On this page
Intro
AWS Certified Solutions Architect – Associate is for people who design solutions on AWS and need to weigh security, resilience, performance and cost together. This guide turns the SAA-C03 exam guide into manageable study tasks, with CertMonk as one option for reviewing what you learn. The exam scope comes from AWS’s certification page and its published exam guide; the study plan below is our suggested approach.
Exam at a glance
| Detail | SAA-C03 |
|---|---|
| Exam code | SAA-C03 |
| Questions | 65, including 15 unscored questions |
| Time | 130 minutes |
| Passing score | 720 on a scale of 100–1,000 |
| Question types | Multiple choice and multiple response |
| Price | Check the vendor’s site for current pricing |
| Language note | AWS lists the Italian exam as retiring after December 31, 2026 |
Source: AWS’s certification page and the SAA-C03 exam guide, reviewed November 7, 2026. Unscored questions are not identified on the exam, and unanswered questions are scored as incorrect, so answer everything.
Exam domains and weights
| Domain | Weight | In plain English |
|---|---|---|
| Design secure architectures | 30% | Control access, protect data and secure the workload and its network. |
| Design resilient architectures | 26% | Build systems that tolerate failure, scale and recover. |
| Design high-performing architectures | 24% | Choose storage, compute, database and network options that meet performance needs. |
| Design cost-optimized architectures | 20% | Meet requirements without paying for capacity or features you do not need. |
Weights are shown as a share of scored content in the exam guide. Use the full official exam objectives as your coverage checklist; a domain’s weight should help allocate attention without becoming a reason to skip smaller topics.
What each domain really tests
Design secure architectures
Most questions here ask which control meets a stated requirement with the least extra effort. Study identity and access management thoroughly: roles, policies, permission boundaries, and how access is granted across accounts. Learn what multi-account governance features add on top of that.
Then cover data protection. Compare encryption at rest and in transit, key management options, and secrets handling. For networking, trace how traffic moves through public and private subnets, security groups, network access controls and endpoints. Write down what each control can see and where it sits.
Design resilient architectures
Resilience questions describe a failure and ask what keeps the system running. Learn the building blocks: multiple Availability Zones, load balancing, automatic scaling, managed databases with failover, and loose coupling with queues or event-driven messaging. For each, state what failure it tolerates and what it does not.
Separate high availability from disaster recovery. Review recovery time and recovery point ideas, and compare strategies from simple backup and restore to active designs across Regions. Read each scenario for the stated recovery needs before choosing a pattern.
Design high-performing architectures
Match workload characteristics to services. Compare storage types by access pattern, such as block, file and object, and by throughput or latency needs. For databases, think about relational versus key-value and in-memory use, and when caching helps.
Add compute and networking choices: instance families, containers, serverless functions, content delivery and global routing. Practice reading a scenario for the bottleneck first, then choosing the option that removes it. Data ingestion and transformation topics also appear here, so review how data moves into analytics services.
Design cost-optimized architectures
Cost questions rarely ask for the cheapest option in isolation. They ask which option meets the requirement at lower cost. Compare purchasing models for compute, storage classes and lifecycle rules, and data transfer charges between services, zones and Regions.
Learn the tools used to monitor and organize spend, such as budgets, tagging and cost reports. Practice rewriting a design to remove idle capacity while keeping the stated availability and performance.
The coverage above is organized from AWS’s published exam guide; the note-taking exercises are study suggestions.
A realistic 30-day study plan
Treat this as a starting schedule, not a deadline you must meet. Aim for a focused session most days, with time for reading, recall and review. AWS recommends at least one year of hands-on experience designing cloud solutions, so if you are newer to AWS, extend the plan and add practical exercises.
Days 1–7: security foundations
Save the exam guide and mark each topic as familiar, uncertain or new. Spend the week on identity, access and data protection. After each session, close your notes and explain one design choice aloud.
Keep a learning log with three columns: topic, misunderstanding and next action. A next action should be specific, such as comparing two ways to grant cross-account access. “Study more” is too broad to help tomorrow.
Days 8–14: networking and resilience
Cover virtual networking, load balancing, scaling and failover. Draw a small architecture and mark what happens when one zone is lost. At the end of the week, revisit week one without looking at your notes first.
If you have an AWS account, build something tiny within free offers and tear it down afterward. Watch the account’s cost settings.
Days 15–21: performance
Study storage, database, compute and caching choices. Make a comparison sheet that lists each option, the access pattern it suits and a limitation. Use untimed practice to expose reasoning gaps, then return to the notes before trying again.
End the week with mixed review. Record correct guesses as uncertain knowledge. They need follow-up even though a practice score may count them as correct.
Days 22–28: cost and pacing
Cover purchasing models, storage classes and transfer costs. Then add timed practice once you can explain trade-offs without help. Review the session afterward and separate knowledge gaps from rushed reading. Scenario questions are wordy, so practice finding the requirement that decides the answer.
Days 29–30: make a readiness decision
Review concise notes and remaining uncertainties. Check your exam version and booking details with the vendor. If important topics still feel unfamiliar, plan another week; finishing a calendar is not evidence that learning is complete.
Common mistakes and how to avoid them
- Choosing a familiar service instead of the requirement. Underline the constraint in each scenario before picking an option.
- Treating high availability and disaster recovery as the same thing. State what failure each design survives.
- Forgetting cost. A secure, resilient design may still be wrong if a simpler option meets the stated need.
- Ignoring multiple-response questions. Read how many answers are required and check each option on its own.
- Counting lucky guesses as mastery. Flag them for review alongside incorrect responses.
- Repeating a familiar set until the score rises. Return to the underlying concept and explain it without answer choices.
How to use practice questions well
Begin untimed. Read the explanation for your selected answer and for each alternative, then identify the distinction you missed. Wrong-answer explanations matter because they can reveal why a familiar term does not fit the situation being described.
CertMonk offers explanations for every answer choice, randomized practice tests, timed practice and an untimed learning mode, plus flip-card flashcards, study games and progress by exam domain. Use those tools for different jobs: explanations for reasoning, flashcards and games for recall, and domain progress to choose what to review next.
After a practice session, choose a small number of gaps to repair. Read the relevant material, write a short explanation and revisit it later. Add timed practice when the concepts feel more stable. Treat practice results as feedback about your preparation, not a prediction of your exam result.
Free practice questions
Use the free samples below to explore the format and review the explanations without a purchase.
After an acquisition, a company wants a continuously updated list of its S3 buckets, KMS keys, IAM roles, and other resources whose resource policies grant access to principals outside its AWS organization. Which service provides this with the LEAST effort?
- AAWS CloudTrail Lake, querying for calls made by external accounts
- BIAM Access Analyzer with an organization zone of trust
- CAmazon Inspector, scanning workloads for exposure
- DAmazon Macie, scanning buckets for sensitive data
Show the answer and explanation
Answer: B. IAM Access Analyzer with an organization zone of trust
Correct. An external access analyzer uses automated reasoning on resource policies and reports resources shared with principals outside the zone of trust.
Why not the others
- A. CloudTrail shows what external principals have already done, not every resource that currently allows them access.
- C. Inspector finds software vulnerabilities and network reachability issues, not resource-policy sharing.
- D. Macie discovers sensitive data inside S3 objects. It does not analyze resource policies for access from outside the organization.
Takeaway: IAM Access Analyzer identifies resources whose policies grant access outside your account or organization.
Source: AWS IAM User Guide: Using AWS Identity and Access Management Access Analyzer
A company deploys a new version of its application as a complete new environment (green) alongside the current one (blue), each behind its own load balancer. It wants to shift 10% of users to green first, increase gradually, and switch back quickly if problems appear. Which approach meets these requirements?
- AUse Route 53 failover records with green as secondary.
- BReplace the DNS record’s value with the green load balancer in one change.
- CUse Route 53 weighted records and adjust the weights.
- DUpdate the blue instances in place, one at a time.
Show the answer and explanation
Answer: C. Use Route 53 weighted records and adjust the weights.
Correct. Weighted records split traffic by percentage, so weights can shift users gradually to green and back to blue if needed.
Why not the others
- A. Failover routing sends traffic to the secondary only when the primary is unhealthy; it cannot shift a chosen percentage.
- B. A single cutover moves everyone at once, with no gradual shift.
- D. In-place updates change the running environment, so rolling back means redeploying the old version.
Takeaway: Route 53 weighted records support gradual blue/green traffic shifting and quick rollback.
Source: Blue/Green Deployments on AWS whitepaper: Update DNS routing with Amazon Route 53
A company runs a large Apache Cassandra cluster of 60 nodes in one Region. It wants to place groups of nodes on separate sets of racks so that a rack-level failure affects only one replica group, and it wants the application to see which rack group each node is in. Which EC2 placement strategy fits BEST?
- ANo placement group, relying on default placement
- BA partition placement group
- CA cluster placement group
- DA spread placement group
Show the answer and explanation
Answer: B. A partition placement group
Correct. Partition placement groups spread instances across logical partitions that do not share racks and expose partition information, which suits large distributed systems such as Cassandra, HDFS, and Kafka.
Why not the others
- A. Default placement gives no control over rack-level separation or visibility into it.
- C. A cluster placement group packs instances close together for low latency, increasing correlated failure risk.
- D. Spread groups put each instance on distinct hardware but support only a small number of running instances per Availability Zone, too few for 60 nodes.
Takeaway: Partition placement groups isolate groups of instances on separate racks for large distributed systems and expose partition IDs.
Source: Amazon EC2 User Guide: Placement groups for your Amazon EC2 instances
A legacy application must keep 16 TiB of historical files on a block volume attached to its EC2 instance. The files are read sequentially a few times per month, and speed is not important. Which EBS volume type provides the LOWEST cost?
- ACold HDD (sc1)
- BGeneral Purpose SSD (gp3)
- CThroughput Optimized HDD (st1)
- DProvisioned IOPS SSD (io2)
Show the answer and explanation
Answer: A. Cold HDD (sc1)
Correct. sc1 is the lowest-cost EBS volume type, designed for large, infrequently accessed sequential data.
Why not the others
- B. gp3 is a good general default, but SSD storage costs more per GB than HDD for rarely accessed data.
- C. st1 suits frequently accessed sequential workloads and costs more than sc1 for data read only a few times a month.
- D. io2 is the most expensive option and is built for I/O-intensive databases.
Takeaway: Cold HDD (sc1) is the lowest-cost EBS option for large, infrequently accessed data that must stay on a block volume.
A company is creating a new Amazon EFS file system for regulated data. The data must be encrypted at rest with a KMS key, and all traffic between the EC2 clients and the file system must be encrypted in transit. Which actions meet these requirements? (Choose two.)
Choose 2.
- ABuild an IPsec VPN tunnel between each instance and the EFS mount targets
- BCreate the file system now and enable encryption at rest later from the console
- CApply SSE-S3 to the file system in its settings
- DMount the file system with the EFS mount helper using the TLS option
- EEnable encryption at rest when the file system is created
Show the answer and explanation
Answer: D. Mount the file system with the EFS mount helper using the TLS option and E. Enable encryption at rest when the file system is created
Correct. The EFS mount helper can establish a TLS tunnel for NFS traffic between the client and the file system.
Correct. EFS encryption at rest is chosen when a file system is created and uses a KMS key.
Why not the others
- A. This is unnecessary effort; the mount helper already provides TLS for NFS traffic.
- B. Encryption at rest cannot be turned on for an existing unencrypted EFS file system; the data would need to be copied to a new one.
- C. SSE-S3 is an Amazon S3 feature and does not apply to EFS file systems.
Takeaway: Enable EFS encryption at rest at creation time, and mount with the EFS mount helper’s TLS option for encryption in transit.
Source: Amazon EFS User Guide: Data encryption in Amazon EFS
FAQ
What experience does AWS recommend?
AWS recommends at least one year of hands-on experience designing cloud solutions that use AWS services, according to the exam guide. Use that to judge your starting point.
What types of questions are on the exam?
AWS lists multiple choice, with one correct response, and multiple response, with two or more correct responses. Read each question for how many answers it requires.
Is there a penalty for guessing?
AWS states that unanswered questions are scored as incorrect and there is no penalty for guessing, so answer every question.
Do all 65 questions count toward my score?
No. AWS states that 15 questions are unscored and are used to evaluate future questions. They are not identified.
Is 30 days enough to prepare?
It can be a useful planning window, but your starting knowledge and available time decide whether it is realistic. Extend it if you lack hands-on AWS exposure or cannot yet explain the design trade-offs.
How should I decide what to revise next?
Start with concepts you cannot explain and mistakes that recur across practice sessions. Use domain weights to balance the remaining schedule, while keeping every domain on your checklist.
Next step
Try free practice questions → https://app.certmonk.app/samples
