ExamPark
Course menuSAP-C03

Exams / SAP-C03 / Study guide

AWS Certified Solutions Architect – Professional (SAP-C03) study guide

What the SAP-C03 exam tests, domain by domain, and how to tell the right answer from the nearly right one. Each topic links to fuller study notes and free practice questions.

Last checked against the official exam guide and AWS documentation · How we write our content

About the SAP-C03 exam

The AWS Certified Solutions Architect – Professional exam checks whether you can design complex solutions on AWS for whole organizations: many accounts, hybrid networks, strict security and compliance rules, tight budgets and demanding recovery targets. It is aimed at people with 2 or more years of hands-on experience designing and deploying cloud architecture on AWS.

SAP-C03 replaces SAP-C02. The last day to take SAP-C02 is November 16, 2026, and SAP-C03 is available from November 17, 2026. The new version adds generative AI and agents, responsible AI controls, post-quantum cryptography and more operational excellence work; see what changed from SAP-C02 to SAP-C03.
Questions 75: 65 scored and 10 unscored, which aren’t marked
Time 180 minutes
Question types Multiple choice (one answer from four) and multiple response (two or more from five or more)
Score Scaled from 100 to 1,000; 720 to pass (SAP-C02 needed 750)
Scoring model Compensatory: you need to pass overall, not in each domain
Guessing An unanswered question counts as wrong, and there is no penalty for a wrong answer, so answer everything

Check the official certification page for the current price, languages and booking options before you book.

What the exam really tests

Professional questions are long. They describe an organization, its current setup and a list of requirements, then offer four answers that all work to some degree. The winning answer meets every requirement, including the qualifier, with managed services and the least custom code. A few themes run through the whole exam:

  • Design for the cloud. Event-driven, serverless and container architectures, stateless services and the right database for each access pattern.
  • Govern many accounts. Organizations, Control Tower, SCPs and RCPs, delegated administrators, IAM Identity Center and data perimeters.
  • Build AI in safely. Amazon Bedrock, agents and RAG, Guardrails, and logging of model use.
  • Spend wisely. Savings Plans, Graviton, storage tiering, data transfer paths and cost allocation.
  • Recover on target. DR strategies matched to RTO and RPO, multi-Region failover, backups protected from ransomware, and migration with AWS Transform MGN and DMS.
  • Automate operations. Infrastructure as code, safe deployments, observability with OpenTelemetry and automated remediation.

How to read a question

  1. Read the last sentence first to find the qualifier: most cost-effective, least operational overhead, highest availability, most secure, fewest changes.
  2. List the hard constraints: accounts, Regions, RTO and RPO, compliance rules, existing tools, budget, timeline.
  3. Eliminate answers that use retired or closed services, break a constraint, or add servers and scripts where a managed feature exists.
  4. Between the last two, pick the one that meets the qualifier best, not the one with the most features.

Pace yourself: 180 minutes for 75 questions is about 2 minutes 24 seconds each, and many scenarios run to a full paragraph. Flag and move on.

How the domains add up

Architecture Design and Implementation Built for the Cloud and Security, Compliance, and Governance are the largest domains at 25% each. Operational Excellence and Automation follows at 20%, then Cost-Optimized Architecture Design and Resilience, Migration, and Business Continuity at 15% each. The domains overlap: a migration question often turns on networking, and a cost question on storage design.

Domain 1: Architecture Design and Implementation Built for the Cloud 25%

This is the largest domain at 25%, and it covers designing workloads built for the cloud: event-driven messaging with EventBridge, SQS, SNS and Kinesis, Step Functions and durable Lambda workflows, containers on ECS and EKS with VPC Lattice and Service Connect, ingress and edge patterns, multi-tenant SaaS isolation, generative AI with Amazon Bedrock, agents and RAG, SageMaker AI inference, hybrid connectivity, DNS, data sync and compute, multi-VPC networks, IPAM and IPv6, network inspection, global traffic routing, and the data layer from lakehouses and streaming analytics to database selection, storage and caching.

A hub-and-spoke network with Transit Gateway and an inspection VPC An on-premises data center connects over Direct Connect, through a Direct Connect gateway, to a Transit Gateway. The Transit Gateway also connects to an inspection VPC running AWS Network Firewall, and to three spoke VPCs: production, development and shared services. On-premises data center Direct Connect via a DX gateway Transit Gateway hub with route tables Inspection VPC Network Firewall Prod VPC workloads Dev VPC no route to prod Shared VPC DNS, directory
Transit Gateway is the hub: every VPC and the Direct Connect link attach once, instead of a mesh of peering connections. Separate Transit Gateway route tables keep dev and prod apart, and sending traffic through an inspection VPC lets one AWS Network Firewall check traffic between VPCs and to on-premises.

Domain 2: Security, Compliance, and Governance 25%

This domain is a quarter of the exam and covers security for whole organizations: workforce and application identity, least privilege and data perimeters, encryption with KMS, ACM, Private CA and CloudHSM (including post-quantum options), landing zones with Control Tower, SCPs and RCPs, centralized logging and threat detection, resource sharing with RAM, continuous compliance and patching, data residency and audit evidence, and new controls for generative AI with Bedrock Guardrails, AgentCore Identity and human approval steps.

A multi-account landing zone in AWS Organizations The management account runs Organizations and Control Tower. Below it, a Security OU holds a log archive account, which receives the organization trail and Config data, and an audit account, the delegated admin for security tools. A Workloads OU holds a production account with strict SCPs and a development account with sandbox SCPs. Management account Organizations, Control Tower Security OU Workloads OU Log archive org trail, Config Audit delegated admin Prod account strict SCPs Dev account sandbox SCPs SCPs and RCPs attach to an OU and apply to every account under it
A typical multi-account landing zone. The management account runs Organizations and Control Tower but no workloads. The Security OU holds the log archive account, where the organization trail and Config data land, and the audit account, which is the delegated admin for security tools. Guardrails attached to an OU apply to every account in it, so prod and dev get different rules without touching each account.

Domain 3: Cost-Optimized Architecture Design 15%

This domain is new as a stand-alone 15% domain in SAP-C03. It covers choosing purchase options (Savings Plans, Reserved Instances, Spot and capacity reservations), cost-optimized compute with Graviton, rightsizing and metric-based scaling, generative AI costs (Bedrock service tiers, batch inference, prompt caching and cross-Region inference), data transfer and network charges (NAT gateways, VPC endpoints, Transit Gateway, AZ-aware design), CloudFront and replication costs, tagging, cost categories and chargeback, cost reporting with CUR 2.0, Budgets and Cost Anomaly Detection, storage tiering and EBS volume types, database capacity modes and Database Savings Plans, and cost-optimized backup and observability retention.

Domain 4: Resilience, Migration, and Business Continuity 15%

This domain covers moving workloads to AWS and keeping them running. It includes discovery, portfolio assessment and migration waves, rehosting with AWS Transform MGN, database and data migration with DMS and DataSync, replatforming and refactoring with the strangler fig pattern, and mainframe, .NET and database modernization. On the continuity side it covers DR strategies against RTO, RPO and cost, AWS Elastic Disaster Recovery, multi-Region failover with Route 53, Global Accelerator and Application Recovery Controller, multi-cluster containers, Resilience Hub assessments and Fault Injection Service experiments, backup governance and ransomware protection, and fault-tolerant, self-healing design.

A warm standby across two AWS Regions Route 53 sends users to the primary Region, with failover to a second Region. Each Region has an application stack, an Aurora cluster and an S3 bucket. The secondary stack is scaled down. Aurora Global Database replicates from the writer to a read-only secondary, and S3 Cross-Region Replication copies objects. Users Route 53 failover routing Primary Standby App stack serving traffic App stack scaled down Aurora writer Global Database Aurora secondary promote on failover S3 bucket S3 replica CRR
A warm standby across two Regions. Aurora Global Database and S3 Cross-Region Replication copy data asynchronously, usually within about a second for Aurora. If the primary Region fails, you promote the secondary cluster, Route 53 or Application Recovery Controller moves traffic, and the scaled-down stack scales out to take the full load.

Domain 5: Operational Excellence and Automation 20%

This domain is worth 20% and covers running workloads with automation: CloudFormation, the CDK and StackSets across accounts and Regions, policy as code with CloudFormation Hooks, CDK aspects, Config rules and SCPs, secrets in IaC, cross-account CI/CD with CodePipeline, CodeBuild and CodeDeploy, pipeline security scanning, artifact signing and Bedrock evaluations, deployment strategies with automatic rollback, observability with CloudWatch, OpenTelemetry, Container Insights and Application Signals SLOs, multi-account log aggregation and alerting, AI and user experience monitoring, Systems Manager runbooks and Service Quotas, and safe remediation, auto scaling and automatic recovery.

A pipeline in a tooling account deploying to staging and production accounts CodePipeline in a tooling account builds and tests the application and stores artifacts in a bucket encrypted with a customer managed KMS key. It deploys by assuming a deploy role in the staging account, waits for manual approval, then assumes a deploy role in the production account. Tooling account CodePipeline build and test Artifact bucket customer managed key Staging account Deploy role CloudFormation trusts the tooling account’s pipeline Manual approval Production account Deploy role CloudFormation needs the KMS key and bucket access
Cross-account delivery. The pipeline lives in a tooling account and deploys by assuming a role in each target account, with a manual approval before production. The artifact bucket uses a customer managed KMS key because an AWS managed key can’t be shared across accounts, and each target role needs access to both the key and the bucket.

An 8-week study plan

This plan assumes about an hour on weekdays and a longer, hands-on session at the weekend. Time follows the domain weights: design and security are 25% each, so they get the most weeks; operations (20%) gets a full week; cost and resilience (15% each) get a week apiece. If you already architect multi-account AWS environments at work, six weeks may be enough.

Week Focus Do this
1 Baseline and cloud-native design Take the free practice exam in timed mode. Then event-driven messaging (SQS, SNS, EventBridge, Kinesis ordering), Step Functions and serverless pipelines, ECS and EKS with scaling, VPC Lattice, ingress and edge (ALB, NLB, API Gateway, CloudFront), multi-tenant SaaS isolation.
2 Networking and hybrid Transit Gateway, PrivateLink and Cloud WAN, VPC design with IPAM and IPv6, Network Firewall, WAF and Gateway Load Balancer, Direct Connect and VPN resilience, Route 53 Resolver hybrid DNS, Route 53 routing policies and Global Accelerator, Outposts and Local Zones, DataSync and Storage Gateway.
3 Data and AI Database selection and scaling (Aurora, DynamoDB, global databases), storage and caching, data lakes with Lake Formation and Iceberg, Kinesis, MSK, EMR and Redshift, Amazon Bedrock integration, agents with AgentCore, RAG with Knowledge Bases, SageMaker AI endpoints.
4 Security: identity and encryption IAM Identity Center with SAML and SCIM, Cognito and Verified Permissions, EKS Pod Identity, cross-account roles, permissions boundaries, ABAC, IAM Roles Anywhere, data perimeters and Access Analyzer, Verified Access, KMS (rotation, key stores, post-quantum keys), ACM, Private CA, CloudHSM.
5 Security: governance and compliance Organizations, OUs, Control Tower and Account Factory, SCPs and RCPs, organization trails, Config aggregators, GuardDuty, Security Hub CSPM, Security Lake, RAM sharing, Inspector and Patch Manager, data residency controls, AWS Artifact, threat modeling, Bedrock Guardrails and human approval with Step Functions.
6 Resilience and migration Discovery and migration waves, AWS Transform MGN, DMS and SCT, replatforming and strangler fig refactoring, DR strategies against RTO and RPO, Elastic Disaster Recovery, Application Recovery Controller, AWS Backup with Vault Lock and Object Lock, Resilience Hub and Fault Injection Service.
7 Operations and automation CloudFormation, CDK and StackSets, CloudFormation Hooks, multi-account pipelines, deployment strategies with rollback, CloudWatch, OpenTelemetry and Application Signals SLOs, cross-account log aggregation, Synthetics and RUM, EventBridge and Systems Manager automation, auto scaling and safe remediation.
8 Cost and exam practice Savings Plans, Reserved Instances and Spot, Graviton and Compute Optimizer, Bedrock cost levers, data transfer and NAT costs, tagging and cost categories, Budgets and Cost Anomaly Detection, S3 and EBS tiering. Then full timed practice exams; review every wrong answer.

How to use practice questions well

  • Practice the length. Do full 75-question sets in 180 minutes; reading stamina is half the challenge.
  • Find the qualifier. Many wrong answers work but cost more, take more effort to run or miss one constraint.
  • Read the wrong options. They are usually real services solving a neighboring problem, or the right service set up the wrong way.
  • Don’t memorize questions. The real exam won’t reuse them.
  • Aim for 80% or more across a few full timed practice exams before you book.

Get hands-on

In a personal account with a budget alert set: create an organization with a few OUs and an SCP and RCP, set up IAM Identity Center, share a subnet through RAM, build a Transit Gateway between two VPCs, call a Bedrock model with a guardrail attached, and run a Fault Injection Service experiment against an Auto Scaling group. Delete everything afterward.

Frequently asked questions

Should I take SAP-C02 or SAP-C03?

SAP-C02 can be taken until November 16, 2026, and SAP-C03 from November 17, 2026. If your exam date is after that, study for SAP-C03. The core is similar, but SAP-C03 adds generative AI, agents, responsible AI, post-quantum cryptography and more operations content, and the passing score drops from 750 to 720. See what changed from SAP-C02 to SAP-C03.

Do I need the associate certification first?

No, AWS has no prerequisites. Most candidates find Solutions Architect – Associate (SAA) knowledge a big help, because this exam assumes it and goes much further into multi-account, hybrid and migration design.

How much AI and ML do I need?

Architecture, not data science. Know how to integrate Amazon Bedrock, build agents and RAG, host models on SageMaker AI endpoints, control costs, and apply guardrails and logging. Model training and fine-tuning are out of scope, and individual AI services such as Comprehend or Textract are no longer on the service list.

Which services are no longer right answers?

AWS Application Migration Service is now AWS Transform MGN. OpsWorks has reached end of life. Incident Manager, Audit Manager and CloudTrail Lake are closed to new customers, and the X-Ray SDKs and daemon are in maintenance mode in favor of AWS Distro for OpenTelemetry. The exam guide also lists out-of-scope services such as Service Catalog, WorkSpaces, App Runner and AWS Batch.

Are the practice questions the real exam questions?

No. Every question on this site is original, written from the public exam guide and checked against AWS documentation. Using real exam questions breaks the AWS Certification Program Agreement.

Test yourself

The free SAP-C03 practice exam has 75 questions with an explanation for every option. No sign-up needed.

Take the free practice examReview questions untimed

Want to be sure you're ready? The 5 full-length practice sets add 375 new questions, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets