Free SAP-C03 practice questions: 20 with answers
Twenty questions across the five SAP-C03 content domains, split in line with the official weightings of 25%, 25%, 15%, 15% and 20%: five questions on architecture design and implementation built for the cloud, five on security, compliance and governance, three on cost-optimized architecture design, three on resilience, migration and business continuity, and four on operational excellence and automation. The real exam has 65 scored and 10 unscored questions, so this set is shorter but weighted the same way. These are original scenario questions, not questions from the real exam. At professional level several options usually work; look for the constraint, such as operational effort, scale, cost or recovery target, that makes only one of them the best fit.
Architecture design and implementation built for the cloud
Question 1. An order service must publish each order to three downstream systems. Each system needs only certain order types, and new consumers must be addable without changing the producer. Which design fits best?
- A. The producer calls each of the three systems directly
- B. An SNS topic with an SQS queue per consumer, each subscription using a filter policy
- C. One SQS queue that all three systems poll
- D. A single-shard Kinesis stream that every consumer reads fully
Show answer
Answer: B
Publishing once to an SNS topic and giving each consumer its own SQS queue subscription with a filter policy decouples the producer, delivers only the matching order types to each consumer and buffers messages per consumer. Calling each system from the producer couples it to every consumer, a single shared queue splits messages between consumers instead of delivering each to all, and a one-shard stream makes every consumer read and discard what it does not need.
Want more questions like this? Full SAP-C03 practice tests →
Question 2. Thousands of concurrent Lambda invocations open connections to an Amazon RDS for PostgreSQL database, which runs out of connections during spikes. The team wants to fix this with minimal code change. What should the architect add?
- A. A much larger database instance class only
- B. A read replica for the function
- C. A shorter Lambda timeout
- D. Amazon RDS Proxy between the functions and the database
Show answer
Answer: D
RDS Proxy pools and shares database connections, so many short-lived Lambda invocations reuse a smaller number of connections to the database. A larger instance raises the limit only partly and costs more, a read replica does not help writes, and reducing the Lambda timeout does not reduce how many connections are opened.
Want more questions like this? Full SAP-C03 practice tests →
Question 3. A gaming company serves players in North America, Europe and Asia. Players must read and write their profile with single-digit-millisecond latency in their own Region, and a Region failure must not stop writes elsewhere. Which data store design fits?
- A. A DynamoDB global table with replicas in the three Regions
- B. One DynamoDB table in a single Region with CloudFront in front
- C. An RDS database with cross-Region read replicas
- D. Profile objects in an S3 bucket in one Region
Show answer
Answer: A
DynamoDB global tables replicate across Regions with multi-Region writes, so each Region serves reads and writes locally and keeps working if another Region fails; with the default multi-Region eventual consistency mode, concurrent writes to the same item are resolved by last writer wins. A single-Region table adds cross-Region latency and is a single point of failure, a cross-Region read replica accepts writes only in the primary Region, and S3 is not suited to low-latency item updates.
Want more questions like this? Full SAP-C03 practice tests →
Question 4. A team already runs applications on Kubernetes with Helm charts and wants to move to AWS, keeping the Kubernetes API and manifests, while minimizing the work of managing worker nodes, scaling and patching them. What should the architect choose?
- A. Self-managed Kubernetes on EC2 instances
- B. Amazon ECS with task definitions rewritten from the manifests
- C. Amazon EKS with EKS Auto Mode
- D. Rewrite every service as a Lambda function
Show answer
Answer: C
Amazon EKS keeps the Kubernetes API and manifests, and EKS Auto Mode lets AWS manage the worker node infrastructure, including node provisioning, autoscaling, patching (nodes are replaced at least every 21 days) and the load balancing, networking and block storage components. Self-managed Kubernetes on EC2 keeps all of that work with the team, ECS uses a different API and would require rewriting the deployment definitions, and Lambda is not a general container platform for existing Helm charts.
Want more questions like this? Full SAP-C03 practice tests →
Question 5. Outbound traffic from workloads in 40 VPCs must pass through one inspection point that applies stateful rules and domain-name filtering, and the design must not require a firewall in every VPC. What should the architect build?
- A. Security groups with a rule per approved domain in each VPC
- B. AWS Network Firewall in a central inspection VPC, with VPCs attached through a Transit Gateway
- C. A firewall deployed in each of the 40 VPCs
- D. VPC peering from every VPC to one shared VPC
Show answer
Answer: B
A central inspection VPC with AWS Network Firewall, reached through a Transit Gateway that all the VPCs attach to, gives one place for stateful and domain-based rules. Security groups and network ACLs in each VPC do not provide central domain filtering, and a firewall per VPC is exactly what the requirement rules out. VPC peering is not transitive, so it does not route traffic through a shared inspection point.
Want more questions like this? Full SAP-C03 practice tests →
Security, compliance, and governance
Question 6. A company wants every bucket policy to guarantee that only principals belonging to its AWS Organization can read from the bucket, now and for accounts added later, without listing account IDs. Which condition should be used?
- A. A list of account IDs in the Principal element
- B. An aws:SourceIp condition for the company network
- C. An aws:PrincipalOrgID condition with the organization ID
- D. An aws:MultiFactorAuthPresent condition
Show answer
Answer: C
The aws:PrincipalOrgID global condition key matches the ID of the organization the calling principal belongs to, so new accounts in the organization are covered without editing the policy. Listing account IDs needs an update for each new account, a source IP condition does not identify who the principal is, and a requirement for MFA does not restrict access to the organization.
Want more questions like this? Full SAP-C03 practice tests →
Question 7. A third-party monitoring vendor needs read access to resources in the company's account. The company wants to prevent the vendor's role from being tricked into acting for another vendor customer, the confused deputy problem. What should the role's trust policy use?
- A. The vendor’s account as principal with a condition on a unique external ID
- B. A long-lived access key for an IAM user shared with the vendor
- C. The vendor’s account as principal with no conditions
- D. A wildcard principal protected by the vendor’s IP range
Show answer
Answer: A
An external ID, a unique value agreed between the company and the vendor and required in the sts:AssumeRole call through a condition in the trust policy, prevents another customer of the vendor from using the vendor’s access to reach this account. Sharing an access key is long-lived and unsafe, trusting the whole vendor account without a condition leaves the problem open, and a public trust policy would allow anyone to assume the role.
Want more questions like this? Full SAP-C03 practice tests →
Question 8. A security team wants one place to see findings about suspicious behavior such as instances talking to known malicious addresses, across all accounts of an organization, with new accounts covered automatically. Which approach fits?
- A. Enable GuardDuty manually in each account when it is created
- B. Store VPC flow logs in S3 and search them when needed
- C. Download reports from AWS Artifact each month
- D. GuardDuty with a delegated administrator and automatic enablement for the organization
Show answer
Answer: D
Amazon GuardDuty with a delegated administrator account and auto-enable for organization members gives central findings and covers new accounts automatically. Enabling it by hand per account misses new accounts, VPC flow logs alone are raw data without threat detection, and AWS Artifact provides compliance reports, not threat findings.
Want more questions like this? Full SAP-C03 practice tests →
Question 9. A company runs a batch application on servers in its own data centre. The application must call Amazon S3 and Amazon SQS in an AWS account. The security team forbids long-lived access keys on the servers, and the company already runs an internal certificate authority that issues X.509 certificates to its servers. What should the architect configure?
- A. IAM Roles Anywhere, with the internal CA registered as a trust anchor and a profile that references an IAM role
- B. An IAM user per server, with access keys rotated by hand every 90 days
- C. An EC2 instance profile attached to each on-premises server
- D. An Amazon Cognito user pool where each server signs in with a user name and password
Show answer
Answer: A
IAM Roles Anywhere lets workloads outside AWS exchange an X.509 certificate issued by a trusted CA, registered as a trust anchor, for temporary credentials of an IAM role named in a profile, so no long-term keys are stored on the servers. IAM user access keys are long-lived, an instance profile exists only for EC2 instances, and a Cognito user pool authenticates application users and does not hand IAM role credentials to servers.
Want more questions like this? Full SAP-C03 practice tests →
Question 10. A regulation requires the encryption keys that protect an organization's S3 and EBS data to be customer managed, so the company controls the key policy, and to be rotated at least once a year with no application changes. What is the simplest way to meet this?
- A. AWS managed keys for each service, relying on their yearly rotation
- B. A new KMS key every year, with every application pointed at the new key
- C. A symmetric customer managed KMS key with automatic key rotation enabled
- D. A customer managed key with imported key material and automatic key rotation enabled
Show answer
Answer: C
Automatic rotation on a symmetric customer managed KMS key with KMS-generated key material creates new key material every 365 days by default (the period is configurable), while the key ID, ARN and aliases stay the same and old material is kept to decrypt existing data, so applications need no change. AWS managed keys also rotate yearly but the company cannot control their key policy, a new key every year means repointing every application, and keys with imported key material do not support automatic rotation, only on-demand rotation.
Want more questions like this? Full SAP-C03 practice tests →
Cost-optimized architecture design
Question 11. A data lake holds hundreds of terabytes in S3 Standard. Some datasets are read daily and others are untouched for months, and nobody can predict which. The company wants lower storage cost without retrieval charges and without managing lifecycle rules per dataset. What should the architect use?
- A. A lifecycle rule moving everything to S3 Glacier Flexible Retrieval after 30 days
- B. S3 Intelligent-Tiering
- C. S3 One Zone-IA for all objects
- D. Keep everything in S3 Standard
Show answer
Answer: B
S3 Intelligent-Tiering moves objects between access tiers automatically based on observed access, with no retrieval charges, and it adds a small monthly monitoring and automation charge per object. A fixed lifecycle rule to Glacier would make frequently read data slow and expensive to retrieve, one-zone storage reduces resilience without solving access patterns, and keeping everything in Standard gives no savings.
Want more questions like this? Full SAP-C03 practice tests →
Question 12. A development database is queried only during working hours and is idle most of the night and weekends. It runs on a large provisioned Aurora instance 24 hours a day. Which change reduces cost the most while keeping the engine compatible?
- A. Buy a three-year reservation for the large instance
- B. Move to an even larger instance for faster queries
- C. Use Aurora Serverless v2 so capacity follows the load
- D. Install the database engine on EC2 and manage it manually
Show answer
Answer: C
Aurora Serverless v2 scales capacity with load, and with a minimum capacity of 0 ACUs it pauses automatically after a configurable idle period (5 minutes to 24 hours) when no connections are open, with no instance charge while paused; the first connection after a pause takes roughly 15 seconds. Reserving the large instance commits to paying for idle time, a bigger instance costs more, and moving to a self-managed database on EC2 adds operational work without addressing idle cost.
Want more questions like this? Full SAP-C03 practice tests →
Question 13. A company transfers about 50 TB per month, steadily, from AWS to its data centre, and the internet data transfer charges are high. The company also wants consistent network performance. Which option reduces the transfer cost and meets the performance goal?
- A. A Site-to-Site VPN over the internet
- B. A NAT gateway for the outbound traffic
- C. S3 Transfer Acceleration
- D. AWS Direct Connect
Show answer
Answer: D
AWS Direct Connect provides a dedicated connection with a much lower data transfer out rate than internet egress (about $0.02 per GB to a US location) plus a port-hour fee, and more consistent network performance. A Site-to-Site VPN over the internet still pays internet-rate transfer and has variable performance, a NAT gateway adds processing charges and serves outbound traffic from private subnets rather than lowering transfer cost, and S3 Transfer Acceleration speeds uploads to S3 rather than lowering outbound transfer costs.
Want more questions like this? Full SAP-C03 practice tests →
Resilience, migration, and business continuity
Question 14. A company will rehost 200 on-premises servers to Amazon EC2. It wants continuous block-level replication, non-disruptive testing of cutover instances and a short final cutover window. Which service fits?
- A. AWS Database Migration Service
- B. AWS Transform MGN (formerly AWS Application Migration Service)
- C. AWS DataSync
- D. Rebuilding each server by hand on EC2
Show answer
Answer: B
AWS Transform MGN, the service formerly named AWS Application Migration Service, continuously replicates source servers at block level, lets you launch test instances without disrupting the source, and keeps the cutover window short, typically minutes. AWS Database Migration Service moves databases rather than whole servers, DataSync copies files and objects rather than whole servers, and a manual rebuild of each server is slow and error-prone at this scale.
Want more questions like this? Full SAP-C03 practice tests →
Question 15. An active-passive application runs in two Regions. The team wants to switch traffic to the standby Region using a mechanism that does not rely on the control plane of the Region that may be failing, with safety checks against shifting traffic wrongly. What should be used?
- A. Edit the DNS records by hand during an incident
- B. Increase the DNS record TTL to one day
- C. Route 53 Application Recovery Controller routing controls with safety rules
- D. An Auto Scaling policy in the standby Region
Show answer
Answer: C
Amazon Application Recovery Controller (Route 53 ARC) routing controls are on-off switches held in a cluster whose data plane spans endpoints in five AWS Regions, and you flip them through that data plane; routing control health checks tied to Route 53 failover records shift the traffic, and safety rules guard against wrong state changes. Editing DNS records by hand relies on the standard control plane with no safeguards, a longer TTL slows failover, and an Auto Scaling policy does not redirect traffic between Regions.
Want more questions like this? Full SAP-C03 practice tests →
Question 16. After a ransomware scare, the company wants backups of its workloads copied to a separate account and made immutable, so even an administrator cannot delete them before the retention period ends. What should the architect configure?
- A. Manual snapshots in the production account
- B. S3 versioning on one bucket
- C. A cron job with administrator rights that copies snapshots
- D. AWS Backup with cross-account copy to a vault protected by Backup Vault Lock
Show answer
Answer: D
AWS Backup can copy recovery points to a vault in another account, and Backup Vault Lock in compliance mode makes the vault immutable once its grace time (at least 3 days) has passed, so recovery points cannot be deleted before their retention ends, even by the root user. Manual snapshots in the same account stay exposed to the same credentials, versioning on a bucket does not protect other resources, and a cron job running with administrator rights can be abused in the same way.
Want more questions like this? Full SAP-C03 practice tests →
Operational excellence and automation
Question 17. Hundreds of EC2 instances in several accounts must be patched on a schedule without opening SSH or using bastion hosts, and the team needs a compliance report on patch status. What should be used?
- A. Systems Manager Patch Manager with a maintenance window and a patch baseline
- B. Engineers log in to each instance and run updates
- C. A bastion host with a script that logs in to every instance
- D. Rebuild the AMI once a year and relaunch
Show answer
Answer: A
Systems Manager Patch Manager applies patch baselines on a schedule, for example through maintenance windows, using the SSM Agent, needs no inbound SSH, and reports patch compliance. Logging in to each instance by hand does not scale, a bastion host keeps inbound access open, and rebuilding the AMI once a year leaves running instances unpatched in between and gives no patch compliance report.
Want more questions like this? Full SAP-C03 practice tests →
Question 18. A team suspects that someone changed a security group by hand in the console after a CloudFormation stack deployed it. How can the team find out which resources no longer match the template?
- A. Create a change set for the stack
- B. Run drift detection on the stack
- C. Enable termination protection on the stack
- D. Create a CloudWatch alarm on CPU utilization
Show answer
Answer: B
CloudFormation drift detection compares the actual configuration of the stack’s resources with the template and reports resources that were modified or deleted outside CloudFormation. A change set previews a future update, enabling termination protection only prevents deleting the stack, and CloudWatch alarms on CPU do not compare configuration with a template.
Want more questions like this? Full SAP-C03 practice tests →
Question 19. A company has 25 workload accounts in one AWS Organization. Operators want one monitoring account to view metrics, logs and traces from all of them in a single console, without building export pipelines. What should the architect set up?
- A. Export every account’s logs to S3 and merge them each night
- B. Share one IAM user with access to all accounts
- C. CloudWatch cross-account observability with a monitoring account and linked source accounts
- D. Ask operators to switch roles into each account in turn
Show answer
Answer: C
CloudWatch cross-account observability lets a monitoring account create a sink and source accounts link to it, individually or through AWS Organizations, so their metrics, log groups and X-Ray traces can be searched and visualized from one account with no export pipeline to build. Exporting logs to S3 and merging them is delayed and needs custom work, sharing one IAM user across accounts breaks accountability, and switching roles into each account separately does not give a single combined view.
Want more questions like this? Full SAP-C03 practice tests →
Question 20. A company wants a pipeline that builds a hardened golden AMI every month, runs tests on it, and distributes it to selected accounts and Regions, with no custom orchestration code. Which service should it use?
- A. Launch an instance by hand each month and create an image
- B. A custom Lambda function that orchestrates the build and tests
- C. AWS Backup with a monthly plan
- D. An EC2 Image Builder pipeline with a schedule and distribution settings
Show answer
Answer: D
EC2 Image Builder defines pipelines that build images from a recipe, test them, and distribute them to chosen accounts and Regions on a schedule. Launching an instance and saving an AMI by hand is not repeatable, a Lambda function with custom code is the orchestration the team wants to avoid, and AWS Backup protects existing resources rather than building images.
Want more questions like this? Full SAP-C03 practice tests →
How did you do?
Seventeen or more correct is a strong result for this level. Questions 1 to 5 map to architecture design and implementation built for the cloud, 6 to 10 to security, compliance and governance, 11 to 13 to cost-optimized design, 14 to 16 to resilience, migration and continuity and 17 to 20 to operational excellence and automation. The sample questions add five more, and the study plan schedules the domains.