SAA-C03 in brief
The AWS Certified Solutions Architect - Associate exam has 65 questions, but only 50 of them count toward your score. You need a scaled score of 720 out of 1,000, and the four domains are weighted from 30% down to 20%. This guide explains how scoring works and how to split your study time across the domains.
What the exam looks like
The AWS certification page lists the SAA-C03 exam at 130 minutes and 65 questions, in multiple choice or multiple response format, with a fee of 150 USD. Check that page before you book, because fees and taxes can vary by location.
The SAA-C03 exam guide describes two response types:
- Multiple choice: one correct response and three distractors.
- Multiple response: two or more correct responses out of five or more options.
The guide says the target candidate has at least 1 year of hands-on experience designing cloud solutions that use AWS services, and that the exam validates the ability to design solutions based on the AWS Well-Architected Framework.
How SAA-C03 scoring works
Several points in the SAA-C03 exam guide are easy to misread, so here they are in order.
- 50 scored, 15 unscored. The exam includes 50 questions that affect your score and 15 unscored questions that do not. AWS uses the unscored ones to evaluate questions for future use, and they are not identified on the exam. Treat every question as if it counts.
- Scaled score. Results are reported as a scaled score of 100 to 1,000, and the minimum passing score is 720. The scaled model helps equate scores across exam forms of slightly different difficulty, so 720 is not a fixed percentage of correct answers.
- No penalty for guessing. Unanswered questions are scored as incorrect, so answer everything.
- Compensatory scoring. You do not need to pass each section. You need to pass only the overall exam, so a weak domain can be offset by a strong one.
The guide also warns that the section-level table in your score report gives general information on strengths and weaknesses and should be interpreted with caution. Do not over-read a single weak-looking section.
Domain weights
| Domain | Weight (scored content) | Task statements |
|---|---|---|
| 1. Design Secure Architectures | 30% | 3 |
| 2. Design Resilient Architectures | 26% | 2 |
| 3. Design High-Performing Architectures | 24% | 5 |
| 4. Design Cost-Optimized Architectures | 20% | 4 |
The weights and task statements come from the SAA-C03 exam guide. Domain 3 has the most task statements even though it is not the heaviest, which means its topics are spread widely. Domain 2 has only two task statements but carries 26%, so each one is covered in depth.
Domain 1: Design Secure Architectures (30%)
This is the heaviest domain. Its three task statements are secure access to AWS resources, secure workloads and applications, and data security controls.
- Access (1.1): IAM users, groups, roles and policies, cross-account access with AWS STS, multi-account strategy with AWS Control Tower and service control policies, resource policies, and federation.
- Workloads (1.2): security groups, route tables, network ACLs, NAT gateways, public and private subnets, AWS Shield, AWS WAF, AWS Secrets Manager, and VPN or AWS Direct Connect for external connections.
- Data (1.3): encryption at rest with AWS KMS, encryption in transit with AWS Certificate Manager, key access policies, key rotation, backups and replication.
Common trap: choosing a broad permission fix when the question asks for least privilege. Read for the narrowest option that still works.
Domain 2: Design Resilient Architectures (26%)
The two task statements are scalable, loosely coupled architectures (2.1) and highly available or fault-tolerant architectures (2.2).
- Know when to decouple with Amazon SQS, event-driven designs, and AWS Step Functions, and when serverless or containers fit.
- Know the disaster recovery strategies the guide names: backup and restore, pilot light, warm standby and active-active failover, along with RPO and RTO.
- Know the single-point-of-failure patterns across Availability Zones and Regions, and how Amazon RDS Proxy and read replicas appear in designs.
Common trap: picking the strongest DR strategy when the question gives a modest RTO and RPO. The cheapest strategy that meets the stated targets is usually the answer.
Domain 3: Design High-Performing Architectures (24%)
This domain has five task statements: storage (3.1), compute (3.2), databases (3.3), networks (3.4), and data ingestion and transformation (3.5).
- Storage: match Amazon S3, Amazon EFS and Amazon EBS to object, file and block needs.
- Compute: EC2 Auto Scaling, Lambda memory sizing, AWS Fargate, Amazon ECS and Amazon EKS.
- Databases: Amazon Aurora compared with Amazon DynamoDB, read replicas, Amazon ElastiCache, and read-intensive compared with write-intensive access patterns.
- Networks: Amazon CloudFront, AWS Global Accelerator, load balancing, AWS PrivateLink.
- Ingestion: Amazon Kinesis, AWS Glue, Amazon Athena, AWS Lake Formation, Amazon QuickSight, AWS DataSync, and converting formats such as .csv to .parquet.
Common trap: confusing CloudFront with Global Accelerator, or an in-memory cache with a read replica. Ask what is actually slow: content delivery, network path, or database reads.
Domain 4: Design Cost-Optimized Architectures (20%)
The four task statements cover storage (4.1), compute (4.2), databases (4.3) and networks (4.4). Cost questions often hide inside the other domains, so do not skip this one because of its weight.
- Storage: S3 lifecycles and storage tiering, EBS volume types, and the lowest-cost way to move data to AWS.
- Compute: Spot Instances, Reserved Instances and Savings Plans, instance family and size, and load balancer type (Application, Network or Gateway).
- Databases: DynamoDB compared with Amazon RDS, serverless options, and backup and retention policies.
- Networks: a single shared NAT gateway compared with one per Availability Zone, Direct Connect compared with VPN, and VPC endpoints to reduce transfer costs.
- Tools: AWS Cost Explorer, AWS Budgets, the AWS Cost and Usage Report, and cost allocation tags.
Common trap: optimising cost at the expense of a stated requirement. If the scenario demands high availability, the cheapest single-AZ answer is wrong.
A four-week study plan
This plan is our suggestion, not an AWS recommendation. Adjust it to your hands-on experience.
- Week 1, Domain 1. Build an IAM role with cross-account access, a VPC with public and private subnets, and a KMS-encrypted S3 bucket.
- Week 2, Domain 2. Put an SQS queue between two components, then compare the four DR strategies against sample RTO and RPO targets.
- Week 3, Domain 3. Cover storage, compute, databases, networking and ingestion, one task statement per day or two.
- Week 4, Domain 4 and review. Study the cost topics, then spend the remaining days on timed practice and on re-reading the topics you got wrong.
Because scoring is compensatory, put extra hours into your weakest area only after you have covered all four domains once.
Check the scope lists
The appendix of the SAA-C03 exam guide lists in-scope and out-of-scope services, and says both lists are non-exhaustive and subject to change. For example, it lists AWS Lambda, Amazon VPC and Amazon S3 as in scope, and AWS CodeBuild, AWS CDK and all Internet of Things services as out of scope. Use the lists to avoid spending time on services that are not tested.
The guide we reviewed is marked Version 1.1 SAA-C03. Always confirm you are using the current version from the AWS certification page before you plan your study.
Try 20 questions free
→ Take the free SAA-C03 practice test: 20 questions, no signup, and your score as soon as you submit.
This article is not affiliated with or endorsed by Amazon Web Services.
