Try 12 free AWS Solutions Architect Associate practice questions
Real exam-style questions taken word for word from the AWS Solutions Architect Associate study guide. Three are below, with the full answer explanation. Enter your email and the full 12-question PDF is yours.
Unlock the full sampler
Three questions to try right now
Work each one before you open the answer. These are the same style and depth as the AWS Certified Solutions Architect Associate (SAA-C03) exam expects.
Question 1. A company enables automatic rotation for a customer-managed KMS key (CMK) in AWS KMS. After the first rotation, an application reports that it can no longer decrypt existing data encrypted with the key. What is the MOST likely cause?
- A. KMS deletes the old key material after rotation, making old ciphertext unreadable.
- B. The key ID or ARN changed after rotation, and the application is referencing the old identifier.
- C. The application is not correctly calling kms:Decrypt, it may be calling kms:Encrypt instead.
- D. This should not happen. KMS automatic rotation retains all previous key material, and old ciphertext remains decryptable using the same key ID and ARN.
Show the answer
Answer: D. KMS automatic rotation creates new key material every year while retaining all previous versions of the key material. The key ID, ARN, and all aliases remain unchanged. When the application calls kms:Decrypt with old ciphertext, KMS automatically identifies which version of the key material was used to encrypt the ciphertext data key and decrypts it with that version, no application changes required, no re-encryption of existing data required. Old data becoming unreadable after automatic rotation is not expected behavior of AWS KMS automatic rotation.
- A: KMS does not delete old key material after automatic rotation. All prior versions are retained internally for as long as the CMK exists. Deletion only occurs if you schedule key deletion or perform a manual key rotation where you explicitly schedule the old CMK for deletion.
Question 2. A security engineer needs to block a specific known-malicious IP address range (203.0.113.0/24) from accessing an Application Load Balancer. The block must take effect immediately and must not affect legitimate traffic from other addresses. Which is the MOST direct solution?
- A. Update the ALB security group to add a deny rule for 203.0.113.0/24 on port 443.
- B. Create a Network ACL rule with a deny action for 203.0.113.0/24 and associate it with the subnets containing the ALB.
- C. Create an AWS WAF IP set containing 203.0.113.0/24. Add a rule to the Web ACL associated with the ALB that blocks requests from this IP set.
- D. Use AWS Shield Standard to automatically detect and block 203.0.113.0/24 traffic.
Show the answer
Answer: C. AWS WAF with an IP set rule is the most direct, purpose-built mechanism for blocking specific IP ranges at the ALB. Create an IP set containing 203.0.113.0/24, add a rule to the associated Web ACL that blocks matching source IPs, and the block takes effect immediately. WAF integrates directly with ALBs and evaluates rules per request. The IP set can be updated rapidly as threat intelligence evolves.
- A: Security groups are allow-only, they do not support deny rules. You cannot add a deny rule to a security group for a specific CIDR. Security group rules only specify what is allowed; everything not explicitly allowed is implicitly denied, but there is no explicit deny for a subset of traffic.
Question 3. A company's development team creates IAM roles for Lambda functions but frequently grants broader permissions than the functions need. Which control BEST limits the maximum permissions any Lambda execution role can have, without modifying each role's identity policy individually?
- A. Attach an SCP to the OU containing the development account that restricts Lambda execution role permissions.
- B. Enable AWS IAM Access Analyzer to generate least-privilege policies for all Lambda roles.
- C. Define a permissions boundary policy. Require that all Lambda execution roles are created with this permissions boundary attached.
- D. Use AWS Trusted Advisor to identify over-privileged Lambda roles and alert the team weekly.
Show the answer
Answer: C. Permissions boundaries set the maximum permissions an IAM entity (user or role) can exercise. By defining a boundary policy scoped to only what Lambda functions are expected to need, and mandating that all Lambda execution roles must be created with this boundary, the effective permissions for any Lambda role become the intersection of its identity policy and the boundary, regardless of how broadly the development team writes the identity policy. This is a preventive control that does not require modifying individual role policies.
- A: SCPs apply to principals in the member account collectively, they cap what any IAM principal can do. An SCP that restricts Lambda execution role permissions would also apply to other principals in the account and may be too blunt a tool for this targeted requirement. Permissions boundaries are the purpose-built mechanism for per-role maximum permission control.
Unlock the full 12-question sampler
All 12 come with the same written explanations the book uses, covering why the right answer is right. We email you the PDF, nothing else.
What you get
The sampler is free. Here is exactly what lands in your inbox.
Print it or work it on screen, then score yourself against the answer key.
Nothing is written for marketing. Every question is lifted from the study guide itself.
A few days later we send one email with a code for the full study guide. That is the entire sequence.
The full AWS Solutions Architect Associate study guide
The complete guide covers the AWS Certified Solutions Architect Associate (SAA-C03) exam objective by objective in plain English, with the full practice question bank behind these samples.
From $20.99
Simply Certified is an independent publisher. AWS is a trademark of Amazon Web Services, Inc., which does not sponsor or endorse this product. This page and the sampler are independent study material and are not affiliated with, endorsed by, or sponsored by AWS.