← All exams
Home · AWS Solutions Architect Associate (SAA-C03)

AWS Solutions Architect Associate (SAA-C03)

Scenario practice for the SAA-C03 — design resilient, secure, cost-optimised architectures.

Pass mark 48/65 130 minutes AWS How many can I get wrong?
Start with a free topic drill, see where you stand, then unlock the full mock.
Free practice questions
Try 3 real AWS Solutions Architect Associate (SAA-C03) questions
Have a go, then reveal the worked explanation. A taster from a bank of 304 original questions — unlock for unlimited drills and full timed mocks.
Q1. A company runs a web application on EC2 instances behind an Application Load Balancer in a single Availability Zone. To improve availability with minimal application changes, what should a solutions architect do first?
  • A.  Add EC2 instances in additional Availability Zones and register them with the same target group
  • B.  Migrate the application to a single larger EC2 instance
  • C.  Enable EC2 instance recovery with CloudWatch alarms in the same AZ
  • D.  Move the application to AWS Lambda functions triggered by API Gateway
Show answer & explanation
✓ Answer: A. Add EC2 instances in additional Availability Zones and register them with the same target group
Spreading instances across multiple AZs behind the same ALB is the standard, minimal-change way to remove a single-AZ point of failure. A bigger instance still fails if the AZ fails, and instance recovery only restarts in the same AZ, so neither improves AZ-level resilience.
Q2. A company wants developers to be able to assume a role in a production AWS account only when they are signed in with MFA. Which IAM policy element should be used in the role's trust policy to enforce this?
  • A.  A resource-based policy on the S3 bucket the developers access
  • B.  A permissions boundary attached to the developer IAM group
  • C.  A service control policy attached to the production organizational unit
  • D.  A condition using aws:MultiFactorAuthPresent set to true
Show answer & explanation
✓ Answer: D. A condition using aws:MultiFactorAuthPresent set to true
The trust policy of a role can include a Condition block checking the aws:MultiFactorAuthPresent global condition key, which is true only when the caller authenticated with MFA before calling sts:AssumeRole. Permissions boundaries and SCPs limit maximum permissions but do not check MFA status at assume-role time, and a bucket resource policy is unrelated to how the role itself is assumed.
Q3. A company wants ECS tasks running on Fargate to pull container images from a private ECR repository. What must be granted to the task execution role for this to succeed?
  • A.  Permissions such as ecr:GetAuthorizationToken and ecr:BatchGetImage on the task execution role
  • B.  No permissions are needed since ECR access is public by default
  • C.  Full AdministratorAccess on the Fargate service
  • D.  Permissions on the task role, not the task execution role
Show answer & explanation
✓ Answer: A. Permissions such as ecr:GetAuthorizationToken and ecr:BatchGetImage on the task execution role
The task execution role is used by the ECS agent (or Fargate infrastructure) to perform actions on the task's behalf before the application starts, including authenticating to ECR and pulling images, so it needs permissions like ecr:GetAuthorizationToken and ecr:BatchGetImage. The task role is for the application's own runtime AWS API calls, not image pulls.
Exam format (pass mark, question count, timing) verified against AWS Certification. Questions are our own, not the official paper.
Start here
Ten questions to see where you stand
Two minutes, no timer, marked the moment you finish with every answer explained. Then you'll know which topics need the work before you sit a full mock.
Exam mode
Full mock exam
65 random questions, real timing, marked against the official pass mark. Different every time.
Create a free account for a full mock
No card needed. A free account unlocks a full timed mock and 3 drills on every exam.
Try it free
Topic drills
Ten quick questions on one topic, marked instantly with explanations.
1 free drill left — then a free account unlocks 3 + a full mock.
Design resilient & highly available architectures · 54
Design secure applications & access (IAM, KMS) · 45
Compute & container design (EC2, Lambda, ECS) · 45
Storage design (S3, EBS, EFS) & data lifecycle · 65
Networking (VPC, Route 53, CloudFront) · 47
Cost-optimised & high-performing design · 48
AWS Solutions Architect Associate (SAA-C03) — common questions
Frequently asked
How many questions are in the AWS Solutions Architect Associate (SAA-C03)?
The exam has 65 questions. Every Revision Robin mock uses the same 65-question format so your practice matches the real thing.
What is the pass mark for the AWS Solutions Architect Associate (SAA-C03)?
You need 48 out of 65 correct to pass, which is about 74%. Our mocks mark you against this exact threshold.
How long do you get?
The test is timed at 130 minutes. Our full mock runs on the same clock so you can practise your pacing.
Are these the real exam questions?
No. Our questions are original and written to match the current syllabus, so they give realistic practice without copying the official paper. Every answer comes with a plain-English explanation. Always confirm current rules and content with AWS.