Every Exam PrepFREE EXAM PREP
Ask AI
STUDY GUIDE · AWS SAA-C03

AWS Certified Solutions Architect – Associate Study Guide

Verified against the AWS exam guide 6 sections
Written by Every Exam Prep Editorial TeamSource and review policyPublished July 18, 2026
Questions
65
Time limit
2h 10m
Passing score
720/1000 (scaled score, range 100–1,000)
Exam fee
$150
Governing body
Amazon Web Services (AWS)

The AWS Certified Solutions Architect – Associate credential is one of the most widely recognized cloud certifications, validating a professional's ability to design and deploy well-architected solutions on Amazon Web Services. Rather than testing rote memorization of service names, the exam probes whether a candidate can translate business and technical requirements into concrete architectural decisions: which compute service fits a workload, how to secure data in transit and at rest, and how to build systems that stay available when components fail.

This certification is aimed at people already working in or moving into cloud architecture, DevOps, and infrastructure engineering roles. It suits systems administrators, software developers, and IT professionals who have started designing distributed applications and want formal recognition of that skill.

Why It Matters

  • It signals to employers and clients that you can reason about trade-offs across security, performance, cost, and resilience rather than just clicking through the AWS console.
  • It is frequently listed as a preferred or required qualification for cloud architect, solutions engineer, and DevOps roles, making it a common gatekeeper credential in hiring pipelines.
  • Because AWS holds a dominant share of the public cloud market, this associate-level badge tends to open doors across a wide range of industries, not just tech-native companies.
  • It also serves as a strong foundation for pursuing AWS's professional-level and specialty certifications later in a career.

For many candidates, this exam is the first serious checkpoint that converts hands-on AWS experience into a portable, industry-recognized qualification.

Understanding the mechanics of the exam helps you plan your study timeline and test-day logistics with confidence.

Format and Scoring

  • The exam contains 65 questions that are either multiple choice or multiple response.
  • Of those, 50 questions affect your score, while 15 unscored questions do not affect your score — these are included by AWS to evaluate future exam content without penalizing candidates.
  • Candidates are given 130 minutes to complete the exam.
  • Results are reported as a scaled score of 100 to 1,000, and the minimum passing score is 720.

Cost and Delivery

  • The cost to take the exam is 150 USD.
  • AWS Certification exams are currently offered through Pearson VUE, and online proctoring is available for all AWS Certification exams from that provider, so candidates can test at a physical center or from home.
  • Candidates can reschedule up to 24 hours before their scheduled exam time, and each exam appointment can only be rescheduled twice.

Identification Requirements

Teen candidates ages 13 to 17 must present one form of photo ID, and school IDs are acceptable. When a minor is accompanied by a parent or guardian for testing, the accompanying parent or guardian must present a valid government-issued ID.

Recommended Background

The target candidate should have at least 1 year of hands-on experience designing cloud solutions that use AWS services. This is not a formal prerequisite, but it strongly shapes how the exam questions are written — they assume familiarity with real deployment scenarios rather than textbook definitions.

The exam validates a candidate's ability to design solutions based on the AWS Well-Architected Framework, and its content is organized into four content domains, each weighted differently in the scored portion of the exam.

Domain 1: Design Secure Architectures (30%)

Content Domain 1: Design Secure Architectures is 30% of scored content, making it the single heaviest domain. It covers designing secure access to AWS resources, secure application tiers, and appropriate data security controls — think IAM policies, encryption choices, network segmentation with VPCs and security groups, and least-privilege design patterns.

Domain 2: Design Resilient Architectures (26%)

Content Domain 2: Design Resilient Architectures is 26% of scored content. This domain focuses on designing scalable and loosely coupled architectures and designing highly available and fault-tolerant architectures, including multi-AZ deployments, decoupling with queues and event-driven patterns, and backup/disaster-recovery strategies.

Domain 3: Design High-Performing Architectures (24%)

Content Domain 3: Design High-Performing Architectures is 24% of scored content. It covers selecting high-performing storage, compute, database, and networking solutions, and identifying elastic and scalable solutions that match workload demand.

Domain 4: Design Cost-Optimized Architectures (20%)

Content Domain 4: Design Cost-Optimized Architectures is 20% of scored content. This domain tests the ability to identify cost-effective storage, compute, and database solutions, and to design cost-optimized network architectures — reflecting AWS's expectation that architects justify decisions in financial terms, not just technical ones.

Because the exam has four content domains and security carries the largest single weighting, candidates who under-invest in IAM, encryption, and network security concepts tend to underperform relative to their overall preparation.

Because the target candidate should have at least 1 year of hands-on experience designing cloud solutions that use AWS services, most successful study plans run six to eight weeks and blend conceptual review with hands-on practice, rather than passive reading alone.

Weeks 1-2: Build the Foundation

Start with core compute, storage, and networking services — EC2, S3, VPC, and IAM — since these underpin nearly every scenario question. Spend time in the AWS console building a small multi-tier application so the concepts are tied to muscle memory, not just flashcards.

Weeks 3-4: Go Deep on Security and Resilience

Given that secure and resilient architectures together make up the majority of scored content, dedicate focused time to IAM policy structure, encryption options (KMS, at-rest and in-transit), multi-AZ and multi-region designs, Auto Scaling, load balancing, and decoupling patterns using SQS and SNS.

Weeks 5-6: Performance and Cost

Round out coverage with storage class selection (S3 tiers, EBS types), database choices (RDS vs. DynamoDB vs. Aurora), caching layers, and cost-optimization levers like Reserved Instances, Savings Plans, and right-sizing.

Final 1-2 Weeks: Practice and Review

  • Take full-length timed practice exams under real conditions to build stamina for the exam's format.
  • Review missed questions by domain, not just by score, so you can see whether weaknesses cluster in security, resilience, performance, or cost.
  • Revisit AWS whitepapers and the Well-Architected Framework pillars in the final days, since scenario questions frequently mirror that framework's language.

Adjust the pace based on your existing hands-on experience — candidates newer to AWS may need eight to ten weeks, while those with daily production experience can often compress this into three or four.

Before Exam Day

  • Confirm your identification in advance — teen candidates ages 13 to 17 must present one form of photo ID, and school IDs are acceptable, while any accompanying parent or guardian must present a valid government-issued ID.
  • If you need to change your appointment, remember that candidates can reschedule up to 24 hours before their scheduled exam time, and each exam appointment can only be rescheduled twice, so avoid last-minute schedule changes.
  • Decide between an in-person Pearson VUE testing center and online proctoring well ahead of time, and if testing from home, check your room setup and equipment against the provider's requirements the day before.

During the Exam

  • With 65 questions and 130 minutes, budget roughly two minutes per question and flag lengthy scenario questions to revisit rather than getting stuck early.
  • Read the last sentence of each question first — it usually reveals what's actually being asked (most cost-effective, most secure, least operational overhead) before you get anchored on service names in the scenario text.
  • Eliminate obviously wrong answers first; AWS scenario questions often include one or two options that are technically valid but violate a stated constraint like cost or availability.
  • Don't assume every question needs the "best" AWS service — read for the specific constraint (compliance, latency, budget) since that constraint usually determines the correct answer.

Common Mistakes to Avoid

  • Memorizing service feature lists without understanding when to choose one service over a similar one.
  • Neglecting security-related content, given it carries the heaviest domain weighting.
  • Skipping hands-on practice and relying solely on video courses or flashcards.
  • Running out of time on the first pass because of over-analyzing early questions.

Beyond reading whitepapers and watching video courses, structured practice materials make the difference between recognizing AWS concepts and being able to apply them quickly under exam conditions.

Practice Questions

Scenario-style practice questions that mirror the exam's multiple-choice and multiple-response format help you get comfortable with the way AWS phrases constraints — cost, security, performance, or operational overhead — inside a realistic story problem. Working through timed sets across all domains also helps you calibrate pacing before the real 130-minute session.

Flashcards

Flashcards are well suited to the high-volume factual recall this exam demands: service limits, storage class characteristics, database engine differences, and IAM policy evaluation logic. Short, spaced repetition sessions on flashcards reinforce this material more efficiently than re-reading documentation.

Glossary

A glossary of AWS terminology is useful early in preparation, when unfamiliar service names and acronyms (VPC, KMS, IAM, RTO/RPO) can slow down comprehension of practice questions. Keeping a running glossary reference nearby lets you resolve unfamiliar terms quickly instead of losing momentum mid-study session.

Putting It Together

  • Use the glossary early to build vocabulary fluency.
  • Use flashcards throughout to reinforce facts and figures via spaced repetition.
  • Use practice questions in the final stretch to simulate exam conditions and identify weak domains.

Combining all three resource types tends to produce more durable retention than relying on any single study method alone.

AWS SAA-C03 flashcards

30 cards on the highest-yield terms and rules. Grading uses spaced repetition and saves in this browser.

Card 1 of 300 mastered
Say the answer out loud before flipping.
Browse all 30 cards
  1. What are the four content domains covered by the AWS Certified Solutions Architect – Associate exam?

    Design Secure Architectures, Design Resilient Architectures, Design High-Performing Architectures, and Design Cost-Optimized Architectures. Together they map to the pillars of the AWS Well-Architected Framework.

  2. What is Amazon S3 versioning used for?

    It keeps multiple variants of an object in the same bucket so accidental overwrites or deletes can be recovered by restoring a prior version, rather than being permanently lost.

  3. When should you choose an Application Load Balancer over a Network Load Balancer?

    Use an ALB for HTTP/HTTPS traffic that needs Layer 7 routing (path- or host-based rules, WebSocket, redirects). Use an NLB when you need ultra-low latency, static IPs, or must handle non-HTTP TCP/UDP traffic at Layer 4.

  4. What is the difference between a Security Group and a Network ACL?

    A Security Group is stateful and attaches to instances/ENIs, evaluating only allow rules. A Network ACL is stateless, applies at the subnet level, and supports both allow and deny rules evaluated in order.

  5. What does Amazon RDS Multi-AZ provide?

    A synchronously replicated standby database in a different Availability Zone that RDS automatically fails over to for high availability; it is for durability/availability, not for read scaling.

  6. What is the purpose of RDS Read Replicas?

    They provide asynchronously replicated copies of a database for offloading read traffic and improving read scalability; they can also be promoted to standalone instances for disaster recovery.

  7. What storage class should you choose for infrequently accessed data that must remain immediately retrievable?

    S3 Standard-Infrequent Access (S3 Standard-IA) — lower storage cost than S3 Standard with a retrieval fee, but data stays instantly accessible, unlike Glacier tiers.

  8. How does S3 Intelligent-Tiering work?

    It automatically moves objects between access tiers based on changing access patterns, without performance impact or operational overhead, optimizing storage cost when access patterns are unpredictable.

  9. What is the primary use case for AWS Direct Connect?

    A dedicated private network connection from an on-premises location to AWS, bypassing the public internet for more consistent bandwidth and lower latency than a VPN.

  10. What is a VPC endpoint and why use one?

    A VPC endpoint lets resources in a VPC privately connect to supported AWS services without traversing the public internet or requiring a NAT gateway or internet gateway, improving security and reducing data transfer cost.

  11. What is the difference between Gateway and Interface VPC endpoints?

    Gateway endpoints support only S3 and DynamoDB and use route table entries; Interface endpoints (powered by AWS PrivateLink) support most other AWS services and use an ENI with a private IP in your subnet.

  12. What does Auto Scaling use to decide when to add or remove instances?

    Scaling policies driven by CloudWatch metrics (such as target tracking on CPU utilization or a custom metric), scheduled actions, or predictive scaling based on historical load patterns.

  13. What is the AWS Well-Architected Framework's cost optimization pillar concerned with?

    Avoiding unnecessary costs by right-sizing resources, using appropriate pricing models (Reserved, Spot, Savings Plans), and continuously monitoring and adjusting spend as workload needs change.

  14. When is Amazon EC2 Spot Instances the right choice?

    For fault-tolerant, flexible workloads (batch processing, big data, CI/CD) that can tolerate interruption, since Spot offers steep discounts off On-Demand pricing in exchange for AWS being able to reclaim capacity.

  15. What is the purpose of AWS Global Accelerator?

    It improves availability and performance for global users by routing traffic over the AWS global network using static anycast IP addresses and directing users to the optimal healthy endpoint.

  16. What problem does Amazon CloudFront solve?

    It is a content delivery network (CDN) that caches content at edge locations close to users, reducing latency and offloading traffic from origin servers such as S3 or EC2.

  17. What is the difference between Amazon SQS and Amazon SNS?

    SQS is a message queue for decoupling and buffering point-to-point communication between producers and consumers; SNS is a pub/sub service that pushes messages to multiple subscribers (including SQS queues, Lambda, email) simultaneously.

  18. What is DynamoDB best suited for compared to RDS?

    DynamoDB is a fully managed NoSQL key-value/document database suited for high-throughput, low-latency workloads with flexible schemas, while RDS is a managed relational database suited for structured data needing complex queries and transactions across tables.

  19. What is the purpose of an AWS Transit Gateway?

    It acts as a central hub that simplifies network connectivity by letting you connect multiple VPCs and on-premises networks through a single gateway, instead of managing many point-to-point VPC peering connections.

  20. What is the shared responsibility model in AWS?

    AWS is responsible for security 'of' the cloud (physical infrastructure, hardware, host OS/virtualization), while the customer is responsible for security 'in' the cloud (data, IAM configuration, guest OS patching, network configuration, encryption choices).

  21. What is the difference between IAM roles and IAM users?

    IAM users represent a person or application with long-term credentials; IAM roles are assumed temporarily (via STS) by trusted entities such as EC2 instances, Lambda functions, or federated users, granting temporary credentials without storing long-term secrets.

  22. What does AWS KMS provide?

    A managed service for creating and controlling encryption keys used to encrypt data across AWS services, supporting key rotation, granular access policies, and integration with CloudTrail for audit logging.

  23. When should you use an NAT Gateway?

    To allow instances in a private subnet to initiate outbound traffic to the internet (e.g., for updates) while preventing unsolicited inbound connections from the internet.

  24. What is the purpose of Amazon Route 53 health checks combined with failover routing?

    Route 53 can monitor endpoint health and automatically route traffic away from unhealthy resources to a healthy backup, supporting active-passive disaster recovery architectures.

  25. What is the difference between a Standard S3 storage class and S3 Glacier?

    S3 Standard is designed for frequently accessed data with millisecond retrieval; S3 Glacier classes are designed for long-term archival at much lower cost, with retrieval times ranging from minutes to hours depending on the tier.

  26. What is Amazon Elastic File System (EFS) used for?

    A fully managed, scalable NFS file system that can be mounted concurrently by multiple EC2 instances across Availability Zones, useful for shared file storage workloads unlike EBS, which attaches to a single instance at a time.

  27. What is the benefit of using CloudFormation for infrastructure?

    It lets you define infrastructure as code in templates, enabling repeatable, version-controlled, and automated provisioning and updates of AWS resources as a single managed stack.

  28. What is the purpose of AWS Organizations and Service Control Policies (SCPs)?

    AWS Organizations centrally manages multiple AWS accounts, while SCPs set maximum permission guardrails across accounts or organizational units, restricting what actions IAM principals can perform even if their IAM policies would otherwise allow it.

  29. What is a placement group and when would you use a cluster placement group?

    A placement group influences how EC2 instances are placed on underlying hardware; a cluster placement group packs instances close together in a single AZ for low-latency, high-throughput networking, ideal for tightly coupled HPC workloads.

  30. What does the AWS exam mean by 'high availability' versus 'fault tolerance'?

    High availability minimizes downtime by rapidly recovering from failure (e.g., Multi-AZ failover), while fault tolerance means the system continues operating with no perceptible interruption even during a component failure, typically at higher cost and complexity.

AWS SAA-C03 glossary

24 terms the AWS SAA-C03 tests, defined in plain English.

Amazon CloudFront
AWS's content delivery network (CDN) service that caches and delivers content from edge locations to reduce latency for end users.
Amazon DynamoDB
A fully managed, serverless NoSQL key-value and document database designed for consistent, single-digit-millisecond performance at any scale.
Amazon EBS
Elastic Block Store, persistent block-level storage volumes that attach to a single EC2 instance, commonly used for boot volumes and databases.
Amazon EC2
Elastic Compute Cloud, AWS's resizable virtual server service that lets users provision compute capacity on demand.
Amazon EFS
Elastic File System, a fully managed, scalable NFS file system that multiple EC2 instances can mount concurrently across Availability Zones.
Amazon RDS
Relational Database Service, a managed service that simplifies setup, operation, and scaling of relational databases such as MySQL, PostgreSQL, and Aurora.
Amazon Route 53
AWS's scalable Domain Name System (DNS) web service, also supporting domain registration, health checking, and various traffic routing policies.
Amazon S3
Simple Storage Service, an object storage service offering scalable, durable storage accessed via APIs, with configurable storage classes and access controls.
Amazon SNS
Simple Notification Service, a fully managed pub/sub messaging service that fans out messages to multiple subscribers such as email, SMS, SQS queues, or Lambda functions.
Amazon SQS
Simple Queue Service, a fully managed message queuing service used to decouple and scale microservices, distributed systems, and serverless applications.
Amazon VPC
Virtual Private Cloud, a logically isolated section of the AWS cloud where you can launch resources in a network you define, including subnets, route tables, and gateways.
Auto Scaling Group (ASG)
A construct that automatically adjusts the number of EC2 instances in a group based on demand, health checks, or schedules to maintain application availability and cost efficiency.
Availability Zone (AZ)
One or more discrete data centers within an AWS Region, each with independent power and networking, used to design fault-tolerant architectures across multiple AZs.
AWS CloudFormation
An infrastructure-as-code service that provisions and manages AWS resources predictably by defining them as templates deployed as a single stack.
AWS KMS
Key Management Service, a managed service for creating, storing, and controlling cryptographic keys used to encrypt data across AWS services.
AWS Lambda
A serverless compute service that runs code in response to events without requiring the user to provision or manage servers, billing only for actual execution time.
AWS Well-Architected Framework
A set of best-practice pillars (operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability) used to evaluate and design cloud architectures.
Elastic Load Balancing (ELB)
A managed service that automatically distributes incoming application traffic across multiple targets, such as EC2 instances, containers, and IP addresses, in one or more Availability Zones.
IAM (Identity and Access Management)
The AWS service for securely controlling access to AWS resources by managing users, groups, roles, and policies that define permissions.
Multi-AZ Deployment
An RDS configuration that maintains a synchronously replicated standby database instance in a different Availability Zone for automatic failover and high availability.
NAT Gateway
A managed AWS service that enables instances in a private subnet to access the internet or other AWS services outbound, while blocking unsolicited inbound connections.
Network ACL (NACL)
A stateless, subnet-level firewall in a VPC that evaluates numbered allow and deny rules in order to control traffic entering or leaving a subnet.
Read Replica
An asynchronously replicated, read-only copy of a database used to offload read traffic from the primary instance and improve read scalability.
Security Group
A stateful virtual firewall attached to EC2 instances or ENIs that controls inbound and outbound traffic at the instance level using allow rules only.

Sources

  1. 1.AWS Certified Solutions Architect – Associate (SAA-C03) Exam GuideAmazon Web Services (AWS) (accessed Jul 18, 2026)
  2. 2.AWS Certification Policies — Before TestingAmazon Web Services (AWS) (accessed Jul 18, 2026)
  3. 3.AWS Certified Solutions Architect – Associate — Certification OverviewAmazon Web Services (AWS) (accessed Jul 18, 2026)
  4. 4.AWS Certification Policies — General PoliciesAmazon Web Services (AWS) (accessed Jul 18, 2026)

Official sources

Primary documents used to verify the exam details shown on this page.

Last verified against the AWS exam guide: