A multi-tenant SaaS application requires customer-managed encryption keys where each tenant manages their own key policy and annual rotation schedule. Which AWS KMS solution fulfills this design requirement?

AWS Managed Keys generated automatically per integrated AWS service

Customer Managed Keys (CMKs) created within AWS KMS with custom tenant key policies

AWS Owned Keys shared across multiple internal service accounts

CloudHSM clusters shared with tenant root accounts

A solutions architect must grant an external vendor's AWS account access to assume an IAM role in the company's account while preventing the Confused Deputy security problem. What should be included in the role trust policy?

An ExternalId condition check alongside the vendor's principal AWS account ARN

A Multi-Factor Authentication (MFA) requirement with an embedded root access token

An IP address CIDR block condition restricted to 0.0.0.0/0

A Service Control Policy denying all sts:AssumeRole actions

A financial regulatory agency requires that audit logs stored in an Amazon S3 bucket cannot be deleted, modified, or overwritten by any user, including the AWS Account Root User, for exactly 10 years. How should this be implemented?

Enable S3 Versioning and configure S3 Object Lock in Governance Mode with an IAM bypass permission

Attach an S3 Bucket Policy with an explicit Deny statement for s3:DeleteObject matching Principal '*'

Configure S3 Glacier Flexible Retrieval with a Vault Access Policy granting admin override

Enable S3 Versioning and configure S3 Object Lock in Compliance Mode with a 10-year retention period

EC2 instances situated inside a private subnet require access to Amazon S3 to download large model artifacts. Company security policy prohibits internet-bound traffic and demands zero data transfer charges. What should be deployed?

An AWS NAT Gateway deployed in the public subnet with an elastic IP

An AWS Transit Gateway peered with an on-premises proxy appliance

A VPC Gateway Endpoint for Amazon S3 attached to the private subnet's route table

An Interface VPC Endpoint (AWS PrivateLink) with hourly endpoint billing

A web tier of EC2 instances in a private subnet communicates with backend microservices on port 8443. The security team insists on least privilege. How should the backend Security Group be configured?

Inbound rule allowing all TCP traffic with the source set to 10.0.0.0/16

Inbound rule allowing TCP port 8443 with the source set to the Web Tier Security Group ID

Inbound rule allowing TCP port 8443 with the source set to 0.0.0.0/0

Outbound rule on the backend allowing ephemeral ports 1024-65535 to the internet

An e-commerce API is experiencing distributed HTTP flood attacks originating from compromised residential proxy networks. Which AWS WAF feature should be configured to automatically throttle clients making more than 2,000 requests per 5 minutes?

AWS WAF Rate-Based Rule Statement configured on client IP or forwarded headers

AWS Shield Standard automated SYN flood mitigation filter

Network Access Control List stateless rate limiting rule

Amazon Route 53 Geolocation latency bias adjuster

An enterprise application requires centralized authentication for external consumers, supporting social identity providers, multi-factor authentication (MFA), and issuance of OIDC-compliant JWT tokens. Which service fulfills this?

Amazon Cognito Identity Pools (Federated Identities)

AWS IAM Identity Center (AWS SSO)

AWS Directory Service AD Connector

A legacy database application running on EC2 requires database credentials to be rotated every 30 days without application downtime. Which solution automates rotation seamlessly?

AWS Systems Manager Parameter Store Standard Tier with a cron script in crontab

Amazon S3 bucket storing encrypted JSON files with S3 Lifecycle expiration

AWS Secrets Manager with automated rotation enabled using a pre-built Lambda function

AWS Key Management Service with annual key rotation enabled

To eliminate the operational overhead and security exposure of managing bastion hosts and SSH key pairs, how should systems engineers access private EC2 instances in an isolated VPC?

EC2 Instance Connect with permanent port 22 open to the corporate gateway IP

AWS Systems Manager Session Manager with IAM policy controls and SSM Agent

Amazon Route 53 Private Hosted Zone resolving SSH hostnames over the internet

AWS Client VPN terminating directly onto an Internet Gateway

An enterprise needs to inspect outbound HTTP and HTTPS traffic from private VPC instances to enforce URL domain allowlists and block communication with malicious C2 domains using Suricata IPS rules. Which service meets this?

AWS Web Application Firewall (AWS WAF) attached to an Internet Gateway

VPC Network Access Control Lists (NACLs) filtering port 443 outbound

Amazon GuardDuty VPC Flow Log Anomaly Detector

AWS Network Firewall with stateful domain list filtering and Suricata rule groups

Certifications / HARD

AWS Solutions Architect Associate Practice Test (SAA-C03): 100 Exam Questions

Pass the AWS Solutions Architect Associate SAA-C03 exam with 100 scenario-based questions on multi-tier architectures, VPC design, S3, SQS, and disaster recovery.

100Questions

90mDuration

+1Marks / Q

NoneNegative Marks

AWS Certified Solutions Architect - Associate (SAA-C03) Practice Exam

Pass the AWS Solutions Architect Associate (SAA-C03) certification exam with confidence. Featuring 100 complex, scenario-based practice questions, this exam tests your ability to design resilient, high-performing, secure, and cost-optimized distributed systems on Amazon Web Services.

SAA-C03 Architecture Domains

Questions are balanced according to the official AWS SAA-C03 exam guide:

Design Secure Architectures (30%): Deep IAM policy evaluation (Resource policies, Permission boundaries, SCPs), secure VPC peering and Transit Gateway topologies, hybrid cloud connectivity with AWS Direct Connect and IPsec VPN, security automation using AWS KMS and AWS Secrets Manager, and perimeter protection using AWS WAF and Shield Advanced.
Design Resilient Architectures (26%): Decoupled messaging architectures using Amazon SQS (FIFO vs standard queues, visibility timeouts), Amazon SNS pub/sub, and Amazon EventBridge event buses; multi-Region active-active and active-passive disaster recovery strategies (RTO/RPO targets, Pilot Light, Warm Standby); and auto-scaling group health check policies.
Design High-Performing Architectures (24%): High-throughput storage solutions with Amazon S3 Transfer Acceleration, Amazon FSx for Lustre high-performance computing, Amazon DynamoDB Accelerator (DAX) microsecond caching, Amazon Aurora Global Databases with cross-Region replication, and horizontal read scaling with RDS Read Replicas.
Design Cost-Optimized Architectures (20%): Storage lifecycle management transitioning unaccessed data to Amazon S3 Glacier, serverless architectures replacing idle compute instances, optimal EC2 compute fleet provisioning (Savings Plans, Reserved, Spot Instances), and AWS Compute Optimizer recommendations.

Architectural Trade-off Evaluation

Every question simulates real client requirements: migrating monolithic legacy applications to microservices, selecting between ALB (Application Load Balancer) path-based routing and NLB (Network Load Balancer) ultra-low latency TCP/UDP routing, and resolving database write bottlenecks under bursty workloads.

Testing Parameters

Standardized testing rules & scoring benchmarks

Volume 100 scenario-driven multiple-choice questions.

Passing Standard 70% passing grade.

In-Depth Rationales Detailed architectural explanations analyzing why specific AWS services best fulfill availability, security, and cost constraints.

Keep Practicing

Related Quizzes & Challenges

Strengthen your understanding with more interactive technical tests in this domain.

Showing 4 of 8 related tests

SEO & Speed•100 Qs

Website Speed & Frontend Optimization Challenge: 100 Performance Questions

Challenge your web performance expertise with 100 questions covering CDN caching, critical rendering path, code splitting, lazy loading, and asset minification.

90m

Take Quiz

Cybersecurity•100 Qs

Web Security Headers Quiz: 100 CSP, HSTS, CORS & Cookie Questions

Validate your browser security knowledge with 100 practice questions on Content Security Policy (CSP), HSTS, X-Frame-Options, CORS, and cookie prefixes.

90m•1

Take Quiz

Cybersecurity•100 Qs

Web Security & HTTP Headers Implementation Quiz: 100 Technical Questions

Test your web security deployment skills with 100 practice questions on Nginx and Apache header directives, TLS ciphers, SRI, and browser policies.

90m

Take Quiz

General Knowledge•100 Qs

Web Design Principles & UI/UX Architecture Test: 100 Questions

Validate your UI/UX and web design knowledge with 100 questions covering visual hierarchy, design systems, responsive typography, and cognitive ergonomics.

90m

Take Quiz

AWS Certified Solutions Architect - Associate (SAA-C03) Practice Exam

SAA-C03 Architecture Domains

Architectural Trade-off Evaluation

Testing Parameters

Related Quizzes & Challenges

Website Speed & Frontend Optimization Challenge: 100 Performance Questions

Web Security Headers Quiz: 100 CSP, HSTS, CORS & Cookie Questions

Web Security & HTTP Headers Implementation Quiz: 100 Technical Questions

Web Design Principles & UI/UX Architecture Test: 100 Questions

Supercharge Your Linux & Cloud Workloads with Hostinger