Practice Exam SAA-C03: AWS Certified Solutions Architect – Associate

Question bank: 115 · timed mock exam: 130 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab) Official prep course (opens in a new tab)

Exam guide: format, domains and how to prepare

Compare: SAA-C03 vs SOA-C03

Compare: SAA-C03 vs AZ-305

Compare: AZ-104 vs SAA-C03

  • Design Secure Architectures 33 questions
  • Design Resilient Architectures 31 questions
  • Design High-Performing Architectures 28 questions
  • Design Cost-Optimized Architectures 23 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 115 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for AWS Certified Solutions Architect – Associate with InfraPrep

The 115 questions cover 4 domains: Design Secure Architectures, Design Resilient Architectures, Design High-Performing Architectures, Design Cost-Optimized Architectures. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 130 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Design Secure Architectures

A company manages many AWS accounts through AWS Organizations. The security team wants a guardrail that restricts which actions can be performed across member accounts, including each member account's root user, and that never by itself grants any permission. Which feature matches this requirement?

  1. Service control policy (SCP) attached at the organizational unit level
  2. IAM identity-based policy attached to a role, granting permissions directly to that one role
  3. Resource-based policy attached to a single resource, controlling access to that resource only
  4. IAM permissions boundary attached to a single user, capping only that user's own maximum permissions
Show the answer and the explanation

Correct answer: A

An SCP restricts permissions for IAM users and roles in member accounts, including the member account's root user, and it never grants permissions by itself, which matches the guardrail requirement.

Source: official documentation

Question 2 Design Resilient Architectures

An order processing system must notify several independent downstream services, each with its own durable queue, whenever an order event occurs, without the producer knowing which or how many services will consume it. Which AWS messaging pattern matches this documented fan-out approach?

  1. Have every downstream service poll the same single shared Amazon SQS queue instead of its own queue
  2. Have the producer call each downstream service's API directly, one call per service
  3. Publish once to an SNS topic with each service's own SQS queue subscribed
  4. Use one Amazon SQS queue with multiple consumers all processing the same message copy
Show the answer and the explanation

Correct answer: C

AWS documentation describes fanning out Amazon SNS notifications to Amazon SQS queues: when you subscribe a queue to a topic, publishing one message to the topic delivers a copy to every subscribed queue, decoupling the producer from each consumer.

Source: official documentation

Question 3 Design High-Performing Architectures

A team is choosing an Amazon EFS performance mode for a new highly parallelized batch workload and is considering Max I/O for extra throughput. According to current AWS guidance, what should they know before choosing it?

  1. General Purpose performance mode cannot be used for parallelized workloads
  2. Max I/O has higher per-operation latency than General Purpose, and AWS recommends always using General Purpose performance mode
  3. Max I/O is required for any file system exceeding 5 read transactions per second
  4. Max I/O always has lower latency than General Purpose, so it should be preferred for latency-sensitive workloads
Show the answer and the explanation

Correct answer: B

AWS documentation states that Max I/O performance mode has higher per-operation latencies than General Purpose performance mode, and that for faster performance, AWS recommends always using General Purpose performance mode.

Source: official documentation

Question 4 Design Cost-Optimized Architectures

A company wants objects in an S3 bucket to move automatically to a cheaper storage class after a set number of days, without deleting them, applied consistently to both objects already in the bucket and objects added later. Which S3 feature matches this, according to AWS documentation?

  1. An S3 Lifecycle configuration with a transition action, applied to the bucket
  2. Manually copying objects to a cheaper storage class on a fixed schedule
  3. S3 Object Lock, configured with a retention period
  4. S3 Versioning, configured to expire noncurrent object versions
Show the answer and the explanation

Correct answer: A

AWS documentation defines a transition action as an action that defines when objects transition to another storage class, and states that once a lifecycle configuration is applied to a bucket, its rules apply to both existing objects and objects added later.

Source: official documentation

Question 5 Design Secure Architectures

An IAM identity-based policy explicitly allows a user to call s3:DeleteObject. The user's account is a member of an AWS Organizations organization, and the applicable SCP explicitly denies s3:DeleteObject. According to AWS documentation on policy evaluation, what happens when the user tries to delete the object?

  1. The request is denied, because the SCP's explicit deny overrides the identity-based policy's explicit allow
  2. The request is denied only if a resource-based policy on the object also separately denies the delete action
  3. The request is allowed, because identity-based policies always take precedence over any applicable SCP in the account
  4. The request is allowed, because SCPs are documented as restricting only the member account's root user, not regular IAM users
Show the answer and the explanation

Correct answer: A

AWS states that an explicit deny in the identity-based policy, an SCP, or an RCP overrides an allow, so the SCP's explicit deny blocks the action regardless of the identity-based policy's allow.

Source: official documentation

Question 6 Design Resilient Architectures

Messages in an order queue occasionally fail processing repeatedly because of a bug, and keep being redelivered, which hides the failure from the operations team. The team wants messages that fail processing a set number of times to be isolated automatically, without being lost, for later debugging. Which SQS configuration matches?

  1. A FIFO queue with content-based deduplication enabled
  2. A dead-letter queue configured through a redrive policy that specifies maxReceiveCount
  3. An indefinitely increased visibility timeout so failed messages are never redelivered
  4. Deleting and recreating the source queue whenever a failure occurs
Show the answer and the explanation

Correct answer: B

AWS documentation states that Amazon SQS supports dead-letter queues that source queues can target for messages not processed successfully, and that these are useful for isolating unconsumed messages to diagnose failures.

Source: official documentation

Question 7 Design High-Performing Architectures

A latency-sensitive application needs the fastest possible Amazon S3 data access for a performance-critical workload, and the team can accept storing the data in a single Availability Zone. Which S3 storage class is purpose-built for this, according to AWS documentation?

  1. S3 Standard-IA, intended for data accessed infrequently but needing rapid access when needed
  2. S3 Express One Zone, purpose-built to deliver consistent single-digit millisecond data access
  3. S3 Standard, the general-purpose default storage class for frequently accessed data
  4. S3 Glacier, intended for long-term archival of data that is rarely, if ever, retrieved
Show the answer and the explanation

Correct answer: B

AWS documentation describes S3 Express One Zone as a high-performance, single-zone storage class purpose-built to deliver consistent, single-digit millisecond data access for the most latency-sensitive applications.

Source: official documentation

Question 8 Design Cost-Optimized Architectures

A team plans to store small backup objects, about 50 KB each, in S3 One Zone-IA for roughly 10 days before deleting them. Does this match AWS's documented guidance for this storage class?

  1. Yes, but only when the objects are also enrolled in S3 Versioning
  2. No, because S3 One Zone-IA cannot be used to store backup objects at all
  3. Yes, S3 One Zone-IA has no minimum object size or storage duration guidance
  4. No, S3 One Zone-IA is documented as suitable for objects larger than 128 KB stored for at least 30 days
Show the answer and the explanation

Correct answer: D

AWS documentation states that S3 One Zone-IA storage classes are suitable for objects larger than 128 KB that you plan to store for at least 30 days, which the described 50 KB, 10-day objects do not meet.

Source: official documentation

Question 9 Design Secure Architectures

A developer signed in to the AWS Management Console as an IAM user switches to an IAM role in a different AWS account to perform temporary administrative tasks. According to AWS documentation, how do the developer's original user permissions and the role's permissions combine while the role is active?

  1. They are combined so both sets of permissions apply at once
  2. Only the role's permissions apply; the user permissions are temporarily given up until the role is exited
  3. The more restrictive of the two permission sets applies
  4. The role's permissions apply only to console actions, while the user's permissions still apply to the CLI
Show the answer and the explanation

Correct answer: B

AWS documentation states that when you switch to a role, you temporarily give up your user permissions and work only with the permissions assigned to the role, and your user permissions are restored automatically when you exit the role.

Source: official documentation

Question 10 Design Resilient Architectures

A client repeatedly sends requests to an Amazon API Gateway REST API faster than the configured steady-state rate and burst limits. According to AWS documentation, which algorithm governs this throttling, and what does the client receive once the limits are exceeded?

  1. A fixed window counter; excess requests are queued indefinitely until capacity frees up
  2. A sliding log algorithm; API Gateway automatically retries excess requests on the client's behalf
  3. A token bucket algorithm; the client may receive 429 Too Many Requests error responses
  4. A leaky bucket algorithm; excess requests are silently dropped with no response
Show the answer and the explanation

Correct answer: C

AWS documentation states that API Gateway throttles requests using the token bucket algorithm, and that clients may receive 429 Too Many Requests error responses once the steady-state rate and burst limits are exceeded.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.