Amazon Web Services · Free Practice Questions · Last reviewed May 2026
24real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
30% of exam · 6 sample questions below
An application in Account B (IAM role arn:aws:iam::account-b:role/app-read) reads objects from an S3 bucket in Account A. The bucket uses SSE-KMS with a customer-managed KMS key in Account A. Object reads consistently fail with an error that includes "AccessDenied" and "kms:Decrypt".
The IAM permissions in Account B for kms:Decrypt are correct, but the requests still fail.
Which change will most directly fix the failure?
Add kms:Decrypt to the KMS key policy in Account A for the Account B role arn:aws:iam::account-b:role/app-read, and remove kms:Decrypt from the role policy in Account B.
Update the IAM role in Account B to use the s3:GetObject permission only, and rely on S3 to authorize KMS decrypt automatically.
Modify the KMS key policy in Account A to allow kms:Decrypt for the Account B role arn:aws:iam::account-b:role/app-read, using the appropriate cross-account conditions (for example, allowing the use via S3 and the expected encryption context for the bucket).
For SSE-KMS, S3 must call KMS Decrypt when serving objects. KMS authorization is evaluated against the KMS key policy in Account A in addition to the identity policy in Account B. If the error includes kms:Decrypt AccessDenied in a cross-account scenario, the most direct fix is to update the KMS key policy to allow the Account B role to use the key for decrypt (often with conditions tied to S3 usage and the specific bucket/object encryption context).
Switch the S3 bucket encryption from SSE-KMS to SSE-S3, keeping all existing IAM and KMS configuration unchanged.
A third-party payroll vendor in another AWS account must assume a role in your account to write a daily settlement file to Amazon S3. You want to prevent confused-deputy attacks and make every assumed session traceable in CloudTrail back to an individual vendor user. Which three trust-policy or session controls should be used? Select three.
Specify the exact vendor role ARN as the trusted principal in the role trust policy.
The trust policy should name only the specific vendor role that is allowed to assume the role in your account. Restricting the principal minimizes the trust boundary and prevents unrelated identities from attempting the assumption path.
Require an external ID in the trust policy conditions.
An external ID helps prevent confused-deputy attacks because the vendor must present a value that your account and the vendor agreed on. That prevents another customer from tricking the vendor into using the same role on their behalf.
Require sts:SourceIdentity when the vendor assumes the role.
SourceIdentity is recorded in CloudTrail and becomes part of the assumed-role session context. Requiring it gives investigators a way to trace the session back to the individual vendor user or workload that initiated the role assumption.
Use a wildcard principal and rely on the S3 bucket policy to narrow access later.
Give the vendor long-term IAM user credentials in your account for easier auditing.
A SaaS vendor will access your AWS resources by assuming an IAM role in your account. You want to prevent confused-deputy attacks and ensure the vendor can only assume the role using an agreed external identifier.
Your role trust policy currently allows sts:AssumeRole from the vendor’s principal, but it does not include any external ID protection. Which change is the best next step?
Add a condition to the trust policy: Condition = {"StringEquals": {"sts:ExternalId": "vendor-agreed-id"}}.
Using sts:ExternalId in the trust policy ensures only assume-role requests presenting the correct external identifier are allowed. This directly mitigates confused-deputy attacks by binding authorization to a value the vendor must know. It also keeps the permissions model clean, because the check is enforced during the STS AssumeRole request.
Add a condition to the trust policy: Condition = {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}.
Remove sts:AssumeRole and replace it with sts:AssumeRoleWithWebIdentity to use the vendor’s browser-based tokens.
Add a condition to the role permissions policy (not the trust policy) requiring aws:PrincipalTag/ExternalId to equal the external identifier.
A team wants detective controls to investigate suspected exfiltration from an S3 bucket. They need to know when objects are accessed (GetObject) and also when new encrypted objects are written.
They already enabled AWS CloudTrail for management events, but their investigation shows no visibility into object-level reads/writes in the logs they review.
Which CloudTrail configuration change most directly provides the missing object-level visibility?
Enable CloudTrail data events for the specific S3 bucket so that GetObject and PutObject operations are logged at the object level.
CloudTrail management events cover control-plane activity, not per-object access details in S3. Enabling S3 data events (object-level logging) causes CloudTrail to record events like GetObject and PutObject for the targeted bucket and prefixes. This directly addresses the missing visibility symptom described. It also limits logging scope when you specify the bucket/prefix.
Enable AWS Config delivery to a separate bucket and create a rule to detect noncompliant S3 policies; this will automatically generate GetObject logs.
Turn on VPC Flow Logs for the VPC hosting the S3 gateway endpoint, because network logs show S3 object read and write details.
Add an S3 bucket policy that denies all GetObject requests unless the caller uses TLS; the denial events will create investigation logs automatically.
A web application runs in private subnets with no NAT gateway. It needs to retrieve credentials from AWS Secrets Manager at runtime. After a recent network hardening change, the application logs timeout errors when calling Secrets Manager.
Which change will most directly enable private connectivity to Secrets Manager while keeping the subnets NAT-free?
Create an interface VPC endpoint (AWS PrivateLink) for the Secrets Manager service and update the security group rules to allow HTTPS from the application subnets.
An interface VPC endpoint provides private, route-table-scoped connectivity to Secrets Manager without internet access or NAT. Security group rules on the endpoint enforce which subnets/instances can reach it.
Add a public DNS entry in the instance /etc/hosts pointing Secrets Manager to the instance’s private IP so requests do not leave the VPC.
Attach an internet gateway to the private route table so that Secrets Manager traffic can reach public endpoints without NAT.
Enable S3 VPC endpoint and store the secrets in an S3 bucket instead of Secrets Manager, then retrieve them using S3 gateway endpoints.
Your team hosts a private web app on an S3 bucket and serves it through CloudFront using a modern Origin Access Control (OAC). After deployment, users receive HTTP 403 from CloudFront with the S3 origin error "AccessDenied".
Which S3 bucket policy change best aligns with CloudFront OAC so the distribution can fetch objects privately?
Allow the CloudFront service principal cloudfront.amazonaws.com to perform s3:GetObject, and scope access with a condition on AWS:SourceArn matching your CloudFront distribution ARN.
With CloudFront OAC, the request to S3 is authorized using the CloudFront service principal. Granting s3:GetObject to cloudfront.amazonaws.com and constraining it with AWS:SourceArn to the specific distribution is the standard secure pattern for private S3 origins.
Allow only the S3 bucket owner account to perform s3:GetObject without any condition, so CloudFront can inherit access automatically.
Add a policy statement that denies s3:GetObject when the request does not include the header CloudFront-Viewer-Country.
Grant s3:GetObject permission to an Origin Access Identity (OAI) canonical user ID even though you are using Origin Access Control (OAC).
Want more Design Secure Architectures practice?
Practice this domain26% of exam · 6 sample questions below
A payments platform requires disaster recovery across Regions. Requirements: RPO of 15 minutes and RTO of about 1 hour. The business cannot afford full duplicate capacity in both Regions all the time, but the team wants automated readiness so failover is mostly operationally guided rather than a slow rebuild. Which DR strategy is the best fit?
Backup and restore only, relying on scheduled snapshots and manual restores during incidents.
Pilot light, keeping only minimal infrastructure in the secondary Region and starting full services after failover.
Warm standby, keeping core infrastructure and a partially provisioned environment ready in the secondary Region with frequent data replication.
Warm standby balances cost and readiness by keeping enough capacity and services running to shorten recovery time while meeting RPO needs.
Active/active, routing production traffic to both Regions continuously and accepting dual-region complexity.
Match the disaster recovery strategy to the recovery posture it best fits for a Regional outage.
Backup & Restore: RPO hours, RTO 24+ hours
This strategy relies on periodic backups of data and infrastructure configurations. The Recovery Point Objective (RPO) is typically measured in hours, reflecting the data loss since the last successful backup. The Recovery Time Objective (RTO) is the longest among DR strategies, often exceeding 24 hours, as it involves restoring data, provisioning new infrastructure, and reconfiguring applications from scratch.
Pilot Light: RPO minutes, RTO hours
The Pilot Light strategy maintains a minimal, core set of infrastructure components, such as databases, running in a standby region. This allows for a Recovery Point Objective (RPO) in minutes, as critical data can be replicated or frequently synchronized. However, the Recovery Time Objective (RTO) is still measured in hours because the full application environment needs to be provisioned and scaled up before traffic can be redirected.
Warm Standby: RPO seconds, RTO minutes
Warm Standby involves maintaining a scaled-down, but fully functional, replica of the production environment in a secondary region. This enables a Recovery Point Objective (RPO) in seconds due to continuous data replication. The Recovery Time Objective (RTO) is significantly reduced to minutes, as it primarily involves scaling up the existing standby resources and redirecting traffic, rather than provisioning new infrastructure.
Multi-Site Active/Active: RPO near zero, RTO near zero
This highly resilient strategy operates a full production environment concurrently across multiple geographic regions, with traffic distributed between them. Data is synchronously replicated, achieving a near-zero Recovery Point Objective (RPO) with virtually no data loss. Automated failover mechanisms ensure a near-zero Recovery Time Objective (RTO), as user traffic is instantly routed away from any failing region to the healthy active site.
Backup & Restore: RPO seconds, RTO minutes
Multi-Site Active/Active: RPO hours, RTO 24+ hours
Based on the exhibit, the database must fail over automatically if the primary Availability Zone goes down. Which solution should the architect choose?
Create a read replica in the same Availability Zone as the primary database.
Convert the database to a Multi-AZ RDS deployment.
A Multi-AZ RDS deployment keeps a synchronous standby in another Availability Zone and automatically fails over when the primary fails. This matches the requirement for minimal manual intervention and preserves the same database endpoint, so the application does not need connection string changes. It is the standard AWS choice for resilient relational databases.
Increase the backup retention period to 35 days.
Move the database to an EC2 instance with an attached EBS volume.
A stateless web API runs on EC2 instances behind an Application Load Balancer (ALB). The Auto Scaling group (ASG) currently uses subnets from only one Availability Zone, even though the ALB spans two Availability Zones. During maintenance of that single AZ, the ALB remains up but clients see timeouts because there are no healthy targets. Which change most directly improves resilience against an AZ failure?
Keep the ASG in one subnet/AZ, but enable ALB stickiness to reduce session interruption.
Update the ASG to launch instances across subnets in at least two Availability Zones and ensure ALB health checks target an application-ready path.
Spreading instances across multiple AZs ensures the ALB can route to healthy targets even when one AZ fails.
Add a NAT gateway in the public subnets so instances can reach the internet during maintenance events.
Create a second ALB in the same Availability Zone and route traffic using DNS failover.
A caching layer uses Amazon ElastiCache for Redis in front of a stateless web service. The service must continue to read cached responses during maintenance events and should automatically fail over to another node if one AZ becomes impaired. Which design change best satisfies this requirement?
Deploy a single-node Redis cluster and rely on application-level retries when cache misses occur.
Configure an ElastiCache Redis replication group with automatic failover across multiple Availability Zones.
Multi-AZ replication groups provide redundant nodes and automatic failover, improving cache resilience during AZ events.
Move the cache into the VPC but keep it in one Availability Zone to reduce network latency.
Use a Memcached cluster and configure only client-side connection pooling without failover support.
A company runs a stateful analytics workload on EC2 instances that use EBS volumes. The data must be restorable in another Region after a major outage, with frequent point-in-time recovery. Which approach provides the most suitable replication mechanism for the EBS-backed data?
Create scheduled EBS snapshots and copy them to another Region, then restore the volumes from those snapshots during recovery.
Snapshotting and cross-Region copying gives point-in-time images of EBS volumes that can be restored in the target Region.
Enable EBS multi-attach to spread the workload across AZs and replicate snapshots automatically between Regions.
Use RDS read replicas in another Region and keep the analytics dataset in an RDS instance only.
Rely on instance store for durability and copy only AMIs across Regions.
Want more Design Resilient Architectures practice?
Practice this domain24% of exam · 6 sample questions below
A DynamoDB table stores device status items. The partition key is deviceId, and the partition distribution is healthy (no single partition dominates). However, during peak periods the application experiences high read latency because many clients repeatedly request the latest status for the same devices. Which action best improves read latency without changing the DynamoDB partitioning model?
Add Amazon DAX as a caching layer in front of DynamoDB and route repeated read operations through DAX.
Amazon DAX is an in-memory caching layer for DynamoDB that accelerates repeated reads. When many clients request the same items (for example, “latest status” point reads by deviceId), DAX can serve cached responses directly, reducing round trips to DynamoDB and lowering read latency during peak periods.
Change the partition key to a random value for each request to eliminate hot partitions.
Increase write capacity only, because writes generally determine read latency in DynamoDB.
Create an additional Global Secondary Index (GSI) and read exclusively from the index to accelerate reads.
A media processing service runs ECS tasks in multiple Availability Zones. Each task must read and write the same shared filesystem with low latency because tasks stream intermediate artifacts to other tasks. The team currently mounts an EBS volume per task, and cross-AZ tasks frequently cannot see each other’s files. Which option best resolves the shared filesystem requirement while supporting high-performing access?
Keep using EBS, but attach the same EBS volume to tasks in multiple Availability Zones using EBS multi-attach so all tasks share the filesystem.
Use Amazon EFS with mount targets in each Availability Zone so all tasks mount a common NFS filesystem over the AWS network.
EFS is designed for shared, NFS-like file storage that can be mounted concurrently from compute resources across multiple Availability Zones. By creating mount targets in each AZ used by the ECS tasks, you enable low-latency network access patterns so tasks can read and write the same shared filesystem reliably.
Use Amazon S3 for the intermediate artifacts and rely on S3 event notifications to emulate POSIX file operations.
Switch to instance store on each task and use SQS messages between tasks to copy intermediate artifacts.
An order lookup API repeatedly reads the same few items from DynamoDB. The application can tolerate slightly stale data for a few seconds, and the team wants the lowest-latency design with minimal application changes. Which two changes should they make? Select two.
Put Amazon DynamoDB Accelerator (DAX) in front of the table.
DAX is an in-memory cache for DynamoDB reads, so repeated lookups for the same keys can be served with much lower latency than direct table reads. It is especially effective for hot-item access patterns like order lookups, product metadata, and profile reads.
Use eventually consistent reads where the application can tolerate slightly stale data.
Eventually consistent reads avoid the extra requirement of reading the most recent committed value on every request. When slight staleness is acceptable, they fit well with caching layers and help keep read-path latency low.
Switch all access to strongly consistent reads for faster results.
Increase the item size so fewer requests are needed.
Replace the table with Amazon EBS volumes mounted on EC2 instances.
A startup runs an HTTP/2 API that also supports WebSocket connections. They need path-based routing to separate microservices (for example, /api/* to Service A and /metrics/* to Service B) and want TLS terminated at the load balancer. Which AWS option best meets these requirements while maintaining high request performance?
Use an Amazon NLB and configure target groups with HTTP health checks and listener rules for path-based routing.
Use an Amazon ALB with HTTP/2 support, WebSocket upgrades enabled, and listener rules for host/path-based routing.
An ALB supports Layer 7 features needed here: it can terminate TLS on an HTTPS listener, evaluate HTTP host/path routing rules, and it supports WebSocket by allowing HTTP Upgrade behavior through the ALB to the targets. ALBs also support HTTP/2 on HTTPS listeners, which helps maintain high request performance.
Use Amazon API Gateway with a single backend integration and rely on the client to route requests to different microservices.
Use Amazon CloudFront without an ALB, and route requests to microservices using only custom origin headers.
A DynamoDB table uses this schema: partition key = customerId, sort key = timestamp. During a marketing campaign, one customer generates extremely high read traffic and the application sees ProvisionedThroughputExceeded errors even though the table’s total capacity is sufficient. What change most directly improves read distribution across partitions?
Increase the table’s provisioned read capacity units while keeping partition key = customerId.
Add a salt component to the partition key by changing it to customerId#salt, where salt is derived from a hash of requestId so a single customer’s requests are spread across many partitions; keep the sort key as timestamp.
Hot partition throttling usually occurs when too many requests target a single partition key value. Salting transforms the partition key so that one high-traffic customerId maps to multiple distinct partition keys (e.g., customerId#0, customerId#1, etc.), which increases the number of partitions that can serve that customer’s workload concurrently and reduces the probability that a single partition becomes overloaded.
Remove the sort key and use timestamp as the partition key to increase cardinality.
Switch to on-demand capacity and rely on DynamoDB to automatically distribute reads across partitions.
Based on the exhibit, what change should the team make to achieve the lowest possible network latency for the distributed workload?
Place the instances in a spread placement group across multiple Availability Zones.
Move the workload into a cluster placement group in one Availability Zone.
Cluster placement groups place instances physically close together inside one Availability Zone, which is the best AWS option for workloads that need low-latency, high-bandwidth communication between many nodes. The exhibit explicitly says the workload can run in a single AZ if performance improves. That makes cluster placement groups the right fit.
Add an Application Load Balancer in front of the workers to reduce inter-node latency.
Increase the EC2 instance size while keeping the current multi-AZ layout.
Want more Design High-Performing Architectures practice?
Practice this domain20% of exam · 6 sample questions below
CloudWatch metrics show your EC2 instances have average CPU utilization around 10% with stable performance over several weeks. The application does not require additional headroom right now. What is the most effective cost-optimization action?
Right-size the instances to a smaller size that matches the observed utilization
Right sizing reduces cost by matching instance capacity to actual demand. If average CPU is consistently low (around 10%) and performance is stable, it strongly indicates overprovisioning. Moving to a smaller instance (or a smaller capability within the same family) typically lowers hourly cost while maintaining sufficient capacity for the workload.
Increase the Auto Scaling desired capacity to add more instances
Switch to Spot Instances immediately even though interruptions would impact users
Disable detailed monitoring to reduce CPU usage from the monitoring agent
A marketing site serves versioned JavaScript and CSS files from Amazon S3 through CloudFront. The origin bill is rising because CloudFront keeps fetching the same files too often, and the application never changes a file at the same URL once it is published. Which two changes should you make? Select two.
Set long-lived Cache-Control headers, such as a high max-age and immutable policy, on the versioned assets.
Versioned assets are ideal for long cache lifetimes because their URLs change when the content changes. Strong Cache-Control headers let CloudFront serve more requests from edge locations instead of repeatedly fetching the same files from S3.
Configure the CloudFront cache policy to avoid forwarding unnecessary query strings, headers, and cookies.
A smaller cache key improves the cache hit rate because more viewer requests map to the same cached object. Avoiding unnecessary request attributes also reduces origin fetches and lowers the bandwidth sent to the origin.
Move the static assets to an EC2 web server behind an Application Load Balancer.
Disable CloudFront caching so every request always reaches the origin.
Add more viewer-facing headers to the cache key so each browser variation gets a unique cached object.
A company has a steady, predictable workload that must run continuously (24/7) in a single AWS Region. The team wants the lowest cost option available for this steady usage, but also expects they may choose different EC2 instance families in the future (without re-buying compute discounts). Which AWS purchase option best meets these goals?
On-Demand Instances only, because they automatically adjust to future needs
Compute Savings Plans, committed for a 1- to 3-year term in the Region
Compute Savings Plans provide discounted pricing in exchange for committing to a consistent hourly spend (scoped to a Region). They apply to EC2 usage and are flexible enough that you can change EC2 instance families over time while still receiving the Savings Plans discount within the commitment scope.
Standard Reserved Instances tied to a single instance type and Availability Zone
EC2 Spot Instances, because they are always cheaper than savings programs
A line-of-business application runs on EC2 instances 24/7 with predictable usage for the next year. The application will stay in the same Region, and the team does not want to manage capacity interruptions. Which two purchase options can reduce cost compared with pure On-Demand pricing? Select two.
Buy Compute Savings Plans for the expected steady usage.
Compute Savings Plans reduce the hourly cost of predictable usage while preserving flexibility across supported compute services. They are a strong fit when the workload is steady and the team wants savings without interruption risk.
Purchase Standard Reserved Instances for the EC2 fleet.
Standard Reserved Instances are designed for steady EC2 usage in a specific Region and can significantly lower the effective hourly rate versus On-Demand. They align well with a one-year predictable workload that must remain continuously available.
Move the fleet to Spot Instances.
Use Dedicated Hosts to reserve physical servers for the application.
Stay entirely on On-Demand Instances because they are already the cheapest option.
A photo studio stores original project archives in Amazon S3. Objects are read heavily for 14 days after upload, occasionally during the next 11 months, and almost never after one year. The team wants the lowest storage cost while keeping retrieval within minutes during the first year. Which three actions are best? Select three.
Keep new objects in S3 Standard for the first 14 days.
Correct. Standard is appropriate for the initial hot-access period because the data is read frequently and needs immediate performance. Using a cheaper archive tier too early would increase retrieval latency and likely access costs.
Transition objects to S3 Standard-IA after 14 days.
Correct. Standard-IA fits the long middle period where objects are still retrievable quickly but accessed only occasionally. It lowers storage cost while preserving minutes-level retrieval.
Transition objects to S3 Glacier Flexible Retrieval after 14 days.
Transition objects to S3 Glacier Deep Archive after one year.
Correct. Deep Archive is the lowest-cost long-term option for data that is almost never read after the first year. It is appropriate once fast retrieval is no longer required.
Disable versioning to make the lifecycle rules work correctly.
A company processes product-image uploads in bursts. Each transform takes up to ten minutes, and every job can be retried safely from the beginning. The current EC2 worker fleet is idle most of the day. Which two changes most reduce cost and idle capacity? Select two.
Buffer jobs in Amazon SQS and let workers scale from queue depth.
Correct. SQS decouples uploads from processing and smooths bursty demand. Queue depth is a practical scaling signal, so the company avoids paying for idle workers while still absorbing traffic spikes.
Run the workers on AWS Fargate Spot, since interruptions are acceptable.
Correct. Fargate Spot lowers container compute cost when the workload can tolerate interruption and retry. For retry-safe image processing, the cost savings are significant compared with always-on EC2 workers.
Keep a fixed fleet of m6i.large instances in an Auto Scaling group with a higher minimum.
Use Reserved Instances for the workers even though demand is highly bursty.
Process uploads only during a nightly window so the fleet looks busier.
Want more Design Cost-Optimized Architectures practice?
Practice this domainThe SAA-C03 exam has 65 questions and must be completed in 130 minutes. The passing score is 720/1000.
Architecture scenario questions on AWS service selection, resilience, cost optimisation, security, and networking trade-offs.
The exam covers 4 domains: Design Secure Architectures, Design Resilient Architectures, Design High-Performing Architectures, Design Cost-Optimized Architectures. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Amazon Web Services SAA-C03 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.