AWS Certified Solutions Architect – Professional moves to a new version, SAP-C03, on 17 November 2026. SAP-C02 is used until 16 November 2026. The domains are completely reorganised around the Well-Architected pillars, and the exam now expects you to design generative AI, RAG and AI agent architectures (Amazon Bedrock, Bedrock AgentCore, Knowledge Bases, SageMaker AI) alongside multi-account governance, migration and disaster recovery.
This guide follows the official AWS exam guide: the five domains with weights, every task, what changed from C02, a 10-week plan and 15 original scenario questions.
Quick facts (AWS, November 2026)
| Item | Detail |
|---|---|
| Exam code | SAP-C03 (from 17 Nov 2026); SAP-C02 until 16 Nov 2026 |
| Length | 180 minutes |
| Questions | 75 (65 scored + 10 unscored), multiple choice or multiple response |
| Passing score | 720 on a 100–1,000 scale (compensatory) |
| Fee | USD 300 |
| Languages | English, Japanese, Korean, Portuguese (Brazil), Simplified Chinese, Spanish (Latin America) |
| Delivery | Pearson VUE test centre or online proctored |
| Valid for | 3 years; renew by passing the latest version |
| Recommended experience | 2+ years designing and implementing cloud solutions on AWS |
Read the official Solutions Architect – Professional page and the SAP-C03 exam guide before booking. Once you hold one AWS certification, you get 50% off your next AWS exam.
Who should take SAP-C03?
- Architects and senior engineers who already hold Solutions Architect – Associate.
- Cloud and DevOps leads who design across many accounts and applications.
- Engineers moving into pre-sales, consulting or forward deployed and solutions roles.
Out of scope: in-depth operating systems, model training and data science, security forensics, and writing or debugging application code.
Domains and weights: C02 vs C03
| SAP-C02 (until 16 Nov) | % | SAP-C03 (from 17 Nov) | % |
|---|---|---|---|
| Design Solutions for Organizational Complexity | 26 | 1. Architecture Design and Implementation Built for the Cloud | 25 |
| Design for New Solutions | 29 | 2. Security, Compliance, and Governance | 25 |
| Continuous Improvement for Existing Solutions | 25 | 3. Cost-Optimized Architecture Design | 15 |
| Accelerate Workload Migration and Modernization | 20 | 4. Resilience, Migration, and Business Continuity | 15 |
| – | – | 5. Operational Excellence and Automation | 20 |
Domain 1: Built for the cloud (25%)
- 1.1 Cloud-native design: event-driven messaging (idempotency, ordering, SQS FIFO, Kinesis partition keys); stateless apps; serverless data pipelines (Kinesis, Glue, Athena, Lambda); durable workflows (Step Functions, durable Lambda functions); cross-account event routing; EKS, ECS and Fargate; service mesh (VPC Lattice, ECS Service Connect); ECR scanning; auto scaling; ingress (ALB, NLB, API Gateway); edge (CloudFront Functions, Lambda@Edge); WebSockets; multi-tenant isolation.
- 1.2 AI and ML (new): gen AI integrations with Bedrock across accounts; AI agent architectures with Bedrock AgentCore and Knowledge Bases; SageMaker AI inference endpoints; RAG ingestion and retrieval with vector stores.
- 1.3 Hybrid: redundant Direct Connect and VPN with Transit Gateway; DataSync, Storage Gateway, Transfer Family; legacy integration; Route 53 Resolver endpoints and split-horizon DNS; EKS/ECS Anywhere, Outposts, Local Zones.
- 1.4 Networking: multi-VPC with peering and PrivateLink; IPAM and subnet strategy; Network Firewall, WAF, Gateway Load Balancer; IPv6 dual-stack; Route 53 routing and Global Accelerator.
- 1.5 Data: data lakes and lakehouses (Lake Formation, Redshift Spectrum, Apache Iceberg); EMR, Redshift, MSK; choosing databases; Aurora Global Database and DynamoDB global tables; S3, EBS, EFS, FSx; caching; Glue Data Catalog and Clean Rooms.
Domain 2: Security, compliance and governance (25%)
- Identity: IAM Identity Center with SAML, OIDC and SCIM; Cognito; EKS Pod Identity; permissions boundaries, external IDs, session policies, ABAC; IAM Access Analyzer, VPC endpoint policies and Verified Access for data perimeters; IAM Roles Anywhere.
- Encryption: KMS customer managed keys with rotation; TLS 1.3, ACM and Private CA; CloudHSM; post-quantum cryptography (ML-DSA, ML-KEM in KMS).
- Multi-account governance: Organizations, OUs, Control Tower and Account Factory; organisation CloudTrail, Config aggregation, GuardDuty, Security Lake, Security Hub (including logging AI model invocations); RAM; SCPs and RCPs; Inspector and Patch Manager.
- Compliance: data sovereignty and residency; audit trails including AI services; AWS Artifact evidence; threat modelling.
- Responsible AI (new): Bedrock Guardrails; AgentCore Identity for agent access control; human approval workflows with Step Functions.
Domain 3: Cost optimisation (15%)
- Purchase options: Reserved Instances, Savings Plans, Spot and On-Demand; Graviton; Step Functions Standard vs Express; Compute Optimizer; Fargate Spot; AI/ML cost through service tiers, batching and caching.
- Data transfer: CloudFront and Origin Shield; VPC endpoints vs NAT gateways; AZ-aware design; Transit Gateway and PrivateLink pricing; cross-Region inference routing.
- Visibility: tagging and tag policies; Cost Explorer and CUR; cost categories and chargeback, including Bedrock token usage; Budgets and Cost Anomaly Detection.
- Storage and databases: S3 Intelligent-Tiering and Glacier; gp3 vs Provisioned IOPS; DynamoDB capacity modes, Aurora Serverless and I/O-Optimized, Database Savings Plans; AWS Backup retention; cheaper observability.
Domain 4: Resilience, migration and continuity (15%)
- Migration: discovery and migration waves; rehost with AWS Transform MGN (formerly Application Migration Service); DMS and DataSync; replatform; refactor with the strangler fig pattern; mainframe modernisation.
- Disaster recovery: RTO/RPO and cost; Elastic Disaster Recovery; Resilience Hub; multi-Region failover with Route 53, Global Accelerator and Application Recovery Controller; multi-cluster EKS/ECS.
- Continuity: AWS Backup policies across accounts; Fault Injection Service and chaos engineering; S3 Object Lock, EBS snapshot lock and Backup Vault Lock against ransomware.
Domain 5: Operational excellence and automation (20%)
- IaC: CloudFormation and CDK; policy as code with CloudFormation Hooks, CDK aspects, Config rules and SCPs; secrets in IaC; StackSets.
- CI/CD and DevSecOps: CodePipeline, CodeBuild, CodeDeploy; Inspector and ECR image scanning; cross-account pipelines with artifact promotion; Bedrock Evaluations; blue/green and canary.
- Observability: CloudWatch, X-Ray, AWS Distro for OpenTelemetry; Container Insights; cross-account log aggregation; AI/ML metrics (latency, agent performance, drift); Synthetics and RUM; SLOs with Application Signals.
- Automation: EventBridge and Systems Manager responses; circuit breakers, rate limits and bulkheads; predictive scaling; automated runbooks.
10-week study plan
| Week | Focus |
|---|---|
| 1 | Organizations, Control Tower, SCPs and RCPs, Identity Center, cross-account roles |
| 2 | Networking: Transit Gateway, PrivateLink, Direct Connect + VPN, Route 53 Resolver, IPv6 |
| 3 | Event-driven and serverless design, Step Functions, containers and service mesh |
| 4 | Data: lakehouse, analytics pipelines, database selection and global databases |
| 5 | Gen AI architecture: Bedrock, Knowledge Bases (RAG), AgentCore, Guardrails, SageMaker AI endpoints |
| 6 | Encryption, compliance, data residency, logging and Security Lake |
| 7 | Cost: purchase options, data transfer, tagging and chargeback, AI cost |
| 8 | Migration (Transform MGN, DMS, strangler fig) and DR (Elastic Disaster Recovery, ARC) |
| 9 | IaC, policy as code, pipelines, observability and SLOs |
| 10 | Long scenario practice under time pressure (about 2.4 minutes per question); book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. No account in the organisation may disable CloudTrail, including admins. What do you use?
A service control policy (SCP) at the root or OU level.
2. S3 buckets in all accounts must only be readable by principals inside the organisation. What enforces it centrally?
A resource control policy (RCP) with an organisation condition, as part of a data perimeter.
3. 200 VPCs across 40 accounts need connectivity to each other and to on-premises. What hub do you use?
AWS Transit Gateway shared with AWS RAM, with Direct Connect plus VPN backup.
4. On-premises servers must resolve private AWS hostnames and vice versa. What do you set up?
Route 53 Resolver inbound and outbound endpoints with forwarding rules.
5. An internal assistant must answer from company documents in S3, with citations. What architecture?
RAG with Amazon Bedrock Knowledge Bases over a vector store, with Guardrails.
6. An AI agent must call internal APIs on behalf of users with their own permissions. What helps?
Amazon Bedrock AgentCore, using AgentCore Identity for access control, with human approval for sensitive actions.
7. A SaaS product must keep each customer's data separate in shared tables. What pattern?
Pooled multi-tenancy with tenant context (for example from Cognito), row-level security and tenant-specific encryption keys.
8. A payment app needs RPO of seconds and RTO of minutes across Regions. What design?
Active-passive (warm standby) or active-active with Aurora Global Database or DynamoDB global tables, and Application Recovery Controller or Route 53 failover.
9. Backups must survive a compromised admin account deleting them. What protects them?
AWS Backup Vault Lock (and S3 Object Lock), with copies in a separate account.
10. A team must prove its failover works every quarter. What do you use?
AWS Fault Injection Service experiments, with Resilience Hub assessments.
11. 500 VMware servers must move to AWS quickly with minimal change. Which approach?
Rehost with AWS Transform MGN, planned in migration waves.
12. A legacy monolith must be modernised gradually without a big-bang rewrite. Which pattern?
The strangler fig pattern: route features one by one to new services behind API Gateway or a load balancer.
13. NAT gateway charges are high because instances pull large amounts of data from S3. What reduces cost?
An S3 gateway VPC endpoint.
14. Finance needs gen AI cost per business unit. What do you implement?
Tagging and cost categories with chargeback or showback, including Bedrock token usage monitoring.
15. Every new account must get the same baseline (logging, roles, guardrails) across Regions. What deploys it?
Control Tower Account Factory with CloudFormation StackSets.
After Solutions Architect – Professional
- Compare with Azure's AZ-305 and Google's Professional Cloud Architect.
- Go deeper on gen AI with the Bedrock engineer roadmap and AgentCore interview questions.
- Practise with AWS interview questions and see live cloud architect jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches AWS architecture, DevOps, security and generative AI on AWS with real-time projects. See the APEX AI, ML, Cloud and Cyber Security program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
When does SAP-C03 replace SAP-C02?
SAP-C03 is used from 17 November 2026. SAP-C02 is used until 16 November 2026.
How long is the SAP-C03 exam?
180 minutes, with 75 questions: 65 scored and 10 unscored.
What is the passing score for SAP-C03?
720 on a scale of 100 to 1,000.
How much does the AWS Solutions Architect Professional exam cost?
USD 300.
What are the SAP-C03 domains?
Architecture Design and Implementation Built for the Cloud (25%), Security, Compliance, and Governance (25%), Cost-Optimized Architecture Design (15%), Resilience, Migration, and Business Continuity (15%), and Operational Excellence and Automation (20%).
Does SAP-C03 cover generative AI?
Yes. It covers gen AI integrations with Amazon Bedrock, AI agent architectures with Bedrock AgentCore and Knowledge Bases, RAG, SageMaker AI inference, Bedrock Guardrails and Bedrock Evaluations.
