Associate-level AWS certification covering secure, resilient, high-performing and cost-optimised architecture design on AWS, with a worked explanation on every practice question.
Free sample questions
No account needed. Every question has a worked explanation, just like the full bank.
lock_openFree sampleDesign Secure Architecturesmedium
A company runs an application on Amazon EC2 instances that must read objects from a specific Amazon S3 bucket. Developers currently store long-lived IAM user access keys in the application configuration file. A solutions architect must remove the static credentials while granting only the access the application needs. Which approach best meets these requirements?
- AAttach an IAM role to the EC2 instances with a policy that allows the s3:GetObject action on the specific bucket, and have the application use the role credentials.check_circle Correct
- BCreate an IAM user with an S3 read-only managed policy and embed its access key and secret key in the EC2 instance user data at launch.
- CAttach an IAM role to the EC2 instances that grants the AdministratorAccess managed policy so the application can reach the bucket without stored keys.
- DStore the IAM user access keys in AWS Secrets Manager and have the running application retrieve the same long-lived keys at startup.
Use IAM roles with instance profiles to give EC2 workloads scoped temporary credentials instead of storing long-lived access keys. An IAM role attached through an instance profile delivers short-lived credentials retrieved from the instance metadata service and rotated automatically, eliminating static keys, while a resource-scoped s3:GetObject policy enforces least privilege.
Why A is correct: An instance profile role supplies automatically rotated temporary credentials and a scoped GetObject policy on one bucket grants least privilege without any static keys.
Why B is wrong: Moving the key to user data still relies on long-lived static credentials that can leak, so it fails the requirement to remove static credentials entirely.
Why C is wrong: A role does remove static keys, but AdministratorAccess grants far more than the read access needed and violates the least-privilege requirement badly.
Why D is wrong: Secrets Manager protects the keys at rest, but the application still authenticates with long-lived IAM user credentials rather than removing them as required.
lock_openFree sampleDesign Secure Architecturesmedium
An identity-based policy attached to a developer grants s3:DeleteObject on a bucket, while a bucket policy on the same bucket contains an explicit Deny for s3:DeleteObject from any principal outside the production account. The developer belongs to the production account. When the developer attempts to delete an object, what is the result of IAM policy evaluation?
- AThe request is denied because an explicit Deny in any applicable policy always overrides any Allow during evaluation.
- BThe request is allowed because the identity-based Allow applies and the explicit Deny condition does not match an in-account principal.check_circle Correct
- CThe request is denied because a resource-based policy always takes precedence over an identity-based policy in cross-policy evaluation.
- DThe request is denied by implicit Deny because two conflicting statements remove the developer permission to act on the object.
Evaluate IAM requests by combining identity and resource policies, applying explicit Deny only when its conditions actually match the principal. IAM evaluation starts at implicit Deny, unions all applicable Allows, then lets any matching explicit Deny override; because the bucket Deny is conditioned on external principals it never matches an in-account developer, leaving the Allow effective.
Why A is wrong: Explicit Deny does win over Allow, but the Deny here is conditioned on principals outside the production account, so it does not apply to this in-account developer.
Why B is correct: The Deny targets only external principals, so it is not triggered for an in-account developer, and the matching identity-based Allow with no other Deny permits the action.
Why C is wrong: Resource and identity policies are evaluated together as a union of Allows rather than one type overriding the other, so this stated precedence rule is incorrect.
Why D is wrong: Implicit Deny applies only when no Allow exists, but an explicit Allow is present here, so the implicit Deny reasoning does not hold for this request.
lock_openFree sampleDesign Secure Architecturesmedium
A company has 60 engineers who each need identical permissions to manage Amazon EC2 and Amazon RDS resources in a development account. The security team wants to manage these permissions in one place and apply future permission changes once rather than editing each identity. How should a solutions architect grant the access?
- AAttach the EC2 and RDS managed policies directly to each of the 60 IAM users so every engineer holds an independent copy of the permissions.
- BCreate one shared IAM user with the EC2 and RDS permissions and distribute its access keys to all 60 engineers for daily use.
- CCreate an IAM group with the EC2 and RDS policies attached and add all 60 engineers to that group as members.check_circle Correct
- DCreate a federated identity provider and require every engineer to assume a unique role per session before they can touch any resource.
Use IAM groups to manage one shared permission set for many users so policy changes are applied in a single place. An IAM group is a collection of users that share attached policies, so editing the group policy updates every member at once while each user keeps a separate sign-in identity, giving central management with individual accountability.
Why A is wrong: Direct per-user attachment works initially but forces 60 separate edits for any future change, which is exactly the management burden the team wants to avoid.
Why B is wrong: A shared identity removes individual accountability and spreads long-lived keys widely, so it is an insecure and untraceable way to grant the access.
Why C is correct: An IAM group centralises the policy set so future changes are made once on the group, while each engineer keeps a distinct, auditable individual identity.
Why D is wrong: Federation is valid for external identities, but it adds setup overhead and does not by itself centralise editing the shared permission set as a group would.
Frequently asked questions
- How many questions are on the SAA-C03 exam?
- The AWS Certified Solutions Architect - Associate (SAA-C03) exam has 65 questions and runs for 130 minutes. The format is multiple choice and multiple response.
- What score do I need to pass SAA-C03?
- The pass mark is 720 / 1000. Examworthy gives you a per-domain readiness score so you can see which domains are holding you back before you book.
- How much does the SAA-C03 exam cost?
- The exam costs 150 USD to sit. Practising on Examworthy is free to start, with a worked explanation on every question.
- How does Examworthy help me prepare for SAA-C03?
- Every practice question carries a worked explanation and a per-distractor rationale, mapped to the official blueprint domains. You learn why each answer is right or wrong, not just the letter.
- Is Examworthy affiliated with Amazon Web Services?
- No. Examworthy is not affiliated with or endorsed by Amazon Web Services. Our questions are original, blueprint-aligned practice material; we never reproduce live exam items.
Examworthy is not affiliated with or endorsed by Amazon Web Services. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. SAA-C03 and related marks belong to their respective owners.
