10 beginner questions on the SAA-C03 domains: Design Secure Architectures (IAM roles, NAT gateways, security groups), Design Resilient Architectures (SQS decoupling, RDS Multi-AZ, multi-AZ Auto Scaling), Design High-Performing Architectures (ElastiCache, EFS) and Design Cost-Optimized Architectures (S3 storage classes, Spot Instances).

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. An application on an Amazon EC2 instance must read objects from an S3 bucket. What is the most secure way to give the application AWS credentials?

    • A. Save an IAM user's access keys in the application's configuration file
    • B. Attach an IAM role to the instance through an instance profile ✔ correct
    • C. Pass the root user's access keys to the instance in user data
    • D. Make the bucket public so that no credentials are needed

    Answer: B. An IAM role attached through an instance profile gives the application temporary credentials that rotate automatically, so no long-term keys are stored on the instance. Public buckets and stored keys create avoidable risk.

    Source: docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html · Domain: Design Secure Architectures

  2. EC2 instances in a private subnet must download software updates from the internet, but nobody on the internet may start connections to them. What should a solutions architect add?

    • A. A virtual private gateway attached to the VPC
    • B. A VPC gateway endpoint for Amazon S3
    • C. A NAT gateway in a public subnet, with a route from the private subnet ✔ correct
    • D. A route from the private subnet directly to the internet gateway

    Answer: C. A NAT gateway in a public subnet lets instances in private subnets connect out to the internet while blocking connections started from outside. A direct internet gateway route would make the subnet public.

    Source: docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html · Domain: Design Secure Architectures

  3. Security groups are stateful: if an inbound rule allows a request, the response traffic for that request is allowed out automatically, regardless of outbound rules.

    • A. True ✔ correct
    • B. False

    Answer: A. True. Security groups track connections, so responses to allowed requests are permitted. Network ACLs are stateless and need explicit rules in both directions.

    Source: docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html · Domain: Design Secure Architectures

  4. A company's web tier sends orders directly to a processing tier. During traffic spikes the processing tier is overwhelmed and orders are lost. Which change decouples the tiers so that no orders are lost?

    • A. Put an Amazon SQS queue between the web tier and the processing tier ✔ correct
    • B. Move the web tier to a larger EC2 instance type
    • C. Add an Amazon ElastiCache cluster in front of the web tier
    • D. Use Amazon Route 53 latency-based routing for the web tier

    Answer: A. An SQS queue stores messages durably until consumers process them, so the processing tier can work at its own pace and scale on queue depth. The other options do not buffer the orders.

    Source: docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/welcome.html · Domain: Design Resilient Architectures

  5. A production Amazon RDS for MySQL database must fail over automatically if its Availability Zone has an outage. Which feature meets this need?

    • A. A read replica in the same Availability Zone
    • B. A larger DB instance class
    • C. Manual DB snapshots taken every hour
    • D. A Multi-AZ deployment ✔ correct

    Answer: D. A Multi-AZ deployment keeps a synchronously replicated standby in another Availability Zone and fails over to it automatically. Snapshots need a manual restore, and a same-AZ replica shares the outage.

    Source: docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZSingleStandby.htm · Domain: Design Resilient Architectures

  6. A web application runs on EC2 instances. Which two design choices make it highly available if one Availability Zone fails? (Select TWO)

    • A. Launch all instances in one cluster placement group
    • B. Use an Application Load Balancer that spans multiple Availability Zones ✔ correct
    • C. Run one large instance with an Elastic IP address
    • D. Store user sessions only on instance store volumes
    • E. Use an Auto Scaling group that spans multiple Availability Zones ✔ correct

    Answer: B, E. An Auto Scaling group spread across AZs replaces failed instances and keeps capacity in healthy zones, and a multi-AZ load balancer sends traffic only to healthy targets. A cluster placement group sits in a single AZ.

    Source: docs.aws.amazon.com/autoscaling/ec2/userguide/auto-scaling-benefits.html · Domain: Design Resilient Architectures

  7. A read-heavy application runs the same database queries again and again. The team wants an in-memory layer that returns these results with very low latency. Which service should they add?

    • A. Amazon Redshift
    • B. Amazon ElastiCache ✔ correct
    • C. Amazon S3 Glacier Flexible Retrieval
    • D. AWS Backup

    Answer: B. Amazon ElastiCache is a managed in-memory cache (Valkey, Redis OSS, Memcached) that serves frequently read data with low latency and reduces database load. Redshift is a data warehouse; Glacier is archival storage.

    Source: docs.aws.amazon.com/AmazonElastiCache/latest/dg/WhatIs.html · Domain: Design High-Performing Architectures

  8. Many Linux EC2 instances in different Availability Zones must read and write the same files at the same time through a shared file system. Which storage service fits?

    • A. One Amazon EBS gp3 volume
    • B. EC2 instance store volumes
    • C. Amazon EFS ✔ correct
    • D. Amazon S3 Glacier Deep Archive

    Answer: C. Amazon EFS is a managed, elastic NFS file system that many instances across Availability Zones can mount at the same time. An EBS volume lives in one AZ, and instance store is local to one host.

    Source: docs.aws.amazon.com/efs/latest/ug/whatisefs.html · Domain: Design High-Performing Architectures

  9. A company stores data in Amazon S3 but cannot predict how often each object will be read, and access patterns change over time. Which storage class optimizes cost automatically?

    • A. S3 Intelligent-Tiering ✔ correct
    • B. S3 Standard
    • C. S3 Express One Zone
    • D. Amazon EBS Cold HDD (sc1)

    Answer: A. S3 Intelligent-Tiering is designed for data with unknown or changing access patterns: it monitors access and moves objects between tiers automatically, with no retrieval fees. EBS sc1 is block storage, not S3.

    Source: docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html · Domain: Design Cost-Optimized Architectures

  10. Spot Instances are a good cost-saving choice for a production database that must never be interrupted.

    • A. True
    • B. False ✔ correct

    Answer: B. False. Amazon EC2 can interrupt Spot Instances when it needs the capacity back, so they fit stateless, flexible or fault-tolerant workloads, not a database that must run without interruption.

    Source: docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html · Domain: Design Cost-Optimized Architectures

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public AWS exam objectives (SAA-C03 exam guide (docs.aws.amazon.com, current edition)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by AWS; exam names are trademarks of their owners. Official exam page: aws.amazon.com/certification/certified-solutions-architect-associate/.

Last modified: Sunday, 25 October 2026, 9:57 PM