ExamPark
Course menuSAA-C03

Exams / SAA-C03 / Study guide

AWS Certified Solutions Architect – Associate (SAA-C03) study guide

What the SAA-C03 exam tests, domain by domain, and how to tell the right answer from the nearly right one. Each topic links to fuller study notes and free practice questions.

Last checked against the official exam guide and AWS documentation · How we write our content

About the SAA-C03 exam

The AWS Certified Solutions Architect – Associate exam checks whether you can design a workload on AWS that is secure, resilient, fast and no more expensive than it needs to be. AWS aims it at people with at least a year of hands-on experience designing cloud solutions, but plenty of people pass with less, as long as they have built things and know why each service exists.
Questions 65: 50 scored and 15 unscored, which aren’t marked
Time 130 minutes
Question types Multiple choice (one answer from four) and multiple response (two or more from five or more)
Score Scaled from 100 to 1,000; 720 to pass
Scoring model Compensatory: you need to pass overall, not in each domain
Guessing An unanswered question counts as wrong, and there is no penalty for a wrong answer, so answer everything

Check the official certification page for the current price, languages and booking options before you book.

What the exam really tests

Almost every question is a short scenario: a company, what it runs, and what it needs. All four options are real AWS services or settings, and most of them would work in some form. The exam is testing whether you notice the constraint that rules three of them out.

Those constraints come in a small number of shapes, and learning to spot them is most of the work:

  • “MOST cost-effective” or “LEAST expensive”: the answer meets every requirement and stops there. An option that adds Multi-Region, provisioned capacity or a premium storage class nobody asked for is wrong, however good it sounds.
  • “LEAST operational overhead”: prefer the managed, serverless or built-in feature over anything you would have to run, patch or write code for. A Lambda function on a schedule usually loses to a native feature that does the same job.
  • “MOST secure” or “least privilege”: temporary credentials over long-term keys, private connectivity over the internet, a narrowly scoped policy over a broad one.
  • “Highly available” or “fault tolerant”: at least two Availability Zones. Multi-Region only when the scenario mentions a Region failure, a recovery target that one Region can’t meet, or users on several continents.
  • Numbers: an RPO, RTO, retention period, file size or request rate is never decoration. If the question gives one, at least one option fails because of it.

How to read a question

  1. Read the last line first, so you know what you are choosing for: cost, effort, security or availability.
  2. Read the scenario and underline (mentally) every requirement and every number.
  3. For each option, find the requirement it breaks. Wrong options usually break exactly one.
  4. If two options both seem to work, compare them on the qualifier in the last line. That is what it is there for.
  5. For “Choose two” questions, each correct option usually covers a different part of the requirement. Two options that do the same job are rarely both right.

Flag anything you have spent more than two minutes on and come back to it. With 130 minutes for 65 questions you have two minutes each, and a few minutes spare for flagged questions at the end.

How the domains add up

The four domains are weighted by their share of the scored questions. Security is the largest, but the domains overlap heavily: a resilience question will often turn on cost, and a performance question on security. Study the topics below, not the domain labels.

Domain 1: Design Secure Architectures 30%

The biggest domain covers three things: who can reach a resource (IAM, Organizations, federation), how a workload is protected on the network and at the edge (security groups, network ACLs, AWS WAF, Shield, VPC endpoints), and how data is protected (KMS, S3 encryption and access, Secrets Manager, Macie). The right answer is almost always the one that uses temporary credentials, keeps traffic private, and grants the least access that still works.

A three-tier VPC with private app servers and database The internet reaches only a load balancer in a public subnet. The load balancer sends traffic to app servers in a private subnet, which talk to an RDS database in the same private subnet. App servers reach the internet outbound through a NAT gateway in the public subnet, and reach Amazon S3 through a gateway endpoint without using the internet. Internet VPC Public subnet Load balancer NAT gateway Private subnet App servers allows LB traffic only RDS database allows app traffic only outbound only Gateway endpoint Amazon S3 Private path to S3: no internet, no NAT cost
Only the load balancer sits in a public subnet. The app servers and database have no public IP addresses, and each security group allows traffic only from the tier in front of it. Servers reach the internet for updates through the NAT gateway, outbound only, and reach S3 privately through a gateway endpoint, which is free and avoids NAT data charges.

Domain 2: Design Resilient Architectures 26%

This domain is about workloads that keep running when something fails and keep up when load changes. Expect questions on loose coupling with SQS, SNS and EventBridge, scaling with Auto Scaling groups, Multi-AZ databases, Route 53 failover, and choosing a disaster recovery strategy from a stated RPO and RTO. The recurring lesson: put state somewhere shared and managed, spread everything across Availability Zones, and only go Multi-Region when the scenario needs it.

A resilient web application spread across two Availability Zones Users reach Route 53, which points to an Application Load Balancer in one Region. The load balancer sends traffic to EC2 instances in an Auto Scaling group that spans Availability Zone A and Availability Zone B. Both instances write to an RDS primary database in zone A, which keeps a synchronous copy on a standby database in zone B. The standby takes no traffic until a failover. Users Route 53 (DNS) Region Application Load Balancer AZ A AZ B Auto Scaling group EC2 instance EC2 instance RDS primary reads and writes RDS standby no traffic sync
The pattern behind many resilience questions. If a whole Availability Zone fails, the load balancer stops sending traffic there, the Auto Scaling group launches replacement instances in the healthy zone, and RDS fails over to the standby, usually within a minute or two. The application keeps no state on the instances, so losing one loses nothing.

Domain 3: Design High-Performing Architectures 24%

These questions ask you to pick the storage, compute, database, network or data pipeline that fits a workload’s access pattern. The scenario nearly always describes the pattern in plain words (many small reads of the same items, a shared POSIX file system, global users on UDP), and your job is to map it to the service built for it. Caching, read replicas and the choice between EFS, FSx and S3 come up again and again.

Caching layers in front of a database Users reach CloudFront, an edge cache. Requests that miss go to app servers. The app servers check ElastiCache first, read from an RDS read replica on a cache miss, and send all writes to the RDS primary. The primary copies data to the read replica asynchronously. Users CloudFront edge cache App servers ElastiCache 1. check first Read replica 2. on a miss RDS primary all writes async copy
Reads stop at the first layer that has the answer: CloudFront at the edge, ElastiCache in memory, then a read replica. Only writes have to reach the primary. Replicas copy from it asynchronously, so a replica can be slightly behind; if a question says reads must always see the latest write, those reads go to the primary.

Domain 4: Design Cost-Optimized Architectures 20%

Cost questions reward matching the pricing model to the usage: S3 storage classes and lifecycle rules for data that cools down, Savings Plans or Reserved Instances for steady compute, Spot for interruptible work, serverless or on-demand capacity for spiky or idle workloads, and VPC endpoints to avoid NAT gateway charges. The trap is the option that saves money by breaking a requirement, such as a storage class that can’t return data fast enough.

An S3 lifecycle rule moving objects to cheaper storage classes over time Objects start in S3 Standard. After 30 days a lifecycle rule moves them to S3 Standard-IA, after 90 days to S3 Glacier Flexible Retrieval, and after 365 days it deletes them. Storage cost per gigabyte falls at each step. S3 Standard new data, read often after 30 days S3 Standard-IA read rarely, still instant after 90 days Glacier Flexible Retrieval archive: minutes to hours after 365 days Expire (delete) $$$ per GB $ per GB
A lifecycle rule moves objects to cheaper storage as they cool down, then deletes them. Each step down cuts the storage price but adds retrieval fees and, for Glacier classes, a wait. Objects must be at least 30 days old before moving to Standard-IA. If the access pattern is unknown, S3 Intelligent-Tiering moves objects between tiers automatically.

A 6-week study plan

This plan assumes about an hour on weekdays and a longer session at the weekend. If you already work with AWS every day, you can compress it to three or four weeks; if you are new to AWS, consider passing the Cloud Practitioner exam first or stretching this to eight weeks.

Week Focus Do this
1 Baseline and IAM Take the free practice exam in timed mode before you study, to find your starting point. Then work through IAM roles and policies, Organizations and SCPs, and S3 access control.
2 Networking and data security VPC design, security groups and network ACLs, VPC endpoints, KMS and S3 encryption, Secrets Manager. Build a VPC with public and private subnets yourself.
3 Resilience Auto Scaling, load balancing, SQS and SNS, RDS Multi-AZ, Route 53 routing and failover, disaster recovery strategies.
4 Performance Caching with CloudFront and ElastiCache, read replicas, EFS vs FSx vs S3, choosing compute, Kinesis and Athena.
5 Cost S3 storage classes and lifecycle, EC2 purchasing options, data transfer and VPC endpoints, database and serverless pricing.
6 Exam practice Full timed practice exams under real conditions. Review every wrong answer and every lucky guess, then go back to the topic notes for the weakest areas.

How to use practice questions well

  • Review every option, not just the answer. The value is in knowing why the three wrong options are wrong, because the same services come back as distractors in other questions.
  • Keep a list of the constraints you missed. Most wrong answers come from skimming past one word, such as “within seconds” or “without changing the application”. Patterns show up quickly.
  • Don’t memorize questions. The real exam won’t reuse them. If you recognize a question, cover the options and explain the answer to yourself before you look.
  • Aim for 80% or more across a few full timed practice exams before you book. Scaled scores aren’t a straight percentage, so give yourself a margin.

Get hands-on

Reading about a NAT gateway is not the same as watching a private instance fail to reach the internet without one. Use a personal AWS account with a budget alert set, build small things (a VPC, an Auto Scaling group behind a load balancer, an S3 bucket served through CloudFront, an SQS queue feeding a Lambda function), and delete them when you finish.

Frequently asked questions

How hard is SAA-C03?

It is the broadest of the Associate exams. The questions aren’t deep on any one service, but they assume you know several dozen services well enough to tell which one fits a scenario. Most people find the cost and performance trade-offs harder than the security questions.

Do I need the Cloud Practitioner certification first?

No. There are no prerequisites for any AWS certification. Cloud Practitioner is a useful first step if you are new to AWS, but if you already build on AWS you can go straight to SAA-C03.

How long should I study?

Somewhere between 4 and 10 weeks is typical, depending on how much AWS you use day to day. The plan above is a good middle ground.

Are the practice questions the real exam questions?

No. Every question on this site is original, written from the public exam guide and checked against AWS documentation. Using real exam questions breaks the AWS Certification Program Agreement and won’t teach you the reasoning the exam tests.

Test yourself

The free SAA-C03 practice exam has 65 questions with an explanation for every option. No sign-up needed.

Take the free practice examReview questions untimed

Want to be sure you're ready? The 5 full-length practice sets add 325 new questions, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets