This is the free Amazon SAA-C03 practice question bank —
510 of 1003 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A company uses GPS trackers to document the migration patterns of thousands of sea turtles. The trackers check every 5 minutes to see if a turtle has moved more than 100 yards (91.4 meters). If a turtle has moved, its tracker sends the new coordinates to a web application running on three Amazon EC2 instances that are in multiple Availability Zones in one AWS Region.
Recently, the web application was overwhelmed while processing an unexpected volume of tracker data. Data was lost with no way to replay the events. A solutions architect must prevent this problem from happening again and needs a solution with the least operational overhead.
What should the solutions architect do to meet these requirements?
A. Create an Amazon S3 bucket to store the data. Configure the application to scan for new data in the bucket for processing.
B. Create an Amazon API Gateway endpoint to handle transmitted location coordinates. Use an AWS Lambda function to process each item concurrently.
C. Create an Amazon Simple Queue Service (Amazon SQS) queue to store the incoming data. Configure the application to poll for new messages for processing.
D. Create an Amazon DynamoDB table to store transmitted location coordinates. Configure the application to query the table for new data for processing. Use TTL to remove data that has been processed.
Show Answer
Correct Answer: C
Explanation: Amazon SQS provides a durable, highly scalable buffer to decouple the GPS trackers from the web application. By queuing incoming location events, SQS absorbs traffic spikes, prevents data loss, and allows the application to process messages at its own pace and recover from failures. Messages remain available until processed, enabling replay if processing is delayed. SQS is fully managed and requires minimal operational overhead compared to managing storage scans or custom polling logic.
Question 2
A company is developing an application in the AWS Cloud. The application's HTTP API contains critical information that is published in Amazon API Gateway. The critical information must be accessible from only a limited set of trusted IP addresses that belong to the company's internal network.
Which solution will meet these requirements?
A. Set up an API Gateway private integration to restrict access to a predefined set of IP addresses.
B. Create a resource policy for the API that denies access to any IP address that is not specifically allowed.
C. Directly deploy the API in a private subnet. Create a network ACL. Set up rules to allow the traffic from specific IP addresses.
D. Modify the security group that is attached to API Gateway to allow inbound traffic from only the trusted IP addresses.
Show Answer
Correct Answer: B
Explanation: Amazon API Gateway supports resource policies that can explicitly allow or deny requests based on source IP address. By creating a resource policy that denies access unless the request originates from the company’s trusted IP ranges, the API remains publicly reachable but securely restricted. Other options are incorrect because API Gateway is a managed service that does not use security groups, cannot be placed directly in subnets, and private integrations are for backend connectivity, not client IP access control.
Question 3
A company needs to give a globally distributed development team secure access to the company's AWS resources in a way that complies with security policies.
The company currently uses an on-premises Active Directory for internal authentication. The company uses AWS Organizations to manage multiple AWS accounts that support multiple projects.
The company needs a solution to integrate with the existing infrastructure to provide centralized identity management and access control.
Which solution will meet these requirements with the LEAST operational overhead?
A. Set up AWS Directory Service to create an AWS managed Microsoft Active Directory on AWS. Establish a trust relationship with the on-premises Active Directory. Use IAM rotes that are assigned to Active Directory groups to access AWS resources within the company's AWS accounts.
B. Create an IAM user for each developer. Manually manage permissions for each IAM user based on each user's involvement with each project. Enforce multi-factor authentication (MFA) as an additional layer of security.
C. Use AD Connector in AWS Directory Service to connect to the on-premises Active Directory. Integrate AD Connector with AWS IAM Identity Center. Configure permissions sets to give each AD group access to specific AWS accounts and resources.
D. Use Amazon Cognito to deploy an identity federation solution. Integrate the identity federation solution with the on-premises Active Directory. Use Amazon Cognito to provide access tokens for developers to access AWS accounts and resources.
Show Answer
Correct Answer: C
Explanation: Using AD Connector with AWS IAM Identity Center allows AWS to authenticate users directly against the existing on‑premises Active Directory without directory replication. Identity Center integrates natively with AWS Organizations to provide centralized access across multiple AWS accounts using permission sets mapped to AD groups. This meets security and compliance requirements while avoiding the overhead of running and trusting a separate managed AD, creating IAM users, or deploying an unnecessary federation service.
Question 4
A company has an application that runs on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2 instances. The application has a UI that uses Amazon DynamoDB and data services that use Amazon S3 as part of the application deployment.
The company must ensure that the EKS Pods for the UI can access only Amazon DynamoDB and that the EKS Pods for the data services can access only Amazon S3. The company uses AWS Identity and Access Management (IAM).
Which solution meals these requirements?
A. Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions. Attach both IAM policies to the EC2 instance profile. Use role-based access control (RBAC) to control access to Amazon S3 or DynamoDB for the respective EKS Pods.
B. Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions. Attach the Amazon S3 IAM policy directly to the EKS Pods for the data services and the DynamoDB policy to the EKS Pods for the UI.
C. Create separate Kubernetes service accounts for the UI and data services to assume an IAM role. Attach the AmazonS3FullAccess policy to the data services account and the AmazonDynamoDBFullAccess policy to the UI service account.
D. Create separate Kubernetes service accounts for the UI and data services to assume an IAM role. Use IAM Role for Service Accounts (IRSA) to provide access to the EKS Pods for the UI to Amazon S3 and the EKS Pods for the data services to DynamoDB.
Show Answer
Correct Answer: C
Explanation: The requirement is to restrict AWS service access at the pod level so that UI pods can access only DynamoDB and data service pods can access only S3. This is achieved by creating separate Kubernetes service accounts that assume separate IAM roles, each with the appropriate IAM policy attached. Option C correctly does this by assigning a DynamoDB policy to the UI service account and an S3 policy to the data services account using IAM Roles for Service Accounts (IRSA). Option A grants both permissions to all pods via the EC2 instance role, B is not supported, and D assigns the permissions to the wrong pod types.
Question 5
A company runs an application in a private subnet behind an Application Load Balancer (ALB) in a VPC. The VPC has a NAT gateway and an internet gateway. The application calls the Amazon S3 API to store objects.
According to the company's security policy, traffic from the application must not travel across the internet.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an S3 interface endpoint. Create a security group that allows outbound traffic to Amazon S3.
B. Configure an S3 gateway endpoint. Update the VPC route table to use the endpoint.
C. Configure an S3 bucket policy to allow traffic from the Elastic IP address that is assigned to the NAT gateway.
D. Create a second NAT gateway in the same subnet where the legacy application is deployed. Update the VPC route table to use the second NAT gateway.
Show Answer
Correct Answer: B
Explanation: An Amazon S3 gateway VPC endpoint allows private subnet resources to access S3 without traversing the public internet or using a NAT gateway. Traffic stays on the AWS backbone, meeting the security requirement. Gateway endpoints for S3 are free (no hourly or per-GB charges), making this the most cost-effective option compared to interface endpoints or NAT-based solutions.
Question 6
A company's image-hosting website gives users around the world the ability to up load, view, and download images from their mobile devices. The company currently hosts the static website in an Amazon S3 bucket.
Because of the website's growing popularity, the website's performance has decreased. Users have reported latency issues when they upload and download images.
The company must improve the performance of the website.
Which solution will meet these requirements with the LEAST implementation effort?
A. Configure an Amazon CloudFront distribution for the S3 bucket to improve the download performance. Enable S3 Transfer Acceleration to improve the upload performance.
B. Configure Amazon EC2 instances of the right sizes in multiple AWS Regions. Migrate the application to the EC2 instances. Use an Application Load Balancer to distribute the website traffic equally among the EC2 instances. Configure AWS Global Accelerator to address global demand with low latency.
C. Configure an Amazon CloudFront distribution that uses the S3 bucket as an origin to improve the download performance. Configure the application to use CloudFront to upload images to improve the upload performance. Create S3 buckets in multiple AWS Regions. Configure replication rules for the buckets to replicate users' data based on the users' location. Redirect downloads to the S3 bucket that is closest to each user's location.
D. Configure AWS Global Accelerator for the S3 bucket to improve network performance. Create an endpoint for the application to use Global Accelerator instead of the S3 bucket.
Show Answer
Correct Answer: A
Explanation: Amazon CloudFront in front of the S3 bucket caches and serves images from edge locations, significantly reducing download latency for global users. Enabling S3 Transfer Acceleration leverages the same edge network to optimize upload paths into S3, improving upload performance. This solution directly addresses both upload and download latency with minimal architectural change and the least implementation effort compared to multi-Region replication, EC2 migrations, or Global Accelerator setups.
Question 7
A digital image processing company wants to migrate its on-premises monolithic application to the AWS Cloud. The company processes thousands of images and generates large files as part of the processing workflow.
The company needs a solution to manage the growing number of image processing jobs. The solution must also reduce the manual tasks in the image processing workflow. The company does not want to manage the underlying infrastructure of the solution.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 Spot Instances to process the images. Configure Amazon Simple Queue Service (Amazon SQS) to orchestrate the workflow. Store the processed files in Amazon Elastic File System (Amazon EFS).
B. Use AWS Batch jobs to process the images. Use AWS Step Functions to orchestrate the workflow. Store the processed files in an Amazon S3 bucket.
C. Use AWS Lambda functions and Amazon EC2 Spot Instances to process the images. Store the processed files in Amazon FSx.
D. Deploy a group of Amazon EC2 instances to process the images. Use AWS Step Functions to orchestrate the workflow. Store the processed files in an Amazon Elastic Block Store (Amazon EBS) volume.
Show Answer
Correct Answer: B
Explanation: AWS Batch is a fully managed service designed for large-scale batch processing, such as image processing jobs, and automatically handles provisioning, scaling, and scheduling without requiring infrastructure management. AWS Step Functions provides serverless workflow orchestration with built-in retries and error handling, reducing manual operational tasks. Storing large processed files in Amazon S3 is highly scalable, durable, and cost-effective. Together, these services meet the requirements with the least operational overhead compared to solutions that require managing EC2 instances or container infrastructure.
Question 8
A company's production environment consists of Amazon EC2 On-Demand Instances that run constantly between Monday and Saturday. The instances must run for only 12 hours on Sunday and cannot tolerate interruptions. The company wants to cost-optimize the production environment.
Which solution will meet these requirements MOST cost-effectively?
A. Purchase Scheduled Reserved Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.
B. Purchase Convertible Reserved Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.
C. Use Spot Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.
D. Use Spot Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Convertible Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.
Show Answer
Correct Answer: A
Explanation: Spot Instances are not allowed because the workload cannot tolerate interruptions, eliminating C and D. For the always-on workload from Monday to Saturday, Standard Reserved Instances provide the highest discount at lowest cost. For the predictable, recurring 12-hour Sunday workload, Scheduled Reserved Instances are designed specifically for fixed schedules and are more cost-effective than Convertible RIs, which trade savings for flexibility that is not required here.
Question 9
A company has a three-tier web application that processes orders from customers. The web tier consists of Amazon EC2 instances behind an Application Load Balancer. The processing tier consists of EC2 instances. The company decoupled the web tier and processing tier by using Amazon Simple Queue Service (Amazon SQS). The storage layer uses Amazon DynamoDB.
At peak times, some users report order processing delays and halls. The company has noticed that during these delays, the EC2 instances are running at 100% CPU usage, and the SQS queue fills up. The peak times are variable and unpredictable.
The company needs to improve the performance of the application.
Which solution will meet these requirements?
A. Use scheduled scaling for Amazon EC2 Auto Scaling to scale out the processing tier instances for the duration of peak usage times. Use the CPU Utilization metric to determine when to scale.
B. Use Amazon ElastiCache for Redis in front of the DynamoDB backend tier. Use target utilization as a metric to determine when to scale.
C. Add an Amazon CloudFront distribution to cache the responses for the web tier. Use HTTP latency as a metric to determine when to scale.
D. Use an Amazon EC2 Auto Scaling target tracking policy to scale out the processing tier instances. Use the ApproximateNumberOfMessages attribute to determine when to scale.
Show Answer
Correct Answer: D
Explanation: The bottleneck is the processing tier: EC2 instances are at 100% CPU and the SQS queue backs up, indicating workers cannot keep up with incoming messages. Because peak load is variable and unpredictable, scheduled scaling is unsuitable. The correct approach is to automatically scale the processing tier based on queue depth using an EC2 Auto Scaling target tracking policy with the SQS ApproximateNumberOfMessages metric. Caching or CloudFront does not address the processing backlog.
Question 10
A company hosts an application in a private subnet. The company has already integrated the application with Amazon Cognito. The company uses an Amazon Cognito user pool to authenticate users.
The company needs to modify the application so the application can securely store user documents in an Amazon S3 bucket.
Which combination of steps will securely integrate Amazon S3 with the application? (Choose two.)
A. Create an Amazon Cognito identity pool to generate secure Amazon S3 access tokens for users when they successfully log in.
B. Use the existing Amazon Cognito user pool to generate Amazon S3 access tokens for users when they successfully log in.
C. Create an Amazon S3 VPC endpoint in the same VPC where the company hosts the application.
D. Create a NAT gateway in the VPC where the company hosts the application. Assign a policy to the S3 bucket to deny any request that is not initiated from Amazon Cognito.
E. Attach a policy to the S3 bucket that allows access only from the users' IP addresses.
Show Answer
Correct Answer: A, C
Explanation: Amazon Cognito user pools handle authentication only, while identity pools are required to obtain temporary AWS credentials that authorize access to AWS services such as Amazon S3. Creating an identity pool allows the application to grant users scoped, temporary S3 access after login. Because the application runs in a private subnet, creating an S3 VPC endpoint enables private, secure connectivity to S3 without traversing the public internet or requiring a NAT gateway.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.