kwizza
Amazon Web Services

AWS Certified Solutions Architect – Associate (SAA-C03) practice questions

8 sample questions from our 328-question Solutions Architect – Associate bank — one from each official domain, with the answer and a full explanation under each. Every question is original, written against the published exam objectives, and quality-checked before it reaches you.

SAA-C03AssociateIntermediate

Question 1 · Design Resilient Architectures

A healthcare startup, MedCore, must design an AWS environment that stores sensitive patient records with strict regulatory compliance. They want to ensure data durability for seven years with minimal administration overhead. Which AWS service and feature should they select to meet these requirements?

  1. A.Use Amazon EBS gp3 volumes attached to EC2 instances with daily snapshots.
  2. B.Store data in Amazon RDS Multi-AZ deployment with automated backups enabled.
  3. C.Save data in Amazon DynamoDB with point-in-time recovery (PITR) enabled.
  4. D.Store data in Amazon S3 using the S3 Glacier Deep Archive storage class with versioning enabled.
Show answer & explanation

Answer: D

Amazon S3 with the Glacier Deep Archive storage class provides highly durable storage designed for long-term retention and compliance, with minimal management. Enabling versioning ensures that object changes are tracked and recoverable. EBS snapshots and RDS backups are primarily for database or volume data, not ideal for long-term archival. DynamoDB PITR protects data changes but is not optimized for cost-efficient long-term storage.

Question 2 · Design Secure Applications and Architectures

An ecommerce company, QuickShop, is migrating to AWS and wants to design a network architecture that isolates the backend payment processing systems from the public internet but still allows the frontend web servers to be publicly accessible. Which VPC setup should the solutions architect recommend?

  1. A.Place frontend web servers in a public subnet and backend payment systems in a private subnet within the same VPC, using NAT Gateway for backend outbound access.
  2. B.Deploy both frontend and backend systems in the same public subnet with security groups restricting traffic between them.
  3. C.Create one public subnet for all systems and rely on OS-level firewalls to isolate backend from external access.
  4. D.Place backend payment systems in a separate VPC without internet gateway and frontend in a public subnet in another VPC with VPC peering between them.
Show answer & explanation

Answer: A

The best practice is to place frontend servers in a public subnet accessible via the internet gateway, while backend systems reside in private subnets without direct internet exposure. NAT Gateway allows backend systems to initiate outbound connections securely. Deploying both in a public subnet or relying only on OS firewalls increases exposure risk. Separate VPCs add complexity unless necessary.

Question 3 · Design High-Performing Architectures

TechNova runs a web app on EC2 instances behind an Application Load Balancer (ALB). Recently, they noticed increased latency during peak hours. They want to improve request handling performance without changing instance types. What should the architect do first to address this?

  1. A.Switch the ALB to a Network Load Balancer for lower latency at layer 4.
  2. B.Enable HTTP/2 on the ALB to improve multiplexing and reduce latency.
  3. C.Add a CloudFront distribution in front of the ALB to cache static content.
  4. D.Increase the session stickiness duration on the ALB to reduce connection overhead.
Show answer & explanation

Answer: C

Adding Amazon CloudFront as a CDN in front of the ALB can cache static assets closer to users, reducing load on EC2 instances and decreasing latency during peak traffic. HTTP/2 helps with multiplexing but may not address backend latency. Switching to NLB is suitable for TCP traffic but does not optimize HTTP. Increasing stickiness can cause uneven load distribution.

Question 4 · Design Cost-Optimized Architectures

A startup named DataViz wants to run a compute-heavy batch job on AWS with unpredictable daily volumes. They want to minimize costs while ensuring the batch jobs complete within 3 hours. Which AWS compute option best fits this need?

  1. A.Use Amazon EC2 Spot Instances with a fleet and Auto Scaling group to run batch jobs.
  2. B.Deploy AWS Lambda functions triggered every minute to process the jobs.
  3. C.Reserve EC2 instances with a 1-year term to ensure availability and lower costs.
  4. D.Run the batch job on Amazon EC2 On-Demand instances only during the batch window.
Show answer & explanation

Answer: A

EC2 Spot Instances offer significant cost savings for batch workloads that are fault tolerant and can handle interruptions. Using a fleet with Auto Scaling allows jobs to run efficiently despite volume variability. Lambda is unsuitable for long-running batch jobs with large compute needs. Reserved instances do not provide flexibility for unpredictable volumes. On-Demand alone may be costly.

Question 5 · Design Resilient Architectures

A logistics firm, RapidRoute, deploys a multi-tier application with an RDS MySQL database. They want to ensure that the database automatically fails over with minimal downtime if the primary instance goes offline. What configuration best meets this requirement?

  1. A.Backup the database daily and restore from backup on failure.
  2. B.Create read replicas in different availability zones and promote one if primary fails.
  3. C.Configure a scheduled Lambda function to restart the database if unreachable.
  4. D.Launch the RDS instance in Multi-AZ deployment mode.
Show answer & explanation

Answer: D

Multi-AZ deployments provide an automated synchronous standby replica in a different AZ that automatically fails over if the primary DB instance fails, ensuring high availability with minimal downtime. Read replicas are for scaling reads and must be manually promoted for failover, causing longer downtime. Lambdas or backups do not provide automated failover.

Question 6 · Design Secure Applications and Architectures

An education platform, EduSpark, requires data stored in S3 buckets to be encrypted at rest and also wants to control encryption keys themselves for compliance reasons. Which configuration should the architect recommend?

  1. A.Enable server-side encryption with AWS KMS-managed keys (SSE-KMS) and create a customer master key (CMK).
  2. B.Use server-side encryption with Amazon S3-managed keys (SSE-S3) for simplicity.
  3. C.Use default unencrypted S3 buckets and restrict access with bucket policies.
  4. D.Encrypt data client-side before uploading to S3 using an application-managed key.
Show answer & explanation

Answer: A

SSE-KMS with a customer-managed CMK allows EduSpark to retain control over encryption keys, meet compliance, and audit key usage. SSE-S3 uses Amazon-managed keys and does not offer direct key control. Client-side encryption adds complexity to key management. Unencrypted buckets fail compliance and security requirements.

Question 7 · Design High-Performing Architectures

A media company, StreamVision, needs to deploy a global static website with low latency and fault tolerance. The content is updated monthly, hosted on S3. What is the best architecture to meet these requirements?

  1. A.Use Amazon Lightsail to host the website in a single region with DNS routing.
  2. B.Host the website on an S3 bucket with versioning enabled and serve directly over HTTP from the bucket endpoint.
  3. C.Deploy the website on EC2 instances in one AWS region behind an Application Load Balancer.
  4. D.Host the website in an S3 bucket configured for static website hosting, fronted by Amazon CloudFront with multiple edge locations.
Show answer & explanation

Answer: D

Using Amazon S3 for static website hosting with CloudFront CDN in front ensures low latency globally by caching content at edge locations and provides resiliency. EC2-based hosting adds unnecessary complexity and single-region latency. Lightsail is less scalable globally. Direct S3 website endpoints are slower and less fault-tolerant for global users.

Question 8 · Design Cost-Optimized Architectures

A retail company, ShopEase, wants to reduce AWS costs for their development environment, which runs 24/7 but at low utilization. Which architectural change will best lower costs while maintaining developer access?

  1. A.Convert development instances to On-Demand pricing with larger instance types.
  2. B.Use dedicated hosts to isolate development workloads from production.
  3. C.Implement Auto Scaling with a minimum capacity of two instances always running.
  4. D.Implement Amazon EC2 instance scheduling to stop instances during off-hours.
Show answer & explanation

Answer: D

Scheduling EC2 instances to stop during off-hours avoids paying for unused compute while preserving developer access during working hours. Using On-Demand with larger instances or dedicated hosts increases costs. Auto Scaling with a fixed minimum capacity does not reduce costs when demand is low.

320+ more questions, free

Full-length, timed or practice mode, weighted to the official blueprint — with per-domain scoring so you know exactly where you stand.

Start the full practice exam →

All questions are original — never reproduced from the real exam — and pass automated duplicate, citation and item-writing checks before publication. See how our exams are made.

Kwizza is an independent study tool and is not affiliated with, endorsed by, or sponsored by Amazon Web Services. Amazon Web Services names, logos and certification marks are the property of their respective owners and are used here only to identify the exam described. Practice questions are original, written against the publicly published exam objectives — no real exam content is reproduced.