SAA-C03 practice questions: 10 free samples from the AWS mock exam

10 questions in the style of the AWS Certified Solutions Architect – Associate exam, with their answer options. They are 10 of the 77 in the pool the mock draws from; answers and explanations come back when you sit it, and every question is marked against its domain so you can see where you stand.

Sit the full 65-question mock — free, no account

  1. 1. What does deploying across two Availability Zones protect you from? The shape of it

    1. AThe loss of one data centre campus within the Region
    2. BA mistake in your own configuration
    3. CThe loss of the whole Region
    4. DA price rise

  2. 2. An IAM policy that denies an action can be overridden by another policy that allows it. Identity

    1. 3. What is the catch with Infrequent Access for data you actually read often? Compute and storage

      1. ARetrieval is charged per gigabyte, so frequent reads can cost more than Standard
      2. BIt is only available in some Regions
      3. CThe data is less durable
      4. DObjects take hours to restore

    2. 4. Which of these usually costs nothing? The bill

      1. AData crossing between Availability Zones
      2. BData through a NAT gateway
      3. CData coming into AWS from the internet
      4. DData leaving to the internet

    3. 5. An application on EC2 needs to read one S3 bucket. Security forbids storing credentials on the instance. What should the architect use? Domain 1 · Design Secure Architectures

      1. AAn IAM role attached to the instance through an instance profile
      2. BA bucket policy allowing anonymous reads from the instance IP
      3. CThe account root user credentials in an environment variable
      4. DAn IAM user with access keys placed in the application config

    4. 6. An external partner needs read access to a bucket for six months, and has their own AWS account. What is the least-privilege design? Domain 1 · Design Secure Architectures

      1. AA signed URL regenerated by hand each week
      2. BA role in your account that the partner account assumes, scoped to that bucket
      3. CAn IAM user in your account with keys emailed to the partner
      4. DMaking the bucket public and sharing the URL

    5. 7. A permissions boundary can grant a principal permissions it does not otherwise have. Domain 1 · Design Secure Architectures

      1. 8. Instances in a private subnet must download OS patches from the internet but must never be reachable from it. What provides this? Domain 1 · Design Secure Architectures

        1. AA security group rule allowing outbound 443
        2. BAn egress-only internet gateway
        3. CAn internet gateway attached directly to the private subnet
        4. DA NAT gateway in a public subnet, with a route from the private subnet

      2. 9. An application in a private subnet writes to S3. The team wants that traffic never to traverse the internet and wants to stop paying NAT data processing charges for it. What should they add? Domain 1 · Design Secure Architectures

        1. AA second NAT gateway in another zone
        2. BA VPN connection to the S3 endpoint
        3. CA gateway VPC endpoint for S3
        4. DAn interface VPC endpoint for EC2

      3. 10. A subnet must deny all traffic from one abusive CIDR range, while the instances inside it keep their existing security groups. What is the right control? Domain 1 · Design Secure Architectures

        1. AAn AWS WAF rule on the instances
        2. BA deny rule in the security group
        3. CA route table entry pointing that CIDR at a black hole
        4. DA deny rule in the network ACL for that subnet

      Check your answers

      The mock marks every answer on submit, explains it and breaks the result down by domain. It draws its questions in the published domain weights, and passes at 72% — The real exam scales scores to 1000 and passes at 720. A mock cannot reproduce that scaling, so 72% of questions is used as an approximation.

      Start the SAA-C03 mock exam

      Not ready yet? The AWS course covers the same domains in short lessons, each with its own questions.

      Exam facts are taken from the official page: d1.awsstatic.com. Questions here are written for practice and are not from the real exam.