Free SAA-C03 practice scenarios: VPC security

The network boundary and how the exam tests it — stateful groups, stateless ACLs, and keeping private things private. Six scenarios, SAA-C03, 2026 edition.

Try 6 free VPC-security scenarios in the exam's own style — every answer explained, no sign-up.

Straight to the 6 free questions ↓

VPC security is where the SAA-C03 tests whether you can reason about a network boundary, not just recite service names. The scenarios reward a handful of clean distinctions — stateful versus stateless, public versus private, and the three ways a private instance talks to the outside world.

The two firewalls: security group vs NACL

Every VPC-security question leans on this line. A security group is stateful and allow-only, wrapping a resource; if a request is allowed in, its response is allowed out automatically. A network ACL is stateless and can deny, guarding a subnet; each direction is evaluated on its own, so responses need an explicit outbound rule on ephemeral ports.

Two reflexes follow. When a scenario needs to block a specific address, only the NACL can express a deny. When it asks about return traffic, the security group handles it for you and the NACL does not. Reverse those two and you have written the exam’s favourite distractor.

Reference the group, not the IP

When the source of allowed traffic is another AWS resource whose addresses change — an ALB, another tier — the durable answer is to set the security group’s source to that resource’s security group, not a CIDR block. It stays correct as addresses churn, and it says exactly what you mean: “traffic from the load balancer”, not “traffic from a list of IPs I have to maintain”.

Public, private, and the road out

Keep anything that must not be internet-facing in a private subnet with no route to an internet gateway — that is what makes it unreachable, more absolutely than any firewall rule. From there, a private instance reaches the outside world in one of two ways, and the exam wants the right one:

Outbound to the internet (patches, third-party APIs) but never inbound → a NAT gateway in a public subnet.
To an AWS service like S3 or DynamoDB without touching the internet at all → a VPC endpoint (a gateway endpoint for S3 and DynamoDB), which keeps the traffic on AWS’s private network and, for gateway endpoints, costs nothing.

The trap is offering NAT where the requirement says “must not traverse the internet” — NAT reaches S3, but over the internet. Read the constraint before choosing the road out.

Placing a database

Put it in a private subnet, give it no internet-gateway route, and make its security group source the app tier only. That is defence at two layers: the subnet cannot be reached from the internet, and the instance accepts only its intended caller. A public subnet with a tight security group is the classic wrong answer — the group may be narrow, but the database is still sitting somewhere the requirement forbids.

How to use the six scenarios below

Answer each one before opening the explanation, and when you miss, name the requirement that decided it — “block one IP”, “outbound only”, “must not traverse the internet”, “only the app tier”. Every explanation states that deciding constraint and then dismantles the distractors, most of which are real controls solving a slightly different requirement. That discrimination is the skill the exam measures. For the wider picture, see Design Secure Architectures.

A VPC with a public subnet and a private subnet across the internet gateway boundary. The public subnet holds an Application Load Balancer and a NAT gateway; the private subnet holds application instances and a database. Security groups wrap each resource as stateful allow-only filters, while a network ACL guards the subnet as a stateless filter that can also deny. Private instances reach the internet outbound only through the NAT gateway, and reach Amazon S3 privately through a gateway VPC endpoint without touching the internet.

6 free SAA-C03 practice questions

Answers and explanations — no email wall

SAA-C03 Question 1 of 6

A company must block inbound traffic from one specific malicious IP address to all instances in a subnet. Security groups are already in place allowing normal application traffic. Which control can explicitly deny that single IP address?

Answer: A — A network ACL rule on the subnet that denies the IP address.

Network ACLs are the only VPC firewall that can express an explicit deny, and they act at the subnet boundary — perfect for blocking a known-bad IP across every instance in the subnet. Why not the others: security groups only ever allow; there is no deny rule to write, which is the exact distinction this question tests. You cannot 'remove the allow' for one IP because the group allows a range, not that single address. And an IAM policy governs AWS API permissions, not network packets. Deny at the network layer means a NACL.

SAA-C03 Question 2 of 6

A web-tier Auto Scaling group sits behind an Application Load Balancer. The web instances must accept traffic only from the load balancer, whose IP addresses change over time. How should the web-tier security group be configured?

Answer: A — Set the source to the load balancer's security group.

A security group rule can reference another security group as its source, so 'traffic from the load balancer' stays correct no matter how the ALB's addresses change — the cleanest and most durable expression of the requirement. Why not the others: hard-coding CIDR blocks means chasing changing IPs forever, the maintenance burden this feature exists to remove. Opening 0.0.0.0/0 exposes the instances directly and trusts a filter that no longer bounds them. Allowing the whole VPC CIDR lets any resource in the VPC reach the web tier, far broader than 'only the load balancer'.

SAA-C03 Question 3 of 6

Instances in a private subnet must download operating-system patches from the internet, but must not be reachable from the internet in any way. What should a solutions architect implement?

Answer: A — A NAT gateway in a public subnet, with the private subnet's route table sending internet-bound traffic to it.

A NAT gateway gives instances outbound-only internet access: they can reach out for patches, but connections cannot be initiated toward them — exactly 'outbound yes, inbound never'. Why not the others: attaching an internet gateway route (or assigning Elastic IPs) would make the instances publicly reachable, the precise thing forbidden. A load balancer accepts inbound traffic, the opposite of the requirement. The tell is the pairing 'needs outbound, must not be reachable' — that sentence is the definition of NAT.

SAA-C03 Question 4 of 6

Application instances in a private subnet need to read and write objects in Amazon S3, and the security team requires that this traffic never traverse the public internet. What is the most appropriate solution?

Answer: A — Create a gateway VPC endpoint for Amazon S3 and route S3 traffic to it.

A gateway VPC endpoint connects the VPC to S3 over the AWS private network, so traffic to S3 never leaves AWS and never touches the internet — and it is free. That is the specific control for 'must not traverse the public internet'. Why not the others: a NAT gateway does reach S3, but over the public internet, which the requirement forbids. Public IPs expose the instances and still route over the internet. A relay proxy is undifferentiated heavy lifting that reinvents what the endpoint provides natively.

SAA-C03 Question 5 of 6

A security review asks how return traffic is handled by the VPC's two stateful and stateless controls. Which statement is correct?

Answer: A — A security group automatically allows return traffic; a network ACL must permit the response explicitly, typically on ephemeral ports.

Security groups are stateful: if a request is allowed in, the response is allowed out automatically. Network ACLs are stateless: each direction is evaluated independently, so the response must be permitted by an outbound rule, usually on the ephemeral port range. Why not the others: the two behave differently, so 'both automatic' and 'neither' are wrong, and the third option reverses the two — it is the security group that is stateful, not the ACL. Stateful versus stateless is the single most tested VPC-firewall distinction.

SAA-C03 Question 6 of 6

A relational database must be reachable only by the application tier inside the VPC and never from the internet. Which subnet placement and configuration meets this?

Answer: A — Place the database in a private subnet with no route to an internet gateway, and allow the app-tier security group as the only source.

A private subnet with no internet-gateway route makes the database unreachable from the internet by construction, and sourcing its security group from the app tier limits access to exactly the callers allowed — defence at both the routing and the instance layer. Why not the others: a public subnet has a path to the internet gateway, so even a tight security group leaves the database in an internet-facing subnet the requirement rules out. An Elastic IP makes it internet-reachable again. Trying to blacklist 'all internet ranges' with a NACL is fragile and unnecessary when simply not routing to the internet is absolute.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 6 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 780 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

780 questions in 12 full tests, SAA-C03 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

How much of the SAA-C03 is VPC security?

VPC networking and its security controls sit in Design Secure Architectures — the exam's largest domain at 30% — and also surface in the performance and resilience domains. Security groups, NACLs, subnets and endpoints are among the most reliably tested topics on the exam.

Security group or NACL — how do I keep them straight?

A security group is stateful and allow-only, attached to a resource; a network ACL is stateless and can deny, attached to a subnet. If a scenario needs an explicit block, it is a NACL; if it needs return traffic handled automatically, that is the security group.

Are these real exam questions?

No. They are original scenarios written for this page in the exam's style and difficulty. Reproducing real exam items violates the AWS certification agreement and can cost a candidate their certification — ours come with the reasoning attached instead.

What is the one-line takeaway?

Keep private things in private subnets with no internet route, reach out through NAT and reach AWS services through VPC endpoints — and remember only the NACL can say no.

Updated for SAA-C03 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.