AWS Solutions Architect Associate (SAA-C03) Practice Exam

Question 1 AWS Solutions Architect Associate (SAA-C03)

EC2/ECR vulnerability scanning?

Amazon Kinesis Data Streams. User: long-lived ID.
Group: shared policies.
Role: temporary credentials assumed by services or federation. Amazon Inspector. SSM Parameter Store.

Question 2 AWS Solutions Architect Associate (SAA-C03)

Catalog/crawl data in S3?

AWS Glue Data Catalog + Crawlers. CloudTrail: who did what (API audit).
CloudWatch: operational metrics & logs. Application Load Balancer (ALB). Share AMI from source account; grant launch permissions to target account.

Question 3 AWS Solutions Architect Associate (SAA-C03)

Default Lambda regional concurrency?

5 TB. RPO: max data loss.
RTO: max downtime. Spot: 90% off, can be reclaimed.
RI: 1/3-year, specific instance.
SP: 1/3-year, flexible family. 1,000.

Question 4 AWS Solutions Architect Associate (SAA-C03)

PII discovery in S3?

Amazon Macie. Route 53 Resolver Inbound/Outbound Endpoints. Gateway VPC Endpoint. Allow private-subnet instances to make outbound internet calls.

Question 5 AWS Solutions Architect Associate (SAA-C03)

Query S3 with SQL, serverless?

Amazon MSK. AWS Firewall Manager. Athena. S3 + CloudFront with versioned filenames.

Question 6 AWS Solutions Architect Associate (SAA-C03)

Encrypt existing RDS?

Read-after-write, list, and overwrite/delete are all strongly consistent. Snapshot → copy with encryption → restore (you can't encrypt in place). CloudWatch. Amazon Inspector.

Question 7 AWS Solutions Architect Associate (SAA-C03)

Pricing tier for CloudFront where you pay only NA/EU edge?

AWS Directory Service. Amazon SQS (Standard or FIFO). Amazon OpenSearch Service. PriceClass_100.

Question 8 AWS Solutions Architect Associate (SAA-C03)

IaC with TS/Python that compiles to CloudFormation?

AWS Glue. Amazon S3 — durability 99.999999999%. AWS CDK. Spot: 90% off, can be reclaimed.
RI: 1/3-year, specific instance.
SP: 1/3-year, flexible family.

Question 9 AWS Solutions Architect Associate (SAA-C03)

Service for pub/sub fan-out to multiple subscribers?

Share AMI from source account; grant launch permissions to target account. Set the listener security policy that excludes TLS 1.0/1.1. Amazon SNS. CloudFormation Drift Detection.

Question 10 AWS Solutions Architect Associate (SAA-C03)

CloudTrail vs CloudWatch?

Insights: CloudWatch Logs queries.
Athena: SQL over S3. CloudTrail: who did what (API audit).
CloudWatch: operational metrics & logs. Amazon SageMaker. Recommended above 100 MB; required above 5 GB.

Question 11 AWS Solutions Architect Associate (SAA-C03)

Service to centrally control AWS account creation?

Allow private-subnet instances to make outbound internet calls. AWS Control Tower — sets up org, guardrails, account factory. FSx for Lustre. AWS Security Hub.

Question 12 AWS Solutions Architect Associate (SAA-C03)

DynamoDB capacity mode for bursty traffic?

90 days; ship to S3 for longer. S3 Intelligent-Tiering — auto-moves objects, no retrieval fees. 1,000. On-Demand.

Question 13 AWS Solutions Architect Associate (SAA-C03)

Consolidated billing across accounts?

Set the listener security policy that excludes TLS 1.0/1.1. AWS Organizations. 90 days; ship to S3 for longer. S3 Intelligent-Tiering — auto-moves objects, no retrieval fees.

Question 14 AWS Solutions Architect Associate (SAA-C03)

Lambda max execution time?

Multi-AZ: synchronous standby for HA.
Read Replica: async copy for read scaling. 15 minutes. Amazon EFS. Failover routing with primary/secondary records and health checks.

Question 15 AWS Solutions Architect Associate (SAA-C03)

Default region for newly created S3 bucket?

SNS: simple pub/sub.
EventBridge: rich rules, SaaS events, schema registry. Kinesis Data Firehose. Network Load Balancer (NLB). Whatever you specify at create — there is no global default; bucket names are global but data is regional.

Question 16 AWS Solutions Architect Associate (SAA-C03)

Schedule a Lambda?

S3 Object Lock (Governance or Compliance mode). AWS CDK. Snapshot: EBS point-in-time.
AMI: snapshot + launch metadata.
AWS Backup: cross-service policies. EventBridge rule with cron/rate.

Question 17 AWS Solutions Architect Associate (SAA-C03)

How should EC2 get S3 permissions?

AWS Storage Gateway. AWS Glue Data Catalog + Crawlers. 100 buckets by default; raise to 1,000 via support. Attach an IAM Instance Profile with a role granting s3:GetObject.

Question 18 AWS Solutions Architect Associate (SAA-C03)

How does a Spot interruption notify your app?

2-minute notice via instance metadata at http://169.254.169.254/latest/meta-data/spot/instance-action, plus EventBridge event. Amazon EFS. Set the listener security policy that excludes TLS 1.0/1.1. AWS Fargate (with ECS or EKS).

Question 19 AWS Solutions Architect Associate (SAA-C03)

Batch container jobs (genomics, render)?

1,000. S3 Glacier Deep Archive. Amazon SQS (Standard or FIFO). AWS Batch.

Question 20 AWS Solutions Architect Associate (SAA-C03)

Feature that prevents accidental S3 object deletion?

Standard 3–5 hr, Expedited 1–5 min (extra cost), Bulk 5–12 hr. SNS: simple pub/sub.
EventBridge: rich rules, SaaS events, schema registry. Variable demand — granular ACU scaling in seconds. S3 Versioning + MFA Delete.

Question 21 AWS Solutions Architect Associate (SAA-C03)

Run stateless containers without managing servers?

AWS Fargate (with ECS or EKS). Allow private-subnet instances to make outbound internet calls. SSE-S3, SSE-KMS, SSE-C. API Gateway.

Question 22 AWS Solutions Architect Associate (SAA-C03)

EventBridge vs SNS?

SNS: simple pub/sub.
EventBridge: rich rules, SaaS events, schema registry. Configure VPC, subnets, and security groups (creates ENIs). API Gateway. Typically <30 seconds.

Question 23 AWS Solutions Architect Associate (SAA-C03)

Give on-prem DNS access to private hosted zones?

Spot: 90% off, can be reclaimed.
RI: 1/3-year, specific instance.
SP: 1/3-year, flexible family. Route 53 Resolver Inbound/Outbound Endpoints. AWS Glue Data Catalog + Crawlers. Application Load Balancer (ALB).

Question 24 AWS Solutions Architect Associate (SAA-C03)

Service to decouple microservices with at-least-once delivery?

AWS Glue Data Catalog + Crawlers. Amazon SQS (Standard or FIFO). Configure VPC, subnets, and security groups (creates ENIs). API Gateway.

Question 25 AWS Solutions Architect Associate (SAA-C03)

Managed Airflow?

S3 Glacier Instant Retrieval. Same-Region Replication (SRR). RPO: max data loss.
RTO: max downtime. Amazon MWAA.

Question 26 AWS Solutions Architect Associate (SAA-C03)

Use multipart upload for files larger than…?

Amazon SageMaker. Amazon EFS. S3 Glacier Deep Archive. Recommended above 100 MB; required above 5 GB.

Question 27 AWS Solutions Architect Associate (SAA-C03)

Service for automatic DB secret rotation?

AWS Secrets Manager. Variable demand — granular ACU scaling in seconds. No transitive routing; one-to-one only. Use Origin Access Control (OAC); restrict bucket policy to the OAC principal.

Question 28 AWS Solutions Architect Associate (SAA-C03)

Aurora failover time?

Set the listener security policy that excludes TLS 1.0/1.1. Attach an IAM Instance Profile with a role granting s3:GetObject. Typically <30 seconds. AWS Chatbot — pipes alarms/security alerts to Slack/Teams.

Question 29 AWS Solutions Architect Associate (SAA-C03)

Stream processing service?

6 copies across 3 AZs, automatic. Amazon Kinesis Data Streams. CloudFormation Drift Detection. Kinesis Data Analytics (Apache Flink) or Lambda.

Question 30 AWS Solutions Architect Associate (SAA-C03)

AWS service to auto-scale reads for a relational DB?

2-minute notice via instance metadata at http://169.254.169.254/latest/meta-data/spot/instance-action, plus EventBridge event. RDS Read Replicas or Aurora Replicas. AWS Organizations. Set the listener security policy that excludes TLS 1.0/1.1.

Question 31 AWS Solutions Architect Associate (SAA-C03)

Cheapest S3 class for rarely-accessed data with 12h retrieval?

15 minutes. Amazon OpenSearch Service. S3 Glacier Deep Archive. SSM Session Manager — no inbound ports, IAM-controlled.

Question 32 AWS Solutions Architect Associate (SAA-C03)

Root account best practice?

Spot: 90% off, can be reclaimed.
RI: 1/3-year, specific instance.
SP: 1/3-year, flexible family. Hardware MFA, no access keys, locked away. 5 TB. Variable demand — granular ACU scaling in seconds.

Question 33 AWS Solutions Architect Associate (SAA-C03)

Hybrid file storage with on-prem cache?

IAM Identity Center. Application Load Balancer (ALB). Pre-signed URLs. AWS Storage Gateway.

Question 34 AWS Solutions Architect Associate (SAA-C03)

Glacier flexible retrieval times?

Standard 3–5 hr, Expedited 1–5 min (extra cost), Bulk 5–12 hr. AWS Glue. AWS Organizations. No transitive routing; one-to-one only.

Question 35 AWS Solutions Architect Associate (SAA-C03)

Cross-account S3 access — recommended?

100 buckets by default; raise to 1,000 via support. CloudTrail: who did what (API audit).
CloudWatch: operational metrics & logs. 1,000. Bucket policy granting account B's role + IAM role in B with required permissions.

Question 36 AWS Solutions Architect Associate (SAA-C03)

Distributed tracing service?

AWS X-Ray. AWS Batch. Spot: 90% off, can be reclaimed.
RI: 1/3-year, specific instance.
SP: 1/3-year, flexible family. Share AMI from source account; grant launch permissions to target account.

Question 37 AWS Solutions Architect Associate (SAA-C03)

Real-time stream of millions of events/sec with replay?

AWS Glue Data Catalog + Crawlers. Memcached: simple cache, multi-threaded.
Redis: persistence, replication, pub/sub, structures. AWS X-Ray. Amazon Kinesis Data Streams.

Question 38 AWS Solutions Architect Associate (SAA-C03)

How to deploy CloudFront in front of a static S3 site privately?

AWS Global Accelerator. Use Origin Access Control (OAC); restrict bucket policy to the OAC principal. Snapshot: EBS point-in-time.
AMI: snapshot + launch metadata.
AWS Backup: cross-service policies. AWS Organizations.

Question 39 AWS Solutions Architect Associate (SAA-C03)

Spark ETL without managing clusters?

Snapshot → copy with encryption → restore (you can't encrypt in place). AWS Glue. AWS Chatbot — pipes alarms/security alerts to Slack/Teams. AWS Directory Service.

Question 40 AWS Solutions Architect Associate (SAA-C03)

How to require HTTPS in CloudFront?

CloudFormation Drift Detection. Global Secondary Index (GSI) or LSI. Amazon Macie. Set Viewer Protocol Policy to HTTPS Only or Redirect HTTP→HTTPS.

Question 41 AWS Solutions Architect Associate (SAA-C03)

Account compliance / config tracking?

AWS Config. Amazon MSK. Snapshot → copy with encryption → restore (you can't encrypt in place). Amazon MWAA.

Question 42 AWS Solutions Architect Associate (SAA-C03)

Why use a NAT Gateway?

S3 Versioning + MFA Delete. Network Load Balancer (NLB). AWS Shield (Standard or Advanced). Allow private-subnet instances to make outbound internet calls.

Question 43 AWS Solutions Architect Associate (SAA-C03)

ML cost anomaly detection?

AWS Cost Anomaly Detection. Amazon SQS (Standard or FIFO). Same-Region Replication (SRR). Share AMI from source account; grant launch permissions to target account.

Question 44 AWS Solutions Architect Associate (SAA-C03)

Spot vs Reserved vs Savings Plans?

AWS X-Ray. AWS Storage Gateway. Service Quotas console — raise via request, tracked per service+region. Spot: 90% off, can be reclaimed.
RI: 1/3-year, specific instance.
SP: 1/3-year, flexible family.

Question 45 AWS Solutions Architect Associate (SAA-C03)

Centrally apply firewall rules across accounts?

On-Demand. Amazon SageMaker. AWS Firewall Manager. AMP + Amazon Managed Grafana.

Question 46 AWS Solutions Architect Associate (SAA-C03)

Batch + deliver streaming to S3/Redshift?

Kinesis Data Analytics (Apache Flink) or Lambda. Multi-AZ: synchronous standby for HA.
Read Replica: async copy for read scaling. Kinesis Data Firehose. AWS Application Migration Service (MGN).

Question 47 AWS Solutions Architect Associate (SAA-C03)

Where do you see Service Quotas for an account?

Amazon MWAA. AWS Chatbot — pipes alarms/security alerts to Slack/Teams. SNS: simple pub/sub.
EventBridge: rich rules, SaaS events, schema registry. Service Quotas console — raise via request, tracked per service+region.

Question 48 AWS Solutions Architect Associate (SAA-C03)

Detect drift in IaC?

CloudFormation Drift Detection. AWS Control Tower — sets up org, guardrails, account factory. 2-minute notice via instance metadata at http://169.254.169.254/latest/meta-data/spot/instance-action, plus EventBridge event. Set the listener security policy that excludes TLS 1.0/1.1.

Question 49 AWS Solutions Architect Associate (SAA-C03)

Enforce TLS 1.2+ on ALB?

Application Load Balancer (ALB). Set the listener security policy that excludes TLS 1.0/1.1. Tracks a CloudWatch metric and triggers via alarms + scaling policies. Amazon S3 — durability 99.999999999%.

Question 50 AWS Solutions Architect Associate (SAA-C03)

Service for federated SSO with SAML/OIDC?

ECS: AWS-native.
EKS: managed Kubernetes. Backup & Restore → Pilot Light → Warm Standby → Multi-site Active/Active. IAM Identity Center. RDS Read Replicas or Aurora Replicas.