This is the free Amazon SAA-C03 practice question bank —
510 of 1004 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-04.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A company uses GPS trackers to document the migration patterns of thousands of sea turtles. The trackers check every 5 minutes to see if a turtle has moved more than 100 yards (91.4 meters). If a turtle has moved, its tracker sends the new coordinates to a web application running on three Amazon EC2 instances that are in multiple Availability Zones in one AWS Region.
Recently, the web application was overwhelmed while processing an unexpected volume of tracker data. Data was lost with no way to replay the events. A solutions architect must prevent this problem from happening again and needs a solution with the least operational overhead.
What should the solutions architect do to meet these requirements?
A. Create an Amazon S3 bucket to store the data. Configure the application to scan for new data in the bucket for processing.
B. Create an Amazon API Gateway endpoint to handle transmitted location coordinates. Use an AWS Lambda function to process each item concurrently.
C. Create an Amazon Simple Queue Service (Amazon SQS) queue to store the incoming data. Configure the application to poll for new messages for processing.
D. Create an Amazon DynamoDB table to store transmitted location coordinates. Configure the application to query the table for new data for processing. Use TTL to remove data that has been processed.
Show Answer
Correct Answer: C
Explanation: Amazon SQS is the best fit because it buffers incoming tracker events, decouples producers from consumers, and allows the EC2 application to process messages at its own rate. Messages are durably retained until processed, preventing data loss during traffic spikes and allowing replay by consuming queued messages. This is a fully managed service with minimal operational overhead. S3 is not a queue and polling buckets is inefficient for this use case. API Gateway with Lambda changes the architecture but does not inherently provide durable buffering against downstream overload unless combined with a queue. DynamoDB is a database, not an event buffer, and querying for new items is not an appropriate ingestion pattern.
Question 1
A company has an application that is running on Amazon EC2 instances. A solutions architect has standardized the company on a particular instance family and various instance sizes based on the current needs of the company.
The company wants to maximize cost savings for the application over the next 3 years. The company needs to be able to change the instance family and sizes in the next 6 months based on application popularity and usage.
Which solution will meet these requirements MOST cost-effectively?
A. Compute Savings Plan
B. EC2 Instance Savings Plan
C. Zonal Reserved Instances
D. Standard Reserved Instances
Show Answer
Correct Answer: A
Explanation: Compute Savings Plans provide flexibility across EC2 instance families, sizes, Regions, operating systems, and tenancy while offering significant discounts over a 1- or 3-year commitment. EC2 Instance Savings Plans are limited to a specific instance family, so they do not meet the requirement to change instance families. Standard and Zonal Reserved Instances are even more restrictive.
Question 2
A company is developing an application in the AWS Cloud. The application's HTTP API contains critical information that is published in Amazon API Gateway. The critical information must be accessible from only a limited set of trusted IP addresses that belong to the company's internal network.
Which solution will meet these requirements?
A. Set up an API Gateway private integration to restrict access to a predefined set of IP addresses.
B. Create a resource policy for the API that denies access to any IP address that is not specifically allowed.
C. Directly deploy the API in a private subnet. Create a network ACL. Set up rules to allow the traffic from specific IP addresses.
D. Modify the security group that is attached to API Gateway to allow inbound traffic from only the trusted IP addresses.
Show Answer
Correct Answer: B
Explanation: API Gateway access can be restricted by attaching a resource policy that explicitly allows or denies requests based on source IP address (aws:SourceIp). API Gateway is a managed service and you do not attach security groups to a public/regional API Gateway endpoint. Private integration is for connecting API Gateway to private backend resources, not for client IP filtering. Deploying an API into a private subnet is not how API Gateway is exposed.
Question 2
A company is preparing a new data platform that will ingest real-time streaming data from multiple sources. The company needs to transform the data before writing the data to Amazon S3. The company needs the ability to use SQL to query the transformed data.
Which solutions will meet these requirements? (Choose two.)
A. Use Amazon Kinesis Data Streams to stream the data. Use Amazon Kinesis Data Analytics to transform the data. Use Amazon Kinesis Data Firehose to write the data to Amazon S3. Use Amazon Athena to query the transformed data from Amazon S3.
B. Use Amazon Managed Streaming for Apache Kafka (Amazon MSK) to stream the data. Use AWS Glue to transform the data and to write the data to Amazon S3. Use Amazon Athena to query the transformed data from Amazon S3.
C. Use AWS Database Migration Service (AWS DMS) to ingest the data. Use Amazon EMR to transform the data and to write the data to Amazon S3. Use Amazon Athena to query the transformed data from Amazon S3.
D. Use Amazon Managed Streaming for Apache Kafka (Amazon MSK) to stream the data. Use Amazon Kinesis Data Analytics to transform the data and to write the data to Amazon S3. Use the Amazon RDS query editor to query the transformed data from Amazon S3.
E. Use Amazon Kinesis Data Streams to stream the data. Use AWS Glue to transform the data. Use Amazon Kinesis Data Firehose to write the data to Amazon S3. Use the Amazon RDS query editor to query the transformed data from Amazon S3.
Show Answer
Correct Answer: A, B
Explanation: A and B satisfy the requirements for real-time streaming ingestion, transformation before storing in Amazon S3, and SQL querying of the transformed data using Amazon Athena. In A, Kinesis Data Streams + Kinesis Data Analytics + Kinesis Data Firehose + Athena is a valid streaming analytics pipeline. In B, Amazon MSK provides streaming, AWS Glue streaming ETL can continuously transform data from MSK and write to S3, and Athena queries the data in S3. C uses AWS DMS, which is not the appropriate streaming ingestion service for this use case. D and E incorrectly use the Amazon RDS query editor to query data stored in S3; Athena is the appropriate SQL query service for S3.
Question 3
A company needs to give a globally distributed development team secure access to the company's AWS resources in a way that complies with security policies.
The company currently uses an on-premises Active Directory for internal authentication. The company uses AWS Organizations to manage multiple AWS accounts that support multiple projects.
The company needs a solution to integrate with the existing infrastructure to provide centralized identity management and access control.
Which solution will meet these requirements with the LEAST operational overhead?
A. Set up AWS Directory Service to create an AWS managed Microsoft Active Directory on AWS. Establish a trust relationship with the on-premises Active Directory. Use IAM rotes that are assigned to Active Directory groups to access AWS resources within the company's AWS accounts.
B. Create an IAM user for each developer. Manually manage permissions for each IAM user based on each user's involvement with each project. Enforce multi-factor authentication (MFA) as an additional layer of security.
C. Use AD Connector in AWS Directory Service to connect to the on-premises Active Directory. Integrate AD Connector with AWS IAM Identity Center. Configure permissions sets to give each AD group access to specific AWS accounts and resources.
D. Use Amazon Cognito to deploy an identity federation solution. Integrate the identity federation solution with the on-premises Active Directory. Use Amazon Cognito to provide access tokens for developers to access AWS accounts and resources.
Show Answer
Correct Answer: C
Explanation: IAM Identity Center is the recommended service for centralized workforce access across AWS Organizations. Using AD Connector allows authentication against the existing on-premises Active Directory without creating a separate directory, minimizing operational overhead. Permission sets in IAM Identity Center map AD groups to AWS accounts and roles for centralized access management. AWS Managed Microsoft AD with trust (A) adds another directory to operate. IAM users (B) do not scale. Amazon Cognito (D) is intended for application end-user identities, not workforce access to AWS accounts.
Question 3
A company has one million users that use its mobile app. The company must analyze the data usage in near-real time. The company also must encrypt the data in near-real time and must store the data in a centralized location in Apache Parquet format for further processing.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an Amazon Kinesis data stream to store the data in Amazon S3. Create an Amazon Kinesis Data Analytics application to analyze the data. Invoke an AWS Lambda function to send the data to the Kinesis Data Analytics application.
B. Create an Amazon Kinesis data stream to store the data in Amazon S3. Create an Amazon EMR cluster to analyze the data. Invoke an AWS Lambda function to send the data to the EMR cluster.
C. Create an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Create an Amazon EMR cluster to analyze the data.
D. Create an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Create an Amazon Kinesis Data Analytics application to analyze the data.
Show Answer
Correct Answer: D
Explanation: Amazon Kinesis Data Firehose is a fully managed ingestion service that can deliver streaming data to Amazon S3 with server-side encryption and supports data format conversion to Apache Parquet. Amazon Kinesis Data Analytics provides near-real-time stream analytics with much lower operational overhead than managing Amazon EMR. Options using Kinesis Data Streams are incorrect as Streams does not directly store data in S3, and EMR introduces unnecessary operational management.
Question 4
An application runs on an Amazon EC2 instance that has an Elastic IP address in VPC A. The application requires access to a database in VPC B. Both VPCs are in the same AWS account.
Which solution will provide the required access MOST securely?
A. Create a DB instance security group that allows all traffic from the public IP address of the application server in VPC
B. Configure a VPC peering connection between VPC A and VPC
C. Make the DB instance publicly accessible. Assign a public IP address to the DB instance.
D. Launch an EC2 instance with an Elastic IP address into VPC B. Proxy all requests through the new EC2 instance.
Show Answer
Correct Answer: B
Explanation: A VPC peering connection enables private communication between VPC A and VPC B using private IP addresses over the AWS network. This avoids exposing the database publicly or relying on public IP connectivity. Option A depends on the application's public Elastic IP and is not the most secure approach. Option C unnecessarily exposes the database to the internet. Option D adds an unnecessary proxy instance and complexity without improving security.
Question 4
A company has an application that runs on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2 instances. The application has a UI that uses Amazon DynamoDB and data services that use Amazon S3 as part of the application deployment.
The company must ensure that the EKS Pods for the UI can access only Amazon DynamoDB and that the EKS Pods for the data services can access only Amazon S3. The company uses AWS Identity and Access Management (IAM).
Which solution meals these requirements?
A. Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions. Attach both IAM policies to the EC2 instance profile. Use role-based access control (RBAC) to control access to Amazon S3 or DynamoDB for the respective EKS Pods.
B. Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions. Attach the Amazon S3 IAM policy directly to the EKS Pods for the data services and the DynamoDB policy to the EKS Pods for the UI.
C. Create separate Kubernetes service accounts for the UI and data services to assume an IAM role. Attach the AmazonS3FullAccess policy to the data services account and the AmazonDynamoDBFullAccess policy to the UI service account.
D. Create separate Kubernetes service accounts for the UI and data services to assume an IAM role. Use IAM Role for Service Accounts (IRSA) to provide access to the EKS Pods for the UI to Amazon S3 and the EKS Pods for the data services to DynamoDB.
Show Answer
Correct Answer: C
Explanation: EKS Pods should receive AWS permissions through IAM Roles for Service Accounts (IRSA) associated with Kubernetes service accounts, not through the EC2 instance profile or by attaching IAM policies directly to Pods. Option A grants both permissions to all Pods on the node. Option B is not a valid IAM attachment model for EKS Pods. Option D describes IRSA but assigns the permissions to the wrong workloads (UI gets S3 and data services get DynamoDB), which does not meet the stated requirement. Option C is the only choice that correctly separates access by Kubernetes service account and IAM role, despite using broad managed policies rather than least-privilege custom policies.
Question 5
A company collects data from thousands of remote devices by using a RESTful web services application that runs on an Amazon EC2 instance. The EC2 instance receives the raw data, transforms the raw data, and stores all the data in an Amazon S3 bucket. The number of remote devices will increase into the millions soon. The company needs a highly scalable solution that minimizes operational overhead.
Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)
A. Use AWS Glue to process the raw data in Amazon S3.
B. Use Amazon Route 53 to route traffic to different EC2 instances.
C. Add more EC2 instances to accommodate the increasing amount of incoming data.
D. Send the raw data to Amazon Simple Queue Service (Amazon SQS). Use EC2 instances to process the data.
E. Use Amazon API Gateway to send the raw data to an Amazon Kinesis data stream. Configure Amazon Kinesis Data Firehose to use the data stream as a source to deliver the data to Amazon S3.
Show Answer
Correct Answer: A, E
Explanation: Use managed, serverless services to maximize scalability and minimize operational overhead. Amazon API Gateway provides a scalable REST endpoint, Kinesis Data Streams ingests large-scale streaming data, and Kinesis Data Firehose delivers it to Amazon S3. AWS Glue can then perform the ETL/transformation on the data stored in S3. Options B and C continue to rely on EC2 management, increasing operational overhead. Option D still requires managing EC2 workers for processing, which is less operationally efficient than a serverless pipeline.
Question 5
A company runs an application in a private subnet behind an Application Load Balancer (ALB) in a VPC. The VPC has a NAT gateway and an internet gateway. The application calls the Amazon S3 API to store objects.
According to the company's security policy, traffic from the application must not travel across the internet.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an S3 interface endpoint. Create a security group that allows outbound traffic to Amazon S3.
B. Configure an S3 gateway endpoint. Update the VPC route table to use the endpoint.
C. Configure an S3 bucket policy to allow traffic from the Elastic IP address that is assigned to the NAT gateway.
D. Create a second NAT gateway in the same subnet where the legacy application is deployed. Update the VPC route table to use the second NAT gateway.
Show Answer
Correct Answer: B
Explanation: Amazon S3 supports both gateway and interface VPC endpoints. For resources in a VPC that need private access to S3 without traversing the public internet, an S3 gateway endpoint is the most cost-effective option because it has no hourly or per-GB endpoint charges and works by updating the route tables. Interface endpoints incur PrivateLink charges. Using a NAT gateway still sends traffic through the internet gateway path and does not satisfy the requirement to avoid internet traversal.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.