AWS Certified Solutions Architect – Associate Detailed Exam Domain Coverage

• Design Secure Architectures (30%): IAM users, groups, roles, and policies; VPC security (NACLs and Security Groups); Data encryption at rest (KMS) and in transit (ACM/TLS); AWS WAF and Shield; Secrets Manager.

• Design Resilient Architectures (26%): High availability across AZs and Regions; Disaster recovery strategies; Loose coupling with SQS and SNS; Auto Scaling; Multi‑AZ database replication.

• Design High‑Performing Architectures (24%): Selection of performant storage (S3, EBS, EFS); Choosing appropriate EC2 instance types; Optimizing databases (RDS, DynamoDB, ElastiCache); Global content delivery (CloudFront, Global Accelerator); Performance monitoring with CloudWatch.

• Design Cost‑Optimized Architectures (20%): Cost management and budgeting; Choosing appropriate pricing models; Reserved Instances and Savings Plans; Right‑sizing compute and storage; Using AWS Trusted Advisor for cost recommendations.

Course Description

Passing the AWS Certified Solutions Architect – Associate (SAA-C03) exam requires more than just reading through documentation. You need practical, scenario-based experience to understand exactly how different AWS services interact under specific constraints. I created this practice test course to give you a realistic simulation of the actual exam environment, matching the difficulty, format, and domain weighting of the real SAA-C03 certification.

When sitting for the AWS SAA-C03, you will face 65 questions to complete in 130 minutes, meaning time management and the ability to quickly eliminate incorrect distractors are just as critical as your technical knowledge. I have structured these mock exams to test your ability to design secure, resilient, high‑performing, and cost‑optimized solutions on AWS. Every single question comes with a highly detailed breakdown of the correct and incorrect options, turning every mistake into a direct study lesson. If you want to identify your weak spots before exam day and walk into the testing center with confidence, these practice exams are your final stepping stone.

Practice Questions Preview

Below is a sample of the exact format and depth you will find inside the course:

• Question 1: A company needs to design a highly available web application. The application will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The database tier uses Amazon RDS for MySQL. Which combination of steps should a solutions architect take to ensure the architecture is highly available and resilient to Availability Zone failures? (Select TWO.)

  • Option A: Deploy the EC2 instances in an Auto Scaling group across multiple Availability Zones.

  • Option B: Place all EC2 instances in a single Availability Zone to reduce latency.

  • Option C: Configure the Amazon RDS for MySQL database with a Multi-AZ deployment.

  • Option D: Use Amazon Route 53 to route traffic to a single active EC2 instance and fail over to a standby instance.

  • Option E: Store the database backups in Amazon Elastic File System (Amazon EFS).

  • Option F: Enable Cross-Region Replication on the Application Load Balancer.

  • Correct Answers: Option A and Option C.

  • Overall Explanation: High availability requires ensuring that no single Availability Zone failure can take down the application. Distributing the EC2 compute layer across multiple AZs and enabling Multi-AZ for the database tier provides a robust, highly available architecture.

  • Explanation for Option A (Correct): Auto Scaling across multiple Availability Zones ensures that if one AZ goes down, the ALB can route traffic to healthy instances in the remaining AZs.

  • Explanation for Option B (Incorrect): Placing instances in a single AZ introduces a single point of failure, violating the resilient architecture requirement.

  • Explanation for Option C (Correct): An RDS Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different AZ, providing immediate failover capabilities if the primary database fails.

  • Explanation for Option D (Incorrect): Routing traffic to a single active instance does not leverage the ALB's ability to distribute load and introduces a severe performance bottleneck.

  • Explanation for Option E (Incorrect): RDS automated backups are stored in Amazon S3 by default, not EFS. EFS is used for file storage attached to EC2 instances.

  • Explanation for Option F (Incorrect): Application Load Balancers operate within a single Region and distribute traffic across AZs within that Region. They do not have a "Cross-Region Replication" feature.

• Question 2: A financial institution needs to securely store sensitive customer data in an Amazon S3 bucket. Compliance regulations mandate that the data must be encrypted at rest using keys managed by the company, and access to the keys must be strictly audited. Which approach meets these requirements?

  • Option A: Enable Server-Side Encryption with Amazon S3 managed keys (SSE-S3).

  • Option B: Enable Server-Side Encryption with AWS KMS keys (SSE-KMS) and use a customer managed key.

  • Option C: Use Amazon Macie to automatically encrypt the objects as they are uploaded.

  • Option D: Enable Client-Side Encryption and store the encryption keys in AWS Systems Manager Parameter Store.

  • Option E: Enable Server-Side Encryption with customer-provided keys (SSE-C) and store the keys in a local text file.

  • Option F: Use AWS Secrets Manager to automatically rotate S3 default encryption keys.

  • Correct Answer: Option B.

  • Overall Explanation: The requirement dictates encryption at rest using keys managed by the company (customer managed) with strict auditing capabilities. AWS KMS (Key Management Service) provides exactly this, integrating with AWS CloudTrail for comprehensive access auditing.

  • Explanation for Option A (Incorrect): SSE-S3 uses keys managed completely by AWS. The customer has no control over the keys, and key usage is not independently audited in CloudTrail.

  • Explanation for Option B (Correct): SSE-KMS with a customer managed key gives the institution control over the key's rotation and policies. Every time the key is used to encrypt or decrypt data, AWS CloudTrail logs the API call, satisfying the auditing requirement.

  • Explanation for Option C (Incorrect): Amazon Macie is a data security service that discovers and protects sensitive data, but it is not an encryption mechanism for S3 objects.

  • Explanation for Option D (Incorrect): While Client-Side Encryption gives the customer control, Parameter Store is not the appropriate service for enterprise-grade key auditing and cryptographic operations compared to KMS.

  • Explanation for Option E (Incorrect): SSE-C requires the application to manage and supply the encryption keys for every request. Storing them in a local text file is highly insecure and fails modern compliance standards.

  • Explanation for Option F (Incorrect): Secrets Manager is used to manage and rotate secrets like database credentials, not to manage S3 bucket encryption keys.

• Question 3: A media streaming company needs a cost-optimized storage solution for large video files. New videos are accessed frequently for the first 30 days. After 30 days, access drops significantly, but the videos must be retrieved within milliseconds if requested. After one year, the videos are rarely accessed and retrieval times of up to 12 hours are acceptable. Which lifecycle configuration is the MOST cost-effective?

  • Option A: Store data in S3 Standard. Transition to S3 Intelligent-Tiering after 30 days. Transition to S3 Glacier Deep Archive after 365 days.

  • Option B: Store data in S3 Standard. Transition to S3 Standard-IA after 30 days. Transition to S3 Glacier Deep Archive after 365 days.

  • Option C: Store data in S3 Standard. Transition to S3 One Zone-IA after 30 days. Transition to S3 Glacier Flexible Retrieval after 365 days.

  • Option D: Store data in Amazon EFS. Transition to EFS Infrequent Access after 30 days. Transition to S3 Glacier after 365 days.

  • Option E: Store data in EBS Cold HDD (sc1). Take a snapshot to S3 Standard-IA after 30 days. Archive the snapshot after 365 days.

  • Option F: Store data in S3 Standard. Transition to S3 Glacier Instant Retrieval after 30 days. Transition to S3 Glacier Flexible Retrieval after 365 days.

  • Correct Answer: Option B.

  • Overall Explanation: The scenario requires a storage progression based on specific access patterns and retrieval time constraints. S3 lifecycle policies are ideal for this. We need millisecond access after 30 days (Standard-IA provides this at a lower cost than Standard) and up to 12-hour retrieval after one year (Glacier Deep Archive is the cheapest option).

  • Explanation for Option A (Incorrect): Intelligent-Tiering carries a small monitoring fee. Standard-IA is more cost-effective when the access pattern is strictly known (drops significantly after 30 days).

  • Explanation for Option B (Correct): S3 Standard handles the frequent access for 30 days. Standard-IA lowers storage costs while maintaining the required millisecond retrieval. Glacier Deep Archive provides the absolute lowest storage cost for the 1-year mark, meeting the 12-hour retrieval window.

  • Explanation for Option C (Incorrect): One Zone-IA is less resilient (stored in a single AZ) which is generally not recommended for primary video assets unless specifically stated. Furthermore, Glacier Deep Archive is cheaper than Glacier Flexible Retrieval for the 1-year requirement.

  • Explanation for Option D (Incorrect): Amazon EFS is much more expensive than S3 and is designed for shared file systems, not large-scale media object storage.

  • Explanation for Option E (Incorrect): EBS volumes must be attached to EC2 instances. This is an overcomplicated, highly expensive architecture for storing media files compared to S3.

  • Explanation for Option F (Incorrect): While Glacier Instant Retrieval offers millisecond access, Standard-IA is generally more appropriate for data accessed less frequently but still needing immediate access without the higher per-request retrieval costs associated with Glacier Instant Retrieval if access spikes occur. More importantly, Deep Archive is cheaper than Flexible Retrieval for the final tier.

• Welcome to the Mock Exam Practice Tests Academy to help you prepare for your AWS Certified Solutions Architect – Associate (SAA-C03) exam.

• You can retake the exams as many times as you want.

• This is a huge original question bank.

• You get support from me if you have questions.

• Each question has a detailed explanation.

• Mobile-compatible with the Udemy app.

I hope that by now you're convinced! And there are a lot more questions inside the course.