AWS Solutions Architect Associate Practice Exam (SAA-C03)

What you get

• Questions mapped to all four SAA-C03 domains, from Design Secure Architectures through Cost-Optimized Architectures.
• Timed mock exams that mirror the real 130-minute, 65-question format so pacing stops being a surprise.
• Per-domain scoring after every attempt, so you revise the two domains losing you marks instead of re-reading all four.
• One subscription covers AWS, Azure and Google Cloud — useful if your next certification is on another platform.

Sample SAA-C03 questions

Four real questions from the SAA-C03 bank, written by a certified subject-matter expert, with the answer and the reasoning. This is the format and difficulty of every question inside.

1. Domain 1: Design Secure Architectures

   Q1. An application requires private connectivity between EC2 instances in a VPC and an Amazon S3 bucket, without routing traffic through the internet. Which solution meets this requirement at the LOWEST cost?

   • A Create an S3 VPC Gateway Endpoint and update the route tableCorrect
   • B Deploy a NAT Gateway in a public subnet
   • C Create an S3 VPC Interface Endpoint powered by AWS PrivateLink
   • D Configure a VPC peering connection to the S3 service VPC

   Why: Gateway endpoints for S3 and DynamoDB are free — you add a route, and traffic never leaves the AWS network. An Interface endpoint also works but bills hourly plus per-GB, and a NAT Gateway both costs more and sends traffic over the internet, which the requirement rules out.

2. Domain 1: Design Secure Architectures

   Q2. Which combination provides the MOST secure method for an EC2 instance to access other AWS services without storing credentials on the instance?

   • A Store an access key and secret key in a file with restricted permissions
   • B Assign an IAM role to the EC2 instance and use the instance profileCorrect
   • C Embed credentials in the application and encrypt the source code
   • D Pass credentials through EC2 user data at launch

   Why: An instance profile delivers temporary, automatically-rotated credentials through the instance metadata service, so there is no long-lived secret to leak, rotate or accidentally commit. Every other option puts a static key somewhere on the instance.

3. Domain 3: Design Secure Applications and Architectures

   Q3. A company needs to ensure that all data uploaded to Amazon S3 is automatically encrypted using encryption keys that they manage and control. Which S3 encryption option should they use?

   • A SSE-S3 (Amazon S3-managed keys)
   • B SSE-KMS (AWS KMS-managed keys)Correct
   • C Client-side encryption with a key stored in the application
   • D No encryption — S3 buckets are private by default

   Why: The phrase "manage and control" is the tell: SSE-KMS gives you a customer-managed key with its own policy, rotation schedule and CloudTrail audit trail. SSE-S3 encrypts just as strongly but AWS holds the key, so you control nothing about it.

4. Domain 1: Design Secure Architectures

   Q4. To protect a public-facing web application from SQL injection and cross-site scripting attacks, which AWS service should be deployed in front of an Application Load Balancer?

   • A AWS Shield Standard
   • B Amazon GuardDuty
   • C AWS WAF (Web Application Firewall)Correct
   • D AWS Network Firewall

   Why: WAF inspects HTTP request content at layer 7, which is the only layer where SQL injection and XSS are visible. Shield handles volumetric DDoS at layers 3 and 4, and GuardDuty detects threats after the fact rather than blocking requests.

Create Your Free Account

Signing up is free. When you upgrade: 5-Day Free Trial — Credit Card Required. No charge until day 5. Cancel anytime. Then 9.99€/month.

Frequently asked questions

Is it free to sign up?

Yes. Creating an account takes an email address and a password — no card, no payment details. The AWS, Azure and Google Cloud question banks and the timed mock exams are the part covered by the 9.99€ per month subscription, which you can start whenever you want from inside the app.

How does the free trial work?

The trial applies to the subscription, not to the account. When you upgrade, the first 5 days are free and give you full access to every question bank and mock exam. A credit card is required to begin the trial, and you are not charged during those 5 days. At the end of day 5 the subscription automatically renews at 9.99€ per month unless you cancel before then.

Do I need to enter a credit card?

Not to sign up or to practise on the free account. A card is required only when you start the subscription and its 5-day trial, by card or through PayPal. Nothing is charged until day 5.

What happens if I cancel during the trial?

You are not charged at all. Cancel any time before the end of day 5 from your account settings — or from your PayPal dashboard if you paid through PayPal — and the subscription ends with no payment taken.

What does the subscription include?

One subscription covers every certification on QuizBuilder — AWS, Microsoft Azure and Google Cloud — including timed mock exams, unlimited practice, and progress tracking across all of them.

Who writes the questions?

Certified subject-matter experts. Each exam is built by someone who holds that certification and works in that field — the AWS banks by AWS-certified SMEs, the Azure banks by Azure-certified SMEs, and so on. Nothing is scraped from other sites or generated and shipped unreviewed.

Are these the real exam questions?

No, and you should be wary of anyone claiming otherwise — distributing real exam content violates the certification agreements you sign with AWS, Microsoft and Google, and can invalidate your certification. These are original questions, written by a certified SME in that field to match the style, difficulty and domain weighting of the real exam.

Can I try it without paying or entering a card?

Yes. The free taster gives you 5 practice questions with full explanations, no signup and no card required.