SAA-C03 Design Resilient Architectures practice questions

Design Resilient Architectures is 26% of the AWS Certified Solutions Architect – Associate (SAA-C03) exam, the second-heaviest of its 4 domains: roughly 13 of the 50 scored questions, and every 10% of accuracy here moves your scaled score about 26 points. Below are 7 free questions from this domain only, each with the answer explained and why every wrong option misses. Last updated 2026-07-03.

Every question is verified against official AWS documentation, linked below each answer.

  1. Question 1Design Resilient Architectures

    A company's production workload uses Amazon CloudFront with an Application Load Balancer as the origin. During a recent application deployment, a misconfigured security group blocked all traffic from CloudFront to the ALB, causing a full outage. The team wants to be notified within 5 minutes if the origin becomes unreachable from CloudFront in the future. Which monitoring approach is most effective?

    Reveal answer & explanation

    Answer: C. Create an Amazon CloudWatch Synthetics canary that tests the CloudFront distribution URL every minute and triggers an SNS alarm if the test fails

    A CloudWatch Synthetics canary continuously makes real HTTP requests to the CloudFront URL on a schedule as frequent as every minute. If the origin becomes unreachable, the canary test fails, a CloudWatch alarm fires, and SNS can notify the team within minutes — genuine end-to-end reachability testing.

    Go deeper: Why does an active canary catch problems that a passive metric alarm might miss? What's the difference between detecting a configuration change and detecting its actual impact?

    Source: official AWS documentation · verified 2026-07-03

  2. Question 2Design Resilient Architectures

    A financial company runs a critical payment processing service behind an Application Load Balancer. The ALB distributes traffic to two target groups: one for new Go-based microservices and one for legacy Java monolith instances. During a recent incident, a faulty deployment to the Go target group caused cascading failures, and it took 45 minutes to manually shift all traffic back to the legacy target group. The team wants future traffic shifts to the Go services to be gradual, observable, and automatically rolled back if error rates exceed 5%. Which AWS-native solution achieves this?

    Reveal answer & explanation

    Answer: A. Use Amazon CodeDeploy with a canary deployment configuration targeting the ALB, and configure a CodeDeploy CloudWatch alarm rollback trigger on the 5xx error rate

    AWS CodeDeploy supports ALB-integrated canary and linear deployment configurations that gradually shift traffic between target groups, with CloudWatch alarms — such as one on HTTPCode_Target_5XX_Count — attached as automatic rollback triggers. If the alarm fires during a deployment, CodeDeploy automatically shifts traffic back to the original target group with no manual intervention.

    Go deeper: Why is an automated rollback trigger more reliable than a notification-only alarm during an incident? What makes DNS-based traffic shifting slower to react than ALB-level shifting?

    Source: official AWS documentation · verified 2026-07-03

  3. Question 3Design Resilient Architectures

    A company's e-commerce platform uses Amazon SQS standard queues to pass orders to a fulfillment Lambda function. Order volume peaks during flash sales, sometimes exceeding 10,000 messages per second. During these peaks, individual fulfillment Lambda invocations fail because a downstream inventory service becomes overloaded. The team wants to automatically slow down order consumption when the downstream service is stressed, without losing any messages. What should the architect implement?

    Reveal answer & explanation

    Answer: A. Set a reserved concurrency limit on the fulfillment Lambda function to throttle its invocation rate

    Setting a reserved concurrency limit on the Lambda function caps how many concurrent executions can process SQS messages. When the limit is reached, messages simply remain in the queue — nothing is lost — and Lambda scales back up as capacity frees, which acts as automatic back-pressure on the downstream service.

    Go deeper: Why does capping Lambda concurrency protect a downstream service without losing messages? What's the difference between limiting throughput and simply delaying redelivery?

    Source: official AWS documentation · verified 2026-07-03

  4. Question 4Design Resilient Architectures

    A company stores application logs in an S3 bucket. A junior developer accidentally deleted the bucket's versioning configuration and removed several critical log files. The team wants to ensure that future accidental deletions can be recovered, and that all versions of every object are preserved. What should the architect enable?

    Reveal answer & explanation

    Answer: B. Enable S3 Versioning and configure an MFA Delete requirement on the bucket

    Enabling S3 Versioning preserves every version of every object so accidental deletions can be recovered. Adding MFA Delete then prevents anyone — including the bucket owner — from permanently deleting versions or suspending versioning without a second factor, protecting against both accidents and malicious actions.

    Go deeper: Why does MFA Delete protect against malicious deletion in a way that versioning alone doesn't? What's the risk of letting a lifecycle rule expire old object versions?

    Source: official AWS documentation · verified 2026-07-03

  5. Question 5Design Resilient Architectures

    A company runs a critical order processing service on Amazon EC2 instances behind an Application Load Balancer. The service depends on an Amazon RDS Aurora PostgreSQL cluster. During a recent deployment, the application tier was taken down for 20 minutes while a schema migration ran. The team needs future schema migrations to complete without any application downtime. Which approach best achieves this?

    Reveal answer & explanation

    Answer: A. Use an Aurora blue/green deployment to perform the schema migration on the green environment, then switch over

    Aurora blue/green deployments create a synchronized staging (green) copy of the cluster where schema changes can be applied and validated before a managed switchover that typically completes in under a minute — eliminating migration-related downtime.

    Go deeper: Why does keeping the green environment continuously synchronized matter for a clean switchover? What goes wrong if the cluster you migrate against isn't receiving live production writes?

    Source: official AWS documentation · verified 2026-07-03

  6. Question 6Design Resilient Architectures

    A multinational company runs a latency-sensitive trading application across AWS regions us-east-1 and eu-west-1 using Amazon Route 53 latency-based routing. Both regions are active. During a partial failure in us-east-1, the ALB in that region continued to pass Route 53 health checks because the ALB itself was healthy, but the EC2 instances behind it were all returning HTTP 500 errors. Users in North America continued to be routed to the degraded region. What is the most robust way to ensure Route 53 stops routing traffic to a region when its application tier is unhealthy?

    Reveal answer & explanation

    Answer: A. Replace the Route 53 health check on the ALB endpoint with a calculated health check that aggregates CloudWatch alarms on the ALB's HTTPCode_Target_5XX_Count metric

    Route 53 calculated health checks combine multiple child health checks — including ones based on CloudWatch alarms — into a single parent health check. Tying a CloudWatch alarm on the ALB's HTTPCode_Target_5XX_Count metric to a Route 53 health check lets Route 53 mark the region unhealthy and stop routing traffic there when the application tier is producing elevated 5xx errors, even though the ALB itself is still reachable.

    Go deeper: Why can an ALB be 'healthy' from Route 53's point of view while the application behind it is failing? What does combining child health checks into one calculated health check let you express that a single check can't?

    Source: official AWS documentation · verified 2026-07-03

  7. Question 7Design Resilient Architectures

    A company runs a high-throughput data ingestion pipeline where producers publish messages to an Amazon SNS topic, which fans out to five SQS queues. One of the SQS queues feeds a Lambda function that processes data for a machine learning model. The ML Lambda function intermittently takes up to 15 minutes to process a batch, far exceeding the SQS visibility timeout of 30 seconds. This causes messages to become visible again and be processed multiple times, corrupting the ML model's training data. What is the correct fix with the least architectural change?

    Reveal answer & explanation

    Answer: A. Increase the SQS visibility timeout on the ML queue to 15 minutes

    The SQS visibility timeout needs to be at least as long as the consumer's maximum processing time. Raising it to 15 minutes (or slightly more) on the ML queue stops messages from becoming visible again while still being processed, which prevents the duplicate deliveries — and it's the smallest possible change to make.

    Go deeper: Why must the visibility timeout be at least as long as the worst-case processing time? What happens to a message if it becomes visible again while still being processed?

    Source: official AWS documentation · verified 2026-07-03

More SAA-C03 practice