AWS SAA-C03: AWS Certified Solutions Architect - Associate

Last checked October 22, 2026 against the official AWS exam page.

1. Question 1Design Secure Architectures

   A company hosts a web application on EC2 instances in private subnets. Users must reach the application over HTTPS, and the instances must not have public IP addresses. Which architecture meets this requirement?

   1. AAssign public IPs to every instance and open inbound port 443 to 0.0.0.0/0 on its security group
   2. BA Client VPN endpoint for each remote user, with a tunnel from each user's device terminating directly on the application instances
   3. CAn internet-facing Application Load Balancer in public subnets forwarding to instances in private subnets
   4. DAn internal Network Load Balancer in a private subnet with no route to the internet gateway, listening on TCP port 443
   Show answer and explanationHide answer

   Correct answer: C

   An internet-facing ALB in public subnets receives HTTPS traffic and forwards to private instances, so the instances keep no public IPs. Public IPs on instances and VPNs per user do not match the requirement, and a private-only load balancer cannot receive internet traffic.

2. Question 2Design Resilient Architectures

   A company runs a stateless web tier that must survive the failure of a single Availability Zone with minimal interruption. Which design is most appropriate?

   1. AA single NAT gateway in one AZ carrying outbound traffic for private subnets in every zone
   2. BA single large EC2 instance in one AZ with vertical scaling and an attached EBS root volume
   3. CInstances in one AZ with a manual restart runbook that operators follow after an outage to recover
   4. DAn Auto Scaling group spanning at least two AZs behind an Application Load Balancer
   Show answer and explanationHide answer

   Correct answer: D

   Spreading instances across AZs with a load balancer and Auto Scaling keeps the service available when one zone fails. A single instance, one-AZ setups and a single NAT gateway create single points of failure.

3. Question 3Design High-Performing Architectures

   A web application experiences high read traffic for product pages that rarely change. The team wants to reduce latency and database load. Which approach is most effective?

   1. AAdd more application servers behind the load balancer without caching so reads still hit the database
   2. BIncrease the database's provisioned write capacity and IOPS so more writes can be served per second
   3. CStore product pages in local storage on each user's device with no server copy
   4. DAdd a caching layer such as ElastiCache or CloudFront caching for the product responses
   Show answer and explanationHide answer

   Correct answer: D

   Caching product responses reduces latency and database read load. Write capacity does not address reads, more servers without caching still hit the database, and device storage is not a web architecture.

4. Question 4Design Cost-Optimized Architectures

   A company runs a steady production workload on EC2 for a full year and wants the lowest compute cost with flexibility across instance families. Which purchasing option should be used?

   1. ACompute Savings Plans
   2. BOn-Demand instances for all workloads
   3. CSpot instances for the production database
   4. DDedicated hosts for every instance
   Show answer and explanationHide answer

   Correct answer: A

   Compute Savings Plans provide lower prices for a committed hourly spend with flexibility across families and Regions. On-Demand is more expensive, Spot can be interrupted, and dedicated hosts are used for specific licensing needs.

5. Question 5Design Secure Architectures

   An application on EC2 needs to read objects from an S3 bucket. The security team requires that the traffic not traverse the internet and that access be limited to one bucket. Which solution fits?

   1. AA public IP on the EC2 instance and a bucket ACL granting READ to AllUsers group with S3 traffic routed over the internet gateway
   2. BA NAT gateway for outbound calls with a bucket policy granting s3:GetObject to external accounts
   3. CAn IAM role on the instance with a least-privilege policy for that bucket and a gateway VPC endpoint for S3
   4. DAn IAM user with an access key hardcoded in the application code and a publicly readable bucket
   Show answer and explanationHide answer

   Correct answer: C

   An instance role with a scoped policy plus a gateway endpoint keeps access private and limited. Stored keys, public buckets and NAT paths over the internet do not meet the requirements.