AWS Certified Solutions Architect - Associate (SAA-C03) study guide

How to use this guide

What to focus on:

• IAM roles, policies and least privilege, including cross-account access and when a role beats a key
• Network segmentation: VPCs, subnets, security groups vs NACLs, and where each control belongs
• Encryption at rest and in transit, KMS key policies, and secret handling with Secrets Manager vs Parameter Store
• Edge and perimeter protection (WAF, Shield, CloudFront) and which threat each actually addresses

What to focus on:

• Multi-AZ versus multi-Region: what each protects against and what each costs
• Decoupling with SQS, SNS and EventBridge so failures stay contained
• Storage durability and lifecycle: S3 classes, versioning, replication
• RTO and RPO reasoning: backup, pilot light, warm standby, active-active

What to focus on:

• Choosing compute (EC2, Lambda, ECS, Fargate) against workload shape rather than preference
• Caching layers: CloudFront, ElastiCache, DAX, and where each belongs in a request path
• Picking the right data store: relational, DynamoDB, Aurora, purpose-built engines
• Scaling patterns: Auto Scaling, load balancer types, read replicas

What to focus on:

• EC2 purchasing models and matching commitment to workload predictability
• S3 storage-class selection and lifecycle transitions as a cost lever
• Data transfer costs, the charge candidates most often forget exists
• Right-sizing, and serverless as a cost strategy for spiky traffic

Common mistakes

• ✕Answering with the most capable service instead of the most appropriate one. The exam rewards the simplest option that satisfies every stated constraint.
• ✕Skimming past the qualifier. MOST cost-effective, MOST highly available and MOST operationally efficient point at different answers, and the rest of the stem is often identical.
• ✕Confusing security groups with NACLs. Stateful versus stateless is tested repeatedly, and as judgment rather than definition.
• ✕Treating Multi-AZ and multi-Region as interchangeable resilience. They defend against different failures and differ enormously in cost and complexity.
• ✕Forgetting data transfer charges in cost questions. Cross-AZ and egress costs are frequently the difference between two otherwise identical designs.
• ✕Studying service trivia rather than service selection. Knowing every DynamoDB limit helps less than knowing when DynamoDB is the wrong choice.

Exam-day tips

• ✓Answer every question. Scoring is compensatory, with no per-domain minimum, so one weak domain cannot fail you.
• ✓There is no penalty for a wrong answer. Never leave one blank.
• ✓Read the last sentence of the stem first. It usually carries the real constraint, and it reframes everything above it.
• ✓Eliminate on hard constraints before comparing the survivors. Options that violate a stated requirement are usually removable on sight.
• ✓When two answers both work, prefer the more managed and more least-privilege one. That is nearly always the AWS-preferred design.
• ✓At 65 questions in 130 minutes you have two minutes each. Flag anything that runs to three and come back.

How to know you’re ready

One good practice score can be luck. What counts is scoring at or above the real pass mark (720 on a 100 to 1000 scaled score) across several full-length sets in a row, with no single domain trailing far behind the others. Kwizza tracks your per-domain readiness automatically as you practice.