Free SAA-C03 practice test — 302+ AWS Solutions Architect practice questions with detailed explanations across all 4 official SAA-C03 exam domains. Every SAA-C03 exam questions set is scored, timed, and drawn from the live question bank — so you practise exactly what the exam tests, not outdated dumps.
Courseiva includes 302+ SAA-C03 practice questions across the official exam domains.
Feature
Courseiva
This free SAA-C03 practice test mirrors the structure and difficulty of the real SAA-C03 exam. Every question is written against the official 2026 exam blueprint published by Amazon Web Services, ensuring you practise exactly what the exam tests — not last year's objectives.
The SAA-C03 blueprint is divided into 4weighted domains. Questions on this page are distributed proportionally across each domain, so the mix you see here reflects the same weighting you'll face on exam day. High-weight domains like Design Secure Architectures and Design Resilient Architectures contribute the most questions, meaning focused practice on these areas gives you the highest return on study time.
SAA-C03 Exam Blueprint — 4 Domains
Design Secure Architectures
Design Resilient Architectures
Design High-Performing Architectures
Design Cost-Optimized Architectures
23 numbered sets, 4 domain question banks, and targeted sessions — every page is a unique set of questions.
Choose all correct answers
Each chapter page covers one topic in depth — theory, key concepts, and focused practice questions. Use these to close knowledge gaps before returning to full practice tests.
Getting the most from practice questions requires more than just clicking through answers. Here is the study method used by candidates who pass SAA-C03 on their first attempt:
Answer before revealing
Read each SAA-C03 question fully, eliminate obviously wrong choices, then commit to an answer before clicking to reveal. This active recall process is what builds lasting knowledge.
Read every explanation
Even when you answer correctly, read the full explanation. Knowing WHY the right answer is correct — and why the distractors are wrong — is what separates a 750 score from a 900 score.
Track weak domains
Note which SAA-C03 domains you get wrong most often. Then do a targeted 20-30 question session focused only on that domain until your accuracy improves.
Simulate exam pacing
The real SAA-C03 gives you roughly 2 minutes per question. Use the 60 or 120-question sessions to practise hitting that pace comfortably.
Most candidates who pass SAA-C03 on their first attempt report doing between 400 and 800 practice questions over 4–8 weeks of preparation. With 302+ questions in the Courseiva bank, you have more than enough material to build that repetition without seeing the same question twice.
Answer each question to reveal the full explanation and correct answer. This starter set is drawn from all 4 exam domains in blueprint proportion. Use the session selector to start a longer focused practice run.
An application in Account B (IAM role arn:aws:iam::account-b:role/app-read) reads objects from an S3 bucket in Account A. The bucket uses SSE-KMS with a customer-managed KMS key in Account A. Object reads consistently fail with an error that includes "AccessDenied" and "kms:Decrypt".
The IAM permissions in Account B for kms:Decrypt are correct, but the requests still fail.
Which change will most directly fix the failure?
Select an answer to reveal the explanation
A SaaS vendor will access your AWS resources by assuming an IAM role in your account. You want to prevent confused-deputy attacks and ensure the vendor can only assume the role using an agreed external identifier.
Your role trust policy currently allows sts:AssumeRole from the vendor’s principal, but it does not include any external ID protection. Which change is the best next step?
Select an answer to reveal the explanation
A team wants detective controls to investigate suspected exfiltration from an S3 bucket. They need to know when objects are accessed (GetObject) and also when new encrypted objects are written.
They already enabled AWS CloudTrail for management events, but their investigation shows no visibility into object-level reads/writes in the logs they review.
Which CloudTrail configuration change most directly provides the missing object-level visibility?
Select an answer to reveal the explanation
A web application runs in private subnets with no NAT gateway. It needs to retrieve credentials from AWS Secrets Manager at runtime. After a recent network hardening change, the application logs timeout errors when calling Secrets Manager.
Which change will most directly enable private connectivity to Secrets Manager while keeping the subnets NAT-free?
Select an answer to reveal the explanation
Your team hosts a private web app on an S3 bucket and serves it through CloudFront using a modern Origin Access Control (OAC). After deployment, users receive HTTP 403 from CloudFront with the S3 origin error "AccessDenied".
Which S3 bucket policy change best aligns with CloudFront OAC so the distribution can fetch objects privately?
Select an answer to reveal the explanation
You deploy a Web ACL with an AWS WAF rate-based rule intended to limit abusive traffic to your API. After the deployment, attackers still reach the backend service. ALB access logs show requests arrive at the ALB, but WAF logs indicate the Web ACL is not evaluating those requests.
Which change most likely fixes the issue?
Select an answer to reveal the explanation
A payments platform requires disaster recovery across Regions. Requirements: RPO of 15 minutes and RTO of about 1 hour. The business cannot afford full duplicate capacity in both Regions all the time, but the team wants automated readiness so failover is mostly operationally guided rather than a slow rebuild. Which DR strategy is the best fit?
Select an answer to reveal the explanation
Based on the exhibit, the database must fail over automatically if the primary Availability Zone goes down. Which solution should the architect choose?
Select an answer to reveal the explanation
A stateless web API runs on EC2 instances behind an Application Load Balancer (ALB). The Auto Scaling group (ASG) currently uses subnets from only one Availability Zone, even though the ALB spans two Availability Zones. During maintenance of that single AZ, the ALB remains up but clients see timeouts because there are no healthy targets. Which change most directly improves resilience against an AZ failure?
Select an answer to reveal the explanation
A caching layer uses Amazon ElastiCache for Redis in front of a stateless web service. The service must continue to read cached responses during maintenance events and should automatically fail over to another node if one AZ becomes impaired. Which design change best satisfies this requirement?
Select an answer to reveal the explanation
A company runs a stateful analytics workload on EC2 instances that use EBS volumes. The data must be restorable in another Region after a major outage, with frequent point-in-time recovery. Which approach provides the most suitable replication mechanism for the EBS-backed data?
Select an answer to reveal the explanation
A DynamoDB table stores device status items. The partition key is deviceId, and the partition distribution is healthy (no single partition dominates). However, during peak periods the application experiences high read latency because many clients repeatedly request the latest status for the same devices. Which action best improves read latency without changing the DynamoDB partitioning model?
Select an answer to reveal the explanation
A media processing service runs ECS tasks in multiple Availability Zones. Each task must read and write the same shared filesystem with low latency because tasks stream intermediate artifacts to other tasks. The team currently mounts an EBS volume per task, and cross-AZ tasks frequently cannot see each other’s files. Which option best resolves the shared filesystem requirement while supporting high-performing access?
Select an answer to reveal the explanation
A startup runs an HTTP/2 API that also supports WebSocket connections. They need path-based routing to separate microservices (for example, /api/* to Service A and /metrics/* to Service B) and want TLS terminated at the load balancer. Which AWS option best meets these requirements while maintaining high request performance?
Select an answer to reveal the explanation
A DynamoDB table uses this schema: partition key = customerId, sort key = timestamp. During a marketing campaign, one customer generates extremely high read traffic and the application sees ProvisionedThroughputExceeded errors even though the table’s total capacity is sufficient. What change most directly improves read distribution across partitions?
Select an answer to reveal the explanation
CloudWatch metrics show your EC2 instances have average CPU utilization around 10% with stable performance over several weeks. The application does not require additional headroom right now. What is the most effective cost-optimization action?
Select an answer to reveal the explanation
A company has a steady, predictable workload that must run continuously (24/7) in a single AWS Region. The team wants the lowest cost option available for this steady usage, but also expects they may choose different EC2 instance families in the future (without re-buying compute discounts). Which AWS purchase option best meets these goals?
Select an answer to reveal the explanation
A SaaS company uses an S3 bucket for database backups created daily. Backups are rarely restored; the company’s documented RTO is 24 hours, and the compliance policy requires backups be kept for 90 days. The team currently stores all backups in S3 Standard, which is costly.
Which single lifecycle policy change is most cost-optimized while still meeting the 24-hour RTO and 90-day retention?
Select an answer to reveal the explanation
A data engineering team runs a nightly ETL job on EC2. The job can be checkpointed every 5 minutes and can be retried from the last checkpoint if the instance terminates. The job runtime varies from 2 to 4 hours, and the team has no need for a specific instance type, as long as it completes before 7:00 AM local time. They currently run the job on On-Demand EC2, leading to high monthly compute cost.
Which change best reduces cost while maintaining the business deadline?
Select an answer to reveal the explanation
Answer all 19 questions to see your domain score breakdown
A structured study plan dramatically increases your chances of passing SAA-C03 on the first attempt. The most effective approach combines reading the official Amazon Web Services documentation or a study guide, watching video explanations for difficult concepts, and then reinforcing everything with daily practice questions.
We recommend the following weekly structure for SAA-C03 preparation:
Cover each SAA-C03 domain systematically. Read the exam objectives, watch explanatory content, and do 10–20 practice questions per domain to test understanding as you go.
Run full 50–60 question mixed sessions daily. Review every wrong answer in detail. Identify which domains are consistently scoring below 70% and revisit those study materials.
Do 100–120 question timed sessions to simulate real exam conditions. Aim for consistent scores above 80% before booking your exam date. A score above 80% in practice typically translates to a passing SAA-C03 score.
On exam day, the SAA-C03 tests your ability to apply knowledge to realistic scenarios — not just recall definitions. This is why reading explanations and understanding the reasoning behind every answer matters more than simply grinding question volume. Use the high-count sessions (100, 120) in the final weeks as your confidence benchmark.
Questions
65
On the real exam
Time limit
130 min
2 min per question
Passing score
720/1000
Scaled scoring
The SAA-C03 exam uses a scaled scoring system — your raw score of correct answers is converted to a score out of 1000. A passing score of 720/1000 does not mean you need 72% of questions correct; the conversion accounts for question difficulty. Consistently scoring above 75–80% on practice tests puts you in a strong position to achieve 720/1000 on the real exam.
Architecture scenario questions on AWS service selection, resilience, cost optimisation, security, and networking trade-offs.
Yes. Courseiva provides free SAA-C03 practice questions with explanations across the official exam domains. Start with a quick practice test, then continue with topic-based practice, mock exams, missed-question review, bookmarked questions, weak-topic recommendations, and readiness tracking. No account required. Create a free account to unlock per-domain analytics and progress tracking across every certification on the platform. Courseiva is free forever, supported by advertising.
Every question is written against the official SAA-C03 exam blueprint published by Amazon Web Services. Our questions follow the same wording style, scenario complexity, and answer structure as the actual exam. They are original questions — not brain dumps — so you learn the underlying concepts and reasoning, not just memorised answers. Candidates who study with brain dumps often pass but have no transferable knowledge; Courseiva questions make you genuinely competent.
Most candidates who pass SAA-C03 on their first attempt do 30–60 questions per day. Use the Quick 10 session for daily warm-ups when you are short on time. On study days, run a 50 or 60-question session to build stamina. Reserve 100 and 120-question sessions for the final two weeks when you want to simulate real exam conditions and benchmark your readiness.
The SAA-C03 covers 4 domains: Design Secure Architectures (30%), Design Resilient Architectures (26%), Design High-Performing Architectures (24%), Design Cost-Optimized Architectures (20%). Each domain carries a different weight, so allocate your study time accordingly. The highest-weighted domains — Design Secure Architectures and Design Resilient Architectures — should receive the most attention.
Exam dumps are memorised question-and-answer lists taken from actual exam papers, often obtained illegally and shared without Amazon Web Services's authorisation. Using them violates your NDA and Amazon Web Services's certification agreement, and can result in certification revocation. Courseiva questions are 100% original — written by certified engineers to test the same knowledge areas using new scenarios and wording. You learn the material, not just the answers.
Per-domain analytics, spaced repetition, daily challenges — and every other certification on the platform.
Sign Up FreeFree forever · Every certification included