What SAA-C03 actually tests

The AWS Certified Solutions Architect - Associate (SAA-C03) is not a memorization exam about every AWS service. It tests whether you can choose the right architecture under constraints: cost, performance, resilience, security, and operational simplicity.

Expect the exam to focus on design decisions, not administration minutiae. You will see scenarios like:

A web application needs to survive an AZ failure.
A database is hitting read bottlenecks.
A company wants secure hybrid connectivity to AWS.
An object store needs lifecycle control and cross-region protection.
A workload needs lower cost without sacrificing availability.

The exam currently has 65 questions, with a mix of multiple choice and multiple response, and a 130-minute time limit. Passing score is scaled. You do not need to know the exact scoring model; you do need to read carefully because AWS loves answer choices that are technically valid but not the best architectural fit.

The domain weighting matters:

Design Secure Architectures – 30%
Design Resilient Architectures – 26%
Design High-Performing Architectures – 24%
Design Cost-Optimized Architectures – 20%

That weighting tells you how to study. Security and resilience come first. Performance is close behind. Cost matters, but usually as a tradeoff layered onto the first three.

This certification is for you if you already work with AWS at least occasionally and want to prove you can design solutions, not just click through the console. If you are brand new to cloud, this is still achievable, but only if you build hands-on familiarity with the core services instead of treating it like a vocabulary test.

The 30% domain: secure architecture choices that AWS expects you to know cold

This is the biggest domain, and it shows up everywhere else too. In SAA-C03, security is not a separate chapter. It is embedded in networking, storage, compute, and data design.

Start with IAM. You need to understand:

Users, groups, roles, and policies
Identity-based vs resource-based policies
IAM roles for EC2, Lambda, and cross-account access
Permission boundaries at a conceptual level
Least privilege and why hardcoded credentials are almost always wrong
STS temporary credentials
Federation basics, especially when the scenario mentions an existing corporate identity provider

Know when to use resource policies:

S3 bucket policies
KMS key policies
Lambda resource policies
Secrets Manager / Systems Manager Parameter Store access patterns

For data protection, focus on encryption at rest and in transit:

SSE-S3, SSE-KMS, SSE-C for S3
EBS encryption
RDS encryption and snapshot behavior
EFS encryption
TLS termination on ALB and CloudFront
AWS Certificate Manager (ACM) for managed certificates
KMS customer managed keys vs AWS managed keys

You should be able to answer questions like:

When is SSE-KMS preferable to SSE-S3?
What changes when you need auditability or key rotation control?
Which services integrate directly with KMS?

Networking security is heavily tested. Be clear on the difference between:

Security groups: stateful, instance/ENI level, allow rules only
Network ACLs: stateless, subnet level, allow and deny rules
AWS WAF: Layer 7 filtering for web traffic
AWS Shield: DDoS protection
AWS Firewall Manager: centralized policy management across accounts

For VPC design, know:

Public vs private subnets
Internet Gateway vs NAT Gateway
Route tables and subnet associations
VPC endpoints: Gateway endpoints for S3/DynamoDB and Interface endpoints via PrivateLink
Why private access to AWS services through endpoints is better than hairpinning through the internet
VPC peering limitations, especially non-transitive routing
Transit Gateway for hub-and-spoke connectivity
Site-to-Site VPN vs Direct Connect

This domain also expects practical security services knowledge:

AWS Organizations and Service Control Policies (SCPs)
CloudTrail for API auditing
Config for configuration tracking and compliance
GuardDuty for threat detection
Security Hub for centralized findings
Inspector at a high level
Secrets Manager vs SSM Parameter Store

Priority list for this domain:

IAM roles and policies
VPC security constructs
KMS and encryption choices
S3 access control and bucket policy logic
Organizations/SCPs
CloudTrail, Config, GuardDuty, Security Hub

Hard part: AWS often gives you two secure answers. The better answer usually removes operational overhead. Example: choose IAM role attached to EC2 over storing access keys on the instance. Choose Secrets Manager rotation over manual secret storage. Choose VPC endpoints over NAT traversal when the requirement is private service access.

The 26% domain: resilience means designing for failure before it happens

This domain is classic SAA. AWS wants you to assume components fail and design so the application keeps working or recovers predictably.

Start with Availability Zones, Regions, and edge locations. You need to know what each provides and when multi-AZ is enough versus when multi-region is required.

Core compute resilience topics:

EC2 Auto Scaling across multiple AZs
Elastic Load Balancing: mainly ALB, NLB, and when GWLB appears conceptually
Health checks and target groups
Stateless app tier design
Launch templates and immutable replacement patterns

Storage and data resilience are constant exam material.

For S3, know:

Designed for high durability
Versioning
Cross-Region Replication (CRR) and Same-Region Replication (SRR)
Lifecycle policies
Object Lock and retention basics
Event notifications and decoupled designs

For databases, understand the resilience patterns, not just product names:

RDS Multi-AZ for failover and high availability
RDS Read Replicas for scaling reads, and sometimes DR
Aurora architecture basics, especially reader endpoints and storage resilience
DynamoDB with multi-AZ managed resilience, plus global tables for multi-region active-active patterns
ElastiCache as a performance layer that reduces backend load but introduces cache design questions

A few distinctions matter a lot:

RDS Multi-AZ is for availability; Read Replicas are for read scaling.
EBS is AZ-scoped; snapshots live in S3 and can restore elsewhere.
EFS is regional and multi-AZ by design.
Instance store is ephemeral; do not choose it for persistent critical data.

Expect event-driven resilience scenarios too:

SQS for decoupling and buffering
SNS for fan-out notifications
EventBridge for event routing and integration
Lambda for serverless processing
Step Functions at a high level for orchestration

Know the queueing details that show up in architecture questions:

Standard vs FIFO SQS
Visibility timeout
Dead-letter queues
Decoupling producers and consumers to absorb traffic spikes

Disaster recovery patterns are fair game. You should understand the tradeoffs among:

Backup and restore
Pilot light
Warm standby
Multi-site active-active

You do not need to write a DR runbook, but you must choose the right pattern based on RTO/RPO requirements and cost constraints.

What to practice here:

Designing a 2-tier or 3-tier app across multiple AZs
Migrating a single-instance database to Multi-AZ or Aurora
Using S3 versioning + CRR for critical objects
Adding SQS between a web tier and worker tier
Replacing direct service calls with asynchronous patterns when reliability matters

Exam trap: if a workload must survive an AZ failure, a single EC2 instance with EBS is not enough even if backups exist. If the requirement says minimal downtime, think failover architectures, Multi-AZ, load balancing, and managed services.

The 24% domain: performance questions are really about picking the right service and data path

This domain rewards breadth. You need to understand how compute, storage, networking, and databases behave under load.

For compute, know the decision points among:

EC2 for full control, custom OS, long-running workloads
Lambda for event-driven, short-lived, scalable functions
ECS and Fargate for containers without managing Kubernetes complexity
EKS at a high level when Kubernetes is a hard requirement
Elastic Beanstalk conceptually, though less central than EC2/Lambda/ECS

Know the EC2 features that affect performance:

Instance families: general purpose, compute optimized, memory optimized, storage optimized
Enhanced networking
Placement groups: cluster, spread, partition
EBS volume types: gp3, io1/io2, throughput implications
EFS performance modes and shared filesystem behavior

For content delivery and web performance:

CloudFront with S3 or custom origins
Caching at edge locations
Signed URLs/signed cookies at a conceptual level
Global Accelerator when the requirement is improved global application pathing for TCP/UDP or static anycast IPs
Route 53 routing policies: latency, failover, weighted, geolocation, geoproximity, multivalue

Database performance is a major differentiator on this exam.

Relational side:

RDS Read Replicas for read-heavy workloads
Aurora Replicas and endpoints
When to choose Aurora Serverless v2 conceptually versus provisioned
Connection management basics

NoSQL side:

DynamoDB partitioning behavior at a high level
On-demand vs provisioned capacity
DAX for microsecond read caching
Global tables for low-latency multi-region reads/writes
TTL and Streams conceptually

Caching:

ElastiCache for Redis vs Memcached
Redis for persistence/features; Memcached for simple distributed caching
Session storage, hot data, and reducing database load

Storage performance choices show up often:

S3 for object storage, massively scalable, not a POSIX filesystem
EFS for shared Linux file access
FSx variants when Windows or high-performance file systems are required
EBS for block storage attached to EC2

You should be able to map requirements to storage quickly:

Shared web content across many Linux instances -> EFS
Boot volume for EC2 -> EBS
Static website assets with global users -> S3 + CloudFront
Windows shared file storage -> FSx for Windows File Server

Networking performance topics that matter:

Direct Connect for consistent private throughput
VPN as faster-to-deploy but internet-based
Transit Gateway simplifying network architecture at scale
Elastic Load Balancer choice by protocol and use case

This domain is where many candidates overcomplicate. The exam usually rewards the managed service that matches the access pattern. If the problem is unpredictable traffic, Lambda, DynamoDB on-demand, or Aurora Serverless may be favored. If the problem is global static content, CloudFront is almost always in the right answer.

The 20% domain: cost optimization without breaking the design

Cost questions in SAA-C03 are not finance questions. They are architecture questions with price sensitivity.

You need to know where AWS expects obvious savings:

Right-sizing EC2
Auto Scaling instead of fixed overprovisioning
Reserved Instances and Savings Plans at a conceptual level
Spot Instances for interruptible workloads
Choosing serverless when idle time is high
Moving data to cheaper storage classes
Reducing NAT Gateway, data transfer, and duplicate service costs

For compute pricing decisions:

On-Demand: flexible, no commitment
Reserved Instances / Savings Plans: steady-state discounts
Spot: best for fault-tolerant, batch, stateless, or flexible workloads
Dedicated options exist, but they are less common in SAA questions unless compliance or licensing is mentioned

For storage, know S3 storage classes well:

S3 Standard
S3 Intelligent-Tiering
S3 Standard-IA
S3 One Zone-IA
S3 Glacier Instant Retrieval
S3 Glacier Flexible Retrieval
S3 Glacier Deep Archive

You should be able to choose based on:

Access frequency
Retrieval speed requirements
Resilience requirements
Archive retention period

Cost optimization patterns that show up repeatedly:

Use S3 lifecycle policies to move aging objects automatically
Use EFS Infrequent Access when appropriate
Use gp3 instead of older EBS defaults when it fits
Use CloudFront to reduce origin load and potentially transfer costs
Use VPC endpoints for some traffic patterns instead of routing everything through NAT
Use RDS Reserved Instances for stable production databases
Use Aurora Serverless or Lambda for variable workloads

Monitoring cost is part of architecture discipline:

AWS Cost Explorer
Budgets
Trusted Advisor
Compute Optimizer
CloudWatch for usage visibility tied to scaling decisions

Common exam logic:

If a workload can tolerate interruption, Spot is usually the cheapest valid answer.
If data is rarely accessed and retrieval time is acceptable, archive classes beat Standard-IA.
If a service is idle most of the day, a serverless design often wins.
If the requirement says lowest cost but also no operational overhead, managed services beat self-managed clusters.

Do not optimize cost in a way that violates the primary requirement. AWS will often tempt you with a cheaper answer that weakens durability, availability, or security.

What to study first, second, and last: a realistic prep sequence

Do not study by alphabetical service list. Study by architectural building blocks.

Phase 1: Core platform map

Spend your first block of time on the services that appear in almost every scenario:

IAM
VPC
EC2
S3
RDS/Aurora
DynamoDB
Route 53
ELB + Auto Scaling
Lambda
CloudFront
SQS/SNS/EventBridge
KMS

If you cannot explain how these services fit together in a production app, you are not ready for practice exams.

Phase 2: Design patterns by requirement

Now study by problem type:

High availability: Multi-AZ, load balancing, failover routing, backups
Security: IAM roles, KMS, private networking, WAF, SCPs
Performance: caching, read replicas, CloudFront, storage selection
Cost: lifecycle policies, Spot, Savings Plans, serverless, right-sizing

Phase 3: Edge cases and service comparisons

This is where your score improves:

NAT Gateway vs VPC endpoint
RDS Multi-AZ vs Read Replica
ALB vs NLB
EBS vs EFS vs S3 vs FSx
SQS vs SNS vs EventBridge
Aurora vs RDS MySQL/PostgreSQL
DynamoDB vs RDS
CloudFront vs Global Accelerator

Timeline by experience

If you already work with AWS weekly:

4-6 weeks is realistic.
Week 1-2: refresh core services and weak spots
Week 3-4: domain-based review and architecture patterns
Week 5: heavy practice questions and explanation review
Week 6: final gap closing, light review, exam

If you have some AWS exposure but do not design often:

7-9 weeks is more realistic.
Spend the first 3 weeks building service understanding and simple labs.
Use the next 3 weeks for domain-focused study.
Use the last 2-3 weeks for practice sets, retakes, and note consolidation.

If you are new to AWS:

Plan for 10-12 weeks.
You need console time, not just videos.
Build a VPC, launch EC2, attach an IAM role, create an ALB, use S3 lifecycle policies, deploy an RDS instance, create a Lambda trigger, and configure CloudFront.

A good weekly rhythm:

2-3 study sessions for concept learning
1 hands-on lab block
2 practice-question sessions with deep review of why wrong answers are wrong

With 1000 practice questions available on Truekia, do not burn through them too early. Use them in waves:

First 200-300: identify weak domains
Middle 400-500: train pattern recognition and timing
Final 200: mixed review under exam conditions

Resources worth your time for this exam

Use a small set of high-quality resources and revisit them. Too many sources creates noise.

Official AWS material

AWS Certified Solutions Architect - Associate exam guide
- Start here for the exact scope.
AWS Skill Builder
- Use the official learning paths and exam prep content.
AWS Well-Architected Framework
- Especially the pillars around operational excellence, security, reliability, performance efficiency, and cost optimization.
AWS Whitepapers and docs most relevant to SAA-C03:
- Amazon VPC documentation
- IAM User Guide
- Amazon S3 documentation
- Amazon EC2 documentation
- Elastic Load Balancing documentation
- Amazon Route 53 documentation
- Amazon RDS and Aurora docs
- Amazon DynamoDB docs
- AWS Lambda developer guide
- AWS KMS developer guide

Do not read every page. Read architecture overviews, feature comparison pages, FAQs, and pricing-related summaries.

Courses that map well to SAA-C03

Adrian Cantrill – AWS Solutions Architect Associate
- Deep and hands-on. Best if you want strong understanding, not just exam tricks.
Stephane Maarek – AWS Certified Solutions Architect Associate SAA-C03 on Udemy
- Efficient and exam-focused. Good for structured review and reinforcement.
AWS Skill Builder official prep
- Useful to align with AWS wording and exam style.

Books

AWS Certified Solutions Architect Associate Study Guide: SAA-C03 Exam by Ben Piper and David Clinton
- Strong as a reference and structured review companion.

Hands-on practice

AWS Free Tier
- Enough for many core labs if you are careful.
Workshops.aws
- Official workshops for guided practical work.
Well-Architected Labs
- Good for understanding design tradeoffs in AWS terms.

Practice questions

Use practice tests only if you review every explanation. For this exam, explanation quality matters more than score.

With the 1000 Truekia questions, create a tracking sheet for:

Service/topic missed
Why you missed it: knowledge gap, reading error, or AWS trap answer
Correct design principle involved

Patterns in your mistakes matter. If you keep missing questions where both answers are viable, your issue is probably not service knowledge. It is requirement prioritization.

How to answer SAA-C03 questions like an architect, not a guesser

Most wrong answers on this exam fail one of four tests:

They do not meet the stated requirement.
They add unnecessary operational overhead.
They are less resilient or less secure than another option.
They are more expensive without delivering extra value.

Use this elimination method:

Find the primary requirement: security, HA, latency, cost, migration speed, or minimal ops.
Find the constraint: existing on-prem environment, relational database, private connectivity, global users, unpredictable traffic.
Remove answers that violate either one.
Between the remaining choices, pick the one that is most managed and best aligned with AWS best practices.

Examples of common exam instincts that usually help:

Prefer managed services over self-managed EC2 builds when requirements allow.
Prefer multi-AZ for production HA.
Prefer IAM roles over static credentials.
Prefer private connectivity with endpoints when the requirement is secure private access.
Prefer SQS when decoupling is needed.
Prefer CloudFront for global content delivery.
Prefer DynamoDB for massive key-value scale with simple access patterns.
Prefer Aurora/RDS for relational requirements, transactions, and SQL.

Words that should trigger specific thinking:

Durable -> S3, versioning, backups, replication
Shared file system -> EFS or FSx, not S3/EBS
Low-latency global users -> CloudFront, Route 53 latency routing, Global Accelerator depending on protocol
Static website -> S3 + CloudFront
Hybrid connectivity -> VPN or Direct Connect
Audit/API logs -> CloudTrail
Configuration compliance -> Config
DDoS/web exploits -> Shield/WAF
Least administrative effort -> managed service answer likely wins

This exam is less about obscure facts than disciplined reading.

Last 72 hours and exam-day tactics

In the final three days, stop trying to learn every AWS service. Tighten the core set.

Review these comparisons one last time:

ALB vs NLB
Security group vs NACL
NAT Gateway vs VPC endpoint
RDS Multi-AZ vs Read Replica
EBS vs EFS vs S3 vs FSx
SQS vs SNS vs EventBridge
Reserved capacity vs Spot vs On-Demand
SSE-S3 vs SSE-KMS
Aurora vs standard RDS
CloudFront vs Global Accelerator

Do one or two timed mixed sets. Then review calmly. If you are still missing VPC questions at that point, focus there. VPC, IAM, storage, and database choices move scores fast.

On exam day:

Read the last sentence first if the scenario is long. It often tells you what is being optimized.
Watch for qualifiers like MOST cost-effective, MOST secure, with the LEAST operational overhead, highly available, fault tolerant, scalable, private access.
In multiple response questions, do not pick a pair of individually good services unless they work together for the scenario.
Flag long scenario questions that involve migration or hybrid networking and return after easier wins.
Manage time. You have enough if you do not overthink every item.

If you test from home, make sure your room and desk setup meet Pearson VUE rules well before the appointment. The easiest exam point to lose is the one you never get to answer because of check-in problems.

Final blunt advice: for SAA-C03, your score improves fastest when you master service selection under constraints. Know the core AWS services deeply enough that the right architecture feels obvious. That is what the exam is measuring.