AWS Solutions Architect – Associate Review (SAA-C03)
The logical next step after the Cloud Practitioner: learn to design secure, resilient, high-performing and cost-optimized architectures on AWS. Original cards written from the official exam guide and the AWS documentation. Voyelle is not affiliated with Amazon Web Services. AWS and SAA-C03 are trademarks of their respective owners.
- 215 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Design Secure Architectures30 %
- Design Resilient Architectures26 %
- Design High-Performing Architectures24 %
- Design Cost-Optimized Architectures20 %
A few cards from the deck
An application running on an Amazon EC2 instance needs to read objects from an Amazon S3 bucket. What is the MOST secure way to grant it access?
- Make the bucket publicly readable and filter by IP address in the application
- Attach an IAM role (through an instance profile) to the instance that allows reading from the bucket
- Pass the root user's access keys in the instance user data
- Store an IAM user's access keys in a configuration file on the instance
Show the answer
Attach an IAM role (through an instance profile) to the instance that allows reading from the bucket
An IAM role attached through an instance profile provides temporary credentials that AWS STS rotates automatically. No long-term keys are stored on the instance, so there is nothing to steal and nothing to rotate manually. IAM user access keys (and even more so root user keys) are long-term secrets that should never live in code or configuration.
What are the three main storage types, and one AWS service for each?
Show the answer
Object: Amazon S3. File: Amazon EFS or Amazon FSx. Block: Amazon EBS (or instance store).
Object storage is addressed by key through an HTTP API and scales almost without limit. File storage provides a shared hierarchy over NFS or SMB. Block storage appears as a disk attached to an instance, for a file system or a database.
The S3 Standard-IA and One Zone-IA storage classes have a minimum billable storage duration of …; S3 Glacier Instant Retrieval and Glacier Flexible Retrieval …; S3 Glacier Deep Archive 180 days.
Show the answer
The S3 Standard-IA and One Zone-IA storage classes have a minimum billable storage duration of 30 days; S3 Glacier Instant Retrieval and Glacier Flexible Retrieval 90 days; S3 Glacier Deep Archive 180 days.
Deleting or transitioning an object before that duration incurs a charge for the remaining days. These classes are therefore suited to data that stays in place for a long time, not to temporary files.
An ordering application receives unpredictable spikes; order processing must never lose a message, even when the processing servers are overloaded. Which service BEST decouples order intake from processing?
- Amazon SNS alone, with no durable subscription
- A direct HTTP call between the front end and the processing servers
- Amazon SQS, with the processing servers consuming from the queue
- A larger EC2 instance for processing
Show the answer
Amazon SQS, with the processing servers consuming from the queue
An SQS queue absorbs spikes: messages wait durably until a consumer processes them, and each side scales independently. A direct call propagates overload back to the front end. SNS pushes messages to subscribers without storing them if no one receives them.
What does a service control policy (SCP) do in AWS Organizations?
Show the answer
It sets the maximum permissions available to the member accounts in an OU or to a single account. It never grants permissions on its own.
An SCP is a guardrail: even an administrator in a member account cannot go beyond what it allows. An IAM policy that grants the action is always required as well. SCPs do not affect users and roles in the management account.
The S3 Standard-IA and One Zone-IA storage classes have a minimum billable storage duration of …; S3 Glacier Instant Retrieval and Glacier Flexible Retrieval …; S3 Glacier Deep Archive 180 days.
Show the answer
The S3 Standard-IA and One Zone-IA storage classes have a minimum billable storage duration of 30 days; S3 Glacier Instant Retrieval and Glacier Flexible Retrieval 90 days; S3 Glacier Deep Archive 180 days.
Deleting or transitioning an object before that duration incurs a charge for the remaining days. These classes are therefore suited to data that stays in place for a long time, not to temporary files.
Cards are written from the official outline published for the exam, never from real exam questions. Voyelle is not affiliated with Amazon Web Services. AWS is a trademark of its owner.