Page 1 of 52
AWS CERTIFIED SOLUTIONS ARCHITECT – ASSOCIATE
(SAA-C03) COMPREHENSIVE EXAM PREP: 150 PRACTICE
QUESTIONS WITH ANSWERS AND DETAILED RATIONALES
– COMPLETE STUDY GUIDE, LATEST 2026 EDITION
This complete practice examination is designed for cloud professionals preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) certification. It provides 150 advanced,
exam-style multiple-choice questions covering all SAA-C03 domains, including designing
resilient, high-performing, secure, and cost-optimized architectures on AWS. Each question
includes a detailed rationale explaining the correct answer and why alternatives are less
suitable. The 2026 edition aligns with current AWS services, best practices, and the AWS Well-
Architected Framework. Use this comprehensive review package to assess readiness, identify
knowledge gaps, and build confidence for your certification exam. Perfect for cloud engineers,
architects, and IT professionals seeking AWS mastery and credentialing preparation.
Table of Contents
1. AWS Global Infrastructure and Core Services
2. Compute Services: EC2, Lambda, and Containers
3. Storage Services: S3, EBS, EFS, and Glacier
4. Database Services: RDS, DynamoDB, and Redshift
5. Networking and Content Delivery: VPC, Route 53, and CloudFront
6. Security, Identity, and Compliance: IAM, KMS, and WAF
7. High Availability, Fault Tolerance, and Disaster Recovery
8. Serverless and Decoupled Architectures
9. Cost Optimization and Pricing Models
10. Monitoring, Logging, and Performance Efficiency
,Page 2 of 52
1: A company wants to host a static website with low latency for global users. Which AWS
service should be used as the primary content delivery mechanism?
A) Amazon EC2
B) Amazon CloudFront
C) AWS Global Accelerator
D) Amazon S3 Transfer Acceleration
Correct Answer: B
CloudFront is a content delivery network (CDN) that caches content at edge locations
worldwide, reducing latency for global users accessing static websites. EC2 is a compute
service not optimized for static content distribution; Global Accelerator improves network
routing but not caching; S3 Transfer Acceleration speeds uploads to S3 but is not a CDN.
2: A solutions architect needs to design a highly available web application that spans multiple
Availability Zones. Which of the following best achieves this requirement?
A) Deploy the application on a single EC2 instance in one AZ
B) Use an Application Load Balancer to distribute traffic across EC2 instances in multiple AZs
C) Store application data in a single EBS volume
D) Use a single NAT gateway in one AZ
Correct Answer: B
An Application Load Balancer distributes incoming traffic across EC2 instances in multiple
Availability Zones, providing fault tolerance and high availability. A single EC2 instance is a
single point of failure; EBS volumes are AZ-scoped; a single NAT gateway in one AZ is also a
single point of failure.
3: Which AWS service provides a fully managed, serverless compute service that automatically
scales based on incoming requests?
A) Amazon EC2 Auto Scaling
B) AWS Lambda
C) Amazon ECS
D) AWS Batch
,Page 3 of 52
Correct Answer: B
AWS Lambda runs code without provisioning servers, automatically scaling with the number
of incoming requests. EC2 Auto Scaling manages EC2 instances, which are not serverless;
ECS is container management but requires underlying infrastructure; AWS Batch is for batch
jobs and not fully serverless for all workloads.
4: A company needs to store large amounts of archival data that will be accessed infrequently and
must be retained for 10 years due to compliance. Which Amazon S3 storage class is most cost-
effective?
A) S3 Standard
B) S3 Intelligent-Tiering
C) S3 Glacier Deep Archive
D) S3 One Zone-IA
Correct Answer: C
S3 Glacier Deep Archive is the lowest-cost storage class for long-term archival with retrieval
times of 12-48 hours, ideal for compliance data. S3 Standard is for frequently accessed data;
Intelligent-Tiering is for unknown access patterns; One Zone-IA lacks redundancy and is for
recreatable data.
5: Which AWS service is used to create a logically isolated section of the AWS cloud where you
can launch resources in a virtual network?
A) AWS Direct Connect
B) Amazon Route 53
C) Amazon VPC
D) AWS Transit Gateway
Correct Answer: C
Amazon Virtual Private Cloud (VPC) lets you provision a logically isolated network with
control over IP addressing, subnets, routing, and security. Direct Connect is a dedicated
network connection; Route 53 is DNS; Transit Gateway connects VPCs.
6: A solutions architect needs to provide secure access to a private subnet from the internet for
software updates. Which resource should be placed in the public subnet?
, Page 4 of 52
A) Internet Gateway
B) NAT Gateway
C) VPC Endpoint
D) VPN Gateway
Correct Answer: B
A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound
traffic to the internet (e.g., for updates) while remaining inaccessible from inbound internet.
An Internet Gateway provides bidirectional internet access; VPC Endpoint provides private
access to AWS services; VPN Gateway connects to on-premises networks.
7: Which AWS service provides a managed NoSQL database with single-digit millisecond
latency at any scale?
A) Amazon RDS
B) Amazon Redshift
C) Amazon DynamoDB
D) Amazon Aurora
Correct Answer: C
DynamoDB is a fully managed NoSQL key-value and document database designed for low-
latency, high-scale workloads. RDS and Aurora are relational databases; Redshift is a data
warehouse.
8: A company wants to run a containerized microservices application. Which AWS service is a
fully managed Kubernetes control plane?
A) Amazon ECS
B) Amazon EKS
C) AWS Fargate
D) AWS Elastic Beanstalk
Correct Answer: B
Amazon Elastic Kubernetes Service (EKS) provides a managed Kubernetes control plane,
allowing you to run Kubernetes workloads without managing the control plane. ECS is AWS's
AWS CERTIFIED SOLUTIONS ARCHITECT – ASSOCIATE
(SAA-C03) COMPREHENSIVE EXAM PREP: 150 PRACTICE
QUESTIONS WITH ANSWERS AND DETAILED RATIONALES
– COMPLETE STUDY GUIDE, LATEST 2026 EDITION
This complete practice examination is designed for cloud professionals preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) certification. It provides 150 advanced,
exam-style multiple-choice questions covering all SAA-C03 domains, including designing
resilient, high-performing, secure, and cost-optimized architectures on AWS. Each question
includes a detailed rationale explaining the correct answer and why alternatives are less
suitable. The 2026 edition aligns with current AWS services, best practices, and the AWS Well-
Architected Framework. Use this comprehensive review package to assess readiness, identify
knowledge gaps, and build confidence for your certification exam. Perfect for cloud engineers,
architects, and IT professionals seeking AWS mastery and credentialing preparation.
Table of Contents
1. AWS Global Infrastructure and Core Services
2. Compute Services: EC2, Lambda, and Containers
3. Storage Services: S3, EBS, EFS, and Glacier
4. Database Services: RDS, DynamoDB, and Redshift
5. Networking and Content Delivery: VPC, Route 53, and CloudFront
6. Security, Identity, and Compliance: IAM, KMS, and WAF
7. High Availability, Fault Tolerance, and Disaster Recovery
8. Serverless and Decoupled Architectures
9. Cost Optimization and Pricing Models
10. Monitoring, Logging, and Performance Efficiency
,Page 2 of 52
1: A company wants to host a static website with low latency for global users. Which AWS
service should be used as the primary content delivery mechanism?
A) Amazon EC2
B) Amazon CloudFront
C) AWS Global Accelerator
D) Amazon S3 Transfer Acceleration
Correct Answer: B
CloudFront is a content delivery network (CDN) that caches content at edge locations
worldwide, reducing latency for global users accessing static websites. EC2 is a compute
service not optimized for static content distribution; Global Accelerator improves network
routing but not caching; S3 Transfer Acceleration speeds uploads to S3 but is not a CDN.
2: A solutions architect needs to design a highly available web application that spans multiple
Availability Zones. Which of the following best achieves this requirement?
A) Deploy the application on a single EC2 instance in one AZ
B) Use an Application Load Balancer to distribute traffic across EC2 instances in multiple AZs
C) Store application data in a single EBS volume
D) Use a single NAT gateway in one AZ
Correct Answer: B
An Application Load Balancer distributes incoming traffic across EC2 instances in multiple
Availability Zones, providing fault tolerance and high availability. A single EC2 instance is a
single point of failure; EBS volumes are AZ-scoped; a single NAT gateway in one AZ is also a
single point of failure.
3: Which AWS service provides a fully managed, serverless compute service that automatically
scales based on incoming requests?
A) Amazon EC2 Auto Scaling
B) AWS Lambda
C) Amazon ECS
D) AWS Batch
,Page 3 of 52
Correct Answer: B
AWS Lambda runs code without provisioning servers, automatically scaling with the number
of incoming requests. EC2 Auto Scaling manages EC2 instances, which are not serverless;
ECS is container management but requires underlying infrastructure; AWS Batch is for batch
jobs and not fully serverless for all workloads.
4: A company needs to store large amounts of archival data that will be accessed infrequently and
must be retained for 10 years due to compliance. Which Amazon S3 storage class is most cost-
effective?
A) S3 Standard
B) S3 Intelligent-Tiering
C) S3 Glacier Deep Archive
D) S3 One Zone-IA
Correct Answer: C
S3 Glacier Deep Archive is the lowest-cost storage class for long-term archival with retrieval
times of 12-48 hours, ideal for compliance data. S3 Standard is for frequently accessed data;
Intelligent-Tiering is for unknown access patterns; One Zone-IA lacks redundancy and is for
recreatable data.
5: Which AWS service is used to create a logically isolated section of the AWS cloud where you
can launch resources in a virtual network?
A) AWS Direct Connect
B) Amazon Route 53
C) Amazon VPC
D) AWS Transit Gateway
Correct Answer: C
Amazon Virtual Private Cloud (VPC) lets you provision a logically isolated network with
control over IP addressing, subnets, routing, and security. Direct Connect is a dedicated
network connection; Route 53 is DNS; Transit Gateway connects VPCs.
6: A solutions architect needs to provide secure access to a private subnet from the internet for
software updates. Which resource should be placed in the public subnet?
, Page 4 of 52
A) Internet Gateway
B) NAT Gateway
C) VPC Endpoint
D) VPN Gateway
Correct Answer: B
A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound
traffic to the internet (e.g., for updates) while remaining inaccessible from inbound internet.
An Internet Gateway provides bidirectional internet access; VPC Endpoint provides private
access to AWS services; VPN Gateway connects to on-premises networks.
7: Which AWS service provides a managed NoSQL database with single-digit millisecond
latency at any scale?
A) Amazon RDS
B) Amazon Redshift
C) Amazon DynamoDB
D) Amazon Aurora
Correct Answer: C
DynamoDB is a fully managed NoSQL key-value and document database designed for low-
latency, high-scale workloads. RDS and Aurora are relational databases; Redshift is a data
warehouse.
8: A company wants to run a containerized microservices application. Which AWS service is a
fully managed Kubernetes control plane?
A) Amazon ECS
B) Amazon EKS
C) AWS Fargate
D) AWS Elastic Beanstalk
Correct Answer: B
Amazon Elastic Kubernetes Service (EKS) provides a managed Kubernetes control plane,
allowing you to run Kubernetes workloads without managing the control plane. ECS is AWS's
