2026/2027
AWS Certified Solutions Architect –
Associate (SAA-C03) The Definitive
Study and Exam Prep Guide:
Comprehensive Topic Review,
Realistic Practice Questions,
Complete Test Bank Mastery, and
Advanced Preparation Manual
Question 1
A global environmental-monitoring company generates approximately 500 GB of
data daily at each collection site. Every site has a high-speed internet connection. The
company must upload data from all sites into one Amazon S3 bucket as quickly as
possible while minimizing operational complexity. Which solution should the
company implement?
A. Enable S3 Transfer Acceleration and use multipart uploads directly to the
destination bucket.
B. Upload data to regional S3 buckets and configure S3 Cross-Region Replication.
C. Request an AWS Snowball Edge device for every site each day.
D. Establish a separate AWS Direct Connect connection from every collection site.
Correct Answer: A
Rationale:
S3 Transfer Acceleration uses AWS edge locations and the AWS global network to
speed long-distance uploads, and multipart upload improves throughput and
resiliency for large objects. That combination best matches fast uploads with low
operational overhead. (AMAZON)
Question 2: Querying S3 logs
An organization stores application logs as JSON objects in Amazon S3. Analysts
occasionally need to run simple SQL queries against the logs. Queries are
unpredictable and do not require a continuously running analytics platform. Which
solution provides the lowest operational overhead?
A. Load the data into an Amazon Redshift provisioned cluster.
B. Transfer the logs to Amazon CloudWatch Logs Insights.
C. Query the objects directly by using Amazon Athena.
D. Create an Amazon EMR cluster whenever analysts need results.
,2026/2027
Correct Answer: C
Rationale:
Amazon Athena is serverless and lets you run SQL directly against data in S3 with no
infrastructure to manage, which makes it ideal for ad hoc, unpredictable queries.
(AMAZON)
Question 3: Restricting S3 access to an AWS Organization
A company uses AWS Organizations to manage accounts belonging to multiple
departments. A central Amazon S3 bucket must be accessible only by principals
whose AWS accounts are members of the company’s organization. Which bucket
policy condition provides the simplest solution?
A. aws:PrincipalOrgID
B. aws:PrincipalTag
C. aws:SourceIp
D. aws:RequestedRegion
Correct Answer: A
Rationale:
aws:PrincipalOrgID is the global condition key designed to restrict access to
principals in a specified AWS Organization, which is simpler and more scalable than
tagging or IP-based controls. (AMAZON)
Question 4: Private S3 access from private subnets
Amazon EC2 instances in private subnets process log files stored in Amazon S3.
Company policy prohibits the instances from using an internet gateway or NAT
gateway to reach S3. Which solution provides private connectivity with the lowest
cost and operational overhead?
A. Create an S3 gateway VPC endpoint and update the private subnet route tables.
B. Assign public IP addresses to the EC2 instances.
C. Create an AWS Site-to-Site VPN connection to Amazon S3.
D. Deploy an HTTP proxy on another EC2 instance.
Correct Answer: A
Rationale:
An S3 gateway endpoint provides private access to S3 from a VPC without requiring
an internet gateway or NAT gateway, and it has no additional charge. (AMAZON)
,2026/2027
Question 5: Shared file storage for EC2
A web application runs on two EC2 instances in different Availability Zones behind
an Application Load Balancer. Each instance stores uploaded documents on its own
EBS volume. Users see different documents depending on which instance processes
their request. Which solution provides shared, highly available file storage?
A. Enable Application Load Balancer stickiness permanently.
B. Copy every document between the two EBS volumes periodically.
C. Migrate the documents to Amazon EFS and mount the file system on both
instances.
D. Attach the same EBS volume to both instances in different Availability Zones.
Correct Answer: C
Rationale:
Amazon EFS is a managed shared file system that can be mounted concurrently by
multiple EC2 instances across multiple Availability Zones, making it the right choice
for shared, highly available file storage. (AMAZON)
Question 6: Rapid 70 TB migration to S3
A company must migrate 70 TB of video files from an on-premises NFS system to
Amazon S3. The data is no longer growing, and the company wants to complete the
migration rapidly while consuming the least possible network bandwidth. Which
solution is most appropriate?
A. Copy the files to S3 by using the AWS CLI over the internet.
B. Use an AWS Snowball Edge Storage Optimized device.
C. Deploy an S3 File Gateway and copy all files through the gateway.
D. Establish a new VPN and transfer the files through the VPN.
Correct Answer: B
Rationale:
Snowball Edge is intended for large offline data transfers when you want to avoid
consuming network bandwidth and need faster migration than network transfer would
provide. (AMAZON)
Question 7: High-throughput event streaming
A messaging application must ingest traffic that can suddenly increase to 100,000
messages per second. Multiple independent applications need to consume the
messages in near real time. The solution must be scalable, durable, and loosely
coupled. Which architecture best meets these requirements?
, 2026/2027
A. Store the messages in Amazon Kinesis Data Streams and allow each consumer to
process the stream independently.
B. Store all messages in an Amazon RDS table that consumers poll.
C. Use a single-shard Kinesis stream and write every message to one Lambda
function.
D. Send messages directly from the producer to each consumer application.
Correct Answer: A
Rationale:
Kinesis Data Streams supports real-time ingestion with multiple consumers and
scalable throughput, which fits this use case better than a database or tightly coupled
direct delivery. (AMAZON)
Question 8: Decoupling jobs with scalable workers
A legacy distributed application uses a central server to assign jobs to compute nodes.
Workload volume varies significantly. The company wants to remove the central
server as a single point of failure and scale workers according to pending work.
Which design is most appropriate?
A. Store jobs in Amazon SQS and scale an EC2 Auto Scaling group according to
queue backlog.
B. Store jobs in AWS CloudTrail and scale workers according to API-call volume.
C. Use scheduled scaling without considering the number of pending jobs.
D. Place jobs on an EBS volume attached to one coordinator instance.
Correct Answer: A
Rationale:
SQS decouples producers from consumers and preserves pending work durably.
Scaling workers based on queue depth is the standard pattern for variable workloads.
(AMAZON)
Question 9: SMB storage with archival
A company’s on-premises SMB file server is approaching capacity. New files require
low-latency access, but files are rarely accessed after seven days. The company wants
to extend storage without changing users’ SMB access patterns and automatically
archive older files. Which solution should be implemented?
A. Deploy an Amazon S3 File Gateway and configure an S3 Lifecycle policy.
B. Install the AWS CLI on every employee workstation.
C. Move all files directly to S3 Glacier Deep Archive.
D. Create a larger local file server without lifecycle management.
AWS Certified Solutions Architect –
Associate (SAA-C03) The Definitive
Study and Exam Prep Guide:
Comprehensive Topic Review,
Realistic Practice Questions,
Complete Test Bank Mastery, and
Advanced Preparation Manual
Question 1
A global environmental-monitoring company generates approximately 500 GB of
data daily at each collection site. Every site has a high-speed internet connection. The
company must upload data from all sites into one Amazon S3 bucket as quickly as
possible while minimizing operational complexity. Which solution should the
company implement?
A. Enable S3 Transfer Acceleration and use multipart uploads directly to the
destination bucket.
B. Upload data to regional S3 buckets and configure S3 Cross-Region Replication.
C. Request an AWS Snowball Edge device for every site each day.
D. Establish a separate AWS Direct Connect connection from every collection site.
Correct Answer: A
Rationale:
S3 Transfer Acceleration uses AWS edge locations and the AWS global network to
speed long-distance uploads, and multipart upload improves throughput and
resiliency for large objects. That combination best matches fast uploads with low
operational overhead. (AMAZON)
Question 2: Querying S3 logs
An organization stores application logs as JSON objects in Amazon S3. Analysts
occasionally need to run simple SQL queries against the logs. Queries are
unpredictable and do not require a continuously running analytics platform. Which
solution provides the lowest operational overhead?
A. Load the data into an Amazon Redshift provisioned cluster.
B. Transfer the logs to Amazon CloudWatch Logs Insights.
C. Query the objects directly by using Amazon Athena.
D. Create an Amazon EMR cluster whenever analysts need results.
,2026/2027
Correct Answer: C
Rationale:
Amazon Athena is serverless and lets you run SQL directly against data in S3 with no
infrastructure to manage, which makes it ideal for ad hoc, unpredictable queries.
(AMAZON)
Question 3: Restricting S3 access to an AWS Organization
A company uses AWS Organizations to manage accounts belonging to multiple
departments. A central Amazon S3 bucket must be accessible only by principals
whose AWS accounts are members of the company’s organization. Which bucket
policy condition provides the simplest solution?
A. aws:PrincipalOrgID
B. aws:PrincipalTag
C. aws:SourceIp
D. aws:RequestedRegion
Correct Answer: A
Rationale:
aws:PrincipalOrgID is the global condition key designed to restrict access to
principals in a specified AWS Organization, which is simpler and more scalable than
tagging or IP-based controls. (AMAZON)
Question 4: Private S3 access from private subnets
Amazon EC2 instances in private subnets process log files stored in Amazon S3.
Company policy prohibits the instances from using an internet gateway or NAT
gateway to reach S3. Which solution provides private connectivity with the lowest
cost and operational overhead?
A. Create an S3 gateway VPC endpoint and update the private subnet route tables.
B. Assign public IP addresses to the EC2 instances.
C. Create an AWS Site-to-Site VPN connection to Amazon S3.
D. Deploy an HTTP proxy on another EC2 instance.
Correct Answer: A
Rationale:
An S3 gateway endpoint provides private access to S3 from a VPC without requiring
an internet gateway or NAT gateway, and it has no additional charge. (AMAZON)
,2026/2027
Question 5: Shared file storage for EC2
A web application runs on two EC2 instances in different Availability Zones behind
an Application Load Balancer. Each instance stores uploaded documents on its own
EBS volume. Users see different documents depending on which instance processes
their request. Which solution provides shared, highly available file storage?
A. Enable Application Load Balancer stickiness permanently.
B. Copy every document between the two EBS volumes periodically.
C. Migrate the documents to Amazon EFS and mount the file system on both
instances.
D. Attach the same EBS volume to both instances in different Availability Zones.
Correct Answer: C
Rationale:
Amazon EFS is a managed shared file system that can be mounted concurrently by
multiple EC2 instances across multiple Availability Zones, making it the right choice
for shared, highly available file storage. (AMAZON)
Question 6: Rapid 70 TB migration to S3
A company must migrate 70 TB of video files from an on-premises NFS system to
Amazon S3. The data is no longer growing, and the company wants to complete the
migration rapidly while consuming the least possible network bandwidth. Which
solution is most appropriate?
A. Copy the files to S3 by using the AWS CLI over the internet.
B. Use an AWS Snowball Edge Storage Optimized device.
C. Deploy an S3 File Gateway and copy all files through the gateway.
D. Establish a new VPN and transfer the files through the VPN.
Correct Answer: B
Rationale:
Snowball Edge is intended for large offline data transfers when you want to avoid
consuming network bandwidth and need faster migration than network transfer would
provide. (AMAZON)
Question 7: High-throughput event streaming
A messaging application must ingest traffic that can suddenly increase to 100,000
messages per second. Multiple independent applications need to consume the
messages in near real time. The solution must be scalable, durable, and loosely
coupled. Which architecture best meets these requirements?
, 2026/2027
A. Store the messages in Amazon Kinesis Data Streams and allow each consumer to
process the stream independently.
B. Store all messages in an Amazon RDS table that consumers poll.
C. Use a single-shard Kinesis stream and write every message to one Lambda
function.
D. Send messages directly from the producer to each consumer application.
Correct Answer: A
Rationale:
Kinesis Data Streams supports real-time ingestion with multiple consumers and
scalable throughput, which fits this use case better than a database or tightly coupled
direct delivery. (AMAZON)
Question 8: Decoupling jobs with scalable workers
A legacy distributed application uses a central server to assign jobs to compute nodes.
Workload volume varies significantly. The company wants to remove the central
server as a single point of failure and scale workers according to pending work.
Which design is most appropriate?
A. Store jobs in Amazon SQS and scale an EC2 Auto Scaling group according to
queue backlog.
B. Store jobs in AWS CloudTrail and scale workers according to API-call volume.
C. Use scheduled scaling without considering the number of pending jobs.
D. Place jobs on an EBS volume attached to one coordinator instance.
Correct Answer: A
Rationale:
SQS decouples producers from consumers and preserves pending work durably.
Scaling workers based on queue depth is the standard pattern for variable workloads.
(AMAZON)
Question 9: SMB storage with archival
A company’s on-premises SMB file server is approaching capacity. New files require
low-latency access, but files are rarely accessed after seven days. The company wants
to extend storage without changing users’ SMB access patterns and automatically
archive older files. Which solution should be implemented?
A. Deploy an Amazon S3 File Gateway and configure an S3 Lifecycle policy.
B. Install the AWS CLI on every employee workstation.
C. Move all files directly to S3 Glacier Deep Archive.
D. Create a larger local file server without lifecycle management.
