AWS Certified Solutions Architect — Associate (SAA-C03)

Associate-level exam on designing secure, resilient, high-performing, and cost-optimized architectures on AWS.

Passing score: 72%
Per attempt: 15 questions
Question pool: 84
Suggested time: 130 min

Content last updated Aug 14, 2026

About this exam

The exam is for individuals performing a solutions architect role, validating the ability to design solutions using the AWS Well-Architected Framework: designing architectures that are secure, resilient, high-performing, and cost-optimized, and reviewing existing solutions for improvements. Target candidate has at least 1 year of hands-on experience designing cloud solutions on AWS.

Question format: multiple choice (1 correct + 3 distractors) and multiple response (2+ correct out of 5+ options). 50 scored questions + 15 unscored, scaled score 100–1000, passing score 720. Compensatory scoring — no need to pass each domain individually, only the overall exam.

Exam details

Exam code: SAA-C03
Exam fee: $150 USD
Item format: 65 questions — multiple choice or multiple response
Prerequisites: Recommended: at least 1 year of hands-on experience designing cloud solutions on AWS
Exam structure: 65 questions
Delivery method: Pearson VUE testing center or online proctored exam
Target audience: Individuals with experience designing and implementing distributed systems on AWS
Result reporting: Pass/fail
Certification validity: 3 years

Content domains

Expand a domain for what it covers and what you'll need to know.

Design Cost-Optimized Architectures 20% ▾

Task 4.1: Design cost-optimized storage solutions

Knowledge of: access options (S3 Requester Pays); cost management features (allocation tags, multi-account billing) and tools (Cost Explorer, Budgets, Cost and Usage Report); storage services (FSx, EFS, S3, EBS); backup strategies; block storage (HDD vs. SSD volume types); data lifecycles; hybrid storage (DataSync, Transfer Family, Storage Gateway); access patterns; storage tiering.
Skills in: batch vs. individual upload strategy; right-sizing storage; lowest-cost data transfer method; storage auto scaling triggers; S3 lifecycle management; backup/archival selection; migration service selection; storage tier selection; most cost-effective storage service for a workload.

Task 4.2: Design cost-optimized compute solutions

Knowledge of: cost management features/tools; global infrastructure; purchasing options (Spot, Reserved, Savings Plans); distributed/edge compute; hybrid compute (Outposts); instance families/sizes; utilization optimization (containers, serverless, microservices); scaling strategies (auto scaling, hibernation).
Skills in: load-balancer type selection (ALB Layer 7 vs. NLB Layer 4 vs. GWLB); scaling method selection (horizontal vs. vertical, EC2 hibernation); cost-effective compute service selection (Lambda vs. EC2 vs. Fargate); availability requirements by workload class; instance family/size selection.

Task 4.3: Design cost-optimized database solutions

Knowledge of: cost management features/tools; caching strategies; retention policies; capacity planning; connections/proxies; database engines; replication; database types (relational vs. non-relational, Aurora, DynamoDB).
Skills in: backup/retention policy design; engine selection (MySQL vs. PostgreSQL); cost-effective database service selection (DynamoDB vs. RDS, serverless); cost-effective database type selection; schema/data migration across engines or locations.

Task 4.4: Design cost-optimized network architectures

Knowledge of: cost management features/tools; load balancing (ALB); NAT gateways (vs. NAT instance cost); connectivity (private lines, dedicated lines, VPNs); routing/topology/peering (Transit Gateway, VPC peering); network services (DNS).
Skills in: NAT gateway configuration (single shared vs. per-AZ); connection type selection (Direct Connect vs. VPN vs. internet); routing to minimize transfer cost (cross-Region, cross-AZ, private-to-public, Global Accelerator, VPC endpoints); CDN/edge caching strategy; reviewing workloads for network optimization; throttling strategy; bandwidth allocation.

Design High-Performing Architectures 24% ▾

Task 3.1: Determine high-performing and/or scalable storage solutions

Knowledge of: hybrid storage; storage services (S3, EFS, EBS) and use cases; storage types (object/file/block).
Skills in: matching storage config to performance demands; choosing storage that scales for future needs.

Task 3.2: Design high-performing and elastic compute solutions

Knowledge of: compute services (AWS Batch, EMR, Fargate); distributed computing on AWS global/edge infrastructure; queuing/pub-sub; scalability (EC2 Auto Scaling, AWS Auto Scaling); serverless (Lambda, Fargate); container orchestration (ECS, EKS).
Skills in: decoupling workloads for independent scaling; identifying scaling metrics/conditions; selecting compute options/instance types by requirement; sizing resources (e.g. Lambda memory) by requirement.

Task 3.3: Determine high-performing database solutions

Knowledge of: global infrastructure; caching (ElastiCache); access patterns (read- vs. write-intensive); capacity planning (capacity units, instance types, Provisioned IOPS); connections/proxies; database engines (heterogeneous vs. homogeneous migration); replication (read replicas); database types (serverless, relational vs. non-relational, in-memory).
Skills in: configuring read replicas; designing database architectures; choosing an engine (MySQL vs. PostgreSQL); choosing a database type (Aurora vs. DynamoDB); integrating caching.

Task 3.4: Determine high-performing and/or scalable network architectures

Knowledge of: edge networking (CloudFront, Global Accelerator); network architecture design (subnet tiers, routing, IP addressing); load balancing (ALB); connectivity options (VPN, Direct Connect, PrivateLink).
Skills in: designing network topologies (global, hybrid, multi-tier); scalable network configuration; resource placement; load-balancing strategy selection.

Task 3.5: Determine high-performing data ingestion and transformation solutions

Knowledge of: analytics/visualization (Athena, Lake Formation, QuickSight); ingestion patterns/frequency; transfer services (DataSync, Storage Gateway); transformation services (Glue); secure ingestion access; sizing for requirements; streaming (Kinesis).
Skills in: building/securing data lakes; designing streaming architectures; designing transfer solutions; visualization strategy; selecting compute for processing (EMR); ingestion configuration; format transformation (e.g. CSV to Parquet).

Design Secure Architectures 30% ▾

Task 1.1: Design secure access to AWS resources

Knowledge of: cross-account access controls; federated access/identity (IAM, IAM Identity Center); AWS global infrastructure (Regions, AZs); least-privilege best practices; the shared responsibility model.
Skills in: MFA and root-user protection best practices; flexible authorization models (IAM users, groups, roles, policies); role-based access (AWS STS, role switching, cross-account access); multi-account security strategy (AWS Control Tower, SCPs); resource policies; federating a directory service with IAM roles.

Task 1.2: Design secure workloads and applications

Knowledge of: application config/credential security; AWS service endpoints; controlling ports/protocols/network traffic; secure application access; security services (Amazon Cognito, GuardDuty, Macie); external threat vectors (DDoS, SQL injection).
Skills in: VPC security architecture (security groups, route tables, network ACLs, NAT gateways); network segmentation (public/private subnets); integrating AWS Shield, AWS WAF, IAM Identity Center, Secrets Manager; securing external connections (VPN, Direct Connect).

Task 1.3: Determine appropriate data security controls

Knowledge of: data access/governance; data recovery; retention and classification; encryption and key management.
Skills in: mapping AWS tech to compliance needs; encrypting data at rest (AWS KMS); encrypting data in transit (ACM/TLS); access policies for encryption keys; backups and replication; data lifecycle/protection policies; rotating keys and renewing certificates.

Design Resilient Architectures 26% ▾

Task 2.1: Design scalable and loosely coupled architectures

Knowledge of: API creation/management (API Gateway, REST); managed services (AWS Transfer Family, SQS, Secrets Manager); caching strategies; microservice design (stateless vs. stateful); event-driven architectures; horizontal vs. vertical scaling; edge accelerators (CDN); migrating apps into containers; load balancing (ALB); multi-tier architectures; queuing/pub-sub messaging; serverless patterns (Fargate, Lambda); storage types (object/file/block); container orchestration (ECS, EKS); read replicas; workflow orchestration (Step Functions).
Skills in: designing event-driven/microservice/multi-tier architectures; scaling-strategy selection; choosing services for loose coupling; deciding containers vs. serverless; recommending compute/storage/network/database technology by requirement; using purpose-built AWS services.

Task 2.2: Design highly available and/or fault-tolerant architectures

Knowledge of: global infrastructure (AZs, Regions, Route 53); AI/ML managed services (Comprehend, Polly); basic networking (route tables); DR strategies (backup and restore, pilot light, warm standby, active-active, RPO/RTO); distributed design patterns; failover strategies; immutable infrastructure; load balancing (ALB); proxy concepts (RDS Proxy); service quotas/throttling; storage durability/replication; workload visibility (X-Ray).
Skills in: automation for infrastructure integrity; choosing services for HA/fault tolerance across Regions/AZs; identifying business-driven availability metrics; mitigating single points of failure; ensuring data durability/availability (backups); selecting a DR strategy to match business requirements; improving reliability of legacy/non-cloud-native apps.

Key concepts

Applied Use Cases (decision guidance — for scenario grounding) ▾

Load balancer selection

Application Load Balancer (ALB, Layer 7): HTTP/HTTPS traffic, content-based routing, microservices, needs path/host-based routing.
Network Load Balancer (NLB, Layer 4): extreme performance/low latency, static IP needed, TCP/UDP traffic.
Gateway Load Balancer (GWLB): deploying/scaling third-party virtual appliances (firewalls, intrusion detection) transparently in-line.

Database selection

Amazon RDS: traditional relational workloads needing a managed engine (MySQL, PostgreSQL, etc.) with standard SQL.
Amazon Aurora: relational workloads needing higher throughput/availability than standard RDS, MySQL/PostgreSQL-compatible.
Amazon DynamoDB: massive-scale key-value/document workloads needing single-digit-millisecond latency, serverless scaling.
Amazon ElastiCache: in-memory caching layer in front of a database to reduce read load and latency.
Read replicas: offload read traffic from a primary database; do not by themselves provide automatic failover (that's Multi-AZ).
Multi-AZ deployments: synchronous standby replica for automatic failover / high availability, not for scaling reads.

Storage class / tiering

S3 Standard: frequently accessed data.
S3 Intelligent-Tiering: unknown or changing access patterns, automatic cost optimization.
S3 Standard-IA / One Zone-IA: infrequent access but need millisecond retrieval when accessed; One Zone-IA is cheaper but single-AZ (less resilient, use only for easily re-creatable data).
S3 Glacier tiers: archival data, retrieval times range from minutes (Instant Retrieval) to many hours (Deep Archive), decreasing cost as retrieval time increases.
Amazon EBS: block storage for a single EC2 instance (like a virtual hard disk).
Amazon EFS: shared file storage mountable by many EC2 instances concurrently (NFS).
Amazon FSx: managed file systems for specific workloads (Windows File Server, Lustre for HPC).

Compute purchasing & scaling

On-Demand: unpredictable, short-term, or spiky workloads.
Reserved Instances / Savings Plans: steady-state, predictable workloads in exchange for a discount.
Spot Instances: fault-tolerant, interruptible workloads (batch, stateless, CI) at the deepest discount; AWS can reclaim capacity with short notice.
Horizontal scaling (more instances) is generally preferred over vertical scaling (bigger instance) for fault tolerance and elasticity in distributed architectures.

Disaster recovery strategies (by RTO/RPO, increasing cost/complexity)

Backup and restore: cheapest, highest RTO/RPO.
Pilot light: core infrastructure always running at minimal capacity, scaled up on failover.
Warm standby: scaled-down but fully functional copy always running, scaled up on failover.
Active-active (multi-site): full production capacity running in multiple locations simultaneously; lowest RTO/RPO, highest cost.

Networking cost optimization

NAT gateway costs accrue per-AZ and per data processed; a single shared NAT gateway is cheaper but creates a cross-AZ dependency (less resilient) than one per AZ.
VPC endpoints (gateway/interface) avoid routing traffic to AWS services over the public internet or NAT gateway, reducing both cost and exposure.
Direct Connect offers consistent, private, high-bandwidth connectivity at a fixed cost — cheaper than VPN at high sustained data transfer volumes, but has longer lead time to provision.

Start Practice

Official resources

Practice by SuperML.org is an independent study resource and is not affiliated with, endorsed by, or officially connected to Amazon Web Services. Questions are AI-generated for practice purposes only.