AWS Certified Solutions Architect – Associate (SAA-C03) actual Exam
2026/ 2027 questions and well detailed answers
1. A company is hosting a web application on Amazon EC2 instances behind an
Application Load Balancer (ALB). The instances are in an Auto Scaling group
across multiple Availability Zones (AZs). Security requirements state that
database connections from the EC2 instances must be encrypted and must
use rotating credentials without hardcoding them in the application code.
Which solution meets these requirements securely?
• A) Store the database password in a plain text configuration file on an
Amazon EBS volume, and encrypt the EBS volume using AWS KMS.
• B) Store the database credentials in AWS Secrets Manager and use IAM
roles for EC2 instances to retrieve the credentials dynamically and establish
an SSL/TLS connection to the database.
• C) Store the database credentials in an Amazon S3 bucket with public read
access disabled, and download the credentials file on application startup.
• D) Hardcode the database credentials in the application environment
variables using AWS Systems Manager Parameter Store with standard text
storage.
• Correct Answer: B) Store the database credentials in AWS Secrets Manager
and use IAM roles for EC2 instances to retrieve the credentials dynamically
and establish an SSL/TLS connection to the database.
• Explanation: AWS Secrets Manager securely stores secrets and supports
automatic credential rotation. Using IAM roles for EC2 provides temporary
security credentials without hardcoding, and SSL/TLS ensures encryption in
transit for database connections.
2. A solutions architect is designing an architecture for a data analytics
application. The application processes large amounts of data stored in
Amazon S3. The processing jobs run on Amazon EC2 instances and can take
several hours to complete. If a job is interrupted, it must be able to resume
quickly from where it left off, and cost optimization is a primary goal. Which
,AWS Certified Solutions Architect – Associate (SAA-C03) actual Exam
2026/ 2027 questions and well detailed answers
EC2 purchasing option provides the most cost-effective and resilient
solution?
• A) On-Demand Instances
• B) Reserved Instances
• C) Spot Instances with a Spot Instance interruption notice handler
• D) Dedicated Hosts
• Correct Answer: C) Spot Instances with a Spot Instance interruption notice
handler
• Explanation: Spot Instances offer discounts of up to 90% compared to On-
Demand prices, making them ideal for fault-tolerant and flexible workloads.
Since the application handles interruptions and can resume, Spot Instances
provide optimal cost savings.
3. An enterprise application runs on Amazon EC2 instances behind an
Application Load Balancer (ALB). During traffic spikes, the application
experiences high latency because the database struggles with heavy read
loads. The database is currently running on a single Amazon RDS MySQL
instance. What is the most operationally efficient way to scale the read
performance of the database?
• A) Migrate the database to Amazon DynamoDB with global tables enabled.
• B) Create multiple Amazon RDS Read Replicas in the same or different
Availability Zones and configure the application to route read queries to the
replicas.
• C) Convert the single RDS instance into a Multi-AZ deployment.
• D) Take daily Amazon EBS snapshots of the database volume and restore
them to new instances during peak hours.
,AWS Certified Solutions Architect – Associate (SAA-C03) actual Exam
2026/ 2027 questions and well detailed answers
• Correct Answer: B) Create multiple Amazon RDS Read Replicas in the same
or different Availability Zones and configure the application to route read
queries to the replicas.
• Explanation: RDS Read Replicas scale out read-heavy database workloads.
A Multi-AZ deployment is designed for high availability and disaster
recovery, not read performance scaling.
4. A financial services company needs to store transactional logs for 7 years to
comply with regulatory requirements. The logs are rarely accessed after 30
days, but when an audit occurs, the logs must be retrievable within
minutes. Which storage solution is the most cost-effective?
• A) Amazon S3 Standard
• B) Amazon S3 Glacier Flexible Retrieval with Expedited retrievals enabled
• C) Amazon S3 Intelligent-Tiering
• D) Amazon S3 Standard-Infrequent Access (S3 Standard-IA)
• Correct Answer: B) Amazon S3 Glacier Flexible Retrieval with Expedited
retrievals enabled
• Explanation: S3 Glacier Flexible Retrieval is designed for long-term archival
storage at a very low cost. Expedited retrievals allow data access within 1–5
minutes when needed for audits, while lifecycle policies can transition
objects after 30 days.
5. A company is deploying a global web application using Amazon CloudFront
with an Amazon S3 bucket as the origin. Security policy dictates that users
must not be able to access the S3 bucket directly via its public S3 website
URL; they must access content exclusively through CloudFront. How can this
requirement be achieved?
• A) Configure an S3 bucket policy that allows public read access only from
the IP addresses of the user's local office.
, AWS Certified Solutions Architect – Associate (SAA-C03) actual Exam
2026/ 2027 questions and well detailed answers
• B) Use Origin Access Control (OAC) in CloudFront and update the S3 bucket
policy to allow only CloudFront service principal to access the bucket.
• C) Make the S3 bucket private and configure an IAM user for every web
visitor to authenticate requests.
• D) Configure a Route 53 DNS record that points directly to the S3 bucket
without CloudFront.
• Correct Answer: B) Use Origin Access Control (OAC) in CloudFront and
update the S3 bucket policy to allow only CloudFront service principal to
access the bucket.
• Explanation: CloudFront Origin Access Control (OAC) (and the legacy OAI)
securely restricts access to an S3 bucket so that only CloudFront can fetch
content, blocking direct public access to S3.
6. A solutions architect is designing a multi-tier web application in a VPC. The
architecture includes public subnets for the load balancers and private
subnets for the web servers and database instances. The web servers
require occasional access to external APIs over the internet to fetch data
updates, but they must not accept inbound connections from the internet.
What is the most secure way to provide internet access to the web servers?
• A) Attach a public IPv4 address directly to each web server EC2 instance.
• B) Deploy a NAT Gateway in the public subnet and route outbound traffic
from the private subnets through the NAT Gateway.
• C) Create an Internet Gateway and attach it directly to the private subnets.
• D) Use an egress-only Internet Gateway for IPv4 traffic.
• Correct Answer: B) Deploy a NAT Gateway in the public subnet and route
outbound traffic from the private subnets through the NAT Gateway.
• Explanation: A NAT Gateway allows instances in private subnets to initiate
outbound connections to the internet while preventing any unsolicited
inbound connections from the internet.
2026/ 2027 questions and well detailed answers
1. A company is hosting a web application on Amazon EC2 instances behind an
Application Load Balancer (ALB). The instances are in an Auto Scaling group
across multiple Availability Zones (AZs). Security requirements state that
database connections from the EC2 instances must be encrypted and must
use rotating credentials without hardcoding them in the application code.
Which solution meets these requirements securely?
• A) Store the database password in a plain text configuration file on an
Amazon EBS volume, and encrypt the EBS volume using AWS KMS.
• B) Store the database credentials in AWS Secrets Manager and use IAM
roles for EC2 instances to retrieve the credentials dynamically and establish
an SSL/TLS connection to the database.
• C) Store the database credentials in an Amazon S3 bucket with public read
access disabled, and download the credentials file on application startup.
• D) Hardcode the database credentials in the application environment
variables using AWS Systems Manager Parameter Store with standard text
storage.
• Correct Answer: B) Store the database credentials in AWS Secrets Manager
and use IAM roles for EC2 instances to retrieve the credentials dynamically
and establish an SSL/TLS connection to the database.
• Explanation: AWS Secrets Manager securely stores secrets and supports
automatic credential rotation. Using IAM roles for EC2 provides temporary
security credentials without hardcoding, and SSL/TLS ensures encryption in
transit for database connections.
2. A solutions architect is designing an architecture for a data analytics
application. The application processes large amounts of data stored in
Amazon S3. The processing jobs run on Amazon EC2 instances and can take
several hours to complete. If a job is interrupted, it must be able to resume
quickly from where it left off, and cost optimization is a primary goal. Which
,AWS Certified Solutions Architect – Associate (SAA-C03) actual Exam
2026/ 2027 questions and well detailed answers
EC2 purchasing option provides the most cost-effective and resilient
solution?
• A) On-Demand Instances
• B) Reserved Instances
• C) Spot Instances with a Spot Instance interruption notice handler
• D) Dedicated Hosts
• Correct Answer: C) Spot Instances with a Spot Instance interruption notice
handler
• Explanation: Spot Instances offer discounts of up to 90% compared to On-
Demand prices, making them ideal for fault-tolerant and flexible workloads.
Since the application handles interruptions and can resume, Spot Instances
provide optimal cost savings.
3. An enterprise application runs on Amazon EC2 instances behind an
Application Load Balancer (ALB). During traffic spikes, the application
experiences high latency because the database struggles with heavy read
loads. The database is currently running on a single Amazon RDS MySQL
instance. What is the most operationally efficient way to scale the read
performance of the database?
• A) Migrate the database to Amazon DynamoDB with global tables enabled.
• B) Create multiple Amazon RDS Read Replicas in the same or different
Availability Zones and configure the application to route read queries to the
replicas.
• C) Convert the single RDS instance into a Multi-AZ deployment.
• D) Take daily Amazon EBS snapshots of the database volume and restore
them to new instances during peak hours.
,AWS Certified Solutions Architect – Associate (SAA-C03) actual Exam
2026/ 2027 questions and well detailed answers
• Correct Answer: B) Create multiple Amazon RDS Read Replicas in the same
or different Availability Zones and configure the application to route read
queries to the replicas.
• Explanation: RDS Read Replicas scale out read-heavy database workloads.
A Multi-AZ deployment is designed for high availability and disaster
recovery, not read performance scaling.
4. A financial services company needs to store transactional logs for 7 years to
comply with regulatory requirements. The logs are rarely accessed after 30
days, but when an audit occurs, the logs must be retrievable within
minutes. Which storage solution is the most cost-effective?
• A) Amazon S3 Standard
• B) Amazon S3 Glacier Flexible Retrieval with Expedited retrievals enabled
• C) Amazon S3 Intelligent-Tiering
• D) Amazon S3 Standard-Infrequent Access (S3 Standard-IA)
• Correct Answer: B) Amazon S3 Glacier Flexible Retrieval with Expedited
retrievals enabled
• Explanation: S3 Glacier Flexible Retrieval is designed for long-term archival
storage at a very low cost. Expedited retrievals allow data access within 1–5
minutes when needed for audits, while lifecycle policies can transition
objects after 30 days.
5. A company is deploying a global web application using Amazon CloudFront
with an Amazon S3 bucket as the origin. Security policy dictates that users
must not be able to access the S3 bucket directly via its public S3 website
URL; they must access content exclusively through CloudFront. How can this
requirement be achieved?
• A) Configure an S3 bucket policy that allows public read access only from
the IP addresses of the user's local office.
, AWS Certified Solutions Architect – Associate (SAA-C03) actual Exam
2026/ 2027 questions and well detailed answers
• B) Use Origin Access Control (OAC) in CloudFront and update the S3 bucket
policy to allow only CloudFront service principal to access the bucket.
• C) Make the S3 bucket private and configure an IAM user for every web
visitor to authenticate requests.
• D) Configure a Route 53 DNS record that points directly to the S3 bucket
without CloudFront.
• Correct Answer: B) Use Origin Access Control (OAC) in CloudFront and
update the S3 bucket policy to allow only CloudFront service principal to
access the bucket.
• Explanation: CloudFront Origin Access Control (OAC) (and the legacy OAI)
securely restricts access to an S3 bucket so that only CloudFront can fetch
content, blocking direct public access to S3.
6. A solutions architect is designing a multi-tier web application in a VPC. The
architecture includes public subnets for the load balancers and private
subnets for the web servers and database instances. The web servers
require occasional access to external APIs over the internet to fetch data
updates, but they must not accept inbound connections from the internet.
What is the most secure way to provide internet access to the web servers?
• A) Attach a public IPv4 address directly to each web server EC2 instance.
• B) Deploy a NAT Gateway in the public subnet and route outbound traffic
from the private subnets through the NAT Gateway.
• C) Create an Internet Gateway and attach it directly to the private subnets.
• D) Use an egress-only Internet Gateway for IPv4 traffic.
• Correct Answer: B) Deploy a NAT Gateway in the public subnet and route
outbound traffic from the private subnets through the NAT Gateway.
• Explanation: A NAT Gateway allows instances in private subnets to initiate
outbound connections to the internet while preventing any unsolicited
inbound connections from the internet.
