Solutions Architect – Associate
AWS Solutions Architect – Associate (SAA-C03)
Independent preparation for AWS Certified Solutions Architect – Associate — the blueprint, 94 study points across three note pages, the design decisions the exam keeps asking about, and the qualifiers that pick the answer.
The highest-leverage AWS exam. SAA-C03 validates that you can design solutions on AWS that are secure, resilient, high-performing and cost-optimised — and, crucially, that you can tell which of those four a scenario is actually asking for. Its service coverage overlaps heavily with both the CloudOps and Developer associate exams, so whichever associate you sit second will cost far less study time than this one.
Unofficial preparation
Independent study material, not affiliated with or endorsed by AWS, containing no official exam questions. Verify every figure on this page against the current SAA-C03 exam guide before booking.
The blueprint
| # | Domain | Weight | Items (approx.) |
|---|---|---|---|
| 1 | Design Secure Architectures | 30% | ~15 |
| 2 | Design Resilient Architectures | 26% | ~13 |
| 3 | Design High-Performing Architectures | 24% | ~12 |
| 4 | Design Cost-Optimized Architectures | 20% | ~10 |
Security is the largest domain and the one candidates most often under-prepare, because it does not feel like architecture. It is: IAM roles and policy evaluation, encryption at rest and in transit, network segmentation, and who can reach what. Budget your study time at 30%, not at “I’ll skim IAM”.
Exam mechanics
- 65 items, 130 minutes — two minutes each, and the stems are long. Reading speed is a real constraint on this exam in a way it is not on CLF-C02.
- 50 items scored, 15 unscored pretest items mixed in unmarked.
- Scaled 100–1,000, pass at 720, compensatory scoring across domains.
- Multiple choice (one of four) and multiple response (two or more of five-plus). Multiple response is all-or-nothing — no partial credit.
- No guessing penalty. Flag and move on rather than burning four minutes on one item.
The three note pages
| # | Page | Study points | Covers |
|---|---|---|---|
| 1 | Architecture notes | 46 | Security Groups vs NACLs vs Flow Logs, IAM and STS, VPC design, EC2, S3, CloudFront, databases, HA and load balancing, monitoring |
| 2 | Study guide | 21 | Exam objectives, cloud fundamentals, global infrastructure, security and compliance, the core service set |
| 3 | Exam tips | 27 | What shifted in the current exam and where the marks concentrate, by service area |
94 study points in total. Page 1 is the working mental model and deserves the most passes; page 3 is a final sweep for the week before the exam.
The decisions this exam keeps asking about
These pairs account for a large share of items. If you can state the discriminator for each in one sentence, you are in good shape.
| Decision | The discriminator |
|---|---|
| Security Group vs NACL | Stateful and instance-level vs stateless and subnet-level; SGs allow only, NACLs allow and deny in numbered order |
| Multi-AZ vs Read Replica | Synchronous standby for availability and failover vs asynchronous copy for read scaling |
| Multi-AZ vs Multi-Region | High availability within a region vs disaster recovery and global latency |
| S3 storage classes | Access frequency and retrieval tolerance — Intelligent-Tiering when the pattern is unknown |
| ALB vs NLB vs GWLB | HTTP path and host routing vs TCP/UDP at extreme scale and static IPs vs third-party appliances |
| SQS vs SNS vs EventBridge | One consumer pulls vs fan-out push to many vs routed events with filtering and schema |
| EBS vs EFS vs S3 | One instance’s block device vs a shared POSIX file system vs object storage over HTTP |
| Gateway vs Interface endpoint | S3 and DynamoDB, free, route-table based vs every other service, per-hour and per-GB, ENI based |
| Scheduled vs Target Tracking scaling | Predictable clock-driven load vs reactive load against a metric target |
| Savings Plans vs Reserved Instances | Commit to $/hour with flexibility across family and region vs commit to a specific configuration |
A three-week plan
Week 1 · The mental model
Architecture notes across four sessions, one service area at a time. Draw the VPC diagram from memory at the end of each session.
Week 2 · Breadth and blueprint
Study guide, then the practice exam untimed. Work every explanation, including for items you got right.
Week 3 · Sharpening
Exam tips, re-sit the practice exam timed, and close gaps with the services glossary.
Throughout · Build something
A VPC with public and private subnets, a NAT gateway, an ALB in front of an ASG and an RDS Multi-AZ instance. Two hours in the console beats ten pages of notes.
Reading the qualifier
Most SAA-C03 items have more than one technically workable answer. The capitalised qualifier picks the winner, and mis-reading it is the most common way to lose marks you had the knowledge for:
- MOST cost-effective — the cheapest option that still meets every stated requirement. Not the cheapest option.
- LEAST operational overhead — prefer managed and serverless. This qualifier almost always kills the self-managed EC2 answer.
- MOST highly available — read the failure domain. Within a region means Multi-AZ; surviving a region means Multi-Region.
- FASTEST / lowest latency — caching, edge, and read-local designs; CloudFront, ElastiCache, DAX, latency-based routing.
- MOST secure — least privilege, roles over keys, private paths over public ones, encryption with a documented key story.
Where to go next
- Compare all five tracks on the certification tracks page.
- CloudOps Engineer – Associate and Developer – Associate reuse most of this service knowledge.
- The AWS appendix carries the reference material you should not re-derive.
Last updated Sep 18, 2026