AWS SAA-C03 Exam Guide: How to Pass the Solutions Architect Exam

The AWS Certified Solutions Architect – Associate (SAA-C03) is one of the most valuable and widely recognised cloud certifications in the industry. It validates your ability to design scalable, cost-effective, secure, and highly available solutions on AWS. This final lesson covers everything you need to know about the exam itself — structure, domains, high-yield topics, and a preparation strategy that works.

Exam Overview

The exam is scenario-based. Questions describe a business or technical requirement and ask you to choose the most appropriate AWS service or architecture — not just any answer that works, but the best one given the constraints.

Domain Breakdown

Domain 1 (Security) has the highest weight — every architecture question has a security dimension. If two answers are technically correct, the more secure one wins.

High-Yield Topics by Domain

Domain 1: Security (30%)

• IAM: Least privilege, roles vs users, resource-based vs identity-based policies, SCP guardrails, sts:AssumeRole
• VPC Security: Security Groups (stateful) vs NACLs (stateless), private subnets, VPC endpoints (no public internet required)
• Encryption: KMS for key management, SSE-S3 vs SSE-KMS vs SSE-C for S3, RDS encryption at rest, encryption in transit (TLS)
• Threat detection: GuardDuty (intelligent threat detection), Macie (S3 sensitive data detection), Inspector (EC2/container vulnerability scanning)
• Compliance services: CloudTrail (API audit log), Config (resource configuration history), Security Hub (aggregated findings)
• Web protection: WAF (Layer 7 rules — block SQL injection, XSS), Shield Standard (free DDoS protection), Shield Advanced (enhanced DDoS + 24/7 DRT)

Domain 2: Resilience (26%)

• Multi-AZ vs Multi-Region: Multi-AZ = high availability; Multi-Region = disaster recovery
• RDS: Multi-AZ (synchronous standby, automatic failover) vs Read Replicas (asynchronous, read scaling)
• Auto Scaling: Target tracking, step scaling, scheduled scaling, predictive scaling; warm-up vs cooldown
• ELB: ALB for HTTP/content routing, NLB for TCP/UDP/static IP; health checks, deregistration delay
• Route 53: Failover, latency, weighted, geolocation routing policies; health checks
• Disaster recovery: Backup & Restore → Pilot Light → Warm Standby → Multi-Site Active/Active; RTO vs RPO trade-offs

Domain 3: Performance (24%)

• Storage selection: S3 for objects, EFS for shared file system (NFS), EBS for block storage (single instance)
• Database selection: RDS for relational/ACID, DynamoDB for NoSQL/scale/millisecond latency, Redshift for analytics/OLAP, ElastiCache for caching
• Compute selection: EC2 families (C for CPU, R for memory, I for storage), Lambda for event-driven, Fargate for containerised workloads
• Content delivery: CloudFront for caching static/dynamic content at edge, Global Accelerator for TCP/UDP performance (anycast routing)
• Streaming: Kinesis Data Streams for real-time multi-consumer; SQS for decoupled queuing

Domain 4: Cost Optimisation (20%)

• EC2 pricing: On-Demand → Savings Plans → Reserved Instances → Spot; know the correct model for each workload description
• S3 cost: Standard → Standard-IA → Glacier Instant → Glacier Flexible → Deep Archive; lifecycle rules to automate transitions
• Serverless economics: Lambda + API Gateway + DynamoDB has no idle cost; compare to always-on EC2
• Data transfer: Inter-AZ transfer costs money; within the same AZ is free; use VPC Gateway Endpoints for S3/DynamoDB to avoid NAT Gateway charges

Exam Question Strategies

Identify the Constraint First

Every SAA-C03 scenario has a constraint embedded in the requirements. Identify it before looking at the answers: "minimum operational overhead" means choose managed/serverless (RDS over EC2 + MySQL, DynamoDB over EC2 + Redis), "most cost-effective" means Spot Instances, Reserved, S3 lifecycle, or serverless, "highest availability" means Multi-AZ, multi-region, Auto Scaling, "compliance requires data stays in one region" rules out multi-region services, and "existing application requires no code changes" points to lift-and-shift options (EC2, RDS, not Lambda).

The Most Common Wrong Answers

• Choosing EC2 when a managed service (Lambda, RDS, Fargate) solves the problem with less overhead
• Choosing Multi-AZ when the question asks about read performance (use Read Replicas)
• Choosing Read Replicas when the question asks about automatic failover (use Multi-AZ)
• Choosing CloudFront when the question needs static IPs (use Global Accelerator or NLB)
• Choosing NAT Gateway when a VPC endpoint would be simpler and cheaper for AWS service access

Preparation Roadmap

Phase 1: Foundation (Weeks 1–2)

Complete this course from the beginning — Lessons 1–5 covering cloud computing fundamentals, global infrastructure, IAM, EC2, and S3.

Phase 2: Core Services (Weeks 3–4)

Complete Lessons 6–9 — VPC networking, databases, high availability, and architecture patterns.

Phase 3: Practice (Weeks 5–6)

Take the official AWS practice exam (20 questions, $20), then work through 65-question timed practice exams from providers like Tutorials Dojo (Jon Bonso) or Whizlabs. Target 80%+ before sitting the real exam. For every wrong answer, understand why the correct answer is right — don't just memorise the answer. Do hands-on labs with AWS Free Tier.

Phase 4: Final Review (Week 7)

Re-read the Well-Architected Framework whitepaper, review the services you got wrong most in practice exams, do a final 65-question timed mock exam under real conditions, and check the official SAA-C03 exam guide PDF from AWS for any recently added topics.

Services You Must Know Cold

Security:      IAM, KMS, VPC Security Groups, NACLs, WAF, GuardDuty, CloudTrail
Compute:       EC2 (all pricing models), Lambda, ECS/Fargate, Auto Scaling
Storage:       S3 (all storage classes), EBS, EFS
Database:      RDS (Multi-AZ + Read Replicas), DynamoDB, ElastiCache, Aurora
Networking:    VPC, Subnets, Route Tables, IGW, NAT Gateway, VPC Endpoints, ALB, NLB, Route 53
Integration:   SQS, SNS, EventBridge, Kinesis, Step Functions, API Gateway
Monitoring:    CloudWatch, CloudTrail, Config, X-Ray
Infrastructure: CloudFormation, Elastic Beanstalk
CDN:           CloudFront, Global Accelerator

On Exam Day

Arrive at Pearson VUE centre 30 minutes early (or start online check-in 30 minutes early). Bring two forms of ID — one must be government-issued with a photo. No notes, phones, or smartwatches in the testing room.

During the exam: flag questions you're unsure of and return to them. Pace yourself: 130 minutes / 65 questions = 2 minutes per question. If you finish early, review flagged questions — don't second-guess confident answers. Eliminate two options, then choose between the remaining two if stuck.

You receive a Pass/Fail result immediately on screen. The numeric score arrives within 5 business days in your AWS Certification account.

Previous: Lesson 9 — Solutions Architect Patterns | Back to course overview

Part of the AWS Cloud Fundamentals course.

External references:

• AWS Certified Solutions Architect Associate SAA-C03 — official exam guide from AWS