Practice exam only
€18.99
30 days · Labs not included.
View exam access →SAA-C03 · Hands-on practice
SAA-C03 Hands-on Labs — practise in a simulated AWS Management Console
Learn it. Practise it. Make it stick.
36 practical tasks + 4 troubleshooting challenges. Security, resilience, performance and cost decisions with supported AWS configurations and supplied evidence. Independent simulation — no real tenant, device or cloud resources.
First five tasks are free, repeatable and have no expiry · No credit card required.
Access options
One-time payments, no automatic renewal. The first five tasks stay free either way.
SAA-C03 Hands-on Labs
€14.99
All labs for this course. 30 days from payment confirmation.
One-time payment · No automatic renewal.
Purchases are temporarily unavailable. Enjoy your 5 open tasks.
SAA-C03 Practice Exam + Hands-on Labs
€29.99
Save €3.99. Exam and all labs each get 60 days.
One-time payment · No automatic renewal.
Purchases are temporarily unavailable. Enjoy your 5 open tasks.
Certificate of Completion
Finish the course. Prove it.
Complete all 36 labs and you can download a certificate of completion with your name, the skills you practised and a unique ID. Challenges are optional. Anyone can check it on a public verification page — and add it to LinkedIn in one click.
- Not self-declared. Before issuing, our server re-runs the grader on every lab you saved, so a checkbox in your browser is not enough.
- Verifiable. Every certificate has its own page at examitlab.com/verify/<ID>.
- Honest. It certifies that you completed this course. It is independent training, not an official certification.
ExamIT Lab
Certificate of Completion
Cloud Solutions Architecture
Hands-on skills course · SAA-C03 track · 36 graded labs
Alex Morgan
has completed every hands-on lab of the course. Each task was graded on the end state left in a simulated cloud console and on the architecture decisions made — not on the clicks.
Multi-tier networkingIdentity & accessResiliencePerformanceSecurityStorage & databasesCost optimisationArchitecture decisions
Completed
4 October 2026
4 October 2026
36/36labs
Certificate ID
CSA-7K4Q-2M9D-X8
CSA-7K4Q-2M9D-X8
Verify at examitlab.com/verify/CSA-7K4Q-2M9D-X8. This is a certificate of course completion issued by ExamIT Lab. It is independent training and not an official certification of any vendor.
Sample certificate — name and ID are fictional.
Your learning path
Follow the suggested learning order or repeat any task independently. Each lab supplies its own prepared scenario; changes stay within that task.
LAB 01 · FREE
Map the enrolment app: three tiers, two AZs
VPC · Resource map · 8–10 min
Open lab →LAB 02 · FREE
Choose the DR strategy: backup & restore, pilot light, warm standby, active-active
DR planner · 8–10 min
Open lab →LAB 03 · FREE
Build the three-tier VPC: public, private and data subnets in two AZs
VPC · 15–18 min
Open lab →LAB 04 · FREE
Front the app with an ALB: target groups, health checks, HTTPS listener, sticky sessions
EC2 · Load balancers · 12–15 min
Open lab →LAB 05 · FREE
Pick the storage for each workload: S3, EBS, EFS, FSx, instance store
Storage chooser · 8–10 min
Open lab →LAB 06 · LOCKED
Lock down the tiers: security groups referencing security groups, NACL on the data tier
VPC · Security · 12–15 min
Included with full SAA-C03 lab access
LAB 07 · LOCKED
Create a scoped cross-account audit role with an external ID
IAM · Roles · 12–15 min
Included with full SAA-C03 lab access
LAB 08 · LOCKED
Restrict member-account Region access with an SCP
Organizations · 10–12 min
Included with full SAA-C03 lab access
LAB 09 · LOCKED
Federate the workforce: IAM Identity Center with Entra ID and permission sets
IAM Identity Center · 10–12 min
Included with full SAA-C03 lab access
LAB 10 · LOCKED
Resource policy vs identity policy: S3 bucket policy for a partner account
S3 · Bucket policy · 10–12 min
Included with full SAA-C03 lab access
LAB 11 · LOCKED
Protect the app edge: WAF web ACL, Shield, Cognito for user sign-in
WAF & Shield · 12–15 min
Included with full SAA-C03 lab access
LAB 12 · LOCKED
Store the secret, not the password: Secrets Manager rotation and a VPC endpoint for it
Secrets Manager · 12–15 min
Included with full SAA-C03 lab access
LAB 13 · LOCKED
Prepare encryption controls with KMS, S3 and ALB TLS
KMS · 12–15 min
Included with full SAA-C03 lab access
LAB 14 · LOCKED
Keep and recover the data: S3 versioning, replication, Object Lock, AWS Backup plan
S3 · Data protection · 12–15 min
Included with full SAA-C03 lab access
LAB 15 · LOCKED
Classify and govern: Macie findings and a lifecycle for PII
Macie · 8–10 min
Included with full SAA-C03 lab access
LAB 16 · LOCKED
Decouple the order pipeline: SQS, SNS, EventBridge, Step Functions
Architecture chooser · 8–10 min
Included with full SAA-C03 lab access
LAB 17 · LOCKED
Scale on demand: Auto Scaling group with target tracking, warm pool and lifecycle hook
EC2 · Auto Scaling · 12–15 min
Included with full SAA-C03 lab access
LAB 18 · LOCKED
Go serverless: API Gateway → Lambda → DynamoDB for the enrolment status API
API Gateway · 12–15 min
Included with full SAA-C03 lab access
LAB 19 · LOCKED
Containerize the report service: ECS on Fargate behind the ALB
ECS · 12–15 min
Included with full SAA-C03 lab access
LAB 20 · LOCKED
Survive an AZ: Multi-AZ RDS, cross-AZ ALB, ASG across AZs — find the remaining SPOF
Architecture review · 8–10 min
Included with full SAA-C03 lab access
LAB 21 · LOCKED
Fail over across Regions: Route 53 health checks and failover records
Route 53 · 10–12 min
Included with full SAA-C03 lab access
LAB 22 · LOCKED
Immutable and repeatable: CloudFormation stack with parameters, AMI baking, quotas for standby
CloudFormation · 12–15 min
Included with full SAA-C03 lab access
LAB 23 · LOCKED
Add a read replica and RDS Proxy for the reporting load
RDS · 12–15 min
Included with full SAA-C03 lab access
LAB 24 · LOCKED
Cache the catalog: ElastiCache Redis, CloudFront TTLs, DynamoDB DAX — which where?
Caching chooser · 8–10 min
Included with full SAA-C03 lab access
LAB 25 · LOCKED
Choose the database: Aurora, DynamoDB, RDS, Redshift, Timestream, DocumentDB
Database chooser · 8–10 min
Included with full SAA-C03 lab access
LAB 26 · LOCKED
Size the compute: instance family, Lambda memory, Fargate task size, Batch/EMR
Compute chooser · 8–10 min
Included with full SAA-C03 lab access
LAB 27 · LOCKED
Accelerate globally: CloudFront vs Global Accelerator, Route 53 latency routing
Edge chooser · 8–10 min
Included with full SAA-C03 lab access
LAB 28 · LOCKED
Connect the sites: Transit Gateway vs peering, Direct Connect + VPN backup, PrivateLink
Network chooser · 10–12 min
Included with full SAA-C03 lab access
LAB 29 · LOCKED
Build the data lake: Kinesis → S3 → Glue → Athena → QuickSight, DataSync for the NAS
Analytics chooser · 10–12 min
Included with full SAA-C03 lab access
LAB 30 · LOCKED
Migrate the database: DMS + SCT from Oracle to Aurora PostgreSQL with minimal downtime
DMS · 12–15 min
Included with full SAA-C03 lab access
LAB 31 · LOCKED
Watch the app: CloudWatch dashboards, alarms on p99 latency, X-Ray traces
CloudWatch · 12–15 min
Included with full SAA-C03 lab access
LAB 32 · LOCKED
Right-size storage cost: S3 Intelligent-Tiering, EBS gp3 vs io2, EFS IA, Requester Pays
Cost Explorer · Storage · 10–12 min
Included with full SAA-C03 lab access
LAB 33 · LOCKED
Right-size compute cost: Savings Plans, Spot for batch, hibernation, Graviton
Cost Explorer · Compute · 10–12 min
Included with full SAA-C03 lab access
LAB 34 · LOCKED
Right-size database cost: Aurora Serverless v2, DynamoDB on-demand vs provisioned, snapshot retention
Cost Explorer · Database · 10–12 min
Included with full SAA-C03 lab access
LAB 35 · LOCKED
Right-size network cost: one NAT gateway vs per-AZ, VPC endpoints instead of NAT, Transit Gateway data charges
Cost Explorer · Network · 10–12 min
Included with full SAA-C03 lab access
LAB 36 · LOCKED
Hybrid edge: Outposts, Snowball Edge, Storage Gateway, Transfer Family — which fits?
Hybrid chooser · 8–10 min
Included with full SAA-C03 lab access
Troubleshooting challenges
Inspect evidence, identify the cause, make a safe fix and verify it. 4 separate exercises, included with full SAA-C03 lab access.
The site is slow only at 09:00
8–10 min
Locked · Full lab access required
The DR test failed
8–10 min
Locked · Full lab access required
The NAT bill is bigger than the compute bill
8–10 min
Locked · Full lab access required
Someone can read every bucket
8–10 min
Locked · Full lab access required
SAA-C03 hands-on labs — questions
- Can I practise SAA-C03 without an AWS account?
- Yes. The course provides 36 independent browser labs and four optional troubleshooting cases with supplied fictional AWS resources and evidence. Nothing is deployed to an AWS account and no AWS resources are billed.
- Are the SAA-C03 labs free?
- The first 5 labs in the learning order are free, repeatable and never expire — no credit card and no sign-up required to start. The full course of 36 labs plus 4 troubleshooting challenges is a one-time purchase with no subscription.
- What does a SAA-C03 lab look like?
- Each task supplies a prepared AWS scenario with optional guidance, three gradual hints and checks of saved configuration or architecture decisions. Native service views and independent architecture workbenches are identified separately. The four troubleshooting cases are optional; the course certificate requires the 36 core labs.
- Do the labs cover the current SAA-C03 exam outline?
- These original tasks practise selected objectives across the four domains in the official AWS SAA-C03 exam guide: security, resilience, performance and cost optimization. The guide revision published October 29, 2026 is recorded separately from when AWS applies changes to the exam. The course does not claim complete coverage of every objective; use the official AWS exam guide and documentation alongside it.
- Is there a certificate at the end?
- Yes. When all 36 labs are complete you can issue a certificate of completion in your account: a PDF with your name and a unique ID, an Add to LinkedIn link and a public verification page. Before issuing, the server re-runs the course grader on every lab you saved, so it reflects work you really did. It certifies completion of this course; it is independent training, not an official certification.
- How does this compare with an AWS training account?
- Each browser exercise supplies fictional resources, evidence and a repeatable starting state with automatic result checks. It supports the described operations; it cannot create AWS resources, execute arbitrary CLI commands or policy documents, change a real account or prove deployment. Use an AWS training account for operations outside the supported simulation.
Access is per course. Sign in for account progress. After paid access expires, your saved progress is retained and the first five tasks remain free.