Free SAA-C03 practice exam 1: feel the format

The real exam is 65 questions in 130 minutes. Here are 10 across every domain to see the format — a sample of the full timed exams in the course. 2026 edition.

Try 10 free practice-exam scenarios in the exam's own style — every answer explained, no sign-up.

Straight to the 10 free questions ↓

The fastest way to know where you stand is to sit the format. The real SAA-C03 is 65 questions in 130 minutes, mixing all four domains, and this free sample gives you ten of them to feel the rhythm before you commit study time. Treat it as a timed run, not a browse.

What the exam feels like

Every question is a short scenario with four options that all describe real AWS services — and one requirement sentence that makes exactly one correct. The ten below deliberately spread across the domains and reach into services the exam names but beginners overlook: Route 53 routing policies, API Gateway, Transit Gateway, Cognito, Object Lock, Kinesis Firehose, Storage Gateway, ACM, placement groups and Redshift. If several feel unfamiliar, that is your study list.

Work it like the real thing

Answer all ten before reading a single explanation. Then, for each miss, do not just note the right answer — find the requirement word that decided it and read why the other three fail. That habit, repeated across full-length material, is what turns recognition into the fast, confident selection the timed exam rewards.

How to use the ten scenarios below

Give yourself a fixed time, answer without peeking, then review every explanation. When you are done, move to practice exam 2 for a second, more scenario-heavy pass, and check the exam guide for scoring. When you can hold 85%+ across these, book with confidence.

The shape of the SAA-C03 exam: 65 questions in 130 minutes, of which 50 are scored, drawn across the four domains at their official weights — Secure 30 percent, Resilient 26 percent, High-Performing 24 percent, Cost-Optimized 20 percent. This free sample of ten scenarios reaches across services including Route 53, API Gateway, Transit Gateway, Cognito, Kinesis Data Firehose, Storage Gateway and Redshift to mirror that spread.

10 free SAA-C03 practice questions

Answers and explanations — no email wall

SAA-C03 Question 1 of 10

A company must serve different content to users based on the country they are in, and block access from countries where it is not licensed to operate. Which Route 53 routing policy fits?

Answer: A — Geolocation routing.

Geolocation routing directs users to endpoints (or blocks them) based on their geographic location, which is exactly 'serve by country and restrict where unlicensed'. Why not the others: latency-based routing optimizes for the fastest Region, not the user's country. Weighted routing splits traffic by percentage. Simple routing returns one record with no logic. Deciding by the user's country is geolocation routing.

SAA-C03 Question 2 of 10

A team wants to build a REST API backed by business logic without managing any servers, scaling automatically with request volume. Which combination fits?

Answer: A — Amazon API Gateway with AWS Lambda.

API Gateway fronts the REST API and invokes Lambda for the logic, a fully managed serverless stack that scales automatically with no servers to run. Why not the others: an ALB with a fixed EC2 fleet means managing and scaling servers, not serverless. CloudFront with S3 serves static content, not a dynamic API with business logic. Route 53 with a static site is DNS plus static hosting. A serverless REST API is API Gateway plus Lambda.

SAA-C03 Question 3 of 10

An enterprise must connect dozens of VPCs and its on-premises network together with centralized routing, avoiding a tangle of individual VPC peering connections. Which service is designed for this?

Answer: A — AWS Transit Gateway.

Transit Gateway acts as a central hub that connects many VPCs and on-premises networks with centralized routing, replacing a full mesh of peering connections. Why not the others: pairwise VPC peering does not scale — dozens of VPCs would need a large, unmanageable mesh with no transitive routing. Internet gateways provide public internet access, not private inter-VPC connectivity. Global Accelerator optimizes user traffic to endpoints, not internal network topology. Hub-and-spoke connectivity at scale is Transit Gateway.

SAA-C03 Question 4 of 10

A regulated company must store financial records so they cannot be deleted or overwritten for a fixed retention period, even by administrators. Which S3 feature enforces this?

Answer: A — S3 Object Lock in compliance mode.

S3 Object Lock in compliance mode enforces write-once-read-many (WORM) retention so objects cannot be deleted or overwritten until the retention period expires, not even by the root user — the immutability the requirement demands. Why not the others: versioning preserves versions but does not prevent deletion of the retained state under compliance rules. A bucket policy can be changed by an administrator, so it is not tamper-proof retention. Lifecycle rules manage transitions and expiration, not immutability. Tamper-proof retention is Object Lock (compliance mode).

SAA-C03 Question 5 of 10

A mobile application needs user sign-up, sign-in, and federated identity (Google, Apple) with managed user directories, without building an auth system. Which service should be used?

Answer: A — Amazon Cognito.

Amazon Cognito provides user pools for sign-up and sign-in and identity pools for federated access to AWS resources — managed authentication for application end users. Why not the others: IAM is for AWS account principals, not millions of application end users, and creating an IAM user per app user does not scale. Secrets Manager stores secrets, not user identities. API Gateway usage plans throttle API keys, not user authentication. Application user identity is Amazon Cognito.

SAA-C03 Question 6 of 10

A company needs to reliably load a continuous stream of data into Amazon S3 and Amazon Redshift with no servers to manage and minimal configuration. Which service fits best?

Answer: A — Amazon Kinesis Data Firehose.

Kinesis Data Firehose is a fully managed delivery stream that loads streaming data into destinations like S3 and Redshift with no servers and minimal setup — exactly the requirement. Why not the others: Kinesis Data Streams gives you the raw stream but you build and run the consumer that writes to the destinations, which is more management. SQS plus a Lambda poller is a custom pipeline. DataSync moves files between storage systems in bulk, not a continuous stream. Managed streaming delivery to S3/Redshift is Firehose.

SAA-C03 Question 7 of 10

A company with a large on-premises footprint wants its data-center applications to access virtually unlimited cloud storage with a local cache for low-latency access to frequently used data. Which service provides this hybrid capability?

Answer: A — AWS Storage Gateway.

AWS Storage Gateway bridges on-premises applications to AWS storage, presenting cloud-backed volumes or file shares with a local cache for low-latency access to hot data — the hybrid storage pattern described. Why not the others: accessing S3 directly gives no local caching layer for on-premises apps. EFS is not designed to be mounted over the public internet from on-premises for this purpose. Snowball is for one-time bulk physical data transfer, not ongoing hybrid access. On-premises-to-cloud storage with a local cache is Storage Gateway.

SAA-C03 Question 8 of 10

A public website behind an Application Load Balancer must serve HTTPS with a trusted public certificate that renews automatically, at no additional certificate cost. What should a solutions architect use?

Answer: A — A public certificate from AWS Certificate Manager (ACM) on the load balancer.

ACM issues free public TLS certificates and manages their renewal automatically, and it integrates with the ALB to terminate HTTPS — no cost and no manual renewal. Why not the others: a self-signed certificate is not trusted by browsers. A purchased, manually managed certificate incurs cost and renewal toil, the opposite of the requirement. CloudFront field-level encryption protects specific data fields, it is not the load balancer's TLS certificate. Free, auto-renewing public TLS is ACM.

SAA-C03 Question 9 of 10

A high-performance computing workload requires the lowest possible network latency and highest throughput between a group of EC2 instances. Which placement strategy should be used?

Answer: A — A cluster placement group.

A cluster placement group packs instances close together within one Availability Zone for the lowest latency and highest throughput between them — the HPC requirement. Why not the others: a spread placement group deliberately separates instances across hardware for availability, increasing distance, not reducing it. Separate Availability Zones maximize resilience but add inter-AZ latency. A Network Load Balancer distributes client traffic; it does not lower instance-to-instance latency. Tight low-latency grouping is a cluster placement group.

SAA-C03 Question 10 of 10

A business-intelligence team must run complex analytical queries across terabytes of structured data aggregated from many sources. Which service is purpose-built for this?

Answer: A — Amazon Redshift.

Amazon Redshift is a columnar data warehouse built for fast, complex analytical queries over large volumes of structured data — the classic BI workload. Why not the others: RDS for MySQL is a transactional (OLTP) database that struggles with large analytical scans. DynamoDB is a key-value store for operational access, not analytical aggregation. ElastiCache is an in-memory cache. Warehouse-scale analytics is Redshift.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 10 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 780 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

780 questions in 12 full tests, SAA-C03 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

Is this a full 65-question exam?

No — this is a free 10-scenario sample to let you feel the format and difficulty. The real SAA-C03 is 65 questions in 130 minutes (50 scored), and the full timed practice exams that mirror it are in the course. These ten span all four domains, as the exam does.

How should I use a practice exam?

Under real conditions: answer before revealing any explanation, and afterwards study every miss by finding the requirement word that decided it. Then try practice exam 2 for a second, scenario-heavier pass. Consistently scoring 85%+ is the signal you are ready to book.

Are these real exam questions?

No. They are original scenarios written for this page in the exam's style and difficulty. Reproducing real exam items violates the AWS certification agreement and can cost a candidate their certification — ours come with the reasoning attached instead.

What score means I am ready?

Consistently 85% or higher across full-length material, with your misses coming from genuine knowledge gaps you then close, rather than careless reading.

Updated for SAA-C03 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.