SAP-C03 Sample Questions With Answers

About these questions

These five questions are original. We wrote them in the scenario style of a Professional-level architecture exam, one per domain. They are not real exam questions, and the real exam will word things differently. AWS published the SAP-C03 exam guide on October 27, 2026, and we have not mapped these questions to its task statements, so we cannot say how closely they match.

How to use these

Try each question without looking at your notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped and revisit it on the domains explained page.

Question 1 (Architecture Design and Implementation Built for the Cloud)

A company has 30 AWS accounts. VPCs in every account must resolve names in the on-premises domain internal.corp.example, which is served by DNS servers in the data center. The network team wants to manage this in one shared networking account and does not want to deploy DNS resources in each application account. Which two actions meet these requirements? Choose two.

  • A. Create a private hosted zone for internal.corp.example in the networking account and copy the on-premises records into it.
  • B. Create a Route 53 Resolver outbound endpoint and a forwarding rule in the networking account, and share the rule with the other accounts through AWS RAM.
  • C. Create a Route 53 Resolver inbound endpoint in each of the 30 accounts.
  • D. In each application account, associate the shared rule with the VPCs that need to resolve the domain.
  • E. In each application account, edit the shared rule to add that account’s own DNS target addresses.
Show the answer and explanation

Correct answers: B and D. An outbound endpoint plus a forwarding rule in one account sends queries for the domain to the on-premises servers. Sharing the rule through AWS RAM lets other accounts use it, and each account then associates the rule with its own VPCs. The closest wrong option is A. A copied hosted zone would work for a while, but the records go stale and you would be maintaining a second source of truth. Option C is the wrong direction, because inbound endpoints let on-premises servers resolve AWS names. Option E fails because consumers of a shared rule cannot edit it.

Question 2 (Security, compliance, and governance)

A company wants to stop all member accounts from using one specific third-party foundation model in Amazon Bedrock. An SCP already denies aws-marketplace:Subscribe in those accounts, yet developers can still call the model. What should the administrator do?

  • A. Add a Bedrock guardrail with a denied topic that names the model.
  • B. Add a statement to the SCP that denies bedrock:InvokeModel on the ARN of that model.
  • C. Also deny aws-marketplace:ViewSubscriptions in the SCP.
  • D. Ask each account owner to remove access to the model on the Bedrock model access page.
Show the answer and explanation

Correct answer: B. The control that matters is permission to invoke the model, so denying bedrock:InvokeModel on that model’s ARN in an SCP blocks it in every member account, however the subscription happens. Option D is the closest wrong answer, because it relies on each account owner and does not give central enforcement. A guardrail filters subjects in prompts and responses, it does not block a model. Viewing subscriptions has nothing to do with invoking a model, so option C changes nothing.

Question 3 (Cost-optimized architecture design)

Application servers in a VPC send a large volume of data to Amazon S3 buckets in the same Region. Servers in a branch data center, connected through AWS Direct Connect, must also reach the same buckets privately through the VPC. Which design has the lowest cost while keeping all traffic private?

  • A. An S3 gateway endpoint for the VPC traffic and an S3 interface endpoint for the branch traffic.
  • B. An S3 interface endpoint used by both the VPC servers and the branch servers.
  • C. An S3 gateway endpoint only, with branch routes pointing to it over Direct Connect.
  • D. A NAT gateway in the VPC that forwards branch traffic to the public S3 endpoints.
Show the answer and explanation

Correct answer: A. A gateway endpoint cannot be used from on premises, so the interface endpoint is needed for the branch servers. The gateway endpoint has no hourly or per-GB charge, so it handles the heavy in-VPC traffic at no extra cost. Option B is the closest wrong answer. It works, but you would pay the per-GB interface endpoint charge on all the VPC traffic. Option C cannot serve the branch servers, and option D adds NAT processing charges and does not give private access for the branch.

Question 4 (Resilience, migration, and business continuity)

A compliance team is turning on AWS Backup Vault Lock in compliance mode for a vault that holds regulated backups. They want a period in which they can test the lock before it becomes permanent. What is the minimum length of that period, and what is possible during it?

  • A. 24 hours. During this period the lock can be tested but nobody can remove it.
  • B. 7 days. During this period only the account root user can remove the lock.
  • C. 72 hours (3 days). During this period the lock configuration can still be changed or removed.
  • D. There is no such period. The lock is permanent as soon as it is applied.
Show the answer and explanation

Correct answer: C. Compliance mode has a grace time, and the minimum is three days. Until it ends, the lock can still be changed or deleted, which is your chance to test it. After it ends, nobody can alter the lock, including the root user and AWS. Option D is the closest wrong answer because it describes the end state but skips the grace time. Options A and B give the wrong length and the wrong rule about who can remove the lock during the grace time.

Question 5 (Operational excellence and automation)

A service has an availability SLO with an attainment goal of 99.5 percent. Over the look-back window, the service’s error rate is 2 percent. What is the burn rate, and what does it mean?

  • A. 40. The error budget for the interval is already used up.
  • B. 2. The service uses its error budget at twice the sustainable rate.
  • C. 0.25. The service is well within its error budget.
  • D. 4. The error budget is being used four times faster than is sustainable, so the SLO is at risk.
Show the answer and explanation

Correct answer: D. The error budget is 100 percent minus the goal, which is 0.5 percent. Burn rate is the observed error rate divided by that budget: 2 divided by 0.5 equals 4. Any value above 1 means the budget will run out before the interval ends if the rate continues. Option B is the closest wrong answer, because it uses the raw error rate and skips the division by the budget. Option C inverts the division, and option A divides by 0.05 instead of 0.5.

More guides for SAP-C03

Next step

Read the study plan to decide how to fix the domains where you slipped, then try the SAP-C03 practice tests for a larger set of original questions.

Try these practice exams