AWS Certified Solutions Architect – Associate SAA-C03 Exam 2026:
Certification Practice Test — Secure, Resilient, High-Performing &
Cost-Optimized Cloud Architectures — 190 Multiple-Choice
Questions with Answers & Detailed Rationales
DOMAIN 1: DESIGN SECURE ARCHITECTURES (Questions 1–57)
Question 1
A solutions architect needs to design a strategy that ensures all IAM users in an organization
use multi-factor authentication (MFA) before performing any console actions. The
organization uses AWS Organizations with multiple member accounts. Which approach
provides the most comprehensive enforcement?
A. Enable MFA on each IAM user individually across all member accounts.
B. Create an IAM policy that denies all actions unless aws:MultiFactorAuthPresent is true,
and attach it to all users.
C. Use an AWS Organizations service control policy (SCP) that denies actions when MFA is
not present.
D. Configure AWS IAM Identity Center to require MFA and disable IAM users entirely.
Correct Answer: C
Explanation: SCPs apply organization-wide and enforce MFA at the account level, providing
comprehensive control across all member accounts without per-user management.
Question 2
A company stores sensitive customer data in Amazon S3. Compliance requires that all data
be encrypted at rest with keys that the company controls and rotates annually. The security
team also needs to audit every key usage. Which solution meets these requirements?
,A. S3-managed encryption keys (SSE-S3) with bucket versioning enabled.
B. Customer-provided encryption keys (SSE-C) stored in AWS Secrets Manager.
C. AWS KMS customer managed keys (SSE-KMS) with automatic annual rotation enabled.
D. Client-side encryption using an open-source library before uploading to S3.
Correct Answer: C
Explanation: SSE-KMS with customer managed keys provides key control, audit trails through
CloudTrail, and supports automatic annual rotation.
Question 3
An application running on Amazon EC2 instances in a private subnet needs to access an
Amazon DynamoDB table. The security policy prohibits traffic from traversing the public
internet. Which solution should the solutions architect implement?
A. Configure a NAT Gateway in the public subnet for outbound traffic.
B. Create a VPC endpoint for DynamoDB and associate it with the private subnet route table.
C. Attach an Elastic IP address to each EC2 instance.
D. Use AWS Direct Connect to establish a private connection to DynamoDB.
Correct Answer: B
Explanation: A Gateway VPC endpoint for DynamoDB enables private connectivity within the
AWS network, eliminating internet exposure entirely.
Question 4
,A solutions architect is designing a multi-account AWS environment for a large enterprise.
The security team needs centralized visibility into all API activity across every account. Which
service should be configured?
A. Enable AWS CloudTrail in each account and aggregate logs into a central S3 bucket.
B. Use Amazon CloudWatch Logs in each account with cross-account subscription filters.
C. Configure AWS Config in each account and use an aggregator.
D. Enable VPC Flow Logs in every VPC and ship to a central destination.
Correct Answer: A
Explanation: Organization trail in CloudTrail automatically logs activity across all accounts to
a central S3 bucket for unified visibility.
Question 5
A company requires that all data stored in Amazon RDS be encrypted at rest. The database
has already been created without encryption enabled. What must the solutions architect do
to enable encryption?
A. Modify the RDS instance and enable encryption in place.
B. Create an encrypted read replica and promote it to primary.
C. Take a snapshot, copy it with encryption enabled, and restore from the encrypted
snapshot.
D. Enable encryption through the RDS console by selecting the database and choosing
"Encrypt."
Correct Answer: C
, Explanation: RDS encryption cannot be enabled in place; snapshot copy with encryption
followed by restore is the standard migration path.
Question 6
A web application hosted on AWS needs protection against common web exploits such as
SQL injection and cross-site scripting. The application runs behind an Application Load
Balancer. Which service should be deployed?
A. AWS Shield Advanced
B. AWS WAF with managed rule groups attached to the ALB.
C. Amazon GuardDuty with automated remediation.
D. Network ACLs with deny rules for malicious IP addresses.
Correct Answer: B
Explanation: AWS WAF operates at Layer 7 and provides managed rules specifically designed
to block SQL injection and XSS attacks.
Question 7
A solutions architect must design a solution that allows an on-premises Active Directory to
be used for authenticating users to AWS resources without creating separate IAM users.
Which approach is most appropriate?
A. Create IAM users for each employee and synchronize passwords manually.
B. Configure SAML 2.0 federation between Active Directory Federation Services and AWS
IAM.
C. Use AWS Directory Service for Microsoft AD and enable AWS Management Console
access.
Certification Practice Test — Secure, Resilient, High-Performing &
Cost-Optimized Cloud Architectures — 190 Multiple-Choice
Questions with Answers & Detailed Rationales
DOMAIN 1: DESIGN SECURE ARCHITECTURES (Questions 1–57)
Question 1
A solutions architect needs to design a strategy that ensures all IAM users in an organization
use multi-factor authentication (MFA) before performing any console actions. The
organization uses AWS Organizations with multiple member accounts. Which approach
provides the most comprehensive enforcement?
A. Enable MFA on each IAM user individually across all member accounts.
B. Create an IAM policy that denies all actions unless aws:MultiFactorAuthPresent is true,
and attach it to all users.
C. Use an AWS Organizations service control policy (SCP) that denies actions when MFA is
not present.
D. Configure AWS IAM Identity Center to require MFA and disable IAM users entirely.
Correct Answer: C
Explanation: SCPs apply organization-wide and enforce MFA at the account level, providing
comprehensive control across all member accounts without per-user management.
Question 2
A company stores sensitive customer data in Amazon S3. Compliance requires that all data
be encrypted at rest with keys that the company controls and rotates annually. The security
team also needs to audit every key usage. Which solution meets these requirements?
,A. S3-managed encryption keys (SSE-S3) with bucket versioning enabled.
B. Customer-provided encryption keys (SSE-C) stored in AWS Secrets Manager.
C. AWS KMS customer managed keys (SSE-KMS) with automatic annual rotation enabled.
D. Client-side encryption using an open-source library before uploading to S3.
Correct Answer: C
Explanation: SSE-KMS with customer managed keys provides key control, audit trails through
CloudTrail, and supports automatic annual rotation.
Question 3
An application running on Amazon EC2 instances in a private subnet needs to access an
Amazon DynamoDB table. The security policy prohibits traffic from traversing the public
internet. Which solution should the solutions architect implement?
A. Configure a NAT Gateway in the public subnet for outbound traffic.
B. Create a VPC endpoint for DynamoDB and associate it with the private subnet route table.
C. Attach an Elastic IP address to each EC2 instance.
D. Use AWS Direct Connect to establish a private connection to DynamoDB.
Correct Answer: B
Explanation: A Gateway VPC endpoint for DynamoDB enables private connectivity within the
AWS network, eliminating internet exposure entirely.
Question 4
,A solutions architect is designing a multi-account AWS environment for a large enterprise.
The security team needs centralized visibility into all API activity across every account. Which
service should be configured?
A. Enable AWS CloudTrail in each account and aggregate logs into a central S3 bucket.
B. Use Amazon CloudWatch Logs in each account with cross-account subscription filters.
C. Configure AWS Config in each account and use an aggregator.
D. Enable VPC Flow Logs in every VPC and ship to a central destination.
Correct Answer: A
Explanation: Organization trail in CloudTrail automatically logs activity across all accounts to
a central S3 bucket for unified visibility.
Question 5
A company requires that all data stored in Amazon RDS be encrypted at rest. The database
has already been created without encryption enabled. What must the solutions architect do
to enable encryption?
A. Modify the RDS instance and enable encryption in place.
B. Create an encrypted read replica and promote it to primary.
C. Take a snapshot, copy it with encryption enabled, and restore from the encrypted
snapshot.
D. Enable encryption through the RDS console by selecting the database and choosing
"Encrypt."
Correct Answer: C
, Explanation: RDS encryption cannot be enabled in place; snapshot copy with encryption
followed by restore is the standard migration path.
Question 6
A web application hosted on AWS needs protection against common web exploits such as
SQL injection and cross-site scripting. The application runs behind an Application Load
Balancer. Which service should be deployed?
A. AWS Shield Advanced
B. AWS WAF with managed rule groups attached to the ALB.
C. Amazon GuardDuty with automated remediation.
D. Network ACLs with deny rules for malicious IP addresses.
Correct Answer: B
Explanation: AWS WAF operates at Layer 7 and provides managed rules specifically designed
to block SQL injection and XSS attacks.
Question 7
A solutions architect must design a solution that allows an on-premises Active Directory to
be used for authenticating users to AWS resources without creating separate IAM users.
Which approach is most appropriate?
A. Create IAM users for each employee and synchronize passwords manually.
B. Configure SAML 2.0 federation between Active Directory Federation Services and AWS
IAM.
C. Use AWS Directory Service for Microsoft AD and enable AWS Management Console
access.
