Amazon Web ServicesAssociate levelSAA-C03

SAA-C03 exam dumps: 552 free AWS Solutions Architect Associate practice questions

Free SAA-C03 practice questions for the AWS Certified Solutions Architect - Associate exam, with the correct answer and a full explanation for every option. Read the first 10 below, browse all 552 by number, or take a timed practice exam.

Question bank last updated December 2024

Start timed practice exam Browse all 552 questions

Free SAA-C03 practice questions

Questions 1 to 10 of 552

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

SAA-C03 Question 1

Select 3

A company is designing a web application that stores sensitive customer data. The application is hosted on Amazon EC2 instances within a private subnet, and the data is stored in an Amazon RDS database. The company wants to ensure data security by encrypting data both at rest and in transit. Which combination of steps should be implemented to achieve this goal?

A
Enable encryption for the RDS database at the time of creation.
B
Use an Application Load Balancer (ALB) with HTTPS listeners to terminate SSL/TLS connections.
C
Enable server-side encryption (SSE) on the EC2 instance root volume using AWS KMS.
D
Configure the application to use SSL/TLS to connect to the RDS database.
E
Use security groups to block all inbound traffic to the EC2 instances.

Show answer and explanation

Correct answers: A, B, D

Explanation

To ensure data security in the given scenario, the company must encrypt data both at rest and in transit. Enabling encryption for the RDS database ensures that data stored in the database is encrypted at rest. Using an Application Load Balancer (ALB) with HTTPS listeners encrypts data in transit between the client and the ALB. Configuring the application to use SSL/TLS for connections to the RDS database secures data in transit between the application and the database. While server-side encryption on EC2 instances and security group rules are important, they do not directly address the encryption requirements for this scenario.

A. Correct.
This is correct. Amazon RDS provides encryption at rest using AWS Key Management Service (KMS). Enabling encryption at the time of database creation ensures that all data stored in the database is encrypted.
B. Correct.
This is correct. Using an Application Load Balancer (ALB) with HTTPS listeners ensures that data in transit between the client and the ALB is encrypted using SSL/TLS.
C. Incorrect.
This is incorrect. While enabling server-side encryption (SSE) on the root volume encrypts data on the EC2 instance, it does not secure data in transit or the RDS database.
D. Correct.
This is correct. Configuring the application to use SSL/TLS when connecting to the RDS database encrypts data in transit between the application and the database.
E. Incorrect.
This is incorrect. Security groups are used to control network access but do not provide encryption capabilities for data at rest or in transit.

SAA-C03 Question 2

Select 3

Your company is building a web application on AWS that stores sensitive customer data in an Amazon S3 bucket. The application is backed by an Amazon RDS database. You are tasked with designing a secure architecture to ensure compliance with security best practices. Which combination of steps should you take to secure the data both in transit and at rest?

A
Enable server-side encryption (SSE) on the Amazon S3 bucket using AWS Key Management Service (KMS).
B
Use SSL/TLS to encrypt data in transit between the application and Amazon RDS.
C
Ensure the Amazon S3 bucket is publicly accessible to simplify application access.
D
Enable Amazon RDS encryption at rest using AWS-managed keys.
E
Set up an IAM policy to allow all users full access to the Amazon S3 bucket for testing purposes.

Show answer and explanation

Correct answers: A, B, D

Explanation

To design a secure architecture for storing sensitive customer data on AWS, you must ensure both data at rest and data in transit are properly protected. This includes enabling encryption for S3 and RDS to secure data at rest and using SSL/TLS to secure data in transit. Avoiding risky configurations like public bucket access and overly permissive IAM policies is also critical for maintaining a secure environment.

A. Correct.
Correct: Enabling server-side encryption (SSE) with AWS KMS ensures that data stored in the S3 bucket is encrypted at rest. This is a critical security measure for protecting sensitive data.
B. Correct.
Correct: Using SSL/TLS ensures that data in transit between the application and Amazon RDS is encrypted, preventing interception and unauthorized access during transmission.
C. Incorrect.
Incorrect: Making the S3 bucket publicly accessible is a significant security risk. Sensitive customer data should never be exposed publicly.
D. Correct.
Correct: Enabling RDS encryption at rest with AWS-managed keys ensures that data stored in the database is encrypted, which is crucial for meeting security best practices.
E. Incorrect.
Incorrect: Allowing all users full access to the S3 bucket using an overly permissive IAM policy violates the principle of least privilege and exposes sensitive data to unauthorized access.

SAA-C03 Question 3

Select 3

A company is designing a new web application that will store sensitive customer information in an Amazon RDS database. The company wants to ensure data security by encrypting the data at rest and in transit. Additionally, the company must meet compliance requirements by controlling database access at the network level. Which combination of actions should the Solutions Architect recommend?

A
Enable encryption at rest for the Amazon RDS instance using AWS KMS.
B
Use a VPC security group to restrict access to the RDS instance.
C
Enable AWS Shield to protect the RDS database against DDoS attacks.
D
Require SSL/TLS for database connections to encrypt data in transit.
E
Use Amazon RDS Multi-AZ deployment to ensure high availability.

Show answer and explanation

Correct answers: A, B, D

Explanation

To design a secure architecture for the web application, the company must ensure that the data is protected both at rest and in transit. Enabling encryption at rest with AWS KMS and requiring SSL/TLS for database connections satisfy these requirements. Additionally, using a VPC security group ensures that access to the database is controlled at the network level. AWS Shield and Multi-AZ deployment are important for other use cases, such as availability and DDoS protection, but they are not directly relevant to the encryption and network security requirements described in this scenario.

A. Correct.
Enabling encryption at rest using AWS KMS ensures that the data stored in the database is encrypted, which addresses the security and compliance requirement.
B. Correct.
Using a VPC security group allows you to control network-level access to the RDS instance, which is necessary for securing the database and meeting compliance requirements.
C. Incorrect.
AWS Shield is a service designed to protect against DDoS attacks, but it does not provide encryption or network-level access control for the RDS database.
D. Correct.
Enabling SSL/TLS for database connections encrypts data in transit, ensuring sensitive information is securely transmitted to and from the RDS database.
E. Incorrect.
While Amazon RDS Multi-AZ deployment provides high availability and fault tolerance, it does not directly address encryption or network-level access control.

SAA-C03 Question 4

Select 3

A company is designing a web application that processes sensitive customer information. The application will be hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). As part of the security requirements, the application must ensure that sensitive data is encrypted both in transit and at rest. Which of the following steps should the company take to meet these requirements?

A
Use an SSL/TLS certificate on the Application Load Balancer to enforce HTTPS connections.
B
Enable server-side encryption for the S3 bucket where sensitive data backups are stored.
C
Use an IAM role to allow the EC2 instances to access the sensitive data without hardcoding credentials.
D
Configure the EC2 instances to use an encrypted Amazon Elastic Block Store (Amazon EBS) volume.
E
Set up VPC Flow Logs to monitor and log all network traffic for the EC2 instances.

Show answer and explanation

Correct answers: A, B, D

Explanation

To meet the requirements of encrypting sensitive data in transit and at rest, the company must enforce HTTPS connections on the ALB with SSL/TLS, enable server-side encryption for S3 buckets, and use encrypted EBS volumes for EC2 instances. While IAM roles and VPC Flow Logs are security best practices, they do not directly address the encryption requirements specified in the scenario.

A. Correct.
Using an SSL/TLS certificate on the Application Load Balancer ensures that all data in transit between clients and the application is encrypted, satisfying the encryption-in-transit requirement.
B. Correct.
Enabling server-side encryption for the S3 bucket ensures that data at rest in the S3 bucket is encrypted, which is part of the requirement for securing sensitive data.
C. Incorrect.
While using an IAM role is good for security and avoiding hardcoding credentials, it does not directly address the encryption of data in transit or at rest.
D. Correct.
Configuring the EC2 instances with encrypted Amazon EBS volumes ensures that sensitive data stored on the instance is encrypted at rest, meeting the data-at-rest encryption requirement.
E. Incorrect.
Setting up VPC Flow Logs is useful for monitoring and troubleshooting, but it does not contribute to meeting the encryption-in-transit or encryption-at-rest requirements.

SAA-C03 Question 5

Select 3

A company wants to provide secure access for its developers to manage resources in an AWS account. The developers should only be able to access specific services and actions based on their job roles. Additionally, the company wants to ensure that access keys are not hardcoded into applications or shared manually. Which of the following solutions would meet these requirements?

A
Create IAM roles with policies that grant the necessary permissions and allow developers to assume these roles.
B
Create IAM users for each developer, attach policies with required permissions, and share long-term access keys with them.
C
Use AWS Systems Manager Session Manager to provide secure access to AWS resources without the need for SSH keys or bastion hosts.
D
Enable Multi-Factor Authentication (MFA) for IAM users and enforce its use for all AWS Management Console logins.
E
Use Amazon Cognito to manage user identities and their access to AWS resources.

Show answer and explanation

Correct answers: A, C, D

Explanation

To design secure access to AWS resources, you should use IAM roles with policies for granting temporary permissions, enforce MFA to enhance account security, and leverage Systems Manager Session Manager for secure access. Sharing long-term credentials or using inappropriate services like Cognito for this purpose is not recommended.

A. Correct.
Creating IAM roles with policies and allowing developers to assume these roles ensures secure, temporary access to AWS resources without the need to share long-term credentials. This aligns with AWS best practices.
B. Incorrect.
Creating IAM users and sharing long-term access keys is not secure. Hardcoding or sharing access keys increases the risk of security breaches and violates AWS best practices.
C. Correct.
AWS Systems Manager Session Manager provides secure, auditable session access to manage AWS resources, avoiding the need for SSH keys or bastion hosts, which enhances security.
D. Correct.
Enabling MFA for IAM users adds an extra layer of security, ensuring that even if credentials are compromised, unauthorized access is prevented.
E. Incorrect.
Amazon Cognito is designed for managing user identities for web and mobile applications, not for granting secure access to AWS resources for developers.

SAA-C03 Question 6

Select 3

A company has an S3 bucket named 'company-data' that stores sensitive customer information. The bucket should only be accessible to employees within the company network via the corporate VPN. The company also wants to ensure that any access attempts from outside the corporate network are denied. How can you design secure access to the S3 bucket to meet these requirements?

A
Configure an S3 bucket policy to allow access only from specific IP ranges corresponding to the corporate VPN.
B
Enable S3 Block Public Access on the bucket to prevent unauthorized public access.
C
Use an IAM role with permissions to access the bucket and assign it to employees' EC2 instances in the corporate network.
D
Enable AWS CloudTrail logging for the bucket to monitor access attempts and identify unauthorized access.
E
Use VPC endpoints for S3 to ensure traffic to the bucket stays within the AWS network.

Show answer and explanation

Correct answers: A, B, E

Explanation

To secure access to the S3 bucket, you should use a combination of an S3 bucket policy to allow access only from the corporate VPN's IP ranges, enable S3 Block Public Access to prevent unauthorized public access, and use VPC endpoints for S3 to keep traffic within the AWS network. These measures collectively ensure that the bucket is only accessible to employees within the corporate network and is protected from unauthorized or public access.

A. Correct.
This is correct. An S3 bucket policy can restrict access to specific IP ranges, such as the IP addresses used by the corporate VPN, ensuring only employees within the network can access the bucket.
B. Correct.
This is correct. Enabling S3 Block Public Access ensures that no public access can be granted to the bucket, reducing the risk of unauthorized access.
C. Incorrect.
This is incorrect. Using an IAM role for EC2 instances can help in granting access to resources, but it does not restrict access based on the corporate VPN or IP range, which is a key requirement in this scenario.
D. Incorrect.
This is incorrect. While enabling AWS CloudTrail logging is a good practice for monitoring access, it does not actively restrict access to the S3 bucket based on the corporate VPN or IP range.
E. Correct.
This is correct. Using VPC endpoints for S3 ensures that all traffic to the bucket remains within the AWS network, providing an additional layer of security by avoiding exposure to the public internet.

SAA-C03 Question 7

Single answer

A company is building a web application hosted on Amazon EC2 instances in a private subnet. The application needs to securely access data stored in an Amazon S3 bucket. The company requires that no S3 bucket credentials are hardcoded in the application, and all communication must remain private. How should the company securely configure access to the S3 bucket?

A
Assign an IAM role to the EC2 instances and configure a VPC endpoint for S3.
B
Store the S3 bucket credentials in an encrypted file on the EC2 instances.
C
Use an IAM user with programmatic access keys and configure the application to use these keys.
D
Configure a public-facing NAT Gateway in the VPC and use it for accessing the S3 bucket.

Show answer and explanation

Correct answer: A

Explanation

The correct approach to securely access an S3 bucket from EC2 instances in a private subnet is to assign an IAM role to the EC2 instances, which provides temporary credentials without hardcoding them. Configuring a VPC endpoint for S3 ensures that all traffic between the EC2 instances and the S3 bucket remains private within the AWS network, eliminating the need to route traffic through the internet or use a NAT Gateway.

A. Correct.
This is the correct solution. Assigning an IAM role to the EC2 instances allows temporary credentials to be securely managed without hardcoding them. Configuring a VPC endpoint for S3 ensures that all traffic between the EC2 instances and the S3 bucket remains private within the AWS network.
B. Incorrect.
This is not a secure solution because storing credentials in an encrypted file increases the risk of accidental exposure or misuse, and it does not meet the requirement of avoiding hardcoded credentials.
C. Incorrect.
Using an IAM user with programmatic access keys involves hardcoding credentials, which is not secure and violates the requirement to avoid hardcoded S3 bucket credentials.
D. Incorrect.
A NAT Gateway is not required to access an S3 bucket if a VPC endpoint for S3 is configured. Additionally, a public-facing NAT Gateway would route traffic through the internet, which does not meet the requirement to keep communication private.

SAA-C03 Question 8

Select 2

A company wants to grant its development team access to specific Amazon S3 buckets while ensuring that the team cannot access other resources in the AWS account. The team members should authenticate using their corporate Active Directory credentials. Which solution will meet these requirements in the most secure and efficient way?

A
Use AWS Identity and Access Management (IAM) users with bucket policies attached to each S3 bucket.
B
Set up AWS Single Sign-On (AWS SSO) integrated with the corporate Active Directory, and assign permissions to access the S3 buckets through IAM roles.
C
Create an IAM policy allowing access to specific S3 buckets, attach it directly to each developer, and enable multi-factor authentication (MFA).
D
Use an identity provider (IdP) federation with SAML, create IAM roles granting access to the S3 buckets, and map the roles to permissions based on Active Directory groups.

Show answer and explanation

Correct answers: B, D

Explanation

To design secure access to AWS resources, integrating with the corporate Active Directory ensures that the development team can authenticate using their existing credentials. Using AWS SSO or SAML-based federation with an IdP provides a scalable and secure way to grant access to specific resources, such as Amazon S3 buckets, through IAM roles. Options 2 and 4 meet all requirements while adhering to AWS security best practices.

A. Incorrect.
This option can work, but managing individual IAM users and bucket policies for each team member is not scalable or efficient. It also does not integrate well with corporate Active Directory for authentication.
B. Correct.
This option is correct because AWS SSO allows integration with corporate Active Directory and provides a scalable way to manage access to AWS resources like S3 buckets through IAM roles.
C. Incorrect.
While this approach can restrict access to specific S3 buckets, attaching policies directly to individual users is not a best practice. It is also not efficient for large teams and does not align with the requirement to use corporate Active Directory credentials.
D. Correct.
This option is correct because using SAML-based federation with an IdP allows the company to integrate corporate Active Directory for authentication. IAM roles mapped to Active Directory groups provide secure and scalable access to the required S3 buckets.

SAA-C03 Question 9

Single answer

A company is deploying a new application using Amazon ECS with Fargate. The application requires sensitive database credentials to connect to an Amazon RDS instance. The company wants to securely manage these credentials without hardcoding them into the application code or storing them in the container image. What is the BEST way to achieve this?

A
Store the credentials in an Amazon S3 bucket and grant the ECS task permissions to access the bucket.
B
Use AWS Secrets Manager to store the credentials and configure the ECS task definition to retrieve the secrets at runtime.
C
Embed the credentials directly into the ECS task definition as environment variables.
D
Encrypt the credentials using AWS KMS and include the encrypted values in the container image.

Show answer and explanation

Correct answer: B

Explanation

AWS Secrets Manager is the best solution for securely managing sensitive information such as database credentials. It integrates with Amazon ECS, allowing applications to retrieve secrets at runtime without exposing them in plain text or hardcoding them. This approach also supports automated secret rotation and provides robust security controls.

A. Incorrect.
Storing sensitive credentials in Amazon S3 is not a secure approach, even if permissions are restricted. This option does not provide the required level of security for sensitive data like database credentials.
B. Correct.
AWS Secrets Manager is the recommended option for securely storing and retrieving sensitive information like database credentials. It integrates seamlessly with ECS task definitions, allowing tasks to retrieve the credentials securely at runtime.
C. Incorrect.
Embedding sensitive credentials directly into the ECS task definition as environment variables is insecure because it exposes the credentials in plain text and increases the risk of unauthorized access.
D. Incorrect.
Including encrypted credentials in the container image is not a secure or scalable solution. It requires additional steps to decrypt the credentials at runtime and risks exposing the decryption keys.

SAA-C03 Question 10

Select 3

A media company runs a video streaming platform that experiences significant traffic spikes during live events. They want to ensure their application can scale automatically to handle unpredictable traffic patterns while minimizing costs. Which combination of AWS services should the company use to achieve this goal?

A
Amazon EC2 Auto Scaling with an Application Load Balancer
B
Amazon RDS with Multi-AZ deployment
C
Amazon DynamoDB with on-demand capacity mode
D
AWS Elastic Beanstalk with Auto Scaling enabled
E
Amazon S3 with Transfer Acceleration

Show answer and explanation

Correct answers: A, C, D

Explanation

To handle unpredictable traffic spikes effectively, the company should use services that provide automatic scaling and cost optimization. Amazon EC2 Auto Scaling with an Application Load Balancer ensures the compute layer scales based on demand. Amazon DynamoDB with on-demand capacity mode automatically handles traffic spikes at the database layer. AWS Elastic Beanstalk simplifies application scaling by providing a managed environment with Auto Scaling enabled. Together, these services provide a comprehensive solution for scaling the application while minimizing costs.

A. Correct.
Amazon EC2 Auto Scaling with an Application Load Balancer allows the application to automatically scale out or in based on traffic patterns, ensuring high availability and cost optimization. This is suitable for handling unpredictable traffic spikes.
B. Incorrect.
Amazon RDS with Multi-AZ deployment is designed for database availability and failover but does not directly address application scaling for unpredictable traffic spikes.
C. Correct.
Amazon DynamoDB with on-demand capacity mode automatically adjusts its capacity to handle traffic spikes, making it a cost-effective solution for unpredictable workloads.
D. Correct.
AWS Elastic Beanstalk with Auto Scaling enabled provides a managed platform that can automatically scale the application layer in response to demand, simplifying the process of handling traffic spikes.
E. Incorrect.
Amazon S3 with Transfer Acceleration is used to speed up data transfers to and from S3 buckets but does not address application or database scaling requirements.

Timed practice exam

Take a SAA-C03 practice test under exam conditions

65 questions in 130 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

What the SAA-C03 exam covers

Official AWS Certified Solutions Architect - Associate exam domains and weightings.

Design Secure Architectures
30% of exam
Design Resilient Architectures
26% of exam
Design High-Performing Architectures
24% of exam
Design Cost-Optimized Architectures
20% of exam

SAA-C03 practice questions 1 to 100 of 552

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 6 pages of up to 100 questions.

SAA-C03 exam dumps FAQ

Are these SAA-C03 dumps real exam questions?

No. These are original practice questions written to the AWS Certified Solutions Architect - Associate exam objectives, not questions copied from a live exam. Memorising leaked questions violates Amazon Web Services's candidate agreement and stops working the moment the question pool rotates. Use this bank to check your understanding of each domain and to find the topics you still need to study.

How many SAA-C03 practice questions are there?

552 questions, each with the correct answer, an explanation of the answer, and a note on why every other option is wrong. The first 10 are on this page and every question has its own page linked below.

Are the SAA-C03 exam dumps free?

Yes. Every question, answer and explanation on this page and the linked question pages is free to read without an account. A free HydraNode account adds timed practice exams, scoring and progress tracking across attempts.

How do I take a timed SAA-C03 practice test?

Sign in and start the AWS Certified Solutions Architect - Associate exam on HydraNode. A session gives you 65 questions drawn from this bank in 130 minutes, then a score report with a per-question review.

What topics does the SAA-C03 exam cover?

The official exam domains are: Design Secure Architectures; Design Resilient Architectures; Design High-Performing Architectures; Design Cost-Optimized Architectures.

More AWS exam dumps

All AWS exams

AIF-C01230 questions

AWS Certified AI Practitioner exam dumps

AWS Certified AI Practitioner

ANS-C01512 questions

AWS Advanced Networking Specialty exam dumps

AWS Certified Advanced Networking - Specialty

CLF-C02341 questions

AWS Certified Cloud Practitioner exam dumps

AWS Certified Cloud Practitioner

DEA-C01549 questions

AWS Data Engineer Associate exam dumps

AWS Certified Data Engineer - Associate

DOP-C02410 questions

AWS DevOps Engineer Professional exam dumps

AWS Certified DevOps Engineer - Professional

DVA-C02398 questions

AWS Developer Associate exam dumps

AWS Certified Developer - Associate

MLS-C01388 questions

AWS Machine Learning Specialty exam dumps

AWS Certified Machine Learning - Specialty

MLA-C01457 questions

AWS Machine Learning Engineer Associate exam dumps

AWS Certified Machine Learning Engineer - Associate