AWS CERTIFIED SOLUTIONS ARCHITECT ASSOCIATE SAA-
C03 EXAM 2026/2027 – EXAM QUESTIONS AND CORRECT
ANSWERS (VERIFIED ANSWERS) PLUS RATIONALE | 2027
Q&A | INSTANT DOWNLOAD PDF
1. A company is designing a new AWS environment with separate accounts for
development, testing, and production. The security team wants to enforce
organization-wide restrictions that individual account administrators cannot
override. Which AWS capability should the company use?
A. IAM groups
B. Service control policies (SCPs)
C. Security groups
D. Resource-based policies
Rationale: SCPs establish permission guardrails across accounts in AWS Organizations. They
limit the maximum available permissions but do not themselves grant permissions.
2. A solutions architect needs to give an EC2 instance permission to read objects
from a specific S3 bucket without storing long-term AWS access keys on the
instance. Which approach should be used?
A. Store an access key in the EC2 user data
B. Create an IAM user and save its credentials in the instance
C. Add the EC2 instance's public IP address to the S3 bucket policy
D. Attach an IAM role to the EC2 instance
Rationale: An IAM role provides temporary credentials to applications running on EC2 through
instance metadata. This avoids the security risks associated with long-term access keys.
3. An organization wants employees to sign in to multiple AWS accounts using their
existing corporate identities. The organization also wants centralized
management of access to AWS accounts. Which service is designed for this
requirement?
A. AWS IAM Identity Center
B. Amazon Cognito
C. AWS Secrets Manager
D. AWS Certificate Manager
Rationale: IAM Identity Center provides centralized workforce access to multiple AWS accounts
and can integrate with external identity providers.
4. A company requires that its AWS account root user be protected against
unauthorized access. Which security measure is most appropriate?
,A. Create an IAM group named RootAdmins
B. Store the root credentials in AWS Secrets Manager
C. Enable multi-factor authentication (MFA) for the root user
D. Attach an administrator policy to the root user
Rationale: MFA adds an additional authentication factor to the root account, which is especially
important because the root user has highly privileged capabilities.
5. An application running on EC2 needs permission to upload files to only one S3
bucket. The security team follows the principle of least privilege. Which policy
design best satisfies the requirement?
A. Allow access to all S3 buckets
B. Grant AdministratorAccess to the EC2 instance
C. Grant s3:* permissions on all resources
D. Allow only the required S3 actions on the required bucket resources
Rationale: Least privilege means granting only the permissions necessary for the workload.
Restricting both actions and resources minimizes unnecessary access.
6. A company hosts a web application in a VPC. The web servers must receive
internet traffic, while the database servers must not be directly reachable from
the internet. Which architecture is appropriate?
A. Place both servers in a public subnet
B. Place web servers in a public subnet and database servers in a private subnet
C. Place web servers in a private subnet and databases in a public subnet
D. Place both servers in a private subnet with public IP addresses
Rationale: Public-facing components can reside in public subnets, while databases should
normally be isolated in private subnets without direct internet exposure.
7. An application in a private subnet needs to download software updates from the
internet. The instances should not accept unsolicited inbound connections from
the internet. Which solution is appropriate?
A. Internet gateway attached directly to the private subnet
B. Public IP addresses on all instances
C. NAT gateway in a public subnet with appropriate private-subnet routing
D. Network ACL allowing all inbound internet traffic
Rationale: A NAT gateway allows resources in private subnets to initiate outbound internet
connections while preventing unsolicited inbound internet connections to those resources.
, 8. A security team needs a stateful network control that allows HTTP traffic to an
application server while restricting other inbound traffic. Which VPC feature is
appropriate?
A. Security group
B. Route table
C. Internet gateway
D. NAT gateway
Rationale: Security groups act as stateful virtual firewalls for resources such as EC2 instances.
They control allowed inbound and outbound traffic.
9. A company wants to protect a public web application against common attacks
such as SQL injection and cross-site scripting. Which AWS service should the
solutions architect recommend?
A. AWS Shield
B. AWS WAF
C. Amazon GuardDuty
D. AWS CloudTrail
Rationale: AWS WAF provides web application firewall capabilities and can use rules to help
protect applications from common web exploits such as SQL injection and cross-site scripting.
10. A company wants automatic detection of suspicious activity and potentially
malicious behavior within its AWS environment. Which service is most
appropriate?
A. AWS Config
B. Amazon Macie
C. AWS Artifact
D. Amazon GuardDuty
Rationale: GuardDuty continuously analyzes relevant AWS data sources for indicators of
compromise and suspicious activity.
11. A company stores sensitive customer information in Amazon S3. The company
wants to automatically identify sensitive data stored in S3 objects. Which service
should be considered?
A. Amazon GuardDuty
B. AWS Shield
C. Amazon Macie
D. AWS CloudTrail
C03 EXAM 2026/2027 – EXAM QUESTIONS AND CORRECT
ANSWERS (VERIFIED ANSWERS) PLUS RATIONALE | 2027
Q&A | INSTANT DOWNLOAD PDF
1. A company is designing a new AWS environment with separate accounts for
development, testing, and production. The security team wants to enforce
organization-wide restrictions that individual account administrators cannot
override. Which AWS capability should the company use?
A. IAM groups
B. Service control policies (SCPs)
C. Security groups
D. Resource-based policies
Rationale: SCPs establish permission guardrails across accounts in AWS Organizations. They
limit the maximum available permissions but do not themselves grant permissions.
2. A solutions architect needs to give an EC2 instance permission to read objects
from a specific S3 bucket without storing long-term AWS access keys on the
instance. Which approach should be used?
A. Store an access key in the EC2 user data
B. Create an IAM user and save its credentials in the instance
C. Add the EC2 instance's public IP address to the S3 bucket policy
D. Attach an IAM role to the EC2 instance
Rationale: An IAM role provides temporary credentials to applications running on EC2 through
instance metadata. This avoids the security risks associated with long-term access keys.
3. An organization wants employees to sign in to multiple AWS accounts using their
existing corporate identities. The organization also wants centralized
management of access to AWS accounts. Which service is designed for this
requirement?
A. AWS IAM Identity Center
B. Amazon Cognito
C. AWS Secrets Manager
D. AWS Certificate Manager
Rationale: IAM Identity Center provides centralized workforce access to multiple AWS accounts
and can integrate with external identity providers.
4. A company requires that its AWS account root user be protected against
unauthorized access. Which security measure is most appropriate?
,A. Create an IAM group named RootAdmins
B. Store the root credentials in AWS Secrets Manager
C. Enable multi-factor authentication (MFA) for the root user
D. Attach an administrator policy to the root user
Rationale: MFA adds an additional authentication factor to the root account, which is especially
important because the root user has highly privileged capabilities.
5. An application running on EC2 needs permission to upload files to only one S3
bucket. The security team follows the principle of least privilege. Which policy
design best satisfies the requirement?
A. Allow access to all S3 buckets
B. Grant AdministratorAccess to the EC2 instance
C. Grant s3:* permissions on all resources
D. Allow only the required S3 actions on the required bucket resources
Rationale: Least privilege means granting only the permissions necessary for the workload.
Restricting both actions and resources minimizes unnecessary access.
6. A company hosts a web application in a VPC. The web servers must receive
internet traffic, while the database servers must not be directly reachable from
the internet. Which architecture is appropriate?
A. Place both servers in a public subnet
B. Place web servers in a public subnet and database servers in a private subnet
C. Place web servers in a private subnet and databases in a public subnet
D. Place both servers in a private subnet with public IP addresses
Rationale: Public-facing components can reside in public subnets, while databases should
normally be isolated in private subnets without direct internet exposure.
7. An application in a private subnet needs to download software updates from the
internet. The instances should not accept unsolicited inbound connections from
the internet. Which solution is appropriate?
A. Internet gateway attached directly to the private subnet
B. Public IP addresses on all instances
C. NAT gateway in a public subnet with appropriate private-subnet routing
D. Network ACL allowing all inbound internet traffic
Rationale: A NAT gateway allows resources in private subnets to initiate outbound internet
connections while preventing unsolicited inbound internet connections to those resources.
, 8. A security team needs a stateful network control that allows HTTP traffic to an
application server while restricting other inbound traffic. Which VPC feature is
appropriate?
A. Security group
B. Route table
C. Internet gateway
D. NAT gateway
Rationale: Security groups act as stateful virtual firewalls for resources such as EC2 instances.
They control allowed inbound and outbound traffic.
9. A company wants to protect a public web application against common attacks
such as SQL injection and cross-site scripting. Which AWS service should the
solutions architect recommend?
A. AWS Shield
B. AWS WAF
C. Amazon GuardDuty
D. AWS CloudTrail
Rationale: AWS WAF provides web application firewall capabilities and can use rules to help
protect applications from common web exploits such as SQL injection and cross-site scripting.
10. A company wants automatic detection of suspicious activity and potentially
malicious behavior within its AWS environment. Which service is most
appropriate?
A. AWS Config
B. Amazon Macie
C. AWS Artifact
D. Amazon GuardDuty
Rationale: GuardDuty continuously analyzes relevant AWS data sources for indicators of
compromise and suspicious activity.
11. A company stores sensitive customer information in Amazon S3. The company
wants to automatically identify sensitive data stored in S3 objects. Which service
should be considered?
A. Amazon GuardDuty
B. AWS Shield
C. Amazon Macie
D. AWS CloudTrail
