Amazon Web Services · Free Practice Questions · Last reviewed May 2026
24real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
30% of exam · 6 sample questions below
A Lambda function needs to read the current value of exactly one AWS Secrets Manager secret at startup. Which least-privilege IAM permission (action and resource scope) should you grant to the Lambda execution role?
secretsmanager:ListSecrets on all secrets (resource set to "*")
secretsmanager:GetSecretValue on only the secret’s full ARN
GetSecretValue is the specific action required to retrieve the secret value. Scoping the permission to the secret’s full ARN ensures the Lambda role can read only that secret and cannot access other secrets.
secretsmanager:UpdateSecret on the specific secret ARN
secretsmanager:DescribeSecret on all secrets (resource set to "*")
A security team requires that every object uploaded to s3://secure-bucket/uploads/ must be encrypted using SSE-KMS with a specific customer-managed KMS key. Which S3 bucket policy condition approach best enforces this requirement for PutObject requests?
Deny PutObject unless s3:x-amz-server-side-encryption equals "aws:kms" and s3:x-amz-server-side-encryption-aws-kms-key-id equals the required CMK ARN
This enforces the encryption choice at upload time by validating the request headers that specify SSE-KMS and the exact KMS key ID/ARN. Using a Deny condition ensures uploads that do not include the correct SSE-KMS headers (for example, unencrypted uploads or uploads using a different KMS key) are rejected immediately.
Allow PutObject only when aws:SecureTransport is true; encryption is then guaranteed automatically
Deny PutObject if the request includes Content-Type other than "application/octet-stream"
Deny PutObject when the caller’s role is not allowed to kms:Decrypt in their IAM policy
An application in Account B (IAM role arn:aws:iam::account-b:role/app-read) reads objects from an S3 bucket in Account A. The bucket uses SSE-KMS with a customer-managed KMS key in Account A. Object reads consistently fail with an error that includes "AccessDenied" and "kms:Decrypt".
The IAM permissions in Account B for kms:Decrypt are correct, but the requests still fail.
Which change will most directly fix the failure?
Add kms:Decrypt to the KMS key policy in Account A for the Account B role arn:aws:iam::account-b:role/app-read, and remove kms:Decrypt from the role policy in Account B.
Update the IAM role in Account B to use the s3:GetObject permission only, and rely on S3 to authorize KMS decrypt automatically.
Modify the KMS key policy in Account A to allow kms:Decrypt for the Account B role arn:aws:iam::account-b:role/app-read, using the appropriate cross-account conditions (for example, allowing the use via S3 and the expected encryption context for the bucket).
For SSE-KMS, S3 must call KMS Decrypt when serving objects. KMS authorization is evaluated against the KMS key policy in Account A in addition to the identity policy in Account B. If the error includes kms:Decrypt AccessDenied in a cross-account scenario, the most direct fix is to update the KMS key policy to allow the Account B role to use the key for decrypt (often with conditions tied to S3 usage and the specific bucket/object encryption context).
Switch the S3 bucket encryption from SSE-KMS to SSE-S3, keeping all existing IAM and KMS configuration unchanged.
A server assumes an IAM role and must read export objects only from this prefix in an S3 bucket: s3://customer-data/exports/acme/ . The application also needs to list the objects under that exact prefix so it can discover which export folders exist. The application performs ListBucket requests with Prefix set to exactly "exports/acme/".
The current role policy allows s3:ListBucket on the bucket ARN without a prefix condition, and security reports the role can list other tenants’ export object keys.
Which IAM policy change best enforces least privilege for both ListBucket and GetObject?
Keep s3:ListBucket allowed on arn:aws:s3:::customer-data, but restrict s3:GetObject to arn:aws:s3:::customer-data/exports/acme/*.
Allow s3:ListBucket on arn:aws:s3:::customer-data only when s3:prefix equals "exports/acme/" (for example, using a StringEquals condition on s3:prefix). Also allow s3:GetObject only on arn:aws:s3:::customer-data/exports/acme/*.
ListBucket must be authorized at the bucket ARN level, then scoped using a Condition on the request prefix (so only the approved listing prefix is allowed). GetObject is authorized at the object ARN level and is restricted to exports/acme/*, preventing reads outside the prefix.
Allow s3:ListBucket only on arn:aws:s3:::customer-data/exports/acme/* and allow s3:GetObject on arn:aws:s3:::customer-data/*.
Add a Deny statement for s3:GetObject outside arn:aws:s3:::customer-data/exports/acme/*, but keep s3:ListBucket unrestricted on arn:aws:s3:::customer-data.
A platform team lets project administrators create IAM roles for workloads in their own AWS accounts, but every role must stay inside a fixed security baseline. The organization also wants to block all member accounts from using AWS Regions outside us-east-1 and us-west-2. Which three controls should be used? Select three.
Attach a permissions boundary to each role created through the delegation process.
A permissions boundary caps the maximum permissions a created role can ever receive, even if an administrator later attaches broader policies. This is the right mechanism for a fixed security baseline on delegated role creation.
Require iam:PermissionsBoundary in the role creation policy so every new role must include the approved boundary.
The creation policy should enforce that the boundary is present at creation time. This prevents a delegated admin from simply omitting the boundary and creating a role that exceeds the approved limit.
Use an SCP to deny actions in all AWS Regions except us-east-1 and us-west-2.
An SCP is the correct organizational guardrail for region restrictions across member accounts. It applies broadly and consistently, which is ideal for blocking unapproved Regions regardless of the local IAM configuration.
Grant AdministratorAccess to the project administrators and rely on later audits for enforcement.
Use an AWS Config rule alone to stop role creation if the permissions are too broad.
A company serves private images stored in S3 through Amazon CloudFront. Only authenticated users should be able to access each image, and access should expire after 1 hour. Which CloudFront feature best meets this requirement?
Signed URLs or signed cookies with an expiration time of 1 hour
Signed URLs/cookies provide cryptographic, edge-enforced authorization for specific CloudFront resources and include an expiration timestamp. After expiry, CloudFront rejects requests (for example, with 403) without needing the origin to handle time-based authorization.
A WAF rule that blocks requests without valid JWTs, without using signed URLs
Turning on S3 bucket public access block, without any CloudFront viewer authentication
Enabling CloudFront geo restriction to allow only one country
Want more Design Secure Architectures practice?
Practice this domain26% of exam · 6 sample questions below
An order-processing service consumes messages from an Amazon SQS Standard queue using a custom worker. During traffic spikes, the worker occasionally times out after performing some work but before acknowledging the message, so SQS redelivers it and it may be processed again.
You also observe that a small set of “poison” messages always fail validation.
What change most directly improves resilience by (1) preventing poison messages from retrying indefinitely and (2) avoiding duplicate side effects caused by legitimate retries?
Increase the SQS visibility timeout and, when validation fails, call DeleteMessage in the consumer to remove the message immediately.
Move to SNS topics with subscriptions and rely on SNS to provide exactly-once delivery to eliminate duplicates automatically.
Configure a dead-letter queue (DLQ) with a redrive policy that moves messages after maxReceiveCount, and implement idempotent processing in the consumer using an idempotency key.
SQS Standard is at-least-once delivery, so timeouts can cause redelivery and duplicates. A DLQ with a redrive policy prevents poison messages from retrying forever by moving them after repeated failures. Idempotent processing (for example, storing a processed marker in a database with conditional logic keyed by an idempotency key) prevents duplicate side effects when retries occur for valid messages.
Change the queue to FIFO and enable content-based deduplication, leaving the consumer logic unchanged.
Based on the exhibit, the application sees several minutes of connection errors during an Aurora failover. What is the best change to reduce failover impact?
Change the application to use the Aurora cluster writer endpoint and retry transient connections.
The current configuration targets a specific instance endpoint, which becomes stale after failover. The Aurora cluster writer endpoint always resolves to the current writer, so the application can reconnect without manual endpoint changes. Adding retries with backoff helps the application survive the short DNS and connection transition during failover.
Add an Aurora read replica and keep using the same JDBC URL.
Increase the EC2 instance size of the application servers.
Switch to a single-AZ RDS PostgreSQL instance for simpler connectivity.
A payments service receives payment orders by consuming messages from an Amazon SQS Standard queue. The downstream processor occasionally exceeds its processing timeout. As a result, some messages reappear in the queue and may be processed more than once.
The team wants to prevent duplicate side effects (for example, double-charging) and also ensure poison messages do not repeatedly consume processing capacity.
What approach best satisfies both goals?
Implement idempotent processing (for example, store processed payment IDs in DynamoDB) and configure an SQS dead-letter queue (DLQ) using a redrive policy with an appropriate maxReceiveCount.
With SQS Standard’s at-least-once delivery, duplicates can occur. Idempotency ensures repeated processing of the same payment ID does not create duplicate side effects. A DLQ with redrive policy isolates poison messages: after a message is received and fails processing more than maxReceiveCount times, SQS moves it to the DLQ instead of cycling it back to the main queue indefinitely.
Rely only on increasing the SQS visibility timeout so duplicates rarely occur, without adding idempotency checks or a DLQ.
Switch to a FIFO queue and delete messages immediately upon receipt to avoid duplicates.
Move the workload to SNS and use synchronous HTTP endpoints so the sender retries until the receiver confirms success.
A company runs an application behind an Application Load Balancer (ALB). An Auto Scaling group (ASG) is configured with desired capacity 2, but it is attached only to subnets in a single Availability Zone. The ALB is healthy because it is configured across multiple Availability Zones.
When the Availability Zone that contains the ASG subnets experiences an outage, what change most directly improves resilience and allows capacity to be restored automatically?
Update the ASG to use subnet IDs that span at least two Availability Zones so it can launch replacement instances after an AZ outage.
If the ASG is attached to subnets in multiple Availability Zones, when instances in the failed AZ become unhealthy/terminate, Auto Scaling can launch new instances in the remaining AZs to restore the desired capacity. This directly addresses the root cause: the ASG cannot create capacity outside the AZs it is configured for.
Reduce the ALB health check interval to speed up detection of unhealthy targets.
Enable connection draining on the ALB so existing requests complete before targets are terminated.
Increase the ASG desired capacity from 2 to 6 to compensate for the missing subnets.
Based on the exhibit, DNS still sends traffic to the primary Region even though Route 53 health checks show the primary endpoint is unhealthy. What is the best change to make failover work as intended?
Change both records to weighted routing with a 50/50 split so Route 53 can shift traffic gradually.
Use a failover routing policy with a primary record and a secondary record, and attach the health check to the primary record.
Failover routing is designed for active-passive DNS behavior. With a primary and secondary record, Route 53 answers with the primary record when it is healthy and returns the secondary record when the primary health check fails. The exhibit shows simple routing, which does not express the failover intent. Switching to failover routing aligns the DNS policy with the stated requirement.
Switch to latency-based routing so users are always directed to the lowest-latency Region.
Use geolocation routing so clients in one Region are sent to the healthier endpoint.
Based on the exhibit, the web application must remain available even if one Availability Zone fails. What is the best change to improve resilience with the least redesign?
Increase DesiredCapacity to 4 while keeping all instances in subnet-a1.
Add subnet-b1 in a different Availability Zone to the Auto Scaling group.
This spreads EC2 instances across two Availability Zones, so the Auto Scaling group can continue serving traffic if one AZ becomes unavailable. Because the ALB is already deployed in both subnets, this is the smallest change that adds true zonal resilience to the compute tier.
Replace the Application Load Balancer with a Network Load Balancer.
Enable EBS encryption on the launch template volumes.
Want more Design Resilient Architectures practice?
Practice this domain24% of exam · 6 sample questions below
A Lambda function behind API Gateway has predictable traffic spikes every hour. The function does not need access to resources in a VPC, and p95 latency spikes are caused by cold starts during scale-out. Which two actions are most effective? Select two.
Enable provisioned concurrency for the function.
Provisioned concurrency keeps a pool of initialized execution environments ready to handle requests. That removes most cold-start delay and is the most direct way to stabilize p95 latency during predictable bursts.
Remove the function from a VPC because it has no VPC dependencies.
If the function does not need private network access, keeping it out of a VPC avoids the extra networking setup associated with VPC-enabled Lambdas. That reduces startup overhead and helps new execution environments become available faster.
Set reserved concurrency to a low fixed number.
Increase the Lambda timeout to 15 minutes.
Add an SQS dead-letter queue to reduce startup latency.
An Aurora PostgreSQL application has an OLTP writer and a reporting dashboard that issues many read-only queries. The writer is healthy, but read latency rises noticeably during reporting windows. Which two changes should you make? Select two.
Add Aurora Replicas to scale out the read workload.
Aurora Replicas provide additional read capacity, which lets you spread read-only traffic away from the writer instance.
Send read-only application traffic to the reader endpoint.
The reader endpoint automatically distributes reads across available replicas, reducing load on the writer and improving throughput.
Scale up only the writer instance and keep all queries on it.
Replace the cluster with a single-AZ RDS instance to reduce replication overhead.
Move the dashboard to DynamoDB without changing the query model.
A production application writes to an Amazon Aurora PostgreSQL cluster. Users report that during business-hour reporting runs, write latency increases. The application team wants to keep the writer focused on OLTP writes while still providing low-latency reads for reporting queries. What architectural approach should the solutions architect recommend?
Create Aurora read replicas and direct reporting read-only connections to the cluster reader endpoint.
Read replicas offload read workloads from the writer. Using the reader endpoint lets reporting queries use replicas, improving write responsiveness.
Resize the writer instance to a larger class so it can handle both writes and reads with fewer slowdowns.
Enable cross-region replication for the entire cluster so reporting always runs in the secondary Region.
Disable read replicas and use caching only in the application layer, keeping all queries connected to the writer endpoint.
A DynamoDB table stores device status items. The partition key is deviceId, and the partition distribution is healthy (no single partition dominates). However, during peak periods the application experiences high read latency because many clients repeatedly request the latest status for the same devices. Which action best improves read latency without changing the DynamoDB partitioning model?
Add Amazon DAX as a caching layer in front of DynamoDB and route repeated read operations through DAX.
Amazon DAX is an in-memory caching layer for DynamoDB that accelerates repeated reads. When many clients request the same items (for example, “latest status” point reads by deviceId), DAX can serve cached responses directly, reducing round trips to DynamoDB and lowering read latency during peak periods.
Change the partition key to a random value for each request to eliminate hot partitions.
Increase write capacity only, because writes generally determine read latency in DynamoDB.
Create an additional Global Secondary Index (GSI) and read exclusively from the index to accelerate reads.
A team is splitting a new workload into two fronts. The first front serves HTTPS microservices that need host- and path-based routing plus health checks. The second front must handle TCP and UDP traffic for a real-time service and preserve static IP addresses for firewall allowlisting. Which two AWS load balancer choices best match these requirements? Select two.
Application Load Balancer
Application Load Balancer supports HTTP and HTTPS routing with host- and path-based rules, making it ideal for microservices.
Network Load Balancer
Network Load Balancer handles TCP and UDP traffic and can preserve stable IP addresses for allowlisting.
Amazon API Gateway
Amazon CloudFront
Gateway Load Balancer
An API team runs an AWS Lambda function behind an Application Load Balancer (ALB). During predictable hourly traffic spikes, p95 response latency increases due to occasional cold starts. The team wants stable latency during those spikes without permanently overprovisioning resources for all functions. Which configuration is the most appropriate way to reduce cold starts for this Lambda function?
Publish a version of the function and configure provisioned concurrency on an alias, using autoscaling for the alias.
Provisioned concurrency pre-initializes execution environments for a specific published function version. By attaching provisioned concurrency to an alias, you can control warm capacity and (with the right settings) autoscale the provisioned capacity for predictable spike patterns, reducing cold-start-driven latency increases.
Increase the function memory size and rely on faster initialization to reduce cold starts.
Set reserved concurrency equal to the expected peak requests per second for the function.
Use an event source mapping with a higher batch size so Lambda triggers earlier and keeps the runtime warm.
Want more Design High-Performing Architectures practice?
Practice this domain20% of exam · 6 sample questions below
You store application logs in an S3 bucket. After 30 days, the logs are rarely accessed, but you must retain them for 1 year for compliance. Which S3 feature is the best way to reduce storage cost while meeting the retention requirement?
Create an S3 lifecycle rule to transition older objects to a colder storage class after 30 days, then expire after 1 year
S3 lifecycle policies can automatically transition objects to lower-cost storage classes based on age. Transitioning after 30 days reduces ongoing storage costs because the logs are rarely accessed, while expiring after 1 year ensures you still meet the compliance retention window.
Keep all logs in S3 Standard and rely on lower request rates to reduce cost
Copy logs to EBS snapshots each week and delete the original files
Use S3 replication to a second bucket in another region to reduce costs
CloudWatch metrics show your EC2 instances have average CPU utilization around 10% with stable performance over several weeks. The application does not require additional headroom right now. What is the most effective cost-optimization action?
Right-size the instances to a smaller size that matches the observed utilization
Right sizing reduces cost by matching instance capacity to actual demand. If average CPU is consistently low (around 10%) and performance is stable, it strongly indicates overprovisioning. Moving to a smaller instance (or a smaller capability within the same family) typically lowers hourly cost while maintaining sufficient capacity for the workload.
Increase the Auto Scaling desired capacity to add more instances
Switch to Spot Instances immediately even though interruptions would impact users
Disable detailed monitoring to reduce CPU usage from the monitoring agent
A marketing site serves versioned JavaScript and CSS files from Amazon S3 through CloudFront. The origin bill is rising because CloudFront keeps fetching the same files too often, and the application never changes a file at the same URL once it is published. Which two changes should you make? Select two.
Set long-lived Cache-Control headers, such as a high max-age and immutable policy, on the versioned assets.
Versioned assets are ideal for long cache lifetimes because their URLs change when the content changes. Strong Cache-Control headers let CloudFront serve more requests from edge locations instead of repeatedly fetching the same files from S3.
Configure the CloudFront cache policy to avoid forwarding unnecessary query strings, headers, and cookies.
A smaller cache key improves the cache hit rate because more viewer requests map to the same cached object. Avoiding unnecessary request attributes also reduces origin fetches and lowers the bandwidth sent to the origin.
Move the static assets to an EC2 web server behind an Application Load Balancer.
Disable CloudFront caching so every request always reaches the origin.
Add more viewer-facing headers to the cache key so each browser variation gets a unique cached object.
An application serves static images through Amazon CloudFront. The team observes higher-than-expected origin fetches, which increases origin bandwidth costs. Which change most directly improves CloudFront cache reuse to reduce origin requests for the static content?
Set appropriate Cache-Control headers (or origin cache settings) so CloudFront caches responses longer
Cache headers and TTL determine how long objects are kept in CloudFront’s edge caches. Longer caching for static assets increases the cache hit ratio, reducing how often requests must go back to the origin.
Disable caching for the distribution so every request goes back to the origin
Configure CloudFront to forward all request headers and query strings to the origin
Move the S3 bucket to a different AWS Region, without changing CloudFront caching behavior
Your team runs a batch processing workload on EC2 that can tolerate interruptions. If an instance is terminated, the job can restart from checkpoints. To reduce compute costs, what is the most cost-optimized approach?
Use EC2 Spot Instances for the batch workers
Spot provides significantly lower pricing than On-Demand for interruptible workloads. Because the workload can restart from checkpoints, termination interruptions are acceptable and the application can recover efficiently, meeting both correctness and throughput requirements at a lower cost.
Use Dedicated Hosts to ensure capacity for the cheapest instance
Use On-Demand instances and schedule extra runs to offset interruptions
Use Reserved Instances only, because they eliminate instance termination events
An internal rendering job runs on EC2 workers in an Auto Scaling group. Each job writes checkpoints every few minutes to S3 and can resume from the latest checkpoint after an interruption. The queue depth varies sharply, and the team wants the lowest possible compute cost. Which two changes should they make? Select two.
Run the worker fleet on EC2 Spot Instances.
Spot Instances usually provide the lowest EC2 compute price and fit workloads that can tolerate interruption. Because the job checkpoints to S3, the application can resume after Spot interruptions without losing all progress.
Purchase Dedicated Hosts so the fleet keeps physical servers reserved for the workload.
Use a Mixed Instances Policy with several compatible instance types and Spot capacity-optimized allocation.
Diversifying instance types improves the chance that Auto Scaling can obtain cheap Spot capacity. A mixed policy also reduces the risk of a single instance type shortage stopping the job fleet.
Run the entire fleet on On-Demand Instances to avoid any interruption risk.
Move the workers to AWS Outposts to keep compute close to the data.
Want more Design Cost-Optimized Architectures practice?
Practice this domainThe SAA-C03 exam has 65 questions and must be completed in 130 minutes. The passing score is 720/1000.
Architecture scenario questions on AWS service selection, resilience, cost optimisation, security, and networking trade-offs.
The exam covers 4 domains: Design Secure Architectures, Design Resilient Architectures, Design High-Performing Architectures, Design Cost-Optimized Architectures. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Amazon Web Services SAA-C03 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.