Practice exams for AWS Certified Solutions Architect – Associate

65 questions · 130 min

  • Design Secure Architectures 19 questions
  • Design Resilient Architectures 17 questions
  • Design High-Performing Architectures 16 questions
  • Design Cost-Optimized Architectures 13 questions
Study mode Exam mode

25 free questions across all domains, no account required.

The full set of 65 questions is included in the All certifications subscription. Subscribe

How to prepare for AWS Certified Solutions Architect – Associate with InfraPrep

The 65 questions cover 4 domains: Design Secure Architectures, Design Resilient Architectures, Design High-Performing Architectures, Design Cost-Optimized Architectures. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 130 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

Sample question

Design Secure Architectures

A company manages many AWS accounts through AWS Organizations. The security team wants a guardrail that restricts which actions can be performed across member accounts, including each member account's root user, and that never by itself grants any permission. Which feature matches this requirement?

  1. Service control policy (SCP) attached at the organizational unit level
  2. IAM identity-based policy attached to a role, granting permissions directly to that one role
  3. Resource-based policy attached to a single resource, controlling access to that resource only
  4. IAM permissions boundary attached to a single user, capping only that user's own maximum permissions
Show the answer and the explanation

Correct answer: A

An SCP restricts permissions for IAM users and roles in member accounts, including the member account's root user, and it never grants permissions by itself, which matches the guardrail requirement.

Source: official documentation

Try the free questions