Free AWS Solutions Architect Associate (SAA-C03) practice test

The AWS Certified Solutions Architect - Associate (SAA-C03) validates that you can design secure, resilient, high-performing, and cost-optimized architectures on AWS. This site gives you 304 original scenario questions in the exam's real formats, free and without an account.

The real exam is multiple choice and multiple response only, and so is our simulator: 65 questions in 130 timed minutes, scored on the real 100 to 1,000 scale with the 720 pass line. Every topic links into Andrew Brown's free freeCodeCamp course at the matching chapter.

What SAA-C03 covers

SAA-C03 domainExam weightQuestions here
Design Secure Architectures30%about 91
Design Resilient Architectures26%about 79
Design High-Performing Architectures24%about 73
Design Cost-Optimized Architectures20%about 61

Real exam facts: 65 questions (50 scored, 15 unscored), 130 minutes, scaled 100 to 1,000, passing score 720.

Practice questions from this bank

Sample question 1 · SAA-C03 · Design Secure Architectures

A company has 30 new developers who all need the same permissions to launch EC2 instances and read from an S3 bucket. What is the MOST efficient way to manage their permissions?

  1. AAdd each developer as a separate statement in the target S3 bucket policy
  2. BCreate an IAM group with the needed policies and add the developers to it
  3. CAttach an identical inline policy to each of the 30 individual IAM users
  4. DCreate one IAM role and share a set of long-term access keys with everyone
Show answer and explanation

B. Create an IAM group with the needed policies and add the developers to it

An IAM group lets you attach policies once and manage many users together; changing the group updates all members. Inline policies per user and shared long-term keys are error-prone and violate best practice.

Topic: freeCodeCamp SAA-C03: IAM users, groups & policies

Sample question 2 · SAA-C03 · Design Resilient Architectures

A web application submits image-processing jobs to a fleet of backend workers. During traffic spikes the workers fall behind and requests are dropped. Which service decouples the tiers so jobs are buffered until workers can process them?

  1. AAmazon MQ
  2. BAmazon Kinesis Data Firehose
  3. CAmazon SQS
  4. DAWS Batch
Show answer and explanation

C. Amazon SQS

SQS is a fully managed queue that buffers jobs so producers and consumers scale independently; Firehose delivers streaming data to stores rather than acting as a work queue.

Topic: freeCodeCamp SAA-C03: SQS decoupling

Sample question 3 · SAA-C03 · Design High-Performing Architectures

An application performs frequent reads of the same S3 objects and wants to serve those hot objects with lower latency by adding a caching layer in front of the bucket. Which service does this?

  1. AAmazon S3 Select
  2. BAmazon CloudFront
  3. CS3 Batch Operations
  4. DAmazon S3 Storage Lens
Show answer and explanation

B. Amazon CloudFront

CloudFront caches S3 objects at edge locations, cutting latency for repeated reads and offloading the origin. S3 Select filters object contents and Storage Lens is analytics, neither caches.

Topic: freeCodeCamp SAA-C03: S3 performance

Sample question 4 · SAA-C03 · Design Cost-Optimized Architectures

A company stores financial records that auditors read only a few times a year but must retrieve within milliseconds when a review is requested. Storage cost is the priority. Which S3 storage class meets the requirement MOST cost-effectively?

  1. AS3 Glacier Flexible Retrieval
  2. BS3 Glacier Deep Archive
  3. CS3 Standard
  4. DS3 Standard-Infrequent Access
Show answer and explanation

D. S3 Standard-Infrequent Access

Standard-IA gives millisecond retrieval at a lower per-GB price than Standard for data read only occasionally. The Glacier classes add retrieval latency that is unsuitable for immediate audit access.

Topic: freeCodeCamp SAA-C03: S3 storage classes

Sample question 5 · SAA-C03 · Design Secure Architectures

An architect is reviewing how an IAM role's trust policy behaves. Which statement about an IAM role trust policy is correct?

  1. AIt sets the maximum session duration for every AWS service call
  2. BIt lists the specific resources the role is permitted to access
  3. CIt encrypts the temporary credentials that STS returns to callers
  4. DIt defines which principals are allowed to call sts:AssumeRole for the role
Show answer and explanation

D. It defines which principals are allowed to call sts:AssumeRole for the role

A trust policy is a resource-based policy on the role specifying who may assume it. The role's permissions come from its identity policies, not the trust policy.

Topic: freeCodeCamp SAA-C03: IAM roles & STS

Sample question 6 · SAA-C03 · Design Resilient Architectures

A security team needs to automatically invoke a Lambda function whenever an EC2 instance transitions to the stopped state, without any polling. Which service routes this AWS event?

  1. AAWS Config rules
  2. BAmazon EventBridge
  3. CAmazon SNS
  4. DAmazon SQS
Show answer and explanation

B. Amazon EventBridge

EventBridge receives AWS service events such as EC2 state changes and routes them to targets like Lambda; SQS has no native source of AWS state-change events.

Topic: freeCodeCamp SAA-C03: EventBridge

Sample question 7 · SAA-C03 · Design High-Performing Architectures

A fleet of Linux EC2 instances across multiple Availability Zones must share one POSIX file system that scales automatically. Which service meets this with the LEAST operational overhead?

  1. AAmazon S3
  2. BAmazon EFS
  3. CAmazon EBS
  4. DAmazon FSx for Windows File Server
Show answer and explanation

B. Amazon EFS

EFS is a managed elastic NFS file system mountable by thousands of instances across AZs at once, with no capacity to manage. EBS attaches within a single AZ and lacks native multi-AZ sharing.

Topic: freeCodeCamp SAA-C03: EFS

Sample question 8 · SAA-C03 · Design Cost-Optimized Architectures

A team wants objects moved automatically from S3 Standard to a cheaper class after 30 days and deleted after one year, with no changes to the application. Which capability achieves this?

  1. AS3 Cross-Region Replication
  2. BS3 Intelligent-Tiering
  3. CS3 Object Lock
  4. DAn S3 Lifecycle configuration
Show answer and explanation

D. An S3 Lifecycle configuration

A Lifecycle configuration defines transition and expiration actions based on object age. Intelligent-Tiering moves data by access pattern but does not delete, and Object Lock and Replication serve other purposes.

Topic: freeCodeCamp SAA-C03: S3 lifecycle & Intelligent-Tiering

Common questions

How many questions are on the SAA-C03 exam?

65 questions in 130 minutes: 50 scored plus 15 unscored. The exam uses multiple-choice and multiple-response questions only, and passing requires a scaled score of 720 on a 100 to 1,000 range.

How hard is SAA-C03 compared to Cloud Practitioner?

Substantially harder. Where Cloud Practitioner tests cloud literacy, SAA-C03 tests designing real architectures: choosing between services for security, resilience, performance, and cost under scenario constraints.

What does SAA-C03 cover?

Four domains: Design Secure Architectures (30%), Design Resilient Architectures (26%), Design High-Performing Architectures (24%), and Design Cost-Optimized Architectures (20%). Our drills track your accuracy in each separately.

Is this actually free?

Yes. Every question and the exam simulator are free with no account. Every topic links into Andrew Brown's free SAA-C03 course on freeCodeCamp's YouTube channel.

More free practice tests

Back to all cert900 exams