AWS Solutions Architect Associate 2026 Latest
Comprehensive Study Guide Cloud Architecture
Review | Verified Answers | Detailed Explanations
| Success Workbook
Exam Reference: AWS Certified Solutions Architect – Associate SAA-C03
Exam Details:
• Exam Code: SAA-C03
• Duration: 130 minutes
• Questions: 65 (Multiple choice and multiple response)
• Passing Score:
• Cost: $150 USD
• Recommended Experience: 1 year of hands-on AWS production
experience
Exam Domains & Weighting:
• Domain 1: Design Secure Architectures — 30%
• Domain 2: Design Resilient Architectures — 26%
• Domain 3: Design High-Performing Architectures — 24%
• Domain 4: Design Cost-Optimized Architectures — 20%
Key 2026 Updates:
• Aurora DSQL
• S3 Vectors
• Cost Optimization Hub
• SAA-C03 content refreshed August 2025
,DOMAIN 1: DESIGN SECURE ARCHITECTURES (30%)
Question 1
A company is building a new web application on AWS. The application will run
on EC2 instances behind an Application Load Balancer (ALB). The EC2
instances need to securely access an S3 bucket to read and write application
data. What is the MOST secure way to grant these EC2 instances access to the
S3 bucket?
A) Create an IAM user with access keys and store the keys in the application
code
B) Create an IAM role and attach it to the EC2 instance profile
C) Create an S3 bucket policy that allows public access from the VPC CIDR
D) Create an IAM user and store the access keys in an encrypted environment
variable
Answer: B
Rationale: The most secure way to grant EC2 instances access to AWS
services is to create an IAM role and attach it to the EC2 instance profile. The
EC2 instances can then assume this role to obtain temporary credentials. This
approach eliminates the need to store long-term access keys on the instances,
reducing the risk of credential exposure. Option A and D involve storing
access keys, which is insecure. Option C would allow any resource in the VPC
to access the bucket, violating least privilege.
Question 2
A company is implementing a new application that requires encryption of data
at rest in Amazon S3. The company wants to maintain full control over the
encryption keys and have the ability to audit key usage. Which encryption
option should the company choose?
A) Server-Side Encryption with S3-Managed Keys (SSE-S3)
B) Server-Side Encryption with Customer-Provided Keys (SSE-C)
C) Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) using a
customer-managed CMK
D) Client-side encryption
,Answer: C
Rationale: SSE-KMS with a customer-managed Customer Master Key (CMK)
provides the company with full control over the encryption keys, including the
ability to enable/disable keys, set key policies, and audit key usage through
AWS CloudTrail. SSE-S3 (A) uses keys managed by AWS, providing less
control. SSE-C (B) allows customer-provided keys but requires the company
to manage key material themselves. Client-side encryption (D) requires the
application to encrypt data before sending it to S3, adding complexity.
Question 3
A Solutions Architect is designing a VPC for a multi-tier web application. The
web servers need to be accessible from the internet, but the database servers
must not be directly accessible from the internet. What is the MOST
appropriate network design?
A) Place all servers in a single public subnet with security groups restricting
database access
B) Place web servers in a public subnet and database servers in a private
subnet with a NAT Gateway
C) Place web servers in a private subnet and database servers in a public
subnet
D) Place web servers in a public subnet and database servers in a private
subnet without internet access
Answer: D
Rationale: The most secure design places web servers (which need internet
access) in a public subnet with an internet gateway, and database servers in a
private subnet without direct internet access. This follows the principle of
least privilege by ensuring only the web tier is exposed to the internet.
Security groups and NACLs provide additional layer security. Option A
exposes database servers to the internet. Option B adds a NAT Gateway
unnecessarily as databases don't need outbound internet. Option C would
expose databases directly to the internet.
, Question 4
A company wants to securely store database credentials and API keys used by
their applications running on EC2. Which AWS service should they use?
A) Store them in plain text in the application configuration files
B) AWS Systems Manager Parameter Store with SecureString parameters
C) Store them in an S3 bucket with a bucket policy
D) Hard-code them in the application source code
Answer: B
Rationale: AWS Systems Manager Parameter Store with SecureString
parameters provides a secure, centralized store for secrets and configuration
data. Secrets are encrypted using AWS KMS and access can be controlled
through IAM policies. AWS Secrets Manager is another option for database
credentials specifically. Options A and D are insecure practices that expose
secrets to anyone with access to the code or configuration. Option C is not
designed for secret management.
Question 5
An organization has multiple AWS accounts and wants to centrally manage
security policies and service control policies (SCPs) across all accounts. Which
AWS service should they use?
A) AWS Identity and Access Management (IAM)
B) AWS Organizations
C) AWS Control Tower
D) AWS Config
Answer: B
Rationale: AWS Organizations allows you to centrally manage multiple AWS
accounts, apply service control policies (SCPs) to restrict actions, and organize
accounts using organizational units (OUs). IAM (A) manages permissions
within a single account. AWS Control Tower (C) provides a way to set up and
govern a multi-account environment but builds on AWS Organizations. AWS
Config (D) monitors resource configurations.
Comprehensive Study Guide Cloud Architecture
Review | Verified Answers | Detailed Explanations
| Success Workbook
Exam Reference: AWS Certified Solutions Architect – Associate SAA-C03
Exam Details:
• Exam Code: SAA-C03
• Duration: 130 minutes
• Questions: 65 (Multiple choice and multiple response)
• Passing Score:
• Cost: $150 USD
• Recommended Experience: 1 year of hands-on AWS production
experience
Exam Domains & Weighting:
• Domain 1: Design Secure Architectures — 30%
• Domain 2: Design Resilient Architectures — 26%
• Domain 3: Design High-Performing Architectures — 24%
• Domain 4: Design Cost-Optimized Architectures — 20%
Key 2026 Updates:
• Aurora DSQL
• S3 Vectors
• Cost Optimization Hub
• SAA-C03 content refreshed August 2025
,DOMAIN 1: DESIGN SECURE ARCHITECTURES (30%)
Question 1
A company is building a new web application on AWS. The application will run
on EC2 instances behind an Application Load Balancer (ALB). The EC2
instances need to securely access an S3 bucket to read and write application
data. What is the MOST secure way to grant these EC2 instances access to the
S3 bucket?
A) Create an IAM user with access keys and store the keys in the application
code
B) Create an IAM role and attach it to the EC2 instance profile
C) Create an S3 bucket policy that allows public access from the VPC CIDR
D) Create an IAM user and store the access keys in an encrypted environment
variable
Answer: B
Rationale: The most secure way to grant EC2 instances access to AWS
services is to create an IAM role and attach it to the EC2 instance profile. The
EC2 instances can then assume this role to obtain temporary credentials. This
approach eliminates the need to store long-term access keys on the instances,
reducing the risk of credential exposure. Option A and D involve storing
access keys, which is insecure. Option C would allow any resource in the VPC
to access the bucket, violating least privilege.
Question 2
A company is implementing a new application that requires encryption of data
at rest in Amazon S3. The company wants to maintain full control over the
encryption keys and have the ability to audit key usage. Which encryption
option should the company choose?
A) Server-Side Encryption with S3-Managed Keys (SSE-S3)
B) Server-Side Encryption with Customer-Provided Keys (SSE-C)
C) Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) using a
customer-managed CMK
D) Client-side encryption
,Answer: C
Rationale: SSE-KMS with a customer-managed Customer Master Key (CMK)
provides the company with full control over the encryption keys, including the
ability to enable/disable keys, set key policies, and audit key usage through
AWS CloudTrail. SSE-S3 (A) uses keys managed by AWS, providing less
control. SSE-C (B) allows customer-provided keys but requires the company
to manage key material themselves. Client-side encryption (D) requires the
application to encrypt data before sending it to S3, adding complexity.
Question 3
A Solutions Architect is designing a VPC for a multi-tier web application. The
web servers need to be accessible from the internet, but the database servers
must not be directly accessible from the internet. What is the MOST
appropriate network design?
A) Place all servers in a single public subnet with security groups restricting
database access
B) Place web servers in a public subnet and database servers in a private
subnet with a NAT Gateway
C) Place web servers in a private subnet and database servers in a public
subnet
D) Place web servers in a public subnet and database servers in a private
subnet without internet access
Answer: D
Rationale: The most secure design places web servers (which need internet
access) in a public subnet with an internet gateway, and database servers in a
private subnet without direct internet access. This follows the principle of
least privilege by ensuring only the web tier is exposed to the internet.
Security groups and NACLs provide additional layer security. Option A
exposes database servers to the internet. Option B adds a NAT Gateway
unnecessarily as databases don't need outbound internet. Option C would
expose databases directly to the internet.
, Question 4
A company wants to securely store database credentials and API keys used by
their applications running on EC2. Which AWS service should they use?
A) Store them in plain text in the application configuration files
B) AWS Systems Manager Parameter Store with SecureString parameters
C) Store them in an S3 bucket with a bucket policy
D) Hard-code them in the application source code
Answer: B
Rationale: AWS Systems Manager Parameter Store with SecureString
parameters provides a secure, centralized store for secrets and configuration
data. Secrets are encrypted using AWS KMS and access can be controlled
through IAM policies. AWS Secrets Manager is another option for database
credentials specifically. Options A and D are insecure practices that expose
secrets to anyone with access to the code or configuration. Option C is not
designed for secret management.
Question 5
An organization has multiple AWS accounts and wants to centrally manage
security policies and service control policies (SCPs) across all accounts. Which
AWS service should they use?
A) AWS Identity and Access Management (IAM)
B) AWS Organizations
C) AWS Control Tower
D) AWS Config
Answer: B
Rationale: AWS Organizations allows you to centrally manage multiple AWS
accounts, apply service control policies (SCPs) to restrict actions, and organize
accounts using organizational units (OUs). IAM (A) manages permissions
within a single account. AWS Control Tower (C) provides a way to set up and
govern a multi-account environment but builds on AWS Organizations. AWS
Config (D) monitors resource configurations.
