Prepare for the SAA-C03 AWS Certified Solutions Architect - Associate Exam

Free SAA-C03 Practice Questions (With Answers)

5 real questions from the SAA-C03 bank, with the full explanation for each answer. No sign-up needed to read them.

1. Question 1Design Secure Architectures [IAM Best Practices]

   A solutions architect is reviewing the security of a new AWS account. According to AWS security best practices, what is the MOST critical initial step to secure the account root user?

   • A.Create a complex password and rotate it every 30 days.
   • B.Enable Multi-Factor Authentication (MFA) on the root user account.
   • C.Create a new IAM user with administrative privileges and use it for all daily tasks.
   • D.Store the root user access keys in AWS Secrets Manager for automated rotation.
   Show answer and explanation

   Correct answer: B

   Correct. The first principle of securing the root user is to add an additional layer of security beyond a password. Enabling MFA is the single most important security best practice for the root user, as it protects the most privileged credentials in the account from being compromised.

   Why the other options are wrong

   A. Incorrect. While a strong password policy is a good practice, it does not provide the same level of protection as multi-factor authentication against compromised credentials. It is not considered the single most critical step.

   C. Incorrect. While creating an administrative IAM user is a crucial step to avoid using the root user for daily tasks, the most critical step for securing the root user itself is enabling MFA.

   D. Incorrect. The fundamental security best practice is to avoid creating access keys for the root user altogether. The root user should not be used for programmatic access.

2. Question 2Design Secure Architectures [Rotating Credentials]

   A security audit has mandated that all IAM user access keys must be rotated every 90 days. A solutions architect needs to design an automated way to check for access keys older than 90 days and send a notification. Which combination of services can achieve this?

   • A.Use Amazon GuardDuty to detect IAM user access keys older than 90 days and configure AWS Shield to send automated notifications to the security team.
   • B.Use Amazon Inspector to scan IAM user access keys for any older than 90 days and configure Amazon Simple Email Service (SES) to send automated email alerts.
   • C.Use AWS CloudTrail to log access key creation events and configure an AWS Lambda function to scan the logs and send automated email notifications.
   • D.Use AWS Config to create a rule that checks the age of access keys and Amazon Simple Notification Service (SNS) to send notifications.
   Show answer and explanation

   Correct answer: D

   Correct. AWS Config is designed to assess, audit, and evaluate the configurations of your AWS resources. Its managed rule access-keys-rotated (parameter maxAccessKeyAge = 90) flags active access keys older than the limit. When a non-compliant key is found, an EventBridge rule on the Config compliance change can publish to an Amazon SNS topic to send notifications.

   Why the other options are wrong

   A. Incorrect. GuardDuty is for threat detection, not for checking the age of credentials. AWS Shield is for DDoS protection, not notifications.

   B. Incorrect. Amazon Inspector scans EC2 instances, container images and Lambda functions for software vulnerabilities and unintended network exposure; it does not evaluate IAM credentials. AWS Config is the service for continuous configuration compliance checks like a 90-day key-age policy.

   C. Incorrect. While CloudTrail logs the creation event, it doesn't continuously track the age. A custom solution would be needed to scan and check this, whereas AWS Config provides a managed service to do so.

3. Question 3Design Secure Architectures [AWS Control Tower]

   An enterprise wants to set up a new multi-account AWS environment that adheres to best practices from the start. They need a service that automates the setup of a landing zone, implements baseline security and networking configurations, and provides ongoing governance with guardrails. Which service is designed to orchestrate this entire process?

   • A.AWS Organizations
   • B.AWS Control Tower
   • C.AWS Service Catalog
   • D.AWS CloudFormation
   Show answer and explanation

   Correct answer: B

   Correct. AWS Control Tower is the service that automates the entire process described. It uses other services like Organizations, CloudFormation, and Config to build a secure, well-architected, multi-account environment (a landing zone) and provides ongoing governance through a set of mandatory and optional guardrails.

   Why the other options are wrong

   A. Incorrect. AWS Organizations is the foundational service for managing multiple accounts, providing features like consolidated billing and SCPs. However, it does not, by itself, automate the setup of a full landing zone with networking and guardrails.

   C. Incorrect. Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS. It helps with standardized deployments but does not set up the foundational multi-account environment.

   D. Incorrect. CloudFormation can be used to provision the resources for a landing zone, but it requires the user to write and manage the templates. It does not provide the orchestration and ongoing governance wrapper.

4. Question 4Design Secure Architectures [Data Classification and Compliance]

   A healthcare provider needs to store patient records containing Protected Health Information (PHI) on AWS. To comply with HIPAA, they must ensure the data is encrypted at rest and in transit, and they need a log of every time the data is accessed. Which combination of services helps meet these compliance requirements?

   • A.Store data in Amazon S3 with SSE-S3 encryption and enable VPC Flow Logs to capture network-level activity, providing an audit trail of all network traffic.
   • B.Store data in Amazon S3 with SSE-KMS, enable S3 Object-Level Logging with AWS CloudTrail, and enforce encryption in transit with a bucket policy.
   • C.Store data in an unencrypted EBS volume and rely on AWS Backup to create encrypted snapshots for compliance.
   • D.Store data in Amazon RDS with encryption at rest and AWS Shield for DDoS protection.
   Show answer and explanation

   Correct answer: B

   Correct. This combination addresses all requirements. SSE-KMS provides auditable encryption at rest. Enabling CloudTrail data events for the S3 bucket provides a detailed log of all object-level API calls (e.g., GetObject), satisfying the access logging requirement. A bucket policy with the `aws:SecureTransport` condition can be used to enforce encryption in transit (HTTPS).

   Why the other options are wrong

   A. Incorrect. VPC Flow Logs capture IP traffic metadata, not data access logs at the object level (who accessed what object). SSE-S3 provides encryption, but may not offer the required level of auditability for key usage.

   C. Incorrect. Storing PHI on an unencrypted volume at any time would likely violate HIPAA's encryption at rest requirement.

   D. Incorrect. While RDS offers encryption, AWS Shield is for DDoS protection and does not provide data access logging.

5. Question 5Design High-Performing Architectures [EBS Volume Types]

   A company is running a large, mission-critical relational database on an Amazon EC2 instance. The application requires sustained, high I/O performance with the lowest possible latency for transactional workloads. The business requires the highest level of durability for the storage volume. Which Amazon EBS volume type is MOST appropriate for this workload?

   • A.General Purpose SSD (gp3)
   • B.Throughput Optimized HDD (st1)
   • C.Provisioned IOPS SSD (io2 Block Express)
   • D.Cold HDD (sc1)
   Show answer and explanation

   Correct answer: C

   Correct. The `io2 Block Express` volume type is specifically designed for the largest, most I/O-intensive, mission-critical applications. It provides the highest performance Provisioned IOPS SSD volume with sub-millisecond latency and the highest durability (99.999% volume durability), making it the ideal choice for a high-performance transactional database.

   Why the other options are wrong

   A. Incorrect. While gp3 offers good, balanced performance and is suitable for many workloads, it does not provide the highest level of IOPS or the highest durability that AWS offers. The requirement is for a mission-critical database with the highest performance and durability.

   B. Incorrect. st1 volumes are designed for large, sequential, throughput-intensive workloads like big data processing or log streaming, not for low-latency transactional database workloads.

   D. Incorrect. sc1 is the lowest-cost magnetic storage, designed for infrequently accessed data. Its performance is not suitable for a production database.