CertifyDeckCargando contenido…
SAA-C03 · Sample questions
10 real questions from the CertifyDeck SAA-C03 bank, spread across the domains of the official AWS Certified Solutions Architect - Associate skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.
Correct answer: D. Deploy Amazon S3 File Gateway on premises and store the files as objects in Amazon S3.
S3 File Gateway runs on premises and exposes Amazon S3 through NFS and SMB file shares, with transparent local caching for low-latency access, while S3 holds the data without capacity planning. DataSync and Snowball Edge move data but leave applications without ongoing NFS and SMB access to the moved files. Volume Gateway presents block volumes over iSCSI rather than file shares, and stored volumes keep the entire data set on premises, which does not relieve local capacity.
Correct answer: A. Run an AWS Glue crawler on a schedule to update the Data Catalog and query the tables with Athena.
An AWS Glue crawler infers the schema of the data and creates or updates tables in the Data Catalog, and Athena is a serverless service that queries data directly in Amazon S3 with standard SQL. Loading the files into RDS fails the requirement to avoid loading data into a database, and an EC2 instance with a self-managed engine adds infrastructure to manage. Firehose delivers streaming data to destinations; it is not a query engine.
Correct answer: A. Orchestrate the steps with AWS Step Functions and use a .waitForTaskToken task that the web tool completes with SendTaskSuccess or SendTaskFailure.
The Step Functions callback pattern pauses a task until a task token is returned with SendTaskSuccess or SendTaskFailure, which is documented for waits such as human approval, and no compute runs while the workflow waits. A Lambda function polling DynamoDB and a Fargate task waiting for an HTTP call both keep compute running during the wait, which the company wants to avoid. A one-time schedule resumes after a fixed time instead of when the officer actually decides.
Correct answer: C. Mount an Amazon EFS Regional file system on every instance by using the NFS protocol.
Amazon EFS is a shared NFS file system, and Regional file systems store data redundantly across multiple Availability Zones so the data stays available if a zone is lost. EBS Multi-Attach only attaches a volume to instances in the same Availability Zone, so it cannot serve a group that spans three zones. An EFS One Zone file system keeps the data in a single zone, which fails the availability requirement, and instance store copies are neither shared nor durable.
Correct answer: B. Backup and restore, with backups copied to a second Region and the infrastructure defined as code for redeployment.
Backup and restore keeps only backups in the recovery Region and redeploys infrastructure from code when needed, which gives the lowest ongoing cost and fits RTO and RPO measured in hours. Pilot light is the next cheapest option, but it keeps databases always on and continuously replicating, which costs more than this business needs. Warm standby and active/active keep running environments in a second Region and cost even more.
Correct answer: C. Create a gateway VPC endpoint for Amazon S3 and add it to the private subnets' route tables.
A gateway endpoint lets instances in the VPC reach Amazon S3 without an internet gateway or NAT device, and there is no additional charge for gateway endpoints, so the NAT processing charges disappear. NAT instances add servers to operate and still process the traffic. Transfer Acceleration adds data transfer charges, and moving private workloads to public subnets breaks the network design without being the cheapest option.
Correct answer: B. Move the workload to a fixed performance instance type sized for its sustained CPU demand.
Fixed performance instances sustain full CPU for as long as the workload needs it and are recommended for consistently high CPU use, so sizing one for the sustained demand removes the surplus charges that unlimited mode adds when the 24-hour average stays above baseline. Standard mode does not allow bursting beyond baseline once earned credits run out, so performance would drop. A smaller burstable size has a lower baseline and would make the surplus larger, and a budget alert only reports the charges.
Correct answer: D. Request the certificate with DNS validation and leave the CNAME records that ACM creates in place.
ACM renews Amazon-issued certificates automatically when DNS validation is used, as long as the certificate is in use and the CNAME record remains in place. With email validation, ACM sends email notices that require action from the domain owner. Imported certificates are not eligible for managed renewal, and a custom Lambda function adds code to do something ACM already does.
Correct answer: C. Put all servers in private subnets with an internet-facing load balancer for the web tier and an internal load balancer for the app tier.
Internet-facing and internal load balancers both route to targets using private IP addresses, so all instances can stay in private subnets; the internet-facing load balancer receives user traffic for the web tier, and an internal load balancer, reachable only from inside the VPC, serves the application tier. Elastic IP addresses on the web servers break the no-public-address requirement. A single internet-facing load balancer for both tiers would expose the application servers to internet users.
Correct answer: C. Set up AWS Control Tower to build the landing zone, provision accounts with Account Factory, and enable controls on the organizational units.
AWS Control Tower sets up and governs a multi-account environment following prescriptive best practices: it builds the landing zone, offers Account Factory to provision accounts from approved templates, and applies controls to whole organizational units. Building the organization manually with StackSets can reach a similar result but requires the company to design and maintain everything itself, which fails the least-overhead requirement. IAM Identity Center alone manages access but does not create a landing zone, and Config conformance packs only detect issues after accounts exist.
Answer each question before opening the explanation, and write down why you discarded the other options. On SAA-C03, most mistakes come from choosing an option that is technically possible but does not meet every requirement in the scenario.
These 10 questions are a taste of the format, not a diagnostic. To know which domains you fail, practice by domain for free and take a timed mock exam that mirrors the official weights and duration.
Start for free, no sign-up or card. Every question includes an explanation like the ones above, and the mock exam reproduces the official SAA-C03 format.