Exam Tip: Spot Instances for fault-tolerant, flexible workloads. Reserved for steady-state 1-3 year commitments. Savings Plans are more flexible than RIs.

Sample SAA-C03 questions with explanations

Use these examples to check how the topics are tested. Read the explanation for every option you were unsure about, then start a scored practice set above.

Question 1 Design Resilient Architectures Choose 2

A solutions architect is designing a fault-tolerant system for processing IoT device data. The system must ensure no data loss if a processing component fails and must be able to reprocess data from a specific point in time. Which TWO AWS services should be used as part of this design? (Select TWO)

✓ Amazon Kinesis Data Streams
✓ Amazon Simple Queue Service (SQS) Standard queue
○ AWS Lambda with on-demand concurrency
○ Amazon Simple Notification Service (SNS)
○ Amazon Kinesis Data Firehose

Answer: A. Amazon Kinesis Data Streams | B. Amazon Simple Queue Service (SQS) Standard queue

Amazon Kinesis Data Streams (A) provides durable, ordered data streams with a retention period (24 hours by default, extendable to 365 days), allowing replay from a past point for reprocessing, which is key for fault tolerance. Amazon SQS (B) provides at-least-once delivery and message durability, preventing data loss if a processor fails. SNS (D) is a pub/sub service but lacks built-in retention for replay. Kinesis Data Firehose (E) is for loading to destinations, not for replayable processing. Lambda (C) is a compute option but doesn't provide the data durability layer.

Question 2 Domain 1: Design Secure Architectures Choose 2

A company is deploying a containerized application on Amazon EKS. The design must ensure that pods can only communicate with each other based on explicit network policies, and that container images are free from known vulnerabilities. Which TWO services or configurations should be implemented? (Select TWO)

○ Configure Amazon VPC CNI for pod networking and use VPC security groups to control pod-to-pod traffic.
✓ Deploy the Kubernetes NetworkPolicy resource and use a compatible CNI plugin (like Calico) that enforces these policies.
✓ Use Amazon ECR to store container images and enable image scanning on push to identify vulnerabilities.
○ Store container images in a public repository to leverage community vulnerability scanning.
○ Run all pods in the `hostNetwork` namespace to simplify networking and rely on EC2 security groups.
○ Use IAM roles for service accounts (IRSA) to grant permissions, which also controls network flow.

Answer: B. Deploy the Kubernetes NetworkPolicy resource and use a compatible CNI plugin (like Calico) that enforces these policies. | C. Use Amazon ECR to store container images and enable image scanning on push to identify vulnerabilities.

Kubernetes NetworkPolicy (B) is the native way to define ingress/egress rules for pods, and a CNI like Calico (often used with EKS) enforces them. Enabling image scanning in Amazon ECR (C) checks container images for known vulnerabilities at push time. Option A is incorrect; VPC security groups operate at the ENI level (node level), not the pod level, and cannot enforce fine-grained pod policies. Option D is insecure; public repositories are not a security best practice for proprietary images. Option E (`hostNetwork`) breaks pod isolation and is a security anti-pattern. Option F (IRSA) is for IAM permissions, not network security.

Question 3 Domain 2: Design Resilient Architectures

A three-tier web application (web, app, database) is deployed to a single AWS Region. To improve the application's resilience to Regional failures, what should be done?

○ Deploy the application across multiple Availability Zones in the same Region.
✓ Deploy the application across multiple AWS Regions.
○ Increase the size of the EC2 instances in each tier.
○ Use Amazon CloudFront to cache content at edge locations.

Answer: B. Deploy the application across multiple AWS Regions.

Deploying across multiple Regions provides protection against a complete Regional failure, which is a disaster recovery consideration. Multi-AZ deployment (A) protects against AZ failure but not Regional failure. Options C and D improve performance and scalability but do not address Regional resilience.

Question 4 Domain 3: Design High-Performing Architectures Choose 2

A company is deploying a high-performance computing (HPC) cluster on AWS for scientific simulations. The cluster requires low-latency, high-throughput network connectivity between compute nodes. Which TWO AWS services or features should be used? (Select TWO.)

○ Amazon EC2 instances with Enhanced Networking enabled
✓ Placement Groups configured with 'cluster' placement strategy
○ AWS Direct Connect for connectivity between on-premises and AWS
✓ Amazon EC2 instances with Elastic Network Adapter (ENA)
○ Amazon VPC endpoints for private connectivity to AWS services

Answer: B. Placement Groups configured with 'cluster' placement strategy | D. Amazon EC2 instances with Elastic Network Adapter (ENA)

A 'cluster' placement group (B) packs instances close together within an Availability Zone to achieve low-latency, high-throughput network performance, which is critical for HPC workloads. Elastic Network Adapter (ENA) (D) provides enhanced networking capabilities on supported instance types, offering higher bandwidth and lower latency. Enhanced Networking (A) is a general feature that includes ENA, but D is more specific and accurate. Direct Connect (C) is for hybrid connectivity, not intra-cluster communication. VPC endpoints (E) provide private access to AWS services but do not improve inter-instance network performance.

Question 5 Domain 4: Design Cost-Optimized Architectures

A company has applications in us-east-1 that frequently access data stored in Amazon S3 in us-west-2. Data transfer costs are unexpectedly high. Which solution would reduce inter-region data transfer costs?

○ Enable S3 Transfer Acceleration
○ Use Amazon CloudFront with S3 origin
✓ Replicate S3 data to us-east-1 using S3 Cross-Region Replication
○ Compress data before transfer

Answer: C. Replicate S3 data to us-east-1 using S3 Cross-Region Replication

S3 Cross-Region Replication would create a copy of the data in us-east-1, allowing local access and eliminating ongoing inter-region data transfer costs. S3 Transfer Acceleration improves transfer speed but not costs. CloudFront caches content at edge locations but may still incur costs for cache misses. Compression reduces data size but doesn't eliminate transfer fees.

Open the full SAA-C03 question-and-answer guide