AWS SAA-C03 Solutions Architect – Associate Practice Exam
Prepare for the AWS Certified Solutions Architect – Associate exam (SAA-C03) — AWS's flagship associate credential — with scenario-based, source-cited practice questions across all four domains: secure, resilient, high-performing, and cost-optimized architectures. Built around Well-Architected trade-offs, where several answers work but only one is optimal. Includes Learn mode and full timed Exam mode.
Start 24-hour free trial →SAA-C03 exam at a glance
- Vendor
- Amazon Web Services (AWS)
- Exam code
- SAA-C03
- Certification
- AWS Certified Solutions Architect – Associate
- Level
- Associate
- Format
- 65 questions (50 scored + 15 unscored); multiple choice and multiple response
- Duration
- 130 minutes
- Scoring
- Scaled 100–1000; passing score 720 (pass/fail, compensatory)
- Cost (USD)
- $150 (50% discount voucher available after any prior AWS certification)
- Delivery
- Pearson VUE test center or online proctored
- Prerequisites
- None required. AWS recommends ~1 year of hands-on experience designing AWS solutions; Cloud Practitioner is a useful starting point for those new to IT
- Validity
- 3 years; recertify by passing the current version, or automatically by earning Solutions Architect – Professional
- Framework
- Anchored in the AWS Well-Architected Framework
Sources: AWS — Solutions Architect – Associate certification · AWS Certification exam guides. Confirm the current exam guide revision and pricing with AWS before scheduling.
About the SAA-C03 certification
AWS Certified Solutions Architect – Associate (SAA-C03) is AWS's most popular associate-level credential and validates the ability to design solutions that meet business requirements using AWS services — balancing security, resilience, performance, and cost across the full service catalog. It is anchored in the AWS Well-Architected Framework, and its questions are deliberately trade-off driven: most scenarios have several workable answers but only one optimal answer for the stated constraints. The skill being tested is architectural judgment, not service memorization.
Design Secure Architectures and Design Resilient Architectures together account for more than half the exam. A recurring pattern is reading the scenario for the constraint hidden in an adjective — "most cost-effective," "least operational overhead," "highest availability" — which decides between otherwise valid options. Storage questions map an access pattern to an Amazon S3 storage class; "decouple" points to Amazon SQS or SNS rather than an EC2 polling loop; and Multi-AZ versus Multi-Region turns on the failure you are protecting against. For the concepts behind these scenarios, see the AWS architecture study guides in the Learning Hub.
SAA-C03 exam domains and weights
AWS publishes four scored content domains with the official weightings below (they sum to 100%). Design Secure Architectures is the heaviest domain — often underweighted by candidates from a developer background — so plan your study time in proportion. The exam uses compensatory scoring, so you only need to pass overall, not each domain.
Secure access with AWS IAM, encryption at rest and in transit with AWS KMS, edge and application protection with AWS WAF and AWS Shield, and threat detection with Amazon GuardDuty — applying defense in depth.
Multi-AZ and multi-Region resilience, Amazon Route 53 failover routing, Amazon S3 versioning and replication, AWS Backup, and loosely coupled designs using Amazon SQS and Amazon SNS.
Selecting Amazon EC2 instance families, scaling with AWS Lambda, caching with Amazon ElastiCache, accelerating delivery with Amazon CloudFront and AWS Global Accelerator, and choosing high-performing storage and databases.
Reserved Instances and Savings Plans, Amazon S3 storage classes and lifecycle policies, right-sizing with AWS Compute Optimizer, and cost-optimized storage, compute, database, and network design.
Source: AWS Certified Solutions Architect – Associate (SAA-C03) exam guide. Weights are AWS's published scored-content percentages and sum to 100%.
Who SAA-C03 is for
This is AWS's benchmark associate exam and a common entry point to the AWS certification track:
- Solutions architects and cloud architects designing AWS solutions that balance cost, performance, security, and resilience.
- Cloud and infrastructure engineers who provision and operate AWS workloads and want to validate design skills.
- Developers and sysadmins moving into cloud architecture roles.
- IT professionals using SAA-C03 as a marketable first or second AWS certification.
There are no mandatory prerequisites, but AWS recommends about a year of hands-on experience designing AWS solutions; those entirely new to IT often earn the Cloud Practitioner first. From here, many candidates progress to the Solutions Architect – Professional or branch into the Developer – Associate and CloudOps – Associate tracks. For where AWS architecture skills lead, see the cloud architecture career paths in the Career Hub.
What this SAA-C03 practice exam delivers
Learn mode
Get the correct answer, the trade-off reasoning, why each near-miss distractor is not optimal, and a link to the relevant AWS documentation right after each question — built for the "best answer, not just a workable answer" style SAA-C03 tests.
Exam mode
Rehearse on a 130-minute timer against 65-question sets that mirror the real SAA-C03 format, so you build the pacing to read dense scenarios and finish confidently.
Source-linked explanations
Every answer cites official AWS documentation — S3, RDS, ElastiCache, Athena, EC2 Spot, and more — so you study from AWS's own material, not a mystery answer key.
Score by domain
Results break down across the four SAA-C03 domains, so practice tells you exactly which area — secure, resilient, high-performing, or cost-optimized — to sharpen next.
Sample SAA-C03 practice questions
Ten free questions across the four SAA-C03 domains, with full explanations and links to the relevant AWS documentation. The complete bank is available with the 24-hour trial.
A web application running in a public subnet stores files in an S3 bucket. The team wants the EC2 instances to access S3 without traversing the public internet. Which feature provides this?
- S3 Gateway VPC Endpoint
- NAT Gateway
- Internet Gateway
- Direct Connect
Show answer & explanation
Correct: A — S3 Gateway VPC Endpoint. A gateway endpoint adds a route to Amazon S3 over the AWS private network at no additional charge, keeping traffic off the public internet.
Why not the others: a NAT gateway (B) and an internet gateway (C) both route over the internet; and Direct Connect (D) is for hybrid on-premises links and is overkill here.
Source: AWS — Gateway VPC endpoints for S3 →An application requires 99.99% availability and uses an RDS PostgreSQL database. Which configuration best supports this SLA?
- Single-AZ DB instance with daily backups
- Multi-AZ DB cluster (with two readable standbys)
- Read replica only in the same AZ
- Snapshots stored in S3 only
Show answer & explanation
Correct: B — Multi-AZ DB cluster. A Multi-AZ cluster (or at minimum a Multi-AZ instance) provides synchronous replication with automatic failover — the foundation of high availability.
Why not the others: single-AZ backups (A) can take hours to restore; a same-AZ read replica (C) does not survive an AZ failure; and snapshots (D) are not a high-availability mechanism.
Source: AWS — RDS Multi-AZ DB cluster →A read-heavy application using RDS shows database CPU at 90% during peak hours; writes are minimal. Which change improves performance with the least disruption?
- Increase storage size only
- Switch to DynamoDB
- Add RDS read replicas and direct read traffic to them
- Disable encryption
Show answer & explanation
Correct: C — Add RDS read replicas. Read replicas offload read traffic and reduce primary CPU with minimal application change — just point reads at the replica endpoint.
Why not the others: increasing storage (A) does not address CPU; switching engines to DynamoDB (B) is disruptive; and disabling encryption (D) is not the cause and weakens security.
Source: AWS — RDS read replicas → Further reading: PowerKram — scaling relational databases →Logs are written daily to S3 and queried within 30 days; after that they are rarely accessed but must be retained for 7 years. Which lifecycle policy is most cost-effective?
- Keep all data in S3 Standard for 7 years
- Delete after 30 days
- Move immediately to S3 One Zone-IA
- Transition to S3 Standard-IA after 30 days, then Glacier Deep Archive after 90 days
Show answer & explanation
Correct: D — Standard-IA then Glacier Deep Archive. Standard-IA fits the 30–90 day infrequent-access window, and Deep Archive is the cheapest tier for long-term retention with rare access.
Why not the others: Standard for 7 years (A) is wasteful; deleting after 30 days (B) violates the retention requirement; and moving immediately to One Zone-IA (C) loses an AZ of redundancy and is not the cheapest for archival.
Source: AWS — S3 storage classes →A stateless web tier runs behind an Application Load Balancer in three AZs, with traffic sticky to a session store. Where should the session store live for highest resilience?
- On each EC2 instance's local disk
- A single S3 bucket via instance-mounted FUSE
- Amazon ElastiCache (Redis) with Multi-AZ replication
- Local /tmp on the load balancer
Show answer & explanation
Correct: C — Amazon ElastiCache (Redis) with Multi-AZ replication. Externalizing session state to ElastiCache with Multi-AZ replication gives low latency and survives an AZ failure.
Why not the others: local disk (A) loses sessions when an instance is lost; a FUSE mount on S3 (B) is high-latency; and a load balancer (D) has no usable local session storage.
Source: AWS — ElastiCache Multi-AZ → Further reading: PowerKram — externalizing session state →A bucket holds confidential PII. The team must guarantee that no object is ever made publicly accessible, even by accident. Which controls should they apply? (Choose two.)
- Enable S3 Block Public Access at the account and bucket levels
- Use a bucket policy that explicitly denies public principals/conditions
- Make the bucket public for ease of testing
- Disable encryption to simplify scanning
Show answer & explanation
Correct: A and B. Account- and bucket-level Block Public Access stops public ACL and policy grants, and an explicit deny in the bucket policy adds defense in depth.
Why not the others: making the bucket public (C) is the opposite of the requirement; and disabling encryption (D) weakens the security posture without helping.
Source: AWS — S3 Block Public Access → Further reading: PowerKram — AWS CloudOps – Associate (SOA-C03) →An analytics workload reads multi-terabyte datasets from S3 and runs ad-hoc SQL queries that finish in seconds to minutes. Which service is most appropriate?
- Amazon Redshift Provisioned with daily ETL only
- Amazon Athena
- Amazon RDS
- Amazon DynamoDB
Show answer & explanation
Correct: B — Amazon Athena. Athena runs serverless SQL directly against S3, paying per scan — ideal for ad-hoc analytics on a data lake with no cluster to manage.
Why not the others: provisioned Redshift (A) suits sustained warehousing, not ad-hoc queries; RDS (C) is OLTP; and DynamoDB (D) is key-value NoSQL, not SQL analytics.
Source: AWS — Amazon Athena →A nightly batch job runs for 4 hours and is fault-tolerant — it can be checkpointed and restarted. Which compute purchase option is most cost-effective?
- Spot Instances with checkpointing
- On-Demand
- 1-year No-Upfront Reserved Instances
- Dedicated Hosts
Show answer & explanation
Correct: A — Spot Instances with checkpointing. Spot offers up to ~90% savings and suits fault-tolerant, restartable batch jobs that can absorb interruptions.
Why not the others: On-Demand (B) and Reserved Instances (C) are pricier for an interruptible workload; and Dedicated Hosts (D) are for licensing or compliance constraints.
Source: AWS — Amazon EC2 Spot Instances → Further reading: PowerKram — EC2 purchase options →A messaging system must absorb spikes of 10x normal load without losing messages, then drain to consumers at their natural rate. Which service is the right fit?
- Amazon SES
- Direct synchronous Lambda invocation
- Amazon SQS standard queue
- Amazon Route 53
Show answer & explanation
Correct: C — Amazon SQS standard queue. SQS decouples producers from consumers and acts as a durable buffer that absorbs spikes, letting consumers drain at their own rate.
Why not the others: direct synchronous Lambda invocation (B) lacks buffering; SES (A) is an email service; and Route 53 (D) is DNS.
Source: AWS — Amazon SQS → Further reading: PowerKram — AWS Developer – Associate (DVA-C02) →An ALB is the entry point for a public web app. The team needs to block SQL injection and known-bad IPs. Which service provides this directly?
- S3 Block Public Access
- AWS Shield Standard alone
- Security groups only
- AWS WAF with managed rule groups
Show answer & explanation
Correct: D — AWS WAF with managed rule groups. WAF inspects HTTP(S) requests for SQL injection and cross-site scripting and supports IP-set rules; managed rule groups speed deployment on an ALB.
Why not the others: Shield Standard (B) mitigates DDoS but not Layer 7 attacks; security groups (C) operate at Layer 3/4; and S3 Block Public Access (A) is an S3 control, unrelated to an ALB.
Source: AWS — AWS WAF →Keep going: Learning & Career resources
Solutions Architect – Associate anchors the whole AWS certification track. Both PowerKram hubs back your next step.
Deep dive: exam format, scoring, study path, and where to go next
Exam format and scoring
SAA-C03 has 65 questions in 130 minutes: 50 are scored and 15 are unscored pretest items that do not affect your result (you cannot tell which are which). Questions are multiple choice (one correct answer) and multiple response (select the exact number stated, with no partial credit). Scoring is scaled from 100 to 1000, and 720 is the minimum passing score. The exam uses a compensatory model, so you need to pass only the overall exam, not each domain. There is no penalty for guessing. Read the SAA-C03 format guide →
The trade-off testing pattern
SAA-C03 rarely asks for the only workable answer — it asks for the best one. The deciding factor is usually a qualifier in the scenario: "most cost-effective," "least operational overhead," "highest availability," or "minimal downtime." Read for that qualifier first, then eliminate options that technically work but miss it. Watch the classic pairings: Multi-AZ (synchronous, for availability) versus read replicas (asynchronous, for read scaling); SQS/SNS for decoupling versus EC2 polling; and access pattern mapped to the right S3 storage class. Read the trade-off decision primer →
Realistic study path
Most candidates with 6–12 months of hands-on AWS need six to eight weeks of focused study; those new to AWS should plan ten to twelve. Anchor study in the Well-Architected Framework, read the service FAQs for your top fifteen services, and get hands-on: build a Multi-AZ RDS setup, an S3 lifecycle policy, an ALB with WAF managed rules, and an SQS-decoupled worker. Start with the highest-weighted domain (Design Secure Architectures at 30%), then rehearse in Learn mode and run full 65-question, 130-minute simulations in Exam mode once your Learn-mode accuracy passes ~85%. Read the SAA-C03 study plan →
Where to go next
SAA-C03 is the hub of the AWS certification track. The Solutions Architect – Professional (SAP-C02) is the direct step up (and passing it auto-recertifies this associate), the Developer – Associate (DVA-C02) adds application-build depth, and the CloudOps – Associate (SOA-C03) adds operations depth. See more AWS exams →
Cost, scheduling, and recertification
The exam costs $150 USD and is delivered at a Pearson VUE test center or online with a proctor. If you have earned any prior AWS certification, a 50% discount voucher is available in your AWS Certification account. The certification is valid for three years; recertify by passing the current version before it expires, or automatically by earning the Solutions Architect – Professional. Career Hub — cloud architecture roles →
Frequently asked questions
What format is the SAA-C03 exam?
65 questions in 130 minutes — 50 scored and 15 unscored pretest items. Questions are multiple choice and multiple response (with no partial credit on multi-response items). Scoring is scaled from 100 to 1000, and the minimum passing score is 720. The exam uses compensatory scoring, so you need to pass only the overall exam, not each domain.
What does SAA-C03 cover?
Four domains: Design Secure Architectures (30%), Design Resilient Architectures (26%), Design High-Performing Architectures (24%), and Design Cost-Optimized Architectures (20%). It is anchored in the AWS Well-Architected Framework and tests architectural trade-offs across the AWS service catalog.
How much does SAA-C03 cost?
$150 USD. If you have earned any prior AWS certification, a 50% discount voucher is available in your AWS Certification account. The certification is valid for three years.
Are there prerequisites for SAA-C03?
No mandatory prerequisites. AWS recommends about one year of hands-on experience designing AWS solutions. Candidates entirely new to IT often earn the AWS Certified Cloud Practitioner first for foundational knowledge.
What should I pursue after SAA-C03?
The Solutions Architect – Professional (SAP-C02) is the direct step up, and passing it automatically recertifies this associate. The Developer – Associate (DVA-C02) and CloudOps – Associate (SOA-C03) are complementary associate tracks that add application-build and operations depth.
Start your free 24-hour SAA-C03 practice trial
Full access to 700+ questions, both study modes, source-linked explanations, and score-by-domain. No credit card required.
Start free trial →