-VPC communication.
    3. C
      Set up a VPC peering connection between the VPCs. Update the route tables of each VPC to use the VPC peering connection for inter-VPC communication.
    4. D
      Set up a 1 GB AWS Direct Connect connection between the VPCs. Update the route tables of each VPC to use the Direct Connect connection for inter-VPC communication.
    Show answer

    Correct answer: C

    Why

    VPC peering connects two VPCs in the same Region at the lowest cost, with no hourly charge. Transit Gateway adds attachment and data charges, a VPN adds cost and limits, and Direct Connect is for on-premises links.

  8. Question 8Single choiceDesign High-Performing Architectures
    A company manages an application that stores data on an Amazon RDS for PostgreSQL Multi-AZ DB instance. Increases in traffic are causing performance problems. The company determines that database queries are the primary reason for the slow performance.

    What should a solutions architect do to improve the application's performance?
    1. A
      Serve read traffic from the Multi-AZ standby replica.
    2. B
      Configure the DB instance to use Transfer Acceleration.
    3. C
      Create a read replica from the source DB instance. Serve read traffic from the read replica.
    4. D
      Use Amazon Kinesis Data Firehose between the application and Amazon RDS to increase the concurrency of database requests.
    Show answer

    Correct answer: C

    Why

    A read replica takes read queries off the primary instance. A Multi-AZ instance standby does not serve reads, Transfer Acceleration is an S3 feature, and Firehose does not sit between an application and a database.

  9. Question 9Single choiceDesign Secure Architectures
    A company collects and shares research data with the company's employees all over the world. The company wants to collect and store the data in an Amazon S3 bucket and process the data in the AWS Cloud. The company will share the data with the company's employees. The company needs a secure solution in the AWS Cloud that minimizes operational overhead.

    Which solution will meet these requirements?
    1. A
      Use an AWS Lambda function to create an S3 presigned URL. Instruct employees to use the URL.
    2. B
      Create an IAM user for each employee. Create an IAM policy for each employee to allow S3 access. Instruct employees to use the AWS Management Console.
    3. C
      Create an S3 File Gateway. Create a share for uploading and a share for downloading. Allow employees to mount shares on their local computers to use S3 File Gateway.
    4. D
      Configure AWS Transfer Family SFTP endpoints. Select the custom identity provider options. Use AWS Secrets Manager to manage the user credentials Instruct employees to use Transfer Family.
    Show answer

    Correct answer: A

    Why

    A Lambda function can generate S3 presigned URLs, which give employees secure temporary access with no servers or user management. IAM users for each employee take a lot of work, File Gateway requires a local appliance, and SFTP with custom identity adds services.

  10. Question 10Single choiceDesign Cost-Optimized Architectures
    A company uses AWS Cost Explorer to monitor its AWS costs. The company notices that Amazon Elastic Block Store (Amazon EBS) storage and snapshot costs increase every month. However, the company does not purchase additional EBS storage every month. The company wants to optimize monthly costs for its current storage usage.

    Which solution will meet these requirements with the LEAST operational overhead?
    1. A
      Use logs in Amazon CloudWatch Logs to monitor the storage utilization of Amazon EBS. Use Amazon EBS Elastic Volumes to reduce the size of the EBS volumes.
    2. B
      Use a custom script to monitor space usage. Use Amazon EBS Elastic Volumes to reduce the size of the EBS volumes.
    3. C
      Delete all expired and unused snapshots to reduce snapshot costs.
    4. D
      Delete all nonessential snapshots. Use Amazon Data Lifecycle Manager to create and manage the snapshots according to the company's snapshot policy requirements.
    Show answer

    Correct answer: D

    Why

    Deleting nonessential snapshots cuts costs, and Data Lifecycle Manager keeps snapshots under control automatically afterward. Deleting once only helps temporarily, and EBS Elastic Volumes cannot reduce volume size.

  11. Question 11Single choiceDesign Resilient Architectures
    A company wants to rearchitect a large-scale web application to a serverless microservices architecture. The application uses Amazon EC2 instances and is written in Python.

    The company selected one component of the web application to test as a microservice. The component supports hundreds of requests each second. The company wants to create and test the microservice on an AWS solution that supports Python. The solution must also scale automatically and require minimal infrastructure and minimal operational support.

    Which solution will meet these requirements?
    1. A
      Use a Spot Fleet with auto scaling of EC2 instances that run the most recent Amazon Linux operating system.
    2. B
      Use an AWS Elastic Beanstalk web server environment that has high availability configured.
    3. C
      Use Amazon Elastic Kubernetes Service (Amazon EKS). Launch Auto Scaling groups of self-managed EC2 instances.
    4. D
      Use an AWS Lambda function that runs custom developed code.
    Show answer

    Correct answer: D

    Why

    Lambda supports Python, scales automatically and has no infrastructure to manage. Spot Fleets, Elastic Beanstalk and EKS with self-managed instances all leave more infrastructure to manage.

  12. Question 12Single choiceDesign High-Performing Architectures
    A company uses Salesforce. The company needs to load existing data and ongoing data changes from Salesforce to Amazon Redshift for analysis. The company does not want the data to travel over the public internet.

    Which solution will meet these requirements with the LEAST development effort?
    1. A
      Establish a VPN connection from the VPC to Salesforce. Use AWS Glue DataBrew to transfer data.
    2. B
      Establish an AWS Direct Connect connection from the VPC to Salesforce. Use AWS Glue DataBrew to transfer data.
    3. C
      Create an AWS PrivateLink connection in the VPC to Salesforce. Use Amazon AppFlow to transfer data.
    4. D
      Create a VPC peering connection to Salesforce. Use Amazon AppFlow to transfer data.
    Show answer

    Correct answer: C

    Why

    Amazon AppFlow moves Salesforce data to Redshift, including changes, with little work, and PrivateLink keeps it off the public internet. DataBrew prepares data rather than transfers it, and VPC peering and VPN connections cannot be made to Salesforce this way.

  13. Question 13Multiple responseOther
    A company uses a Microsoft SQL Server database. The company's applications are connected to the database. The company wants to migrate to an Amazon Aurora PostgreSQL database with minimal changes to the application code.

    Which combination of steps will meet these requirements? (Choose two.)
    1. A
      Use the AWS Schema Conversion Tool (AWS SCT) to rewrite the SQL queries in the applications.
    2. B
      Enable Babelfish on Aurora PostgreSQL to run the SQL queries from the applications.
    3. C
      Migrate the database schema and data by using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS).
    4. D
      Use Amazon RDS Proxy to connect the applications to Aurora PostgreSQL.
    5. E
      Use AWS Database Migration Service (AWS DMS) to rewrite the SQL queries in the applications.
    Show answer

    Correct answer: B, C

    Why

    Babelfish lets Aurora PostgreSQL understand SQL Server queries, so application code changes little, and SCT with DMS moves the schema and data. SCT and DMS do not rewrite queries in applications, and RDS Proxy manages connections.

  14. Question 14Single choiceOther
    A company is migrating five on-premises applications to VPCs in the AWS Cloud. Each application is currently deployed in isolated virtual networks on premises and should be deployed similarly in the AWS Cloud. The applications need to reach a shared services VPC. All the applications must be able to communicate with each other.

    If the migration is successful, the company will repeat the migration process for more than 100 applications.

    Which solution will meet these requirements with the LEAST administrative overhead?
    1. A
      Deploy software VPN tunnels between the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets to the shared services VPC.
    2. B
      Deploy VPC peering connections between the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets to the shared services VPC through the peering connection.
    3. C
      Deploy an AWS Direct Connect connection between the application VPCs and the shared services VPAdd routes from the application VPCs in their subnets to the shared services VPC and the applications VPCs. Add routes from the shared services VPC subnets to the applications VPCs.
    4. D
      Deploy a transit gateway with associations between the transit gateway and the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets and the application VPCs to the shared services VPC through the transit gateway.
    Show answer

    Correct answer: D

    Why

    A transit gateway connects all VPCs and shared services through one hub and scales to more than 100 applications. VPNs and peering connections do not scale well, and Direct Connect is for on-premises links rather than between VPCs.

  15. Question 15Single choiceDesign Secure Architectures
    A company wants to create an Amazon EMR cluster that multiple teams will use. The company wants to ensure that each team’s big data workloads can access only the AWS services that each team needs to interact with. The company does not want the workloads to have access to Instance Metadata Service Version 2 (IMDSv2) on the cluster’s underlying EC2 instances.

    Which solution will meet these requirements?
    1. A
      Configure interface VPC endpoints for each AWS service that the teams need. Use the required interface VPC endpoints to submit the big data workloads.
    2. B
      Create EMR runtime roles. Configure the cluster to use the runtime roles. Use the runtime roles to submit the big data workloads.
    3. C
      Create an EC2 IAM instance profile that has the required permissions for each team. Use the instance profile to submit the big data workloads.
    4. D
      Create an EMR security configuration that has the EnableApplicationScopedIAMRole option set to false. Use the security configuration to submit the big data workloads.
    Show answer

    Correct answer: B

    Why

    EMR runtime roles give each team's jobs only the AWS access they need, and those jobs cannot use the instance metadata service. VPC endpoints control network paths, an instance profile applies to the whole cluster, and turning off application-scoped roles does not do this.