Full exam simulation
65 questions · 130 minutes, 15 unscored and not identified. One question per screen, flag and strike-out, a review screen and a score report per domain — no answers until you finish.
Amazon Web ServicesSAA-C03AssociateCloudAvailable
AWS Certified Solutions Architect – Associate
Design secure, resilient, high-performing and cost-optimized architectures on AWS.
Independent practice — not affiliated with or endorsed by Amazon Web Services. SAA-C03 is used only to identify the exam. Trademark notices
Domain weights
Share of scored content per domain. Every sitting draws questions by these weights.
- D1Design Secure Architectures30 %25 concepts
- D2Design Resilient Architectures26 %22 concepts
- D3Design High-Performing Architectures24 %23 concepts
- D4Design Cost-Optimized Architectures20 %17 concepts
Your progress
No attempts yet. Take a full sitting to get a readiness rating; results are kept in this browser. Join your class to keep them on every device.
Choose a mode
ESL +30
The full sitting with 30 extra minutes (160 min) — the accommodation non-native English speakers can request for exams in English.
Quick 20
20 questions · 40 min, same weights, all scored. A daily check.
Weak spots
20 questions aimed at your weakest domains, missed concepts and due reviews.
Practice builder
Pick domains, topics, how many questions and which pool (new, wrong, due, low confidence). Spaced repetition with confidence ratings, flashcards and a mistake book.
Open practiceDomain drill
One domain, up to 20 questions.
What's on the exam
Domain 1: Design Secure Architectures
30 %Secure access to AWS resources (IAM, federation, Organizations and SCPs), secure workloads and applications (VPC security, WAF, Shield, secrets) and data security controls (encryption, KMS, backups, compliance).
Practice domain 1 →Domain 2: Design Resilient Architectures
26 %Scalable, loosely coupled architectures (queues, events, serverless, containers) and highly available, fault-tolerant designs (multi-AZ, multi-Region, DR strategies, Route 53).
Practice domain 2 →Domain 3: Design High-Performing Architectures
24 %High-performing storage, elastic compute, databases and caching, network architectures (CloudFront, Global Accelerator, load balancing, hybrid) and data ingestion and transformation.
Practice domain 3 →Domain 4: Design Cost-Optimized Architectures
20 %Cost-optimised storage, compute, database and network architectures: storage classes and lifecycles, purchasing options, right sizing, and data transfer costs.
Practice domain 4 →
Domain names and weights come from the official SAA-C03 exam guide (checked 2026-10-26). Always check it for the authoritative scope.
Sources · checked 2026-10-26
Sample questions
Two of this exam's original questions, with the explanation you get after every answer.
Sample 1Select one
An application on Amazon EC2 needs to read objects from an S3 bucket. The developers currently store an IAM user's access keys in a configuration file on the instance. What is the MOST secure way to grant access?
- AEmbed the access keys in the AMI so new instances inherit them
- BStore the access keys in the EC2 user data script
- CMake the bucket public and restrict access with an obscure bucket name
- DAttach an IAM role with the required S3 permissions to the instance through an instance profile
Show answer & explanation
Correct: D. An instance profile delivers temporary credentials for the role through the instance metadata service and rotates them automatically, so no long-term keys are stored. User data and AMIs would still contain static keys, and a public bucket exposes the data to everyone.
Sample 2Select 2
A company uses AWS Organizations and must restrict all member accounts to the eu-west-1 and eu-north-1 Regions while still allowing global services such as IAM. Which steps achieve this? (Select TWO.)
- AExempt global services such as IAM, Organizations and CloudFront from the Region condition in the SCP
- BCreate an SCP that denies actions when aws:RequestedRegion is not one of the approved Regions
- CAttach the SCP to the management account only
- DDelete the default VPCs in other Regions
- EUse an IAM permissions boundary in the management account
Show answer & explanation
Correct: A, B. A deny SCP with the aws:RequestedRegion condition key enforces the Region guardrail across member accounts; global services must be excluded with NotAction because their requests use us-east-1. SCPs do not affect the management account, and deleting VPCs does not stop API usage.