Amazon SAA-C03 Exam Dumps

AWS Certified Solutions Architect - Associate (SAA-C03)

936 Reviews

Exam Code	SAA-C03
Exam Name	AWS Certified Solutions Architect - Associate (SAA-C03)
Questions	962 Questions & Answers
Update Date	September 10, 2026
Price	Was : $90 Today : $50 Was : $108 Today : $60 Was : $126 Today : $70

Add To Cart

Demo Questions

Question # 1

A company has applications that run on Amazon EC2 instances in a VPC One of the applications needs to call the Amazon S3 API to store and read objects. According to the company's security regulations, no traffic from the applications is allowed to travel across the internet. Which solution will meet these requirements?

A. Configure an S3 gateway endpoint. 
B. Create an S3 bucket in a private subnet. 
C. Create an S3 bucket in the same AWS Region as the EC2 instances. 
D. Configure a NAT gateway in the same subnet as the EC2 instances 

Show Answer

Question # 2

A company has a web application that uses Amazon API Gateway to route HTTPS requests to AWS Lambda functions. The application uses an Amazon Aurora MySQL database for its data storage. The application has experienced unpredictable surges in traffic that overwhelm the database with too many connection requests. The company wants to implement a scalable solution that is more resilient to database failures. Which solution will meet these requirements MOST cost-effectively? 

A. Create an Amazon RDS proxy for the database. Replace the database endpoint with the proxy endpoint in the Lambda functions. 
B. Migrate the database to Amazon DynamoDB tables by using AWS Database Migration Service (AWS DMS). 
C. Review the existing connections. Call MySQL queries to end any connections in the sleep state. 
D. Increase the instance class of the database with more memory. Set a larger value for the max_connections parameter. 

Show Answer

Question # 3

A company stores data for multiple business units in a single Amazon S3 bucket that is in the company's payer AWS account. To maintain data isolation, the business units store data in separate prefixes in the S3 bucket by using an S3 bucket policy. The company plans to add a large number of dynamic prefixes. The company does not want to rely on a single S3 bucket policy to manage data access at scale. The company wants to develop a secure access management solution in addition to the bucket policy to enforce prefix-level data isolation. 

A. Configure the S3 bucket policy to deny s3:GetObject permissions for all users. Configure the bucket policy to allow s3:* access to individual business units. 
B. Enable default encryption on the S3 bucket by using server-side encryption with Amazon S3 managed keys (SSE-S3). 
C. Configure resource-based permissions on the S3 bucket by creating an S3 access point for each business unit. 
D. Use pre-signed URLs to provide access to the S3 bucket. 

Show Answer

Question # 4

A solutions architect is designing an application that helps users fill out and submit registration forms. The solutions architect plans to use a two-tier architecture that includes a web application server tier and a worker tier. The application needs to process submitted forms quickly. The application needs to process each form exactly once. The solution must ensure that no data is lost. Which solution will meet these requirements? 

A. Use an Amazon Simple Queue Service {Amazon SQS) FIFO queue between the web application server tier and the worker tier to store and forward form data. 
B. Use an Amazon API Gateway HTTP API between the web application server tier and the worker tier to store and forward form data. 
C. Use an Amazon Simple Queue Service (Amazon SQS) standard queue between the web application server tier and the worker tier to store and forward form data. 
D. Use an AWS Step Functions workflow. Create a synchronous workflow between the web application server tier and the worker tier that stores and forwards form data. 

Show Answer

Question # 5

A company runs a multi-tier application on premises by using virtual machines (VMs). The application tiers communicate asynchronously through third-party middleware that guarantees exactly-once delivery. The company is planning to migrate the application to AWS and needs to replace the middleware solution. The solution must provide exactlyonce delivery for messages from the application. Which combination of actions will meet these requirements with the LEAST infrastructure management? (Select TWO.) 

A. Use AWS Lambda functions to provide compute layers in the architecture. 
B. Use Amazon EC2 instances to provide compute layers in the architecture. 
C. Use Amazon SNS as a messaging component between the compute layers. 
D. Use Amazon SQS FIFO queues as a messaging component between the compute layers. 
E. Run containers on Amazon EKS to provide compute layers in the architecture. 

Show Answer

Question # 6

A company uses AWS Lambda functions in a private subnet in a VPC to run application logic. The Lambda functions must not have access to the public internet. Additionally, all data communication must remain within the private network. As part of a new requirement, the application logic needs access to an Amazon DynamoDB table. What is the MOST secure way to meet this new requirement? 

A. Provision the DynamoDB table inside the same VPC that contains the Lambda functions. 
B. Create a gateway VPC endpoint for DynamoDB to provide access to the table. 
C. Use a network ACL to only allow access to the DynamoDB table from the VPC. 
D. Use a security group to only allow access to the DynamoDB table from the VPC. 

Show Answer

Question # 7

A company is developing an application using Amazon Aurora MySQL. The team will frequently make schema changes to test new features without affecting production. After testing, changes must be promoted to production with minimal downtime. Which solution meets these requirements? 

A. Create a staging Aurora cluster based on the existing cluster. Test schema changes on the staging cluster. 
B. Create a read replica, modify its schema, and then promote it to primary. 
C. Create an Aurora MySQL blue/green deployment. Make schema changes in the staging environment and switch traffic after testing. 
D. Replicate the Aurora database to DynamoDB, apply schema changes, and switch the application to DynamoDB. 

Show Answer

Question # 8

A company is designing an application to run in a VPC on AWS. The application consists of Amazon EC2 instances that run in private subnets as part of an Auto Scaling group. The application stores data in an Amazon RDS DB instance. The company attaches a security group named web-servers to the EC2 instances. The company attaches a security group named database to the DB instance. The company needs a solution to establish communication between the EC2 instances and the DB instance. Which solution will meet this requirement? 

A. Configure the inbound rule for the database security group to allow access from the current set of IP addresses that the EC2 instances use. 
B. Configure the inbound rule of the database security group to allow access from the webservers security group. Configure an outbound rule for the web-servers security group to allow access to the database security group. 
C. Configure the inbound rule of the database security group to allow access by specifying the Auto Scaling group ID. 
D. Configure the outbound rule of the database security group to allow access to the webservers security group. Configure an inbound rule for the web-servers security group to allow access from the database security group. 

Show Answer

Question # 9

A financial services company has a two-tier consumer banking application. The frontend serves static web content. The backend consists of APIs. The company needs to migrate the frontendcomponent to AWS. The backend of the application will remain on-premises. The company must protect the application from common web vulnerabilities and attacks.

A. Migrate the frontend to Amazon EC2 instances. Deploy an Application Load Balancer (ALB) in front of the instances. Use the instances to invoke the on-premises APIs. Associate AWS WAF rules with the instances. 
B. Deploy the frontend as an Amazon CloudFront distribution that has multiple origins. Configure one origin to be an Amazon S3 bucket that serves the static web content. Configure a second origin to route traffic to the on-premises APIs based on the URL pattern. Associate AWS WAF rules with the distribution. 
C. Migrate the frontend to Amazon EC2 instances. Deploy a Network Load Balancer (NLB) in front of the instances. Use the instances to invoke the on-premises APIs. Create an AWS Network Firewall instance. Route all traffic through the Network Firewall instance. 
D. Deploy the frontend as a static website based on an Amazon S3 bucket. Use an Amazon API Gateway REST API and a set of Amazon EC2 instances to invoke the onpremises APIs. AssociateAWS WAF rules with the REST API and the S3 bucket. 

Show Answer

Question # 10

A company uses a general-purpose instance class Amazon RDS for MySQL DB instance in a Multi-AZ configuration. The finance team runs SQL queries to generate reports. Customers experience performance issues during report generation. A solutions architect needs to minimize the effect of the reporting job on the DB instance. Which solution will meet these requirements? 

A. Create a proxy in Amazon RDS Proxy. Update the reporting job to query the proxy endpoint. 
B. Update the RDS DB instance configuration to use three Availability Zones. 
C. Add an RDS read replica. Update the reporting job to query the replica endpoint. 
D. Change the RDS configuration to a memory-optimized instance class. 

Show Answer

Question # 11

A company uses Amazon API Gateway to manage its REST APIs that third-party service providers access The company must protect the REST APIs from SQL injection and crosssite scripting attacks. What is the MOST operationally efficient solution that meets these requirements? 

A. Configure AWS Shield. 
B. Configure AWS WAR 
C. Set up API Gateway with an Amazon CloudFront distribution Configure AWS Shield in CloudFront. 
D. Set up API Gateway with an Amazon CloudFront distribution. Configure AWS WAF in CloudFront 

Show Answer

Question # 12

A company hosts an application that processes highly sensitive customer transactions on AWS. The application uses Amazon RDS as its database. The company manages its own encryption keys to secure the data in Amazon RDS. The company needs to update the customer-managed encryption keys at least once each year. Which solution will meet these requirements with the LEAST operational overhead? 

A. Set up automatic key rotation in AWS Key Management Service (AWS KMS) for the encryption keys. 
B. Configure AWS Key Management Service (AWS KMS) to alert the company to rotate the encryption keys annually. 
C. Schedule an AWS Lambda function to rotate the encryption keys annually. 
D. Create an AWS CloudFormation stack to run an AWS Lambda function that deploys new encryption keys once each year. 

Show Answer

Question # 13

A company's application is deployed on Amazon EC2 instances and uses AWS Lambda functions for an event-driven architecture. The company uses nonproduction development environments in a different AWS account to test new features before the company deploys the features to production. The production instances show constant usage because of customers in different time zones. The company uses nonproduction instances only during business hours on weekdays. The company does not use the nonproduction instances on the weekends. The company wants to optimize the costs to run its application on AWS. Which solution will meet these requirements MOST cost-effectively? 

A. Use On-Demand Instances (or the production instances. Use Dedicated Hosts for the nonproduction instances on weekends only. 
B. Use Reserved instances for the production instances and the nonproduction instances Shut down the nonproduction instances when not in use. 
C. Use Compute Savings Plans for the production instances. Use On-Demand Instances for the nonproduction instances Shut down the nonproduction instances when not in use. 
D. Use Dedicated Hosts for the production instances. Use EC2 Instance Savings Plans for the nonproduction instances. 

Show Answer

Question # 14

A company needs to provide a team of contractors with temporary access to the company's AWS resources for a short-term project. The contractors need different levels of access to AWS services. The company needs to revoke permissions for all the contractors when the project is finished. Which solution will meet these requirements with the LEAST operational overhead? 

A. Use AWS IAM to create a user account for each contractor. Attach policies that define access levels for the contractors to the user accounts. Manually deactivate the accounts when the project is finished. 
B. Use AWS Security Token Service (AWS STS) to generate temporary credentials for the contractors. Provide the contractors access based on predefined roles. Set the access to automatically expire when the project is finished. 
C. Configure AWS Config rules to monitor the contractors' access patterns. Use AWS Config rules to automatically revoke permissions that are not in use or that are too permissive. 
D. Use AWS CloudTrail and custom Amazon EventBridge triggers to audit the contractors' actions. Adjust the permissions for each contractor based on activity logs. 

Show Answer

Question # 15

A company runs an application on an Amazon ECS cluster that uses AWS Fargate OnDemand capacity. The application cannot tolerate any sudden interruptions. The company wants to optimize costs for the application and ensure that the application remains operational. Which solution will meet these requirements? 

A. Create an On-Demand Capacity Reservation. 
B. Purchase Convertible Reserved Instances. 
C. Use Fargate Spot capacity instead of On-Demand capacity with a rolling update deployment type. 
D. Purchase a Compute Savings Plan. 

Show Answer

Question # 16

A company wants to migrate its on-premises Oracle database to Amazon Aurora. The company wants to use a secure and encrypted network to transfer the data. Which combination of steps will meet these requirements? (Select TWO.) 

A. Use AWS Application Migration Service to migrate the data. 
B. Use AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS) to migrate the data. 
C. Use AWS Direct Connect SiteLink to transfer data from the on-premises environment to AWS. 
D. Use AWS Site-to-Site VPN to establish a connection to transfer the data from the onpremises environment to AWS.
 E. Use AWS App2Container to migrate the data. 

Show Answer

Question # 17

An analytics application runs on multiple Amazon EC2 Linux instances that use Amazon Elastic File System (Amazon EFS) Standard storage. The files vary in size and access frequency. The company accesses the files infrequently after 30 days. However, users sometimes request older files to generate reports. The company wants to reduce storage costs for files that are accessed infrequently. The company also wants throughput to adjust based on the size of the file system. The company wants to use the TransitionToIA Amazon EFS lifecycle policy to transition files to Infrequent Access (IA) storage after 30 days. Which solution will meet these requirements? 

A. Configure files to transition back to Standard storage when a user accesses the files again. Specify the provisioned throughput mode. 
B. Specify the provisioned throughput mode only. 
C. Configure files to transition back to Standard storage when a user accesses the files again. Specify the bursting throughput mode. 
D. Specify the bursting throughput mode only. 

Show Answer

Question # 18

A company hosts an Amazon EC2 instance in a private subnet in a new VPC. The VPC also has a public subnet that has the default route set to an internet gateway. The private subnet does not have outbound internet access. The EC2 instance needs to have the ability to download monthly security updates from an outside vendor. However, the company must block any connections that are initiated from the internet. Which solution will meet these requirements? 

A. Configure the private subnet route table to use the internet gateway as the default route. 
B. Create a NAT gateway in the public subnet. Configure the private subnet route table to use the NAT gateway as the default route. 
C. Create a NAT instance in the private subnet. Configure the private subnet route table to use the NAT instance as the default route. 
D. Create a NAT instance in the private subnet. Configure the private subnet route table to use the internet gateway as the default route.  

Show Answer

Question # 19

A gaming company hosts a browser-based application on AWS. The users of the application consume a large number of videos and images that are stored in Amazon S3. This content is the same for all users. The application has increased in popularity, and millions of users worldwide are accessing these media files. The company wants to provide the files to the users while reducing the load on the origin. Which solution meets these requirements MOST cost-effectively? 

A. Deploy an AWS Global Accelerator accelerator in front of the web servers. 
B. Deploy an Amazon CloudFront web distribution in front of the S3 bucket. 
C. Deploy an Amazon ElastiCache (Redis OSS) instance in front of the web servers. 
D. Deploy an Amazon ElastiCache (Memcached) instance in front of the web servers. 

Show Answer

Question # 20

A company is developing a rating system for its ecommerce web application. The company needs a solution to save ratings that users submit in an Amazon DynamoDB table. The company wants to ensure that developers do not need to interact directly with the DynamoDB table. The solution must be scalable and reusable. Which solution will meet these requirements with the LEAST operational overhead? 

A. Create an Application Load Balancer ALB. Create an AWS Lambda function, and set the function as a target group in the ALB. Invoke the Lambda function by using the PutItem method through the ALB. 
B. Create an AWS Lambda function. Configure the Lambda function to interact with the DynamoDB table by using the PutItem method from Boto3. Invoke the Lambda function from the web application. 
C. Create an Amazon SQS queue and an AWS Lambda function that has an SQS trigger type. Instruct the developers to add customer ratings to the SQS queue as JSON messages. Configure the Lambda function to fetch the ratings from the queue and store the ratings in DynamoDB. 
D. Create an Amazon API Gateway REST API. Define a resource and create a new POST method. Choose AWS as the integration type, and select DynamoDB as the service. Set the action to PutItem. 

Show Answer

Question # 21

A company has 15 employees. The company stores employee start dates in an Amazon DynamoDB table. The company wants to send an email message to each employee on the day of the employee's work anniversary. Which solution will meet these requirements with the MOST operational efficiency? 

A. Create a script that scans the DynamoDB table and uses Amazon Simple Notification Service (Amazon SNS) to send email messages to employees when necessary. Use a cron job to run this script every day on an Amazon EC2 instance. 
B. Create a script that scans the DynamoDB table and uses Amazon Simple Queue Service {Amazon SQS) to send email messages to employees when necessary. Use a cron job to run this script every day on an Amazon EC2 instance. 
C. Create an AWS Lambda function that scans the DynamoDB table and uses Amazon Simple Notification Service (Amazon SNS) to send email messages to employees when necessary. Schedule this Lambda function to run every day. 
D. Create an AWS Lambda function that scans the DynamoDB table and uses Amazon Simple Queue Service (Amazon SQS) to send email messages to employees when necessary Schedule this Lambda function to run every day. 

Show Answer

Question # 22

A company is planning to deploy its application on an Amazon Aurora PostgreSQL Serverless v2 cluster. The application will receive large amounts of traffic. The company wants to optimize the storage performance of the cluster as the load on the application increases Which solution will meet these requirements MOST cost-effectively? 

A. Configure the cluster to use the Aurora Standard storage configuration. 
B. Configure the cluster storage type as Provisioned IOPS. 
C. Configure the cluster storage type as General Purpose. 
D. Configure the cluster to use the Aurora l/O-Optimized storage configuration. 

Show Answer

Question # 23

A company recently launched a new product that is highly available in one AWS Region The product consists of an application that runs on Amazon Elastic Container Service (Amazon ECS), apublic Application Load Balancer (ALB), and an Amazon DynamoDB table. The company wants a solution that will make the application highly available across Regions. Which combination of steps will meet these requirements? (Select THREE.) 

A. In a different Region, deploy the application to a new ECS cluster that is accessible through a new ALB. 
B. Create an Amazon Route 53 failover record. 
C. Modify the DynamoDB table to create a DynamoDB global table. 
D. In the same Region, deploy the application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that is accessible through a new ALB. 
E. Modify the DynamoDB table to create global secondary indexes (GSIs). 
F. Create an AWS PrivateLink endpoint for the application. 

Show Answer

Question # 24

A developer is creating a serverless application that performs video encoding. The encoding process runs as background jobs and takes several minutes to encode each video. The process must not send an immediate result to users. The developer is using Amazon API Gateway to manage an API for the application. The developer needs to run test invocations and request validations. The developer must distribute API keys to control access to the API. Which solution will meet these requirements? 

A. Create an HTTP API. Create an AWS Lambda function to handle the encoding jobs. Integrate the function with the HTTP API. Use the Event invocation type to call the Lambda function. 
B. Create a REST API with the default endpoint type. Create an AWS Lambda function to handle the encoding jobs. Integrate the function with the REST API. Use the Event invocation type to call the Lambda function. 
C. Create an HTTP API. Create an AWS Lambda function to handle the encoding jobs. Integrate the function with the HTTP API. Use the RequestResponse invocation type to call the Lambda function. 
D. Create a REST API with the default endpoint type. Create an AWS Lambda function to handle the encoding jobs. Integrate the function with the REST API. Use the RequestResponse invocation type to call the Lambda function. 

Show Answer

Question # 25

A company is running a critical workload on an Amazon RDS DB instance. The company needs the DB instance to be highly available. The company requires a recovery time of less than 5 minutes. Which solution will meet these requirements? 

A. Create a read replica of the DB instance. 
B. Use AWS CloudFormation to create a template of the DB instance. 
C. Take periodic snapshots of the DB instance. Store the snapshots in Amazon S3. 
D. Modify the DB instance to use a Multi-AZ deployment. 

Show Answer