AWS Solutions Architect Associate Exam Prep 2026
Updated Practice Questions, Comprehensive Cloud
Architecture Review, Detailed Rationales, Verified
Answers, Success Workbook
EXAM OVERVIEW
The AWS Certified Solutions Architect – Associate (SAA-C03) exam validates
your ability to design secure, resilient, high-performing, and cost-optimized
architectures on AWS.
Exam Details at a Glance:
Detail Information
Exam Code SAA-C03
Level Associate
Format 65 questions (50 scored, 15 unscored)
Question Types Multiple choice & multiple response
Duration 130 minutes
Passing Score
Cost $150 USD
Validity 3 years
Recommended Experience 1+ year hands-on AWS experience
,Exam Domains & Weights:
Domain Weight Approx. Questions
1.0 Design Secure Architectures 30% ~20 questions
2.0 Design Resilient Architectures 26% ~17 questions
3.0 Design High-Performing Architectures 24% ~16 questions
4.0 Design Cost-Optimized Architectures 20% ~13 questions
Key Insight: Domains 1 (Security) and 2 (Resilient Architectures) together
account for 56% of the exam. Prioritize these areas for maximum impact.
Exam Updates (2025–2026): The SAA-C03 content was refreshed in August
2025 to add Aurora DSQL, S3 Vectors, and updated Cost Optimization
Hub topics.
DOMAIN 1: DESIGN SECURE ARCHITECTURES (30%)
Question 1
A company needs to grant temporary read-only access to a third-party auditor
to review resources in their AWS account for 24 hours. What is the MOST
secure approach?
A. Create an IAM user with ReadOnlyAccess policy and delete it after 24 hours
B. Create a cross-account role with a trust policy and use AWS STS to assume
the role
C. Share the root user credentials with the auditor and change them after 24
hours
D. Create an IAM group with ReadOnlyAccess and add the auditor's IAM user
Answer: B. Create a cross-account role with a trust policy and use AWS
STS to assume the role
,Rationale: IAM roles with cross-account access and temporary security
credentials via AWS STS are the most secure approach for granting temporary
access. Roles provide temporary credentials that automatically expire,
eliminating the need to manage user credentials. Creating an IAM user (A)
requires managing credentials and deletion. Sharing root credentials (C)
violates best practices. An IAM group (D) still requires creating a user and
managing credentials.
Question 2
An application running on Amazon EC2 needs to access an Amazon S3 bucket.
Which method provides the MOST secure way to grant this access without
storing credentials on the instance?
A. Store AWS access keys in the application code
B. Store AWS access keys in a configuration file on the instance
C. Attach an IAM role to the EC2 instance with an instance profile
D. Store AWS access keys in an environment variable
Answer: C. Attach an IAM role to the EC2 instance with an instance
profile
Rationale: IAM roles attached to EC2 instances (via instance profiles) provide
temporary credentials through the instance metadata service. This eliminates
the need to store or manage long-term credentials. Storing keys in code (A),
files (B), or environment variables (D) creates security risks and requires
credential rotation.
Question 3
A company is designing a VPC architecture with both public and private
subnets. They need to allow instances in a private subnet to download
software updates from the internet without exposing them to inbound traffic.
Which component should be used?
A. Internet Gateway (IGW)
B. Virtual Private Gateway (VGW)
C. NAT Gateway in a public subnet
D. VPC endpoint
, Answer: C. NAT Gateway in a public subnet
Rationale: A NAT Gateway in a public subnet allows instances in private
subnets to initiate outbound traffic to the internet while preventing inbound
connections. An Internet Gateway (A) alone doesn't provide NAT
functionality. A Virtual Private Gateway (B) is for VPN connections. VPC
endpoints (D) are for private AWS service access, not general internet access.
Question 4
An organization wants to implement a centralized security policy across
multiple AWS accounts. Which AWS service should be used to manage service
control policies (SCPs)?
A. AWS IAM
B. AWS Organizations
C. AWS Control Tower
D. AWS Config
Answer: B. AWS Organizations
Rationale: AWS Organizations enables centralized management of multiple
accounts with Service Control Policies (SCPs) that apply permissions
guardrails across all member accounts. IAM (A) manages permissions within a
single account. Control Tower (C) builds on Organizations but adds
governance. Config (D) monitors compliance.
Question 5
A web application is deployed behind an Application Load Balancer (ALB).
The security team wants to protect against SQL injection and cross-site
scripting (XSS) attacks. Which AWS service should be used?
A. AWS Shield
B. AWS WAF
C. AWS GuardDuty
D. AWS Security Hub
Answer: B. AWS WAF
Updated Practice Questions, Comprehensive Cloud
Architecture Review, Detailed Rationales, Verified
Answers, Success Workbook
EXAM OVERVIEW
The AWS Certified Solutions Architect – Associate (SAA-C03) exam validates
your ability to design secure, resilient, high-performing, and cost-optimized
architectures on AWS.
Exam Details at a Glance:
Detail Information
Exam Code SAA-C03
Level Associate
Format 65 questions (50 scored, 15 unscored)
Question Types Multiple choice & multiple response
Duration 130 minutes
Passing Score
Cost $150 USD
Validity 3 years
Recommended Experience 1+ year hands-on AWS experience
,Exam Domains & Weights:
Domain Weight Approx. Questions
1.0 Design Secure Architectures 30% ~20 questions
2.0 Design Resilient Architectures 26% ~17 questions
3.0 Design High-Performing Architectures 24% ~16 questions
4.0 Design Cost-Optimized Architectures 20% ~13 questions
Key Insight: Domains 1 (Security) and 2 (Resilient Architectures) together
account for 56% of the exam. Prioritize these areas for maximum impact.
Exam Updates (2025–2026): The SAA-C03 content was refreshed in August
2025 to add Aurora DSQL, S3 Vectors, and updated Cost Optimization
Hub topics.
DOMAIN 1: DESIGN SECURE ARCHITECTURES (30%)
Question 1
A company needs to grant temporary read-only access to a third-party auditor
to review resources in their AWS account for 24 hours. What is the MOST
secure approach?
A. Create an IAM user with ReadOnlyAccess policy and delete it after 24 hours
B. Create a cross-account role with a trust policy and use AWS STS to assume
the role
C. Share the root user credentials with the auditor and change them after 24
hours
D. Create an IAM group with ReadOnlyAccess and add the auditor's IAM user
Answer: B. Create a cross-account role with a trust policy and use AWS
STS to assume the role
,Rationale: IAM roles with cross-account access and temporary security
credentials via AWS STS are the most secure approach for granting temporary
access. Roles provide temporary credentials that automatically expire,
eliminating the need to manage user credentials. Creating an IAM user (A)
requires managing credentials and deletion. Sharing root credentials (C)
violates best practices. An IAM group (D) still requires creating a user and
managing credentials.
Question 2
An application running on Amazon EC2 needs to access an Amazon S3 bucket.
Which method provides the MOST secure way to grant this access without
storing credentials on the instance?
A. Store AWS access keys in the application code
B. Store AWS access keys in a configuration file on the instance
C. Attach an IAM role to the EC2 instance with an instance profile
D. Store AWS access keys in an environment variable
Answer: C. Attach an IAM role to the EC2 instance with an instance
profile
Rationale: IAM roles attached to EC2 instances (via instance profiles) provide
temporary credentials through the instance metadata service. This eliminates
the need to store or manage long-term credentials. Storing keys in code (A),
files (B), or environment variables (D) creates security risks and requires
credential rotation.
Question 3
A company is designing a VPC architecture with both public and private
subnets. They need to allow instances in a private subnet to download
software updates from the internet without exposing them to inbound traffic.
Which component should be used?
A. Internet Gateway (IGW)
B. Virtual Private Gateway (VGW)
C. NAT Gateway in a public subnet
D. VPC endpoint
, Answer: C. NAT Gateway in a public subnet
Rationale: A NAT Gateway in a public subnet allows instances in private
subnets to initiate outbound traffic to the internet while preventing inbound
connections. An Internet Gateway (A) alone doesn't provide NAT
functionality. A Virtual Private Gateway (B) is for VPN connections. VPC
endpoints (D) are for private AWS service access, not general internet access.
Question 4
An organization wants to implement a centralized security policy across
multiple AWS accounts. Which AWS service should be used to manage service
control policies (SCPs)?
A. AWS IAM
B. AWS Organizations
C. AWS Control Tower
D. AWS Config
Answer: B. AWS Organizations
Rationale: AWS Organizations enables centralized management of multiple
accounts with Service Control Policies (SCPs) that apply permissions
guardrails across all member accounts. IAM (A) manages permissions within a
single account. Control Tower (C) builds on Organizations but adds
governance. Config (D) monitors compliance.
Question 5
A web application is deployed behind an Application Load Balancer (ALB).
The security team wants to protect against SQL injection and cross-site
scripting (XSS) attacks. Which AWS service should be used?
A. AWS Shield
B. AWS WAF
C. AWS GuardDuty
D. AWS Security Hub
Answer: B. AWS WAF
