SAA-C03 · AWS · Design High-Performing Architectures · Bank updated 2026-09-20
SAA-C03 practice questions: Design High-Performing Architectures
5 free questions from 17 on this area · answer and explanation for each · no sign-up
These 5 questions come from the Design High-Performing Architectures section of our SAA-C03 bank (17 questions on this area, which carries 24% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.
1/5 · Design High-Performing Architectures · easy
A multiplayer game runs server fleets behind Network Load Balancers in three AWS Regions and communicates with players over UDP. The installed clients connect to IP addresses rather than to a host name, so the studio needs a small pair of entry-point addresses that stay the same for the life of a client build. The studio also needs players routed to a healthy Region and an unhealthy regional endpoint taken out of service quickly. Which solution will meet these requirements?
ACreate an AWS Global Accelerator standard accelerator with each Region's Network Load Balancer as an endpoint, and publish its static IP addresses.
BCreate an Amazon CloudFront distribution with the three Network Load Balancers as origins and give the clients the distribution's domain name.
CCreate latency-based Amazon Route 53 records for the three Network Load Balancers and configure the clients to resolve that record before they connect.
DPlace a single Network Load Balancer in front of the server fleets in the three Regions and register the fleets as IP address targets.
Show answer & explanation
A is correct. Task Statement 3.4 covers edge networking services with appropriate use cases. The Global Accelerator documentation states that it 'provides you with static IP addresses that you associate with your accelerator. The static IP addresses are anycast from the AWS edge network' and that it 'uses the AWS global network to route traffic to the optimal regional endpoint based on health, client location, and policies'. The FAQ confirms support for 'both TCP and UDP protocols' and detection of an unhealthy endpoint in under a minute.
↗ AWS SAA-C03 Exam Guide — Domain 3: Design High-Performing Architectures
2/5 · Design High-Performing Architectures
A stateless API runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The group scales on average CPU utilization. During busy periods response times climb while CPU stays near 30 percent, because each instance saturates on concurrent connections long before it becomes processor bound. Load tests have established the point at which one instance stops keeping up, and the team wants the group to add capacity as the fleet approaches that point. Which solution will meet these requirements?
AReplace the policy with a step scaling policy on the load balancer's target response time metric, with three steps that add progressively more instances.
BReplace the policy with scheduled scaling actions that set the desired capacity for each hour of the day from last week's traffic profile.
CKeep the CPU-based policy but lower its target value to add instances earlier in the busy period.
DCreate a target tracking scaling policy on the ALBRequestCountPerTarget predefined metric with the target value taken from the load test.
Show answer & explanation
D is correct. Task Statement 3.2 covers identifying metrics and conditions to perform scaling actions. The Amazon EC2 Auto Scaling User Guide states that 'a target tracking scaling policy automatically scales the capacity of your Auto Scaling group based on a target metric value', that you 'select a metric and a target value to represent the ideal average utilization or throughput level for your application', and lists ALBRequestCountPerTarget among the predefined metrics. It also warns not to edit the CloudWatch alarms that the policy creates.
↗ AWS SAA-C03 Exam Guide — Domain 3: Design High-Performing Architectures
3/5 · Design High-Performing Architectures
A mobile game studio keeps per-player state in an Amazon DynamoDB table that is read and written by player ID, and lookups have to complete in single-digit milliseconds. A launch event opens at midnight; marketing will not put a number on the first hour, and nobody will be available to change the table's configuration while the event runs. Which configuration will carry the launch hour?
AProvisioned capacity mode with DynamoDB auto scaling on a target utilization and a maximum of ten times the beta rate.
BOn-demand capacity mode with the table's maximum read and write throughput set to ten times the beta rate.
CProvisioned capacity mode with the read and write capacity units set to ten times the beta rate.
DOn-demand capacity mode with the table bounded by the account-level default throughput quota and no table maximum.
Show answer & explanation
D is correct. Task Statement 3.3 asks for determining an appropriate database type and covers database capacity planning. The DynamoDB Developer Guide states that 'On-demand mode is the default and recommended throughput option' and that on-demand capacity mode 'instantly accommodates up to double the previous peak traffic on a table', with more capacity allocated automatically as traffic grows. It also states that for on-demand tables 'throughput requests that exceed the maximum amount specified will be throttled', that auto scaling 'triggers when your consumed capacity breaches the configured target utilization for two consecutive minutes' and then 'takes several minutes to update the provisioned capacity', and that DynamoDB 'retains up to five minutes (300 seconds) of unused read and write capacity' as burst capacity.
↗ AWS SAA-C03 Exam Guide — Domain 3: Design High-Performing Architectures
4/5 · Design High-Performing Architectures
A company must move 300 TB of data from an on-premises NFS file server into Amazon S3 and then keep the bucket in step with daily changes on the file server. An AWS Direct Connect link with spare capacity overnight is already in place. The team wants transfers scheduled, incremental after the first run, and verified for integrity, without writing and maintaining transfer scripts. Which solution will meet these requirements?
ADeploy an AWS Storage Gateway tape gateway in the data center and back the file tree up to virtual tapes stored in Amazon S3.
BTurn on S3 Transfer Acceleration for the bucket and schedule the AWS CLI s3 sync command from the file server in a nightly cron job.
CDeploy an Amazon S3 File Gateway in the data center and mount it on the NFS server as an additional share.
DDeploy an AWS DataSync agent in the data center and create scheduled DataSync tasks that transfer from the NFS share to the Amazon S3 bucket.
Show answer & explanation
D is correct. Task Statement 3.5 covers data transfer services with appropriate use cases and designing data transfer solutions. The AWS DataSync User Guide describes 'a secure, reliable, high-speed file transfer service that helps you quickly and easily transfer your file or object data to, from, and between AWS storage services', lists Network File System among the supported on-premises systems, and states that DataSync 'provides end-to-end security, including encryption and data integrity validation'. The two requirements that decide this item are documented on their own pages: a scheduled task 'runs at a frequency that you specify, with a minimum interval of 1 hour', and a task execution transfers 'only the data that's changed since the previous task execution'.
↗ AWS SAA-C03 Exam Guide — Domain 3: Design High-Performing Architectures
5/5 · Design High-Performing Architectures · hard
A software vendor sells an API that 40 customers consume from their own VPCs in the same Region. Several of those customers use private address ranges that overlap with each other and with the vendor's VPC. The traffic must stay off the public internet, and a customer must be able to reach this API without gaining a path to the rest of the vendor's network. Which solution will meet these requirements?
ACreate a VPC peering connection between the vendor's VPC and each of the 40 customer VPCs, and add the matching routes to the route tables on both sides.
BAttach the vendor's VPC and the 40 customer VPCs to an AWS Transit Gateway and use its route tables to permit traffic toward the vendor's service subnets.
CBuild an AWS Site-to-Site VPN connection from the vendor's VPC to each of the 40 customer VPCs and carry the API traffic over those connections.
DPut the API behind a Network Load Balancer, create a VPC endpoint service from it, and have each customer create an interface VPC endpoint to that service.
Show answer & explanation
D is correct. Task Statement 3.4 names network connection options including AWS PrivateLink. The PrivateLink guide states that it lets 'clients in your VPC connect to services and resources in other VPCs using private IP addresses, as if those services and resources were hosted directly in your VPC', and that 'traffic between a VPC endpoint and an endpoint service or resource stays within the AWS network, without traversing the public internet'. A consumer connects to the endpoint interface in its own subnet rather than to the provider's address range, which is why address ranges on the two sides do not have to be distinct.
↗ AWS SAA-C03 Exam Guide — Domain 3: Design High-Performing Architectures
Other SAA-C03 areas
The same kind of free sample for every other section of the SAA-C03 bank:
Study Design High-Performing Architectures with instant feedback
6 free questions · filter study mode by area and difficulty · error log with spaced repetition · no card, no dumps, no ads.
Create your free account →
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by AWS. SAA-C03 and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official AWS materials (as of September 2026); always confirm current details with the vendor before booking.