AWSOctober 14, 202620 min read

SAA-C03 Scenario Questions: How to Read and Answer Them (2026)

Most of the SAA-C03 is a reading test. Here is how to find the constraint, the qualifier and the noise in a stem, with three examples taken apart option by option.

  • 65Questions
  • 130 minTime
  • 720/1000Pass mark
  • ~2 minPer question
  • LEAST overheadKey qualifier
SAA-C03 scenario questions decoded - keywords, qualifiers and traps

Table of Contents

SAA-C03 has a reputation as a test of how many AWS services you know. In practice most items are short architecture briefs: a company, its current setup, two or three requirements, and a final line that ranks the options, such as LEAST operational overhead or MOST cost-effective. Usually two answers would work in the real world. Only one survives every requirement in the stem and then wins on the qualifier.

That makes the exam a reading test layered on a knowledge test. Phrases like 'decouple', 'without managing servers' or 'keys the company controls' point at specific services, and the wrong answers often carry the right service name in the wrong variant. This guide shows how to decode a stem: which words eliminate options, which word ranks the survivors, which details are there only to distract, and how the distractors are built. The three worked scenarios are original, written against the published SAA-C03 outline.

The one rule for reading SAA-C03 stems

Read every stem as a filter: constraints remove options, the qualifier ranks what is left, and everything else is scenery.

Most SAA-C03 distractors are real services used in a reasonable way, so asking 'would this work?' leaves two or three candidates. Asking 'which stated requirement does this break?' usually leaves one. The qualifier only does its job after the constraints have done theirs.

Read it like this

  • Read the final question line first
  • List the hard requirements before the options
  • Name the constraint that kills each wrong answer

Not like this

  • Pick the first option that names the keyword's service
  • Rank on the qualifier before checking constraints
  • Add requirements the stem never states

The 5-step decode routine

Run the same five steps on every scenario. The time on each step is a target for a practised reader, not a rule; the order is the part that matters.

  1. ~10s

    Read the ask line

    Find the qualifier (LEAST operational overhead, MOST cost-effective, MOST secure, or none) and check for Choose two or Choose three. This tells you what kind of ranking happens last and how many answers to select.

  2. ~30s

    Pull out the hard constraints

    Mark anything stated as must, required or cannot: retention, recovery time, no internet path, key control, latency, a deadline. These are the phrases that eliminate options.

  3. ~20s

    Translate keywords to services

    Map each requirement phrase to the service or pattern it usually points to: decouple to Amazon SQS, keys the company controls to a customer managed KMS key, can be interrupted to Spot Instances.

  4. ~40s

    Eliminate option by option

    Test each option against each constraint and strike it the moment one fails, saying which one. Do not compare options with each other yet.

  5. ~20s

    Rank the survivors

    Apply the qualifier only to what is left. Managed services and fewer moving parts win on overhead; the cheapest surviving option wins on cost.

Anatomy of a SAA-C03 scenario

Every highlighted phrase below is pinned to a note. Four kinds of phrase matter:

  • Constrainta hard requirement that eliminates options
  • Qualifierthe word that ranks the survivors
  • Keywordpoints at a specific service, control or concept
  • Noiselooks important, changes nothing
Scenario 1 · Design Secure ArchitecturesSingle answer

Keys the company controls

A company stores quarterly financial reports in an Amazon S3 bucket1. A new audit rule requires that the company controls the encryption keys2, can disable a key immediately3 if it is suspected of compromise, and keeps a log of every use of the key4. The reports are produced each night by an application on Amazon EC25. The security team has two people and does not want to write or maintain encryption code6.

Which solution meets these requirements with the LEAST operational overhead?

  1. 1Keyword. The data stays in S3, so the answer is an S3 encryption setting. Candidates: SSE-S3, SSE-KMS with either key type, or client-side encryption.
  2. 2Constraint. Removes keys that AWS manages: SSE-S3 and the AWS managed aws/s3 key. Leaves a customer managed KMS key or CloudHSM.
  3. 3Constraint. A customer managed KMS key can be disabled at any time. An AWS managed key cannot be disabled or have its key policy changed.
  4. 4Keyword. Points to AWS KMS with CloudTrail, which records each GenerateDataKey and Decrypt request made against the key.
  5. 5Noise. Where the reports come from changes nothing. The detail is there to make client-side encryption in that application look natural.
  6. 6Qualifier. The overhead tie-breaker. KMS and CloudHSM both give the company key control; only KMS needs no code and no cluster to run.
  1. AEnable default bucket encryption with server-side encryption using Amazon S3 managed keys (SSE-S3).OutEliminated by the key-control constraint. Amazon S3 owns and manages these keys; the company cannot disable them and gets no per-key usage record in CloudTrail.
  2. BCreate a customer managed key in AWS KMS, set it as the bucket's default encryption (SSE-KMS), and restrict it through the key policy.AnswerMeets all three constraints: the company owns the key policy, can disable the key at any time, and CloudTrail logs each KMS request S3 makes with it. No code and no cluster to run.
  3. CSet the bucket's default encryption to SSE-KMS using the AWS managed key (aws/s3).OutThe near miss. Its use is logged in CloudTrail, but AWS manages it: the company cannot change its key policy, control its rotation, or disable it.
  4. DGenerate keys in an AWS CloudHSM cluster and change the EC2 application to encrypt each report before uploading it.OutSatisfies key control, but the qualifier kills it: a two-person team would run an HSM cluster and own client-side encryption code. More control than the stem asked for.

The lesson: Let the constraints cut the list to options that truly satisfy them, then let LEAST overhead choose; the over-engineered option often survives the constraints and only loses on the qualifier.

Two more: decode them yourself

Read each one as you would on the day: mark the constraints, find the qualifier, cross out what fails, and commit to a letter before you open the decode.

Scenario 2 · Design Resilient ArchitecturesChoose two

Orders lost during a sale

An online retailer's web tier sends each new order directly to a fleet of Amazon EC2 instances that process payments. During sales events, order volume spikes and the fleet falls behind. When an instance fails, the orders it was handling are lost. The company requires that no order is lost and that processing capacity follows demand. Orders may be processed a few minutes after they are placed, and the payment step is idempotent. Order records are kept in an Amazon RDS for MySQL DB instance that averages 20% CPU.

Which combination of steps will meet these requirements? (Choose two.)

  1. AHave the web tier send each order to an Amazon SQS standard queue, and have the processing instances poll the queue.
  2. BRun the processing instances in an EC2 Auto Scaling group with a target tracking policy on queue backlog per instance.
  3. CHave the web tier publish each order to an Amazon SNS topic and subscribe the processing instances as HTTPS endpoints.
  4. DReplace the fleet with fewer, larger EC2 instances.
  5. EMigrate the order database to Amazon Aurora MySQL and add Aurora Replicas.
Decode it and show the answer

An online retailer's web tier sends each new order directly to a fleet of Amazon EC2 instances that process payments. During sales events, order volume spikes1 and the fleet falls behind. When an instance fails, the orders it was handling are lost. The company requires that no order is lost2 and that processing capacity follows demand3. Orders may be processed a few minutes after they are placed4, and the payment step is idempotent5. Order records are kept in an Amazon RDS for MySQL DB instance that averages 20% CPU6.

  1. 1Keyword. Bursty, unpredictable load. Points to a buffer that absorbs the peak plus capacity that scales, not a bigger fixed fleet.
  2. 2Constraint. Needs durable storage between the tiers. A queue holds a message until a consumer deletes it; a direct call or a push does not.
  3. 3Keyword. Auto Scaling. With a queue in front, scale on backlog per instance so capacity tracks the work actually waiting.
  4. 4Constraint. Asynchronous processing is allowed. That permission is what makes a queue acceptable; a stem demanding an instant result would change the design.
  5. 5Keyword. Processing an order twice is harmless, so a standard queue's at-least-once delivery is fine. FIFO's exactly-once processing is not needed.
  6. 6Noise. The database is healthy. Any option that changes the database answers a problem the stem does not have.
  1. AHave the web tier send each order to an Amazon SQS standard queue, and have the processing instances poll the queue.AnswerCovers 'no order is lost'. A message stays in the queue until a consumer deletes it; if an instance dies mid-order, the message becomes visible again. Idempotency makes duplicates harmless.
  2. BRun the processing instances in an EC2 Auto Scaling group with a target tracking policy on queue backlog per instance.AnswerCovers 'capacity follows demand'. Backlog per instance measures waiting work against fleet size, which is the metric AWS documents for scaling queue workers.
  3. CHave the web tier publish each order to an Amazon SNS topic and subscribe the processing instances as HTTPS endpoints.OutSNS pushes and retries for a limited time; it is not a buffer that waits for a slow or failed consumer. It also does nothing about capacity.
  4. DReplace the fleet with fewer, larger EC2 instances.OutStill tightly coupled: a failed instance still drops its orders and a fixed fleet still falls behind at peak. Fewer instances also make each failure bigger.
  5. EMigrate the order database to Amazon Aurora MySQL and add Aurora Replicas.OutFixes the wrong tier. The stem shows the database at 20% CPU; neither the lost orders nor the backlog trace back to it.

The lesson: In a Choose-two item, expect each correct pick to cover a different requirement; if a pair leaves one requirement uncovered, it is the wrong pair.

Scenario 3 · Design Cost-Optimized ArchitecturesSingle answer

A nightly job and a three-year contract

A research firm runs a batch simulation every night that takes about three hours. It currently uses On-Demand Instances, four c6i.4xlarge per run. Results must be ready within an eight-hour window. The job writes a checkpoint to Amazon S3 every 10 minutes and can resume from it if an instance stops. The firm has just signed a three-year contract with the client that funds the work. Finance wants to cut the compute bill as far as possible.

Which solution meets these requirements MOST cost-effectively?

  1. APurchase three-year Standard Reserved Instances for four c6i.4xlarge instances.
  2. BPurchase a one-year EC2 Instance Savings Plan with an hourly commitment equal to the job's On-Demand cost.
  3. CRun the job on Spot Instances through an EC2 Auto Scaling group that allows several similar instance types and uses the price-capacity-optimized allocation strategy.
  4. DCreate an On-Demand Capacity Reservation for four c6i.4xlarge instances for the nightly window.
Decode it and show the answer

A research firm runs a batch simulation every night that takes about three hours1. It currently uses On-Demand Instances, four c6i.4xlarge per run2. Results must be ready within an eight-hour window3. The job writes a checkpoint to Amazon S3 every 10 minutes and can resume from it4 if an instance stops. The firm has just signed a three-year contract with the client5 that funds the work. Finance wants to cut the compute bill as far as possible6.

  1. 1Keyword. Three of 24 hours a day. Any purchase option billed for every hour of a term mostly pays for idle time.
  2. 2Noise. Instance family and size are detail. The question is how you pay for capacity, not which instance you choose.
  3. 3Constraint. Three hours of work inside an eight-hour window leaves five hours of slack to absorb Spot interruptions and restarts.
  4. 4Keyword. Interruption-tolerant. This is the phrase that makes Spot Instances acceptable; an interruption costs at most about ten minutes of work.
  5. 5Noise. Bait for three-year Reserved Instances. The contract's length says nothing about hourly usage, which is what commitments are billed against.
  6. 6Qualifier. The MOST cost-effective ranking. It applies only after the window and the restart ability have ruled options in or out.
  1. APurchase three-year Standard Reserved Instances for four c6i.4xlarge instances.OutBait from the contract noise. A Reserved Instance is billed for every hour of its term; using 3 of 24 hours, even the maximum 72% discount costs more than staying On-Demand.
  2. BPurchase a one-year EC2 Instance Savings Plan with an hourly commitment equal to the job's On-Demand cost.OutSame flaw in a different wrapper. The hourly commitment is charged every hour of the term, so 21 hours a day are paid for and unused.
  3. CRun the job on Spot Instances through an EC2 Auto Scaling group that allows several similar instance types and uses the price-capacity-optimized allocation strategy.AnswerCheckpoints make interruptions survivable and the five spare hours absorb restarts. Spot is priced up to 90% below On-Demand, and diversifying instance types improves access to capacity.
  4. DCreate an On-Demand Capacity Reservation for four c6i.4xlarge instances for the nightly window.OutSolves availability, not cost. A Capacity Reservation is billed at the On-Demand rate whether or not instances run in it, so the bill does not go down.

The lesson: A long contract is not steady usage; commitment discounts pay off on hours actually used, so check the daily run time before reaching for Reserved Instances or Savings Plans.

Now do it at exam speed

The SAA-C03 app has 3,100+ exam-style questions with an explanation for every option. Read each stem with the routine above and check whether your elimination matches the explanation.

App StoreGoogle PlayFree SAA-C03 practice test

Keyword decoder: what the stem is telling you

These phrases recur in SAA-C03 stems. Each one narrows the answer before you read the options.

When the stem saysIt points toUsually the wrong pick
Security
encryption keys the company controlsSSE-KMS with a customer managed KMS key; key policy, disabling and rotation are yoursSSE-S3 or the AWS managed aws/s3 key, which you cannot disable or edit
rotate database credentials automaticallyAWS Secrets Manager with managed rotation for the RDS or Aurora secretParameter Store SecureString (no built-in rotation) or credentials in code
reach S3 from a private subnet without using the internetAn S3 gateway VPC endpoint added to the private subnet's route tableA NAT gateway, which uses S3's public endpoint and adds data processing charges
block SQL injection and cross-site scriptingAWS WAF rules on the ALB, CloudFront distribution or API GatewaySecurity groups or network ACLs, which filter only by IP, port and protocol
prevent every account in the organization from ...A service control policy (SCP) in AWS OrganizationsIAM policies in each account, which local administrators can change
Resilience
decouple the tiers / loosely coupledAmazon SQS between producer and consumer so either side can slow or failDirect synchronous calls, or a larger instance in the same tier
send each event to several independent consumersAn Amazon SNS topic fanning out to one SQS queue per consumerOne shared SQS queue, where each message reaches only one consumer
processed exactly once, in the order receivedAmazon SQS FIFO queue, with message group IDs for orderingSQS standard queue: at-least-once delivery, best-effort ordering
highly available across multiple Availability ZonesALB plus Auto Scaling across two or more AZs; RDS Multi-AZA read replica as the only failover plan, or one large instance
recover in another Region with an RPO of secondsAurora Global Database, or DynamoDB global tables for key-value dataSnapshots copied to another Region on a schedule: RPO of hours
Performance
real-time stream, several consumers, replayAmazon Kinesis Data StreamsAmazon SQS, where a message is gone once a consumer deletes it
near real-time delivery into S3 or Redshift, no consumer codeAmazon Data Firehose, which buffers, optionally transforms and deliversKinesis Data Streams plus custom consumer code on EC2
microsecond read latency for DynamoDBDynamoDB Accelerator (DAX), a cache compatible with existing DynamoDB API callsElastiCache in front of DynamoDB, which needs cache logic in the application
shared file system for Linux instances in several AZsAmazon EFS (NFS, Regional, grows and shrinks automatically)Amazon EBS; Multi-Attach is io1/io2 only, within a single AZ
Operations
LEAST operational overheadManaged or serverless services; fewer components to patch, scale and scriptSelf-managed software on EC2, custom scripts or cron jobs
without managing serversLambda, Fargate, DynamoDB, Aurora Serverless, S3EC2 Auto Scaling groups: still instances to patch and size
run a short task every night at 02:00EventBridge Scheduler invoking Lambda, for tasks under 15 minutesAn EC2 instance kept running all day just to host cron
Cost
MOST cost-effectiveCheapest option that still meets every stated constraint, including retrieval and recovery timesThe cheapest-looking option that quietly breaks one constraint
steady usage, around the clock, for the next three yearsSavings Plans or Reserved InstancesSpot Instances for a workload that cannot be interrupted
can tolerate interruption / can resume from a checkpointEC2 Spot Instances, ideally across several instance typesReserved Instances or Savings Plans for jobs that run a few hours a day
access patterns are unknown or change over timeS3 Intelligent-TieringA fixed lifecycle rule to Standard-IA, then retrieval fees when data is read
rarely read, but must be returned in millisecondsS3 Glacier Instant RetrievalGlacier Flexible Retrieval or Deep Archive: minutes to hours to restore

The qualifier words

The qualifier decides between options that all work. On the SAA-C03 these words carry a specific meaning:

LEAST operational overhead

Several options work; pick the one with the fewest things for the team to build, patch, scale or monitor. Managed beats self-managed, and a native feature beats custom code.

S3 Event Notifications invoking a Lambda function beats a script on an EC2 instance that polls the bucket.

MOST cost-effective

Lowest total cost among the options that meet every constraint. It never licenses dropping a requirement to save money.

S3 Glacier Instant Retrieval over Deep Archive when the stem needs millisecond access, even though Deep Archive costs less per GB.

"meet these requirements" (no ranking word)

Exactly one option satisfies every constraint; each of the others breaks at least one. Elimination alone should finish the job.

If two options still look right, you have missed a constraint. Reread the stem, not the options.

(Choose two.) / (Choose three.)

Multiple response: select exactly the number stated. The correct options usually cover different requirements and together form one design.

A queue for durability plus Auto Scaling on queue backlog for throughput, not two different kinds of queue.

MOST secure

More than one option may work; pick the one with least privilege, no long-lived credentials and no unnecessary public path.

An IAM role attached to the EC2 instance over access keys stored in the application's configuration file.

fewest changes to the application

Favour a managed service that is compatible with what runs today over a re-architecture, even if the rewrite would be better long term.

Amazon RDS for the same database engine over moving a relational schema to DynamoDB.

How the wrong answers are built

Distractors are not random. Most wrong options on the SAA-C03 fall into one of these patterns:

  1. Right service, wrong variant

    The tellNames the keyword's service but picks the wrong key type, queue type, storage class or endpoint type.

    Why it temptsSpotting the expected service name feels like recognising the answer, so the variant goes unchecked.

  2. The self-managed twin

    The tellThe same capability built by hand: Kafka on EC2, cron on an instance, custom encryption code in the application.

    Why it temptsIt would work, and it is how many on-premises teams do it today. It loses on LEAST operational overhead.

  3. Fixes the wrong tier

    The tellImproves a component the stem says is healthy or never mentions: the database, DNS, instance size.

    Why it temptsIt is a genuine best practice, so it reads as a sensible improvement.

  4. Commitment for a part-time workload

    The tellReserved Instances or Savings Plans offered for work that runs a few hours a day or unpredictably.

    Why it temptsThe large discount and a long contract or project in the stem make a commitment feel safe.

  5. Wins the qualifier, breaks a constraint

    The tellThe cheapest or simplest option, which misses one requirement buried in a subordinate clause such as a retrieval time or 'no internet path'.

    Why it temptsIt ranks first on the qualifier, so the reader stops checking constraints.

Time budget by question type

Question typeBudgetTactic
Short single-answer stem (2-3 sentences)60-90 secUsually one keyword and one constraint. Map, eliminate, answer. Flag only if two options still survive.
Long single-answer scenario (5+ sentences)2-3 minName the constraints before reading the options, and expect at least one sentence of noise.
Multiple response (Choose two / three)2.5-3 minJudge each option alone against the stem. Correct picks usually satisfy different requirements, not the same one twice.
Flagged-question review pass15-20 min reservedRevisit flagged items only. Change an answer only if you can name the constraint you missed. Leave nothing blank.

How to practise reading, not just content

Knowing the material is half of it. These drills train the reading:

Cover the options

Take any practice question, hide the answers, and write down the constraints, the qualifier and the service you expect. Then reveal the options. If your prediction is not there, find the phrase you misread.

Strike the noise

Rewrite a stem deleting one sentence at a time. If the correct answer does not change, that sentence was noise. After ten stems you start spotting noise on the first read.

A kill line for every distractor

For each wrong option, write one line naming the exact stem phrase that eliminates it. If you cannot, you got the question right by recognition, not by reading.

The SAA-C03 at a glance

Questions65 (50 scored, 15 unscored and unmarked)
Time130 minutes
Passing score720 on a 100-1,000 scaled score (compensatory)
Question typesMultiple choice (1 correct of 4) and multiple response (2+ correct of 5+)
Going back / flaggingNext and previous allowed; Flag for Review button; no penalty for guessing
Fee150 USD
DeliveryPearson VUE test center or online proctored

Practise the reading, not just the facts

Work SAA-C03 questions by domain on the app or try the free practice test. After each miss, find the phrase in the stem you read past.

App StoreGoogle PlayFree SAA-C03 practice test

FAQ

Are these real SAA-C03 exam questions?

No. The three scenarios are original, written for this guide against the published SAA-C03 exam outline and current AWS documentation. They are not taken from the live exam, from brain dumps, or from AWS's official sample questions. Their purpose is to show how a stem is put together, so you can apply the same reading routine to any practice set you use.

How many questions are on SAA-C03 and how long do I get?

65 questions in 130 minutes, about two minutes each. 50 questions are scored and 15 are unscored items AWS is evaluating for future use; they are not identified, so treat every question as if it counts. Results are a scaled score from 100 to 1,000 with 720 to pass, and scoring is compensatory, so you pass on the overall score rather than domain by domain.

Can I flag questions and come back to them?

Yes. AWS's testing policy says you can move to the next and previous question throughout the exam unless specifically noted, and a Flag for Review button marks items for later. Unanswered questions are scored as incorrect and there is no penalty for guessing, so give every question an answer on the first pass and flag the ones you want to revisit.

Is SAA-C03 being replaced by an SAA-C04?

As of October 2026, AWS's certification page and exam guide still list SAA-C03, and AWS has not announced a successor on aws.amazon.com. Some third-party sites sell SAA-C04 material; treat that as unverified. The confirmed changes are narrower: the Italian-language version retires after December 31, 2026, and the exam uses short service names such as Amazon SNS, with a full-name list in the in-exam Help feature.

Is memorising keyword-to-service pairs enough to pass?

It gets you to two candidates, not one. Phrases such as 'decouple' or 'without managing servers' do point at specific services, but distractors often use the same service in the wrong variant: an AWS managed key instead of a customer managed key, or a standard queue where order matters. The constraints in the stem decide between them, which is why the routine checks constraints before applying the qualifier.

Sources

Figures on this page come from AWS and the other primary sources below:

Checked October 14, 2026. Fees, outlines and eligibility rules change — confirm with AWS before you book.