Free SAP-C03 sample questions
These five original scenario questions cover architecture topics that appear in both the outgoing and the updated Solutions Architect – Professional exams: governance, resilience, networking, migration and cost. Questions 1 and 3 touch the security and governance domain, 2 and 4 the resilience and migration domain, and 5 the cost domain of the five SAP-C03 domains in the AWS exam guide. They are written for this site and are not real exam questions. Answer first, then open the explanation.
Question 1. A company runs 60 AWS accounts in one organization. Security requires that no account administrator, including root users of member accounts, can stop or delete the organization-wide CloudTrail trail. What is the best way to enforce this?
- A. Attach an IAM policy denying the actions to every administrator role in each account
- B. Attach a service control policy that denies the CloudTrail stop and delete actions
- C. Create an AWS Config rule that flags the trail when it is stopped
- D. Create a CloudWatch alarm on StopLogging events and notify the security team
Show answer
Answer: B
A service control policy attached to the organization root or relevant OUs sets a maximum permission boundary that applies to every principal in member accounts, including their root users, so denying the CloudTrail stop and delete actions enforces the rule centrally. IAM policies inside each account can be changed by that account’s administrators, AWS Config only detects, and a CloudWatch alarm only notifies after the fact.
Want more questions like this? Full SAP-C03 practice tests →
Question 2. A critical application uses Amazon Aurora in one Region. The business requires recovery in another Region within minutes and data loss of at most a few seconds, but does not want to pay for a full duplicate production environment. Which approach fits best?
- A. Copy automated snapshots to the second Region and restore after a failure
- B. Run a full active-active duplicate environment in both Regions
- C. Use an Aurora Global Database with a scaled-down warm standby in the second Region
- D. Export the database to Amazon S3 nightly and import it during a disaster
Show answer
Answer: C
A warm standby with an Aurora Global Database replicates storage asynchronously across Regions, typically within about a second, and keeps a scaled-down copy of the application tier that can be scaled up and promoted in minutes. Cross-Region snapshot restores take far longer and lose more data, an active-active full duplicate exceeds the cost constraint, and nightly exports cannot meet a seconds-level RPO.
Want more questions like this? Full SAP-C03 practice tests →
Question 3. An enterprise has 300 VPCs across 80 accounts. Workloads in any VPC must reach shared services and on-premises networks, and the connection model must scale without managing a mesh of individual links. What should the architect use?
- A. Full-mesh VPC peering between all VPCs
- B. Route inter-VPC traffic over internet gateways with security groups
- C. Move all workloads into one large shared VPC
- D. An AWS Transit Gateway with VPC and on-premises attachments
Show answer
Answer: D
AWS Transit Gateway acts as a regional hub to which many VPCs and VPN or Direct Connect attachments connect, giving transitive routing without per-pair links. VPC peering is not transitive and would need a very large number of connections, internet gateways would expose traffic unnecessarily, and a single shared VPC for everything removes account-level isolation.
Want more questions like this? Full SAP-C03 practice tests →
Question 4. A company must move 400 TB of archive data to Amazon S3 once. The data centre has a 100 Mbps internet link that is also used for business traffic, and the move should finish within a few weeks. Which option is most appropriate?
- A. Order AWS Snowball Edge devices and ship the data
- B. Upload with the AWS CLI over the existing link
- C. Enable S3 Transfer Acceleration and upload over the existing link
- D. Run AWS DataSync over the existing link
Show answer
Answer: A
At 100 Mbps, 400 TB would take roughly a year to transfer even with the link fully dedicated, so physical transfer with AWS Snowball Edge devices is the practical choice for a one-time bulk load. Upgrading and using DataSync or direct uploads still depends on network speed, and S3 Transfer Acceleration helps with distance, not with a link that is too small.
Want more questions like this? Full SAP-C03 practice tests →
Question 5. A company runs a steady fleet of Amazon EC2 instances 24 hours a day, expects to keep running it for three years, and expects to change instance families and Regions as it modernizes. Which purchasing choice gives the best discount with the most flexibility?
- A. Three-year Standard Reserved Instances for the current instance family
- B. Spot Instances for the whole fleet
- C. On-Demand Instances, reviewed annually
- D. A three-year Compute Savings Plan
Show answer
Answer: D
Compute Savings Plans commit to a spend per hour and apply across instance families, sizes, Regions, and even Fargate and Lambda usage, so they keep discounting after the fleet changes. Standard Reserved Instances lock the instance family and Region, Spot instances can be interrupted and suit fault-tolerant work, and On-Demand carries no commitment discount.
Want more questions like this? Full SAP-C03 practice tests →
After the questions
The domain pages (security, resilience and migration, cost) hold more practice. Professional questions test trade-offs under constraints: here, central enforcement, recovery targets, scale, data volume and commitment. If you missed one, find the constraint you did not weigh. The study plan assigns each of these domains a week, and study resources lists official AWS practice material.