AWS CLOUD ACTUAL EXAM 2026/2027 [QUESTION 1-
200] AND ANSWERS UPDATED 2026/2027| PRACTICE
QUESTIONS|DETAILED RATIONALES |INSTANT
DOWNLOAD
INTRODUCTION
The AWS Certified Solutions Architect – Associate (SAA-C03) is an associate-level certification
administered by Amazon Web Services (AWS). It validates the ability to design distributed
systems on AWS and apply AWS architectural best practices, including the AWS Well-
Architected Framework. AWS currently identifies four scored content domains: secure
architectures, resilient architectures, high-performing architectures, and cost-optimized
architectures. (AWS Documentation)
The certification is intended primarily for individuals performing solutions-architect
responsibilities. AWS recommends approximately one year of hands-on experience designing
cloud solutions using AWS services, although AWS notes that candidates with less experience
can prepare for and earn the certification. (Amazon Web Services, Inc.)
The certification can provide a standardized way to demonstrate AWS architecture knowledge to
employers and can support roles involving cloud architecture, infrastructure design, migration,
reliability, security, and cost optimization. The exam currently consists of 65 questions, uses
multiple-choice and multiple-response formats, and provides 130 minutes. Of the 65 questions,
50 are scored and 15 are unscored; the unscored questions are not identified. (Amazon Web
Services, Inc.)
The current SAA-C03 blueprint allocates 30% of scored content to secure architectures, 26% to
resilient architectures, 24% to high-performing architectures, and 20% to cost-optimized
architectures. AWS reports results on a 100–1,000 scaled-score range, with 720 as the minimum
passing score. (AWS Documentation)
Core Domains Tested in AWS Certified Solutions Architect
– Associate (SAA-C03)
Design Secure Architectures
Design Resilient Architectures
Design High-Performing Architectures
Design Cost-Optimized Architectures
Identity and access management
Networking and content delivery
Storage and database architecture
Compute and serverless architecture
Migration, data transfer, and integration
, Monitoring, governance, and operational architecture
CONTENT AREA TABLE
% of Approx. # of
Content Domain Key Topics Covered
Exam Questions
Design Secure IAM, encryption, network security, data
30% ~15 scored
Architectures protection, secure application design
Design Resilient High availability, fault tolerance, scaling,
26% ~13 scored
Architectures decoupling, disaster recovery
Design High-Performing Storage, compute, databases, networking,
24% ~12 scored
Architectures caching, data ingestion
Design Cost-Optimized Pricing models, storage tiers, right-sizing,
20% ~10 scored
Architectures serverless, data-transfer optimization
The question counts above are approximate because AWS specifies percentages of scored
content rather than fixed question counts by domain. The current official blueprint is SAA-C03.
(AWS Documentation)
QUESTIONS 1-200
Q1: A company runs a three-tier web application on Amazon EC2 instances in a single
Availability Zone. A database failure must not make the application unavailable, and the
company wants the architecture to tolerate the loss of an entire Availability Zone. Which
change provides the most appropriate architecture?
A) Place all EC2 instances in a larger instance type
B) Deploy EC2 instances across multiple Availability Zones behind an Application Load
Balancer and use a Multi-AZ database configuration
C) Deploy the EC2 instances in a single Availability Zone with larger EBS volumes
D) Replace the load balancer with Route 53 weighted routing
Correct Answer: B
Rationale: A Multi-AZ architecture addresses Availability Zone failure by distributing
application capacity and database infrastructure across independent Availability Zones. An
Application Load Balancer can distribute traffic across healthy targets. Increasing instance size
or EBS capacity does not provide AZ-level fault tolerance, while weighted DNS routing alone
does not solve application or database availability.
Q2: A company stores confidential customer documents in Amazon S3. Security
requirements state that objects must be encrypted at rest and that encryption keys must be
controlled by the security team. Which solution best satisfies the requirement?
A) S3 server-side encryption with Amazon S3 managed keys (SSE-S3)
B) S3 server-side encryption with AWS KMS keys (SSE-KMS) using a customer-managed
KMS key
,C) Client-side encryption using an unencrypted key stored in the application source code
D) S3 Transfer Acceleration
Correct Answer: B
Rationale: SSE-KMS allows encryption at rest while providing centralized key management,
access policies, auditing, and key administration through AWS KMS. SSE-S3 provides
encryption but does not provide the same customer-controlled KMS key management
capabilities. Storing encryption keys in source code is insecure, and Transfer Acceleration
concerns data transfer rather than encryption.
Q3: An application running on EC2 needs temporary access to objects in an S3 bucket.
Security policy prohibits storing long-term AWS access keys on the instances. What should
the architect implement?
A) Store access keys in user data
B) Store access keys in an encrypted file on the instance
C) Attach an IAM role to the EC2 instance with the required permissions
D) Create an IAM user for each EC2 instance
Correct Answer: C
Rationale: IAM roles provide temporary credentials to EC2 through the instance metadata
credential mechanism and eliminate the need for long-term credentials. User data, local files,
and individual IAM users create unnecessary credential-management risks.
Q4: A public web application is receiving malicious SQL injection requests. The
application is behind an Application Load Balancer. Which AWS service should be used to
filter HTTP requests based on SQL injection and other web-application attack patterns?
A) AWS Shield Standard only
B) AWS WAF
C) Amazon GuardDuty
D) AWS CloudTrail
Correct Answer: B
Rationale: AWS WAF provides Layer 7 request filtering and managed rules for threats such as
SQL injection and cross-site scripting. Shield primarily provides DDoS protection, GuardDuty
detects suspicious activity, and CloudTrail records API activity.
Q5: An organization requires centralized authentication for employees accessing multiple
AWS accounts. Employees should use their existing corporate identities and should receive
permissions based on job role. Which solution is most appropriate?
A) Create separate IAM users in every AWS account
B) Share one IAM user among employees
C) Use AWS IAM Identity Center integrated with the organization's identity provider
D) Store corporate passwords in AWS Secrets Manager
Correct Answer: C
Rationale: IAM Identity Center is designed for centralized workforce access across AWS
, accounts and applications and can integrate with an external identity provider. Individual IAM
users in every account increase administrative overhead, shared users undermine accountability,
and Secrets Manager is not a workforce authentication platform.
Q6: A company needs to ensure that an S3 bucket can be accessed only through a specific
VPC endpoint. Which control should the architect use?
A) Security group attached to the S3 bucket
B) An S3 bucket policy using the aws:sourceVpce condition key
C) A Network ACL attached to the S3 service
D) A Route 53 private hosted zone
Correct Answer: B
Rationale: S3 bucket policies can restrict access based on the VPC endpoint through which
requests originate using aws:sourceVpce. Security groups and network ACLs do not attach
directly to S3, and DNS configuration does not enforce object-level authorization.
Q7: A company needs a private connection from its VPC to Amazon S3 without sending
traffic through the public internet. Which solution is appropriate?
A) Internet gateway
B) NAT gateway
C) S3 VPC endpoint
D) Bastion host
Correct Answer: C
Rationale: An S3 VPC endpoint provides private connectivity from a VPC to S3 without
requiring an internet gateway or NAT gateway. A bastion host is unrelated to service
connectivity.
Q8: An application needs to retrieve database credentials at runtime. The credentials must
be rotated automatically and should not be embedded in application code. Which service is
most appropriate?
A) Amazon S3
B) AWS Systems Manager Parameter Store with plaintext values
C) AWS Secrets Manager
D) Amazon CloudWatch Logs
Correct Answer: C
Rationale: Secrets Manager is specifically designed for storing, retrieving, and managing
sensitive credentials and supports automated rotation for supported services. Plaintext
configuration and object storage do not provide the same purpose-built secret lifecycle
management.
Q9: A company wants to detect compromised AWS credentials and unusual API activity
across its accounts. Which service should provide threat detection?
A) AWS Config
B) Amazon GuardDuty
200] AND ANSWERS UPDATED 2026/2027| PRACTICE
QUESTIONS|DETAILED RATIONALES |INSTANT
DOWNLOAD
INTRODUCTION
The AWS Certified Solutions Architect – Associate (SAA-C03) is an associate-level certification
administered by Amazon Web Services (AWS). It validates the ability to design distributed
systems on AWS and apply AWS architectural best practices, including the AWS Well-
Architected Framework. AWS currently identifies four scored content domains: secure
architectures, resilient architectures, high-performing architectures, and cost-optimized
architectures. (AWS Documentation)
The certification is intended primarily for individuals performing solutions-architect
responsibilities. AWS recommends approximately one year of hands-on experience designing
cloud solutions using AWS services, although AWS notes that candidates with less experience
can prepare for and earn the certification. (Amazon Web Services, Inc.)
The certification can provide a standardized way to demonstrate AWS architecture knowledge to
employers and can support roles involving cloud architecture, infrastructure design, migration,
reliability, security, and cost optimization. The exam currently consists of 65 questions, uses
multiple-choice and multiple-response formats, and provides 130 minutes. Of the 65 questions,
50 are scored and 15 are unscored; the unscored questions are not identified. (Amazon Web
Services, Inc.)
The current SAA-C03 blueprint allocates 30% of scored content to secure architectures, 26% to
resilient architectures, 24% to high-performing architectures, and 20% to cost-optimized
architectures. AWS reports results on a 100–1,000 scaled-score range, with 720 as the minimum
passing score. (AWS Documentation)
Core Domains Tested in AWS Certified Solutions Architect
– Associate (SAA-C03)
Design Secure Architectures
Design Resilient Architectures
Design High-Performing Architectures
Design Cost-Optimized Architectures
Identity and access management
Networking and content delivery
Storage and database architecture
Compute and serverless architecture
Migration, data transfer, and integration
, Monitoring, governance, and operational architecture
CONTENT AREA TABLE
% of Approx. # of
Content Domain Key Topics Covered
Exam Questions
Design Secure IAM, encryption, network security, data
30% ~15 scored
Architectures protection, secure application design
Design Resilient High availability, fault tolerance, scaling,
26% ~13 scored
Architectures decoupling, disaster recovery
Design High-Performing Storage, compute, databases, networking,
24% ~12 scored
Architectures caching, data ingestion
Design Cost-Optimized Pricing models, storage tiers, right-sizing,
20% ~10 scored
Architectures serverless, data-transfer optimization
The question counts above are approximate because AWS specifies percentages of scored
content rather than fixed question counts by domain. The current official blueprint is SAA-C03.
(AWS Documentation)
QUESTIONS 1-200
Q1: A company runs a three-tier web application on Amazon EC2 instances in a single
Availability Zone. A database failure must not make the application unavailable, and the
company wants the architecture to tolerate the loss of an entire Availability Zone. Which
change provides the most appropriate architecture?
A) Place all EC2 instances in a larger instance type
B) Deploy EC2 instances across multiple Availability Zones behind an Application Load
Balancer and use a Multi-AZ database configuration
C) Deploy the EC2 instances in a single Availability Zone with larger EBS volumes
D) Replace the load balancer with Route 53 weighted routing
Correct Answer: B
Rationale: A Multi-AZ architecture addresses Availability Zone failure by distributing
application capacity and database infrastructure across independent Availability Zones. An
Application Load Balancer can distribute traffic across healthy targets. Increasing instance size
or EBS capacity does not provide AZ-level fault tolerance, while weighted DNS routing alone
does not solve application or database availability.
Q2: A company stores confidential customer documents in Amazon S3. Security
requirements state that objects must be encrypted at rest and that encryption keys must be
controlled by the security team. Which solution best satisfies the requirement?
A) S3 server-side encryption with Amazon S3 managed keys (SSE-S3)
B) S3 server-side encryption with AWS KMS keys (SSE-KMS) using a customer-managed
KMS key
,C) Client-side encryption using an unencrypted key stored in the application source code
D) S3 Transfer Acceleration
Correct Answer: B
Rationale: SSE-KMS allows encryption at rest while providing centralized key management,
access policies, auditing, and key administration through AWS KMS. SSE-S3 provides
encryption but does not provide the same customer-controlled KMS key management
capabilities. Storing encryption keys in source code is insecure, and Transfer Acceleration
concerns data transfer rather than encryption.
Q3: An application running on EC2 needs temporary access to objects in an S3 bucket.
Security policy prohibits storing long-term AWS access keys on the instances. What should
the architect implement?
A) Store access keys in user data
B) Store access keys in an encrypted file on the instance
C) Attach an IAM role to the EC2 instance with the required permissions
D) Create an IAM user for each EC2 instance
Correct Answer: C
Rationale: IAM roles provide temporary credentials to EC2 through the instance metadata
credential mechanism and eliminate the need for long-term credentials. User data, local files,
and individual IAM users create unnecessary credential-management risks.
Q4: A public web application is receiving malicious SQL injection requests. The
application is behind an Application Load Balancer. Which AWS service should be used to
filter HTTP requests based on SQL injection and other web-application attack patterns?
A) AWS Shield Standard only
B) AWS WAF
C) Amazon GuardDuty
D) AWS CloudTrail
Correct Answer: B
Rationale: AWS WAF provides Layer 7 request filtering and managed rules for threats such as
SQL injection and cross-site scripting. Shield primarily provides DDoS protection, GuardDuty
detects suspicious activity, and CloudTrail records API activity.
Q5: An organization requires centralized authentication for employees accessing multiple
AWS accounts. Employees should use their existing corporate identities and should receive
permissions based on job role. Which solution is most appropriate?
A) Create separate IAM users in every AWS account
B) Share one IAM user among employees
C) Use AWS IAM Identity Center integrated with the organization's identity provider
D) Store corporate passwords in AWS Secrets Manager
Correct Answer: C
Rationale: IAM Identity Center is designed for centralized workforce access across AWS
, accounts and applications and can integrate with an external identity provider. Individual IAM
users in every account increase administrative overhead, shared users undermine accountability,
and Secrets Manager is not a workforce authentication platform.
Q6: A company needs to ensure that an S3 bucket can be accessed only through a specific
VPC endpoint. Which control should the architect use?
A) Security group attached to the S3 bucket
B) An S3 bucket policy using the aws:sourceVpce condition key
C) A Network ACL attached to the S3 service
D) A Route 53 private hosted zone
Correct Answer: B
Rationale: S3 bucket policies can restrict access based on the VPC endpoint through which
requests originate using aws:sourceVpce. Security groups and network ACLs do not attach
directly to S3, and DNS configuration does not enforce object-level authorization.
Q7: A company needs a private connection from its VPC to Amazon S3 without sending
traffic through the public internet. Which solution is appropriate?
A) Internet gateway
B) NAT gateway
C) S3 VPC endpoint
D) Bastion host
Correct Answer: C
Rationale: An S3 VPC endpoint provides private connectivity from a VPC to S3 without
requiring an internet gateway or NAT gateway. A bastion host is unrelated to service
connectivity.
Q8: An application needs to retrieve database credentials at runtime. The credentials must
be rotated automatically and should not be embedded in application code. Which service is
most appropriate?
A) Amazon S3
B) AWS Systems Manager Parameter Store with plaintext values
C) AWS Secrets Manager
D) Amazon CloudWatch Logs
Correct Answer: C
Rationale: Secrets Manager is specifically designed for storing, retrieving, and managing
sensitive credentials and supports automated rotation for supported services. Plaintext
configuration and object storage do not provide the same purpose-built secret lifecycle
management.
Q9: A company wants to detect compromised AWS credentials and unusual API activity
across its accounts. Which service should provide threat detection?
A) AWS Config
B) Amazon GuardDuty
