This is the free Amazon SAA-C03 practice question bank —
510 of 1004 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-10-13.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A company uses GPS trackers to document the migration patterns of thousands of sea turtles. The trackers check every 5 minutes to see if a turtle has moved more than 100 yards (91.4 meters). If a turtle has moved, its tracker sends the new coordinates to a web application running on three Amazon EC2 instances that are in multiple Availability Zones in one AWS Region.
Recently, the web application was overwhelmed while processing an unexpected volume of tracker data. Data was lost with no way to replay the events. A solutions architect must prevent this problem from happening again and needs a solution with the least operational overhead.
What should the solutions architect do to meet these requirements?
A. Create an Amazon S3 bucket to store the data. Configure the application to scan for new data in the bucket for processing.
B. Create an Amazon API Gateway endpoint to handle transmitted location coordinates. Use an AWS Lambda function to process each item concurrently.
C. Create an Amazon Simple Queue Service (Amazon SQS) queue to store the incoming data. Configure the application to poll for new messages for processing.
D. Create an Amazon DynamoDB table to store transmitted location coordinates. Configure the application to query the table for new data for processing. Use TTL to remove data that has been processed.
Show Answer
Correct Answer: C
Explanation: Amazon SQS is the best fit because it buffers incoming tracker events, decouples producers from consumers, and allows the EC2 application to process messages at its own rate. Messages are durably retained until processed, preventing data loss during traffic spikes and allowing replay by consuming queued messages. This is a fully managed service with minimal operational overhead. S3 is not a queue and polling buckets is inefficient for this use case. API Gateway with Lambda changes the architecture but does not inherently provide durable buffering against downstream overload unless combined with a queue. DynamoDB is a database, not an event buffer, and querying for new items is not an appropriate ingestion pattern.
Question 1
A company uses Amazon EC2 instances to host its internal systems. As part of a deployment operation, an administrator tries to use the AWS CLI to terminate an EC2 instance. However, the administrator receives a 403 (Access Denied) error message.
The administrator is using an IAM role that has the following IAM policy attached:
What is the cause of the unsuccessful request?
A. The EC2 instance has a resource-based policy with a Deny statement.
B. The principal has not been specified in the policy statement.
C. The "Action" field does not grant the actions that are required to terminate the EC2 instance.
D. The request to terminate the EC2 instance does not originate from the CIDR blocks 192.0.2.0/24 or 203.0.113.0/24.
Show Answer
Correct Answer: D
Explanation: The policy explicitly denies `ec2:TerminateInstances` when the request’s source IP is not in either listed CIDR block. An explicit Deny overrides the Allow, so a request originating outside those ranges receives Access Denied.
Question 1
A consumer survey company has gathered data for several years from a specific geographic region. The company stores this data in an Amazon S3 bucket in an AWS Region.
The company has started to share this data with a marketing firm in a new geographic region. The company has granted the firm's AWS account access to the S3 bucket. The company wants to minimize the data transfer costs when the marketing firm requests data from the S3 bucket.
Which solution will meet these requirements?
A. Configure the Requester Pays feature on the company’s S3 bucket.
B. Configure S3 Cross-Region Replication (CRR) from the company’s S3 bucket to one of the marketing firm’s S3 buckets.
C. Configure AWS Resource Access Manager to share the S3 bucket with the marketing firm AWS account.
D. Configure the company’s S3 bucket to use S3 Intelligent-Tiering Sync the S3 bucket to one of the marketing firm’s S3 buckets.
Show Answer
Correct Answer: A
Explanation: Enable S3 Requester Pays. The marketing firm, as the requester, pays the request and data transfer charges for its access, reducing the survey company’s costs. Cross-Region Replication would add replication and storage costs rather than directly reducing the company’s costs for requests to its bucket.
Question 1
A company is running a batch application on Amazon EC2 instances. The application consists of a backend with multiple Amazon RDS databases. The application is causing a high number of reads on the databases. A solutions architect must reduce the number of database reads while ensuring high availability.
What should the solutions architect do to meet this requirement?
A. Add Amazon RDS read replicas.
B. Use Amazon ElastiCache for Redis.
C. Use Amazon Route 53 DNS caching
D. Use Amazon ElastiCache for Memcached.
Show Answer
Correct Answer: B
Explanation: ElastiCache for Redis can serve frequently requested data from an in-memory cache, reducing reads against the RDS databases. Redis supports high availability through replication and automatic failover. RDS read replicas distribute database reads but do not reduce the total number of database read requests.
Question 1
A company has an application that is running on Amazon EC2 instances. A solutions architect has standardized the company on a particular instance family and various instance sizes based on the current needs of the company.
The company wants to maximize cost savings for the application over the next 3 years. The company needs to be able to change the instance family and sizes in the next 6 months based on application popularity and usage.
Which solution will meet these requirements MOST cost-effectively?
A. Compute Savings Plan
B. EC2 Instance Savings Plan
C. Zonal Reserved Instances
D. Standard Reserved Instances
Show Answer
Correct Answer: A
Explanation: Compute Savings Plans provide flexibility across EC2 instance families, sizes, Regions, operating systems, and tenancy while offering significant discounts over a 1- or 3-year commitment. EC2 Instance Savings Plans are limited to a specific instance family, so they do not meet the requirement to change instance families. Standard and Zonal Reserved Instances are even more restrictive.
Question 2
A company is developing an application in the AWS Cloud. The application's HTTP API contains critical information that is published in Amazon API Gateway. The critical information must be accessible from only a limited set of trusted IP addresses that belong to the company's internal network.
Which solution will meet these requirements?
A. Set up an API Gateway private integration to restrict access to a predefined set of IP addresses.
B. Create a resource policy for the API that denies access to any IP address that is not specifically allowed.
C. Directly deploy the API in a private subnet. Create a network ACL. Set up rules to allow the traffic from specific IP addresses.
D. Modify the security group that is attached to API Gateway to allow inbound traffic from only the trusted IP addresses.
Show Answer
Correct Answer: B
Explanation: API Gateway access can be restricted by attaching a resource policy that explicitly allows or denies requests based on source IP address (aws:SourceIp). API Gateway is a managed service and you do not attach security groups to a public/regional API Gateway endpoint. Private integration is for connecting API Gateway to private backend resources, not for client IP filtering. Deploying an API into a private subnet is not how API Gateway is exposed.
Question 2
A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing data and new data by using SQL. The company stores the data in an Amazon S3 bucket. The data must be encrypted at rest and replicated to a different AWS Region.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a new S3 bucket that uses server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon Athena to query the data.
B. Create a new S3 bucket that uses server-side encryption with Amazon S3 managed keys (SSE-S3). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon RDS to query the data.
C. Configure Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use Amazon Athena to query the data.
D. Configure S3 Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon RDS to query the data.
Show Answer
Correct Answer: A
Explanation: Amazon Athena provides serverless SQL queries over S3 data. Configuring encryption and Cross-Region Replication before loading the existing data into the new bucket ensures that both the loaded data and subsequent objects are encrypted and replicated. Option C has less setup, but enabling CRR on an existing bucket does not automatically replicate objects already in it.
Question 2
A company is preparing a new data platform that will ingest real-time streaming data from multiple sources. The company needs to transform the data before writing the data to Amazon S3. The company needs the ability to use SQL to query the transformed data.
Which solutions will meet these requirements? (Choose two.)
A. Use Amazon Kinesis Data Streams to stream the data. Use Amazon Kinesis Data Analytics to transform the data. Use Amazon Kinesis Data Firehose to write the data to Amazon S3. Use Amazon Athena to query the transformed data from Amazon S3.
B. Use Amazon Managed Streaming for Apache Kafka (Amazon MSK) to stream the data. Use AWS Glue to transform the data and to write the data to Amazon S3. Use Amazon Athena to query the transformed data from Amazon S3.
C. Use AWS Database Migration Service (AWS DMS) to ingest the data. Use Amazon EMR to transform the data and to write the data to Amazon S3. Use Amazon Athena to query the transformed data from Amazon S3.
D. Use Amazon Managed Streaming for Apache Kafka (Amazon MSK) to stream the data. Use Amazon Kinesis Data Analytics to transform the data and to write the data to Amazon S3. Use the Amazon RDS query editor to query the transformed data from Amazon S3.
E. Use Amazon Kinesis Data Streams to stream the data. Use AWS Glue to transform the data. Use Amazon Kinesis Data Firehose to write the data to Amazon S3. Use the Amazon RDS query editor to query the transformed data from Amazon S3.
Show Answer
Correct Answer: A, B
Explanation: A and B satisfy the requirements for real-time streaming ingestion, transformation before storing in Amazon S3, and SQL querying of the transformed data using Amazon Athena. In A, Kinesis Data Streams + Kinesis Data Analytics + Kinesis Data Firehose + Athena is a valid streaming analytics pipeline. In B, Amazon MSK provides streaming, AWS Glue streaming ETL can continuously transform data from MSK and write to S3, and Athena queries the data in S3. C uses AWS DMS, which is not the appropriate streaming ingestion service for this use case. D and E incorrectly use the Amazon RDS query editor to query data stored in S3; Athena is the appropriate SQL query service for S3.
Question 2
A group requires permissions to list an Amazon S3 bucket and delete objects from that bucket. An administrator has created the following IAM policy to provide access to the bucket and applied that policy to the group. The group is not able to delete objects in the bucket. The company follows least-privilege access rules.
Which statement should a solutions architect add to the policy to correct bucket access?
A.
B.
C.
D.
Show Answer
Correct Answer: D
Explanation: ` s3:ListBucket` requires the bucket ARN (`arn:aws:s3:::bucket-name`), while `s3:DeleteObject` requires an object ARN (`arn:aws:s3:::bucket-name/*`). Add a separate Allow statement for `s3:DeleteObject` using the object ARN, which grants only the needed object-level permission.
Question 2
A company collects data for temperature, humidity, and atmospheric pressure in cities across multiple continents. The average volume of data that the company collects from each site daily is 500 GB. Each site has a high-speed Internet connection.
The company wants to aggregate the data from all these global sites as quickly as possible in a single Amazon S3 bucket. The solution must minimize operational complexity.
Which solution meets these requirements?
A. Turn on S3 Transfer Acceleration on the destination S3 bucket. Use multipart uploads to directly upload site data to the destination S3 bucket.
B. Upload the data from each site to an S3 bucket in the closest Region. Use S3 Cross-Region Replication to copy objects to the destination S3 bucket. Then remove the data from the origin S3 bucket.
C. Schedule AWS Snowball Edge Storage Optimized device jobs daily to transfer data from each site to the closest Region. Use S3 Cross-Region Replication to copy objects to the destination S3 bucket.
D. Upload the data from each site to an Amazon EC2 instance in the closest Region. Store the data in an Amazon Elastic Block Store (Amazon EBS) volume. At regular intervals, take an EBS snapshot and copy it to the Region that contains the destination S3 bucket. Restore the EBS volume in that Region.
Show Answer
Correct Answer: A
Explanation: Enable S3 Transfer Acceleration on the destination bucket and upload directly from each site using multipart uploads. Transfer Acceleration routes uploads through nearby AWS edge locations to improve long-distance transfer speeds, while direct uploads to one bucket avoid the extra buckets and replication steps in the other options.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
