SAA-C03 is the most popular AWS certification exam in the world. It's also one of the most misunderstood in terms of what it actually tests and how to prepare for it efficiently.
This guide covers everything you need: the exam structure, what each domain actually tests, the services that show up most often, and the prep method that gets you certified faster than a 30-hour video course.
SAA-C03 Exam Overview
| Detail | Info |
|---|---|
| Exam code | SAA-C03 |
| Number of questions | 65 (50 scored, 15 unscored) |
| Time limit | 130 minutes |
| Passing score | 720 / 1000 |
| Cost | $150 (USD) |
| Format | Multiple choice, multiple response, ordering, matching |
| Delivery | Pearson VUE or PSI (testing centre or online proctored) |
The Four SAA-C03 Domains
Domain 1: Design Secure Architectures — 30%
The heaviest domain. Nearly a third of your score comes from here.
What it covers:
- IAM — users, roles, policies, cross-account access, permission boundaries, SCPs
- S3 bucket policies, ACLs, encryption (SSE-S3, SSE-KMS, SSE-C, client-side)
- VPC security — security groups, NACLs, VPC endpoints, PrivateLink
- KMS, Secrets Manager, Parameter Store
- AWS Shield, WAF, GuardDuty, Security Hub, Macie
What the exam actually tests: Not definitions, but decisions. Given a multi-account setup with specific compliance requirements, which combination of IAM policies and S3 bucket policies achieves the correct access control? That's the level of application required.
Most commonly failed topics: Cross-account IAM roles, the difference between resource-based and identity-based policies, when to use VPC endpoints vs PrivateLink.
Domain 2: Design Resilient Architectures — 26%
What it covers:
- Multi-AZ vs Multi-Region designs
- RDS Multi-AZ, Read Replicas, Aurora Global Database
- Route 53 routing policies — Failover, Latency, Weighted, Geolocation
- Elastic Load Balancing — ALB vs NLB vs CLB (know the difference cold)
- Auto Scaling groups — target tracking, step scaling, scheduled
- S3 versioning, replication (SRR vs CRR), lifecycle policies
- DynamoDB global tables, point-in-time recovery, DAX
What the exam actually tests: RTO and RPO trade-offs. When a scenario gives you a recovery time objective of 5 minutes, which architecture achieves that? Multi-AZ RDS vs a Read Replica? Pilot light vs warm standby? These are the questions.
Domain 3: Design High-Performing Architectures — 24%
What it covers:
- Compute — EC2 instance types, placement groups, Spot vs On-Demand vs Reserved
- Storage performance — EBS volume types (gp3, io2, st1, sc1), instance store
- Database performance — ElastiCache (Redis vs Memcached), DynamoDB DAX
- Networking — Enhanced Networking, Placement Groups, Global Accelerator vs CloudFront
- Serverless — Lambda concurrency, API Gateway throttling, SQS vs SNS vs Kinesis for event streaming
Most commonly failed topics: When to use SQS vs SNS vs Kinesis vs EventBridge — each exists for specific use cases and the exam loves to test these distinctions.
Domain 4: Design Cost-Optimized Architectures — 20%
What it covers:
- EC2 purchasing options — On-Demand, Reserved (Standard vs Convertible), Savings Plans, Spot
- S3 storage classes and lifecycle automation
- Right-sizing and compute optimizer
- Serverless vs EC2 cost trade-offs for bursty workloads
- Data transfer costs — knowing which data transfers incur charges
The Services You Must Know Cold
These appear across multiple domains in scenario questions:
Compute: EC2 (instance types, purchasing options), Lambda, ECS, EKS, Fargate Storage: S3 (storage classes, encryption, replication), EBS, EFS, FSx Database: RDS, Aurora, DynamoDB, ElastiCache, Redshift Networking: VPC (subnets, route tables, IGW, NAT), ALB, NLB, Route 53, CloudFront, Global Accelerator, Direct Connect, VPN Security: IAM, KMS, Secrets Manager, Shield, WAF, GuardDuty Integration: SQS, SNS, EventBridge, Kinesis, Step Functions Monitoring: CloudWatch, CloudTrail, Config, X-Ray
How to Prepare for SAA-C03 (The Method That Actually Works)
The standard advice is: buy a 30-hour video course and work through it. This approach produces mediocre results for a straightforward reason — video courses train recognition, not recall. The exam tests recall.
The approach that works:
Day 1: Take a full practice exam cold, before studying anything. Score it by domain. Your two lowest domains are where your study time goes first.
Weeks 1–4: Work through your weakest domains using active recall — flashcards, scenario-based quizzes, explaining concepts from memory. Use video only to look up specific things you can't recall at all. Never passively watch a full module on something you already partially understand.
Weekly: Take a domain-specific practice exam on your weakest area. Check whether the score moved.
Every 2–3 weeks: Take a full mock exam. Check overall domain balance.
Book the exam: When every domain consistently clears 80% on fresh practice exam banks.
The Hardest Questions on SAA-C03
The questions that trip up most candidates aren't about obscure services — they're about trade-offs between common ones:
- ALB vs NLB vs CLB for a specific workload requirement
- When to use SQS vs SNS vs Kinesis vs EventBridge
- S3 Standard vs Standard-IA vs Glacier Instant Retrieval vs Glacier Flexible Retrieval for a given access pattern
- Multi-AZ RDS vs Aurora vs a read replica for a given RTO/RPO
- VPC peering vs Transit Gateway vs PrivateLink for a given network topology
- CloudFront vs Global Accelerator for a given latency problem
Build a mental model for each of these trade-offs. Don't memorise a table — understand why each service exists and what problem it uniquely solves. That's what the scenario questions test.
Next Steps
Take a baseline practice exam today and see where your domain scores land. That single exercise will tell you more about what you need to study than any course outline.