AWS SAA-C03 exam pathFree assessment

AWS SAA-C03 Practice Tests That Find Your Weak Spots

5 practice tests, a 65-question timed simulation, and a free assessment.

AWS Certified Solutions Architect - Associate

Find your AWS SAA-C03 gaps in 15 minutes.

Learner actions will appear after the current account is confirmed.

Official exam objectives effective Aug 30, 2022
Sample report preview

Preview the output before you study

Take a free assessment, see the decisions costing you points, or confirm where to validate breadth next instead of browsing a generic study list.

Sample readiness result640 / 1000

Know where you stand before another full practice test.

Sample top gapResilient architecture decisions

Targeted repair: Fix a focused gap around failover, data protection, and recovery tradeoffs.

ReportTop gapsPass PlanTargeted repairsUnlocksPractice + Timed Exam
01Answer exam-style questions
02Work your Pass Plan
03Complete the final simulation
Try it

Answer one AWS SAA-C03 question

If you miss it, CramHQ identifies the decision you misunderstood, helps you fix it, then checks whether you can apply it in a different scenario.

CramHQ receives bursty telemetry downlinks from multiple ground stations. Each message must be decoded by a custom Linux-native library, and some decoding runs continue for 30-40 minutes during anomaly investigations. The team already writes checkpoints and final results outside the compute layer and wants independent scaling of these workers without maintaining host fleets. Which recommendation best fits this workload?

  1. Run workers as AWS Lambda functions triggered by Amazon SQS, tune reserved concurrency for bursts, and keep checkpoints and results in Amazon DynamoDB and Amazon S3.
  2. Run workers on AWS Elastic Beanstalk worker environments, scale the environment from Amazon SQS queue depth, and keep checkpoints and results in Amazon DynamoDB and Amazon S3.
  3. Run workers on Amazon ECS with AWS Fargate, scale the service from Amazon SQS queue depth, and keep checkpoints and results in Amazon DynamoDB and Amazon S3.
  4. Run workers on Amazon ECS with Amazon EC2 capacity providers, scale from Amazon SQS queue depth, and keep checkpoints and results in Amazon DynamoDB and Amazon S3.
Show the explanation

This supports containerized custom binaries and long-running worker processes while removing server management. Scaling from backlog matches bursty telemetry, and external checkpoints keep workers replaceable during scaling or failure.

Try it now

Free AWS SAA-C03 practice questions

Eight practice questions from the CramHQ AWS SAA-C03 bank, with answers and explanations. No signup needed. When you are ready, start the free assessment. CramHQ ranks your weak spots across the whole exam by the points they cost, and your Pass Plan starts with the costliest.

Question 1 of 8Design Secure Architectures

CramHQ runs market-data collectors on Amazon EC2 instances in an Auto Scaling group. The collectors call Amazon S3 and Amazon DynamoDB during startup and processing. A review found IAM user access keys baked into the AMI; instances are replaced frequently and new instances must begin work without an operator distributing secrets. Which recommendation best reduces credential exposure while preserving automated scale-out?

  1. Attach an IAM role to the EC2 Auto Scaling launch template through an instance profile and grant only the required S3 and DynamoDB permissions.
  2. Create an IAM user for the collectors, store its access key in AWS Secrets Manager, enable rotation, and let instances retrieve it at startup.
  3. Store an IAM user access key in the AMI only for AWS STS calls, then have the application call GetSessionToken and cache the returned credentials.
  4. Create an IAM user for the collectors, store its access key as an AWS Systems Manager Parameter Store SecureString, and restrict KMS decrypt permissions to the instances.
Show answer and explanation

Answer: A

This lets each launched instance receive automatically refreshed, scoped credentials from the EC2 runtime. No reusable IAM user secret needs to be embedded, copied, or retrieved at boot.

If you picked B

Why it is tempting: Secrets Manager can securely store and rotate secrets, so it appears to reduce exposure compared with baking a key into an AMI.

Why it is wrong: For EC2 workload AWS API access, remove the reusable IAM user key and let the instance receive temporary role credentials.

If you picked C

Why it is tempting: STS session credentials expire, so the option sounds like it changes the workload to a temporary-credential model.

Why it is wrong: Temporary credentials only solve the exposure problem when the workload does not need a persistent access key to obtain them.

If you picked D

Why it is tempting: Parameter Store SecureString and KMS restrictions sound like strong controls around secret retrieval.

Why it is wrong: For automated EC2 scale-out, use an instance profile so the workload receives temporary role credentials instead of retrieving an IAM user key.

Question 2 of 8Design Secure Architectures

A hospital network runs a public appointment application on Amazon EC2 behind an Application Load Balancer. During recent events, bots sent valid-looking search and booking requests from many IP ranges, exhausting the application tier while network metrics stayed normal. The team wants to stop abusive request patterns before they reach the instances and keep the current load balancer architecture. Which recommendation best addresses the immediate risk?

  1. Associate an AWS WAF web ACL with the Application Load Balancer and add managed rules plus rate-based rules for abusive request patterns.
  2. Move the application behind Amazon API Gateway and configure usage plans with throttling for all clients.
  3. Place Amazon CloudFront in front of the Application Load Balancer and require HTTPS between viewers and the distribution.
  4. Enable AWS Shield Advanced on the Application Load Balancer and configure proactive engagement for the application.
Show answer and explanation

Answer: A

AWS WAF can be attached to an Application Load Balancer and evaluate HTTP(S) requests before forwarding them. Managed and rate-based rules address abusive but syntactically valid request traffic that would otherwise consume origin capacity.

If you picked B

Why it is tempting: Usage plans and throttling are real controls for APIs, so they can look relevant when the stem mentions bots and excessive requests.

Why it is wrong: Use API Gateway throttling when the workload is fronted as an API and clients can be controlled through API mechanisms; use AWS WAF for immediate HTTP inspection on an existing ALB.

If you picked C

Why it is tempting: CloudFront is an edge service and can reduce origin load for cacheable content, so it can seem like a natural shield in front of an ALB.

Why it is wrong: Choose a control that can inspect and enforce HTTP request rules when the harmful traffic is valid-looking dynamic application requests.

If you picked D

Why it is tempting: Shield Advanced protects internet-facing resources and proactive engagement sounds relevant during attack events.

Why it is wrong: Use Shield Advanced for DDoS protection and response; use AWS WAF rules when the required action is inspecting and controlling HTTP request attributes.

Question 3 of 8Design Resilient Architectures

CramHQ runs a subscriber activation portal for field technicians. During regional rollout windows, traffic jumps sharply and the application tier must add and replace workers quickly. Today, users sometimes lose partially completed activation flows when a worker is terminated or becomes unhealthy. The team can change the application code but wants to keep the web tier replaceable and scale it horizontally without coordinating user placement. Which recommendation best addresses this?

  1. Run the web tier as an Amazon ECS service on AWS Fargate behind an Application Load Balancer, and enable Application Load Balancer duration-based sticky sessions.
  2. Run the web tier in an Amazon EC2 Auto Scaling group behind a Network Load Balancer, and configure source IP based routing in the application.
  3. Run the web tier in an Amazon EC2 Auto Scaling group behind an Application Load Balancer, and configure lifecycle hooks to drain instances before termination.
  4. Run the web tier as an Amazon ECS service on AWS Fargate behind an Application Load Balancer, and store per-user progress in Amazon DynamoDB with TTL where appropriate.
Show answer and explanation

Answer: D

This treats each task as replaceable request-processing capacity while keeping user progress in a managed, highly available data store. Documented service scaling and task replacement can occur without relying on the same container continuing to serve a user.

If you picked A

Why it is tempting: Sticky sessions can reduce user movement during normal requests, so they can look like session-state protection.

Why it is wrong: For horizontally scaled replaceable workers, user progress must live outside the worker and not depend on a particular target.

If you picked B

Why it is tempting: Source IP based routing sounds predictable and may appear to keep each technician tied to the same worker.

Why it is wrong: Horizontal scaling without coordinating user placement requires workers that can be replaced without owning the user's progress.

If you picked C

Why it is tempting: Lifecycle hooks and draining are real tools for controlled scale-in, so they can look like the operational fix.

Why it is wrong: Draining can reduce interruption during planned termination, but it does not make local worker state durable or shareable.

Show all 8 practice questions
Question 4 of 8Design Resilient Architectures

CramHQ's trade-ingest application runs risk validation, order acceptance, audit writing, and downstream position updates in one EC2 Auto Scaling group. Market-open bursts make audit writes and position updates exhaust the same fleet as the latency-sensitive acceptance path, even when validation capacity is healthy. The matching engine interface cannot be changed this quarter. Which recommendation best reduces shared scaling pressure while preserving the current synchronous acceptance behavior?

  1. Deploy the monolithic application on Amazon ECS with AWS Fargate behind an Application Load Balancer and configure Service Auto Scaling for request count.
  2. Keep the current application on EC2 Auto Scaling and add Amazon ElastiCache for Redis to cache validation results before writing audit and position updates synchronously.
  3. Move the entire trade-ingest application to a larger EC2 Auto Scaling group behind an Application Load Balancer and use target tracking on CPU utilization.
  4. Keep validation and acceptance on EC2 Auto Scaling; publish accepted trade events to Amazon SQS, and process audit and position updates with a separate AWS Lambda consumer tier.
Show answer and explanation

Answer: D

This preserves the synchronous validation and acceptance path while moving bursty follow-on work behind a durable queue. The consumer side can scale, retry, and fail separately from the accepting fleet.

If you picked A

Why it is tempting: Fargate reduces server management and Service Auto Scaling sounds like a better scaling model.

Why it is wrong: Independent scaling requires a boundary between latency-sensitive request handling and bursty follow-on work, not just a different place to run the same combined service.

If you picked B

Why it is tempting: A cache can improve repeated reads and may make the validation step look less expensive during bursts.

Why it is wrong: Caching helps repeated reads, but it does not create an independent processing tier for write-heavy follow-on work.

If you picked C

Why it is tempting: Adding instances and target tracking can reduce immediate saturation and is a familiar scaling response.

Why it is wrong: When two workloads have different scaling and latency needs, separate them so each tier can scale and fail independently.

Question 5 of 8Design High-Performing Architectures

CramHQ's genomics cluster writes 20-GB result files to an on-premises NAS after each sequencing run. Runs finish unpredictably but only several times per day. Downstream AWS jobs can start within 2 hours, and file contents must arrive intact in Amazon S3; record-level ordering is irrelevant. Which recommendation best fits this ingestion need?

  1. Use Amazon SQS FIFO queues with one message per file block and consumers writing blocks to Amazon S3 in sequence.
  2. Use Amazon Data Firehose with the NAS publishing file fragments to a delivery stream that writes buffered objects to Amazon S3.
  3. Use AWS DataSync to transfer completed files from the NAS to Amazon S3 on a scheduled task that runs often enough to meet the 2-hour window.
  4. Use Amazon Kinesis Data Streams with producers sending file chunks as records and consumers rebuilding files before writing them to Amazon S3.
Show answer and explanation

Answer: C

AWS DataSync is designed for moving files between on-premises storage and AWS storage services. Scheduling frequent transfers matches completed file production and the stated delay tolerance without forcing the workload into record streaming semantics.

If you picked A

Why it is tempting: SQS FIFO can sound useful when data must arrive intact because it preserves message order within a message group.

Why it is wrong: Use messaging queues for discrete messages and decoupled processing, not as a replacement for managed transfer of large completed files.

If you picked B

Why it is tempting: Amazon Data Firehose can deliver data to Amazon S3, so the destination matches part of the requirement.

Why it is wrong: Use Firehose for streaming records delivered to destinations; use file transfer when the producer creates completed files that must arrive intact.

If you picked D

Why it is tempting: Kinesis Data Streams is associated with ingestion and ordered reads, which can sound relevant to moving data reliably.

Why it is wrong: Use Kinesis Data Streams for continuous record ingestion and stream processing, not for scheduled transfer of large completed files.

Question 6 of 8Design High-Performing Architectures

CramHQ's dispatch service uses an AWS Lambda function to score candidate drivers for each ride request. During regional promotions, volume rises sharply, but each request handler starts promptly and payload sizes remain stable. Metrics show most elapsed time is spent after the handler begins, and memory use stays well below the configured limit. The team wants lower per-request latency without redesigning the scoring logic. Which recommendation best fits the performance issue?

  1. Increase the AWS Lambda ephemeral storage allocation for the function and monitor temporary file usage during promotions.
  2. Increase the AWS Lambda reserved concurrency for the function and monitor throttles during the next promotion.
  3. Configure AWS Lambda provisioned concurrency for the function and keep enough initialized environments warm before promotions.
  4. Increase the AWS Lambda memory size for the function and, when the function is eligible, use AWS Compute Optimizer recommendations to help select and validate the setting.
Show answer and explanation

Answer: D

For AWS Lambda, increasing configured memory also increases proportional CPU allocation. The scenario points to active handler work taking too long, so memory tuning can reduce duration even when memory usage is below the limit; Compute Optimizer can help where recommendations are available for the function.

If you picked A

Why it is tempting: Temporary storage is a Lambda sizing setting, so it can look like a general performance lever.

Why it is wrong: Increase ephemeral storage when local scratch space is the constraint; it does not add CPU capacity for scoring logic.

If you picked B

Why it is tempting: Promotions increase traffic, and reserved concurrency is closely tied to handling many Lambda invocations.

Why it is wrong: Reserved concurrency controls how many function instances can run and protects against throttling; it does not shorten active handler execution time.

If you picked C

Why it is tempting: Provisioned concurrency is a common Lambda latency feature, especially before predictable traffic spikes.

Why it is wrong: Provisioned concurrency reduces initialization latency; it does not make already-running handler code complete faster.

Question 7 of 8Design Cost-Optimized Architectures

CramHQ must store intraday order-state records for a trading platform. Each update replaces one record by order ID, readers fetch individual records during investigations, and records expire after a few days. Traffic is extreme during market events but drops sharply overnight, and the team wants to reduce cost without managing database instances. Which recommendation is the best fit?

  1. Use Amazon Aurora Serverless v2 with a single-writer cluster and scheduled scaling for market hours.
  2. Use Amazon DynamoDB with on-demand capacity mode and TTL on the table.
  3. Use Amazon DynamoDB with provisioned capacity, auto scaling, reserved capacity, and TTL on the table.
  4. Use Amazon ElastiCache for Redis with a replication group and key expirations for each order record.
Show answer and explanation

Answer: B

This matches item-level reads and writes, automatically accommodates uneven request rates without instance management, and removes expired items through TTL, aligning spend with bursty demand and short retention.

If you picked A

Why it is tempting: Aurora Serverless v2 sounds operationally lighter and scheduled scaling seems aligned to market hours.

Why it is wrong: When access is simple item reads and overwrites by key, a purpose-built key-value database can avoid paying for relational features that the workload does not use.

If you picked C

Why it is tempting: Provisioned capacity with auto scaling and reserved capacity can reduce cost for steady, predictable high usage.

Why it is wrong: Reserved or provisioned capacity is cost-effective when throughput is predictable and consistently used; on-demand capacity is better for sharp bursts and deep idle periods.

If you picked D

Why it is tempting: Redis supports fast key access and expiration, which resemble the stated order ID reads and short record lifetime.

Why it is wrong: Use a durable database service for a system of record; a cache is primarily for accelerating access to data stored elsewhere.

Question 8 of 8Design Cost-Optimized Architectures

CramHQ stores mission-event metadata in an Amazon DynamoDB table. Traffic is low most days, but allied exercises and regional alerts cause abrupt, hard-to-forecast spikes that can be 20 times normal for several hours. After each spike, usage returns near baseline for days. The team wants to stop paying for capacity that sits unused while keeping the table available during unexpected bursts. Which recommendation best fits this access pattern?

  1. Use DynamoDB provisioned capacity mode sized for the largest observed spike and purchase DynamoDB reserved capacity for the baseline workload.
  2. Use DynamoDB provisioned capacity mode with auto scaling and set the maximum read and write capacity to the expected exercise peak.
  3. Use DynamoDB on-demand capacity mode for the table and monitor consumed read and write request units with Amazon CloudWatch.
  4. Use DynamoDB provisioned capacity mode with scheduled scaling actions for known exercise windows and manual increases for regional alerts.
Show answer and explanation

Answer: C

On-demand capacity is designed for tables with unpredictable request traffic and automatically accommodates traffic changes without preconfiguring throughput, avoiding payment for long idle periods of peak-sized capacity.

If you picked A

Why it is tempting: Reserved capacity can reduce costs when provisioned throughput is used consistently, and sizing for the largest spike sounds availability-focused.

Why it is wrong: Use reserved or provisioned capacity when throughput is predictable and well utilized; do not make rare spikes define the paid baseline.

If you picked B

Why it is tempting: Auto scaling reduces manual tuning and a high maximum can appear to cover the expected peak.

Why it is wrong: Use elastic pay-per-request capacity when demand timing is hard to forecast and bursts can arrive abruptly.

If you picked D

Why it is tempting: Scheduled scaling works well for known events, and manual increases can sound like a practical backup plan.

Why it is wrong: Scheduled scaling is appropriate when demand increases are predictable; unexpected bursts need capacity that can absorb changes without manual timing.

CramHQ links wrong answers to the mistake behind them. Start with the free assessment, and CramHQ keeps finding your gaps as you practice and adds a repair for each to your Pass Plan.

Start the free AWS SAA-C03 assessment

Why study with CramHQ

Test the AWS architecture decisions that matter.

Start with the free AWS Solutions Architect Associate assessment. CramHQ uses your result to rank the next step, explain the decisions that matter, and check you again.

Learner actions will appear after the current account is confirmed.

  1. A clear next step, chosen for you

    The Pass Plan ranks gaps by the points they cost and opens the top repair.

  2. Understand why an answer works

    The reasoning behind the right answer and where the alternatives break.

  3. Prove it on a retest

    A fresh question on the same decision verifies the gap is closed.

  4. Track it on your readiness map

    Strengthened areas change colour; pick the next priority from what is left.

  • Flashcards saved from your repairs
  • Optional hints when you are stuck
  • Timed simulations at exam pace
Exam syllabus

Exam-weighted coverage.

Coverage follows the published AWS SAA-C03 skill areas measured as of Aug 30, 2022, so your practice stays aligned.

Design Secure Architectures

30%

9 concepts

Design Resilient Architectures

26%

6 concepts

Design High-Performing Architectures

24%

15 concepts

Design Cost-Optimized Architectures

20%

12 concepts

Official AWS exam changes

AWS exam update history

Changes recorded from official AWS exam sources.

Effective Aug 30, 2022Major updateAWS introduced SAA-C03 with reorganized task statements and new data ingestion and transformation coverage.Integrated by CramHQ

Compared with SAA-C02

Added

  • Determine high-performing data ingestion and transformation solutions

Changed

  • Existing task statements were reorganized across the four exam domains.
  • More than 90% of the previous exam's task statements carried forward.
Updated

CramHQ completed the SAA-C03 update for the reorganized exam scope and the added data ingestion and transformation task.

View official source
Effective Mar 23, 2020Major updateAWS introduced SAA-C02 with updated objectives across every domain, including databases, cost optimization, and security.Integrated by CramHQ

Compared with SAA-C01

Changed

  • AWS introduced SAA-C02 with updated objectives across every domain, including databases, cost optimization, and security.
Updated

CramHQ integrated the AWS-SAA-C03 update into this course.

View official source
Published Feb 14, 2018Major updateAWS updated the exam for new services and Well-Architected security, reliability, performance, cost, and operations practices.Integrated by CramHQ

Compared with Previous Solutions Architect Associate exam

Changed

  • AWS updated the exam for new services and Well-Architected security, reliability, performance, cost, and operations practices.
Updated

CramHQ integrated the AWS-SAA-C03 update into this course.

View official source
Practice and validate

Build breadth before the timed simulation.

Use separate exam-style practice quizzes to validate breadth, review explanations and your answers, use hints when stuck, and build confidence before the timed simulation, with an optional timer.

5 Practice Quizzes

01Practice quiz

AWS SAA-C03 Practice Quiz 1

Questions
65
Timer
Optional
02Practice quiz

AWS SAA-C03 Practice Quiz 2

Questions
65
Timer
Optional
03Practice quiz

AWS SAA-C03 Practice Quiz 3

Questions
65
Timer
Optional
04Practice quiz

AWS SAA-C03 Practice Quiz 4

Questions
65
Timer
Optional
05Practice quiz

AWS SAA-C03 Practice Quiz 5

Questions
65
Timer
Optional
Timed readiness check

Check readiness under timed conditions.

Use this after practice when you want an exam-style pacing, stamina, and breadth check.

FinalReadiness simulation
CramHQ target720 / 1000

AWS SAA-C03 Final Readiness Simulation

Questions
65
Time
130 min
Mode
Timed

Start with the free assessment; full Pass Plan access unlocks the timed exam simulation.

Question formats

Practice the formats this exam path supports.

CramHQ shows the interaction patterns available for AWS SAA-C03 from the active exam path inventory.

Single answer

Choose the best answer from exam-style options.

Multi-answer

Select every correct option when more than one applies.

Exam integrity

Original practice, aligned to public objectives.

CramHQ helps you practice the decisions behind AWS SAA-C03 without using copied or confidential exam content.

Practice contentOriginal questions

Original practice questions aligned to public exam objectives.

Coverage sourcePublic objectives

Coverage is checked against the published exam objectives.

Provider relationshipIndependent prep
AWS SAA-C03 exam guide

CramHQ is independent and is not affiliated with AWS.

Readiness guide

Not sure if you are ready for AWS SAA-C03?

Use the AWS SAA-C03 readiness checklist to interpret practice scores, spot gaps a score can hide, and decide whether to book the exam or keep repairing weak areas.

Read the AWS SAA-C03 readiness checklist before you book the exam
Quick answers

AWS SAA-C03 practice test questions, answered.

Do I need to sign up?

No. You can start the assessment and review your report before creating an account. Sign up when you want to save the report and continue the Pass Plan.

Is the report free?

Yes. The assessment, readiness report, and your first targeted repair are free.

Are these copied exam questions or dumps?

No. CramHQ uses original practice items designed to test the decisions and concepts behind the exam.

Is CramHQ affiliated with AWS?

No. CramHQ is independent and is not endorsed by AWS.

What do I get after the assessment?

Save your report to keep the Pass Plan, fix your first gap free, and unlock the full Pass Plan when you want every repair, practice quizzes, and timed simulation.

I have already studied a lot. Is this still worth it?

That is exactly who it is built for. CramHQ keeps tracking the last few gaps between you and a comfortable pass, the ones a raw score hides, and puts the one costing you the most points at the top of your Pass Plan.

How long do I get access?

12 months of full access from purchase, with room to come back after a break.

What is your refund policy?

Paid exam paths come with a 7-day money-back guarantee. Conditions apply; see the Refund Policy. You can also try the assessment and your first repair free before you buy. Refund Policy

More exam paths

Choose the next certification path that fits your current goal.