Prepstellar
Get the app

SAA-C03 · Mock exam · 25 questions

SAA-C03 mock exam: 25 free practice questions

Untimed here · timed and scored in the app

A free SAA-C03 practice test with 25 exam-style questions drawn from the whole course and weighted by domain like the exam guide. Answer at your pace and read why each option is right or wrong.

  • 65Questions
  • 720 (scaled 100–1,000)Passing score
  • Design Secure Architectures 30%
  • Design Resilient Architectures 26%
  • Design High-Performing Architectures 24%
  • Design Cost-Optimized Architectures 20%

Exam details from the vendor’s exam guide, captured 2026-08-30.

Swipe, scroll or use ← →

  1. Q1 / 25

    A company copies backups into a repository account and must restrict who can restore or delete them. Which control should it implement?

    1. AA lifecycle transition on backups in the repository account
    2. BA customizable Audit Manager control without a vault policy
    3. CA tag-based backup-plan assignment on each source workload
    4. DA resource-based access policy on the destination backup vault
    Show the answer

    The decision is authorization on backups in the destination vault, so the vault resource policy defines the principals and permitted actions. Classification, lifecycle, and assessment are separate controls.

    Next → 1 / 25

  2. Q2 / 25

    What capacity does Elastic Load Balancing adjust automatically as incoming traffic changes?

    1. AThe file capacity of an EFS system
    2. BThe capacity of the load balancer itself
    3. CThe expiration period of every cached CloudFront object
    4. DThe message count in each SQS queue
    Show the answer

    Elastic Load Balancing scales its own capacity automatically; target fleet size is handled separately by services such as EC2 Auto Scaling.

    Next → 2 / 25

  3. Q3 / 25

    A trading application needs predictable latency and throughput between an on-premises data centre and AWS. Which connectivity option is recommended?

    1. AA customer-managed VPN appliance running on EC2 instances
    2. BSite-to-Site VPN with Large Bandwidth Tunnels
    3. CAWS Direct Connect
    4. DAccelerated Site-to-Site VPN over the internet
    Show the answer

    Predictability is the deciding word: only the dedicated connection is described as providing deterministic performance, because it does not depend on an internet path. Faster internet options improve the path without making it predictable.

    Next → 3 / 25

  4. Q4 / 25

    Which Amazon Quick feature provides interactive data visualization, dashboards, and embedded analytics?

    1. AAmazon Quick Flows provides those visual analytics capabilities.
    2. BAmazon Quick Sight provides those business-intelligence capabilities.
    3. CAmazon Quick Index provides those visual analytics capabilities.
    4. DAmazon Quick Research provides those visual analytics capabilities.
    Show the answer

    Quick Sight is the visualization and business-intelligence feature within Amazon Quick; the other named features automate workflows, connect information, or conduct research.

    Next → 4 / 25

  5. Q5 / 25

    After initiating recovery for a supported resource, an operator must verify whether the operation is progressing. Which action is appropriate?

    1. ACheck whether a cross-account copy replaced the restore job
    2. BCheck whether the backup changed from warm storage to cold storage
    3. CCheck whether resource tags created a second source resource
    4. DCheck the recent restore job in the AWS Backup dashboard
    Show the answer

    Recovery execution is represented by a restore job, and the dashboard exposes its status. Lifecycle, tags, and account copies answer different operational questions.

    Next → 5 / 25

  6. Q6 / 25

    What is an instance of a running Step Functions workflow called?

    1. AA CloudFront distribution
    2. BA Fargate platform revision
    3. CA workflow execution
    4. DA queue visibility timeout
    Show the answer

    A workflow defines the state machine, while an execution is one running instance of it.

    Next → 6 / 25

  7. Q7 / 25

    Which connection option is explicitly described as giving a VPC access to an on-premises network?

    1. AA CloudFront distribution and origin
    2. BA PrivateLink endpoint attached to an endpoint service in another VPC
    3. CA Global Accelerator attached to regional load balancers
    4. DAn AWS VPN connection attached to the VPC
    Show the answer

    VPN is the documented VPC connection pattern for access to the on-premises boundary.

    Next → 7 / 25

  8. Q8 / 25

    Which connection choice best fits temporary hybrid connectivity when the existing internet link has sufficient capacity?

    1. AAWS Site-to-Site VPN over the existing internet connection
    2. BA full mesh of VPC peering links extending to the on-premises network
    3. CA permanent Direct Connect circuit selected without a breakeven analysis
    4. DA Route 53 record used as the encrypted connection to the data center
    Show the answer

    For temporary connectivity, internet elasticity can make Site-to-Site VPN cheaper when the on-premises internet connection meets the requirement.

    Next → 8 / 25

  9. Q9 / 25

    Which AWS Backup design can centralize account-separated recovery copies?

    1. AMove production resources from all Regions into one backup vault
    2. BReplace organization accounts with tags on one source resource
    3. CCopy backups from organization accounts into one repository account
    4. DConvert restore jobs from all accounts into lifecycle policies
    Show the answer

    Cross-account backup can fan copies into a repository account. A vault stores backups, lifecycle manages tiers, and tags select resources; none replaces the account-copy operation.

    Next → 9 / 25

  10. Q10 / 25

    Which Step Functions state selects a workflow branch according to input data?

    1. AA Choice state
    2. BA Map state
    3. CA Task state
    4. DA Parallel state
    Show the answer

    Choice evaluates input to determine the next path; Task performs work, Parallel creates branches, and Map iterates items.

    Next → 10 / 25

  11. Halfway, at your pace

    In the app the mock exam is timed and scored like the real thing.

    Get the app

  12. Q11 / 25

    Records arrive continuously, must be cleaned and transformed in transit, and must become available in a target data store within seconds without managing processing servers. Which ingestion configuration best fits?

    1. AConfigure a scheduled AWS Glue job that waits for the next periodic run.
    2. BConfigure an on-demand AWS Glue job that requires a manual invocation.
    3. CConfigure a Kinesis producer that batches records on the application server before intake.
    4. DConfigure an AWS Glue streaming job for continuous consumption and transformation.
    Show the answer

    A Glue streaming job continuously consumes, cleans, and transforms data in transit and can make it available in the target store within seconds.

    Next → 11 / 25

  13. Q12 / 25

    Why does Amazon Redshift columnar storage reduce resource use for queries that scan a few columns across many rows?

    1. AIt stores each complete record across sequential row-wise disk blocks
    2. BIt reads blocks for the required columns instead of loading unneeded columns
    3. CIt reads every value in each row before selecting the required columns
    4. DIt converts analytic scans into single-record OLTP write operations
    Show the answer

    Columnar blocks group values from one column, so selected-column analytics reduce disk input and output and memory compared with loading full rows.

    Next → 12 / 25

  14. Q13 / 25

    Instances in a private subnet sit behind a NAT gateway. Which capability is unavailable in that arrangement?

    1. ALetting those instances open outbound connections through the gateway
    2. BApplying inbound and outbound rules to those instances
    3. CUsing a network ACL on the subnet where the gateway resides
    4. DPublishing an inbound port on those instances through the gateway
    Show the answer

    Port forwarding is the missing feature, which is why a NAT gateway is an egress device and never an entry point. The other three are all documented ways of working with the same design.

    Next → 13 / 25

  15. Q14 / 25

    Which Step Functions state represents a unit of work performed by another AWS service or API?

    1. AA Map state
    2. BA Choice state
    3. CA Task state
    4. DA Parallel state
    Show the answer

    A Task state performs the work; the other states select paths or coordinate repeated and parallel branches.

    Next → 14 / 25

  16. Q15 / 25

    Which relationship forms the documented PrivateLink provider and consumer tiers?

    1. AA provider load balancer receives requests from consumer VPC endpoints
    2. BA consumer Direct Connect port creates interfaces in provider subnets
    3. CA provider IPAM pool forwards requests to consumer route tables
    4. DA consumer load balancer writes cached objects to provider edge locations
    Show the answer

    The provider exposes an endpoint service through a load balancer, while consumers create VPC endpoints in their selected subnets.

    Next → 15 / 25

  17. Q16 / 25

    An ecommerce platform needs predictable low latency for browsing sessions at very high scale, while inventory and orders require joins and transactions. The team may use more than one database. Which design best matches both constraints?

    1. AUse Aurora for browsing sessions and Timestream for inventory and orders
    2. BUse DynamoDB for browsing sessions and Aurora for inventory and orders
    3. CUse Redshift for browsing sessions and DynamoDB for relational order joins
    4. DUse Timestream for browsing sessions and Redshift for transactional orders
    Show the answer

    A best-fit design assigns the key-value, high-scale access pattern to DynamoDB and the relational transaction pattern to Aurora.

    Next → 16 / 25

  18. Q17 / 25

    Which statement describes a Control Tower landing zone?

    1. AA governed multi-account environment based on security and compliance practices
    2. BA directory instance limited to isolated applications in one AWS account
    3. CA single identity policy that grants every administrator access to all organization accounts
    4. DA temporary role session used to access one destination account
    Show the answer

    The landing zone is Control Tower's multi-account foundation and contains the accounts and organizational structure subject to governance.

    Next → 17 / 25

  19. Q18 / 25

    What primarily determines the achievable recovery point for periodic backups?

    1. AHow many route tables the VPC contains
    2. BHow frequently the backups run
    3. CHow large the application instance is
    4. DHow many load balancer listeners exist
    Show the answer

    The interval between recoverable copies bounds how much recent data can be lost.

    Next → 18 / 25

  20. Q19 / 25

    Which supported method transforms CSV source data into Parquet for later Athena queries?

    1. AKeep Athena output in CSV and apply an INSERT INTO operation.
    2. BMap a Quick Sight dimension or measure to a visual field well.
    3. CApply a Lake Formation row filter or a cell-level permission grant.
    4. DRun an Athena CTAS query or an AWS Glue transformation job.
    Show the answer

    CTAS and Glue jobs perform the format conversion; Parquet then supports column compression, predicate pushdown, and parallel reads.

    Next → 19 / 25

  21. Q20 / 25

    A repository server uses compute, memory, and networking in similar proportions. Which family category is the initial fit?

    1. AGeneral purpose for a balanced resource profile
    2. BStorage optimized for a balanced resource profile
    3. CCompute optimized for a memory-dominant profile
    4. DMemory optimized for a processor-dominant profile
    Show the answer

    A balanced demand profile maps to general purpose; specialized families are selected when processor, memory, or local storage input/output dominates.

    Next → 20 / 25

  22. Q21 / 25

    An auditor needs recurring evidence that backup activities and resources comply with defined controls. Which design meets the requirement?

    1. AMove every backup to cold storage through one lifecycle rule
    2. BAssign every workload to one plan through a shared tag
    3. CAlign Backup Audit Manager controls and use its daily reports
    4. DAllow the auditor to modify retention through a vault policy
    Show the answer

    The requirement is assessment plus evidence over time, which maps to Audit Manager controls and daily reporting. Storage tier, plan assignment, and vault authorization do not supply that evidence.

    Next → 21 / 25

  23. Q22 / 25

    Which relationship correctly separates managed transfer from persistent storage?

    1. AS3 handles SFTP; Transfer Family stores blocks
    2. BTransfer Family handles protocols; S3 or EFS stores data
    3. CTransfer Family supplies NFS; EFS routes FTP
    4. DEFS publishes messages; SQS stores files
    Show the answer

    The transfer endpoint and storage destination have distinct responsibilities in the documented design.

    Next → 22 / 25

  24. Q23 / 25

    A company must rapidly move an active on-premises NFS dataset into Amazon S3 and validate integrity during transfer. Which solution fits?

    1. AS3 Intelligent-Tiering using automatic access-tier movement
    2. BAWS DataSync using its accelerated transfer architecture
    3. CEBS st1 using its throughput-optimized block volume
    4. DS3 Glacier Flexible Retrieval using archive restoration
    Show the answer

    DataSync supports on-premises NFS, transfers active datasets rapidly into AWS storage, and includes data-integrity validation.

    Next → 23 / 25

  25. Q24 / 25

    Why can a NAT gateway in each Availability Zone be preferable to one shared gateway?

    1. AIt removes gateway-hour charges while retaining per-gigabyte processing fees
    2. BIt provides zone-independent egress and avoids cross-zone transfer on local routes
    3. CIt converts internet-bound traffic into free VPC peering traffic automatically
    4. DIt permits one zonal gateway to remain the shared dependency for every subnet
    Show the answer

    Per-zone placement keeps each subnet's NAT path local and avoids making another Availability Zone part of that egress path, trading extra gateway-hours for independence.

    Next → 24 / 25

  26. Q25 / 25

    Secrets must be encrypted under a key the security team creates and controls, and rotation has to run automatically without managed rotation. Which charges follow from that pair of decisions?

    1. AA Key Management Service charge for the key and a Lambda charge for the rotation function
    2. BNeither charge, because the key and the rotation are both included
    3. COnly the key charge, because rotation is included in the secret price
    4. DOnly the function charge, because keys you create are not billed
    Show the answer

    Each decision adds its own line. Choosing your own key gives up the free managed key, and rotation outside the managed form executes a function that is billed like any other. The free key would only apply if the team accepted the AWS managed one.

    Next → 25 / 25

  27. That’s the whole mock exam

    Every question you miss comes back exactly when you’re about to forget it.

    Back to the course Get the app

How to use this mock exam

Sit all 25 questions in one go: the mix covers every domain in the same proportion as the exam, so a low score points at the domain you skipped rather than at bad luck.

Read the explanation under every question, including the ones you got right — the reason an option is wrong is usually the thing being tested.

Then retake it in the app, where the mock exam is timed and scored and the questions you miss come back on a schedule.

Keep your progress · Get the app

The whole course, on your phone

Lessons you can read, audio you can listen to on the way to work, and practice that remembers what you got wrong.

Get the app