AWS Certified Solutions Architect – Associate (SAA-
C03) – 2026/2027 – Questions & Verified Answers
with Rationales – Grade A+
Introduction
This practice exam is designed to simulate the rigor and format of the AWS
Certified Solutions Architect – Associate (SAA-C03) exam. It contains 200 original
questions distributed across the four official exam domains according to their
published weightings:
• Design Secure Architectures – 30% (60 questions)
• Design Resilient Architectures – 26% (52 questions)
• Design High-Performing Architectures – 24% (48 questions)
• Design Cost-Optimized Architectures – 20% (40 questions)
.
Chapter 1: Design Secure Architectures (Questions 1–60)
Domain weight: 30%
Official tasks: 1.1 Design secure access to AWS resources; 1.2 Design secure
workloads and applications; 1.3 Determine appropriate data security controls.
Question 1
A company is migrating a web application to AWS. The application stores sensitive
customer data and must comply with PCI DSS. The security team requires that
data be encrypted at rest and in transit, with the company managing its own
encryption keys. Which solution meets these requirements?
A. Use S3 with SSE-S3 encryption and HTTPS
B. Use S3 with SSE-KMS using customer-managed keys and HTTPS
,C. Use S3 with SSE-C and HTTP for internal traffic
D. Use S3 with client-side encryption only
Correct: B
Rationale: SSE-KMS with customer-managed keys (CMKs) allows the
company to control the encryption keys while meeting PCI DSS requirements for
encryption at rest. HTTPS ensures encryption in transit. SSE-S3 uses AWS-
managed keys, which does not satisfy the requirement for customer-managed
keys. SSE-C requires the customer to manage the key material and transfer it with
each request, which is operationally complex and does not address transit
encryption. Client-side encryption alone does not ensure encryption in transit
unless combined with HTTPS.
Question 2
An application running on EC2 instances needs to access an S3 bucket. The
security team requires that credentials should not be stored on the instances and
should automatically rotate. Which solution should be used?
A. Store AWS access keys in environment variables
B. Use an IAM role attached to the EC2 instances
C. Store credentials in AWS Secrets Manager and retrieve at startup
D. Embed credentials in the application code
Correct: B
Rationale: IAM roles for EC2 provide temporary credentials that
automatically rotate. The EC2 instance assumes the role and receives temporary
credentials via the instance metadata service. This is the AWS best practice for
granting permissions to EC2 instances. Storing access keys in environment
variables or code is insecure and does not rotate automatically. Secrets Manager
can store credentials, but it is unnecessary when IAM roles provide the required
access.
,Question 3
A company needs to allow users from their corporate Active Directory to access
AWS resources without creating separate IAM users. Users should have different
permissions based on their AD group membership. Which solution meets these
requirements?
A. Create IAM users for each AD user with matching permissions
B. Use AWS IAM Identity Center (SSO) with AD integration
C. Share IAM access keys with AD administrators
D. Use Amazon Cognito User Pools
Correct: B
Rationale: IAM Identity Center (formerly AWS SSO) integrates with
corporate Active Directory and allows mapping AD groups to AWS permission
sets. Users authenticate with their existing AD credentials. Creating individual IAM
users is operationally inefficient and does not scale. Sharing access keys is a
security anti-pattern. Cognito is for customer identity, not employee federation.
Question 4
A web application receives traffic from the internet and needs protection against
SQL injection and cross-site scripting attacks. The application runs on EC2
instances behind an Application Load Balancer. Which service should be
deployed?
A. Configure Security Groups to block malicious traffic
B. Deploy AWS WAF with ALB and configure managed rules
C. Enable AWS Shield Standard
D. Use Network ACLs to filter traffic
Correct: B
Rationale: AWS WAF protects against common web exploits like SQL
injection and XSS. It integrates with ALB and provides managed rule sets for
common attacks. Security Groups and NACLs operate at layers 3/4 and cannot
inspect application-layer attacks. Shield protects against DDoS, not application-
layer exploits.
, Question 5 (SATA)
A solutions architect is designing a secure VPC for a three-tier application. Which
of the following are appropriate security controls for the database tier? (Select
TWO.)
A. Place the database in a public subnet
B. Use a security group that allows traffic only from the application tier security
group
C. Enable encryption at rest for the database
D. Assign a public IP address to the database instance
E. Use a network ACL that allows all inbound traffic
Correct: B, C
Rationale: Database instances should be placed in private subnets, not
public subnets. A security group that allows traffic only from the application tier
security group enforces least privilege. Encryption at rest protects data
confidentiality. Public IP addresses and permissive NACLs increase attack surface.
Question 6
A company wants to ensure that all API calls made to AWS services in its account
are logged and can be audited. The logs must be retained for 7 years. Which
service should be used?
A. AWS Config
B. AWS CloudTrail
C. Amazon CloudWatch Logs
D. AWS Trusted Advisor
Correct: B
Rationale: AWS CloudTrail records API calls made in the account, including
the identity of the caller, the time of the call, the source IP address, and more.
CloudTrail logs can be delivered to S3 for long-term retention. AWS Config records
C03) – 2026/2027 – Questions & Verified Answers
with Rationales – Grade A+
Introduction
This practice exam is designed to simulate the rigor and format of the AWS
Certified Solutions Architect – Associate (SAA-C03) exam. It contains 200 original
questions distributed across the four official exam domains according to their
published weightings:
• Design Secure Architectures – 30% (60 questions)
• Design Resilient Architectures – 26% (52 questions)
• Design High-Performing Architectures – 24% (48 questions)
• Design Cost-Optimized Architectures – 20% (40 questions)
.
Chapter 1: Design Secure Architectures (Questions 1–60)
Domain weight: 30%
Official tasks: 1.1 Design secure access to AWS resources; 1.2 Design secure
workloads and applications; 1.3 Determine appropriate data security controls.
Question 1
A company is migrating a web application to AWS. The application stores sensitive
customer data and must comply with PCI DSS. The security team requires that
data be encrypted at rest and in transit, with the company managing its own
encryption keys. Which solution meets these requirements?
A. Use S3 with SSE-S3 encryption and HTTPS
B. Use S3 with SSE-KMS using customer-managed keys and HTTPS
,C. Use S3 with SSE-C and HTTP for internal traffic
D. Use S3 with client-side encryption only
Correct: B
Rationale: SSE-KMS with customer-managed keys (CMKs) allows the
company to control the encryption keys while meeting PCI DSS requirements for
encryption at rest. HTTPS ensures encryption in transit. SSE-S3 uses AWS-
managed keys, which does not satisfy the requirement for customer-managed
keys. SSE-C requires the customer to manage the key material and transfer it with
each request, which is operationally complex and does not address transit
encryption. Client-side encryption alone does not ensure encryption in transit
unless combined with HTTPS.
Question 2
An application running on EC2 instances needs to access an S3 bucket. The
security team requires that credentials should not be stored on the instances and
should automatically rotate. Which solution should be used?
A. Store AWS access keys in environment variables
B. Use an IAM role attached to the EC2 instances
C. Store credentials in AWS Secrets Manager and retrieve at startup
D. Embed credentials in the application code
Correct: B
Rationale: IAM roles for EC2 provide temporary credentials that
automatically rotate. The EC2 instance assumes the role and receives temporary
credentials via the instance metadata service. This is the AWS best practice for
granting permissions to EC2 instances. Storing access keys in environment
variables or code is insecure and does not rotate automatically. Secrets Manager
can store credentials, but it is unnecessary when IAM roles provide the required
access.
,Question 3
A company needs to allow users from their corporate Active Directory to access
AWS resources without creating separate IAM users. Users should have different
permissions based on their AD group membership. Which solution meets these
requirements?
A. Create IAM users for each AD user with matching permissions
B. Use AWS IAM Identity Center (SSO) with AD integration
C. Share IAM access keys with AD administrators
D. Use Amazon Cognito User Pools
Correct: B
Rationale: IAM Identity Center (formerly AWS SSO) integrates with
corporate Active Directory and allows mapping AD groups to AWS permission
sets. Users authenticate with their existing AD credentials. Creating individual IAM
users is operationally inefficient and does not scale. Sharing access keys is a
security anti-pattern. Cognito is for customer identity, not employee federation.
Question 4
A web application receives traffic from the internet and needs protection against
SQL injection and cross-site scripting attacks. The application runs on EC2
instances behind an Application Load Balancer. Which service should be
deployed?
A. Configure Security Groups to block malicious traffic
B. Deploy AWS WAF with ALB and configure managed rules
C. Enable AWS Shield Standard
D. Use Network ACLs to filter traffic
Correct: B
Rationale: AWS WAF protects against common web exploits like SQL
injection and XSS. It integrates with ALB and provides managed rule sets for
common attacks. Security Groups and NACLs operate at layers 3/4 and cannot
inspect application-layer attacks. Shield protects against DDoS, not application-
layer exploits.
, Question 5 (SATA)
A solutions architect is designing a secure VPC for a three-tier application. Which
of the following are appropriate security controls for the database tier? (Select
TWO.)
A. Place the database in a public subnet
B. Use a security group that allows traffic only from the application tier security
group
C. Enable encryption at rest for the database
D. Assign a public IP address to the database instance
E. Use a network ACL that allows all inbound traffic
Correct: B, C
Rationale: Database instances should be placed in private subnets, not
public subnets. A security group that allows traffic only from the application tier
security group enforces least privilege. Encryption at rest protects data
confidentiality. Public IP addresses and permissive NACLs increase attack surface.
Question 6
A company wants to ensure that all API calls made to AWS services in its account
are logged and can be audited. The logs must be retained for 7 years. Which
service should be used?
A. AWS Config
B. AWS CloudTrail
C. Amazon CloudWatch Logs
D. AWS Trusted Advisor
Correct: B
Rationale: AWS CloudTrail records API calls made in the account, including
the identity of the caller, the time of the call, the source IP address, and more.
CloudTrail logs can be delivered to S3 for long-term retention. AWS Config records
