AWS Certified Solutions Architect – Associate SAA-C03 2026
Practice Exam – 190 Questions with Answers & Detailed Rationales,
Secure, Resilient, High-Performing & Cost-Optimized Cloud
Architectures
Domain 1: Design Secure Architectures (Questions 1–57)
Question 1
A company has multiple AWS accounts managed through AWS Organizations. The security
team wants to ensure that no IAM user in any member account can create IAM users with
console access unless explicitly approved. Which mechanism should be used to enforce this
restriction centrally?
A. IAM permission boundaries attached to each user
B. Service control policies (SCPs) applied at the organization root
C. AWS Config rules that detect and remediate non-compliant IAM users
D. Resource-based policies on the IAM service
Correct Answer: B
Explanation: SCPs define maximum permissions for all accounts in an organization, centrally
restricting actions like iam:CreateUser with console access.
Question 2
A solutions architect is designing a system where applications running on Amazon EC2 need
to access an Amazon S3 bucket without storing long-term credentials on the instances.
Which approach follows AWS security best practices?
A. Store IAM access keys in an encrypted EBS volume attached to each instance
,B. Create an IAM role with S3 access and attach it to an instance profile
C. Generate temporary credentials using AWS STS and hardcode them in the application
D. Use the root account access keys encrypted with AWS KMS
Correct Answer: B
Explanation: IAM roles provide temporary credentials automatically rotated by AWS,
eliminating hardcoded keys and adhering to least privilege.
Question 3
An organization wants to give a third-party auditing firm read-only access to specific S3
buckets in their AWS account. The auditors have their own AWS accounts and use their own
IAM users. What is the most secure and operationally efficient way to grant this access?
A. Create IAM users for each auditor with read-only S3 policies
B. Share the root account credentials with the auditing firm
C. Create a cross-account IAM role with a trust policy allowing the auditor's account and
attach a read-only S3 policy
D. Generate long-term access keys and send them securely to the auditors
Correct Answer: C
Explanation: Cross-account roles allow the auditor’s IAM users to assume a role, avoiding
credential sharing and enabling centralized revocation.
Question 4
A company stores sensitive data in Amazon S3 and needs to ensure that data is encrypted at
rest using keys they manage and rotate on a custom schedule. They also need an audit trail
of every key usage. Which combination of services should be used?
,A. SSE-S3 with S3 default encryption
B. SSE-KMS with a customer managed key and CloudTrail logging
C. SSE-C with client-provided keys stored in AWS Secrets Manager
D. Client-side encryption with keys stored in an on-premises HSM only
Correct Answer: B
Explanation: SSE-KMS with customer managed keys provides key rotation control, and
CloudTrail logs every KMS API call for auditing.
Question 5
A web application running on EC2 instances behind an Application Load Balancer is
experiencing SQL injection attacks. Which AWS service should be deployed to protect the
application from these attacks?
A. AWS Shield Advanced
B. Amazon GuardDuty
C. AWS WAF with managed rule groups
D. AWS Network Firewall
Correct Answer: C
Explanation: AWS WAF inspects HTTP/HTTPS requests and can block SQL injection patterns
using managed or custom rules.
Question 6
A solutions architect needs to design a VPC for a three-tier web application. The database
tier must not have any route to the internet, but must be accessible from the application
tier. Which VPC configuration achieves this?
, A. Place the database in a public subnet with a security group restricting access
B. Place the database in a private subnet with a route table containing only local routes
C. Place the database in a private subnet with a NAT gateway for outbound updates only
D. Place the database in a public subnet with a network ACL denying all inbound traffic
Correct Answer: B
Explanation: A private subnet with only local routes has no internet gateway or NAT route,
fully isolating the database from internet access.
Question 7
A company wants to enforce encryption in transit for all connections to their Application
Load Balancer. They have obtained a public certificate from a third-party CA. Which AWS
service should they use to manage and deploy this certificate?
A. AWS Certificate Manager (ACM) with imported certificate
B. AWS KMS with an asymmetric key
C. AWS Secrets Manager with automatic rotation
D. IAM server certificates
Correct Answer: A
Explanation: ACM allows importing third-party certificates and associating them with ALBs
for TLS termination.
Question 8
An application running on EC2 instances needs to retrieve database credentials securely. The
credentials must be automatically rotated every 30 days. Which AWS service meets these
requirements?
Practice Exam – 190 Questions with Answers & Detailed Rationales,
Secure, Resilient, High-Performing & Cost-Optimized Cloud
Architectures
Domain 1: Design Secure Architectures (Questions 1–57)
Question 1
A company has multiple AWS accounts managed through AWS Organizations. The security
team wants to ensure that no IAM user in any member account can create IAM users with
console access unless explicitly approved. Which mechanism should be used to enforce this
restriction centrally?
A. IAM permission boundaries attached to each user
B. Service control policies (SCPs) applied at the organization root
C. AWS Config rules that detect and remediate non-compliant IAM users
D. Resource-based policies on the IAM service
Correct Answer: B
Explanation: SCPs define maximum permissions for all accounts in an organization, centrally
restricting actions like iam:CreateUser with console access.
Question 2
A solutions architect is designing a system where applications running on Amazon EC2 need
to access an Amazon S3 bucket without storing long-term credentials on the instances.
Which approach follows AWS security best practices?
A. Store IAM access keys in an encrypted EBS volume attached to each instance
,B. Create an IAM role with S3 access and attach it to an instance profile
C. Generate temporary credentials using AWS STS and hardcode them in the application
D. Use the root account access keys encrypted with AWS KMS
Correct Answer: B
Explanation: IAM roles provide temporary credentials automatically rotated by AWS,
eliminating hardcoded keys and adhering to least privilege.
Question 3
An organization wants to give a third-party auditing firm read-only access to specific S3
buckets in their AWS account. The auditors have their own AWS accounts and use their own
IAM users. What is the most secure and operationally efficient way to grant this access?
A. Create IAM users for each auditor with read-only S3 policies
B. Share the root account credentials with the auditing firm
C. Create a cross-account IAM role with a trust policy allowing the auditor's account and
attach a read-only S3 policy
D. Generate long-term access keys and send them securely to the auditors
Correct Answer: C
Explanation: Cross-account roles allow the auditor’s IAM users to assume a role, avoiding
credential sharing and enabling centralized revocation.
Question 4
A company stores sensitive data in Amazon S3 and needs to ensure that data is encrypted at
rest using keys they manage and rotate on a custom schedule. They also need an audit trail
of every key usage. Which combination of services should be used?
,A. SSE-S3 with S3 default encryption
B. SSE-KMS with a customer managed key and CloudTrail logging
C. SSE-C with client-provided keys stored in AWS Secrets Manager
D. Client-side encryption with keys stored in an on-premises HSM only
Correct Answer: B
Explanation: SSE-KMS with customer managed keys provides key rotation control, and
CloudTrail logs every KMS API call for auditing.
Question 5
A web application running on EC2 instances behind an Application Load Balancer is
experiencing SQL injection attacks. Which AWS service should be deployed to protect the
application from these attacks?
A. AWS Shield Advanced
B. Amazon GuardDuty
C. AWS WAF with managed rule groups
D. AWS Network Firewall
Correct Answer: C
Explanation: AWS WAF inspects HTTP/HTTPS requests and can block SQL injection patterns
using managed or custom rules.
Question 6
A solutions architect needs to design a VPC for a three-tier web application. The database
tier must not have any route to the internet, but must be accessible from the application
tier. Which VPC configuration achieves this?
, A. Place the database in a public subnet with a security group restricting access
B. Place the database in a private subnet with a route table containing only local routes
C. Place the database in a private subnet with a NAT gateway for outbound updates only
D. Place the database in a public subnet with a network ACL denying all inbound traffic
Correct Answer: B
Explanation: A private subnet with only local routes has no internet gateway or NAT route,
fully isolating the database from internet access.
Question 7
A company wants to enforce encryption in transit for all connections to their Application
Load Balancer. They have obtained a public certificate from a third-party CA. Which AWS
service should they use to manage and deploy this certificate?
A. AWS Certificate Manager (ACM) with imported certificate
B. AWS KMS with an asymmetric key
C. AWS Secrets Manager with automatic rotation
D. IAM server certificates
Correct Answer: A
Explanation: ACM allows importing third-party certificates and associating them with ALBs
for TLS termination.
Question 8
An application running on EC2 instances needs to retrieve database credentials securely. The
credentials must be automatically rotated every 30 days. Which AWS service meets these
requirements?
