AWS Trusted Advisor: SAA-C03 optimization scenarios

The automated best-practice checker across five categories — and the support tier that decides how much of it you get. Seven scenarios, SAA-C03, 2026 edition.

Try 7 free Trusted Advisor scenarios in the exam's own style — every answer explained, no sign-up.

Straight to the 7 free questions ↓

AWS Trusted Advisor is the exam’s automated best-practice checker: point it at an account and it grades what it finds against AWS’s own recommendations. The SAA-C03 tests two things about it — what it covers, and what it takes to see all of that coverage. The diagram above lays out both: the five categories it reports on, and the support-tier gate beneath them.

The five categories

Trusted Advisor organizes every check into five categories, and the exam’s favorite move is to name a finding and ask which category owns it:

Cost Optimization — idle and underutilized resources, unassociated Elastic IP addresses, other spend waste.
Performance — over-utilized instances and configuration that holds back speed.
Security — security groups open to the world (0.0.0.0/0) on sensitive ports, MFA missing on the root account, exposed access keys.
Fault Tolerance — backups, Multi-AZ, resource health: can this survive a failure?
Service Limits — how close the account is to a quota, so provisioning does not fail at the limit.

Learn the categories as a lookup table. A stem describing a wide-open security group is a Security check; one about nearing an EC2 quota is Service Limits; one about idle resources is Cost Optimization.

The support-tier gate

The second thing the exam tests is availability. Trusted Advisor’s breadth depends on your AWS Support tier. On Basic and Developer support you get only a core subset — a handful of security checks and the service-limit checks. The full set of checks across all five categories requires Business or Enterprise Support. When a scenario says a team sees only a few checks and wants the rest, the answer is an upgrade to Business or Enterprise Support — not a config change, not a quota increase.

Trusted Advisor vs AWS Config

These two get offered as each other’s distractors, and the distinction is clean. Trusted Advisor gives best-practice recommendations from a fixed AWS catalog — “this group is too open”, “this instance is idle”. AWS Config evaluates configuration compliance against rules you define — “every EBS volume must be encrypted”, “no security group may allow 0.0.0.0/0 on port 22” — and tracks compliant/non-compliant over time. Best-practice advice from AWS is Trusted Advisor; compliance against your own rules is Config.

Acting on a recommendation

One more expectation the exam checks: Trusted Advisor advises, it does not remediate. It will never close a security group or delete an idle load balancer on its own — acting on a finding is your job, done manually or through automation you build by routing its results to Amazon EventBridge and a remediation workflow. An option claiming Trusted Advisor auto-fixes or rolls back the account is wrong by definition.

How to use the seven scenarios below

Answer each one before opening the explanation, and when you miss, name what the stem was really testing — “which category owns this finding”, “what unlocks the full check set”, “recommend versus enforce”, “advise versus remediate”. Every explanation states that distinction and dismantles the distractors, which usually offer a neighbouring category or confuse Trusted Advisor with Config. For the domain overview, see Design Cost-Optimized Architectures, and for the deeper cost-cutting moves, right-sizing scenarios.

AWS Trusted Advisor as an automated best-practice checker feeding five check categories: Cost Optimization (idle and underutilized resources, unassociated Elastic IPs), Performance (over-utilized instances, configuration tuning), Security (security groups open to the world, MFA on the root account, exposed access keys), Fault Tolerance (Multi-AZ, backups, health), and Service Limits (quota usage approaching the account limit). A gate note beneath the five categories states that the Basic and Developer support tiers expose only a core subset of checks, while the full set of checks requires Business or Enterprise Support.

7 free SAA-C03 practice questions

Answers and explanations — no email wall

SAA-C03 Question 1 of 7

An architecture review board wants a single AWS service that continuously inspects an account against AWS best practices across several dimensions — not just cost, but also security posture, resiliency and how close the account is to its service quotas. Which service does this?

Answer: A — AWS Trusted Advisor.

Trusted Advisor is the automated best-practice checker, and it reports across five categories — Cost Optimization, Performance, Security, Fault Tolerance and Service Limits — which is exactly the multi-dimensional account review described. Why not the others: CloudWatch collects metrics, logs and alarms on operational health, it does not grade the account against best practices. CloudTrail records API activity for audit, answering 'who did what', not 'is this well-architected'. Systems Manager operates and patches fleets; it manages resources rather than scoring them against best practices. An account-wide best-practice checker across cost, security, resiliency and limits is Trusted Advisor.

SAA-C03 Question 2 of 7

A company on the Basic support plan opens Trusted Advisor and sees only a handful of checks, mostly a few security items and service-limit checks. They want the complete set of Trusted Advisor checks across all five categories. What must they do?

Answer: A — Upgrade to Business or Enterprise Support, which exposes the full set of Trusted Advisor checks.

The breadth of Trusted Advisor is gated by support tier: Basic and Developer plans expose only a core subset of checks, while the full set across all five categories requires Business or Enterprise Support. Why not the others: enabling AWS Config evaluates configuration compliance, a different service that does not populate Trusted Advisor's checks. There is no console toggle that reveals the full set — the missing checks are withheld by the support tier, not hidden by a setting. A service quota increase raises a resource limit; it has nothing to do with which checks are visible. The gate on Trusted Advisor's full check set is the Business or Enterprise Support tier.

SAA-C03 Question 3 of 7

A cost-conscious team wants Trusted Advisor to help trim spend by highlighting resources that are provisioned but barely doing work — for example unassociated Elastic IP addresses and RDS DB instances sitting idle. Which Trusted Advisor category surfaces these?

Answer: A — The Cost Optimization category.

Trusted Advisor's Cost Optimization category is the one that flags spend waste — idle and underutilized resources, unassociated Elastic IPs, and similar savings opportunities. Why not the others: the Performance category looks at things holding back speed, such as over-utilized instances or suboptimal configuration, not idle waste. Fault Tolerance evaluates resiliency — backups, Multi-AZ, health — not cost. Service Limits tracks how close usage is to account quotas. When the requirement is trimming spend on barely-used resources, it is the Cost Optimization category.

SAA-C03 Question 4 of 7

A security team wants an automated, account-wide flag when a security group allows unrestricted access (0.0.0.0/0) to a sensitive port, or when the root account is missing MFA. They already pay for Business Support. Which Trusted Advisor category reports these findings?

Answer: A — The Security category.

Trusted Advisor's Security category runs exactly these checks — security groups open to the world on sensitive ports, MFA missing on the root account, exposed access keys and similar posture issues — and Business Support makes the full set available. Why not the others: Cost Optimization targets spend waste, not exposure. Fault Tolerance is about surviving failure, not access risk. Performance is about speed and utilization. Wide-open security groups and root-account MFA are Security-category checks.

SAA-C03 Question 5 of 7

An operations lead wants advance warning when the account is nearing a quota — for instance the number of EC2 instances or VPCs allowed in a Region — so provisioning does not suddenly fail at the limit. Which Trusted Advisor category provides this?

Answer: A — The Service Limits category.

The Service Limits category tracks usage against account quotas and warns when a resource is approaching its limit, so a team can request an increase before new launches are refused — an availability and fault-tolerance concern. Why not the others: Cost Optimization flags waste, not quota headroom. Security flags exposure. Performance flags speed bottlenecks. Running out of quota mid-provision is caught by the Service Limits category.

SAA-C03 Question 6 of 7

An architect must decide between two services. One returns AWS best-practice recommendations — 'this security group is too open', 'this volume is idle'. The other continuously evaluates whether resource configurations comply with the company's own defined rules, such as 'every EBS volume must be encrypted'. Which service does the second job?

Answer: A — AWS Config, using config rules for configuration compliance.

AWS Config evaluates resource configuration against rules you define and reports compliant/non-compliant over time — the configuration-compliance job in the stem. Trusted Advisor is the first service described: curated AWS best-practice recommendations, not your own custom rules. Why not the others: Trusted Advisor gives best-practice guidance from a fixed catalog of checks, it does not let you author 'every EBS volume must be encrypted' as an enforced rule. Amazon Inspector scans workloads for software vulnerabilities and unintended network exposure, a security-assessment role. CloudTrail logs API calls for audit. Best-practice recommendations are Trusted Advisor; compliance against your own configuration rules is AWS Config.

SAA-C03 Question 7 of 7

Trusted Advisor has flagged several security groups open to the world and a set of idle load balancers. A team lead asks what Trusted Advisor will do about them automatically. What is the correct expectation?

Answer: A — Trusted Advisor reports the findings but does not remediate them; a person or an automation you build (for example via Amazon EventBridge) must act on each recommendation.

Trusted Advisor is an advisor: it inspects and recommends, but acting on a recommendation is your responsibility — manually, or through automation you build by wiring its check results to Amazon EventBridge and a remediation workflow. Why not the others: it never changes your resources on its own — it will not close a security group or delete a load balancer, which would be dangerous to do unattended. It does not dispatch AWS engineers to fix your account. It has no 'roll back to compliant' capability — that is not what a best-practice checker does. Trusted Advisor surfaces the work; you (or your automation) do it.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 7 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 780 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

780 questions in 12 full tests, SAA-C03 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

What are Trusted Advisor's five check categories?

Cost Optimization (idle and underutilized resources, unassociated Elastic IPs), Performance (over-utilized instances and tuning), Security (open security groups, root MFA, exposed keys), Fault Tolerance (backups, Multi-AZ, health) and Service Limits (usage approaching account quotas). The exam expects you to map a finding to the right category.

Do you need Business Support to get all Trusted Advisor checks?

Yes. The Basic and Developer support tiers expose only a core subset of checks — a few security items and the service-limit checks. The full set of Trusted Advisor checks across all five categories requires Business or Enterprise Support. Support tier is the gate the exam tests.

Are these real exam questions?

No. They are original scenarios written for this page in the exam's style and difficulty. Reproducing real exam items violates the AWS certification agreement and can cost a candidate their certification — ours come with the reasoning attached instead.

Updated for SAA-C03 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.