An application on EC2 needs read-only access to one S3 bucket. What is the most secure way to grant it?

Attach an IAM role with a least-privilege policy to the instance

Store root credentials in an environment variable

Embed an IAM user's access keys in the app

Make the bucket public and filter by IP

Which approach encrypts objects at rest in Amazon S3 with the least operational overhead?

Enable server-side encryption (SSE-S3 or SSE-KMS)

Use a public bucket with signed URLs

Encrypt files yourself before upload only

You must give an application temporary, automatically rotated AWS credentials. Which service issues them?

AWS STS (Security Token Service)

How should an application store a database password securely on AWS?

Use AWS Secrets Manager and retrieve at runtime

Which is a security best practice for the AWS account root user?

Enable MFA and avoid using it for routine tasks

Use it for daily administration

Create access keys for automation

A web app must stay available even if an entire Availability Zone fails. What is the core design choice?

Deploy across multiple Availability Zones

Use a single AZ with bigger disks

Run everything in one large instance

To handle variable load automatically while staying available, you should combine an Elastic Load Balancer with:

An Auto Scaling group of stateless instances

An e-commerce site has heavy, repeated read queries slowing its database. What improves read performance most directly?

Add an ElastiCache caching layer

A workload runs 24/7 at a steady, predictable level for the next three years. Which pricing reduces cost most?

Reserved Instances or Savings Plans

Which combination avoids paying for idle capacity while handling demand spikes?

Auto Scaling with right-sized instances

Over-provision a large fleet permanently

A private-subnet application needs outbound internet access for updates but must not be reachable from the internet. What do you use?

A NAT Gateway in a public subnet

An Internet Gateway attached to the subnet

Which service is a fully managed, multi-region, low-latency NoSQL store that scales on demand?

Amazon DynamoDB (with global tables)

A single EC2-hosted MySQL server

A team wants to grant developers permission to start and stop EC2 instances but never to delete them. What is the cleanest way to express this?

Write an IAM policy that allows the start/stop actions and omits the terminate action

Give them the AdministratorAccess managed policy

Share the root user password with the developers

Add the developers to the EC2 instance's security group

Which AWS feature lets you require a one-time code from a hardware or virtual device in addition to a password when signing in?

Multi-factor authentication (MFA)

You need to encrypt traffic between users' browsers and an Application Load Balancer. What do you attach to the load balancer's HTTPS listener?

A TLS/SSL certificate (for example from AWS Certificate Manager)

Which statement about IAM groups is correct?

A group is a way to attach the same permissions to multiple users at once

A group can be used as a principal to assume a role directly

A group has its own long-term access keys

A group can sign in to the AWS console

To block all inbound traffic to an EC2 instance except HTTPS from anywhere, you configure:

A security group that allows inbound TCP 443 and no other inbound rules

Which approach keeps data confidential while it travels over the public internet to your application?

Encrypting the connection with TLS (HTTPS)

Which service lets you create and centrally control the encryption keys used by many AWS services?

AWS Key Management Service (KMS)

A new employee should have no permissions until explicitly granted. Which IAM default supports this?

IAM denies all actions by default until a policy allows them

IAM allows all actions by default until a policy denies them

IAM grants administrator access to every new user

IAM copies permissions from the previous employee automatically

An application running on ECS tasks needs to read from a specific DynamoDB table. What is the recommended way to provide access?

Bake an IAM user's access keys into the container image

Open the table to public access and filter by IP

Assign an IAM task role scoped to that table to the ECS task

Store admin credentials in an environment variable

You must ensure that objects uploaded to an S3 bucket are always encrypted with a specific KMS key, rejecting any unencrypted upload. What enforces this?

Enabling S3 Transfer Acceleration

A bucket policy that denies PutObject requests without the required SSE-KMS header

A company wants permissions defined once and reused across many AWS accounts, with central control. Which approach fits best?

Use AWS Organizations with service control policies and IAM roles for cross-account access

Create identical IAM users in every account by hand

Email credentials between account owners

Share one root user across all accounts

Which design lets an external mobile app obtain short-lived AWS credentials after a user signs in with a social identity provider?

Distribute a shared IAM access key inside the mobile app

Use Amazon Cognito identity pools to federate the login and vend temporary credentials

Give every mobile user an IAM user account

Embed the root credentials in the app binary

An EC2 instance in a private subnet must call the AWS KMS API without sending traffic over the internet. What enables this?

An interface VPC endpoint (powered by AWS PrivateLink) for KMS

Which practice reduces the blast radius if a single set of credentials is compromised?

Applying least-privilege policies so each identity can do only what it needs

Granting every user AdministratorAccess for convenience

Using one shared account for the whole team

Disabling CloudTrail to reduce noise

You want application code on EC2 to access Secrets Manager, but you must avoid storing any static credentials on the instance. What do you use?

An IAM instance profile (role) granting secretsmanager:GetSecretValue

A hardcoded access key in the application config

A public S3 object holding the secret

A regulated workload must ensure that even AWS-managed encryption uses a key the customer can audit and disable. Which choice meets this?

SSE-S3 with Amazon-managed keys only

Client-side obfuscation without real encryption

A customer managed key (CMK) in AWS KMS

No encryption, relying on private subnets

Which mechanism lets one AWS account grant a partner account permission to assume a role with specific permissions, without sharing long-term keys?

A cross-account IAM role with a trust policy naming the partner account

Emailing the partner an IAM user's access keys

Adding the partner to your security group

Practice questions · IT & Cloud

AWS Solutions Architect – Associate (SAA-C03): Practice Questions

intermediate 150 questions

Original, scenario-based practice questions for the AWS Certified Solutions Architect – Associate (SAA-C03). Each answer is explained, including why the other options are wrong. Filter by domain or difficulty. These are concept checks - not real exam questions.

By The Exam Atlas Editorial Team · Verified 2026-05-31 · ~188 min

Domain Difficulty

Design Secure Architectures medium

An application on EC2 needs read-only access to one S3 bucket. What is the most secure way to grant it?
Design Secure Architectures easy

Which approach encrypts objects at rest in Amazon S3 with the least operational overhead?
Design Secure Architectures medium

You must give an application temporary, automatically rotated AWS credentials. Which service issues them?
Design Secure Architectures easy

How should an application store a database password securely on AWS?
Design Secure Architectures hard

You want resources in a private subnet to reach Amazon S3 without traversing the public internet. What do you use?
Design Secure Architectures easy

Which is a security best practice for the AWS account root user?
Design Resilient Architectures easy

A web app must stay available even if an entire Availability Zone fails. What is the core design choice?
Design Resilient Architectures medium

A producer service occasionally overwhelms a slower consumer. Which service best decouples them?
Design Resilient Architectures medium

To handle variable load automatically while staying available, you should combine an Elastic Load Balancer with:
Design Resilient Architectures medium

You need an RDS database to fail over automatically to a standby if the primary fails. What do you enable?
Design Resilient Architectures easy

Which service sends the same notification to many subscribers (fan-out) such as email, SQS queues and Lambda?
Design High-Performing Architectures medium

An e-commerce site has heavy, repeated read queries slowing its database. What improves read performance most directly?
Design High-Performing Architectures easy

Users worldwide complain that static assets load slowly. Which service reduces latency?
Design High-Performing Architectures medium

Which storage is best for serving large numbers of static objects with high durability and virtually unlimited scale?
Design High-Performing Architectures hard

You need to ingest and process a high-throughput stream of clickstream data in near real time. Which service fits?
Design High-Performing Architectures medium

Which read scaling option offloads read traffic from a relational primary without providing automatic failover?
Design Cost-Optimized Architectures medium

Data is accessed rarely but must be retrievable within hours when needed. Which S3 option is most cost-effective?
Design Cost-Optimized Architectures medium

A workload runs 24/7 at a steady, predictable level for the next three years. Which pricing reduces cost most?
Design Cost-Optimized Architectures medium

A fault-tolerant batch job can be interrupted and resumed. Which compute option is cheapest?
Design Cost-Optimized Architectures easy

Which combination avoids paying for idle capacity while handling demand spikes?
Design Cost-Optimized Architectures easy

Which tools help you monitor and control AWS spend?
Design Resilient Architectures hard

A private-subnet application needs outbound internet access for updates but must not be reachable from the internet. What do you use?
Design Secure Architectures medium

Which AWS service lets you centrally manage user identities and their permissions?
Design Secure Architectures medium

To filter common web exploits such as SQL injection at the application layer, you place which service in front of your app?
Design Resilient Architectures medium

To distribute incoming traffic across multiple EC2 instances in several Availability Zones, you use:
Design Resilient Architectures hard

Which service is a fully managed, multi-region, low-latency NoSQL store that scales on demand?
Design High-Performing Architectures medium

To reduce read load on a relational database using an in-memory cache, you use:
Design High-Performing Architectures medium

Which service runs code without provisioning servers, scaling automatically with the number of requests?
Design Cost-Optimized Architectures medium

To automatically move infrequently accessed S3 objects to cheaper storage classes over time, you configure:
Design Cost-Optimized Architectures hard

Which service gives recommendations to reduce cost and improve performance, security and fault tolerance across your account?
Design Secure Architectures easy

A team wants to grant developers permission to start and stop EC2 instances but never to delete them. What is the cleanest way to express this?
Design Secure Architectures easy

Which AWS feature lets you require a one-time code from a hardware or virtual device in addition to a password when signing in?
Design Secure Architectures easy

You need to encrypt traffic between users' browsers and an Application Load Balancer. What do you attach to the load balancer's HTTPS listener?
Design Secure Architectures easy

Which service stores and automatically rotates database credentials so applications never hold a static password?
Design Secure Architectures easy

A compliance rule says every API call in the account must be recorded for later audit. Which service produces that record?
Design Secure Architectures easy

Which statement about IAM groups is correct?
Design Secure Architectures easy

To block all inbound traffic to an EC2 instance except HTTPS from anywhere, you configure:
Design Secure Architectures easy

Which approach keeps data confidential while it travels over the public internet to your application?
Design Secure Architectures easy

Which service lets you create and centrally control the encryption keys used by many AWS services?
Design Secure Architectures easy

A new employee should have no permissions until explicitly granted. Which IAM default supports this?
Design Secure Architectures medium

An application running on ECS tasks needs to read from a specific DynamoDB table. What is the recommended way to provide access?
Design Secure Architectures medium

You must ensure that objects uploaded to an S3 bucket are always encrypted with a specific KMS key, rejecting any unencrypted upload. What enforces this?
Design Secure Architectures medium

A company wants permissions defined once and reused across many AWS accounts, with central control. Which approach fits best?
Design Secure Architectures medium

Which design lets an external mobile app obtain short-lived AWS credentials after a user signs in with a social identity provider?
Design Secure Architectures medium

To detect publicly accessible S3 buckets and unusual IAM activity automatically, which service should you enable?
Design Secure Architectures medium

An EC2 instance in a private subnet must call the AWS KMS API without sending traffic over the internet. What enables this?
Design Secure Architectures medium

Which practice reduces the blast radius if a single set of credentials is compromised?
Design Secure Architectures medium

You want application code on EC2 to access Secrets Manager, but you must avoid storing any static credentials on the instance. What do you use?
Design Secure Architectures medium

Which option provides network-level, stateless filtering for an entire subnet as an extra layer beyond security groups?
Design Secure Architectures medium

A regulated workload must ensure that even AWS-managed encryption uses a key the customer can audit and disable. Which choice meets this?
Design Secure Architectures medium

Which mechanism lets one AWS account grant a partner account permission to assume a role with specific permissions, without sharing long-term keys?
Design Secure Architectures medium

To protect a web application from large-scale layer-3/4 DDoS attacks with managed mitigation and 24/7 support, you use:
Design Secure Architectures medium

Which configuration ensures S3 objects cannot be deleted or overwritten for a fixed retention period, even by administrators?
Design Secure Architectures medium

An application's logs must be encrypted at rest in CloudWatch Logs using a key your security team controls. What do you configure?
Design Secure Architectures medium

Which practice helps you discover and remediate overly permissive policies by showing which permissions are actually used?
Design Secure Architectures medium

You need to give a Lambda function permission to write to a specific S3 prefix and nothing else. What do you attach?
Design Secure Architectures medium

Which approach lets you centrally deploy and audit firewall rules across many VPCs and accounts?
Design Secure Architectures medium

To allow temporary, time-boxed access to an S3 object for someone without AWS credentials, you generate:
Design Secure Architectures hard

A workload must use envelope encryption where a data key encrypts the data and a KMS key encrypts the data key, minimising KMS calls for large files. Which pattern matches?
Design Secure Architectures hard

An organization wants to guarantee that no member account, regardless of its IAM policies, can disable CloudTrail. What enforces this guardrail?
Design Secure Architectures hard

You must ensure a private API in your VPC can be reached by another VPC owned by a partner, exposing only that one service and no broader network access. Which option is most appropriate?
Design Secure Architectures hard

A security policy requires that EBS volumes are always encrypted at creation across an entire Region, with no chance for a user to forget. What achieves this?
Design Secure Architectures hard

An auditor needs cryptographic proof that log files have not been tampered with after CloudTrail wrote them. Which feature provides this?
Design Secure Architectures hard

A multi-tier app should allow the web tier to reach the app tier only on port 8080, using identities rather than fixed IPs that change with scaling. What is the cleanest design?
Design Secure Architectures hard

A company needs to rotate a long-lived third-party API key stored in Secrets Manager using custom rotation logic. What implements the rotation?
Design Resilient Architectures easy

Which design choice removes a single point of failure for a stateless web tier?
Design Resilient Architectures easy

What does an Auto Scaling group do when a health check marks an instance as unhealthy?
Design Resilient Architectures easy

Which storage service is designed for 99.999999999% (eleven nines) durability of objects?
Design Resilient Architectures easy

To decouple a web front end from a slow order-processing backend so a backend outage does not lose orders, you place between them:
Design Resilient Architectures easy

Which Route 53 feature lets DNS stop sending users to an endpoint that has failed?
Design Resilient Architectures easy

What is the main benefit of designing application instances to be stateless?
Design Resilient Architectures medium

An application stores user session state on each web server's local disk, which breaks when Auto Scaling replaces instances. What is the best fix?
Design Resilient Architectures medium

Which architecture lets a spike of incoming jobs be absorbed and processed by a fleet that scales on the backlog size?
Design Resilient Architectures medium

To run a relational database that automatically fails over to a synchronously replicated standby in another AZ, you choose:
Design Resilient Architectures medium

A queue-based system must guarantee that each message is processed exactly once and in order. Which SQS option fits?
Design Resilient Architectures medium

Which approach lets an application continue serving reads if the primary database instance is briefly unavailable during failover, with minimal data loss?
Design Resilient Architectures medium

To replicate critical S3 data to a bucket in another Region for disaster recovery, you enable:
Design Resilient Architectures medium

A workflow coordinates several Lambda functions with retries, error handling, and state across steps. Which service manages this reliably?
Design Resilient Architectures medium

Which design improves resilience for a containerized service so failed tasks are automatically rescheduled across AZs?
Design Resilient Architectures medium

To ensure messages that repeatedly fail processing are set aside for later inspection instead of blocking the queue, you configure:
Design Resilient Architectures medium

Which option lets a fleet behind a load balancer keep serving traffic during a rolling deployment without downtime?
Design Resilient Architectures medium

A serverless API must remain available even if one AZ fails. How do Lambda and API Gateway help by default?
Design Resilient Architectures medium

To protect against accidental deletion of objects in an S3 bucket, you should enable:
Design Resilient Architectures medium

Which database choice gives a single relational endpoint with storage that automatically replicates across three AZs and self-heals?
Design Resilient Architectures medium

A batch system must continue if individual worker instances fail mid-job. Which combination is most resilient and cost-aware?
Design Resilient Architectures medium

Which feature lets you distribute traffic to the healthiest endpoints across multiple Regions with fast failover and a static anycast IP?
Design Resilient Architectures hard

A company needs an RTO of minutes and RPO of seconds for a critical workload, but wants to avoid paying for a full duplicate environment running at all times. Which DR strategy fits best?
Design Resilient Architectures hard

An Aurora database must survive the loss of an entire Region with the lowest possible RPO for global users. Which feature should you use?
Design Resilient Architectures hard

A payment service must not process the same SQS message twice even if a worker crashes after partial work. Beyond FIFO, what design property is essential?
Design Resilient Architectures hard

A multi-tier application needs the data tier to remain consistent and available during an AZ failure while keeping write latency low. Which RDS configuration is most appropriate?
Design Resilient Architectures hard

To recover an entire application stack (network, compute, configuration) reliably and repeatably after a disaster, the most robust approach is to:
Design High-Performing Architectures easy

Which service caches frequently requested content at edge locations to reduce latency for global users?
Design High-Performing Architectures easy

To improve read performance of a database by serving frequent queries from memory, you add:
Design High-Performing Architectures easy

Which compute option runs your code only when triggered and scales automatically with the number of events, with no servers to manage?
Design High-Performing Architectures easy

Which storage is best suited to a shared file system that many EC2 instances mount at the same time?
Design High-Performing Architectures easy

To handle a sudden, large increase in web traffic automatically, you combine a load balancer with:
Design High-Performing Architectures medium

A read-heavy application repeatedly runs the same expensive query. Which combination most reduces database load and latency?
Design High-Performing Architectures medium

Which storage class and feature combination delivers the lowest-latency reads for small, frequently accessed objects served to a web app?
Design High-Performing Architectures medium

An application needs single-digit-millisecond key-value reads and writes at very large scale with no capacity planning. Which database fits?
Design High-Performing Architectures medium

To accelerate uploads of large objects to S3 from users far from the bucket's Region, you enable:
Design High-Performing Architectures medium

Which EBS volume type is designed for I/O-intensive workloads that need consistently high IOPS, such as a busy transactional database?
Design High-Performing Architectures medium

A data warehouse must run complex analytical queries over terabytes of structured data with high performance. Which service is purpose-built for this?
Design High-Performing Architectures medium

To reduce the latency of dynamic API responses for users in distant Regions while keeping a single origin, you can use:
Design High-Performing Architectures medium

Which option scales database reads horizontally for a relational workload without changing the application's read query logic significantly?
Design High-Performing Architectures medium

An application ingests millions of events per second and must process them in near real time. Which service is designed for this streaming workload?
Design High-Performing Architectures medium

To improve DynamoDB read performance for hot items down to microseconds, you add:
Design High-Performing Architectures medium

A globally distributed application needs low-latency local reads and writes to the same table in multiple Regions. Which feature provides this?
Design High-Performing Architectures medium

Which approach best improves throughput when many small files must be processed by a fleet, avoiding a single bottleneck node?
Design High-Performing Architectures medium

To offload TLS termination and spread Layer 7 routing decisions across targets based on URL path, you use:
Design High-Performing Architectures medium

A media company transcodes video files uploaded to S3 and wants processing to start automatically as files arrive, scaling with volume. Which design fits?
Design High-Performing Architectures hard

A relational database's writes have become the bottleneck under heavy load, and read replicas have not helped because the pressure is on writes. Which approach most directly addresses write scalability?
Design High-Performing Architectures hard

An analytics team queries large amounts of data sitting in S3 ad hoc, and wants to avoid running a cluster when idle while still getting good performance. Which service fits best?
Design High-Performing Architectures hard

A latency-sensitive global API serves both static and dynamic content. Which combination minimizes latency end to end?
Design High-Performing Architectures hard

A workload needs a shared, POSIX-compliant file system with high aggregate throughput that scales as you add more EC2 clients, without pre-provisioning capacity. Which service fits?
Design Cost-Optimized Architectures easy

Which pricing model is cheapest for a fault-tolerant workload that can tolerate interruptions, such as image rendering?
Design Cost-Optimized Architectures easy

To automatically move S3 objects to cheaper storage classes as they age, you configure:
Design Cost-Optimized Architectures easy

Which tools help you visualise spend and get alerted when costs exceed a threshold?
Design Cost-Optimized Architectures easy

For a workload that runs steadily 24/7 for at least a year, which option reduces compute cost the most while keeping flexibility across instance families?
Design Cost-Optimized Architectures medium

A development environment is only used during business hours. What is the simplest way to cut its cost?
Design Cost-Optimized Architectures medium

You have unpredictable, spiky traffic and want to pay only for what you use without managing servers. Which compute choice is most cost-effective?
Design Cost-Optimized Architectures medium

Which approach reduces data-transfer costs for serving the same popular files to many internet users?
Design Cost-Optimized Architectures medium

A team runs many small, infrequent jobs and is paying for idle EC2 capacity between them. Which change best optimizes cost?
Design Cost-Optimized Architectures medium

Which S3 storage class automatically moves objects between frequent and infrequent tiers based on access patterns, with no retrieval fees for the movement, ideal when access is unpredictable?
Design Cost-Optimized Architectures medium

A company wants to reduce the cost of NAT gateway data processing for private instances that mainly talk to S3 and DynamoDB. What helps most?
Design Cost-Optimized Architectures medium

Which practice helps you continuously identify idle or underutilized resources to remove or downsize?
Design Cost-Optimized Architectures medium

For long-term backups that are rarely retrieved and can tolerate hours of retrieval time, which is the most cost-effective storage?
Design Cost-Optimized Architectures medium

A predictable production database runs continuously, while a separate analytics job runs only a few hours each night. Which mix optimizes cost?
Design Cost-Optimized Architectures medium

Which change reduces cost for an over-provisioned EC2 fleet whose CPU and memory utilization are consistently low?
Design Cost-Optimized Architectures medium

A startup wants to minimize fixed costs and pay only as it grows, avoiding upfront capacity purchases. Which principle should guide its architecture?
Design Cost-Optimized Architectures hard

An application transfers large volumes of data out to the internet from one Region, and costs are dominated by data egress. Which change reduces cost the most without hurting users?
Design Cost-Optimized Architectures hard

A company commits to a one-year Compute Savings Plan but its workload mix shifts between EC2, Fargate, and Lambda over the year. Why is the Compute Savings Plan still a good cost choice?
Design Cost-Optimized Architectures hard

A data pipeline writes intermediate files to S3 that are only needed for 7 days, but they are accumulating and inflating storage cost. What is the most efficient fix?
Design Secure Architectures easy

Which AWS service should you use to centrally store and version application configuration values such as a non-secret feature flag or an environment name?
Design Secure Architectures hard

An S3 bucket policy grants access, but a separate VPC endpoint policy for S3 does not include the same action. What is the effective result for a request through that endpoint?
Design Resilient Architectures easy

Which statement best describes an AWS Availability Zone?
Design Resilient Architectures hard

A stateful legacy application cannot be made stateless quickly, but it must survive an instance failure with minimal disruption. Which interim approach best improves resilience?
Design Resilient Architectures hard

Two microservices must communicate, but a failure or slowdown in the consumer must never cause the producer to fail or block. Which pattern best provides this isolation?
Design Resilient Architectures hard

A workload must tolerate the failure of an entire Region. Which combination of services supports an active-passive multi-Region design?
Design Resilient Architectures hard

During a deployment, you want to shift a small percentage of production traffic to a new version and roll back instantly if errors rise. Which approach supports this safely?
Design High-Performing Architectures easy

Which service delivers a global content cache plus the ability to run lightweight code at edge locations close to users?
Design High-Performing Architectures easy

To run containers without managing the underlying EC2 servers, which compute option should you choose?
Design High-Performing Architectures hard

A web application's database is the bottleneck for a small set of extremely popular read keys (a hot-key problem), even with read replicas. Which approach most directly relieves it?
Design High-Performing Architectures hard

An application needs consistent low latency between EC2 instances doing tightly coupled, high-throughput computation (for example HPC). Which placement strategy helps most?
Design High-Performing Architectures hard

A read-heavy relational workload serves users in three continents and needs low-latency reads everywhere while keeping a single primary for writes. Which approach fits best?
Design High-Performing Architectures hard

A workload's performance suffers from cold starts and unpredictable scaling when traffic spikes sharply on a serverless function. Which feature reduces this latency for critical paths?
Design Cost-Optimized Architectures easy

Which AWS pricing principle means you generally pay only for the resources you actually use, with no large upfront commitment required?
Design Cost-Optimized Architectures hard

A company has steady baseline compute plus unpredictable bursts above it. Which cost strategy covers both efficiently?
Design Cost-Optimized Architectures hard

A backup retention policy keeps EBS snapshots indefinitely, and snapshot storage cost is climbing. Which approach controls cost while meeting a 90-day retention requirement?
Design Cost-Optimized Architectures hard

An organization wants one consolidated bill across many AWS accounts and to benefit from combined volume pricing and shared commitments. Which feature provides this?
Design Cost-Optimized Architectures hard

A serverless API is cost-efficient at low traffic but becomes expensive at sustained very high request volumes compared with always-on containers. What is the most cost-aware response?

Practice questions FAQ

Are these real SAA-C03 exam questions?: No. These are original study questions written to test understanding. They are not real exam questions, exam dumps, or copied from any provider.
How should I use these practice questions?: Answer each one, read the explanation (including why the wrong options are wrong), and use the per-domain score below to focus your revision on weak areas. Revisit before exam day.
How many questions should I do before the exam?: Enough to score consistently across every domain, alongside full-length practice from official or reputable providers. Understanding why each answer is right matters more than raw volume.
What score means I am ready?: A good signal is consistently scoring around 80% or higher across all domains on questions you have not seen before, and being able to explain why the wrong options are wrong.
Should I use exam dumps?: No. Dumps (real or leaked questions) breach provider policy, can void your certification, and do not build the understanding the exam actually tests.

Sources

AWS - Solutions Architect Associate exam guide ↗