Free AWS Solutions Architect Exam Questions and Answers
Updated October 13, 2026 | 20 questions with full answers
The short answer
SAA-C03 is 65 questions in 130 minutes with a 720/1000 passing score. It is a scenario exam: almost every question describes an architecture and asks you to choose the option that best meets a stated requirement. The questions below come from our 975-question SAA-C03 bank, covering all four domains, with the answer and explanation.
SAA-C03 exam facts
| Questions | 65 (multiple choice and multiple response) |
| Time limit | 130 minutes |
| Passing score | 720 / 1000 |
| Cost | $150 USD |
| Delivery | Pearson VUE test centre or online proctored |
| Prerequisites | None formally, but AWS recommends hands-on experience |
What the exam covers, domain by domain
| Domain | Weight | What it tests |
|---|---|---|
| Domain 1 - Design Secure Architectures | 30% | IAM, encryption, network security, data protection, key management. |
| Domain 2 - Design Resilient Architectures | 26% | High availability, multi-AZ and multi-region, decoupling, disaster recovery. |
| Domain 3 - Design High-Performing Architectures | 24% | Compute, storage, database and networking choices for performance. |
| Domain 4 - Design Cost-Optimized Architectures | 20% | Storage classes, instance purchasing options, cost-aware architecture. |
20 free SAA-C03 exam questions with answers
Real questions from our 975-question SAA-C03 bank, spread across every domain. The correct answer is marked and every question carries an explanation, so you can check the reasoning and not just the result. The interactive mocks serve the full bank, timed and scaled-scored.
A solutions architect is designing a fault-tolerant system for processing IoT device data. The system must ensure no data loss if a processing component fails and must be able to reprocess data from a specific point in time. Which TWO AWS services should be used as part of this design? (Select TWO)
- ✓ Amazon Kinesis Data Streams
- ✓ Amazon Simple Queue Service (SQS) Standard queue
- ○ AWS Lambda with on-demand concurrency
- ○ Amazon Simple Notification Service (SNS)
- ○ Amazon Kinesis Data Firehose
A company wants to grant temporary access to an AWS S3 bucket for an external contractor. The access should be limited to specific operations and expire after 3 days. Which approach is MOST secure?
- ○ Create an IAM user for the contractor and attach a policy with the necessary permissions.
- ✓ Use IAM roles and assume role with temporary security credentials.
- ○ Share the access keys of an existing IAM user with the contractor.
- ○ Create a bucket policy that allows access from the contractor's IP address.
An e-commerce company uses an Amazon RDS for MySQL database for its application. The database is currently in a single Availability Zone. To improve availability and ensure automated failover in case of an AZ outage, the Solutions Architect must implement a solution with minimal downtime and no application changes. What should the architect do?
- ○ Create a read replica in another AZ and configure the application to use the replica if the primary fails.
- ✓ Modify the RDS instance to use a Multi-AZ deployment.
- ○ Create a database snapshot and restore it in another AZ, then update the application endpoint.
- ○ Migrate the database to Amazon Aurora with a replica in another AZ.
An e-commerce application uses an Amazon RDS for PostgreSQL database. During sales events, the database experiences high read traffic, causing increased latency for customers. Which solution will improve read performance WITHOUT adding management overhead?
- ○ Create a read replica and direct read queries to it
- ○ Upgrade the RDS instance to a larger instance class
- ○ Implement Amazon ElastiCache for Redis to cache query results
- ✓ Use Amazon Aurora PostgreSQL with Aurora Replicas
A company uses AWS Organizations with multiple accounts. They want to centralize cost management and optimize spending. What should they enable?
- ✓ AWS Cost Explorer with linked accounts
- ○ AWS Config aggregator
- ○ AWS Service Catalog
- ○ AWS Control Tower
Data uploaded to an S3 bucket must be encrypted in transit. How can this be enforced?
- ○ Use S3 default encryption with SSE-S3.
- ✓ Configure a bucket policy to deny HTTP requests.
- ○ Enable S3 versioning.
- ○ Use IAM policies to require SSL/TLS.
A legacy application running on-premises will be migrated to AWS. It requires a shared file system that is accessible from multiple Amazon EC2 instances in a VPC. The solution must be highly available, durable, and managed. Which AWS service should be used?
- ○ Amazon S3 with a file gateway interface.
- ✓ Amazon EFS (Elastic File System)
- ○ Amazon EC2 instance store aggregated with RAID.
- ○ An Amazon EBS volume with Multi-Attach enabled.
Which TWO are characteristics of the Amazon S3 Glacier storage classes (such as Glacier Instant Retrieval) that are relevant for archive performance? (Select TWO.)
- ○ Millisecond retrieval latency
- ○ Optimized for frequent access
- ✓ Lower cost than S3 Standard
- ✓ Designed for long-term archive
- ○ Provides the highest durability
A company uses Amazon DynamoDB for a mobile gaming application. Traffic patterns are unpredictable with occasional viral spikes. Which capacity mode balances cost and performance?
- ○ Provisioned capacity with Auto Scaling
- ✓ On-demand capacity
- ○ Provisioned capacity without Auto Scaling
- ○ Use DynamoDB Accelerator (DAX) only
A company needs to encrypt data in an Amazon DynamoDB table to meet compliance requirements. How can this be achieved?
- ✓ Enable encryption at rest using AWS KMS when creating the table.
- ○ Use client-side encryption before writing data to DynamoDB.
- ○ Configure SSL/TLS for all queries to the table.
- ○ Store encryption keys in DynamoDB items.
A Solutions Architect is designing a microservices-based application. To ensure the services are loosely coupled and can be scaled independently, which THREE strategies should be adopted? (Select THREE)
- ○ Use a shared relational database for all services to maintain data consistency.
- ✓ Implement API Gateway as a single entry point for client requests.
- ✓ Use asynchronous event-driven communication between services.
- ○ Deploy all services in a single Amazon ECS cluster with a shared task definition.
- ✓ Use containerized services that can be deployed independently.
- ○ Implement a service mesh for service discovery and traffic management.
A company is deploying a microservices-based application on AWS. Each microservice is deployed as a container. The company wants a fully managed container orchestration service that automatically scales the containers based on demand. Which service should be used?
- ✓ Amazon ECS with Fargate launch type
- ○ Amazon EKS with managed node groups
- ○ AWS App Runner
- ○ AWS Lambda with container support
Which of the following are effective ways to optimize costs for data transfer between AWS services within the same region? (Select TWO.)
- ○ Use public IP addresses for all inter-service communication.
- ✓ Use private IP addresses and keep traffic within the same Availability Zone.
- ✓ Use VPC endpoints for AWS services like S3 and DynamoDB.
- ○ Use NAT Gateways for all outbound traffic to AWS services.
- ○ Enable flow logs on all VPCs to monitor traffic.
An application requires secure storage of database credentials that are used by AWS Lambda functions. The credentials must be automatically rotated every 90 days. Which AWS service should be used?
- ○ AWS Systems Manager Parameter Store
- ✓ AWS Secrets Manager
- ○ AWS KMS
- ○ AWS Certificate Manager
A three-tier web application is being redesigned for high availability. The current design has web servers in one Availability Zone (AZ) and application servers in another AZ, with a Network Load Balancer (NLB) in front. Users report intermittent failures. How should the architecture be modified to be highly available?
- ○ Move all web and application servers into the same AZ to reduce latency.
- ✓ Deploy redundant web and application servers, and the NLB, across at least two AZs.
- ○ Replace the NLB with an Application Load Balancer (ALB) in a single AZ.
- ○ Increase the instance size of the web and application servers.
A solutions architect needs to design a highly available and performant network connection between an on-premises data center and multiple Amazon VPCs across different AWS Regions. The connection must provide consistent, high bandwidth and low jitter for real-time data synchronization. Which TWO AWS services should be used? (Select TWO.)
- ✓ AWS Direct Connect
- ○ AWS Site-to-Site VPN
- ○ AWS Global Accelerator
- ✓ AWS Transit Gateway
- ○ Amazon Route 53
A company has a three-tier web application hosted on Amazon EC2. The application is deployed in a single region across three Availability Zones. To improve fault tolerance and performance, they want to implement an Active-Active configuration across two AWS regions. What is a cost-effective network design to route user traffic to the nearest healthy region?
- ○ Use an Amazon CloudFront distribution with origins in both regions.
- ○ Use Amazon Route 53 with a failover routing policy.
- ○ Use an Application Load Balancer in each region and AWS Global Accelerator.
- ✓ Use Amazon Route 53 with a latency-based routing policy and health checks.
A company has compliance requirements to retain data in Amazon S3 for a minimum of 7 years. Which S3 features can help meet this requirement? (Select TWO)
- ✓ S3 Lifecycle policies
- ✓ S3 Object Lock
- ○ S3 Transfer Acceleration
- ○ S3 Intelligent-Tiering
- ○ S3 Cross-Region Replication
- ○ S3 Server-side encryption
Which of the following are benefits of using an Amazon SQS queue between application components? (Select TWO)
- ○ It eliminates the need for a load balancer.
- ✓ It decouples components, allowing them to scale independently.
- ○ It guarantees message delivery in the order they were sent.
- ✓ It provides a buffer for messages if the consumer is unavailable.
- ○ It automatically encrypts messages at rest.
An application requires a persistent, high-performance file system that can be accessed from EC2 instances in multiple AWS Regions. Which service can meet this requirement?
- ○ Amazon EFS with cross-region replication
- ○ Amazon FSx for Windows File Server with Multi-Region deployment
- ○ Amazon S3 with cross-region replication
- ✓ There is no native AWS service that provides a single shared file system across multiple regions.
How to use these questions
Every SAA-C03 question contains a constraint, and the constraint is the question. Look for most cost-effective, least operational overhead, highly available or most secure. The correct answer is the one that satisfies the constraint with the least unnecessary complexity.
Two answers are usually technically valid. The differentiator is almost always operational overhead - a managed service beats a self-managed one when the question says least operational overhead, even if the self-managed option is cheaper.
Learn the Well-Architected Framework pillars as a lens rather than a list. Each domain maps to a pillar, and the framing tells you what kind of trade-off the question is testing.
130 minutes for 65 questions is genuinely generous - two minutes each. Use the extra time to re-read the requirement statement before committing, because misreading the constraint is the most common failure mode on this exam.
Frequently asked questions
How hard is the AWS Solutions Architect Associate exam?
It is a real step up from Cloud Practitioner. Questions are long scenario descriptions, two answers are often plausible, and you need 720/1000. Most candidates need 2-3 months of study alongside hands-on AWS work.
How many questions are on SAA-C03?
65 questions in 130 minutes, including multiple-choice and multiple-response items. There is no penalty for guessing.
What is the SAA-C03 passing score?
720 out of 1000 on a scaled score. Because the score is scaled, the raw number of correct answers needed varies between exam versions.
Does SAA-C03 expire?
Yes, after three years. You renew by passing the current exam version or by earning the Professional-level Solutions Architect certification.
Ready to test yourself under exam conditions?
975 questions across 6 timed mock exams, domain-wise drills, and the same scaled scoring as the real thing. Free, no signup.