Try 10 Real Questions From AWS Certified Solutions Architect - Associate (SAA-C03)
These are unedited questions from the full 600-question set, pulled from across every exam domain. Click a question to reveal the answer and the full rationale for every option, exactly as it appears in the PDF.
A large enterprise must ensure all objects uploaded to an S3 bucket are encrypted at rest using a customer-managed KMS key. What is the best way to enforce this?
Show answer & full rationale
A: S3 Object Lock enforces data immutability (WORM retention policies); it does not control which encryption key is used when objects are uploaded.
B: SSE-S3 uses AWS-managed keys, not customer-managed KMS keys; it does not satisfy the requirement for a specific customer-controlled key.
C (Correct): A bucket policy with a Deny on s3:PutObject unless the request header specifies SSE-KMS with the exact required key ARN enforces the encryption requirement at upload time, preventing noncompliant uploads.
D: S3 Transfer Acceleration routes uploads through CloudFront edge locations to improve upload speed; it has no bearing on encryption key requirements.
A company wants an S3 bucket to be accessible only from a specific VPC endpoint. What should be used?
Show answer & full rationale
A: Amazon S3 is a managed service; security groups are attached to VPC resources such as EC2 instances, not to S3 buckets.
B: Route 53 private hosted zones provide DNS resolution within a VPC; they control name resolution, not authorization decisions for S3 API requests.
C: NACLs operate at the subnet level, filtering IP traffic by port and protocol; they cannot evaluate AWS request context such as which VPC endpoint was used.
D (Correct): The aws:sourceVpce condition key in a bucket policy restricts access so that only requests arriving through the specified VPC endpoint are allowed, ensuring no direct internet access to the bucket.
A security team wants to require MFA before users can perform sensitive IAM actions. Which approach is best?
Show answer & full rationale
A: CloudTrail records API activity after the fact for auditing; it does not enforce or require MFA before an action is permitted.
B: Secrets Manager stores and rotates secrets such as database credentials; it has no mechanism for enforcing MFA on IAM actions.
C (Correct): An IAM policy condition requiring aws:MultiFactorAuthPresent denies the specified sensitive actions unless the caller's session was authenticated with MFA, enforcing the requirement directly at the permission level.
D: Security groups filter network traffic to compute resources; they have no concept of IAM authentication factors and cannot enforce MFA.
An IT department needs a relational database that automatically fails over to standby capacity in another Availability Zone. Which option is best?
Show answer & full rationale
A (Correct): RDS Multi-AZ deployment maintains a synchronous standby replica in a different Availability Zone; if the primary instance fails, RDS automatically updates the endpoint DNS to the standby within 60-120 seconds with no manual intervention required.
B: A Single-AZ RDS instance with weekly snapshots provides recovery capability but requires a manual restore which takes hours; there is no automatic failover and data since the last snapshot is lost on failure.
C: Instance store is ephemeral storage physically attached to the underlying host; all data is permanently lost if the host fails, terminates, or is stopped -- it is completely unsuitable for a production database.
D: Nightly S3 table exports provide a recovery point but require manual import processes; there is no automatic failover and up to 24 hours of data can be lost on failure.
A web application receives sudden traffic spikes that overwhelm downstream processing. The company wants to keep the web tier responsive while processing catches up later. What should be used?
Show answer & full rationale
A (Correct): Amazon SQS decouples the web ingestion tier from the processing tier; during traffic spikes the web tier writes requests to the queue immediately, returns a fast response to users, and the processing tier consumes from the queue at a sustainable rate -- absorbing the burst without timeouts.
B: Instance memory is volatile and limited; requests stored only in memory are lost if the instance restarts, and memory exhaustion during a spike causes crashes -- providing no durability or scalability benefit.
C: Scaling the database tier alone does not address the bottleneck in the processing tier; the web tier still faces timeout pressure if it synchronously waits for processing to complete.
D: Consolidating all tiers onto a single large instance creates a single point of failure, eliminates independent scaling of each tier, and means one resource-starved tier degrades all other tiers simultaneously.
A development team needs resilience to a full Region outage with minimal downtime. Which approach best meets this requirement?
Show answer & full rationale
A: A single large instance remains entirely in one Region; a Regional failure takes the application completely offline with no automated recovery path.
B (Correct): An active-passive multi-Region setup runs the primary workload in Region A while keeping a replica in Region B; Route 53 health checks detect the primary failure and automatically redirect DNS to the secondary Region, minimizing downtime even for full Regional outages.
C: Multi-AZ in a single Region protects against individual AZ failures; if the entire Region experiences a prolonged outage, all AZs in that Region are affected and the application goes down with no automated path to a healthy Region.
D: Single-AZ with daily snapshots requires a manual restore and loses up to a day of data; it provides no automated failover for either an AZ or a Regional outage.
A team wants to run SQL queries directly against data stored in S3 without managing servers. Which service is best?
Show answer & full rationale
A: Amazon EBS provides block storage volumes that must be attached to specific EC2 instances; it cannot be queried with SQL and is not accessible to serverless analytics tools without an intermediary compute layer.
B: AWS KMS is a key management service for creating and controlling encryption keys; it handles cryptographic operations and has no SQL query execution capability.
C (Correct): Amazon Athena is a fully serverless, interactive query service that uses standard SQL to analyze data directly in Amazon S3; there are no servers to provision, configure, or manage -- you pay only for the data scanned per query.
D: Amazon EC2 Auto Scaling automatically adjusts the number of EC2 instances based on demand; it is a compute scaling service that does not provide SQL query execution capabilities or access to S3 data directly.
A serverless application makes many short-lived connections to Amazon RDS and is exhausting database connections. Which solution best improves connection management?
Show answer & full rationale
A: Amazon CloudFront is a content delivery network that caches and serves web content from global edge locations; it operates at the HTTP layer and has no capability to manage or pool database connections.
B: Amazon EBS snapshots are point-in-time backups of EBS block storage volumes; they provide data recovery for storage volumes and have no role in managing live database connection pools.
C: AWS Snowcone is a small, portable edge computing and data transfer device for remote or disconnected environments; it is unrelated to database connection pooling or RDS optimization.
D (Correct): Amazon RDS Proxy sits between your application and the RDS database, maintaining a pool of persistent connections to the database while multiplexing many short-lived application connections into fewer long-lived database connections -- purpose-built for Lambda and other serverless applications that create many short connections.
A consulting firm runs interruption-tolerant batch jobs and wants to reduce compute costs as much as possible. Which purchasing option is best?
Show answer & full rationale
A: Reserved Instances require a 1-year or 3-year commitment and are expressed as a term commitment, not a 1-hour reservation; they are designed for steady-state workloads, not short batch jobs, and do not provide the maximum cost reduction for interruption-tolerant work.
B (Correct): EC2 Spot Instances use spare AWS capacity and can offer discounts of up to 90% compared to On-Demand pricing; for batch workloads that can checkpoint progress and tolerate interruptions (with a 2-minute warning), Spot provides the maximum possible compute cost savings.
C: Dedicated Hosts provide physical servers dedicated to a single customer for software licensing compliance purposes; they are among the most expensive EC2 purchasing options and are entirely inappropriate for cost-optimized batch workloads.
D: On-Demand Instances provide pay-per-second compute with no commitment and no interruption risk; they offer maximum flexibility but are significantly more expensive per hour than Spot Instances for interruption-tolerant workloads.
An insurance company needs the most detailed dataset available for cost analytics and chargeback reporting. Which AWS option provides this?
Show answer & full rationale
A: AWS CloudTrail records API calls made to AWS services including who made the call, when, from where, and what was requested; it provides an operational and security audit trail but does not contain billing line items, pricing data, or cost attribution by resource or tag.
B: AWS WAF logs record details about web requests that match configured WAF rules; they are security and access logs for web applications and contain no billing, usage, or cost information.
C (Correct): The AWS Cost and Usage Report is the most comprehensive billing dataset available; it provides hourly or daily granularity with every line-item charge, including resource IDs, usage amounts, pricing rates, Reserved Instance and Savings Plans amortization, and all activated cost allocation tags -- the foundation for enterprise cost analytics and chargeback.
D: Amazon CloudWatch metrics provide operational telemetry such as CPU utilization, network throughput, and custom application metrics; they monitor the performance and health of resources but do not contain billing costs, usage pricing, or financial allocation data.
AWS Certified Solutions Architect - Associate (SAA-C03) — $14.99, instant PDF download with full rationale on every answer.
View the practice questions →