AWS Certified Solutions Architect – Associate (exam code SAA-C03) is the AWS certification that Indian employers mention most in cloud engineer, DevOps and solutions roles. It doesn't ask you to memorise commands. It asks you to choose the *best* architecture for a scenario: the most secure, the most resilient, the fastest or the cheapest. This guide follows AWS's official exam guide. It explains how the exam is scored, what each domain really tests, the service comparisons that come up again and again, an 8-week plan, 12 labs and 20 scenario questions written for this guide.
Quick facts (from AWS, November 2026)
| Item | Detail |
|---|---|
| Exam | AWS Certified Solutions Architect – Associate (SAA-C03) |
| Duration | 130 minutes |
| Questions | 65 (50 scored + 15 unscored, which are not identified) |
| Format | Multiple choice (one correct answer out of four) and multiple response (two or more correct out of five or more) |
| Scoring | Scaled 100–1,000; 720 to pass; compensatory (you need to pass overall, not every section) |
| Cost | 150 USD (exchange rates may apply) |
| Delivery | Pearson VUE test centre or online proctored |
| Validity | 3 years |
| Recommended experience | At least 1 year designing cloud solutions on AWS |
There is no penalty for guessing. Answer every question. Check the official exam guide and the certification page before you book. AWS also notes that questions may use short names for some services. A list of those short names is available inside the exam through the Help button.
Should freshers take SAA-C03?
Yes, but not as their very first step if they have never used AWS. A realistic path:
- Learn Linux, networking basics (IP, CIDR, DNS, HTTP) and one scripting language.
- Do 4–6 weeks of hands-on work in AWS (the labs below).
- Then take SAA-C03. AWS Certified Cloud Practitioner is optional. It helps total beginners, but most employers ask for the Associate.
For an Azure-first learner, the equivalent is AZ-104 after AZ-900. Many Hyderabad companies want both clouds, so it is worth doing one of each.
Domains and weights
| Domain | Weight (of scored content) |
|---|---|
| 1. Design Secure Architectures | 30% |
| 2. Design Resilient Architectures | 26% |
| 3. Design High-Performing Architectures | 24% |
| 4. Design Cost-Optimized Architectures | 20% |
The domains follow the pillars of the AWS Well-Architected Framework. Read the Well-Architected pillars once. The way the exam phrases its questions will make more sense afterwards.
Domain 1: Design Secure Architectures (30%)
Secure access to AWS resources.
- IAM users, groups and roles, and least-privilege policies.
- Use roles for EC2, Lambda and other services instead of access keys.
- MFA, and keeping the root account protected and unused.
- AWS Organizations with service control policies (SCPs): SCPs set the maximum permissions for accounts. They don't grant permissions.
- IAM Identity Center for single sign-on (SSO).
- Cross-account access with role assumption (STS).
Secure workloads and applications.
- VPC design: public and private subnets.
- Security groups: stateful, allow rules only.
- Network ACLs: stateless, allow and deny rules, evaluated by rule number.
- NAT gateway for outbound traffic from private subnets.
- VPC endpoints: gateway endpoints for S3 and DynamoDB, interface endpoints (PrivateLink) for most other services.
- AWS WAF, AWS Shield and Amazon Cognito for app users.
- Secrets Manager vs Systems Manager Parameter Store for configuration and secrets.
Data security controls.
- Encryption at rest with KMS (AWS-managed keys or customer-managed keys).
- Encryption in transit (TLS; ACM for certificates).
- S3 Block Public Access, bucket policies, Object Lock and versioning.
- Backups with AWS Backup.
- Macie finds sensitive data in S3.
Domain 2: Design Resilient Architectures (26%)
Scalable, loosely coupled architectures.
- SQS: decouple producers from consumers. Standard queues vs FIFO queues.
- SNS: fan-out notifications.
- EventBridge: event routing.
- Step Functions: orchestrate multi-step workflows.
- API Gateway with Lambda for serverless APIs.
- Containers on ECS or EKS, with Fargate if you don't want to manage servers.
- Stateless application tiers that keep session state in ElastiCache or DynamoDB.
Highly available and fault-tolerant architectures.
- Multi-AZ by default: an Auto Scaling group across AZs behind an Application Load Balancer.
- RDS Multi-AZ (failover) vs read replicas (read scaling, can be cross-region).
- Aurora global databases.
- Route 53 routing policies: failover, latency, weighted, geolocation, health checks.
- Disaster recovery strategies, from cheapest and slowest to most expensive and fastest:
- backup and restore
- pilot light
- warm standby
- multi-site active/active
Know which strategy meets which RTO (how long you can be down) and RPO (how much data you can lose). See our RTO vs RPO guide.
Domain 3: Design High-Performing Architectures (24%)
Storage.
- S3: storage classes, multipart upload, Transfer Acceleration.
- EBS: gp3, io2 and the throughput-optimised types.
- EFS: shared Linux file system.
- FSx: Windows File Server, Lustre for HPC, NetApp ONTAP.
Compute.
- EC2 instance families (general purpose, compute, memory, storage, accelerated).
- Auto Scaling policies (target tracking, step, scheduled).
- Lambda: memory/CPU and concurrency.
- Placement groups (cluster, spread, partition).
Databases.
- RDS vs Aurora.
- DynamoDB: partition key design, on-demand vs provisioned capacity, DAX caching.
- ElastiCache (Redis or Memcached).
- Read replicas.
- Choosing purpose-built databases: Redshift for analytics, Neptune for graphs, OpenSearch for search.
Networking.
- CloudFront for caching at the edge.
- Global Accelerator for TCP/UDP traffic and static anycast IPs.
- Transit Gateway for many VPCs.
- Direct Connect vs Site-to-Site VPN.
- Load balancers:
- ALB: layer 7, path-based and host-based routing.
- NLB: layer 4, static IPs, very high throughput.
- Gateway Load Balancer: for third-party appliances.
Data ingestion and transformation.
- Kinesis Data Streams vs Amazon Data Firehose.
- Glue for ETL and the data catalogue.
- Athena for SQL on S3.
- EMR for Spark.
- Lake Formation.
Domain 4: Design Cost-Optimized Architectures (20%)
- Storage cost:
- S3 storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, the Glacier classes.
- Lifecycle rules.
- Moving EBS gp2 to gp3.
- Deleting unattached volumes and old snapshots.
- Compute cost:
- On-Demand, Savings Plans, Reserved Instances, Spot Instances (for fault-tolerant work).
- Right-sizing.
- Graviton instances.
- Lambda and Fargate for spiky workloads.
- Database cost:
- Aurora Serverless or DynamoDB on-demand for unpredictable load.
- Reserved DB instances for steady load.
- Caching to reduce reads.
- Network cost:
- Data transfer out and between AZs costs money.
- NAT gateway data-processing charges. A gateway endpoint for S3 avoids them.
- CloudFront to reduce origin traffic.
- Tools:
- Cost Explorer
- AWS Budgets
- Cost allocation tags
- Compute Optimizer
- Trusted Advisor
The comparisons that decide most questions
| If the question says… | Usually choose… |
|---|---|
| "Decouple", "buffer", "absorb spikes" | SQS between the tiers |
| "One message to many subscribers" | SNS fan-out (often SNS → several SQS queues) |
| "Shared file system for many Linux EC2 instances" | EFS |
| "Windows SMB file share" | FSx for Windows File Server |
| "High-performance computing file system" | FSx for Lustre |
| "Private S3 access from a VPC without the internet" | S3 gateway endpoint |
| "Static IP for a load balancer" | NLB (or Global Accelerator) |
| "Path-based routing /api and /images" | ALB |
| "Unpredictable, infrequent access, don't want to manage tiers" | S3 Intelligent-Tiering |
| "Keep archives for years, retrieval in hours is fine" | S3 Glacier Deep Archive |
| "Fault-tolerant batch job, lowest cost" | Spot Instances |
| "Steady 24/7 usage for 3 years" | Savings Plans or Reserved Instances |
| "Automatic failover for a relational database" | RDS Multi-AZ |
| "Scale reads for a relational database" | Read replicas (or ElastiCache) |
| "Millisecond key-value at any scale" | DynamoDB (add DAX for microseconds) |
| "Store secrets with automatic rotation" | Secrets Manager |
| "Limit what member accounts can do" | SCPs in AWS Organizations |
8-week SAA-C03 study plan
| Week | Focus | Labs |
|---|---|---|
| 1 | IAM, Organizations, account security, billing alerts | 1–2 |
| 2 | VPC, subnets, routing, security groups vs NACLs, endpoints | 3–4 |
| 3 | EC2, EBS, Auto Scaling, ALB/NLB | 5–6 |
| 4 | S3 in depth, CloudFront, storage classes, EFS/FSx | 7–8 |
| 5 | RDS, Aurora, DynamoDB, ElastiCache | 9 |
| 6 | SQS, SNS, EventBridge, Lambda, API Gateway, Step Functions | 10–11 |
| 7 | Route 53, DR strategies, monitoring (CloudWatch, CloudTrail, Config), cost tools | 12 |
| 8 | Full-length practice exams, review every wrong answer, AWS's official practice question set | — |
Use AWS Skill Builder (the free exam-prep resources and official practice question set) alongside the exam guide. Book the exam when you are consistently above 80% on full-length practice tests.
12 hands-on labs
Create a billing alarm *before* lab 1 and delete resources after every lab. NAT gateways, load balancers and RDS instances cost money even when they sit idle.
- Account security. Turn on MFA for root, create an admin role and use IAM Identity Center for daily sign-in. Create a Budgets alert.
- Least privilege. Write an IAM policy that allows read access to a single S3 prefix, and test it with the IAM policy simulator.
- VPC from scratch. Two AZs, public and private subnets, an internet gateway, a NAT gateway and route tables.
- Endpoints. Add an S3 gateway endpoint and check that a private EC2 instance reaches S3 with the NAT gateway removed.
- Web tier. A launch template, an Auto Scaling group across two AZs, and an ALB with health checks. Then kill an instance and watch it get replaced.
- Session state. Move the sessions into ElastiCache so the web tier becomes stateless.
- S3. Versioning, lifecycle rules (to Standard-IA after 30 days, Glacier after 90), Block Public Access and encryption with a KMS customer-managed key.
- CloudFront. Put a private S3 bucket behind CloudFront with origin access control.
- RDS. Create a Multi-AZ PostgreSQL instance, force a failover, then add a read replica.
- Decoupling. API Gateway → Lambda → SQS → Lambda worker → DynamoDB, with a dead-letter queue.
- Fan-out. One SNS topic with two SQS subscribers, plus an EventBridge rule that runs on a schedule.
- Disaster recovery. Route 53 failover routing between two regions with health checks, and AWS Backup copies to the second region.
# Example: quick checks from AWS CloudShell
aws sts get-caller-identity
aws ec2 describe-vpcs --query "Vpcs[].{id:VpcId,cidr:CidrBlock}" --output table
aws s3api get-bucket-versioning --bucket <your-bucket>20 scenario questions with answers
These are original practice scenarios written for this guide, not exam questions.
1. An order system loses requests when traffic spikes overwhelm the processing tier. What is the least-effort fix? Put an SQS queue between the web tier and the processing tier, and scale the workers on queue depth.
2. EC2 instances in private subnets must download objects from S3 without internet access. What do you add? An S3 gateway VPC endpoint, with routes in the private route tables.
3. A company wants to stop all member accounts from leaving one approved region. What do you use? An SCP in AWS Organizations that denies actions outside the approved region (with exceptions for global services).
4. A relational database must survive an AZ failure with automatic failover. What do you choose? RDS Multi-AZ, or Aurora with replicas in several AZs.
5. Reporting queries are slowing down the production database. What helps without changing the app's write path? Read replicas, with reporting pointed at the replica endpoint.
6. Many Linux instances in several AZs need the same shared file system. What do you choose? Amazon EFS.
7. Logs are rarely read after 30 days and must be kept for 7 years at the lowest cost. What do you configure? S3 lifecycle rules that move objects to Standard-IA or Glacier classes and finally Glacier Deep Archive, then expire them after 7 years.
8. A nightly batch job can be interrupted and restarted. What is the cheapest compute option? Spot Instances, ideally across several instance types.
9. An application needs static IP addresses for its load balancer so partners can allowlist them. What do you choose? A Network Load Balancer (or Global Accelerator in front of the ALB).
10. Requests for /api go to one service and /images to another. Which load balancer? An Application Load Balancer with path-based routing rules.
11. A database password must rotate automatically. Where do you store it? AWS Secrets Manager, with rotation turned on.
12. Users worldwide report slow downloads of static files from S3 in Mumbai. What fixes this? Amazon CloudFront in front of the bucket.
13. The RPO is 1 hour and the RTO is 4 hours, and cost matters. Which DR strategy? Usually pilot light, or backup and restore if restoring can finish within 4 hours. Multi-site would cost far more than needed.
14. An S3 bucket must never become public, even by mistake. What do you turn on? S3 Block Public Access at the account level, plus bucket policies.
15. One event must reach email, a Lambda function and two SQS queues. What do you use? An SNS topic with those subscriptions.
16. A DynamoDB table needs microsecond reads for a hot dataset. What do you add? DynamoDB Accelerator (DAX).
17. Who changed a security group rule yesterday? Which service tells you? AWS CloudTrail. AWS Config also shows the configuration history.
18. NAT gateway charges are high because instances download large files from S3. How do you cut them? Route S3 traffic through a gateway endpoint instead of the NAT gateway.
19. A web app needs user sign-up and sign-in with social logins. Which service? Amazon Cognito user pools.
20. The workload is steady, runs around the clock and will continue for 3 years on mixed EC2 and Fargate. Which pricing option? A Compute Savings Plan.
Exam-day tips
- Find the deciding phrase first: "most cost-effective", "least operational overhead", "highest availability", "most secure". Two answers often work technically, and that phrase picks between them.
- "Least operational overhead" usually points to a managed or serverless service rather than something built on EC2.
- Eliminate answers that use single points of failure, long-lived access keys or public S3 buckets.
- Flag long questions and come back to them. With 130 minutes for 65 questions you have about two minutes per question.
Beyond the exam: what interviewers ask
SAA-C03 gets you shortlisted. In interviews you will be asked to design something on a whiteboard (a three-tier web app, a disaster recovery plan, a data pipeline), to explain a real project, and to discuss Terraform, CI/CD and Kubernetes. Prepare with:
- AWS interview questions
- EKS interview questions
- Serverless interview questions
- How to explain your project in an interview
If you're aiming for AI roles, add Amazon Bedrock and Bedrock Knowledge Bases after the Associate.
Next steps
- Read the AWS cloud engineer career path.
- Compare it with the best IT certifications for freshers.
- Browse live IT jobs and fresher jobs that list AWS.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches AWS, Azure and DevOps with real-time projects and placement support. See the AWS DevOps real-time project course and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
How many questions are on SAA-C03?
65: 50 scored and 15 unscored questions, which are not identified, in 130 minutes.
What is the SAA-C03 passing score?
720 on a scaled score of 100 to 1,000. Scoring is compensatory, so you only need to pass overall.
How much does the AWS Solutions Architect Associate exam cost?
150 USD; foreign exchange rates may apply.
How long is the AWS Solutions Architect Associate certification valid?
Three years.
Which SAA-C03 domain is the largest?
Design Secure Architectures, at 30% of scored content.
Is there negative marking in SAA-C03?
No. Unanswered questions are scored as incorrect and there is no penalty for guessing.
