A team stores raw clickstream data in Amazon S3 and queries it with Amazon Athena. They currently store data as uncompressed JSON. Queries scan the entire dataset and monthly Athena charges are high. The dataset is written once and read many times by analysts running column-specific queries. Which change most reduces Athena costs?

Convert the data to Apache Parquet format, partitioned by date

Enable S3 Transfer Acceleration on the bucket

Move the data to S3 Intelligent-Tiering

Enable S3 Requester Pays on the bucket

A company runs 500 AWS Lambda functions across three AWS accounts. Functions have diverse memory settings (128 MB to 3 GB) and duration profiles. The team wants a systematic, data-driven way to right-size all Lambda functions to minimize cost without manually profiling each function. Which AWS-native approach is most effective?

Use AWS Compute Optimizer to review Lambda memory and duration recommendations for each function

Enable AWS X-Ray on all functions and analyze trace data to find inefficiencies

Set all functions to 128 MB memory to minimize per-GB-second charges

Use AWS Cost Explorer to filter Lambda spend by function and manually adjust the highest-cost functions

A company runs an Amazon OpenSearch Service domain with 6 data nodes for a logging platform. Logs older than 14 days are rarely queried but must be searchable within minutes if needed. Storage costs for the hot nodes are growing rapidly. What is the most cost-effective way to reduce OpenSearch storage costs without losing searchability?

Enable UltraWarm nodes and move indices older than 14 days to UltraWarm storage

Increase the EBS volume size on each data node to get a better per-GB price

Delete indices older than 14 days and restore from S3 snapshots when needed

Switch the cluster to a single-AZ deployment to halve node count

A company is running hundreds of EC2 instances across multiple AWS regions. The billing team notices that several Elastic IP addresses are allocated but not attached to any running instance, generating unnecessary charges. What is the most direct action to eliminate these charges?

Release all unattached Elastic IP addresses

Convert the Elastic IPs to IPv6 addresses

Associate each Elastic IP with a stopped EC2 instance

Move the Elastic IPs to a different AWS region

A company runs an AWS Fargate service with tasks that each require 4 vCPU and 8 GB memory. Tasks run continuously. The engineering team has just determined that actual CPU usage averages 1 vCPU and memory averages 2 GB. Which two changes together minimize Fargate cost? (Choose the single answer that captures both.)

Right-size tasks to 1 vCPU / 2 GB and purchase Compute Savings Plans

Right-size tasks to 1 vCPU / 2 GB and switch to EC2 launch type with Spot Instances

Keep task size but purchase Compute Savings Plans

Right-size tasks to 1 vCPU / 2 GB and enable Fargate Spot

A company hosts a popular read-heavy web application backed by Amazon RDS for MySQL. They add multiple read replicas to scale read traffic, but their RDS bill increases significantly. Analysis shows that 70% of read queries repeatedly request the same rows. What is the most cost-effective way to reduce the number of read replicas needed?

Place an Amazon ElastiCache for Memcached cluster in front of RDS to cache frequent reads

Enable RDS Multi-AZ to distribute read traffic automatically

Increase the instance size of existing read replicas

Enable RDS Performance Insights to identify and optimize slow queries

A company uses AWS CloudTrail to record API activity across all accounts in an AWS Organization. They enable CloudTrail in every region and every account independently, each writing to its own S3 bucket. The storage and duplication costs are high. What is the most cost-effective way to centralize and reduce CloudTrail costs across the organization?

Create an organization trail in the management account that logs all accounts and regions to a single S3 bucket

Enable CloudTrail only in us-east-1 for all accounts to avoid multi-region duplication

Replace CloudTrail with AWS Config to record API calls at lower cost

Use S3 Replication to consolidate per-account buckets into a central bucket

A company serves a high-traffic public API using Amazon API Gateway and Lambda. The API responses change only once every hour but are identical for all users. API Gateway metrics show 80% of invocations are redundant re-computations. What is the simplest way to reduce Lambda invocations and improve response latency?

Enable API Gateway stage-level caching with an appropriate TTL

Place an Application Load Balancer in front of API Gateway

Increase Lambda reserved concurrency to handle more simultaneous requests

Enable Lambda Provisioned Concurrency

A company runs a MySQL workload on Amazon RDS. The database is read-heavy with 95% SELECT queries. The engineering team wants to offload read traffic with the least amount of infrastructure management. Which approach is most appropriate?

Create an RDS Read Replica and point read traffic to its endpoint

Enable Multi-AZ deployment on the existing RDS instance

Take daily snapshots and restore them to a separate RDS instance for reads

Migrate the database to Amazon Redshift

A company runs a containerized application on Amazon EKS. The application processes large scientific datasets by reading and writing to shared storage simultaneously across dozens of pods. The workload requires consistent sub-millisecond storage latency and throughput of several GB/s. Which storage solution is most appropriate?

Amazon FSx for Lustre integrated with S3

Amazon EFS with General Purpose performance mode

Amazon EBS io2 volumes attached to each node independently

Amazon S3 with byte-range fetch requests

An online travel booking application queries Amazon Aurora PostgreSQL for available flights. Each search query joins five tables and returns results in 2–4 seconds. The marketing team runs the same searches repeatedly for popular routes. The engineering team wants to serve popular route searches in under 100 ms without rewriting the complex SQL queries. Which solution achieves this?

Add an Amazon ElastiCache for Redis cluster and cache query result sets keyed by route parameters

Add additional Aurora read replicas and load-balance the search queries across them

Convert the query to use DynamoDB with a GSI on departure and arrival airports

Enable Aurora Parallel Query to distribute the join across multiple nodes

A company runs a batch analytics workload that reads 50 TB of compressed CSV files from Amazon S3 using Amazon Athena. Queries scan entire datasets every run and take over 30 minutes, primarily because of format overhead. The data schema is fixed and rarely changes. Which single change most dramatically reduces query run time and data scanned?

Convert the CSV files to Apache Parquet format partitioned by date and store them back in S3

Load the CSV data into Amazon Redshift for querying

Increase the Athena query DPU allocation

Enable S3 Transfer Acceleration on the source bucket

A company processes clickstream events using an Amazon Kinesis Data Streams consumer running on EC2. The consumer calls GetRecords every second and processes records in batches. As throughput scales, the team observes that record processing lag grows and CPU utilization is low. Investigation reveals the consumer is spending most of its time waiting on GetRecords API responses. Which change best improves consumer throughput?

Switch from the classic GetRecords polling model to the Kinesis Enhanced Fan-Out (EFO) feature with SubscribeToShard

Increase the shard count to distribute data across more shards

Decrease the GetRecords polling interval to 200 ms

Enable server-side encryption on the Kinesis stream

A financial services firm runs a latency-sensitive order matching engine on Amazon EC2. The application requires predictable, consistent network performance and the lowest possible packet loss between instances in the same region. The team notices occasional latency spikes they attribute to network jitter from co-hosted workloads. Which EC2 feature most directly addresses this?

Use a placement group with Cluster strategy

Enable Elastic Fabric Adapter (EFA) on each instance

Attach multiple Elastic Network Interfaces to each instance

Enable Enhanced Networking with the ENA driver

A company wants to accelerate DNS resolution for an application that makes thousands of DNS queries per minute to external domains. The application runs on EC2 instances in a VPC. Which AWS feature provides the fastest DNS resolution for queries within the VPC?

Use the Amazon Route 53 Resolver (VPC+2 resolver) already available at the VPC base address

Deploy a self-managed BIND DNS server on EC2 in each Availability Zone

Configure instances to use an external public DNS resolver such as 8.8.8.8

Enable DNS hostnames on the VPC and add a CNAME for each external domain

A company's application uploads hundreds of 5 GB files daily from an on-premises data center to Amazon S3. Engineers observe that individual upload speeds top out at 300 Mbps even though the internet link supports 1 Gbps. They want to maximize S3 upload throughput. Which S3 feature should they use?

S3 Multipart Upload to split each file into parallel parts and upload them concurrently

S3 Transfer Acceleration to route uploads through CloudFront edge locations

S3 Intelligent-Tiering to reduce per-request overhead

S3 Batch Operations to queue the uploads

A company's production workload uses Amazon CloudFront with an Application Load Balancer as the origin. During a recent application deployment, a misconfigured security group blocked all traffic from CloudFront to the ALB, causing a full outage. The team wants to be notified within 5 minutes if the origin becomes unreachable from CloudFront in the future. Which monitoring approach is most effective?

Create an Amazon CloudWatch Synthetics canary that tests the CloudFront distribution URL every minute and triggers an SNS alarm if the test fails

Create a CloudWatch alarm on the CloudFront 5xxErrorRate metric and set the alarm threshold to trigger after 5 consecutive minutes above 1%

Enable AWS Config on the security group resource and create a Config rule that alerts when CloudFront IP ranges are removed

Enable CloudTrail logging and create a CloudWatch Logs metric filter to detect security group modification events

A financial company runs a critical payment processing service behind an Application Load Balancer. The ALB distributes traffic to two target groups: one for new Go-based microservices and one for legacy Java monolith instances. During a recent incident, a faulty deployment to the Go target group caused cascading failures, and it took 45 minutes to manually shift all traffic back to the legacy target group. The team wants future traffic shifts to the Go services to be gradual, observable, and automatically rolled back if error rates exceed 5%. Which AWS-native solution achieves this?

Use Amazon CodeDeploy with a canary deployment configuration targeting the ALB, and configure a CodeDeploy CloudWatch alarm rollback trigger on the 5xx error rate

Manually update the ALB listener weighted target group rules at intervals, and set a CloudWatch alarm to notify the team if errors exceed 5%

Use AWS AppConfig to gradually roll out configuration changes to the Go services and roll back if health checks fail

Deploy a second ALB for the Go services and use Route 53 weighted routing to shift traffic, with Route 53 health checks triggering rollback

A company's e-commerce platform uses Amazon SQS standard queues to pass orders to a fulfillment Lambda function. Order volume peaks during flash sales, sometimes exceeding 10,000 messages per second. During these peaks, individual fulfillment Lambda invocations fail because a downstream inventory service becomes overloaded. The team wants to automatically slow down order consumption when the downstream service is stressed, without losing any messages. What should the architect implement?

Set a reserved concurrency limit on the fulfillment Lambda function to throttle its invocation rate

Enable SQS long polling and increase the message visibility timeout to match the downstream service's recovery time

Place an Amazon EventBridge Pipe between the SQS queue and Lambda with a maximum concurrency setting

Switch to an SQS FIFO queue to limit throughput to 3,000 messages per second

A company stores application logs in an S3 bucket. A junior developer accidentally deleted the bucket's versioning configuration and removed several critical log files. The team wants to ensure that future accidental deletions can be recovered, and that all versions of every object are preserved. What should the architect enable?

Enable S3 Versioning and configure an MFA Delete requirement on the bucket

Enable S3 Versioning and add an S3 Lifecycle rule to expire old versions after 90 days

Enable S3 Cross-Region Replication to a second bucket

Enable S3 Object Lock in Compliance mode

A company runs a critical order processing service on Amazon EC2 instances behind an Application Load Balancer. The service depends on an Amazon RDS Aurora PostgreSQL cluster. During a recent deployment, the application tier was taken down for 20 minutes while a schema migration ran. The team needs future schema migrations to complete without any application downtime. Which approach best achieves this?

Use an Aurora blue/green deployment to perform the schema migration on the green environment, then switch over

Enable Aurora Multi-AZ so that the migration runs on the standby instance

Create a manual Aurora snapshot, restore it, run the migration, then swap the cluster endpoint

Run the schema migration using AWS DMS with Change Data Capture enabled on the existing cluster

A multinational company runs a latency-sensitive trading application across AWS regions us-east-1 and eu-west-1 using Amazon Route 53 latency-based routing. Both regions are active. During a partial failure in us-east-1, the ALB in that region continued to pass Route 53 health checks because the ALB itself was healthy, but the EC2 instances behind it were all returning HTTP 500 errors. Users in North America continued to be routed to the degraded region. What is the most robust way to ensure Route 53 stops routing traffic to a region when its application tier is unhealthy?

Replace the Route 53 health check on the ALB endpoint with a calculated health check that aggregates CloudWatch alarms on the ALB's HTTPCode_Target_5XX_Count metric

Configure the ALB to return a 200 status code only when all target instances are healthy

Enable Route 53 Resolver DNS Firewall to block queries destined for the unhealthy region

Enable ALB access logs and use Amazon Athena to query for 5xx errors, then trigger a Lambda function to update Route 53

A company runs a high-throughput data ingestion pipeline where producers publish messages to an Amazon SNS topic, which fans out to five SQS queues. One of the SQS queues feeds a Lambda function that processes data for a machine learning model. The ML Lambda function intermittently takes up to 15 minutes to process a batch, far exceeding the SQS visibility timeout of 30 seconds. This causes messages to become visible again and be processed multiple times, corrupting the ML model's training data. What is the correct fix with the least architectural change?

Increase the SQS visibility timeout on the ML queue to 15 minutes

Replace the SQS trigger with an EventBridge Pipe and use a Step Functions Express Workflow to process each message with a 15-minute timeout

Enable SQS long polling and reduce the Lambda function timeout to 30 seconds to match the visibility timeout

Switch the ML SQS queue to a FIFO queue to prevent duplicate processing

A company runs a web application that uses Amazon Cognito User Pools. A security team wants to automatically block sign-ins from users whose credentials appear in a known compromised password database, without writing custom Lambda code. Which Cognito feature addresses this?

Cognito advanced security features with compromised credentials detection enabled

A Cognito pre-authentication Lambda trigger that queries a custom compromised credentials list

Enable Cognito MFA for all users — compromised passwords become irrelevant with MFA

Configure a WAF rule on the Cognito endpoint to block authentication requests from known bad IPs

A company wants to enforce that IAM users can only perform AWS actions from a specific geographic region (us-east-1) and must deny all actions attempted from any other region. Which IAM condition key should be used to enforce this in an SCP or IAM policy?

aws:RequestedRegion with a StringNotEquals condition

aws:SourceIp with the IP ranges of the us-east-1 region

aws:SourceVpc with the VPC ID of the VPC in us-east-1

aws:PrincipalArn with a wildcard matching only us-east-1 IAM resources

A company wants to receive an alert any time someone creates, modifies, or deletes a security group in their AWS account. Which is the simplest combination of services to achieve this?

Enable AWS CloudTrail, create an Amazon EventBridge rule matching EC2 security group API events, and trigger an SNS notification

Configure Amazon Inspector to scan security groups and send findings to SNS

Write a Lambda function that calls DescribeSecurityGroups every minute and compares the results to a baseline

Enable AWS Config and create a custom Config rule that checks security group changes

A security engineer is auditing IAM policies and finds a role with the following condition on an S3 policy: 'aws:MultiFactorAuthPresent': 'true'. The role is used by an EC2 instance via an instance profile. Will EC2 instance calls to S3 succeed? Explain the issue.

No, EC2 instance profile calls never set aws:MultiFactorAuthPresent to true, so the condition will always deny access

Yes, EC2 automatically satisfies MFA conditions when using instance profiles

Yes, as long as the IAM role itself was created by a user who was authenticated with MFA

No, but it can be resolved by enabling MFA for the EC2 service role in the IAM console

A company's security policy requires that all API Gateway REST API endpoints be accessible only to applications running inside the company's VPC. Requests originating from the public internet must be rejected. What is the correct configuration?

Deploy the API as a Private endpoint type, create a VPC endpoint for API Gateway, and attach a resource policy that denies access from outside the VPC endpoint

Deploy the API as a Regional endpoint and configure a WAF rule to block all non-VPC source IPs

Place the API Gateway behind an Application Load Balancer in the VPC with security groups restricting access

Deploy the API as an Edge-Optimized endpoint and configure IAM authorization to require VPC-sourced requests

A company wants to ensure that Amazon S3 server access logs for a bucket named 'app-data' are stored securely and that the logging configuration cannot be disabled by any team member except the security team. Which combination of controls achieves this?

Enable S3 server access logging and use an S3 bucket policy that denies s3:PutBucketLogging except for the security team's IAM role

Enable AWS CloudTrail data events for the bucket to capture all access, and restrict CloudTrail deletion via an SCP

Enable S3 server access logging and use a Service Control Policy to prevent any member account from calling s3:PutBucketLogging

Configure Amazon Macie to monitor the bucket and alert if logging is disabled

A company uses AWS Organizations with SCPs. A member account has an SCP attached that allows only s3:* and ec2:* actions. An IAM administrator in the member account creates an IAM policy granting iam:CreateUser and attaches it to a developer's IAM user. The developer attempts to call iam:CreateUser. What is the outcome?

The call fails because the SCP does not include iam:CreateUser, and SCPs act as a maximum permissions boundary for the account

The call succeeds because the IAM administrator has full control within the member account

The call succeeds because IAM actions are always exempt from SCP restrictions

The call fails because member accounts can never manage IAM

Free AWS Solutions Architect Associate (SAA-C03) Practice Questions

Sharpen your AWS Solutions Architect Associate skills with real exam-style scenario questions covering security, resilience, performance, and cost optimization. Every question comes with a full explanation of why the correct answer wins and why the other options fall short, plus a direct link to the official AWS documentation that backs it up. No signup, no email wall — just practice. 30 questions below, free with no signup. Last updated 2026-07-03.

Every question is verified against official AWS documentation, linked below each answer.

Question 1Design Cost-Optimized Architectures
A team stores raw clickstream data in Amazon S3 and queries it with Amazon Athena. They currently store data as uncompressed JSON. Queries scan the entire dataset and monthly Athena charges are high. The dataset is written once and read many times by analysts running column-specific queries. Which change most reduces Athena costs?
Reveal answer & explanation
Answer: B. Convert the data to Apache Parquet format, partitioned by date
Athena bills by the amount of data scanned per query. Converting to columnar Parquet lets Athena read only the columns a query references instead of full rows, and partitioning by date lets it skip whole partitions that don't match the query's filter. Together these cut scanned bytes — and cost — by 90% or more.
Go deeper: Why does Athena charge based on bytes scanned rather than query complexity? How does partitioning let Athena skip data before it even reads it?
Source: official AWS documentation · verified 2026-07-03
Question 2Design Cost-Optimized Architectures
A company runs 500 AWS Lambda functions across three AWS accounts. Functions have diverse memory settings (128 MB to 3 GB) and duration profiles. The team wants a systematic, data-driven way to right-size all Lambda functions to minimize cost without manually profiling each function. Which AWS-native approach is most effective?
Reveal answer & explanation
Answer: A. Use AWS Compute Optimizer to review Lambda memory and duration recommendations for each function
Compute Optimizer analyzes each function's invocation history and recommends a memory size that minimizes cost while preserving performance, accounting for the fact that Lambda bills memory times duration so more memory can sometimes lower total cost by shortening runtime. It works across multiple accounts when integrated with AWS Organizations, giving a systematic, data-driven view instead of manual profiling.
Go deeper: Why can raising a function's memory sometimes lower its total cost? What would happen to a CPU-bound function's duration if you set it to the minimum memory?
Source: official AWS documentation · verified 2026-07-03
Question 3Design Cost-Optimized Architectures
A company runs an Amazon OpenSearch Service domain with 6 data nodes for a logging platform. Logs older than 14 days are rarely queried but must be searchable within minutes if needed. Storage costs for the hot nodes are growing rapidly. What is the most cost-effective way to reduce OpenSearch storage costs without losing searchability?
Reveal answer & explanation
Answer: A. Enable UltraWarm nodes and move indices older than 14 days to UltraWarm storage
UltraWarm moves indices onto S3-backed warm storage that costs significantly less per GB than hot EBS-backed nodes, while keeping those indices searchable — queries are just slower, but still return within minutes.
Go deeper: Why is S3-backed warm storage so much cheaper than EBS-backed hot storage? What tradeoff are you accepting when data moves from hot to warm storage?
Source: official AWS documentation · verified 2026-07-03
Question 4Design Cost-Optimized Architectures
A company is running hundreds of EC2 instances across multiple AWS regions. The billing team notices that several Elastic IP addresses are allocated but not attached to any running instance, generating unnecessary charges. What is the most direct action to eliminate these charges?
Reveal answer & explanation
Answer: C. Release all unattached Elastic IP addresses
AWS charges for Elastic IP addresses that are allocated but not associated with a running instance. Releasing the unattached ones stops those charges immediately — it's the most direct fix.
Go deeper: Why does AWS charge for an idle Elastic IP but not for one attached to a running instance? What's the difference between an EIP being 'allocated' and being 'associated'?
Source: official AWS documentation · verified 2026-07-03
Question 5Design Cost-Optimized Architectures
A company runs an AWS Fargate service with tasks that each require 4 vCPU and 8 GB memory. Tasks run continuously. The engineering team has just determined that actual CPU usage averages 1 vCPU and memory averages 2 GB. Which two changes together minimize Fargate cost? (Choose the single answer that captures both.)
Reveal answer & explanation
Answer: A. Right-size tasks to 1 vCPU / 2 GB and purchase Compute Savings Plans
Right-sizing the tasks from 4 vCPU/8 GB down to 1 vCPU/2 GB cuts the Fargate resource cost by roughly 75%, matching provisioned capacity to actual usage. Layering a Compute Savings Plan on top adds a further discount (up to about 17%) with full flexibility, without introducing interruption risk for a continuously running service.
Go deeper: Why does right-sizing produce a bigger saving here than a Savings Plan alone? What makes a workload a poor fit for Spot capacity?
Source: official AWS documentation · verified 2026-07-03
Question 6Design Cost-Optimized Architectures
A company hosts a popular read-heavy web application backed by Amazon RDS for MySQL. They add multiple read replicas to scale read traffic, but their RDS bill increases significantly. Analysis shows that 70% of read queries repeatedly request the same rows. What is the most cost-effective way to reduce the number of read replicas needed?
Reveal answer & explanation
Answer: B. Place an Amazon ElastiCache for Memcached cluster in front of RDS to cache frequent reads
Since 70% of reads target the same rows, putting a cache in front of RDS lets the majority of reads be served from memory instead of the database, dramatically reducing load and allowing the number of read replicas — and their cost — to be reduced.
Go deeper: Why does caching repeated reads reduce the number of replicas you need? What kind of read pattern makes a cache especially effective?
Source: official AWS documentation · verified 2026-07-03
Question 7Design Cost-Optimized Architectures
A company uses AWS CloudTrail to record API activity across all accounts in an AWS Organization. They enable CloudTrail in every region and every account independently, each writing to its own S3 bucket. The storage and duplication costs are high. What is the most cost-effective way to centralize and reduce CloudTrail costs across the organization?
Reveal answer & explanation
Answer: A. Create an organization trail in the management account that logs all accounts and regions to a single S3 bucket
An AWS Organizations trail is a single CloudTrail configuration in the management account that automatically covers every existing and future account and region, writing to one central S3 bucket. This eliminates the duplicate per-account trails and their storage and API costs, and consolidating into one trail maximizes the free first copy of management events.
Go deeper: Why does consolidating into one organization trail reduce cost compared to per-account trails? What would you lose by disabling CloudTrail in all but one region?
Source: official AWS documentation · verified 2026-07-03
Question 8Design High-Performing Architectures
A company serves a high-traffic public API using Amazon API Gateway and Lambda. The API responses change only once every hour but are identical for all users. API Gateway metrics show 80% of invocations are redundant re-computations. What is the simplest way to reduce Lambda invocations and improve response latency?
Reveal answer & explanation
Answer: A. Enable API Gateway stage-level caching with an appropriate TTL
API Gateway has a built-in stage-level response cache. With a TTL matching how often the data actually changes, repeated identical requests are served straight from the cache without invoking Lambda at all, cutting both latency and compute cost.
Go deeper: Why does caching at the API Gateway stage level save more than caching inside the Lambda function? What determines the right TTL to set for the cache?
Source: official AWS documentation · verified 2026-07-03
Question 9Design High-Performing Architectures
A company runs a MySQL workload on Amazon RDS. The database is read-heavy with 95% SELECT queries. The engineering team wants to offload read traffic with the least amount of infrastructure management. Which approach is most appropriate?
Reveal answer & explanation
Answer: A. Create an RDS Read Replica and point read traffic to its endpoint
An RDS Read Replica asynchronously replicates from the primary and exposes its own read endpoint, so SELECT traffic can be routed there directly, offloading the primary — with minimal infrastructure to manage.
Go deeper: Why can't the Multi-AZ standby be used to serve read traffic? What tradeoff comes with a read replica's asynchronous replication?
Source: official AWS documentation · verified 2026-07-03
Question 10Design High-Performing Architectures
A company runs a containerized application on Amazon EKS. The application processes large scientific datasets by reading and writing to shared storage simultaneously across dozens of pods. The workload requires consistent sub-millisecond storage latency and throughput of several GB/s. Which storage solution is most appropriate?
Reveal answer & explanation
Answer: B. Amazon FSx for Lustre integrated with S3
FSx for Lustre is a high-performance parallel file system built for HPC and ML workloads. It delivers sub-millisecond latency and throughput in the hundreds of GB/s, can be mounted concurrently by many pods at once, and natively integrates with S3 for loading and offloading data.
Go deeper: Why does a shared, multi-pod workload rule out EBS as a storage option? What makes a parallel file system different from a general-purpose network file system like EFS?
Source: official AWS documentation · verified 2026-07-03
Question 11Design High-Performing Architectures
An online travel booking application queries Amazon Aurora PostgreSQL for available flights. Each search query joins five tables and returns results in 2–4 seconds. The marketing team runs the same searches repeatedly for popular routes. The engineering team wants to serve popular route searches in under 100 ms without rewriting the complex SQL queries. Which solution achieves this?
Reveal answer & explanation
Answer: A. Add an Amazon ElastiCache for Redis cluster and cache query result sets keyed by route parameters
Caching the result sets for popular route searches in Redis, keyed by the route parameters, lets repeated identical searches be served from memory in under a millisecond — entirely bypassing the expensive five-table join in Aurora — without touching the SQL.
Go deeper: Why does caching the whole result set beat caching individual rows for a five-table join? What determines a good cache key for this kind of query?
Source: official AWS documentation · verified 2026-07-03
Question 12Design High-Performing Architectures
A company runs a batch analytics workload that reads 50 TB of compressed CSV files from Amazon S3 using Amazon Athena. Queries scan entire datasets every run and take over 30 minutes, primarily because of format overhead. The data schema is fixed and rarely changes. Which single change most dramatically reduces query run time and data scanned?
Reveal answer & explanation
Answer: A. Convert the CSV files to Apache Parquet format partitioned by date and store them back in S3
Converting the CSV files to columnar Parquet lets Athena read only the needed columns and apply predicate pushdown and compression, while partitioning by date lets it skip irrelevant S3 prefixes entirely. Together these typically cut both query time and data scanned by 80-90%.
Go deeper: Why does row format (CSV) force Athena to scan more data than a columnar format? How does partitioning let a query engine skip data before scanning it?
Source: official AWS documentation · verified 2026-07-03
Question 13Design High-Performing Architectures
A company processes clickstream events using an Amazon Kinesis Data Streams consumer running on EC2. The consumer calls GetRecords every second and processes records in batches. As throughput scales, the team observes that record processing lag grows and CPU utilization is low. Investigation reveals the consumer is spending most of its time waiting on GetRecords API responses. Which change best improves consumer throughput?
Reveal answer & explanation
Answer: A. Switch from the classic GetRecords polling model to the Kinesis Enhanced Fan-Out (EFO) feature with SubscribeToShard
Enhanced Fan-Out uses HTTP/2 server push via SubscribeToShard to deliver records to each registered consumer at up to 2 MB/s per shard as soon as they arrive, eliminating the polling overhead and the shared 2 MB/s read limit that classic GetRecords consumers contend for on a shard.
Go deeper: Why do classic GetRecords consumers on the same shard have to share a 2 MB/s read limit? What does 'server push' change about how quickly a consumer sees new records?
Source: official AWS documentation · verified 2026-07-03
Question 14Design High-Performing Architectures
A financial services firm runs a latency-sensitive order matching engine on Amazon EC2. The application requires predictable, consistent network performance and the lowest possible packet loss between instances in the same region. The team notices occasional latency spikes they attribute to network jitter from co-hosted workloads. Which EC2 feature most directly addresses this?
Reveal answer & explanation
Answer: B. Use a placement group with Cluster strategy
A Cluster placement group packs instances physically close together within a single Availability Zone on the same high-bisection-bandwidth rack fabric, which is the primary mechanism for minimizing round-trip time and jitter between co-located instances.
Go deeper: Why does physical proximity between instances reduce network jitter? What's the difference between reducing CPU overhead on one instance versus reducing distance between two instances?
Source: official AWS documentation · verified 2026-07-03
Question 15Design High-Performing Architectures
A company wants to accelerate DNS resolution for an application that makes thousands of DNS queries per minute to external domains. The application runs on EC2 instances in a VPC. Which AWS feature provides the fastest DNS resolution for queries within the VPC?
Reveal answer & explanation
Answer: B. Use the Amazon Route 53 Resolver (VPC+2 resolver) already available at the VPC base address
The Route 53 Resolver is built into every VPC at the reserved IP address (VPC CIDR base + 2). It forwards external queries to authoritative servers with typically single-digit millisecond latency and requires no deployment or management.
Go deeper: Why is a resolver built into the VPC faster than one reached over the internet? What's the tradeoff of running your own DNS server on EC2 instead of using the built-in resolver?
Source: official AWS documentation · verified 2026-07-03
Question 16Design High-Performing Architectures
A company's application uploads hundreds of 5 GB files daily from an on-premises data center to Amazon S3. Engineers observe that individual upload speeds top out at 300 Mbps even though the internet link supports 1 Gbps. They want to maximize S3 upload throughput. Which S3 feature should they use?
Reveal answer & explanation
Answer: A. S3 Multipart Upload to split each file into parallel parts and upload them concurrently
S3 Multipart Upload splits a large object into parts and uploads them in parallel over multiple TCP connections, which saturates available bandwidth — a single PUT request is limited by the throughput of one TCP stream. AWS recommends Multipart Upload for objects over 100 MB, which fits these 5 GB files.
Go deeper: Why does splitting one large upload into parallel parts increase total throughput? When would Transfer Acceleration actually help more than Multipart Upload?
Source: official AWS documentation · verified 2026-07-03
Question 17Design Resilient Architectures
A company's production workload uses Amazon CloudFront with an Application Load Balancer as the origin. During a recent application deployment, a misconfigured security group blocked all traffic from CloudFront to the ALB, causing a full outage. The team wants to be notified within 5 minutes if the origin becomes unreachable from CloudFront in the future. Which monitoring approach is most effective?
Reveal answer & explanation
Answer: C. Create an Amazon CloudWatch Synthetics canary that tests the CloudFront distribution URL every minute and triggers an SNS alarm if the test fails
A CloudWatch Synthetics canary continuously makes real HTTP requests to the CloudFront URL on a schedule as frequent as every minute. If the origin becomes unreachable, the canary test fails, a CloudWatch alarm fires, and SNS can notify the team within minutes — genuine end-to-end reachability testing.
Go deeper: Why does an active canary catch problems that a passive metric alarm might miss? What's the difference between detecting a configuration change and detecting its actual impact?
Source: official AWS documentation · verified 2026-07-03
Question 18Design Resilient Architectures
A financial company runs a critical payment processing service behind an Application Load Balancer. The ALB distributes traffic to two target groups: one for new Go-based microservices and one for legacy Java monolith instances. During a recent incident, a faulty deployment to the Go target group caused cascading failures, and it took 45 minutes to manually shift all traffic back to the legacy target group. The team wants future traffic shifts to the Go services to be gradual, observable, and automatically rolled back if error rates exceed 5%. Which AWS-native solution achieves this?
Reveal answer & explanation
Answer: A. Use Amazon CodeDeploy with a canary deployment configuration targeting the ALB, and configure a CodeDeploy CloudWatch alarm rollback trigger on the 5xx error rate
AWS CodeDeploy supports ALB-integrated canary and linear deployment configurations that gradually shift traffic between target groups, with CloudWatch alarms — such as one on HTTPCode_Target_5XX_Count — attached as automatic rollback triggers. If the alarm fires during a deployment, CodeDeploy automatically shifts traffic back to the original target group with no manual intervention.
Go deeper: Why is an automated rollback trigger more reliable than a notification-only alarm during an incident? What makes DNS-based traffic shifting slower to react than ALB-level shifting?
Source: official AWS documentation · verified 2026-07-03
Question 19Design Resilient Architectures
A company's e-commerce platform uses Amazon SQS standard queues to pass orders to a fulfillment Lambda function. Order volume peaks during flash sales, sometimes exceeding 10,000 messages per second. During these peaks, individual fulfillment Lambda invocations fail because a downstream inventory service becomes overloaded. The team wants to automatically slow down order consumption when the downstream service is stressed, without losing any messages. What should the architect implement?
Reveal answer & explanation
Answer: A. Set a reserved concurrency limit on the fulfillment Lambda function to throttle its invocation rate
Setting a reserved concurrency limit on the Lambda function caps how many concurrent executions can process SQS messages. When the limit is reached, messages simply remain in the queue — nothing is lost — and Lambda scales back up as capacity frees, which acts as automatic back-pressure on the downstream service.
Go deeper: Why does capping Lambda concurrency protect a downstream service without losing messages? What's the difference between limiting throughput and simply delaying redelivery?
Source: official AWS documentation · verified 2026-07-03
Question 20Design Resilient Architectures
A company stores application logs in an S3 bucket. A junior developer accidentally deleted the bucket's versioning configuration and removed several critical log files. The team wants to ensure that future accidental deletions can be recovered, and that all versions of every object are preserved. What should the architect enable?
Reveal answer & explanation
Answer: B. Enable S3 Versioning and configure an MFA Delete requirement on the bucket
Enabling S3 Versioning preserves every version of every object so accidental deletions can be recovered. Adding MFA Delete then prevents anyone — including the bucket owner — from permanently deleting versions or suspending versioning without a second factor, protecting against both accidents and malicious actions.
Go deeper: Why does MFA Delete protect against malicious deletion in a way that versioning alone doesn't? What's the risk of letting a lifecycle rule expire old object versions?
Source: official AWS documentation · verified 2026-07-03
Question 21Design Resilient Architectures
A company runs a critical order processing service on Amazon EC2 instances behind an Application Load Balancer. The service depends on an Amazon RDS Aurora PostgreSQL cluster. During a recent deployment, the application tier was taken down for 20 minutes while a schema migration ran. The team needs future schema migrations to complete without any application downtime. Which approach best achieves this?
Reveal answer & explanation
Answer: A. Use an Aurora blue/green deployment to perform the schema migration on the green environment, then switch over
Aurora blue/green deployments create a synchronized staging (green) copy of the cluster where schema changes can be applied and validated before a managed switchover that typically completes in under a minute — eliminating migration-related downtime.
Go deeper: Why does keeping the green environment continuously synchronized matter for a clean switchover? What goes wrong if the cluster you migrate against isn't receiving live production writes?
Source: official AWS documentation · verified 2026-07-03
Question 22Design Resilient Architectures
A multinational company runs a latency-sensitive trading application across AWS regions us-east-1 and eu-west-1 using Amazon Route 53 latency-based routing. Both regions are active. During a partial failure in us-east-1, the ALB in that region continued to pass Route 53 health checks because the ALB itself was healthy, but the EC2 instances behind it were all returning HTTP 500 errors. Users in North America continued to be routed to the degraded region. What is the most robust way to ensure Route 53 stops routing traffic to a region when its application tier is unhealthy?
Reveal answer & explanation
Answer: A. Replace the Route 53 health check on the ALB endpoint with a calculated health check that aggregates CloudWatch alarms on the ALB's HTTPCode_Target_5XX_Count metric
Route 53 calculated health checks combine multiple child health checks — including ones based on CloudWatch alarms — into a single parent health check. Tying a CloudWatch alarm on the ALB's HTTPCode_Target_5XX_Count metric to a Route 53 health check lets Route 53 mark the region unhealthy and stop routing traffic there when the application tier is producing elevated 5xx errors, even though the ALB itself is still reachable.
Go deeper: Why can an ALB be 'healthy' from Route 53's point of view while the application behind it is failing? What does combining child health checks into one calculated health check let you express that a single check can't?
Source: official AWS documentation · verified 2026-07-03
Question 23Design Resilient Architectures
A company runs a high-throughput data ingestion pipeline where producers publish messages to an Amazon SNS topic, which fans out to five SQS queues. One of the SQS queues feeds a Lambda function that processes data for a machine learning model. The ML Lambda function intermittently takes up to 15 minutes to process a batch, far exceeding the SQS visibility timeout of 30 seconds. This causes messages to become visible again and be processed multiple times, corrupting the ML model's training data. What is the correct fix with the least architectural change?
Reveal answer & explanation
Answer: A. Increase the SQS visibility timeout on the ML queue to 15 minutes
The SQS visibility timeout needs to be at least as long as the consumer's maximum processing time. Raising it to 15 minutes (or slightly more) on the ML queue stops messages from becoming visible again while still being processed, which prevents the duplicate deliveries — and it's the smallest possible change to make.
Go deeper: Why must the visibility timeout be at least as long as the worst-case processing time? What happens to a message if it becomes visible again while still being processed?
Source: official AWS documentation · verified 2026-07-03
Question 24Design Secure Architectures
A company runs a web application that uses Amazon Cognito User Pools. A security team wants to automatically block sign-ins from users whose credentials appear in a known compromised password database, without writing custom Lambda code. Which Cognito feature addresses this?
Reveal answer & explanation
Answer: A. Cognito advanced security features with compromised credentials detection enabled
Cognito's advanced security features include compromised credentials detection, which checks passwords against a database of known compromised credentials during sign-in and sign-up and can block or flag those attempts natively, with no Lambda code required.
Go deeper: Why is a native feature preferable here to writing custom Lambda logic that does something similar? What's the difference between blocking a bad IP and blocking a bad credential?
Source: official AWS documentation · verified 2026-07-03
Question 25Design Secure Architectures
A company wants to enforce that IAM users can only perform AWS actions from a specific geographic region (us-east-1) and must deny all actions attempted from any other region. Which IAM condition key should be used to enforce this in an SCP or IAM policy?
Reveal answer & explanation
Answer: A. aws:RequestedRegion with a StringNotEquals condition
aws:RequestedRegion is the condition key that restricts which AWS region an API call targets. Using StringNotEquals with a list of allowed regions cleanly denies calls aimed at any other region.
Go deeper: Why does the region an API call targets need its own condition key, separate from the caller's identity or location? What's unreliable about trying to infer a caller's region from their source IP?
Source: official AWS documentation · verified 2026-07-03
Question 26Design Secure Architectures
A company wants to receive an alert any time someone creates, modifies, or deletes a security group in their AWS account. Which is the simplest combination of services to achieve this?
Reveal answer & explanation
Answer: A. Enable AWS CloudTrail, create an Amazon EventBridge rule matching EC2 security group API events, and trigger an SNS notification
CloudTrail captures all EC2 API calls, including security group modifications. An EventBridge rule can match specific events — like AuthorizeSecurityGroupIngress, CreateSecurityGroup, or DeleteSecurityGroup — and route them straight to SNS for near-real-time alerts, with no custom code.
Go deeper: Why does routing CloudTrail events through EventBridge avoid the need for custom polling code? What's the tradeoff between a polling-based detection approach and an event-driven one?
Source: official AWS documentation · verified 2026-07-03
Question 27Design Secure Architectures
A security engineer is auditing IAM policies and finds a role with the following condition on an S3 policy: 'aws:MultiFactorAuthPresent': 'true'. The role is used by an EC2 instance via an instance profile. Will EC2 instance calls to S3 succeed? Explain the issue.
Reveal answer & explanation
Answer: B. No, EC2 instance profile calls never set aws:MultiFactorAuthPresent to true, so the condition will always deny access
The aws:MultiFactorAuthPresent condition key evaluates to false (or is absent) for calls made with temporary credentials from an EC2 instance profile, because no interactive MFA step occurs when the EC2 service assumes the role. A policy requiring this condition to be true will therefore always deny calls made through the instance profile, breaking the application.
Go deeper: Why can't a machine identity like an EC2 instance ever satisfy an interactive MFA condition? What would you need to change in the policy to let instance-profile calls succeed?
Source: official AWS documentation · verified 2026-07-03
Question 28Design Secure Architectures
A company's security policy requires that all API Gateway REST API endpoints be accessible only to applications running inside the company's VPC. Requests originating from the public internet must be rejected. What is the correct configuration?
Reveal answer & explanation
Answer: B. Deploy the API as a Private endpoint type, create a VPC endpoint for API Gateway, and attach a resource policy that denies access from outside the VPC endpoint
Private API Gateway endpoints are specifically designed to be reachable only from within a VPC, via an interface VPC endpoint using AWS PrivateLink. Adding a resource policy that denies access outside the VPC endpoint's source VPC condition ensures no public access is possible.
Go deeper: Why is a Private endpoint type a stronger control than a public endpoint plus a WAF rule? What role does the VPC endpoint's source-VPC condition play in the resource policy?
Source: official AWS documentation · verified 2026-07-03
Question 29Design Secure Architectures
A company wants to ensure that Amazon S3 server access logs for a bucket named 'app-data' are stored securely and that the logging configuration cannot be disabled by any team member except the security team. Which combination of controls achieves this?
Reveal answer & explanation
Answer: A. Enable S3 server access logging and use an S3 bucket policy that denies s3:PutBucketLogging except for the security team's IAM role
Enabling S3 server access logging and adding a bucket policy that denies s3:PutBucketLogging to everyone except the security team's role ensures only that team can modify or disable logging — a preventive control targeted exactly at the right people.
Go deeper: Why does an org-wide SCP block go too far compared to a targeted bucket policy? What's the difference between a preventive control and a detective control here?
Source: official AWS documentation · verified 2026-07-03
Question 30Design Secure Architectures
A company uses AWS Organizations with SCPs. A member account has an SCP attached that allows only s3:* and ec2:* actions. An IAM administrator in the member account creates an IAM policy granting iam:CreateUser and attaches it to a developer's IAM user. The developer attempts to call iam:CreateUser. What is the outcome?
Reveal answer & explanation
Answer: B. The call fails because the SCP does not include iam:CreateUser, and SCPs act as a maximum permissions boundary for the account
SCPs set the maximum permissions available in a member account. Even though the IAM policy explicitly grants iam:CreateUser, the attached SCP only allows s3:* and ec2:* — since iam:CreateUser falls outside that boundary, the call is denied regardless of what the IAM policy says.
Go deeper: Why does an SCP override an explicit Allow in an IAM policy? What would need to change in the SCP for this call to succeed?
Source: official AWS documentation · verified 2026-07-03

SAA-C03 exam — common questions

How many questions are on the SAA-C03 exam?

The SAA-C03 exam has 65 questions — 50 that count toward your score and 15 unscored questions AWS uses to evaluate future exam content. You won't know which is which, so treat every question as scored.

How long is the SAA-C03 exam and what score do I need to pass?

You get 130 minutes to complete the exam, and you need a scaled score of 720 out of a possible 1000 to pass.

How much does the SAA-C03 exam cost, and are there prerequisites?

The exam costs $150 USD, and AWS sets no formal prerequisites — anyone can register and sit for it.

What topics does the SAA-C03 exam cover, and how long should I study?

The exam is organized into four domains: Design Secure Architectures (30%), Design Resilient Architectures (26%), Design High-Performing Architectures (24%), and Design Cost-Optimized Architectures (20%). Most candidates with some hands-on AWS exposure spend about 4-6 weeks preparing, and it's AWS's most-recognized associate-level certification.

More practice sets: AI Practitioner (AIF-C01) · Cloud Practitioner (CLF-C02) · Developer (DVA-C02)