SAA-C03 practice questions: 10 free samples from the AWS mock exam

10 questions in the style of the AWS Certified Solutions Architect – Associate exam, with their answer options. They are 10 of the 77 in the pool the mock draws from; answers and explanations come back when you sit it, and every question is marked against its domain so you can see where you stand.

Sit the full 65-question mock — free, no account

  1. 1. An S3 bucket in eu-central-1 stores its objects in that Region only, unless you configure otherwise. The shape of it

    1. 2. What kind of workload suits Spot? The bill

      1. AA payment API
      2. BOne that can be interrupted and resumed, such as batch processing
      3. CAnything, since interruptions are rare
      4. DA production database

    2. 3. An application on EC2 needs to read one S3 bucket. Security forbids storing credentials on the instance. What should the architect use? Domain 1 · Design Secure Architectures

      1. AThe account root user credentials in an environment variable
      2. BAn IAM user with access keys placed in the application config
      3. CAn IAM role attached to the instance through an instance profile
      4. DA bucket policy allowing anonymous reads from the instance IP

    3. 4. A company runs 40 accounts under Organizations and must guarantee that no team can disable CloudTrail, whatever their account permissions say. What enforces this? Domain 1 · Design Secure Architectures

      1. AA Service Control Policy applied to the organizational units
      2. BA permissions boundary on each administrator role
      3. CAn AWS Config rule that reports the change
      4. DAn IAM policy attached to every user in every account

    4. 5. An external partner needs read access to a bucket for six months, and has their own AWS account. What is the least-privilege design? Domain 1 · Design Secure Architectures

      1. AAn IAM user in your account with keys emailed to the partner
      2. BMaking the bucket public and sharing the URL
      3. CA signed URL regenerated by hand each week
      4. DA role in your account that the partner account assumes, scoped to that bucket

    5. 6. A permissions boundary can grant a principal permissions it does not otherwise have. Domain 1 · Design Secure Architectures

      1. 7. Instances in a private subnet must download OS patches from the internet but must never be reachable from it. What provides this? Domain 1 · Design Secure Architectures

        1. AAn egress-only internet gateway
        2. BA NAT gateway in a public subnet, with a route from the private subnet
        3. CA security group rule allowing outbound 443
        4. DAn internet gateway attached directly to the private subnet

      2. 8. An application in a private subnet writes to S3. The team wants that traffic never to traverse the internet and wants to stop paying NAT data processing charges for it. What should they add? Domain 1 · Design Secure Architectures

        1. AA VPN connection to the S3 endpoint
        2. BA gateway VPC endpoint for S3
        3. CAn interface VPC endpoint for EC2
        4. DA second NAT gateway in another zone

      3. 9. A subnet must deny all traffic from one abusive CIDR range, while the instances inside it keep their existing security groups. What is the right control? Domain 1 · Design Secure Architectures

        1. AAn AWS WAF rule on the instances
        2. BA route table entry pointing that CIDR at a black hole
        3. CA deny rule in the security group
        4. DA deny rule in the network ACL for that subnet

      4. 10. A security group that allows inbound port 443 also needs an outbound rule for the response traffic. Domain 1 · Design Secure Architectures

        Check your answers

        The mock marks every answer on submit, explains it and breaks the result down by domain. It draws its questions in the published domain weights, and passes at 72% — The real exam scales scores to 1000 and passes at 720. A mock cannot reproduce that scaling, so 72% of questions is used as an approximation.

        Start the SAA-C03 mock exam

        Not ready yet? The AWS course covers the same domains in short lessons, each with its own questions.

        Exam facts are taken from the official page: d1.awsstatic.com. Questions here are written for practice and are not from the real exam.