Free SAA-C03 practice scenarios: CloudFront

The CDN at architect level — locking the origin, private content, path routing and failover. Six scenarios, SAA-C03, 2026 edition.

Try 6 free CloudFront scenarios in the exam's own style — every answer explained, no sign-up.

Straight to the 6 free questions ↓

CloudFront on the SAA-C03 goes beyond “a CDN caches content near users”. The scenarios test the architect-level features: how you lock the origin, gate viewers, route paths, and fail over — each mapped to one specific control.

Performance: caching near users

The baseline use case remains latency: a single-Region origin serving a global audience is slow, and CloudFront fixes it by caching at edge locations close to users. Watch for distractors that speed the origin (bigger instances, more AZs) when the problem is distance — those improve the wrong thing.

Two kinds of access control

The exam consistently separates these, so keep them apart:

Origin Access Control (OAC) — locks the origin. With a matching bucket policy, only the distribution can read a private S3 bucket, blocking direct object access.
Signed URLs / signed cookies — gate the viewer. Time-limited, authorized access to premium content; URLs for single files, cookies for many.

OAC protects the origin from the world; signing decides which users may view.

Routing and failover

Cache behaviors match path patterns and point each to a different origin — /static/* to S3, /api/* to an ALB — all from one distribution.
Origin groups provide automatic failover: if the primary origin returns errors, CloudFront retries a secondary.

Freshness: invalidation

When updated content is stuck behind a long TTL at the edge, a cache invalidation removes those paths so the next request pulls the fresh version. (For frequently changing assets, versioned file names avoid invalidations altogether.)

How to use the six scenarios below

Answer each one before opening the explanation, and when you miss, name the control the requirement needed — “only via CloudFront”, “only subscribers, limited time”, “global latency”, “split by path”, “automatic origin failover”, “refresh before TTL”. Every explanation states that requirement and dismantles the distractors, which often swap origin protection for viewer access or offer a non-CDN service. For the domain overview, see Design High-Performing Architectures.

Amazon CloudFront serving users from edge locations. Origin Access Control lets only the distribution read a private S3 bucket, with a bucket policy blocking direct access. Signed URLs and signed cookies gate premium content to authorized users for a limited time. Cache behaviors route path patterns to different origins, such as static paths to S3 and API paths to an Application Load Balancer. An origin group provides failover from a primary origin to a secondary, and cache invalidation forces a refresh before the TTL expires.

6 free SAA-C03 practice questions

Answers and explanations — no email wall

SAA-C03 Question 1 of 6

A company serves static assets from an S3 bucket through CloudFront and must ensure users can reach the content only via CloudFront, never by requesting the S3 objects directly. What should a solutions architect configure?

Answer: A — Origin Access Control (OAC) with a bucket policy allowing only the CloudFront distribution.

Origin Access Control lets only the CloudFront distribution read the bucket, and a bucket policy scoped to that distribution blocks all direct S3 access — exactly 'reachable only via CloudFront'. Why not the others: a public bucket can be reached directly by anyone who knows the object URL, defeating the requirement. Signing every object is for gating access by user, not for locking the origin to the distribution. A NAT gateway provides outbound internet for private subnets and has nothing to do with S3 origin access. Locking an S3 origin to CloudFront is OAC plus a matching bucket policy.

SAA-C03 Question 2 of 6

A media company must ensure that only paying subscribers can access premium video files through CloudFront, and only for a limited time window. Which CloudFront feature meets this?

Answer: A — Signed URLs or signed cookies.

Signed URLs (for individual files) and signed cookies (for multiple files) grant time-limited, authorized access to restricted content — precisely 'only subscribers, only for a window'. Why not the others: Origin Access Control locks the origin to the distribution but does not authenticate end users. A long TTL controls caching duration, not who may access content. There is no simple 'make the distribution private' toggle that gates users; access control for viewers is signed URLs or cookies. Time-limited viewer access is signed URLs/cookies.

SAA-C03 Question 3 of 6

A website's servers run in a single AWS Region, but users are worldwide and complain about slow load times for images and pages. What is the most effective way to reduce latency for the global audience?

Answer: A — Serve the content through CloudFront so it is cached at edge locations near users.

CloudFront caches content at edge locations close to users, so requests are served from a nearby edge instead of crossing the globe to the origin — the direct fix for worldwide latency. Why not the others: a larger instance speeds compute, not the network distance a global user must traverse. More Availability Zones improve in-Region availability, not global latency. S3 Transfer Acceleration speeds uploads to S3 buckets, not general web-page delivery. Caching content near users worldwide is CloudFront.

SAA-C03 Question 4 of 6

A single CloudFront distribution must send requests for /static/* to an S3 bucket and requests for /api/* to an Application Load Balancer. How is this configured?

Answer: A — Multiple cache behaviors with path patterns, each pointing to a different origin.

CloudFront cache behaviors match path patterns and route each to a chosen origin, so /static/* can go to S3 and /api/* to the ALB from one distribution. Why not the others: two distributions is more infrastructure than the single-distribution requirement asks for and complicates the domain setup. A Route 53 policy resolves DNS names, it does not route request paths within a distribution. A single default behavior sends everything to one origin, which cannot split by path. Path-based routing to different origins is cache behaviors.

SAA-C03 Question 5 of 6

A company wants CloudFront to automatically serve content from a secondary origin if the primary origin returns errors or becomes unavailable. What should they configure?

Answer: A — An origin group with origin failover (primary and secondary origins).

CloudFront origin failover uses an origin group with a primary and a secondary origin; if the primary returns specified error codes, CloudFront automatically retries the secondary — exactly the automatic failover described. Why not the others: a long TTL only helps for content still cached and does nothing for cache misses during an outage. A second distribution as a manual backup is not automatic. A dead-letter queue is an SQS concept for failed messages, unrelated to CDN origins. Automatic origin failover is an origin group.

SAA-C03 Question 6 of 6

After deploying new content, some users still receive the old version because it is cached at edge locations with a long TTL. The team needs the updated files served immediately. What should they do?

Answer: A — Create a CloudFront invalidation for the affected paths.

A CloudFront invalidation removes the specified objects from the edge caches so the next request fetches the fresh version from the origin — the immediate way to push an update before the TTL expires. Why not the others: deleting and recreating the distribution is drastic and changes the domain, an outage in itself. Waiting for TTL expiry is exactly what the requirement wants to avoid. Disabling caching removes the performance benefit for all content, not just the updated files. Forcing a refresh before TTL is an invalidation (versioned file names are the alternative for frequent updates).

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 6 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 780 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

780 questions in 12 full tests, SAA-C03 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

OAC or signed URLs — what is the difference?

They solve different problems. Origin Access Control locks the origin (like an S3 bucket) so only the CloudFront distribution can read it, preventing direct origin access. Signed URLs and signed cookies gate access for viewers, granting time-limited, authorized access to restricted content. One protects the origin, the other authenticates the user.

How do I route different paths to different backends in CloudFront?

With cache behaviors. Each behavior matches a path pattern (for example /api/*) and points to a specific origin, so one distribution can serve static assets from S3 and dynamic APIs from an ALB. The default behavior handles anything not matched by a more specific pattern.

Are these real exam questions?

No. They are original scenarios written for this page in the exam's style and difficulty. Reproducing real exam items violates the AWS certification agreement and can cost a candidate their certification — ours come with the reasoning attached instead.

What is the one-line takeaway?

CloudFront caches near users for low global latency; lock the S3 origin with OAC, gate viewers with signed URLs/cookies, route paths with cache behaviors, fail over with an origin group, and refresh early with an invalidation.

Updated for SAA-C03 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.