26.2
Exam Format, Strategy and the Keyword Cheat Sheet
How the exam works, elimination, reading scenarios, and the keyword-to-service map from every chapter.
24 min Reading + animations
Tip: tap or hover any dotted-underlined term to see what it means.
By the end of this lesson you will be able to
- Book the SAA-C03 exam the right way: account, price, ID, online or test centre, and the ESL extra 30 minutes for non-native English speakers.
- Explain how the exam is scored: 65 questions of which 50 count, scaled score 100–1,000, pass at 720, compensatory scoring, no penalty for guessing, results within five business days, retake after 14 days.
- Name the four domains with their weights and the chapters of this course that feed each one.
- Read a scenario like an architect: find the real question in the last sentence, underline the constraint words, and see how one changed word changes the answer.
- Eliminate the certainly-wrong options, then decide between the last two on the constraint word, including choose-two questions.
- Pace 65 questions in 130 minutes with a three-pass method.
- Use the keyword cheat sheet of the whole course, chapter by chapter, and the list of look-alike pairs that cause most wrong answers.
#Why exam technique matters
You have now met more than 150 AWS services and features across 25 chapters. Knowing them is necessary, but the exam measures something narrower: whether you can pick the best of four plausible designs for a short business scenario, 65 times, in 130 minutes. Most wrong answers on this exam are not caused by never having heard of a service. They come from a missed word (“least operational overhead”), a look-alike (Trusted Advisor or the Well-Architected Tool, CloudTrail or Config), or time running out.
This lesson teaches no new service. It covers three things: how the exam itself works, a method for reading and answering scenarios, and the keyword cheat sheet: every chapter’s “if the question says this, pick that”, taken from the exam patterns the lessons teach and from the owner’s “Exam Trick” notes. Every row links back to the lesson that explains it.
The exam guide says the exam validates your ability to design solutions based on the AWS Well-Architected Framework. The framework, its six pillars and the review tools are lesson 26.1: every answer in this lesson is that framework applied under time pressure.
#How the exam works
Everything in this section was checked against the official exam page, the SAA-C03 exam guide and the AWS Certification policies on 1 November 2026. SAA-C03 is still the live version of the Solutions Architect – Associate exam. AWS has not announced a successor for it, despite pages on the web advertising an “SAA-C04”; when AWS replaces an exam, it publishes a new exam guide and a date on the official exam page first, so check that page in the week you book.
#Booking, price and ID
| Item | What it is |
|---|---|
| Exam | AWS Certified Solutions Architect – Associate, SAA-C03 |
| Where you book | Your AWS Certification account (sign in at aws.training/Certification), which hands you to Pearson VUE |
| Delivery | A Pearson VUE test centre, or online proctored from home or office |
| Price | 150 USD (plus local taxes and exchange rate) |
| Discount | After you pass any AWS certification you get a 50% voucher for your next exam |
| Questions and time | 65 questions, 130 minutes |
| Languages | English, Japanese, Korean, Simplified and Traditional Chinese, Portuguese (Brazil), Spanish (Latin America and Spain), French, and Italian (Italian is retired after 31 December 2026) |
| Recommended experience | At least one year of hands-on experience designing solutions on AWS. With no IT background, AWS suggests the Cloud Practitioner exam first |
| ID | A primary government-issued ID (outside your country of residence: your passport) whose name matches your account, plus a secondary ID. Check the exact rules for online and test centre delivery when you book |
| Reschedule or cancel | Up to 24 hours before the appointment (at most twice per appointment). Later than that, or a missed appointment, and the fee is lost |
| Payment | Credit card or voucher |
#Online or at a test centre
Both deliver the same exam, the same questions and the same result. The difference is the room.
Online proctoring (Pearson VUE’s online delivery) runs on your own computer, watched through your camera and microphone:
- Run Pearson VUE’s system test on the same computer and network days before. A company laptop with a strict VPN or firewall often fails it.
- Check in up to 30 minutes early: photos of your ID, your face and the room. Arriving more than 15 minutes late means you cannot launch, and the fee is forfeited.
- The desk must be clear, the phone out of reach, nobody else in the room. You may not speak, read aloud or leave the camera’s view.
- No breaks are allowed during an online exam. Plan the water and the washroom before you start.
A test centre removes the home risks (noise, family, power cuts, broadband drops) at the cost of travel. Bags and phones go into a locker; the centre gives you the noteboard.
#The ESL accommodation: 30 extra minutes
If English is not your first language, you can request the ESL +30 minutes accommodation (English as a Second Language) for exams taken in English. For most Bangladeshi candidates this is the single most valuable step in the whole booking: 130 minutes becomes 160, about 2.5 minutes per question instead of 2.
- Request it in your AWS Certification account (Request Exam Accommodations, then the ESL +30 type). Once approved, it applies to your future exams with every delivery provider.
- It must be approved before you schedule the exam. An exam you already booked does not gain the time; you would have to cancel or reschedule it (at least 24 hours before) and book again.
- There is no test of your English and no extra fee.
Exam day, from booking to result
You book through your AWS Certification account; Pearson VUE delivers the exam, online or at a test centre; the result comes back to your account. Follow the normal path, then the ways it goes wrong.
Scenario
A Mirpur developer takes the exam at home, in English, with the ESL accommodation approved first.
English is not her first language, so before booking anything she requests the “ESL +30 minutes” accommodation in her AWS Certification account. Once approved, it applies to her future bookings.
#Questions and scoring
The exam guide defines two question types:
- Multiple choice: one correct answer and three incorrect ones (distractors).
- Multiple response: two or more correct answers out of five or more options. The question tells you how many to choose (“Choose two.”). The guide does not promise partial credit, so treat each one as all or nothing.
The distractors are written to be plausible: they are what someone with incomplete knowledge would choose. That is why reading and elimination matter as much as memory.
How the score works:
- Of the 65 questions, 50 are scored. 15 are unscored: AWS is testing them for future exams. They are not identified, so you cannot skip them, and a strange question may be one of them.
- Unanswered questions are scored as incorrect, and there is no penalty for guessing. Never leave a question blank.
- The result is a scaled score from 100 to 1,000. The minimum to pass is 720. Scaling evens out exam forms of slightly different difficulty, so there is no fixed “72% of the questions”; AWS does not publish the conversion.
- The exam uses a compensatory scoring model: you need to pass the overall exam, not each section. A strong domain can make up for a weak one.
- The score report gives pass or fail, the scaled score, and a table that classifies your performance in each section (“Meets competencies” or “Needs improvement”). It never shows which questions you got wrong.
- Results appear in your AWS Certification account within five business days (unless held for a security review). At the end of the exam the screen does not show a score.
How the exam is scored
65 cells are the questions. Watch the 15 unscored ones appear only after the exam, then the scaled score and the domain bands of the score report.
Scenario
Every question looks the same during the exam. Only 50 of them decide the score.
The exam has 65 questions: multiple choice (one right answer out of four) and multiple response (two or more right answers out of five or more).
#Retakes, validity and renewal
- If you fail, you must wait 14 calendar days before you can retake. There is no limit on attempts, and every attempt costs the full fee.
- The certification is valid for three years. You renew it by passing the latest version of the exam again, or by earning the Solutions Architect – Professional certification, which also renews the Associate.
- A pass gives you a digital badge and the 50% voucher for your next AWS exam.
#The four domains
The exam guide splits the scored questions into four content domains. The weights tell you where the points are: security alone is almost a third of the exam.
| Domain | Weight | Task statements | Where this course teaches it |
|---|---|---|---|
| 1. Design Secure Architectures | 30% | 1.1 secure access to AWS resources · 1.2 secure workloads and applications · 1.3 data security controls | Ch02 IAM, 3.5 security groups and NACLs, 4.2–4.3 roles and IMDS, 10.2 and 10.8–10.9 S3 security, 11.2 OAC and VPC origins, Ch20 advanced identity, Ch21 encryption and security services, 22.2 endpoints, 22.7 Network Firewall |
| 2. Design Resilient Architectures | 26% | 2.1 scalable and loosely coupled architectures · 2.2 highly available and/or fault-tolerant architectures | 1.2 AZs, Ch06 load balancing and Auto Scaling, 7.1–7.3 Multi-AZ and Aurora, 8.3–8.4 failover, Ch09, Ch13 decoupling, Ch15 serverless, Ch23 DR, Ch24 |
| 3. Design High-Performing Architectures | 24% | 3.1 storage · 3.2 elastic compute · 3.3 databases · 3.4 network architectures · 3.5 data ingestion and transformation | Ch04–05 EC2 and its storage, 7.5 ElastiCache, 10.6 S3 performance, Ch11 CloudFront and Global Accelerator, Ch12 FSx, Ch14 containers, Ch16 databases, Ch17 analytics, Ch18 ML services, 24.2 and 24.4 |
| 4. Design Cost-Optimized Architectures | 20% | 4.1 storage · 4.2 compute · 4.3 databases · 4.4 network architectures | 1.4 billing, 4.4 purchasing options, 5.2 volume types, 10.5 storage classes, 13–15 serverless pricing, 22.8 networking costs, 23.5 data transfer, 25.4 cost tools |
Chapter 19 (monitoring and audit) and chapter 25 (other services) appear in all four domains: you cannot secure, recover or optimise what you cannot see.
#Services that are retired, renamed or out of scope
The exam guide ends with lists of in-scope and out-of-scope services. Read the in-scope list once before the exam: anything there can appear. Questions are also not rewritten every time a product changes, so you will meet services that are retired or closed to new customers. Answer by what the question describes, not by today’s product catalogue:
- Snowmobile (retired in 2024) and Snowcone (discontinued): still the answer in an older question about exabytes or a tiny edge device (lesson 10.11). Snowball Edge is available only to existing customers since November 2025 but is still the answer for “petabytes offline”.
- Amazon Pinpoint stopped taking new customers in 2025 and its engagement features reached end of support on 30 October 2026; an exam question about targeted multi-channel campaigns may still name it (lesson 25.2).
- QLDB (ledger database) was retired in 2025 (lesson 16.1); Server Migration Service means MGN today (lesson 23.4); CloudWatch Events is EventBridge (lesson 19.5); Kinesis Data Firehose is Amazon Data Firehose; SageMaker is SageMaker AI.
- Older questions quote older numbers: 256 KB for an SQS message (now 1 MiB), five read replicas for RDS (now up to 15 for several engines). The answer pattern is the same; only the number changed.
#Studying in the last weeks
The slides’ advice holds: practise hands-on, skim a few whitepapers and FAQs, join a community. Here it is as a plan.
#Practise hands-on, safely
Build small versions of the patterns: a VPC with public and private subnets, an ALB with an Auto Scaling group, an S3 bucket behind CloudFront with OAC, an SQS queue feeding a Lambda function. Ten minutes in the console teaches more than an hour of reading about a setting. Set a budget alert first, use the free tier, and delete everything afterwards (lesson 1.4).
#Whitepapers and FAQs
- The AWS Well-Architected Framework (lesson 26.1) is the whitepaper the exam is built on.
- Disaster Recovery of Workloads on AWS (lesson 23.1) is the source of the four DR strategies.
- The slides’ “Architecting for the Cloud: AWS Best Practices” is an older paper; its ideas now live in the Well-Architected Framework.
- Service FAQs (for example the VPC, S3, EC2 and RDS FAQs) answer many exam-style questions directly. Read them for the services in your weakest domain.
#Official practice from AWS
On AWS Skill Builder: the AWS Certification Official Practice Question Set (exam-style questions with explanations, free) and the Official Practice Exam (full length and timed; check on Skill Builder whether your plan includes it). Take the practice exam once, under real conditions, about a week before the exam, and spend more time on its explanations than on the score.
#Community
Study with others: discuss questions, explain answers to each other, read AWS blogs and watch re:Invent sessions on the services you find hardest. AWS community meetups in Dhaka are a good place to meet people who have already passed.
#A four-week revision plan
| Week | Focus | Chapters | Daily routine |
|---|---|---|---|
| 1 | Secure (30%) | 2, 3.5, 10.2, 10.8–10.9, 20, 21 | Re-read summaries, redo self-checks, read every explanation, also for answers you got right |
| 2 | Resilient (26%) | 6, 7.1–7.3, 8.3–8.4, 9, 13, 15, 23, 24 | Same, plus draw each DR strategy and each decoupling pattern from memory |
| 3 | High-performing and cost (44%) | 4, 5, 10.5–10.6, 11, 12, 14, 16, 17, 22, 25.4 | Same, plus the cheat sheet below: cover the Pick column and say the answer |
| 4 | Mixed, timed | Everything | One timed set of 65 in 130 (or 160) minutes, then a day on its mistakes; the drill below; light review the day before, then sleep |
#Reading a scenario
Most questions are scenarios: two to six sentences about a company, followed by a question. Read them in a fixed order.
#Find the real question first
- Read the last sentence first. It is the actual question: what is being asked for (a storage class, a migration tool, a way to restrict access) and under which goal (“most cost-effective”, “least operational overhead”, “highest availability”).
- Then read the scenario for the facts that limit the answer: the data size, the access pattern, the latency, what may not change, what already exists.
- Underline the constraint words (next section). These are the words that make one of two working designs better than the other.
- Ignore decoration. The company’s industry, its name and its history rarely matter. A bank in the question does not mean CloudHSM; a hospital does not mean anything until the question says “PHI” or “sensitive data”.
#Constraint words and what they push towards
The exam prints the strongest of these words in capitals (MOST, LEAST). They decide between two answers that would both work.
| The question says… | It pushes towards |
|---|---|
| most cost-effective, lowest cost | The cheapest option that still meets every stated requirement (not the cheapest overall) |
| least operational overhead, least effort, fully managed | Managed and serverless services; built-in features over scripts |
| with minimal changes to the application, without code changes | Lift-and-shift answers: read replicas, sticky sessions, DAX, RDS Proxy, rehost |
| highly available | Multi-AZ, a short interruption is acceptable |
| fault tolerant, no downtime, no performance impact | Enough capacity survives the failure (more instances per AZ, active/active) |
| near real time | Data Firehose, buffering of seconds to minutes is fine |
| real time | Kinesis Data Streams, Lambda consumers, milliseconds |
| serverless, without managing servers | Lambda, Fargate, DynamoDB, Athena, Aurora Serverless, S3 |
| encrypt in transit / at rest | TLS (ACM) / server-side encryption with KMS |
| temporary credentials | IAM roles and STS, never access keys |
| across accounts | Resource-based policies, roles to assume, RAM, Organizations |
| on-premises | VPN, Direct Connect, Storage Gateway, DataSync, Outposts, interface endpoints |
| petabytes, limited bandwidth, weeks | Snowball Edge |
| in the shortest time | The fastest path, even if it costs more |
| millisecond / microsecond | DynamoDB, ElastiCache / DAX, ElastiCache |
| durable | S3, EBS, DynamoDB (not instance store, not a cache) |
| ordered, exactly once | SQS FIFO (and Step Functions Standard for workflows) |
| decouple | SQS (or SNS + SQS) |
| static IP | NLB with Elastic IPs, Global Accelerator |
| global users | CloudFront (cacheable content), Global Accelerator (TCP/UDP, static IPs) |
#One scenario, four answers
The same data can lead to four different answers when only the constraint words change. A tea exporter in Sylhet keeps 2 TB of sales reports in S3:
| The question adds… | Answer | Why |
|---|---|---|
| Opened daily for 30 days, then rarely; most cost-effective; millisecond access | Lifecycle rule to S3 Standard-IA after 30 days | Known pattern: a free rule moves objects at the right time |
| Unknown, changing access; least operational overhead | S3 Intelligent-Tiering | Watches each object and moves it, no retrieval fees |
| Occasional ad hoc SQL on the reports, no infrastructure | Athena | Serverless SQL on files in S3, pay per data scanned |
| Complex BI dashboards all day on petabytes | Redshift | A data warehouse for heavy, repeated queries |
Keywords light up the answer
Each scenario sentence hides a few deciding words. Watch each keyword travel to the one service it names, and watch the look-alike that fails.
Scenario
“Decouple the order service from billing; store carts with single-digit-millisecond reads at millions of requests per second; give global gamers a static IP.”
Read the sentence once for its story, then again only for the words that limit the design. Three short phrases carry the whole answer.
#Proceed by elimination
The slides’ advice is the core of the method: rule out what you know is wrong, then choose the option that makes the most sense from what is left. There are very few trick questions, so do not over-think it.
#What makes an option certainly wrong
- Wrong category of service. EBS for shared files across AZs, SNS to store messages, CloudFront for UDP, Athena for transactions.
- It violates a stated constraint. Deep Archive when “within minutes” is required; a single AZ when “survive an AZ failure” is required; a NAT gateway when the question says “most cost-effective” and a gateway endpoint exists.
- It is technically impossible. A deny rule in a security group, a CNAME at the zone apex, a Route 53 health check reaching a private IP directly, attaching an EBS volume in another AZ, enabling encryption on an existing unencrypted EBS volume or RDS instance in place.
- A custom script on EC2 when a managed feature exists. A cron job that copies objects instead of S3 replication, a script that snapshots volumes instead of DLM or AWS Backup, an SFTP daemon on EC2 instead of Transfer Family.
- It is feasible but highly complicated. If an answer needs four services glued with code to do what one service does natively, it is probably wrong.
- It uses the root account or long-term access keys for anything routine. Always wrong.
After this, usually two options remain. Re-read the constraint word and pick the one that honours it.
#Multiple-response questions
Judge each of the five options on its own, as a true or false statement about the scenario. Do not look for two that “fit together”: each right option is right by itself. If three look right, one of them violates a constraint you skipped; if only one looks right, the second is probably the less obvious managed feature.
Proceed by elimination
Cross out the certainly-wrong answers with a reason, then let the constraint word choose between the two that are left. Change one word and watch the other card win.
Scenario
The access pattern is known: busy for 30 days, rare after. The question asks for the most cost-effective storage.
A Sylhet tea exporter keeps 2 TB of sales reports in S3. Reports are opened every day for 30 days, then a few times a year, and must open within milliseconds when someone asks.
Constraint word: most cost-effective
Read the last sentence first: it asks for the most cost-effective storage. Then underline the facts that limit the answer: a known pattern (30 days busy, then rare) and millisecond access.
#Top confusion pairs
Most lost points come from the same pairs of look-alikes. Learn the one-line decider for each.
| Pair | The decider | Lessons |
|---|---|---|
| Trusted Advisor vs Well-Architected Tool | Trusted Advisor scans your account automatically; the Well-Architected Tool is a questionnaire you answer about one workload | 26.1 |
| CloudTrail vs Config vs CloudWatch | Who called which API / what the configuration was and is it compliant / metrics, logs and alarms | 19.6, 19.7 |
| SQS vs SNS vs Kinesis Data Streams | Queue, one consumer per message / push to many, keeps nothing / stream, many readers, replay | 13.7 |
| Data Streams vs Data Firehose | Real time, custom consumers, replay / near real time delivery to S3, Redshift, OpenSearch, no code | 13.6 |
| Global Accelerator vs CloudFront | TCP/UDP, static IPs, instant failover / caching HTTP(S) content at the edge | 11.4 |
| ALB vs NLB | HTTP routing by path, host, header / TCP/UDP, extreme scale, static IPs | 6.3 |
| Multi-AZ vs read replicas | Synchronous standby for failover / asynchronous copies for reads | 7.1 |
| Aurora Global Database vs cross-Region read replica | Aurora, RPO about 1 s, RTO under a minute / plain RDS cross-Region DR | 7.3 |
| DAX vs ElastiCache | DynamoDB with no code change / any database, your code manages the cache | 15.5 |
| Secrets Manager vs Parameter Store | Automatic rotation, cross-Region secrets / cheap or free config and secure strings, no rotation | 21.3 |
| KMS vs CloudHSM | Multi-tenant, integrated with services / single-tenant HSM, exclusive key control, PKCS#11 | 21.5 |
| Gateway vs interface endpoint | S3 or DynamoDB from inside the VPC, free / any service, or reached from on-premises or another VPC, paid | 22.2 |
| VPC peering vs Transit Gateway | Two VPCs, cheapest / many VPCs, transitive hub-and-spoke | 22.1, 22.6 |
| Site-to-Site VPN vs Direct Connect | Quick, encrypted, over the internet / dedicated, consistent, weeks to set up, not encrypted by itself | 22.4, 22.5 |
| Storage Gateway types | File (NFS/SMB to S3) / Volume stored or cached (iSCSI) / Tape (replace tapes, keep backup software) | 12.3 |
| DataSync vs Transfer Family vs Snowball | Scheduled online copy of your storage / SFTP endpoint for partners / offline, petabytes | 12.4, 23.5 |
| EFS vs FSx for Windows vs FSx for Lustre | Linux NFS across AZs / Windows SMB with AD / HPC parallel file system on S3 data | 12.2 |
| WAF vs Shield Advanced | Layer 7 rules: SQL injection, XSS, rate limits / DDoS response team and cost protection | 21.6 |
| GuardDuty vs Inspector vs Macie | Threats, unusual activity / software vulnerabilities, CVEs / sensitive data in S3 | 21.7 |
| SCP vs permissions boundary | Guard rail for whole accounts in an organization / limit on one user or role | 20.1, 20.2 |
| Identity Center vs Cognito | Your workforce signing in to many accounts / your app’s customers | 20.3, 15.7 |
| Elastic Disaster Recovery vs MGN | Keep replicating for recovery / move once for good | 23.2, 23.4 |
| Budgets vs Cost Explorer vs Anomaly Detection | Alert on a threshold you set / analyse and forecast, no alerts / machine-learning alert on unusual spend | 1.4, 25.4 |
#Managing the clock
130 minutes for 65 questions is 2 minutes per question (2.5 with ESL). That is enough for a careful read of every question, but not for re-reading one question for ten minutes.
#The three-pass method
- Pass 1, answer everything once (to about two thirds of the time). Answer what you are sure of in about a minute. If a question is not settled after about 3 minutes, choose the best option, flag it and move on. A flagged question already has an answer, so nothing is ever blank.
- Pass 2, the flagged questions. With fresh eyes, and with facts that later questions reminded you of. Most flags get settled here.
- Pass 3, a last check (the final 5–10 minutes). The review screen shows unanswered and flagged questions. Make sure none is blank. Change an answer only for a concrete reason, such as a constraint word you now see you missed, never from a vague feeling.
Keep 10–15 minutes for passes 2 and 3 at the very least. Stop re-reading a question when the fourth read shows nothing new: the fact you are missing is not in the question.
Pacing 65 questions in 130 minutes
The bar is the clock, the grid is the 65 questions. Compare a planned three-pass exam with a candidate who gets stuck, then see the ESL time budget.
Scenario
130 minutes for 65 questions. Pass 1 answers everything once, pass 2 revisits the flagged ones, pass 3 checks nothing is blank.
The clock starts: 130 minutes for 65 questions is exactly 2 minutes each. The plan is to finish a first pass by about minute 85, which leaves 45 minutes for the hard ones.
#On the day
- Sleep. A rested mind reads constraint words; a tired one skips them.
- Eat before, and (online) visit the washroom before check-in: there are no breaks.
- Online: start check-in 30 minutes early with your ID, an empty desk and the phone out of reach. Centre: arrive 30 minutes early with both IDs.
- Use the whiteboard or noteboard for numbers (transfer times, IP counts, costs) rather than doing them in your head.
- When a question looks unfamiliar, remember that it may be one of the 15 unscored ones. Answer it, flag it, and do not let it shake the next ten.
#What goes wrong
| Symptom | Cause | Fix |
|---|---|---|
| Cannot launch the online exam | More than 15 minutes late, or the system test fails on the day | Run the system test days before on the same computer and network; check in 30 minutes early |
| Exam revoked midway | Someone entered the room, you spoke, or you left the camera’s view | Choose a test centre if home cannot be private for three hours |
| No extra 30 minutes on exam day | ESL was requested after scheduling | Request ESL before scheduling; otherwise reschedule at least 24 hours ahead |
| Turned away at the centre | Name on the ID does not match the account, or no secondary ID | Fix the account name before booking; bring two IDs |
| Ran out of time with questions blank | Too long on a few questions; no pacing plan | 3-minute rule, flag and move; first pass by two thirds of the time |
| Picked a working but wrong answer | Missed “most cost-effective” or “least operational overhead” | Read the last sentence first; underline constraint words |
| Chose a look-alike | Trusted Advisor for the Well-Architected Tool, CloudFront for Global Accelerator, Config for CloudTrail | Learn the confusion pairs and their deciders |
| Picked the clever custom solution | A script on EC2 instead of a managed feature | “Feasible but complicated” is probably wrong |
| Changed right answers to wrong ones in review | Second-guessing without a reason | Change only for a concrete, newly seen reason |
| Failed by a few points | One or two weak domains | Use the score report’s bands; study those chapters for 14 days; retake |
#How it is used beyond the exam
The habits this lesson trains are the habits of design reviews at work. A product manager says “the reports must be cheap to keep but open instantly when an auditor asks”: that is a constraint word, and it decides the storage class. A bank’s head of technology says “we cannot change the application this quarter”: that rules out the refactor and points to read replicas or RDS Proxy. Eliminating the impossible and choosing between the last two on the stated goal is how architects argue for a design, and the Well-Architected pillars of lesson 26.1 are the vocabulary of that argument: security, reliability, performance, cost, operations, sustainability.
The cheat sheet below works the same way in a real meeting: when someone says “decouple”, “replay” or “static IP”, you should already hear the service.
#The keyword cheat sheet
One table per chapter. Each row is a phrase you will meet in questions, the service or feature it points to, and the lesson that explains why. The rows come from the exam patterns in the lessons and from the owner’s “Exam Trick” notes. Cover the middle column and test yourself; when a row surprises you, open its lesson.
#Ch01: Cloud foundations
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Servers bought for peak and idle the rest of the year | Elasticity: pay for what you use | 1.1 |
| Who patches the OS of an EC2 instance? | The customer | 1.1 |
| Who patches the OS of RDS, or guards the data centre? | AWS | 1.1 |
| Data must stay in one country | A Region in that country | 1.2 |
| Survive a data centre failure | Multi-AZ | 1.2 |
| Single-digit ms in a city with no Region | Local Zones | 1.2 |
| Ultra-low latency for 5G mobile devices | Wavelength | 1.2 |
| AWS CLI in the browser, nothing to install | CloudShell | 1.3 |
| Alert before spend crosses a limit | AWS Budgets | 1.4 |
| IAM admin cannot see the bill | Root enables IAM access to Billing + a billing policy | 1.4 |
#Ch02: IAM essentials
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| One group allows, another explicitly denies | Denied: explicit deny wins | 2.2 |
| New user with no policies | Can do nothing (implicit deny) | 2.2 |
| Several answers work; grant the least | Specific actions on specific resources | 2.1 |
| Use root for daily administration | Always wrong | 2.3 |
| Application on EC2 needs AWS access | IAM role (instance profile) | 2.4 |
| Role has admin rights but cannot be assumed | The trust policy | 2.4 |
| Access keys pushed to GitHub | Rotate them; move the workload to a role | 1.3 |
| Which permissions were never used | Access Advisor (last accessed) / Access Analyzer | 2.4 |
#Ch03: VPC fundamentals
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| VPN or peering cannot be set up | Overlapping CIDR ranges | 3.1 |
| Need more than 65,536 IPs in one VPC | Add a secondary CIDR block | 3.2 |
| Private instances need outbound internet | NAT gateway in a public subnet | 3.4 |
| Highly available NAT | One NAT gateway per AZ | 3.4 |
| NAT instance does not forward | Disable source/destination check | 3.4 |
| SG allows 80, page still fails | NACL outbound ephemeral ports | 3.5 |
| Only the web tier may reach the DB | DB SG allows the web tier’s SG | 3.5 |
| Block one IP address | NACL deny rule (SGs cannot deny) | 3.5 |
| Public IP must survive stop/start | Elastic IP | 3.6 |
#Ch04: EC2
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Full control of the OS, long-running process | EC2 (not Lambda) | 4.1 |
| In-memory analytics / CPU-heavy / big local disks | R or X / C / I or D families | 4.1 |
| T instance slow every afternoon | CPU credits ran out: unlimited mode or M/C | 4.1 |
| Without opening port 22, no bastion | Session Manager | 4.2 |
| Protect role credentials against SSRF | Require IMDSv2 | 4.3 |
| Steady 24/7 for years | Reserved Instances or Savings Plan | 4.4 |
| Commitment across families, Fargate, Lambda | Compute Savings Plan | 4.4 |
| Interruptible batch at lowest cost | Spot Instances | 4.4 |
| Per-socket licence, BYOL | Dedicated Hosts | 4.4 |
| Lowest latency between nodes | Cluster placement group | 4.5 |
| Keep RAM across a stop, fast resume | Hibernate (encrypted root volume) | 4.5 |
#Ch05: EC2 storage
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Move an EBS volume to another AZ | Snapshot, then a new volume there | 5.1 |
| Full performance right after a restore | Fast Snapshot Restore | 5.1 |
| Recover snapshots deleted by mistake | Recycle Bin rule | 5.1 |
| Automate EBS snapshot schedules | Data Lifecycle Manager | 5.1 |
| Big data, logs, cheap throughput | st1 | 5.2 |
| One volume, several instances, same AZ | io1/io2 Multi-Attach | 5.2 |
| Encrypt an existing unencrypted volume | Snapshot, encrypted copy, new volume | 5.2 |
| Highest IOPS, temporary data | Instance store | 5.3 |
| Shared Linux files across AZs | Amazon EFS | 5.4 |
| Files rarely read after weeks | EFS lifecycle to Infrequent Access | 5.4 |
#Ch06: High availability and scalability
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Stateless web tier must scale | Auto Scaling group behind a load balancer | 6.1 |
| Instance healthy in EC2, unhealthy in target group | App down or SG blocks the health check | 6.2 |
| Path- or host-based routing, microservices | ALB | 6.3 |
| UDP, millions of requests per second, static IP | NLB | 6.3 |
| Third-party firewall appliances inline | Gateway Load Balancer | 6.3 |
| Cart lost, legacy app, no code change | Sticky sessions | 6.4 |
| Uneven CPU across AZs | Cross-zone load balancing | 6.4 |
| Many TLS certificates on one ALB | SNI | 6.4 |
| Requests dropped during scale-in | Increase the deregistration delay | 6.4 |
| LB says unhealthy, ASG does not replace | Enable ELB health checks on the ASG | 6.5 |
| Replace a failed single server automatically | ASG min 1 / max 1 / desired 1, two AZs | 6.5 |
#Ch07: RDS, Aurora and ElastiCache
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Automatic failover, survive an AZ | RDS Multi-AZ | 7.1 |
| Reporting slows production, offload reads | Read replicas | 7.1 |
| Table deleted an hour ago | Point-in-time restore (new instance) | 7.2 |
| Major upgrade, minimal downtime | Blue/Green Deployment | 7.2 |
| OS access to Oracle or SQL Server | RDS Custom | 7.2 |
| Cross-Region DR, RPO 1 s, RTO under a minute | Aurora Global Database | 7.3 |
| Spiky or idle relational workload | Aurora Serverless v2 | 7.3 |
| Test copy of production, fast and cheap | Aurora cloning | 7.3 |
| Lambda exhausts DB connections | RDS Proxy | 7.4 |
| Encrypt an existing unencrypted database | Snapshot, encrypted copy, restore | 7.4 |
| Sub-millisecond reads, sessions, leaderboard | ElastiCache (Redis OSS / Valkey) | 7.5 |
#Ch08: Route 53
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Lower the risk of tomorrow’s migration | Lower the TTL well in advance | 8.1 |
| Zone apex to an ALB, CloudFront or S3 | Alias record | 8.2 |
| Send 10% to the new version | Weighted routing | 8.3 |
| Active-passive, standby site | Failover routing | 8.3 |
| Users must be served in their country | Geolocation routing | 8.3 |
| Fastest Region for each user | Latency routing | 8.3 |
| Fail over a private resource | CloudWatch alarm + health check on the alarm | 8.4 |
| Domain at another registrar | Hosted zone + update NS at the registrar | 8.5 |
| On-premises must resolve private zones | Resolver inbound endpoint | 8.5 |
#Ch09: Classic architectures
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Thousands of instances without losing data | Stateless tier, state in shared stores | 9.1 |
| Sessions must survive instance termination | Sessions in ElastiCache or DynamoDB | 9.2 |
| Uploaded files visible on every instance | Amazon EFS | 9.3 |
| Instances slow to start because of installs | Golden AMI | 9.3 |
| Upload code, keep OS access, no infra work | Elastic Beanstalk | 9.4 |
| Long tasks off the Beanstalk web tier | Worker environment + SQS | 9.4 |
| Zero downtime, quickest rollback | Immutable or blue/green | 9.4 |
| Database deleted with the environment | Create RDS outside the environment | 9.4 |
#Ch10: Amazon S3
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| No bucket may ever be public | Account-level Block Public Access | 10.2 |
| Browser blocks assets from another bucket | CORS on the assets bucket | 10.3 |
| Protect against accidental deletion | Versioning (+ MFA Delete) | 10.4 |
| Copy objects to another Region | Cross-Region Replication | 10.4 |
| Unknown or changing access pattern | S3 Intelligent-Tiering | 10.5 |
| Cheapest archive, 12–48 hours is fine | Glacier Deep Archive | 10.5 |
| Thousands of GETs per second throttled | Spread over more prefixes | 10.6 |
| Global users upload to one bucket | S3 Transfer Acceleration | 10.6 |
| Act on billions of existing objects | S3 Batch Operations | 10.7 |
| Audit who used the encryption key | SSE-KMS | 10.8 |
| WORM, even root cannot delete | Object Lock, compliance mode | 10.9 |
| Temporary download or upload link | Pre-signed URL | 10.9 |
#Ch11: CloudFront and Global Accelerator
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Cache static content for global users | CloudFront | 11.1 |
| Private bucket served only via CloudFront | Origin access control (OAC) | 11.1 |
| ALB reachable only through CloudFront | VPC origins, or prefix list + secret header | 11.2 |
| Users still get the old file | Invalidation, or versioned file names | 11.2 |
| Block countries | Geo restriction | 11.2 |
| Header rewrite, sub-ms, cheapest | CloudFront Functions | 11.3 |
| Network calls or heavy logic at the edge | Lambda@Edge | 11.3 |
| TCP/UDP, two static IPs, instant failover | Global Accelerator | 11.4 |
#Ch12: Hybrid storage and data transfer
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Lots of data, little bandwidth, offline | Snowball Edge | 12.1 |
| Snowball straight into Glacier | Import to S3, then a lifecycle rule | 12.1 |
| Windows, SMB, Active Directory | FSx for Windows File Server | 12.2 |
| HPC or ML on data in S3 | FSx for Lustre | 12.2 |
| NFS + SMB, deduplication, NetApp | FSx for NetApp ONTAP | 12.2 |
| On-premises NFS/SMB backed by S3 | S3 File Gateway | 12.3 |
| Replace tapes, keep backup software | Tape Gateway | 12.3 |
| SFTP for partners, no servers | Transfer Family | 12.4 |
| Scheduled online copy from NFS/SMB | DataSync | 12.4 |
#Ch13: Decoupling
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Decouple, buffer spikes, async | Amazon SQS | 13.1 |
| Messages processed twice | Raise the visibility timeout | 13.2 |
| Fewer empty responses, lower cost | Long polling | 13.2 |
| Poison-pill messages | Dead-letter queue | 13.2 |
| Order matters, no duplicates | SQS FIFO | 13.3 |
| One event, several independent consumers | SNS + SQS fan-out | 13.4 |
| Subscriber wants only some messages | SNS filter policy | 13.4 |
| Real time, replay, many consumers | Kinesis Data Streams | 13.5 |
| Load a stream into S3 or Redshift, no code | Amazon Data Firehose | 13.6 |
| Legacy app on JMS, AMQP, MQTT | Amazon MQ | 13.7 |
#Ch14: Containers
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Private tasks must pull from ECR | ECR interface endpoints + S3 gateway endpoint | 14.1 |
| Containers without managing servers | Fargate | 14.2 |
| The container reads S3 | Task role | 14.2 |
| Cannot pull the image or send logs | Task execution role | 14.2 |
| Tasks share files across AZs | Amazon EFS | 14.2 |
| Cluster must add EC2 for new tasks | Capacity provider with managed scaling | 14.3 |
| A container per uploaded file | EventBridge rule → ECS task | 14.3 |
| Kubernetes, Helm, avoid lock-in | Amazon EKS | 14.4 |
| Simplest, deepest AWS integration | Amazon ECS | 14.4 |
#Ch15: Serverless
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Failed async invocations with error details | On-failure destination | 15.1 |
| Job runs longer than 15 minutes | Not Lambda: Step Functions, ECS, Batch | 15.2 |
| A critical function must always run | Reserved concurrency | 15.2 |
| No cold starts at a known peak | Provisioned concurrency | 15.2 |
| Key-value, single-digit ms, any scale | DynamoDB | 15.4 |
| Search by another attribute, cheaply | Global secondary index (never Scan) | 15.5 |
| Active-active multi-Region NoSQL | DynamoDB global tables | 15.5 |
| Delete old items automatically | DynamoDB TTL | 15.5 |
| Usage plans, API keys, caching | API Gateway REST API | 15.6 |
| Workflow with waits and human approval | Step Functions Standard | 15.7 |
| Sign-up and sign-in for app users | Cognito user pool | 15.7 |
#Ch16: Choosing databases
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Relational, joins, transactions | RDS or Aurora | 16.1 |
| Durable in-memory primary database | MemoryDB | 16.1 |
| Data warehouse, OLAP, BI | Redshift | 16.1 |
| MongoDB compatible | DocumentDB | 16.2 |
| Graph, social network, fraud rings | Neptune | 16.2 |
| Apache Cassandra, CQL | Keyspaces | 16.2 |
| IoT metrics over time | Timestream | 16.2 |
#Ch17: Data and analytics
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Ad hoc SQL on files in S3, serverless | Athena | 17.1 |
| Make Athena cheaper and faster | Parquet/ORC, compression, partitions | 17.1 |
| Complex BI queries all day on petabytes | Redshift (Spectrum to read S3) | 17.2 |
| Log search, full text, dashboards | OpenSearch Service | 17.3 |
| Migrate Hadoop or Spark | EMR | 17.4 |
| EMR cost without risking HDFS | Core On-Demand, task nodes on Spot | 17.4 |
| Interactive BI dashboards | QuickSight | 17.5 |
| Serverless ETL, schema discovery | Glue (crawler + Data Catalog) | 17.6 |
| Row- and column-level access to a data lake | Lake Formation | 17.6 |
| SQL or Flink on a live stream | Managed Service for Apache Flink | 17.7 |
#Ch18: Machine learning
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Faces, labels, unsafe images or video | Rekognition | 18.1 |
| Speech to text, subtitles | Transcribe | 18.1 |
| Text to lifelike speech | Polly | 18.1 |
| Translate user content | Translate | 18.1 |
| Chatbot, voice or text bot | Lex | 18.1 |
| Cloud contact centre | Connect | 18.1 |
| Sentiment, entities, PII in text | Comprehend (Medical for clinical text) | 18.1 |
| Forms and tables from scanned documents | Textract | 18.2 |
| Build and train your own models | SageMaker AI | 18.2 |
| Generative AI with foundation models | Bedrock | 18.2 |
| Intelligent search across documents | Kendra | 18.2 |
#Ch19: Monitoring and audit
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Memory or disk usage of EC2 | Unified CloudWatch agent | 19.1 |
| Metrics to Datadog or Splunk | Metric Streams + Firehose | 19.1 |
| Alert on an error in the logs | Metric filter + alarm + SNS | 19.2 |
| Logs to S3 or OpenSearch in real time | Subscription filter | 19.2 |
| Recover EC2 on hardware failure | Alarm with the recover action | 19.3 |
| Test the user journey with no traffic | Synthetics canary | 19.3 |
| Top 10 IPs, hot keys | Contributor Insights | 19.4 |
| React to an event, run on a schedule | EventBridge | 19.5 |
| Who made this API call | CloudTrail | 19.6 |
| Configuration history, compliance | AWS Config | 19.7 |
#Ch20: Advanced identity
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Restrict member accounts, even admins | Service control policy | 20.1 |
| One bill, shared RI discounts | Organizations, consolidated billing | 20.1 |
| Share subnets or a transit gateway | Resource Access Manager | 20.1 |
| Only principals of our organization | aws:PrincipalOrgID condition | 20.2 |
| Only from the corporate IP range | aws:SourceIp condition | 20.2 |
| Developers create roles without escalating | Permissions boundary | 20.2 |
| Single sign-on to many accounts | IAM Identity Center | 20.3 |
| Landing zone with guard rails | Control Tower | 20.3 |
#Ch21: Encryption and security services
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Encrypt before data leaves the premises | Client-side encryption | 21.1 |
| Audit key use, own rotation, share keys | KMS customer managed key | 21.2 |
| Rotate database credentials automatically | Secrets Manager | 21.3 |
| Cheap or free configuration values | Parameter Store | 21.3 |
| Free TLS certificates that renew | ACM (in us-east-1 for CloudFront) | 21.4 |
| Single-tenant HSM, exclusive key control | CloudHSM | 21.5 |
| SQL injection, XSS, rate limiting | AWS WAF | 21.6 |
| DDoS response team, cost protection | Shield Advanced | 21.6 |
| WAF rules across all accounts | Firewall Manager | 21.6 |
| Threats, crypto-mining, odd API calls | GuardDuty | 21.7 |
| Vulnerabilities, CVEs | Inspector | 21.7 |
| PII in S3 buckets | Macie | 21.7 |
#Ch22: Advanced networking
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Two VPCs, cheapest private link | VPC peering | 22.1 |
| Private S3 or DynamoDB access, cheapest | Gateway endpoint | 22.2 |
| Expose a service privately to other VPCs | PrivateLink with an NLB | 22.2 |
| Which traffic was rejected | VPC Flow Logs | 22.3 |
| Quick, encrypted link to the office | Site-to-Site VPN | 22.4 |
| Branch offices talk through AWS | VPN CloudHub | 22.4 |
| Dedicated, consistent bandwidth | Direct Connect | 22.5 |
| Encrypt traffic on Direct Connect | VPN over DX, or MACsec | 22.5 |
| Hundreds of VPCs, transitive routing | Transit Gateway | 22.6 |
| IPv6 outbound only | Egress-only internet gateway | 22.7 |
| Filter by domain name, IPS for the VPC | Network Firewall | 22.7 |
| Cut data transfer costs | Private IPs, same AZ, gateway endpoints | 22.8 |
#Ch23: Disaster recovery and migration
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Cheapest, hours of downtime acceptable | Backup and restore | 23.1 |
| Core DB replicated, servers off | Pilot light | 23.1 |
| Scaled-down copy always running | Warm standby | 23.1 |
| Near-zero RPO and RTO, two Regions live | Multi-site active/active | 23.1 |
| Continuous block replication, recover in minutes | Elastic Disaster Recovery | 23.2 |
| Central backups across services and accounts | AWS Backup | 23.2 |
| Backups nobody can delete, even root | Backup Vault Lock, compliance mode | 23.2 |
| Migrate a database, source stays online | DMS with CDC | 23.3 |
| Oracle to PostgreSQL | SCT + DMS | 23.3 |
| Lift and shift servers | Application Migration Service (MGN) | 23.4 |
| Keep using VMware tools | VMware Cloud on AWS | 23.4 |
| Weeks over the network, petabytes | Snowball Edge | 23.5 |
#Ch24: More solution architectures
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| SQS-triggered function keeps failing | DLQ on the queue | 24.1 |
| Filter S3 events by size, replay them | S3 → EventBridge | 24.1 |
| React when a specific API call is made | CloudTrail + EventBridge rule | 24.1 |
| Repeated identical API requests | API Gateway caching | 24.2 |
| Cached data must never be stale | Write-through | 24.2 |
| Block malicious IPs at the edge | WAF on CloudFront | 24.3 |
| Tightly coupled HPC, MPI | EFA + cluster placement group | 24.4 |
| Thousands of batch jobs on Spot | AWS Batch | 24.4 |
| HA single instance, lowest cost | ASG 1/1/1 in two AZs + Elastic IP via user data | 24.5 |
#Ch25: Other services
| Keyword / phrase in the question | Pick | Lesson |
|---|---|---|
| Infrastructure as code, repeatable, drift | CloudFormation | 25.1 |
| Developers may not create EC2 directly | CloudFormation service role | 25.1 |
| Transactional or bulk email | Amazon SES | 25.2 |
| Targeted multi-channel campaigns | Pinpoint (in older questions) | 25.2 |
| Run a script on 100 instances, no SSH | Run Command | 25.3 |
| Automate OS patching | Patch Manager | 25.3 |
| Disruptive work only at weekends | Maintenance Windows | 25.3 |
| Visualise and forecast spend | Cost Explorer | 25.4 |
| Unexpected cost spike, ML | Cost Anomaly Detection | 25.4 |
| Stop dev servers outside office hours | Instance Scheduler | 25.5 |
| Salesforce or Zendesk data to S3, no code | AppFlow | 25.5 |
| Front-end developers need a backend fast | Amplify | 25.5 |
Now practise it with scenarios instead of rows:
Keyword → service drill
Twenty short scenarios from every domain. Tap the keywords you think decide the answer, pick a service, then press Check.
An order service must keep accepting orders during Eid sale spikes while the slow invoice service catches up at its own pace.
1. Mark the deciding keywords
2. Pick the service
#Certification paths after SAA
AWS certifications come in four levels: Foundational (no experience needed), Associate (role-based, some cloud or IT experience), Professional (advanced, about two years of AWS experience recommended) and Specialty (one deep area). In 2026 AWS added a fifth, Business category for non-technical roles. The list as of November 2026:
| Level | Certifications |
|---|---|
| Business | AI Business Strategist (new, in beta) |
| Foundational | Cloud Practitioner, AI Practitioner |
| Associate | Solutions Architect, Developer, CloudOps Engineer (which replaced SysOps Administrator), Data Engineer, Machine Learning Engineer |
| Professional | Solutions Architect, DevOps Engineer, Generative AI Developer |
| Specialty | Security, Advanced Networking (retires after 31 December 2026) |
Where SAA usually leads:
- Solutions Architect – Professional: the natural next step; AWS marks the exam as being updated, and the new version (SAP-C03) is announced for 17 November 2026, so use preparation material written for that version. Passing it also renews your Associate.
- Security – Specialty: if chapters 20 and 21 were your favourites.
- Developer or CloudOps Engineer – Associate: the same services seen from building or running them, and a cheaper second Associate with your 50% voucher.
- AI Practitioner, Machine Learning Engineer or Generative AI Developer: if chapter 18 is where you want to grow.
AWS retired several Specialty exams in 2024 (Data Analytics, Database, SAP on AWS) and the Machine Learning Specialty in March 2026, and has announced Advanced Networking’s retirement for the end of 2026. A certification you already hold stays valid for its three years.
#The end of the course, and what comes next
You started with what the cloud is and how AWS charges for it, and you have now designed networks, secured accounts, chosen databases, built event-driven and serverless systems, planned disaster recovery and migrations, and learned to judge all of it by the six pillars. That is what the exam tests, and more importantly, it is what a solutions architect does every week.
Next steps, in order:
- Request ESL if it applies to you, then book the exam for three to four weeks from today. A date makes revision real.
- Follow the four-week plan above, with one timed practice set at the end.
- After you pass, build one real project end to end (a small shop, a booking system for a clinic, a data pipeline for a garment factory) and write down your design decisions with the pillar each one serves. That page is worth more in an interview than the badge.
- Keep going: a Professional or Specialty certification, or depth in the area of your work.
Thank you for staying to the last lesson. Good luck in the exam. You are ready to start practising for it.
#Try it yourself
This lesson’s practice is not commands but exam rehearsal:
- Request ESL in your AWS Certification account now, if English is not your first language, before you book anything.
- Take the Official Practice Question Set on AWS Skill Builder under exam conditions: a quiet room, a timer at 2 minutes per question (2.5 with ESL), the three-pass method, no notes. Afterwards, for every question (right or wrong) write one line on why each wrong option is wrong.
- Build a one-page personal keyword sheet: copy only the cheat-sheet rows you got wrong or hesitated on, in your own words. Re-read it daily in the last week.
- Redo the self-checks of the chapters in your weakest domain (from your practice score or your feeling). For each wrong answer, open the lesson and find the sentence that would have saved you.
- Run the drill above until you score at least 18 of 20 right first time, then reset and do it in a different order with the chips covered by your hand.
- Rehearse the online check-in if you will test from home: run Pearson VUE’s system test on the exam computer and network, clear the desk, and time a 130-minute sitting without leaving the chair.
- Do one timed full set (65 questions in 130 or 160 minutes) a week before the exam, then spend a day on its explanations rather than another set.
#Summary
Key takeaways
- SAA-C03 is still the live exam (checked November 2026): 65 questions, 130 minutes, 150 USD, at a Pearson VUE centre or online; book through the AWS Certification account with two IDs.
- ESL +30 minutes for non-native English speakers: request it before scheduling; 160 minutes is about 2.5 per question.
- 50 scored + 15 unscored (not identified), multiple choice and multiple response, blank = wrong with no penalty for guessing, scaled 100–1,000, pass at 720, compensatory (overall, not per domain), results and score report within five business days, retake after 14 days, valid three years.
- Domains: Secure 30%, Resilient 26%, High-performing 24%, Cost-optimized 20%.
- Read the last sentence first, underline the constraint words, ignore decoration. One changed word changes the answer.
- Eliminate wrong category, constraint violations, impossibilities, custom scripts and over-complicated designs; decide the last two on the constraint word. Judge each option of a choose-two on its own.
- Three passes: answer everything once by about two thirds of the time, flag after about 3 minutes, review flagged, never leave a blank.
- The keyword cheat sheet and the confusion pairs are the course in one page: when a row surprises you, go back to its lesson.
Answer on your own first, then read the explanation, even when you got it right.
Self-checkQuestion
How many of the 65 questions on SAA-C03 affect your score?
Self-checkQuestion
What does a candidate need to pass SAA-C03?
Self-checkQuestion
Time is almost up and three questions are still unanswered. What should the candidate do?
Self-checkQuestion
A candidate’s score report shows “Needs improvement” for Design Cost-Optimized Architectures, “Meets competencies” for the other three domains, and an overall scaled score of 752. What is the result?
Self-checkQuestion
A candidate fails the exam on 3 March. When is the earliest they can take it again?
Self-checkQuestion
A Dhaka developer booked SAA-C03 in English, then requested and received the ESL accommodation. What happens on exam day?
Self-checkQuestion
Which two statements about taking the exam online with Pearson VUE are true? (Choose two.)
Choose 2
Self-checkQuestion
What does the SAA-C03 score report contain?
Self-checkQuestion
An application on EC2 must read objects from an S3 bucket. What is the most secure way to give it access?
Self-checkQuestion
An order website loses orders during sales because the billing back end cannot keep up. The company wants the front end to keep accepting orders, with minimal changes. What should a solutions architect do?
Self-checkQuestion
A payroll database runs 24/7 at a constant size and will for at least three years. Which purchasing option is most cost-effective?
Self-checkQuestion
A DynamoDB product catalogue must serve reads in microseconds during flash sales, and the team cannot change application code. What should be added?
Self-checkQuestion
A company runs Aurora MySQL in Singapore and needs cross-Region disaster recovery with an RPO of about one second and an RTO under one minute. Which solution meets this?
Self-checkQuestion
An organization with 40 accounts must make sure that nobody, including account administrators, can create resources outside two approved Regions. What should be used?
Self-checkQuestion
EC2 instances in a private subnet upload large files to S3 through a NAT gateway, and the data processing charges are high. What is the most cost-effective change?
Self-checkQuestion
A multiplayer game uses UDP. Players around the world need lower latency, and their firewalls allow only two fixed IP addresses. Which service fits?
Self-checkQuestion
A bank’s application uses a database password that compliance requires to be rotated automatically every 30 days, without the team writing rotation code. Where should the password be stored?
Self-checkQuestion
A garments exporter needs its ERP running again within minutes after a Region failure, and can afford a smaller but fully working copy running all the time in a second Region. Which DR strategy is this?
Self-checkQuestion
A news portal stores millions of images. Nobody can predict which old image will be popular again, and the team wants storage costs to be optimised automatically. Which storage class should it use?
Self-checkQuestion
Analysts run occasional SQL queries on CSV logs in S3 with Athena, and the bills are growing. Which two changes reduce cost and improve speed? (Choose two.)
Choose 2
Self-checkQuestion
A hospital must find which of its 300 S3 buckets contain patient names and national ID numbers. Which service should it use?
Self-checkQuestion
During a cricket final, thousands of Lambda invocations each open a database connection and the RDS instance fails with too many connections. What should a solutions architect add?
Self-checkQuestion
A payment event must trigger an SMS service, a loyalty service and an accounting service independently, and no message may be lost if one service is down for an hour. Which design fits?
Self-checkQuestion
A television channel must move 600 TB of archive to S3 within a few weeks over a 200 Mbps line, and then keep sending a few GB of new files every day. Which two services should it use? (Choose two.)
Choose 2
Self-checkQuestion
An e-commerce site behind an Application Load Balancer is attacked with SQL injection and cross-site scripting. What should be deployed?
Self-checkQuestion
Windows application servers need a shared file system over SMB that enforces the company’s Active Directory permissions. Which service should be used?
Self-checkQuestion
Two answers would both copy objects to another Region: enabling S3 Cross-Region Replication, or a Lambda function on a schedule that lists the bucket and copies new objects. Why is the second one almost certainly wrong on the exam?
Self-checkQuestion
A scenario is six sentences long. Where should you look first?
Self-checkQuestion
A security team asks two questions about a deleted S3 bucket policy: who deleted it, and whether the bucket stayed compliant with the encryption rule over the past year. Which two services answer them? (Choose two.)
Choose 2
Self-checkQuestion
Which two statements about the Solutions Architect – Associate exam are true as of November 2026? (Choose two.)
Choose 2