AWS Certified Solutions Architect – Associate (SAA-C03) study guide

How to use this guide

Know these cold:

• IAM roles, policies and least privilege — including cross-account access and when a role beats a key
• Network segmentation: VPCs, subnets, security groups vs NACLs, and where each control belongs
• Encryption at rest and in transit, KMS key policies, and secret handling with Secrets Manager vs Parameter Store
• Edge and perimeter protection — WAF, Shield, CloudFront — and which threat each actually addresses

Know these cold:

• Multi-AZ versus multi-Region: what each protects against and what each costs
• Decoupling with SQS, SNS and EventBridge so failures stay contained
• Storage durability and lifecycle — S3 classes, versioning, replication
• RTO and RPO reasoning: backup, pilot light, warm standby, active-active

Know these cold:

• Choosing compute — EC2, Lambda, ECS, Fargate — against workload shape rather than preference
• Caching layers: CloudFront, ElastiCache, DAX, and where each belongs in a request path
• Picking the right data store: relational, DynamoDB, Aurora, purpose-built engines
• Scaling patterns — Auto Scaling, load balancer types, read replicas

Know these cold:

• EC2 purchasing models and matching commitment to workload predictability
• S3 storage-class selection and lifecycle transitions as a cost lever
• Data transfer costs — the charge candidates most often forget exists
• Right-sizing, and serverless as a cost strategy for spiky traffic

Common mistakes

• ✕Answering with the most capable service instead of the most appropriate one. The exam consistently rewards the simplest option that satisfies every stated constraint.
• ✕Skimming past the qualifier. MOST cost-effective, MOST highly available and MOST operationally efficient point at different answers, and the rest of the stem is often identical.
• ✕Confusing security groups with NACLs — stateful versus stateless is tested repeatedly and as judgment, not definition.
• ✕Treating Multi-AZ and multi-Region as interchangeable resilience. They defend against different failures and differ enormously in cost and complexity.
• ✕Forgetting data transfer charges in cost questions. Cross-AZ and egress costs are frequently the difference between two otherwise identical designs.
• ✕Studying service trivia rather than service selection. Knowing every DynamoDB limit helps less than knowing when DynamoDB is the wrong choice.

Exam-day tips

• ✓Scoring is compensatory — no per-domain minimum — so a weak domain cannot fail you on its own. Answer every question.
• ✓There is no penalty for a wrong answer. Never leave one blank.
• ✓Read the last sentence of the stem first. It usually carries the actual constraint, and it reframes everything above it.
• ✓Eliminate on hard constraints before comparing the survivors — options that violate a stated requirement are usually removable on sight.
• ✓When two answers both work, prefer the more managed and more least-privilege one. That is nearly always the AWS-preferred design.
• ✓At 65 questions in 130 minutes you have two minutes each. Flag anything that eats three and come back.

How to know you’re ready

One good practice score can be luck. The signal that holds up: consistently at or above the real pass mark (720 on a 100–1000 scaled score) across multiple full-length sets, with no single domain dragging far below the rest. Kwizza tracks your per-domain readiness automatically as you practice.