SAA-C03 · Hands-on practice

SAA-C03 Hands-on Labs — practise in a simulated AWS Management Console

Learn it. Practise it. Make it stick.

36 practical tasks + 4 troubleshooting challenges. Familiar administration workflows, gradual hints and explanations. Independent simulation — no real tenant, device or cloud resources.

First five tasks are free, repeatable and have no expiry · No credit card required.

Access options

One-time payments, no automatic renewal. The first five tasks stay free either way.

SAA-C03 Hands-on Labs

€14.99

All labs for this course. 30 days from payment confirmation.

One-time payment · No automatic renewal.

Purchases are temporarily unavailable. Enjoy your 5 open tasks.

Best value

SAA-C03 Practice Exam + Hands-on Labs

€29.99

Save €3.99. Exam and all labs each get 60 days.

One-time payment · No automatic renewal.

Purchases are temporarily unavailable. Enjoy your 5 open tasks.

Your learning path

Work through the tasks in order — each one builds on the last.

LAB 01 · FREE

Map the enrolment app: three tiers, two AZs

VPC · Resource map · 8–10 min

Open lab →

LAB 02 · FREE

Choose the DR strategy: backup & restore, pilot light, warm standby, active-active

DR planner · 8–10 min

Open lab →

LAB 03 · FREE

Build the three-tier VPC: public, private and data subnets in two AZs

VPC · 15–18 min

Open lab →

LAB 04 · FREE

Front the app with an ALB: target groups, health checks, HTTPS listener, sticky sessions

EC2 · Load balancers · 12–15 min

Open lab →

LAB 05 · FREE

Pick the storage for each workload: S3, EBS, EFS, FSx, instance store

Storage chooser · 8–10 min

Open lab →

LAB 06 · LOCKED

Lock down the tiers: security groups referencing security groups, NACL on the data tier

VPC · Security · 12–15 min

Included with full SAA-C03 lab access

LAB 07 · LOCKED

Cross-account access with a role, STS and an external ID

IAM · Roles · 12–15 min

Included with full SAA-C03 lab access

LAB 08 · LOCKED

Guard the organization: SCP that denies leaving the EU Regions

Organizations · 10–12 min

Included with full SAA-C03 lab access

LAB 09 · LOCKED

Federate the workforce: IAM Identity Center with Entra ID and permission sets

IAM Identity Center · 10–12 min

Included with full SAA-C03 lab access

LAB 10 · LOCKED

Resource policy vs identity policy: S3 bucket policy for a partner account

S3 · Bucket policy · 10–12 min

Included with full SAA-C03 lab access

LAB 11 · LOCKED

Protect the app edge: WAF web ACL, Shield, Cognito for user sign-in

WAF & Shield · 12–15 min

Included with full SAA-C03 lab access

LAB 12 · LOCKED

Store the secret, not the password: Secrets Manager rotation and a VPC endpoint for it

Secrets Manager · 12–15 min

Included with full SAA-C03 lab access

LAB 13 · LOCKED

Encrypt everything: KMS key policy, SSE-KMS, ACM certificate on the ALB

KMS · 12–15 min

Included with full SAA-C03 lab access

LAB 14 · LOCKED

Keep and recover the data: S3 versioning, replication, Object Lock, AWS Backup plan

S3 · Data protection · 12–15 min

Included with full SAA-C03 lab access

LAB 15 · LOCKED

Classify and govern: Macie findings and a lifecycle for PII

Macie · 8–10 min

Included with full SAA-C03 lab access

LAB 16 · LOCKED

Decouple the order pipeline: SQS, SNS, EventBridge, Step Functions

Architecture chooser · 8–10 min

Included with full SAA-C03 lab access

LAB 17 · LOCKED

Scale on demand: Auto Scaling group with target tracking, warm pool and lifecycle hook

EC2 · Auto Scaling · 12–15 min

Included with full SAA-C03 lab access

LAB 18 · LOCKED

Go serverless: API Gateway → Lambda → DynamoDB for the enrolment status API

API Gateway · 12–15 min

Included with full SAA-C03 lab access

LAB 19 · LOCKED

Containerize the report service: ECS on Fargate behind the ALB

ECS · 12–15 min

Included with full SAA-C03 lab access

LAB 20 · LOCKED

Survive an AZ: Multi-AZ RDS, cross-AZ ALB, ASG across AZs — find the remaining SPOF

Architecture review · 8–10 min

Included with full SAA-C03 lab access

LAB 21 · LOCKED

Fail over across Regions: Route 53 health checks and failover records

Route 53 · 10–12 min

Included with full SAA-C03 lab access

LAB 22 · LOCKED

Immutable and repeatable: CloudFormation stack with parameters, AMI baking, quotas for standby

CloudFormation · 12–15 min

Included with full SAA-C03 lab access

LAB 23 · LOCKED

Add a read replica and RDS Proxy for the reporting load

RDS · 12–15 min

Included with full SAA-C03 lab access

LAB 24 · LOCKED

Cache the catalog: ElastiCache Redis, CloudFront TTLs, DynamoDB DAX — which where?

Caching chooser · 8–10 min

Included with full SAA-C03 lab access

LAB 25 · LOCKED

Choose the database: Aurora, DynamoDB, RDS, Redshift, Timestream, DocumentDB

Database chooser · 8–10 min

Included with full SAA-C03 lab access

LAB 26 · LOCKED

Size the compute: instance family, Lambda memory, Fargate task size, Batch/EMR

Compute chooser · 8–10 min

Included with full SAA-C03 lab access

LAB 27 · LOCKED

Accelerate globally: CloudFront vs Global Accelerator, Route 53 latency routing

Edge chooser · 8–10 min

Included with full SAA-C03 lab access

LAB 28 · LOCKED

Connect the sites: Transit Gateway vs peering, Direct Connect + VPN backup, PrivateLink

Network chooser · 10–12 min

Included with full SAA-C03 lab access

LAB 29 · LOCKED

Build the data lake: Kinesis → S3 → Glue → Athena → QuickSight, DataSync for the NAS

Analytics chooser · 10–12 min

Included with full SAA-C03 lab access

LAB 30 · LOCKED

Migrate the database: DMS + SCT from Oracle to Aurora PostgreSQL with minimal downtime

DMS · 12–15 min

Included with full SAA-C03 lab access

LAB 31 · LOCKED

Watch the app: CloudWatch dashboards, alarms on p99 latency, X-Ray traces

CloudWatch · 12–15 min

Included with full SAA-C03 lab access

LAB 32 · LOCKED

Right-size storage cost: S3 Intelligent-Tiering, EBS gp3 vs io2, EFS IA, Requester Pays

Cost Explorer · Storage · 10–12 min

Included with full SAA-C03 lab access

LAB 33 · LOCKED

Right-size compute cost: Savings Plans, Spot for batch, hibernation, Graviton

Cost Explorer · Compute · 10–12 min

Included with full SAA-C03 lab access

LAB 34 · LOCKED

Right-size database cost: Aurora Serverless v2, DynamoDB on-demand vs provisioned, snapshot retention

Cost Explorer · Database · 10–12 min

Included with full SAA-C03 lab access

LAB 35 · LOCKED

Right-size network cost: one NAT gateway vs per-AZ, VPC endpoints instead of NAT, Transit Gateway data charges

Cost Explorer · Network · 10–12 min

Included with full SAA-C03 lab access

LAB 36 · LOCKED

Hybrid edge: Outposts, Snowball Edge, Storage Gateway, Transfer Family — which fits?

Hybrid chooser · 8–10 min

Included with full SAA-C03 lab access

Troubleshooting challenges

Inspect evidence, identify the cause, make a safe fix and verify it. 4 separate exercises, included with full SAA-C03 lab access.

The site is slow only at 09:00

8–10 min

Locked · Full lab access required

The DR test failed

8–10 min

Locked · Full lab access required

The NAT bill is bigger than the compute bill

8–10 min

Locked · Full lab access required

Someone can read every bucket

8–10 min

Locked · Full lab access required

SAA-C03 hands-on labs — questions

Does SAA-C03 have labs, and can I practise them without a tenant?
Yes. ExamIT Lab gives you 36 guided SAA-C03 labs in a simulated AWS Management Console. Nothing is deployed to a real Microsoft tenant, subscription or device, so there is nothing to set up, nothing to pay Microsoft for, and nothing you can break.
Are the SAA-C03 labs free?
The first 5 labs in the learning order are free, repeatable and never expire — no credit card and no sign-up required to start. The full course of 36 labs plus 4 troubleshooting challenges is a one-time purchase with no subscription.
What does a SAA-C03 lab look like?
Each lab opens a realistic simulation of the AWS Management Console — VPC, IAM, Organizations, S3, KMS, EC2, Auto Scaling, RDS, Route 53, ECS and CloudFormation, plus architecture-decision and cost-optimization tasks. You get a task brief, a guided or independent mode, progressive hints and a "Check configuration" button that grades the actual end state you left behind — not just the buttons you clicked.
Do the labs cover the current SAA-C03 exam outline?
The labs are mapped to the objectives in Microsoft's current SAA-C03 study guide, and we re-audit the mapping when Microsoft updates the skills measured. Combine them with the SAA-C03 practice test on ExamIT Lab for full coverage.
How is this different from a Microsoft Learn sandbox or a trial tenant?
A trial tenant gives you a blank environment and no feedback. These labs give you a pre-built scenario with fictional users, devices and policies, a clear goal, and automatic checking of your result — so you practise the exact administration workflows the SAA-C03 exam expects, in minutes, not hours of setup.

Access is per course. Sign in for account progress. After paid access expires, your saved progress is retained and the first five tasks remain free.