AWS Certified Solutions Architect - Associate (SAA-C03)

SAA-C03 Exam Prep Notes

Based on the official exam guide scope as of October 2026About 30 min read

A complete summary of the SAA-C03 exam scope, short enough to reread in the last 30 minutes before the exam. Use it as a final check after working through all four domains in the learning course and finding your weak spots with the practice questions. Read the table that maps question cues to the right answer, and the wrong-answer patterns and traps, first.

Exam facts and approach

The exam has 65 questions in 130 minutes, including 15 unscored questions, and you cannot tell which questions are unscored.
Results are reported as a scaled score from 100 to 1,000, and the passing score is 720.
Scoring is compensatory, so there is no per-domain passing line and you only need 720 overall.
There are two question formats: multiple choice, where you choose one answer, and multiple response, where you choose two or more.
Unanswered questions are counted as incorrect, and there is no penalty for guessing, so answer every question.
The weights are 30% for Domain 1 Secure, 26% for Domain 2 Resilient, 24% for Domain 3 High-Performing, and 20% for Domain 4 Cost-Optimized.
Most questions ask you to read the requirements from a scenario and choose the most suitable architecture.
Condition words such as "lowest operational overhead" and "most cost-effective" are the key to narrowing plausible choices down to one.

Question cues and the right answer

Cue in the question	Direction of the answer
Lowest operational overhead	Managed services or serverless (avoid custom scripts and managing EC2)
Most cost-effective	The cheapest choice that meets the requirements (performance beyond the requirements is unnecessary)
Do not use long-term access keys	Temporary credentials from IAM roles
Prohibit in all accounts in the organization, including administrators	Service control policies in AWS Organizations
Employees access multiple accounts with a single sign-in	AWS IAM Identity Center
Sign-up and sign-in for apps for the general public	Amazon Cognito
Reach S3 or DynamoDB without traversing the internet	Gateway endpoints
Expose only your own service to other VPCs	AWS PrivateLink endpoint services
Decide in-house who can use keys, and rotate them automatically every year	AWS KMS customer managed keys
Change database passwords automatically on a schedule	AWS Secrets Manager
SQL injection or large volumes of requests from a single IP	AWS WAF
Detect suspicious communication or API calls	Amazon GuardDuty
Fail over a database automatically during an AZ failure	RDS Multi-AZ deployments
Orders are lost because processing cannot keep up with sudden spikes	An Amazon SQS queue and Auto Scaling based on the queue backlog
Multiple systems each receive one event	Fan-out from Amazon SNS to multiple SQS queues
Resume writes in about 1 minute even during a Regional failure	Aurora Global Database
Read and write anywhere across multiple Regions	DynamoDB global tables
Shared files used at the same time by instances in multiple AZs	Amazon EFS
DynamoDB reads in microseconds	DynamoDB Accelerator (DAX)
Fixed IP addresses and TCP or UDP traffic	AWS Global Accelerator or Network Load Balancer
Occasional SQL on data stored in S3	Amazon Athena
Processing that can resume where it left off after an interruption	Spot Instances
S3 data with unpredictable access frequency	S3 Intelligent-Tiering
Kept for years, and retrieval within 12 hours is acceptable	S3 Glacier Deep Archive
Keep the discount even when changing EC2 families or Regions	Compute Savings Plans

Wrong-answer patterns

Eliminate choices that embed access keys in configuration files, user data, AMIs, or apps.
Eliminate choices that write deny rules in security groups. Security groups support only allow rules.
Eliminate choices that claim detection services such as GuardDuty, AWS Config, and Inspector stop operations or attacks.
Be suspicious of choices that try to solve availability or sudden spike problems just by making instances larger.
When the question has an operational overhead condition, eliminate choices that replace a managed feature with scheduled scripts or custom replication.
Eliminate choices that send reads to the standby of a Multi-AZ deployment. Read distribution is done with read replicas.
Eliminate choices that claim read replicas fail over automatically during a failure. Failover requires a promotion operation.
Eliminate choices that claim one SQS queue shared by multiple systems delivers to all of them.
Eliminate choices that handle UDP traffic with CloudFront.
Eliminate choices that buy Reserved Instances for processing that runs only at night.
Eliminate choices that pick Glacier Flexible Retrieval or Glacier Deep Archive for a requirement of immediate retrieval.

Key points by domain

Domain 1 Design Secure Architectures (30%)

Use IAM Identity Center for human sign-in, IAM roles for applications, and for another account, a role whose trust policy allows it to be assumed.
Service control policies set the maximum permissions for accounts in the organization, and even administrators cannot perform denied operations.
Security groups have allow-only rules at the instance level, and return traffic is allowed automatically. Network ACLs evaluate allow and deny rules in number order at the subnet level.
Encryption at rest uses AWS KMS, customer managed keys are used when you decide who can use keys, and encryption in transit uses TLS and the aws:SecureTransport condition.
Block Public Access stops S3 from being public, origin access control lets only CloudFront read, and presigned URLs grant time-limited access.

Domain 2 Design Resilient Architectures (26%)

Place SQS queues between processing steps for loose coupling, and scale the processing side based on the queue backlog.
Spread Auto Scaling groups and ALBs across two or more AZs, and replace unhealthy instances based on health checks.
RDS Multi-AZ deployments provide synchronous replication and automatic failover, and read replicas provide asynchronous replication and read distribution.
Prepare for Regional failures with Aurora Global Database, DynamoDB global tables, S3 Cross-Region Replication, and Route 53 failover routing.
For disaster recovery, RTO and RPO become shorter and costs become higher in the order backup and restore, pilot light, warm standby, and multi-site.

Domain 3 Design High-Performing Architectures (24%)

EBS is for block storage on one instance, EFS for shared files, FSx for Lustre for fast reads in compute-intensive workloads, and S3 for objects.
gp3 lets you specify IOPS separately from capacity, and io2 is used when high IOPS and durability are needed.
Separate repeated queries with ElastiCache, DynamoDB reads with DAX, and heavy reads with Aurora Replicas from the writes.
CloudFront is for delivering web content, Global Accelerator for fixed IP addresses and TCP or UDP, and Network Load Balancer for ultra-low-latency TCP.
Kinesis Data Streams is for ingesting large volumes of data in order, Athena for SQL on S3, and Redshift for large-scale aggregation.

Domain 4 Design Cost-Optimized Architectures (20%)

Use Savings Plans or Reserved Instances for steady usage, Spot Instances for interruptible processing, and On-Demand for short-term or unpredictable usage.
Compute Savings Plans apply their discount regardless of EC2 family, size, Region, or OS, and they also apply to Fargate and Lambda.
In S3, use Intelligent-Tiering for unpredictable access, Glacier Instant Retrieval for data read rarely but immediately, and Glacier Deep Archive for long-term retention, and move objects with lifecycle rules.
For few irregular calls, use API Gateway and Lambda, and for hard-to-predict database load, use Aurora Serverless v2, paying only for what you use.
Use Cost Explorer for cost trends, Budgets for budget and forecast notifications, and Compute Optimizer for reviewing types and sizes.

Services in one line

Name	In one line
AWS IAM Identity Center	Single sign-on to multiple accounts for employees
Amazon Cognito	Sign-up and sign-in for apps for the general public
AWS Secrets Manager	Storing secrets such as passwords and rotating them automatically
AWS WAF	Inspecting and blocking web requests
AWS Shield Advanced	Protection against large-scale DDoS attacks and consultation with a specialized team
Amazon GuardDuty	Finding suspicious communication and operations in logs
Amazon Macie	Finding sensitive data such as personal information in S3
AWS PrivateLink	Private connectivity to services in other VPCs
Amazon SQS	A queue that holds messages
Amazon SNS	Delivering messages to all subscribed destinations
AWS Step Functions	Connecting multiple steps with retries and branching
AWS Backup	Managing backups of multiple services under one policy
AWS Global Accelerator	Delivering to the nearest Region through static anycast IPs
Amazon RDS Proxy	Pooling and sharing database connections
Amazon EFS	A shared file system used at the same time from multiple AZs
Amazon FSx for Lustre	A fast file system for compute-intensive workloads
DynamoDB Accelerator (DAX)	An in-memory cache dedicated to DynamoDB
Amazon Kinesis Data Streams	Receiving large volumes of data in order for multiple readers
AWS Compute Optimizer	Recommending type and size changes based on usage records
AWS Budgets	Notifications for budgets and forecast amounts

Top 15 traps

Service control policies do not grant permissions. They only set the maximum, and an allow in an IAM policy is also required.
Users cannot modify the key policy of an AWS managed key.
ACM does not automatically renew certificates imported into ACM. Only certificates issued by ACM are renewed automatically.
Gateway endpoints are available only for S3 and DynamoDB.
VPC peering cannot be established when IP address ranges overlap, and traffic does not reach VPCs beyond a peered VPC.
An EBS volume is a resource within one AZ and cannot be attached to instances in another AZ.
Instance store data is lost when the instance is stopped.
The CloudWatch alarm recover action recovers on other hardware in the same AZ and does not help during an AZ failure.
S3 replication requires versioning on both the source and destination buckets.
The maximum execution time of a single Lambda invocation is 15 minutes.
SQS standard queues do not guarantee ordering, and the same message can be delivered twice. If you need ordering and deduplication, use a FIFO queue.
The baseline IOPS of gp2 is proportional to capacity, while gp3 lets you specify IOPS separately from capacity.
Consulting the specialized team of Shield Advanced also requires a Support plan of Business or higher.
Dedicated Hosts and Dedicated Instances are options for bringing your own licenses or for regulatory and compliance needs; do not choose them simply to lower costs.
Amazon Data Lifecycle Manager handles EBS snapshots and AMIs, and RDS and DynamoDB are handled by AWS Backup.

Last-minute checklist

I can state the number of questions, the exam time, the number of unscored questions, and the passing score.
I can state the names and weights of the four domains.
I can explain when to use IAM roles, service control policies, IAM Identity Center, and Cognito.
I can state three differences between security groups and network ACLs.
I can explain the difference between gateway endpoints and interface endpoints.
I can explain the difference between KMS customer managed keys and AWS managed keys.
I can state the role of WAF, Shield, and GuardDuty in one sentence each.
I can explain the difference between RDS Multi-AZ deployments and read replicas.
I can explain when to use SQS, SNS, and Kinesis Data Streams.
I can list the four disaster recovery strategies in order of shortest RTO.
I can distinguish Route 53 failover, weighted, latency, and geolocation routing.
I can explain when to use EBS, EFS, FSx for Lustre, and S3.
I can explain the difference between ElastiCache and DAX.
I can explain the difference between CloudFront and Global Accelerator.
I can explain when to use On-Demand, Savings Plans, Reserved Instances, and Spot Instances.
I can list the S3 storage classes in order of fastest retrieval.
I can state the roles of Cost Explorer, Budgets, and Compute Optimizer.