SAA-C04
Free AWS Certified Solutions Architect – Associate (SAA-C04) Practice Test
12 exam-style questions with full explanations — no sign-up. Score yourself, then close your gaps with the full course.
Exam fee ~$1504 exam domainsLevel Intermediate2 timed practice tests in the course
✅ Free practice — no sign-up📝 Real exam-style questions💡 Detailed explanations💸 30-day money-back via Udemy
A company delegates IAM user and role creation to a DevOps team but must ensure that even if the DevOps team writes an overly permissive policy, no IAM principal they create can ever exceed access to S3 and DynamoDB in a single specified region. Which mechanism should be attached to the roles the DevOps team creates?
A permissions boundary is an IAM feature that sets the maximum permissions an identity-based policy can grant to a user or role; it applies at the exact IAM entity level and travels with any role created under it, making it the mechanism specifically designed for delegated administration scenarios like this.
A company runs a critical order-processing application. Leadership sets an RTO of 30 minutes and an RPO of 5 minutes. The DR architect proposes a secondary region where the database continuously replicates data, and a scaled-down (minimal-capacity) version of the full application stack is already running and can be scaled up quickly during a failover. Which DR strategy does this describe?
Warm standby maintains a scaled-down but fully functional copy of the entire application stack in the DR region, which can be scaled up rapidly. This matches the 30-minute RTO and 5-minute RPO with continuous DB replication.
A media company stores 50 TB of video archive files that are accessed roughly once every 3-4 months for compliance review. When retrieval is needed, the files must be available in milliseconds without a separate rehydration wait. Which S3 storage class BEST meets these requirements at the lowest cost?
S3 Glacier Instant Retrieval is purpose-built for archive data accessed about once per quarter that still needs millisecond retrieval, offering lower cost than Standard-IA for this access frequency while preserving instant access.
A media analytics company stores clickstream data in Amazon S3. Access patterns are highly unpredictable: some objects are accessed dozens of times within the first two weeks then never again, while others are accessed sporadically for years with no discernible pattern. The team wants to minimize storage cost without building custom lifecycle logic or risking retrieval fees on unpredictable access. Which solution BEST meets these requirements?
S3 Intelligent-Tiering automatically monitors access patterns at the object level and moves objects between Frequent, Infrequent, Archive Instant Access, and optional Archive/Deep Archive tiers with no retrieval fees and no operational overhead — the exact fit when access patterns are unknown or unpredictable.
An application on EC2 needs to retrieve a database password that must be automatically rotated every 30 days using a Lambda rotation function, with native integration for RDS credential rotation. Which service should store this credential?
AWS Secrets Manager provides built-in automatic rotation with native Lambda rotation templates for RDS, Redshift, and DocumentDB credentials, directly matching the automated 30-day rotation requirement.
A global e-commerce company wants DNS queries to be answered with the AWS Region that provides users the fastest network round-trip time, dynamically adjusting as network conditions change. Which Route 53 routing policy should the architect configure?
Latency-based routing returns the record associated with the AWS Region that gives the lowest network latency to the user, based on Route 53's continuously updated latency measurements between regions and users.
A financial trading application requires a single EBS volume delivering up to 64,000 IOPS and 1,000 MB/s throughput with sub-millisecond latency consistency, attached to a Nitro-based EC2 instance. Which EBS volume type should the architect choose?
io2 Block Express is the current-generation Provisioned IOPS volume built for the highest-performance workloads, delivering up to 256,000 IOPS and 4,000 MB/s with sub-millisecond latency and 99.999% durability, comfortably meeting the stated requirement as the recommended modern option.
A company runs a fleet of EC2 instances that must operate 24/7 for the next three years. The workload is steady-state, but the engineering team frequently changes instance families, sizes, and even regions as the application evolves. Which EC2 pricing model provides the deepest discount while preserving this flexibility?
Compute Savings Plans offer up to the same discount level as Standard RIs (up to 66% off On-Demand) while automatically applying across any instance family, size, OS, tenancy, and AWS Region — matching the requirement for ongoing flexibility over a 3-year commitment.
A company uses a customer-managed KMS key to encrypt sensitive S3 objects and wants the key's cryptographic material to be rotated automatically every year without changing the KMS key ARN referenced in existing bucket policies and applications. What should the solutions architect enable?
Enabling automatic key rotation on a customer-managed KMS key rotates the underlying cryptographic material on a scheduled interval (default annually, configurable) while keeping the same key ID/ARN, so no application or bucket policy changes are required.
A solutions architect has configured an RDS Multi-AZ deployment for a production database. During an unplanned AZ outage affecting the primary instance, which mechanism allows the application to reconnect to the database without any changes to the application's connection string?
In RDS Multi-AZ, the DB instance endpoint is a CNAME. During failover, RDS automatically updates the CNAME to resolve to the standby (now promoted primary) instance's IP address, so applications using the same endpoint reconnect transparently.
A multiplayer online game uses both TCP and UDP traffic and requires consistent low-latency routing of players to the nearest healthy regional endpoint across multiple AWS Regions, with fast failover if a region becomes unhealthy. Which service should the architect implement?
AWS Global Accelerator uses static anycast IP addresses and the AWS global network to route both TCP and UDP traffic to the nearest healthy endpoint, with health checks providing fast automatic failover independent of DNS caching.
An application running on EC2 instances in a private subnet makes frequent calls to Amazon S3, generating a large monthly bill for NAT Gateway data processing charges. The security team requires that instances remain in the private subnet with no direct internet route. What is the MOST cost-effective way to reduce these charges?
An S3 Gateway VPC Endpoint routes S3 traffic directly over the AWS private network with no NAT Gateway data processing or per-GB egress charges, and it requires no change to instance placement or internet exposure — Gateway endpoints for S3 and DynamoDB have no hourly or per-GB charge.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$109.99 $34.99 with code FREETEST33 — valid through September 2.
Get my $34.99 deal →SAA-C04 exam — quick answers
How much does the SAA-C04 exam cost?
The exam fee is approximately $150 and varies by region — confirm current pricing with the certification vendor before you book.
What topics are on the exam?
It covers 4 domains: Design Secure Architectures (30%), Design Resilient Architectures (26%), Design High-Performing Architectures (24%), Design Cost-Optimized Architectures (20%). The full course has a dedicated chapter, lab and practice-test coverage for each.
Is this practice test really free?
Yes — all questions on this page are free with explanations and no sign-up. The paid Udemy course adds two full-length timed exams, video lessons and hands-on labs.
How do I get the discount?
Use code FREETEST33 at checkout for $34.99 (list $109.99) through September 2 — the enroll button applies it automatically.
Will this prepare me for the real exam?
The questions mirror the real exam's style and are mapped to the official domains. This is exam-focused preparation — combine the free test with the full course's timed simulations to gauge your readiness.