AWS Certified Solutions Architect - Associate

SAA-C03 is a scenario-based exam: stems describe a business problem with constraints (cost, latency, RPO/RTO, compliance) and ask for the best architecture from four or five plausible options. Memorising service names is not enough — you must know which service wins for which constraint. The 'most cost-effective' answer is rarely the same as the 'lowest operational overhead' answer.

Security is the heaviest domain at 30%. The bulk of these questions are IAM (identity-based vs resource-based policies, permission boundaries, cross-account roles with external ID, when to use SCPs vs IAM policies vs session policies). Encryption (KMS envelope encryption, key policies, Secrets Manager rotation) is the second-heaviest sub-topic.

Multiple-response (multi-select) questions appear throughout. Five options, pick the two or three correct — there is no partial credit, you need every correct option and no incorrect ones. Read every option twice; the wrong-but-tempting picks usually swap one keyword (e.g. NACL for SG, async for sync replica, NAT Instance for NAT Gateway).

Master the difference between Multi-AZ and read replicas — it shows up in nearly every test session, in both RDS and Aurora flavours. Multi-AZ = sync standby + automatic DNS failover, no read scaling. Read replica = async, separate endpoint, manual promotion, can scale reads or live in another Region. Aurora's cluster + reader endpoint topology collapses both.

VPC traffic-flow questions are a guaranteed appearance and a frequent miss. Stateless NACL evaluated by rule number with explicit allow + deny + return rule; stateful SG evaluated together, allow-only, return traffic automatic. If a packet reaches the instance but the response never gets back, suspect a missing NACL return rule on the ephemeral port range (1024-65535).

Route 53 routing policies map cleanly to scenarios: failover = active-passive HA, latency = lowest RTT, weighted = blue/green or A/B, geolocation = compliance/locale, multivalue = randomised + health-checked, geoproximity = bias-able location with Traffic Flow. Memorise the one-keyword trigger for each policy.

For disaster recovery, learn the four strategies and their RTO/RPO and cost tradeoffs: backup & restore (hours, cheap), pilot light (10s of minutes, low cost), warm standby (minutes, moderate cost), multi-site active-active (seconds, high cost). The 'right' answer is whichever matches the RTO/RPO + cost wording in the stem.

Cost-optimization questions almost always hinge on workload pattern. Steady-state predictable load → Reserved Instances or Savings Plans (Compute SP if you want Lambda/Fargate coverage too). Fault-tolerant batch / CI / stateless workers → Spot. Unpredictable / spiky → On-Demand or Lambda. S3 lifecycle to IA/Glacier or Intelligent-Tiering for unknown access patterns.

Read keywords carefully. 'Most cost-effective' = cheapest viable, not necessarily cheapest absolute. 'Least operational overhead' = managed/serverless (Aurora Serverless, Lambda, Fargate, DynamoDB on-demand) over self-managed. 'Highest availability' = Multi-AZ at minimum, multi-Region if RPO/RTO is tight. 'Real-time' = streaming (Kinesis, MSK), not batch (Glue).

You have 130 minutes for 65 questions = exactly 2 minutes each. Multi-response and long scenario stems eat 3-4 minutes; pure 'which service does X' takes 30 seconds. Sweep in two passes — bank the easy service-knowledge questions, flag long scenarios for round two. The 15 unscored questions are randomly mixed in and indistinguishable, so answer every question.

Keep your Well-Architected Framework reflexes sharp. The 'best' answer almost always aligns with one of the six pillars (operational excellence, security, reliability, performance efficiency, cost optimization, sustainability). When in doubt between two technically valid answers, the one that better matches a Well-Architected best practice is usually the intended pick.