AWS SAA-C03 practice exam: 10 free questions, every option explained
Ten scenario questions across the four SAA-C03 domains: the shared responsibility model, stateless web tiers, instance families, Elastic Volumes, Direct Connect sizing and a multiple-response IAM item. Answer, then read why each option fits, costs too much or breaks a requirement.
- 65 questions
- 130 minutes
- Pass: 720 / 1,000
10 free SAA-C03 practice questions
Taken from the course, from all four domains, including one Choose TWO item. Click an option to answer; the explanation under every option appears as soon as you do.
A school district moves a database from on-premises servers to Amazon RDS for PostgreSQL. Under the AWS shared responsibility model, which task remains the district's responsibility?
- Correct. The customer controls who can connect and what database users can do.
- Hardware is AWS's responsibility; the customer configures backups and Multi-AZ.
- On RDS, AWS patches the underlying OS; the customer chooses the maintenance window.
- Physical security is always AWS's responsibility.
A startup is writing its first IAM standards. Which practices follow AWS security best practices? (Choose TWO.)
- Correct. AWS recommends federation through an identity provider, with MFA, for human access.
- Root should be reserved for the few tasks that require it.
- This is the opposite of least privilege.
- Correct. Roles give EC2, Lambda and containers automatically rotated temporary credentials.
- Keys in images spread long-term credentials to every copy of the AMI.
A photo-sharing startup stores user uploads. The data will grow to hundreds of terabytes, files are written once and read often over HTTPS by web and mobile clients, and many services such as analytics jobs will also read them. Which storage type is the BEST fit?
- EFS is shared by mounted compute, not served to mobile clients over HTTPS, and costs more per GB for this content.
- Instance store is temporary and tied to one instance, so it is not durable shared storage.
- A volume attaches to one instance at a time and has a size limit, so it does not scale to hundreds of terabytes shared by many services.
- Correct. S3 scales without capacity planning, is accessed over HTTPS by any client or service, and suits write-once, read-many content.
An e-commerce application runs on EC2 instances in an Auto Scaling group behind an Application Load Balancer. Shopping carts are kept in each instance's memory, so customers lose their carts when the group scales in. Which change BEST makes the web tier stateless?
- Stickiness routes a user to the same instance, but the cart is still lost when that instance is terminated.
- Correct. Moving session state to a shared in-memory store lets any instance serve any request, so terminating an instance no longer loses carts.
- An EBS volume belongs to one instance, so the data stays bound to that server and is deleted on termination by default.
- Avoiding scale-in hides the problem, wastes capacity and still loses carts when an instance fails.
A software company already runs its workloads on Kubernetes on premises with Helm charts, kubectl tooling, and Kubernetes-native operators. It wants to move to AWS while keeping these tools and reducing control plane management. Which service should it use?
- ECS is AWS's own orchestrator; it does not run Kubernetes manifests, Helm charts or operators.
- Correct. EKS runs a managed, upstream-compatible Kubernetes control plane, so Helm charts, kubectl and operators keep working.
- This keeps the tools, but the company would still manage the control plane, which it wants to avoid.
- Beanstalk deploys containers through its own platform and is not a Kubernetes cluster.
A financial analytics firm runs an in-memory risk engine that needs about 900 GiB of RAM on a single instance and moderate CPU. Which EC2 instance family should a solutions architect choose?
- Correct. Memory-optimized instances provide a high ratio of memory to vCPU for in-memory workloads.
- C instances favor CPU and would need far more vCPUs, at higher cost, to reach the memory required.
- I instances are built for high local storage I/O, not large memory.
- T instances are small, burstable general-purpose instances that cannot provide 900 GiB of RAM.
A logistics company's EBS gp3 volume on a production EC2 instance is almost full, and the application also needs more IOPS. The company cannot take downtime. Which solution meets these requirements with the LEAST effort?
- Splitting data across volumes needs application or file system changes and more work.
- This works but requires stopping writes and swapping volumes, which means downtime.
- Correct. Elastic Volumes changes size, IOPS and throughput on a live volume without detaching it; the file system is then extended online.
- Moving to a new instance means downtime, and instance store data is lost when the instance stops.
A retail company wants 500 business users to explore interactive sales dashboards built on data in Amazon Athena and Amazon Redshift. The company does not want to run BI servers. Which service should a solutions architect recommend?
- This means building and running servers, which the company wants to avoid.
- OpenSearch Dashboards visualizes data indexed in OpenSearch, such as logs, not Athena or Redshift sales tables.
- Correct. Amazon Quick is AWS's serverless business intelligence service for interactive dashboards on sources such as Athena and Redshift, with no servers to manage.
- Managed Grafana is aimed at operational metrics and observability dashboards, not business sales analytics for hundreds of users.
A biotech company runs an in-memory graph analytics engine on EC2. Profiling shows the engine needs about 8 GiB of memory per vCPU, and the CPUs are rarely busy. Which instance family is the MOST cost-effective fit?
- C instances offer about 2 GiB per vCPU, so you would buy many idle vCPUs to get enough memory.
- Correct. R instances provide about 8 GiB of memory per vCPU, matching the profile without paying for extra CPU or local storage.
- M instances offer about 4 GiB per vCPU, so meeting the memory need doubles the vCPUs you pay for.
- I instances bundle fast local NVMe storage that an in-memory engine does not use, so you pay for capacity you do not need.
A regional bank needs a private, dedicated connection from its office to AWS for a steady 300 Mbps of traffic. It does not expect to grow beyond 500 Mbps in the next 3 years. Which option is the MOST cost-effective?
- This meets the need but pays for many times the required bandwidth.
- This works, but its port charge is higher than a 500 Mbps hosted connection that already covers the growth.
- A VPN is cheap, but it runs over the internet, which breaks the dedicated-connection requirement.
- Correct. Hosted connections come in sub-1 Gbps speeds, so the bank pays for a port that matches its need.
The SAA-C03 exam at a glance
| Domain | Weight of scored content | About this many per 65-question exam |
|---|---|---|
| 1. Design Secure Architectures | 30% | 19–20 |
| 2. Design Resilient Architectures | 26% | 17 |
| 3. Design High-Performing Architectures | 24% | 15–16 |
| 4. Design Cost-Optimized Architectures | 20% | 13 |
The real exam has 65 questions (50 scored, 15 unscored) in 130 minutes, with multiple-choice items (one correct of four) and multiple-response items (two or more correct of five or more). Each course exam is 65 questions timed at 130 minutes and weighted 30/26/24/20. AWS publishes weights by domain, not by task statement.
What SAA-C03 really tests
Trade-offs, not definitions. Most items describe a workload and a constraint, then ask for the solution that is MOST cost-effective, has the LEAST operational overhead or meets a resilience target. Several options work; one fits the constraint best.
Secure architectures are 30%. IAM best practices, federation and roles, the shared responsibility model, security groups and NACLs, encryption and key management, and data security controls across storage and database services.
Resilient and high-performing design. Loosely coupled, scalable architectures with queues and load balancers, multi-AZ and multi-Region patterns, the right storage, compute, database and network choice for a performance requirement, and data ingestion and transformation (task 3.5, added in C03).
Cost everywhere. Storage classes and lifecycle rules, purchasing options and right-sizing, database engines and read scaling, and network choices such as VPC peering, Direct Connect and alias records.
The in-scope service list. The guide lists which services can appear and which are out of scope (for example, Lightsail, CDK, all IoT services). The course only uses in-scope services with their official short names.
Six full exams, 390 questions, all options explained
65 questions and 130 minutes per exam, weighted like the SAA-C03 guide, with multiple-response items and the architecture trade-offs explained under every option.
SAA-C03 FAQ
How many questions are on the AWS SAA-C03 exam?
65 questions in 130 minutes, multiple choice or multiple response. According to the exam guide, 50 are scored and 15 are unscored items you cannot tell apart.
What is the SAA-C03 passing score?
720 on a scaled score of 100 to 1,000. It is a scaled score, not a percentage, so it does not convert to 72%. The exam uses a compensatory model: you do not need to pass each section separately.
What are the SAA-C03 domains and weights?
Design Secure Architectures 30%, Design Resilient Architectures 26%, Design High-Performing Architectures 24%, Design Cost-Optimized Architectures 20%, of scored content.
Is there a penalty for guessing?
No. AWS says unanswered questions are scored as incorrect and there is no penalty for guessing, so answer every question.
Is SAA-C03 still the current version?
Yes. As of October 2026 the AWS certification page links the SAA-C03 exam guide and no new version or beta has been announced in official AWS sources. Check the AWS page before you book.
How much experience does AWS recommend?
At least one year of hands-on experience designing cloud solutions that use AWS services. The certification is valid for three years.
Are these real AWS exam questions?
No. Every question is original, written from the public SAA-C03 exam guide. Real exam content is confidential.
Keep going: 6-week SAA-C03 study plan · AWS AI Practitioner questions · AI Practitioner vs Cloud Practitioner · Google Cloud ACE practice exam