Course outline

26.2

Exam Format, Strategy and the Keyword Cheat Sheet

How the exam works, elimination, reading scenarios, and the keyword-to-service map from every chapter.

24 min Reading + animations

Tip: tap or hover any dotted-underlined term to see what it means.

By the end of this lesson you will be able to

  • Book the SAA-C03 exam the right way: account, price, ID, online or test centre, and the ESL extra 30 minutes for non-native English speakers.
  • Explain how the exam is scored: 65 questions of which 50 count, scaled score 100–1,000, pass at 720, compensatory scoring, no penalty for guessing, results within five business days, retake after 14 days.
  • Name the four domains with their weights and the chapters of this course that feed each one.
  • Read a scenario like an architect: find the real question in the last sentence, underline the constraint words, and see how one changed word changes the answer.
  • Eliminate the certainly-wrong options, then decide between the last two on the constraint word, including choose-two questions.
  • Pace 65 questions in 130 minutes with a three-pass method.
  • Use the keyword cheat sheet of the whole course, chapter by chapter, and the list of look-alike pairs that cause most wrong answers.

#Why exam technique matters

You have now met more than 150 AWS services and features across 25 chapters. Knowing them is necessary, but the exam measures something narrower: whether you can pick the best of four plausible designs for a short business scenario, 65 times, in 130 minutes. Most wrong answers on this exam are not caused by never having heard of a service. They come from a missed word (“least operational overhead”), a look-alike (Trusted Advisor or the Well-Architected Tool, CloudTrail or Config), or time running out.

This lesson teaches no new service. It covers three things: how the exam itself works, a method for reading and answering scenarios, and the keyword cheat sheet: every chapter’s “if the question says this, pick that”, taken from the exam patterns the lessons teach and from the owner’s “Exam Trick” notes. Every row links back to the lesson that explains it.

The exam guide says the exam validates your ability to design solutions based on the AWS Well-Architected Framework. The framework, its six pillars and the review tools are lesson 26.1: every answer in this lesson is that framework applied under time pressure.

#How the exam works

Everything in this section was checked against the official exam page, the SAA-C03 exam guide and the AWS Certification policies on 1 November 2026. SAA-C03 is still the live version of the Solutions Architect – Associate exam. AWS has not announced a successor for it, despite pages on the web advertising an “SAA-C04”; when AWS replaces an exam, it publishes a new exam guide and a date on the official exam page first, so check that page in the week you book.

#Booking, price and ID

ItemWhat it is
ExamAWS Certified Solutions Architect – Associate, SAA-C03
Where you bookYour AWS Certification account (sign in at aws.training/Certification), which hands you to Pearson VUE
DeliveryA Pearson VUE test centre, or online proctored from home or office
Price150 USD (plus local taxes and exchange rate)
DiscountAfter you pass any AWS certification you get a 50% voucher for your next exam
Questions and time65 questions, 130 minutes
LanguagesEnglish, Japanese, Korean, Simplified and Traditional Chinese, Portuguese (Brazil), Spanish (Latin America and Spain), French, and Italian (Italian is retired after 31 December 2026)
Recommended experienceAt least one year of hands-on experience designing solutions on AWS. With no IT background, AWS suggests the Cloud Practitioner exam first
IDA primary government-issued ID (outside your country of residence: your passport) whose name matches your account, plus a secondary ID. Check the exact rules for online and test centre delivery when you book
Reschedule or cancelUp to 24 hours before the appointment (at most twice per appointment). Later than that, or a missed appointment, and the fee is lost
PaymentCredit card or voucher

#Online or at a test centre

Both deliver the same exam, the same questions and the same result. The difference is the room.

Online proctoring (Pearson VUE’s online delivery) runs on your own computer, watched through your camera and microphone:

  • Run Pearson VUE’s system test on the same computer and network days before. A company laptop with a strict VPN or firewall often fails it.
  • Check in up to 30 minutes early: photos of your ID, your face and the room. Arriving more than 15 minutes late means you cannot launch, and the fee is forfeited.
  • The desk must be clear, the phone out of reach, nobody else in the room. You may not speak, read aloud or leave the camera’s view.
  • No breaks are allowed during an online exam. Plan the water and the washroom before you start.

A test centre removes the home risks (noise, family, power cuts, broadband drops) at the cost of travel. Bags and phones go into a locker; the centre gives you the noteboard.

#The ESL accommodation: 30 extra minutes

If English is not your first language, you can request the ESL +30 minutes accommodation (English as a Second Language) for exams taken in English. For most Bangladeshi candidates this is the single most valuable step in the whole booking: 130 minutes becomes 160, about 2.5 minutes per question instead of 2.

  • Request it in your AWS Certification account (Request Exam Accommodations, then the ESL +30 type). Once approved, it applies to your future exams with every delivery provider.
  • It must be approved before you schedule the exam. An exam you already booked does not gain the time; you would have to cancel or reschedule it (at least 24 hours before) and book again.
  • There is no test of your English and no extra fee.

Exam day, from booking to result

You book through your AWS Certification account; Pearson VUE delivers the exam, online or at a test centre; the result comes back to your account. Follow the normal path, then the ways it goes wrong.

Scenario

A Mirpur developer takes the exam at home, in English, with the ESL accommodation approved first.

Youcandidate
Certification accountAWSESL approved
Pearson VUEproctor
request ESL +30
Step 1 of 7
1

English is not her first language, so before booking anything she requests the “ESL +30 minutes” accommodation in her AWS Certification account. Once approved, it applies to her future bookings.

#Questions and scoring

The exam guide defines two question types:

  • Multiple choice: one correct answer and three incorrect ones (distractors).
  • Multiple response: two or more correct answers out of five or more options. The question tells you how many to choose (“Choose two.”). The guide does not promise partial credit, so treat each one as all or nothing.

The distractors are written to be plausible: they are what someone with incomplete knowledge would choose. That is why reading and elimination matter as much as memory.

How the score works:

  • Of the 65 questions, 50 are scored. 15 are unscored: AWS is testing them for future exams. They are not identified, so you cannot skip them, and a strange question may be one of them.
  • Unanswered questions are scored as incorrect, and there is no penalty for guessing. Never leave a question blank.
  • The result is a scaled score from 100 to 1,000. The minimum to pass is 720. Scaling evens out exam forms of slightly different difficulty, so there is no fixed “72% of the questions”; AWS does not publish the conversion.
  • The exam uses a compensatory scoring model: you need to pass the overall exam, not each section. A strong domain can make up for a weak one.
  • The score report gives pass or fail, the scaled score, and a table that classifies your performance in each section (“Meets competencies” or “Needs improvement”). It never shows which questions you got wrong.
  • Results appear in your AWS Certification account within five business days (unless held for a security review). At the end of the exam the screen does not show a score.

How the exam is scored

65 cells are the questions. Watch the 15 unscored ones appear only after the exam, then the scaled score and the domain bands of the score report.

Scenario

Every question looks the same during the exam. Only 50 of them decide the score.

Step 1 of 4
1

The exam has 65 questions: multiple choice (one right answer out of four) and multiple response (two or more right answers out of five or more).

#Retakes, validity and renewal

  • If you fail, you must wait 14 calendar days before you can retake. There is no limit on attempts, and every attempt costs the full fee.
  • The certification is valid for three years. You renew it by passing the latest version of the exam again, or by earning the Solutions Architect – Professional certification, which also renews the Associate.
  • A pass gives you a digital badge and the 50% voucher for your next AWS exam.

#The four domains

The exam guide splits the scored questions into four content domains. The weights tell you where the points are: security alone is almost a third of the exam.

DomainWeightTask statementsWhere this course teaches it
1. Design Secure Architectures30%1.1 secure access to AWS resources · 1.2 secure workloads and applications · 1.3 data security controlsCh02 IAM, 3.5 security groups and NACLs, 4.2–4.3 roles and IMDS, 10.2 and 10.8–10.9 S3 security, 11.2 OAC and VPC origins, Ch20 advanced identity, Ch21 encryption and security services, 22.2 endpoints, 22.7 Network Firewall
2. Design Resilient Architectures26%2.1 scalable and loosely coupled architectures · 2.2 highly available and/or fault-tolerant architectures1.2 AZs, Ch06 load balancing and Auto Scaling, 7.1–7.3 Multi-AZ and Aurora, 8.3–8.4 failover, Ch09, Ch13 decoupling, Ch15 serverless, Ch23 DR, Ch24
3. Design High-Performing Architectures24%3.1 storage · 3.2 elastic compute · 3.3 databases · 3.4 network architectures · 3.5 data ingestion and transformationCh04–05 EC2 and its storage, 7.5 ElastiCache, 10.6 S3 performance, Ch11 CloudFront and Global Accelerator, Ch12 FSx, Ch14 containers, Ch16 databases, Ch17 analytics, Ch18 ML services, 24.2 and 24.4
4. Design Cost-Optimized Architectures20%4.1 storage · 4.2 compute · 4.3 databases · 4.4 network architectures1.4 billing, 4.4 purchasing options, 5.2 volume types, 10.5 storage classes, 13–15 serverless pricing, 22.8 networking costs, 23.5 data transfer, 25.4 cost tools

Chapter 19 (monitoring and audit) and chapter 25 (other services) appear in all four domains: you cannot secure, recover or optimise what you cannot see.

#Services that are retired, renamed or out of scope

The exam guide ends with lists of in-scope and out-of-scope services. Read the in-scope list once before the exam: anything there can appear. Questions are also not rewritten every time a product changes, so you will meet services that are retired or closed to new customers. Answer by what the question describes, not by today’s product catalogue:

  • Snowmobile (retired in 2024) and Snowcone (discontinued): still the answer in an older question about exabytes or a tiny edge device (lesson 10.11). Snowball Edge is available only to existing customers since November 2025 but is still the answer for “petabytes offline”.
  • Amazon Pinpoint stopped taking new customers in 2025 and its engagement features reached end of support on 30 October 2026; an exam question about targeted multi-channel campaigns may still name it (lesson 25.2).
  • QLDB (ledger database) was retired in 2025 (lesson 16.1); Server Migration Service means MGN today (lesson 23.4); CloudWatch Events is EventBridge (lesson 19.5); Kinesis Data Firehose is Amazon Data Firehose; SageMaker is SageMaker AI.
  • Older questions quote older numbers: 256 KB for an SQS message (now 1 MiB), five read replicas for RDS (now up to 15 for several engines). The answer pattern is the same; only the number changed.

#Studying in the last weeks

The slides’ advice holds: practise hands-on, skim a few whitepapers and FAQs, join a community. Here it is as a plan.

#Practise hands-on, safely

Build small versions of the patterns: a VPC with public and private subnets, an ALB with an Auto Scaling group, an S3 bucket behind CloudFront with OAC, an SQS queue feeding a Lambda function. Ten minutes in the console teaches more than an hour of reading about a setting. Set a budget alert first, use the free tier, and delete everything afterwards (lesson 1.4).

#Whitepapers and FAQs

  • The AWS Well-Architected Framework (lesson 26.1) is the whitepaper the exam is built on.
  • Disaster Recovery of Workloads on AWS (lesson 23.1) is the source of the four DR strategies.
  • The slides’ “Architecting for the Cloud: AWS Best Practices” is an older paper; its ideas now live in the Well-Architected Framework.
  • Service FAQs (for example the VPC, S3, EC2 and RDS FAQs) answer many exam-style questions directly. Read them for the services in your weakest domain.

#Official practice from AWS

On AWS Skill Builder: the AWS Certification Official Practice Question Set (exam-style questions with explanations, free) and the Official Practice Exam (full length and timed; check on Skill Builder whether your plan includes it). Take the practice exam once, under real conditions, about a week before the exam, and spend more time on its explanations than on the score.

#Community

Study with others: discuss questions, explain answers to each other, read AWS blogs and watch re:Invent sessions on the services you find hardest. AWS community meetups in Dhaka are a good place to meet people who have already passed.

#A four-week revision plan

WeekFocusChaptersDaily routine
1Secure (30%)2, 3.5, 10.2, 10.8–10.9, 20, 21Re-read summaries, redo self-checks, read every explanation, also for answers you got right
2Resilient (26%)6, 7.1–7.3, 8.3–8.4, 9, 13, 15, 23, 24Same, plus draw each DR strategy and each decoupling pattern from memory
3High-performing and cost (44%)4, 5, 10.5–10.6, 11, 12, 14, 16, 17, 22, 25.4Same, plus the cheat sheet below: cover the Pick column and say the answer
4Mixed, timedEverythingOne timed set of 65 in 130 (or 160) minutes, then a day on its mistakes; the drill below; light review the day before, then sleep

#Reading a scenario

Most questions are scenarios: two to six sentences about a company, followed by a question. Read them in a fixed order.

#Find the real question first

  1. Read the last sentence first. It is the actual question: what is being asked for (a storage class, a migration tool, a way to restrict access) and under which goal (“most cost-effective”, “least operational overhead”, “highest availability”).
  2. Then read the scenario for the facts that limit the answer: the data size, the access pattern, the latency, what may not change, what already exists.
  3. Underline the constraint words (next section). These are the words that make one of two working designs better than the other.
  4. Ignore decoration. The company’s industry, its name and its history rarely matter. A bank in the question does not mean CloudHSM; a hospital does not mean anything until the question says “PHI” or “sensitive data”.

#Constraint words and what they push towards

The exam prints the strongest of these words in capitals (MOST, LEAST). They decide between two answers that would both work.

The question says…It pushes towards
most cost-effective, lowest costThe cheapest option that still meets every stated requirement (not the cheapest overall)
least operational overhead, least effort, fully managedManaged and serverless services; built-in features over scripts
with minimal changes to the application, without code changesLift-and-shift answers: read replicas, sticky sessions, DAX, RDS Proxy, rehost
highly availableMulti-AZ, a short interruption is acceptable
fault tolerant, no downtime, no performance impactEnough capacity survives the failure (more instances per AZ, active/active)
near real timeData Firehose, buffering of seconds to minutes is fine
real timeKinesis Data Streams, Lambda consumers, milliseconds
serverless, without managing serversLambda, Fargate, DynamoDB, Athena, Aurora Serverless, S3
encrypt in transit / at restTLS (ACM) / server-side encryption with KMS
temporary credentialsIAM roles and STS, never access keys
across accountsResource-based policies, roles to assume, RAM, Organizations
on-premisesVPN, Direct Connect, Storage Gateway, DataSync, Outposts, interface endpoints
petabytes, limited bandwidth, weeksSnowball Edge
in the shortest timeThe fastest path, even if it costs more
millisecond / microsecondDynamoDB, ElastiCache / DAX, ElastiCache
durableS3, EBS, DynamoDB (not instance store, not a cache)
ordered, exactly onceSQS FIFO (and Step Functions Standard for workflows)
decoupleSQS (or SNS + SQS)
static IPNLB with Elastic IPs, Global Accelerator
global usersCloudFront (cacheable content), Global Accelerator (TCP/UDP, static IPs)

#One scenario, four answers

The same data can lead to four different answers when only the constraint words change. A tea exporter in Sylhet keeps 2 TB of sales reports in S3:

The question adds…AnswerWhy
Opened daily for 30 days, then rarely; most cost-effective; millisecond accessLifecycle rule to S3 Standard-IA after 30 daysKnown pattern: a free rule moves objects at the right time
Unknown, changing access; least operational overheadS3 Intelligent-TieringWatches each object and moves it, no retrieval fees
Occasional ad hoc SQL on the reports, no infrastructureAthenaServerless SQL on files in S3, pay per data scanned
Complex BI dashboards all day on petabytesRedshiftA data warehouse for heavy, repeated queries

Keywords light up the answer

Each scenario sentence hides a few deciding words. Watch each keyword travel to the one service it names, and watch the look-alike that fails.

Scenario

“Decouple the order service from billing; store carts with single-digit-millisecond reads at millions of requests per second; give global gamers a static IP.”

The scenario
Amazon SQS
DynamoDB
Global Accelerator
Step 1 of 4
1

Read the sentence once for its story, then again only for the words that limit the design. Three short phrases carry the whole answer.

#Proceed by elimination

The slides’ advice is the core of the method: rule out what you know is wrong, then choose the option that makes the most sense from what is left. There are very few trick questions, so do not over-think it.

#What makes an option certainly wrong

  • Wrong category of service. EBS for shared files across AZs, SNS to store messages, CloudFront for UDP, Athena for transactions.
  • It violates a stated constraint. Deep Archive when “within minutes” is required; a single AZ when “survive an AZ failure” is required; a NAT gateway when the question says “most cost-effective” and a gateway endpoint exists.
  • It is technically impossible. A deny rule in a security group, a CNAME at the zone apex, a Route 53 health check reaching a private IP directly, attaching an EBS volume in another AZ, enabling encryption on an existing unencrypted EBS volume or RDS instance in place.
  • A custom script on EC2 when a managed feature exists. A cron job that copies objects instead of S3 replication, a script that snapshots volumes instead of DLM or AWS Backup, an SFTP daemon on EC2 instead of Transfer Family.
  • It is feasible but highly complicated. If an answer needs four services glued with code to do what one service does natively, it is probably wrong.
  • It uses the root account or long-term access keys for anything routine. Always wrong.

After this, usually two options remain. Re-read the constraint word and pick the one that honours it.

#Multiple-response questions

Judge each of the five options on its own, as a true or false statement about the scenario. Do not look for two that “fit together”: each right option is right by itself. If three look right, one of them violates a constraint you skipped; if only one looks right, the second is probably the less obvious managed feature.

Proceed by elimination

Cross out the certainly-wrong answers with a reason, then let the constraint word choose between the two that are left. Change one word and watch the other card win.

Scenario

The access pattern is known: busy for 30 days, rare after. The question asks for the most cost-effective storage.

A Sylhet tea exporter keeps 2 TB of sales reports in S3. Reports are opened every day for 30 days, then a few times a year, and must open within milliseconds when someone asks.

Constraint word: most cost-effective

AA lifecycle rule: S3 Standard → Standard-IA after 30 days
BA nightly script on EC2 moves old reports to Glacier Deep Archive
CMove the reports to EBS gp3 volumes
DS3 Intelligent-Tiering for all reports
Step 1 of 5
1

Read the last sentence first: it asks for the most cost-effective storage. Then underline the facts that limit the answer: a known pattern (30 days busy, then rare) and millisecond access.

#Top confusion pairs

Most lost points come from the same pairs of look-alikes. Learn the one-line decider for each.

PairThe deciderLessons
Trusted Advisor vs Well-Architected ToolTrusted Advisor scans your account automatically; the Well-Architected Tool is a questionnaire you answer about one workload26.1
CloudTrail vs Config vs CloudWatchWho called which API / what the configuration was and is it compliant / metrics, logs and alarms19.6, 19.7
SQS vs SNS vs Kinesis Data StreamsQueue, one consumer per message / push to many, keeps nothing / stream, many readers, replay13.7
Data Streams vs Data FirehoseReal time, custom consumers, replay / near real time delivery to S3, Redshift, OpenSearch, no code13.6
Global Accelerator vs CloudFrontTCP/UDP, static IPs, instant failover / caching HTTP(S) content at the edge11.4
ALB vs NLBHTTP routing by path, host, header / TCP/UDP, extreme scale, static IPs6.3
Multi-AZ vs read replicasSynchronous standby for failover / asynchronous copies for reads7.1
Aurora Global Database vs cross-Region read replicaAurora, RPO about 1 s, RTO under a minute / plain RDS cross-Region DR7.3
DAX vs ElastiCacheDynamoDB with no code change / any database, your code manages the cache15.5
Secrets Manager vs Parameter StoreAutomatic rotation, cross-Region secrets / cheap or free config and secure strings, no rotation21.3
KMS vs CloudHSMMulti-tenant, integrated with services / single-tenant HSM, exclusive key control, PKCS#1121.5
Gateway vs interface endpointS3 or DynamoDB from inside the VPC, free / any service, or reached from on-premises or another VPC, paid22.2
VPC peering vs Transit GatewayTwo VPCs, cheapest / many VPCs, transitive hub-and-spoke22.1, 22.6
Site-to-Site VPN vs Direct ConnectQuick, encrypted, over the internet / dedicated, consistent, weeks to set up, not encrypted by itself22.4, 22.5
Storage Gateway typesFile (NFS/SMB to S3) / Volume stored or cached (iSCSI) / Tape (replace tapes, keep backup software)12.3
DataSync vs Transfer Family vs SnowballScheduled online copy of your storage / SFTP endpoint for partners / offline, petabytes12.4, 23.5
EFS vs FSx for Windows vs FSx for LustreLinux NFS across AZs / Windows SMB with AD / HPC parallel file system on S3 data12.2
WAF vs Shield AdvancedLayer 7 rules: SQL injection, XSS, rate limits / DDoS response team and cost protection21.6
GuardDuty vs Inspector vs MacieThreats, unusual activity / software vulnerabilities, CVEs / sensitive data in S321.7
SCP vs permissions boundaryGuard rail for whole accounts in an organization / limit on one user or role20.1, 20.2
Identity Center vs CognitoYour workforce signing in to many accounts / your app’s customers20.3, 15.7
Elastic Disaster Recovery vs MGNKeep replicating for recovery / move once for good23.2, 23.4
Budgets vs Cost Explorer vs Anomaly DetectionAlert on a threshold you set / analyse and forecast, no alerts / machine-learning alert on unusual spend1.4, 25.4

#Managing the clock

130 minutes for 65 questions is 2 minutes per question (2.5 with ESL). That is enough for a careful read of every question, but not for re-reading one question for ten minutes.

#The three-pass method

  1. Pass 1, answer everything once (to about two thirds of the time). Answer what you are sure of in about a minute. If a question is not settled after about 3 minutes, choose the best option, flag it and move on. A flagged question already has an answer, so nothing is ever blank.
  2. Pass 2, the flagged questions. With fresh eyes, and with facts that later questions reminded you of. Most flags get settled here.
  3. Pass 3, a last check (the final 5–10 minutes). The review screen shows unanswered and flagged questions. Make sure none is blank. Change an answer only for a concrete reason, such as a constraint word you now see you missed, never from a vague feeling.

Keep 10–15 minutes for passes 2 and 3 at the very least. Stop re-reading a question when the fourth read shows nothing new: the fact you are missing is not in the question.

Pacing 65 questions in 130 minutes

The bar is the clock, the grid is the 65 questions. Compare a planned three-pass exam with a candidate who gets stuck, then see the ESL time budget.

Scenario

130 minutes for 65 questions. Pass 1 answers everything once, pass 2 revisits the flagged ones, pass 3 checks nothing is blank.

Time used: 0 / 130 minfirst pass ends ≈ 85 min
You are on: Q1Plan: by now about question 1on track
▸
answeredflaggedblank = wrongnot reached yet
Step 1 of 7
1

The clock starts: 130 minutes for 65 questions is exactly 2 minutes each. The plan is to finish a first pass by about minute 85, which leaves 45 minutes for the hard ones.

#On the day

  • Sleep. A rested mind reads constraint words; a tired one skips them.
  • Eat before, and (online) visit the washroom before check-in: there are no breaks.
  • Online: start check-in 30 minutes early with your ID, an empty desk and the phone out of reach. Centre: arrive 30 minutes early with both IDs.
  • Use the whiteboard or noteboard for numbers (transfer times, IP counts, costs) rather than doing them in your head.
  • When a question looks unfamiliar, remember that it may be one of the 15 unscored ones. Answer it, flag it, and do not let it shake the next ten.

#What goes wrong

SymptomCauseFix
Cannot launch the online examMore than 15 minutes late, or the system test fails on the dayRun the system test days before on the same computer and network; check in 30 minutes early
Exam revoked midwaySomeone entered the room, you spoke, or you left the camera’s viewChoose a test centre if home cannot be private for three hours
No extra 30 minutes on exam dayESL was requested after schedulingRequest ESL before scheduling; otherwise reschedule at least 24 hours ahead
Turned away at the centreName on the ID does not match the account, or no secondary IDFix the account name before booking; bring two IDs
Ran out of time with questions blankToo long on a few questions; no pacing plan3-minute rule, flag and move; first pass by two thirds of the time
Picked a working but wrong answerMissed “most cost-effective” or “least operational overhead”Read the last sentence first; underline constraint words
Chose a look-alikeTrusted Advisor for the Well-Architected Tool, CloudFront for Global Accelerator, Config for CloudTrailLearn the confusion pairs and their deciders
Picked the clever custom solutionA script on EC2 instead of a managed feature“Feasible but complicated” is probably wrong
Changed right answers to wrong ones in reviewSecond-guessing without a reasonChange only for a concrete, newly seen reason
Failed by a few pointsOne or two weak domainsUse the score report’s bands; study those chapters for 14 days; retake

#How it is used beyond the exam

The habits this lesson trains are the habits of design reviews at work. A product manager says “the reports must be cheap to keep but open instantly when an auditor asks”: that is a constraint word, and it decides the storage class. A bank’s head of technology says “we cannot change the application this quarter”: that rules out the refactor and points to read replicas or RDS Proxy. Eliminating the impossible and choosing between the last two on the stated goal is how architects argue for a design, and the Well-Architected pillars of lesson 26.1 are the vocabulary of that argument: security, reliability, performance, cost, operations, sustainability.

The cheat sheet below works the same way in a real meeting: when someone says “decouple”, “replay” or “static IP”, you should already hear the service.

#The keyword cheat sheet

One table per chapter. Each row is a phrase you will meet in questions, the service or feature it points to, and the lesson that explains why. The rows come from the exam patterns in the lessons and from the owner’s “Exam Trick” notes. Cover the middle column and test yourself; when a row surprises you, open its lesson.

#Ch01: Cloud foundations

Keyword / phrase in the questionPickLesson
Servers bought for peak and idle the rest of the yearElasticity: pay for what you use1.1
Who patches the OS of an EC2 instance?The customer1.1
Who patches the OS of RDS, or guards the data centre?AWS1.1
Data must stay in one countryA Region in that country1.2
Survive a data centre failureMulti-AZ1.2
Single-digit ms in a city with no RegionLocal Zones1.2
Ultra-low latency for 5G mobile devicesWavelength1.2
AWS CLI in the browser, nothing to installCloudShell1.3
Alert before spend crosses a limitAWS Budgets1.4
IAM admin cannot see the billRoot enables IAM access to Billing + a billing policy1.4

#Ch02: IAM essentials

Keyword / phrase in the questionPickLesson
One group allows, another explicitly deniesDenied: explicit deny wins2.2
New user with no policiesCan do nothing (implicit deny)2.2
Several answers work; grant the leastSpecific actions on specific resources2.1
Use root for daily administrationAlways wrong2.3
Application on EC2 needs AWS accessIAM role (instance profile)2.4
Role has admin rights but cannot be assumedThe trust policy2.4
Access keys pushed to GitHubRotate them; move the workload to a role1.3
Which permissions were never usedAccess Advisor (last accessed) / Access Analyzer2.4

#Ch03: VPC fundamentals

Keyword / phrase in the questionPickLesson
VPN or peering cannot be set upOverlapping CIDR ranges3.1
Need more than 65,536 IPs in one VPCAdd a secondary CIDR block3.2
Private instances need outbound internetNAT gateway in a public subnet3.4
Highly available NATOne NAT gateway per AZ3.4
NAT instance does not forwardDisable source/destination check3.4
SG allows 80, page still failsNACL outbound ephemeral ports3.5
Only the web tier may reach the DBDB SG allows the web tier’s SG3.5
Block one IP addressNACL deny rule (SGs cannot deny)3.5
Public IP must survive stop/startElastic IP3.6

#Ch04: EC2

Keyword / phrase in the questionPickLesson
Full control of the OS, long-running processEC2 (not Lambda)4.1
In-memory analytics / CPU-heavy / big local disksR or X / C / I or D families4.1
T instance slow every afternoonCPU credits ran out: unlimited mode or M/C4.1
Without opening port 22, no bastionSession Manager4.2
Protect role credentials against SSRFRequire IMDSv24.3
Steady 24/7 for yearsReserved Instances or Savings Plan4.4
Commitment across families, Fargate, LambdaCompute Savings Plan4.4
Interruptible batch at lowest costSpot Instances4.4
Per-socket licence, BYOLDedicated Hosts4.4
Lowest latency between nodesCluster placement group4.5
Keep RAM across a stop, fast resumeHibernate (encrypted root volume)4.5

#Ch05: EC2 storage

Keyword / phrase in the questionPickLesson
Move an EBS volume to another AZSnapshot, then a new volume there5.1
Full performance right after a restoreFast Snapshot Restore5.1
Recover snapshots deleted by mistakeRecycle Bin rule5.1
Automate EBS snapshot schedulesData Lifecycle Manager5.1
Big data, logs, cheap throughputst15.2
One volume, several instances, same AZio1/io2 Multi-Attach5.2
Encrypt an existing unencrypted volumeSnapshot, encrypted copy, new volume5.2
Highest IOPS, temporary dataInstance store5.3
Shared Linux files across AZsAmazon EFS5.4
Files rarely read after weeksEFS lifecycle to Infrequent Access5.4

#Ch06: High availability and scalability

Keyword / phrase in the questionPickLesson
Stateless web tier must scaleAuto Scaling group behind a load balancer6.1
Instance healthy in EC2, unhealthy in target groupApp down or SG blocks the health check6.2
Path- or host-based routing, microservicesALB6.3
UDP, millions of requests per second, static IPNLB6.3
Third-party firewall appliances inlineGateway Load Balancer6.3
Cart lost, legacy app, no code changeSticky sessions6.4
Uneven CPU across AZsCross-zone load balancing6.4
Many TLS certificates on one ALBSNI6.4
Requests dropped during scale-inIncrease the deregistration delay6.4
LB says unhealthy, ASG does not replaceEnable ELB health checks on the ASG6.5
Replace a failed single server automaticallyASG min 1 / max 1 / desired 1, two AZs6.5

#Ch07: RDS, Aurora and ElastiCache

Keyword / phrase in the questionPickLesson
Automatic failover, survive an AZRDS Multi-AZ7.1
Reporting slows production, offload readsRead replicas7.1
Table deleted an hour agoPoint-in-time restore (new instance)7.2
Major upgrade, minimal downtimeBlue/Green Deployment7.2
OS access to Oracle or SQL ServerRDS Custom7.2
Cross-Region DR, RPO 1 s, RTO under a minuteAurora Global Database7.3
Spiky or idle relational workloadAurora Serverless v27.3
Test copy of production, fast and cheapAurora cloning7.3
Lambda exhausts DB connectionsRDS Proxy7.4
Encrypt an existing unencrypted databaseSnapshot, encrypted copy, restore7.4
Sub-millisecond reads, sessions, leaderboardElastiCache (Redis OSS / Valkey)7.5

#Ch08: Route 53

Keyword / phrase in the questionPickLesson
Lower the risk of tomorrow’s migrationLower the TTL well in advance8.1
Zone apex to an ALB, CloudFront or S3Alias record8.2
Send 10% to the new versionWeighted routing8.3
Active-passive, standby siteFailover routing8.3
Users must be served in their countryGeolocation routing8.3
Fastest Region for each userLatency routing8.3
Fail over a private resourceCloudWatch alarm + health check on the alarm8.4
Domain at another registrarHosted zone + update NS at the registrar8.5
On-premises must resolve private zonesResolver inbound endpoint8.5

#Ch09: Classic architectures

Keyword / phrase in the questionPickLesson
Thousands of instances without losing dataStateless tier, state in shared stores9.1
Sessions must survive instance terminationSessions in ElastiCache or DynamoDB9.2
Uploaded files visible on every instanceAmazon EFS9.3
Instances slow to start because of installsGolden AMI9.3
Upload code, keep OS access, no infra workElastic Beanstalk9.4
Long tasks off the Beanstalk web tierWorker environment + SQS9.4
Zero downtime, quickest rollbackImmutable or blue/green9.4
Database deleted with the environmentCreate RDS outside the environment9.4

#Ch10: Amazon S3

Keyword / phrase in the questionPickLesson
No bucket may ever be publicAccount-level Block Public Access10.2
Browser blocks assets from another bucketCORS on the assets bucket10.3
Protect against accidental deletionVersioning (+ MFA Delete)10.4
Copy objects to another RegionCross-Region Replication10.4
Unknown or changing access patternS3 Intelligent-Tiering10.5
Cheapest archive, 12–48 hours is fineGlacier Deep Archive10.5
Thousands of GETs per second throttledSpread over more prefixes10.6
Global users upload to one bucketS3 Transfer Acceleration10.6
Act on billions of existing objectsS3 Batch Operations10.7
Audit who used the encryption keySSE-KMS10.8
WORM, even root cannot deleteObject Lock, compliance mode10.9
Temporary download or upload linkPre-signed URL10.9

#Ch11: CloudFront and Global Accelerator

Keyword / phrase in the questionPickLesson
Cache static content for global usersCloudFront11.1
Private bucket served only via CloudFrontOrigin access control (OAC)11.1
ALB reachable only through CloudFrontVPC origins, or prefix list + secret header11.2
Users still get the old fileInvalidation, or versioned file names11.2
Block countriesGeo restriction11.2
Header rewrite, sub-ms, cheapestCloudFront Functions11.3
Network calls or heavy logic at the edgeLambda@Edge11.3
TCP/UDP, two static IPs, instant failoverGlobal Accelerator11.4

#Ch12: Hybrid storage and data transfer

Keyword / phrase in the questionPickLesson
Lots of data, little bandwidth, offlineSnowball Edge12.1
Snowball straight into GlacierImport to S3, then a lifecycle rule12.1
Windows, SMB, Active DirectoryFSx for Windows File Server12.2
HPC or ML on data in S3FSx for Lustre12.2
NFS + SMB, deduplication, NetAppFSx for NetApp ONTAP12.2
On-premises NFS/SMB backed by S3S3 File Gateway12.3
Replace tapes, keep backup softwareTape Gateway12.3
SFTP for partners, no serversTransfer Family12.4
Scheduled online copy from NFS/SMBDataSync12.4

#Ch13: Decoupling

Keyword / phrase in the questionPickLesson
Decouple, buffer spikes, asyncAmazon SQS13.1
Messages processed twiceRaise the visibility timeout13.2
Fewer empty responses, lower costLong polling13.2
Poison-pill messagesDead-letter queue13.2
Order matters, no duplicatesSQS FIFO13.3
One event, several independent consumersSNS + SQS fan-out13.4
Subscriber wants only some messagesSNS filter policy13.4
Real time, replay, many consumersKinesis Data Streams13.5
Load a stream into S3 or Redshift, no codeAmazon Data Firehose13.6
Legacy app on JMS, AMQP, MQTTAmazon MQ13.7

#Ch14: Containers

Keyword / phrase in the questionPickLesson
Private tasks must pull from ECRECR interface endpoints + S3 gateway endpoint14.1
Containers without managing serversFargate14.2
The container reads S3Task role14.2
Cannot pull the image or send logsTask execution role14.2
Tasks share files across AZsAmazon EFS14.2
Cluster must add EC2 for new tasksCapacity provider with managed scaling14.3
A container per uploaded fileEventBridge rule → ECS task14.3
Kubernetes, Helm, avoid lock-inAmazon EKS14.4
Simplest, deepest AWS integrationAmazon ECS14.4

#Ch15: Serverless

Keyword / phrase in the questionPickLesson
Failed async invocations with error detailsOn-failure destination15.1
Job runs longer than 15 minutesNot Lambda: Step Functions, ECS, Batch15.2
A critical function must always runReserved concurrency15.2
No cold starts at a known peakProvisioned concurrency15.2
Key-value, single-digit ms, any scaleDynamoDB15.4
Search by another attribute, cheaplyGlobal secondary index (never Scan)15.5
Active-active multi-Region NoSQLDynamoDB global tables15.5
Delete old items automaticallyDynamoDB TTL15.5
Usage plans, API keys, cachingAPI Gateway REST API15.6
Workflow with waits and human approvalStep Functions Standard15.7
Sign-up and sign-in for app usersCognito user pool15.7

#Ch16: Choosing databases

Keyword / phrase in the questionPickLesson
Relational, joins, transactionsRDS or Aurora16.1
Durable in-memory primary databaseMemoryDB16.1
Data warehouse, OLAP, BIRedshift16.1
MongoDB compatibleDocumentDB16.2
Graph, social network, fraud ringsNeptune16.2
Apache Cassandra, CQLKeyspaces16.2
IoT metrics over timeTimestream16.2

#Ch17: Data and analytics

Keyword / phrase in the questionPickLesson
Ad hoc SQL on files in S3, serverlessAthena17.1
Make Athena cheaper and fasterParquet/ORC, compression, partitions17.1
Complex BI queries all day on petabytesRedshift (Spectrum to read S3)17.2
Log search, full text, dashboardsOpenSearch Service17.3
Migrate Hadoop or SparkEMR17.4
EMR cost without risking HDFSCore On-Demand, task nodes on Spot17.4
Interactive BI dashboardsQuickSight17.5
Serverless ETL, schema discoveryGlue (crawler + Data Catalog)17.6
Row- and column-level access to a data lakeLake Formation17.6
SQL or Flink on a live streamManaged Service for Apache Flink17.7

#Ch18: Machine learning

Keyword / phrase in the questionPickLesson
Faces, labels, unsafe images or videoRekognition18.1
Speech to text, subtitlesTranscribe18.1
Text to lifelike speechPolly18.1
Translate user contentTranslate18.1
Chatbot, voice or text botLex18.1
Cloud contact centreConnect18.1
Sentiment, entities, PII in textComprehend (Medical for clinical text)18.1
Forms and tables from scanned documentsTextract18.2
Build and train your own modelsSageMaker AI18.2
Generative AI with foundation modelsBedrock18.2
Intelligent search across documentsKendra18.2

#Ch19: Monitoring and audit

Keyword / phrase in the questionPickLesson
Memory or disk usage of EC2Unified CloudWatch agent19.1
Metrics to Datadog or SplunkMetric Streams + Firehose19.1
Alert on an error in the logsMetric filter + alarm + SNS19.2
Logs to S3 or OpenSearch in real timeSubscription filter19.2
Recover EC2 on hardware failureAlarm with the recover action19.3
Test the user journey with no trafficSynthetics canary19.3
Top 10 IPs, hot keysContributor Insights19.4
React to an event, run on a scheduleEventBridge19.5
Who made this API callCloudTrail19.6
Configuration history, complianceAWS Config19.7

#Ch20: Advanced identity

Keyword / phrase in the questionPickLesson
Restrict member accounts, even adminsService control policy20.1
One bill, shared RI discountsOrganizations, consolidated billing20.1
Share subnets or a transit gatewayResource Access Manager20.1
Only principals of our organizationaws:PrincipalOrgID condition20.2
Only from the corporate IP rangeaws:SourceIp condition20.2
Developers create roles without escalatingPermissions boundary20.2
Single sign-on to many accountsIAM Identity Center20.3
Landing zone with guard railsControl Tower20.3

#Ch21: Encryption and security services

Keyword / phrase in the questionPickLesson
Encrypt before data leaves the premisesClient-side encryption21.1
Audit key use, own rotation, share keysKMS customer managed key21.2
Rotate database credentials automaticallySecrets Manager21.3
Cheap or free configuration valuesParameter Store21.3
Free TLS certificates that renewACM (in us-east-1 for CloudFront)21.4
Single-tenant HSM, exclusive key controlCloudHSM21.5
SQL injection, XSS, rate limitingAWS WAF21.6
DDoS response team, cost protectionShield Advanced21.6
WAF rules across all accountsFirewall Manager21.6
Threats, crypto-mining, odd API callsGuardDuty21.7
Vulnerabilities, CVEsInspector21.7
PII in S3 bucketsMacie21.7

#Ch22: Advanced networking

Keyword / phrase in the questionPickLesson
Two VPCs, cheapest private linkVPC peering22.1
Private S3 or DynamoDB access, cheapestGateway endpoint22.2
Expose a service privately to other VPCsPrivateLink with an NLB22.2
Which traffic was rejectedVPC Flow Logs22.3
Quick, encrypted link to the officeSite-to-Site VPN22.4
Branch offices talk through AWSVPN CloudHub22.4
Dedicated, consistent bandwidthDirect Connect22.5
Encrypt traffic on Direct ConnectVPN over DX, or MACsec22.5
Hundreds of VPCs, transitive routingTransit Gateway22.6
IPv6 outbound onlyEgress-only internet gateway22.7
Filter by domain name, IPS for the VPCNetwork Firewall22.7
Cut data transfer costsPrivate IPs, same AZ, gateway endpoints22.8

#Ch23: Disaster recovery and migration

Keyword / phrase in the questionPickLesson
Cheapest, hours of downtime acceptableBackup and restore23.1
Core DB replicated, servers offPilot light23.1
Scaled-down copy always runningWarm standby23.1
Near-zero RPO and RTO, two Regions liveMulti-site active/active23.1
Continuous block replication, recover in minutesElastic Disaster Recovery23.2
Central backups across services and accountsAWS Backup23.2
Backups nobody can delete, even rootBackup Vault Lock, compliance mode23.2
Migrate a database, source stays onlineDMS with CDC23.3
Oracle to PostgreSQLSCT + DMS23.3
Lift and shift serversApplication Migration Service (MGN)23.4
Keep using VMware toolsVMware Cloud on AWS23.4
Weeks over the network, petabytesSnowball Edge23.5

#Ch24: More solution architectures

Keyword / phrase in the questionPickLesson
SQS-triggered function keeps failingDLQ on the queue24.1
Filter S3 events by size, replay themS3 → EventBridge24.1
React when a specific API call is madeCloudTrail + EventBridge rule24.1
Repeated identical API requestsAPI Gateway caching24.2
Cached data must never be staleWrite-through24.2
Block malicious IPs at the edgeWAF on CloudFront24.3
Tightly coupled HPC, MPIEFA + cluster placement group24.4
Thousands of batch jobs on SpotAWS Batch24.4
HA single instance, lowest costASG 1/1/1 in two AZs + Elastic IP via user data24.5

#Ch25: Other services

Keyword / phrase in the questionPickLesson
Infrastructure as code, repeatable, driftCloudFormation25.1
Developers may not create EC2 directlyCloudFormation service role25.1
Transactional or bulk emailAmazon SES25.2
Targeted multi-channel campaignsPinpoint (in older questions)25.2
Run a script on 100 instances, no SSHRun Command25.3
Automate OS patchingPatch Manager25.3
Disruptive work only at weekendsMaintenance Windows25.3
Visualise and forecast spendCost Explorer25.4
Unexpected cost spike, MLCost Anomaly Detection25.4
Stop dev servers outside office hoursInstance Scheduler25.5
Salesforce or Zendesk data to S3, no codeAppFlow25.5
Front-end developers need a backend fastAmplify25.5

Now practise it with scenarios instead of rows:

Keyword → service drill

Twenty short scenarios from every domain. Tap the keywords you think decide the answer, pick a service, then press Check.

Scenario 1 of 20Right first time: 0 / 0

An order service must keep accepting orders during Eid sale spikes while the slow invoice service catches up at its own pace.

1. Mark the deciding keywords

2. Pick the service

#Certification paths after SAA

AWS certifications come in four levels: Foundational (no experience needed), Associate (role-based, some cloud or IT experience), Professional (advanced, about two years of AWS experience recommended) and Specialty (one deep area). In 2026 AWS added a fifth, Business category for non-technical roles. The list as of November 2026:

LevelCertifications
BusinessAI Business Strategist (new, in beta)
FoundationalCloud Practitioner, AI Practitioner
AssociateSolutions Architect, Developer, CloudOps Engineer (which replaced SysOps Administrator), Data Engineer, Machine Learning Engineer
ProfessionalSolutions Architect, DevOps Engineer, Generative AI Developer
SpecialtySecurity, Advanced Networking (retires after 31 December 2026)

Where SAA usually leads:

  • Solutions Architect – Professional: the natural next step; AWS marks the exam as being updated, and the new version (SAP-C03) is announced for 17 November 2026, so use preparation material written for that version. Passing it also renews your Associate.
  • Security – Specialty: if chapters 20 and 21 were your favourites.
  • Developer or CloudOps Engineer – Associate: the same services seen from building or running them, and a cheaper second Associate with your 50% voucher.
  • AI Practitioner, Machine Learning Engineer or Generative AI Developer: if chapter 18 is where you want to grow.

AWS retired several Specialty exams in 2024 (Data Analytics, Database, SAP on AWS) and the Machine Learning Specialty in March 2026, and has announced Advanced Networking’s retirement for the end of 2026. A certification you already hold stays valid for its three years.

#The end of the course, and what comes next

You started with what the cloud is and how AWS charges for it, and you have now designed networks, secured accounts, chosen databases, built event-driven and serverless systems, planned disaster recovery and migrations, and learned to judge all of it by the six pillars. That is what the exam tests, and more importantly, it is what a solutions architect does every week.

Next steps, in order:

  1. Request ESL if it applies to you, then book the exam for three to four weeks from today. A date makes revision real.
  2. Follow the four-week plan above, with one timed practice set at the end.
  3. After you pass, build one real project end to end (a small shop, a booking system for a clinic, a data pipeline for a garment factory) and write down your design decisions with the pillar each one serves. That page is worth more in an interview than the badge.
  4. Keep going: a Professional or Specialty certification, or depth in the area of your work.

Thank you for staying to the last lesson. Good luck in the exam. You are ready to start practising for it.

#Try it yourself

This lesson’s practice is not commands but exam rehearsal:

  1. Request ESL in your AWS Certification account now, if English is not your first language, before you book anything.
  2. Take the Official Practice Question Set on AWS Skill Builder under exam conditions: a quiet room, a timer at 2 minutes per question (2.5 with ESL), the three-pass method, no notes. Afterwards, for every question (right or wrong) write one line on why each wrong option is wrong.
  3. Build a one-page personal keyword sheet: copy only the cheat-sheet rows you got wrong or hesitated on, in your own words. Re-read it daily in the last week.
  4. Redo the self-checks of the chapters in your weakest domain (from your practice score or your feeling). For each wrong answer, open the lesson and find the sentence that would have saved you.
  5. Run the drill above until you score at least 18 of 20 right first time, then reset and do it in a different order with the chips covered by your hand.
  6. Rehearse the online check-in if you will test from home: run Pearson VUE’s system test on the exam computer and network, clear the desk, and time a 130-minute sitting without leaving the chair.
  7. Do one timed full set (65 questions in 130 or 160 minutes) a week before the exam, then spend a day on its explanations rather than another set.

#Summary

Key takeaways

  • SAA-C03 is still the live exam (checked November 2026): 65 questions, 130 minutes, 150 USD, at a Pearson VUE centre or online; book through the AWS Certification account with two IDs.
  • ESL +30 minutes for non-native English speakers: request it before scheduling; 160 minutes is about 2.5 per question.
  • 50 scored + 15 unscored (not identified), multiple choice and multiple response, blank = wrong with no penalty for guessing, scaled 100–1,000, pass at 720, compensatory (overall, not per domain), results and score report within five business days, retake after 14 days, valid three years.
  • Domains: Secure 30%, Resilient 26%, High-performing 24%, Cost-optimized 20%.
  • Read the last sentence first, underline the constraint words, ignore decoration. One changed word changes the answer.
  • Eliminate wrong category, constraint violations, impossibilities, custom scripts and over-complicated designs; decide the last two on the constraint word. Judge each option of a choose-two on its own.
  • Three passes: answer everything once by about two thirds of the time, flag after about 3 minutes, review flagged, never leave a blank.
  • The keyword cheat sheet and the confusion pairs are the course in one page: when a row surprises you, go back to its lesson.