Certbie

Free practice · No sign-up required

Amazon SAA-C03 AWS Certified Solutions Architect – Associate (SAA–C03) free practice test

30 questions with answer explanations. Choose an answer below to begin.

Question 1 of 30

A company is planning to deploy a multi-tier web application on AWS consisting of frontend and backend components. They want to ensure that the frontend servers are only accessible from the internet while the backend servers are accessible only from the frontend servers. Which AWS service should they use to achieve this network architecture?

0/30 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.

Learn by doing

Put your answers into practice

Use official documentation and hands-on labs to work through topics you missed.

Explore all study resources →
AWS Serverless Patterns

AWS sample integrations for learning how serverless services work together. Useful supporting practice for architecture and developer study.

Try it: Choose a two-service pattern. Sketch its event path, identify the execution role, and explain what should happen if processing fails. Deploy only after reviewing its prerequisites and cleanup steps.

Code is free to read. Deploying AWS resources can incur charges.

AWS certification and exam guides

Find the certification owner's exam pages and preparation resources before choosing topics to study.

Try it: Open your target certification and its exam guide. Mark each objective as explain, practice, or revisit; map your next missed question to one of those objectives.

Public exam information is free. Training, exams, and lab access may have separate charges.

All questions and explanations

Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.

  1. Question 1

    Link to question

    A company is planning to deploy a multi-tier web application on AWS consisting of frontend and backend components. They want to ensure that the frontend servers are only accessible from the internet while the backend servers are accessible only from the frontend servers. Which AWS service should they use to achieve this network architecture?

    1. Amazon VPC

    2. Amazon Route 53

    3. Amazon CloudFront

    4. Amazon API Gateway

    Show answer and explanation

    Correct answer

    • Amazon VPC

    Amazon Virtual Private Cloud (VPC) allows companies to create a logically isolated section of the AWS Cloud where they can launch AWS resources in a virtual network. By setting up multiple subnets within the VPC and configuring security groups and network ACLs, the company can ensure that frontend servers are placed in a public subnet accessible from the internet, while backend servers are placed in a private subnet accessible only from the frontend servers.

  2. Question 2

    Link to question

    A company wants to enhance the security of their AWS environment by enforcing multi-factor authentication (MFA) for IAM users accessing the AWS Management Console. Which AWS service should they use to enable MFA for IAM users?

    1. Amazon GuardDuty

    2. AWS IAM (Identity and Access Management)

    3. AWS Directory Service

    4. AWS Shield

    Show answer and explanation

    Correct answer

    • AWS IAM (Identity and Access Management)

    AWS Identity and Access Management (IAM) allows companies to manage access to AWS services and resources securely. By enabling MFA for IAM users, the company can add an extra layer of protection to their AWS accounts and enforce additional authentication factors, such as hardware tokens or mobile apps, for accessing the AWS Management Console. This helps reduce the risk of unauthorized access to sensitive resources.

  3. Question 3

    Link to question

    A company is planning to migrate their existing web application to AWS and wants to ensure high availability and fault tolerance. They want a service that automatically distributes incoming traffic across multiple EC2 instances and performs health checks to route traffic only to healthy instances. Which AWS service should they use to achieve this requirement?

    1. Amazon EC2 Auto Scaling

    2. Amazon CloudFront

    3. Elastic Load Balancing (ELB)

    4. AWS Lambda

    Show answer and explanation

    Correct answer

    • Elastic Load Balancing (ELB)

    Elastic Load Balancing (ELB) is a service provided by AWS that automatically distributes incoming application traffic across multiple targets, such as EC2 instances, to ensure high availability and fault tolerance. ELB performs health checks on the registered instances and only routes traffic to healthy instances, thereby improving the overall reliability and availability of the web application.

  4. Question 4

    Link to question

    A company wants to monitor the performance of their AWS resources and set up alarms to notify their operations team of any performance anomalies. Which AWS service should they use to achieve this requirement?

    1. AWS CloudTrail

    2. Amazon CloudWatch

    3. AWS Config

    4. AWS X-Ray

    Show answer and explanation

    Correct answer

    • Amazon CloudWatch

    Amazon CloudWatch is a monitoring and observability service provided by AWS. It allows companies to collect and track metrics, create alarms, and visualize logs and metrics in real-time. With CloudWatch, the company can monitor the performance of their AWS resources and set up alarms to notify their operations team of any performance anomalies, ensuring proactive management of their environment.

  5. Question 5

    Link to question

    A company wants to encrypt data stored in Amazon S3 buckets using encryption keys managed by AWS. Which AWS service should they use to achieve this requirement?

    1. AWS KMS (Key Management Service)

    2. AWS IAM (Identity and Access Management)

    3. AWS Shield

    4. Amazon VPC (Virtual Private Cloud)

    Show answer and explanation

    Correct answer

    • AWS KMS (Key Management Service)

    AWS Key Management Service (KMS) is a managed service provided by AWS that allows companies to create and control encryption keys used to encrypt data stored in various AWS services, including Amazon S3. By using AWS KMS, the company can encrypt data stored in S3 buckets using encryption keys managed by AWS, ensuring data security and compliance with encryption best practices.

  6. Question 6

    Link to question

    A company wants to set up a scalable file storage solution for their AWS environment that can be shared across multiple EC2 instances. They require a fully managed service that can automatically scale storage capacity and throughput as needed. Which AWS service should they use to achieve this requirement?

    1. Amazon S3

    2. Amazon EBS (Elastic Block Store)

    3. Amazon EFS (Elastic File System)

    4. Amazon Glacier

    Show answer and explanation

    Correct answer

    • Amazon EFS (Elastic File System)

    Amazon Elastic File System (EFS) is a fully managed, scalable file storage service provided by AWS. It allows companies to create scalable file systems that can be shared across multiple EC2 instances, providing scalable storage capacity and throughput without the need for provisioning or managing infrastructure. By using Amazon EFS, the company can set up a scalable file storage solution for their AWS environment, ensuring flexibility and ease of use.

  7. Question 7

    Link to question

    A company wants to set up a highly available and scalable architecture for their web application, which consists of multiple microservices running in containers. They need a service that can manage container orchestration, automatically scale containers based on demand, and distribute incoming traffic across containers. Which AWS service should they use for this purpose?

    1. Amazon ECS (Elastic Container Service)

    2. AWS Fargate

    3. Amazon EKS (Elastic Kubernetes Service)

    4. AWS Lambda

    Show answer and explanation

    Correct answer

    • Amazon ECS (Elastic Container Service)

    Amazon ECS is a fully managed container orchestration service provided by AWS. It allows companies to run, manage, and scale containerized applications using Docker containers. ECS supports automatic scaling of containers based on CPU and memory utilization, as well as integration with Elastic Load Balancing (ELB) for distributing incoming traffic across containers. Therefore, Amazon ECS is the appropriate service for managing the highly available and scalable architecture described.

  8. Question 8

    Link to question

    A company wants to run serverless functions in response to events triggered by changes in their AWS environment. They need a service that can automatically scale resources based on the number of incoming requests and execute functions in a stateless manner. Which AWS service should they use for this requirement?

    1. Amazon EC2

    2. AWS Lambda

    3. Amazon SNS (Simple Notification Service)

    4. Amazon SQS (Simple Queue Service)

    Show answer and explanation

    Correct answer

    • AWS Lambda

    AWS Lambda is a serverless computing service provided by AWS. It allows companies to run code in response to events triggered by changes in their AWS environment, such as changes to data in Amazon S3 or updates to Amazon DynamoDB tables. Lambda automatically scales resources based on the number of incoming requests and executes functions in a stateless manner, making it suitable for running serverless functions in response to events.

  9. Question 9

    Link to question

    A company wants to ensure that all data stored in their Amazon S3 buckets is encrypted at rest using encryption keys managed by AWS. Which AWS service should they use to achieve this requirement?

    1. AWS KMS (Key Management Service)

    2. AWS IAM (Identity and Access Management)

    3. Amazon Macie

    4. Amazon GuardDuty

    Show answer and explanation

    Correct answer

    • AWS KMS (Key Management Service)

    AWS Key Management Service (KMS) is a managed service provided by AWS that allows companies to create and control encryption keys used to encrypt data at rest in various AWS services, including Amazon S3. By using AWS KMS, the company can ensure that all data stored in their S3 buckets is encrypted at rest using encryption keys managed by AWS, thereby enhancing data security and compliance with encryption best practices.

  10. Question 10

    Link to question

    A company needs to store large volumes of data for long-term archival purposes. They want a cost-effective storage solution that provides durable, secure, and scalable storage with retrieval times ranging from minutes to hours. Which AWS service should they use to achieve this requirement?

    1. Amazon S3

    2. Amazon Glacier

    3. Amazon EFS (Elastic File System)

    4. Amazon EBS (Elastic Block Store)

    Show answer and explanation

    Correct answer

    • Amazon Glacier

    Amazon Glacier is a secure, durable, and cost-effective storage service designed for long-term data archival and backup. It offers extremely low-cost storage options suitable for storing data that is rarely accessed but needs to be retained for compliance or regulatory requirements. Glacier provides retrieval times ranging from minutes to hours, making it suitable for long-term archival purposes with occasional access requirements.

  11. Question 11

    Link to question

    A company wants to establish a private network connection between their on-premises data center and their Amazon VPC to access AWS resources securely. They require a dedicated network connection with consistent network performance and reduced latency. Which AWS service should they use to achieve this requirement?

    1. Amazon VPC Peering

    2. AWS Direct Connect

    3. AWS VPN (Virtual Private Network)

    4. Amazon Route 53

    Show answer and explanation

    Correct answer

    • AWS Direct Connect

    AWS Direct Connect is a dedicated network connection service provided by AWS that allows companies to establish private connectivity between their on-premises data center and their Amazon VPC. It provides consistent network performance, reduced latency, and increased security compared to VPN connections over the public internet. With AWS Direct Connect, companies can achieve secure and reliable connectivity for their hybrid cloud environments.

  12. Question 12

    Link to question

    A company is deploying a web application that requires serverless computing capabilities and event-driven architecture. They need a service that can automatically execute code in response to events triggered by changes in their AWS environment. Which AWS service should they use to achieve this requirement?

    1. Amazon EC2

    2. AWS Lambda

    3. Amazon ECS (Elastic Container Service)

    4. AWS Fargate

    Show answer and explanation

    Correct answer

    • AWS Lambda

    AWS Lambda is a serverless computing service provided by AWS that allows companies to run code in response to events triggered by changes in their AWS environment. It automatically scales resources based on the number of incoming requests and executes code in a stateless manner, making it suitable for event-driven architectures and serverless computing scenarios. With AWS Lambda, companies can build scalable and cost-effective web applications without managing servers or infrastructure.

  13. Question 13

    Link to question

    A company wants to enhance the security of their AWS environment by implementing fine-grained access control for their resources. They require a service that allows them to define and enforce access policies based on attributes such as IP address, user identity, and resource type. Which AWS service should they use to achieve this requirement?

    1. Amazon VPC

    2. AWS IAM (Identity and Access Management)

    3. AWS WAF (Web Application Firewall)

    4. AWS Config

    Show answer and explanation

    Correct answer

    • AWS IAM (Identity and Access Management)

    AWS IAM (Identity and Access Management) is a service that enables companies to manage access to AWS services and resources securely. It allows them to define fine-grained access policies that specify who can access which resources and under what conditions. By using IAM, the company can enforce access control based on attributes such as IP address, user identity, and resource type, thereby enhancing the security of their AWS environment.

  14. Question 14

    Link to question

    A company wants to set up a secure and isolated network environment for their AWS resources, with granular control over network traffic and access between different components of their application. Which AWS service should they use to achieve this requirement?

    1. Amazon VPC

    2. AWS Direct Connect

    3. Amazon Route 53

    4. AWS VPN (Virtual Private Network)

    Show answer and explanation

    Correct answer

    • Amazon VPC

    Amazon Virtual Private Cloud (VPC) allows companies to create a logically isolated section of the AWS Cloud where they can launch AWS resources in a virtual network. It provides granular control over network traffic and access by allowing them to define subnets, route tables, and security groups. With Amazon VPC, the company can set up a secure and isolated network environment for their AWS resources, ensuring the confidentiality and integrity of their data.

  15. Question 15

    Link to question

    A company wants to deploy a highly available and fault-tolerant web application on AWS. They need a service that can automatically distribute incoming traffic across multiple EC2 instances and perform health checks to route traffic only to healthy instances. Which AWS service should they use to achieve this requirement?

    1. Amazon EC2 Auto Scaling

    2. AWS Lambda

    3. Amazon Route 53

    4. Elastic Load Balancing (ELB)

    Show answer and explanation

    Correct answer

    • Elastic Load Balancing (ELB)

    Elastic Load Balancing (ELB) is a service provided by AWS that automatically distributes incoming application traffic across multiple targets, such as EC2 instances, to ensure high availability and fault tolerance. It performs health checks on the registered instances and only routes traffic to healthy instances, thereby improving the overall reliability and availability of the web application. Therefore, Elastic Load Balancing (ELB) is the appropriate service for this requirement.

  16. Question 16

    Link to question

    A company is designing a web application that requires a database with low latency and high throughput for read-heavy workloads. They want a managed database service that automatically scales storage and compute capacity based on demand. Which AWS service should they use to achieve this requirement?

    1. Amazon RDS (Relational Database Service)

    2. Amazon DynamoDB

    3. Amazon Redshift

    4. Amazon Aurora

    Show answer and explanation

    Correct answer

    • Amazon DynamoDB

    Amazon DynamoDB is a fully managed NoSQL database service provided by AWS. It is designed for applications that require single-digit millisecond latency and can handle massive-scale workloads with low latency and high throughput. DynamoDB automatically scales storage and compute capacity to accommodate fluctuating workloads, making it suitable for read-heavy workloads in web applications.

  17. Question 17

    Link to question

    A company wants to design a highly available architecture for their AWS resources to ensure minimal downtime and uninterrupted service for their customers. They need a solution that automatically detects and recovers from infrastructure failures without manual intervention. Which AWS service should they use to achieve this requirement?

    1. Amazon EC2 Auto Scaling

    2. AWS Lambda

    3. AWS CloudWatch

    4. AWS CloudFormation

    Show answer and explanation

    Correct answer

    • Amazon EC2 Auto Scaling

    Amazon EC2 Auto Scaling is a service provided by AWS that automatically adjusts the number of EC2 instances in a fleet based on demand. It helps ensure the availability and fault tolerance of applications by automatically detecting unhealthy instances and replacing them with new ones. With EC2 Auto Scaling, companies can design highly available architectures that can handle infrastructure failures and provide uninterrupted service to their customers.

  18. Question 18

    Link to question

    A company wants to monitor the performance of their AWS resources in real-time and receive notifications when certain thresholds are exceeded. They need a service that can collect and track metrics, create alarms, and visualize performance data. Which AWS service should they use to achieve this requirement?

    1. Amazon CloudWatch

    2. AWS CloudTrail

    3. AWS Config

    4. Amazon Inspector

    Show answer and explanation

    Correct answer

    • Amazon CloudWatch

    Amazon CloudWatch is a monitoring and observability service provided by AWS. It collects and tracks metrics, creates alarms, and visualizes performance data in real-time. With CloudWatch, companies can monitor the performance of their AWS resources and set up alarms to notify them when certain thresholds are exceeded, allowing them to take proactive actions to maintain the health and performance of their applications and infrastructure.

  19. Question 19

    Link to question

    A company is planning to deploy a web application on AWS that requires a scalable and cost-effective solution for handling variable traffic patterns. They want to minimize infrastructure management overhead and only pay for the compute resources consumed by their application. Which AWS service should they use to achieve this requirement?

    1. Amazon EC2 Auto Scaling

    2. AWS Lambda

    3. Amazon ECS (Elastic Container Service)

    4. AWS Elastic Beanstalk

    Show answer and explanation

    Correct answer

    • AWS Lambda

    AWS Lambda is a serverless computing service provided by AWS. It allows companies to run code in response to events without provisioning or managing servers. Lambda automatically scales resources based on the number of incoming requests and charges only for the compute time consumed by the application, making it a cost-effective solution for handling variable traffic patterns with minimal infrastructure management overhead.

  20. Question 20

    Link to question

    A company wants to encrypt data stored in their Amazon S3 buckets using their own encryption keys and manage the lifecycle of encryption keys centrally. Which AWS service should they use to achieve this requirement?

    1. Amazon Macie

    2. AWS Key Management Service (KMS)

    3. AWS Identity and Access Management (IAM)

    4. AWS Certificate Manager (ACM)

    Show answer and explanation

    Correct answer

    • AWS Key Management Service (KMS)

    AWS Key Management Service (KMS) is a managed service provided by AWS that allows companies to create and control encryption keys used to encrypt data stored in various AWS services, including Amazon S3. By using AWS KMS, the company can import their own encryption keys or generate new ones, manage the lifecycle of encryption keys centrally, and encrypt data stored in S3 buckets using their own keys for enhanced security and compliance.

  21. Question 21

    Link to question

    A company wants to store frequently accessed data in a scalable and durable storage service provided by AWS. They require low latency and high throughput for accessing data and need the ability to archive infrequently accessed data for long-term retention. Which AWS service should they use to achieve this requirement?

    1. Amazon S3

    2. Amazon EBS (Elastic Block Store)

    3. Amazon Glacier

    4. Amazon EFS (Elastic File System)

    Show answer and explanation

    Correct answer

    • Amazon S3

    Amazon S3 (Simple Storage Service) is a highly scalable object storage service provided by AWS. It offers low latency and high throughput for accessing frequently accessed data and provides features such as lifecycle policies for automatically transitioning data to lower-cost storage tiers like Amazon Glacier for long-term retention. Therefore, Amazon S3 is the appropriate service for storing frequently accessed data with the abilit

  22. Question 22

    Link to question

    A company wants to securely connect their on-premises data center to their AWS environment over a dedicated private connection. They require consistent network performance and the ability to transfer large volumes of data between the environments. Which AWS service should they use to achieve this requirement?

    1. Amazon VPC Peering

    2. Amazon Route 53

    3. AWS Direct Connect

    4. AWS VPN (Virtual Private Network)

    Show answer and explanation

    Correct answer

    • AWS Direct Connect

    AWS Direct Connect provides a dedicated private connection between an organization\'s on-premises data center and their AWS environment. It offers consistent network performance, reduced latency, and high bandwidth for transferring large volumes of data securely. Therefore, AWS Direct Connect is the appropriate service for securely connecting on-premises data centers to AWS environments.

  23. Question 23

    Link to question

    A company wants to enforce encryption for data stored in their Amazon S3 buckets and ensure that all objects are encrypted before being written to S3. Which AWS feature should they use to achieve this requirement?

    1. Amazon S3 Object Lock

    2. Amazon S3 Bucket Policies

    3. Amazon S3 Server-Side Encryption

    4. Amazon S3 Access Points

    Show answer and explanation

    Correct answer

    • Amazon S3 Server-Side Encryption

    Amazon S3 Server-Side Encryption is a feature provided by AWS that automatically encrypts data stored in Amazon S3 buckets at the server side before storing it. It ensures that all objects stored in S3 are encrypted, regardless of how they are uploaded. By enabling server-side encryption, the company can enforce encryption for data stored in their S3 buckets, providing an additional layer of security.

  24. Question 24

    Link to question

    A company wants to gain insights into the performance and operational health of their AWS resources. They require a service that can collect and analyze logs, metrics, and events generated by their AWS infrastructure. Which AWS service should they use to achieve this requirement?

    1. Amazon CloudWatch

    2. AWS CloudTrail

    3. AWS Config

    4. AWS X-Ray

    Show answer and explanation

    Correct answer

    • Amazon CloudWatch

    Amazon CloudWatch is a monitoring and observability service provided by AWS. It allows companies to collect and track metrics, monitor log files, set alarms, and automatically react to changes in their AWS resources. CloudWatch provides insights into the operational health and performance of AWS resources, making it the appropriate service for gaining insights into the performance and operational health of AWS infrastructure.

  25. Question 25

    Link to question

    A company is planning to migrate their legacy monolithic application to AWS. They want to break down the application into smaller, independent components that can be deployed and scaled separately. Which AWS service should they use to containerize their application components and manage container orchestration?

    1. Amazon ECS (Elastic Container Service)

    2. AWS Fargate

    3. Amazon EKS (Elastic Kubernetes Service)

    4. AWS Lambda

    Show answer and explanation

    Correct answer

    • Amazon EKS (Elastic Kubernetes Service)

    Amazon EKS (Elastic Kubernetes Service) is a fully managed Kubernetes service provided by AWS. It allows companies to run containerized applications using Kubernetes, an open-source container orchestration platform. With EKS, companies can easily deploy, manage, and scale containerized applications, making it suitable for breaking down monolithic applications into smaller, independent components.

  26. Question 26

    Link to question

    A company wants to set up a highly available and scalable relational database solution on AWS for their e-commerce platform. They require automatic failover, read replicas for read scalability, and backup and restore capabilities. Which AWS service should they use to achieve this requirement?

    1. Amazon RDS (Relational Database Service)

    2. Amazon DynamoDB

    3. Amazon Redshift

    4. Amazon Aurora

    Show answer and explanation

    Correct answer

    • Amazon RDS (Relational Database Service)

    Amazon RDS (Relational Database Service) is a managed relational database service provided by AWS. It supports various database engines such as MySQL, PostgreSQL, and SQL Server, offering features such as automatic failover, read replicas, and backup and restore capabilities. By using Amazon RDS, companies can set up a highly available and scalable relational database solution for their e-commerce platform.

  27. Question 27

    Link to question

    A company wants to secure their AWS environment by implementing centralized identity and access management. They want a service that allows them to manage users, groups, and permissions centrally and integrate with their existing identity systems. Which AWS service should they use to achieve this requirement?

    1. Amazon Cognito

    2. AWS IAM (Identity and Access Management)

    3. AWS Single Sign-On (SSO)

    4. AWS Directory Service

    Show answer and explanation

    Correct answer

    • AWS IAM (Identity and Access Management)

    AWS IAM (Identity and Access Management) is a service provided by AWS that allows companies to manage users, groups, and permissions centrally for accessing AWS resources. It enables centralized identity and access management and supports integration with existing identity systems such as Active Directory. By using AWS IAM, companies can secure their AWS environment and enforce least privilege access controls effectively.

  28. Question 28

    Link to question

    A company is designing a multi-tier architecture for their application on AWS. They want to ensure secure communication between different tiers while allowing only specific types of traffic. Which AWS service should they use to set up and manage network access control for their architecture?

    1. Amazon Route 53

    2. Amazon VPC (Virtual Private Cloud)

    3. AWS WAF (Web Application Firewall)

    4. AWS Shield

    Show answer and explanation

    Correct answer

    • Amazon VPC (Virtual Private Cloud)

    Amazon VPC allows companies to create a virtual network in the AWS Cloud, providing them with complete control over their network environment, including IP addressing, subnets, route tables, and security groups. By using Amazon VPC, the company can set up and manage network access control for their multi-tier architecture, ensuring secure communication between different tiers and allowing only specific types of traffic as per their requirements.

  29. Question 29

    Link to question

    A company wants to migrate their on-premises file storage to AWS and requires a fully managed file storage service that can be accessed by multiple EC2 instances concurrently. They need the ability to dynamically adjust storage capacity and performance based on demand. Which AWS service should they use to achieve this requirement?

    1. Amazon S3 (Simple Storage Service)

    2. Amazon EBS (Elastic Block Store)

    3. Amazon EFS (Elastic File System)

    4. Amazon Glacier

    Show answer and explanation

    Correct answer

    • Amazon EFS (Elastic File System)

    Amazon EFS is a fully managed file storage service provided by AWS that can be accessed by multiple EC2 instances concurrently. It automatically scales storage capacity and performance based on demand, allowing companies to dynamically adjust resources as needed. By using Amazon EFS, the company can migrate their on-premises file storage to AWS and benefit from a fully managed, scalable file storage solution.

  30. Question 30

    Link to question

    A company wants to track changes to their AWS resources over time, identify any unauthorized changes, and maintain a complete audit trail for compliance purposes. Which AWS service should they use to achieve this requirement?

    1. Amazon CloudWatch

    2. AWS Config

    3. AWS CloudTrail

    4. AWS X-Ray

    Show answer and explanation

    Correct answer

    • AWS CloudTrail

    AWS CloudTrail is a service that enables companies to monitor and log AWS API activity for their AWS account. It provides a complete audit trail of API calls made to AWS resources, including details such as the identity of the caller, the time of the call, and the actions performed. By using AWS CloudTrail, the company can track changes to their AWS resources over time, identify any unauthorized changes, and maintain a complete audit trail for compliance purposes.

Read all flashcards

Recall the answer before opening each card.

What AWS service provides a logically isolated virtual network?

Amazon VPC allows creating a virtual network with subnets, security groups, route tables, and network ACLs to isolate AWS resources.

Which AWS service enforces multi-factor authentication for IAM users?

AWS IAM (Identity and Access Management) enables MFA for console and API access, adding a second authentication factor.

Which service automatically distributes traffic across healthy EC2 instances?

Elastic Load Balancing (ELB) performs health checks and routes traffic only to healthy targets, improving availability.

What AWS service monitors metrics and sets alarms for performance anomalies?

Amazon CloudWatch collects metrics, creates alarms, and visualizes performance data in real-time for proactive management.

Which service manages encryption keys for S3 data at rest?

AWS Key Management Service (KMS) creates and controls encryption keys used to encrypt data in S3 and other AWS services.

What fully managed file system can be shared across multiple EC2 instances?

Amazon EFS (Elastic File System) is a scalable NFS file system that automatically adjusts capacity and throughput.

Which container orchestration service supports Docker containers and integrates with ELB?

Amazon ECS (Elastic Container Service) manages containerized applications with automatic scaling and load balancing.

What serverless service runs code in response to events and scales automatically?

AWS Lambda executes code in a stateless manner, charging only for compute time and scaling with request volume.

Which low-cost storage service is designed for long-term archival with retrieval times of minutes to hours?

Amazon Glacier provides durable, secure storage for rarely accessed data at very low cost.

What dedicated network connection provides consistent performance between on-premises and AWS?

AWS Direct Connect is a private connection offering lower latency and higher bandwidth than VPN.

Which NoSQL database offers single-digit millisecond latency and auto-scales for read-heavy workloads?

Amazon DynamoDB is a fully managed key-value and document database designed for high throughput and low latency.

Which service automatically replaces unhealthy EC2 instances to maintain availability?

Amazon EC2 Auto Scaling automatically adjusts instance count and replaces unhealthy instances to ensure fault tolerance.

What feature automatically encrypts data before writing to S3 using AWS-managed keys?

Amazon S3 Server-Side Encryption (SSE-S3) encrypts data at rest without requiring key management.

Which managed Kubernetes service simplifies container orchestration on AWS?

Amazon EKS (Elastic Kubernetes Service) provides a fully managed Kubernetes control plane for running containerized applications.

Which relational database service supports automatic failover and read replicas?

Amazon RDS (Relational Database Service) offers Multi-AZ failover and read replicas for scalability and high availability.

What AWS service provides a centralized audit trail of API calls?

AWS CloudTrail logs all API activity, including caller identity and time, for compliance and security analysis.

Which service allows fine-grained access control based on IP address and resource type?

AWS IAM (Identity and Access Management) defines policies that specify conditions like IP address and resource type.

What is the primary benefit of using Elastic Load Balancing with Auto Scaling?

ELB distributes traffic across a dynamic fleet of instances managed by Auto Scaling, ensuring high availability and fault tolerance.

When migrating a monolithic app to microservices, which AWS service helps containerize and orchestrate?

Amazon EKS (Elastic Kubernetes Service) provides Kubernetes orchestration for deploying and scaling containerized microservices.

Which storage service offers scalable object storage with lifecycle policies for archival?

Amazon S3 provides low-latency access for frequent data and can transition objects to Glacier for cost savings.

Active recall deck

Practice Amazon SAA-C03 AWS Certified Solutions Architect – Associate (SAA–C03) with real flashcards

Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.

20 free cards

Card 1 of 20

1 reviewed this session

Connect the concepts

Your Amazon SAA-C03 AWS Certified Solutions Architect – Associate (SAA–C03) study mind map

Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.

Amazon SAA-C03 AWS Certified Solutions Architect – Associate (SAA–C03)30 questions in this practice set
Practice focus 1(1)
Practice focus 2(1)
Practice focus 3(1)
Practice focus 4(1)
Practice focus 5(1)
Practice focus 6(1)
Practice focus 7(1)
Practice focus 8(1)
Practice focus 9(1)
Practice focus 10(1)
Practice focus 11(1)
Practice focus 12(1)
More practice connections(18)
Exam-focused analysis

What this SAA-C03 practice set measures

This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.

Core Networking and Isolation

The practice bank emphasizes designing secure network architectures using Amazon VPC. Questions test the ability to create public and private subnets, control traffic with security groups and network ACLs, and establish dedicated connectivity via AWS Direct Connect. Understanding VPC is fundamental for isolating frontend from backend tiers and ensuring secure communication.

  • Use VPC to create logically isolated sections of the AWS Cloud.
  • Place frontend servers in public subnets and backend servers in private subnets.
  • AWS Direct Connect provides dedicated private connection for consistent performance.

Identity, Security, and Encryption

Multiple questions cover identity and access management with AWS IAM and data encryption using AWS KMS and S3 server-side encryption. IAM enables fine-grained access control based on user attributes, while KMS provides centralized key management for encrypting data at rest. Enforcement of MFA and encryption policies is a recurring theme.

  • IAM centrally manages users, groups, permissions, and supports MFA for console access.
  • KMS creates and controls encryption keys for S3 and other AWS services.
  • S3 server-side encryption automatically encrypts data before writing to buckets.

Compute, Containers, and Serverless

The practice bank contrasts compute options: EC2 Auto Scaling for high availability, Amazon ECS/EKS for container orchestration, and AWS Lambda for event-driven serverless functions. Decisions depend on scalability, management overhead, and cost models. Load balancing via ELB complements these services to distribute traffic.

  • EC2 Auto Scaling automatically adjusts instance count for fault tolerance.
  • Amazon ECS/EKS manage containerized applications; EKS uses Kubernetes.
  • AWS Lambda runs code in response to events, scaling automatically and charging per execution.

Storage, Databases, and Monitoring

Questions explore storage solutions (S3 for object, EFS for shared file, Glacier for archival) and databases (DynamoDB for NoSQL, RDS for relational). Monitoring and logging are covered by CloudWatch and CloudTrail for metrics, alarms, and audit trails. Choosing based on access patterns, latency, and durability is key.

  • S3 provides scalable object storage with low latency; use lifecycle policies for archival.
  • EFS offers fully managed shared file storage that scales automatically.
  • DynamoDB suits read-heavy NoSQL workloads; RDS provides managed relational databases with read replicas.
  • CloudWatch monitors metrics and logs; CloudTrail tracks API activity for auditing.

Study workflow

Turn one SAA-C03 attempt into a study plan

  1. 1

    Identify Network Architecture Requirements

    Determine which components need internet access and which must be isolated. Plan subnetting (public/private) in a VPC, define route tables, and set up security groups or network ACLs for traffic control. Consider dedicated connectivity if needed.

  2. 2

    Choose Appropriate Storage Class

    Assess data access frequency, required latency, and retention policies. Use S3 with lifecycle transitions for cost-effective storage, Glacier for archival, and EFS for shared file systems across EC2 instances. Enable encryption via KMS or server-side encryption for security.

  3. 3

    Select Compute Model

    Evaluate workload characteristics: use EC2 Auto Scaling for predictable, stateful applications; ECS/EKS for containerized microservices; Lambda for event-driven, stateless functions. Integrate with ELB for traffic distribution and health checks.

  4. 4

    Design for High Availability

    Deploy resources across multiple Availability Zones. Use ELB to route traffic to healthy instances and Auto Scaling to replace failed ones. For databases, enable Multi-AZ for automatic failover and read replicas for read scalability.

  5. 5

    Implement Security Controls

    Enforce least privilege with IAM policies and roles. Enable MFA for sensitive actions. Encrypt data at rest with KMS and in transit using TLS. Use CloudTrail for audit logging and CloudWatch alarms for anomaly detection.

FAQ

Questions about this SAA-C03 practice page

Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.

What is the difference between EBS and EFS for shared storage?+

EBS provides block storage volumes attached to a single EC2 instance, ideal for databases. EFS is a fully managed NFS file system that can be mounted by multiple EC2 instances concurrently, automatically scaling capacity and throughput. Choose EFS for shared file access across instances.

When should I use AWS Lambda vs Amazon ECS for a web application?+

Use Lambda for short-running, event-driven functions that scale automatically and charge per invocation. Use ECS for longer-running containerized applications requiring more control over the runtime environment, networking, and task definitions. Lambda is simpler but limited to 15-minute execution.

How can I ensure my S3 data is encrypted at rest?+

Enable S3 Server-Side Encryption (SSE-S3) using AWS-managed keys, SSE-KMS with AWS KMS-managed keys, or SSE-C with your own keys. For compliance, enforce encryption via bucket policies that deny writes without encryption headers.

What does Amazon CloudWatch do beyond basic monitoring?+

CloudWatch collects metrics, logs, and events from AWS resources. It can trigger alarms, invoke Lambda functions, or auto-scale. CloudWatch Logs Insights allows querying log data. It also provides dashboards and anomaly detection for proactive management.

Why would I use Direct Connect instead of a VPN to connect to AWS?+

AWS Direct Connect provides a dedicated private network connection, offering consistent performance, lower latency, and higher bandwidth compared to VPN over the internet. It is ideal for large data transfers, real-time applications, and hybrid cloud architectures.

Keep studying

Build the next review session

Browse another free bank or use the study strategy guide to turn your misses into spaced review.

All free testsStudy strategy