AWS SAA-C03 Practice Exam: 20 Realistic Scenario Questions#

How to use this page: Every question below is written in the real SAA-C03 style — multiple plausible options where a single requirement keyword (“least operational overhead”, “most cost-effective”, “without traversing the public internet”, “RPO under 1 second”) decides the winner. Includes Multiple Response (Choose TWO) questions.

Question 1 (Domain 1 - Security & Networking)#

A company has established an AWS Direct Connect connection between its on-premises data center and a VPC (Virtual Private Cloud). Applications running on-premises must upload sensitive files to an Amazon S3 (Simple Storage Service) bucket privately without traffic traversing the public internet, and without deploying proxy servers on EC2 (Elastic Compute Cloud). What should the solutions architect configure?

• A) Create a VPC Gateway Endpoint for Amazon S3 and update the VPC route table
• B) Create an Amazon S3 Interface VPC Endpoint (AWS PrivateLink) in the VPC and route on-premises S3 traffic to it
• C) Attach an Internet Gateway to the VPC and use an S3 Bucket Policy with aws:SourceIp
• D) Configure S3 Transfer Acceleration on the bucket

Question 2 (Domain 2 - Resilience & Serverless)#

An e-commerce platform uses AWS Lambda functions inside a VPC to process checkout requests and write transactions to an Amazon RDS (Relational Database Service) for PostgreSQL Multi-AZ DB instance. During promotional events, sudden traffic spikes cause thousands of concurrent Lambda executions, overwhelming the database with new connection requests and causing timeouts. Which solution resolves this with the LEAST code and architectural change?

• A) Create three RDS Read Replicas and point the Lambda checkout writes to the replica endpoints
• B) Deploy Amazon RDS Proxy in the VPC and update the Lambda function to connect to the proxy endpoint
• C) Migrate the PostgreSQL database to Amazon DynamoDB and rewrite all SQL queries
• D) Put Amazon ElastiCache for Memcached in front of the RDS database for write operations

Question 3 (Domain 1 - Storage Governance)#

A financial institution stores audit logs in an Amazon S3 bucket. Regulatory compliance requires that once a log file is written, it must not be overwritten or deleted by any user — including the AWS account root user — for a period of 7 years. After 7 years, the logs should be transitionable or deletable. Which configuration meets this requirement?

• A) Enable S3 Object Lock in Governance mode with a retention period of 7 years
• B) Enable S3 Object Lock in Compliance mode with a retention period of 7 years
• C) Attach an S3 Bucket Policy with Effect: Deny on s3:DeleteObject for all IAM (Identity and Access Management) users
• D) Enable S3 Versioning and MFA (Multi-Factor Authentication) Delete on the bucket

Question 4 (Domain 3 - High-Performing Storage)#

A genomics research company stores 200 TB of raw sequencing files in an Amazon S3 bucket. Every Friday, they spin up a cluster of 64 compute-optimized EC2 Linux instances for 4 hours to run parallel analysis over this dataset. The instances need sub-millisecond latency, hundreds of GB/s of aggregate throughput, and POSIX file system access to the S3 objects. If the storage layer fails during the 4-hour window, the job can be re-run. What is the MOST cost-effective solution?

• A) Amazon EFS (Elastic File System) Standard with Provisioned Throughput
• B) Amazon FSx for Lustre Scratch file system linked to the S3 bucket
• C) Amazon FSx for Lustre Persistent file system linked to the S3 bucket
• D) Copy the 200 TB from S3 onto EBS (Elastic Block Store) io2 Block Express volumes attached to each instance

Question 5 (Domain 2 - Event-Driven & Streaming) — Choose TWO#

A media company ingests real-time clickstream events from its website. The data must be analyzed in real time using SQL window queries to detect trending articles within 10 seconds, AND simultaneously delivered in Apache Parquet format to an Amazon S3 data lake with a 1-minute buffer and minimal operational overhead. Which TWO services should be combined to build this pipeline? (Choose TWO)

• A) Amazon Kinesis Data Streams + Amazon Managed Service for Apache Flink
• B) Amazon Data Firehose with built-in JSON-to-Parquet conversion delivering to S3
• C) Amazon SQS (Simple Queue Service) Standard queue + AWS Batch
• D) AWS Database Migration Service (DMS)
• E) AWS DataSync scheduled every minute

Question 6 (Domain 2 - Decoupling & Auto Scaling)#

An application processes video transcoding jobs placed in an Amazon SQS Standard queue by a fleet of EC2 instances in an Auto Scaling Group (ASG). Each video takes between 3 and 8 minutes to transcode. Currently, users complain that some videos are transcoded twice, and when a corrupted video file arrives, workers crash repeatedly trying to process it forever. Which TWO actions will fix both issues? (Choose TWO)

• A) Increase the SQS queue Visibility Timeout to at least 10 minutes (or extend it dynamically during processing)
• B) Configure a Dead-Letter Queue (DLQ) redrive policy on the SQS queue with a maxReceiveCount of 3
• C) Switch from Long Polling to Short Polling
• D) Increase the SQS message retention period to 14 days
• E) Put an Application Load Balancer in front of the SQS queue

Question 7 (Domain 4 - Cost-Optimized Networking)#

A company runs a data-processing fleet on EC2 instances in private subnets across three Availability Zones. The instances download and upload 80 TB of data per month to Amazon S3 and Amazon DynamoDB in the same region. A monthly billing review shows very high NAT Gateway data processing charges. How can the solutions architect eliminate these data processing costs for S3 and DynamoDB traffic?

• A) Replace the NAT Gateways with an AWS Transit Gateway
• B) Create VPC Gateway Endpoints for S3 and DynamoDB and add them to the private subnets’ route tables
• C) Create VPC Interface Endpoints (PrivateLink) for S3 and DynamoDB
• D) Move the EC2 instances into public subnets and use VPN connections

Question 8 (Domain 1 - Security & Operations)#

A company runs 150 EC2 instances in private subnets across multiple AWS accounts. Security compliance strictly prohibits opening inbound SSH (port 22) or RDP (port 3389) in any Security Group, forbids deploying bastion hosts, and requires every command typed by an administrator during a troubleshooting session to be logged to an encrypted Amazon S3 bucket. What should the architect recommend?

• A) Use EC2 Instance Connect over an Internet Gateway
• B) Configure AWS Systems Manager Session Manager with an IAM instance profile and enable session logging to S3
• C) Deploy a Network Load Balancer forwarding port 22 to the private instances
• D) Use AWS Config to run shell commands on the instances

Question 9 (Domain 2 - Disaster Recovery & Databases)#

A mission-critical financial application uses Amazon Aurora PostgreSQL in us-east-1. The business requires a cross-region disaster recovery solution in us-west-2 with an RPO (Recovery Point Objective) of less than 1 second and an RTO (Recovery Time Objective) of less than 1 minute. Which architecture satisfies these requirements?

• A) Enable RDS automated backups and use AWS Backup to copy daily snapshots to us-west-2
• B) Configure Amazon Aurora Global Database with a secondary cluster in us-west-2 and Route 53 failover routing
• C) Use Aurora Backtrack with a 24-hour window
• D) Create a standard RDS MySQL Multi-AZ deployment in us-east-1

Question 10 (Domain 3 - Networking & Load Balancing)#

A gaming company hosts a multiplayer backend on EC2 instances behind a load balancer. The application uses UDP and TCP protocols, requires ultra-low latency for millions of packets per second, and partners require one static IP address per Availability Zone so they can whitelist the service in their corporate firewalls. Which solution meets these requirements?

• A) Application Load Balancer (ALB) with Elastic IPs attached
• B) Network Load Balancer (NLB) with Elastic IPs assigned per Availability Zone
• C) Gateway Load Balancer (GWLB)
• D) Amazon CloudFront with an S3 origin

Question 11 (Domain 3 - S3 Replication & Compliance)#

A company has an existing S3 bucket containing 50 million objects (40 TB) in eu-central-1. Due to a new disaster recovery policy, the architect enables S3 Versioning and configures S3 Cross-Region Replication (CRR) to a new bucket in eu-west-1. The next day, the team notices that newly uploaded objects appear in eu-west-1, but none of the original 50 million objects are in the destination bucket. Why did this happen, and how should it be resolved?

• A) CRR only replicates new objects after the rule is created; run an S3 Batch Replication job to replicate the existing objects
• B) CRR requires S3 Transfer Acceleration to replicate existing objects
• C) Versioning must be disabled on the destination bucket for historical objects to copy
• D) Existing objects take 30 days to transition via S3 Lifecycle rules before CRR starts

Question 12 (Domain 1 - Encryption & KMS Cross-Account)#

Account A has an Amazon S3 bucket encrypted with a Customer Managed Key (CMK) in AWS KMS (Key Management Service). An IAM role in Account B needs to download and decrypt objects from this bucket. The architect has already updated the S3 Bucket Policy in Account A to allow the IAM role in Account B. What ELSE must be configured for the download to succeed?

• A) Nothing else; the S3 Bucket Policy automatically delegates KMS decryption permissions
• B) Update the KMS Key Policy in Account A to allow Account B, AND ensure the IAM Role Policy in Account B allows kms:Decrypt on Account A’s CMK
• C) Switch the bucket encryption to SSE-S3 because SSE-KMS does not support cross-account access
• D) Export the KMS key material from Account A and import it into Account B

Question 13 (Domain 4 - Compute Pricing & Cost Optimization)#

A company runs a steady baseline of containerized web services on AWS Fargate in us-east-1, several AWS Lambda functions, and a fleet of m6i.large EC2 instances that the team plans to migrate to Graviton (m7g.large) in us-west-2 in six months. They want to commit to a 3-year spend to maximize discounts while keeping the flexibility to change instance families, regions, and compute services automatically. Which purchasing option should they choose?

• A) EC2 Instance Savings Plans
• B) Compute Savings Plans
• C) Standard Reserved Instances
• D) Convertible Reserved Instances

Question 14 (Domain 2 - Hybrid DNS)#

A company has connected its on-premises network to an AWS VPC via AWS Direct Connect. They use an Amazon Route 53 Private Hosted Zone (aws.internal.example.com) for resources inside the VPC, and an on-premises DNS server for onprem.example.com. Servers on-premises need to resolve aws.internal.example.com, and EC2 instances in the VPC need to resolve onprem.example.com. What should the solutions architect configure?

• A) Make the Route 53 Hosted Zone public
• B) Create a Route 53 Resolver Inbound Endpoint (for on-premises → AWS queries) and a Route 53 Resolver Outbound Endpoint with forwarding rules (for AWS → on-premises queries)
• C) Enable enableDnsHostnames only and create CNAME records in S3
• D) Deploy an Application Load Balancer in front of Route 53

Question 15 (Domain 3 - Caching & CloudFront Security)#

A media company distributes paid training videos stored in an Amazon S3 bucket through Amazon CloudFront. Only paying subscribers who log into the web application should be able to stream a set of 15 video files (HLS segments) for a course during their 2-hour session, without modifying the individual video URLs in the video player playlist. How should this be implemented?

• A) Configure CloudFront Origin Access Control (OAC) on the S3 bucket and issue CloudFront Signed Cookies to authenticated subscribers
• B) Issue S3 Pre-Signed URLs for every individual video segment
• C) Make the S3 bucket public and restrict access using a NACL (Network Access Control List)
• D) Use Cognito User Pools attached directly to the S3 bucket

Question 16 (Domain 1 - Web Security & DDoS)#

A public API hosted behind an Application Load Balancer (ALB) is suffering from credential-stuffing attacks where single IP addresses send 5,000 login requests per minute, as well as occasional SQL injection payloads. The company wants to automatically block any IP address that exceeds 500 requests in a 5-minute window and block SQL injection patterns. Which solution meets these requirements with the LEAST effort?

• A) Add deny rules to the subnet Network ACL manually whenever an attack occurs
• B) Attach an AWS WAF (Web Application Firewall) Web ACL to the ALB with an AWS Managed Rule group for SQL injection and a rate-based rule set to 500
• C) Enable Amazon Inspector on the ALB
• D) Subscribe to AWS Shield Standard

Question 17 (Domain 2 - Global Traffic & Non-HTTP Failover)#

A financial trading application runs on Network Load Balancers (NLBs) in us-east-1 and eu-west-1 over custom TCP ports. Clients around the world require two static Anycast IP addresses that never change, traffic routed over the AWS global network backbone from the nearest edge, and sub-30-second health-checked failover between regions without waiting for client DNS cache TTLs to expire. Which service should be placed in front of the NLBs?

• A) Amazon CloudFront
• B) AWS Global Accelerator
• C) Amazon Route 53 Geolocation Routing
• D) AWS Transit Gateway

Question 18 (Domain 4 - Observability & Right-Sizing)#

An operations team wants to configure a CloudWatch alarm that triggers whenever an EC2 instance’s memory (RAM) utilization exceeds 85% OR its root EBS disk space exceeds 90% full. However, they cannot find these metrics in the Amazon CloudWatch console under the AWS/EC2 namespace. Why are these metrics missing, and how can they be collected?

• A) Memory and disk space are OS-level metrics not visible to the hypervisor; install the CloudWatch Unified Agent on the EC2 instance to push them as custom metrics
• B) Enable Detailed Monitoring (1-minute intervals) on the EC2 instance
• C) Enable VPC Flow Logs on the subnet
• D) Upgrade the EBS volume from gp2 to gp3

Question 19 (Domain 3 - Analytics & Data Lake Cost)#

A company stores 50 TB of application logs in Amazon S3 as uncompressed JSON files. Analysts run ad-hoc SQL queries using Amazon Athena a few times a week, and complain that queries are slow and Athena bills are high (since Athena charges $5 per TB scanned). Which TWO changes will dramatically improve query speed AND reduce Athena costs? (Choose TWO)

• A) Use AWS Glue or Amazon Data Firehose to convert the JSON files into compressed Apache Parquet (columnar format)
• B) Partition the data in S3 by date (e.g., s3://bucket/year=2026/month=10/day=30/) and filter on partition columns in WHERE clauses
• C) Move the S3 bucket to S3 Glacier Deep Archive
• D) Provision an S3 Transfer Acceleration endpoint
• E) Increase the number of EC2 instances running Athena

Question 20 (Domain 1 - Multi-Account Security & Guardrails)#

An enterprise uses AWS Organizations with 40 member accounts organized into Organizational Units (OUs). A security mandate requires that no user or role — including the account root user — in any member account is allowed to launch resources outside eu-central-1 and eu-west-1, or disable AWS CloudTrail. What is the MOST effective way to enforce this centrally?

• A) Create an IAM Permission Boundary in each of the 40 accounts
• B) Attach a Service Control Policy (SCP) to the root or top-level OUs in AWS Organizations that explicitly denies actions in other regions (aws:RequestedRegion) and denies cloudtrail:StopLogging
• C) Configure an AWS Budgets alert in each account
• D) Create a Network ACL in each account blocking traffic from other regions