SAA-C03 · Associate

AWS Certified Solutions Architect – Associate

Build the judgment to choose secure, resilient AWS architectures—and explain why they fit.

Start Free

Your free account includes a full SAA-C03 practice exam.

ExamNova practice

Your first session

Questions: 65
Time limit: 130 min
Coverage: 4 domains

Practise, review your answers and see where to focus next.

Preview a question

Is SAA-C03 your next step?

For people moving into solution design or strengthening an existing AWS architecture role. The work is choosing between plausible designs when availability, performance, security and cost pull in different directions.

Design around failure

Compare multi-AZ deployments, decoupled components and recovery strategies against a workload’s availability needs.

Set the security boundary

Reason through identity policies, network isolation, encryption and cross-account access.

Choose for the workload

Match compute, storage and database services to access patterns, scale and operating cost.

Official certification guide ↗

What you’ll study

Explore the domains and topics in your ExamNova study path.

Design Secure Architectures30% practice balance

Explore Design Secure Architectures

Design Secure Access to AWS Resources

IAM Identity Center and Workforce Access
Federation with SAML and OIDC
ABAC and Tag-Based Access
Access Analyzer and External Access Review
Organizations Guardrails and SCPs
Cross-Account Sharing with RAM and Roles
Least-Privilege IAM Policies and Roles
Session Manager Instance Access

Design Secure Workloads and Applications

WAF Web ACLs and Managed Rules
API Gateway Authorization and Throttling
Bot, Rate, and Geo Controls
Shield Advanced DDoS Protection
Firewall Manager Policy Governance
Network Firewall and VPC Inspection
Private Connectivity and Service Access
VPC Flow Logs and Threat Detection
Container and Serverless Runtime Security

Determine Appropriate Data Security Controls

AWS KMS and Client-Side Encryption
Database Encryption Options
Secrets Management and Secure Storage
TLS Certificates and Compliance Auditing
Data Immutability and Retention

Design Resilient Architectures26% practice balance

Explore Design Resilient Architectures

Design Scalable and Loosely Coupled Architectures

API Gateway APIs and Service Integrations
AppSync GraphQL and Real-Time Sync
EventBridge Routing and API Destinations
Step Functions Workflow Orchestration
SNS Fanout and Notification Patterns
Amazon MQ Protocol Compatibility
Hybrid Broker Migration and Legacy Messaging
SQS Queue Decoupling and Backpressure
FIFO Ordering and Idempotent Processing
Kinesis Streaming and Delivery Pipelines
Glue ETL and Data Catalog Pipelines

Design Highly Available and Fault-Tolerant Architectures

Disaster Recovery Strategies and Solutions
Route 53 Failover Routing and Health Checks
Route 53 Latency, Geolocation, and Geoproximity Routing
AWS Global Accelerator for Multi-Region Entry Points
Reliability Pillar Patterns for Multi-Region Architectures
AWS Elastic Disaster Recovery for Workloads
Multi-Account DR Infrastructure Automation
EC2 Auto Scaling for Resilient Capacity
Database High Availability and Global Solutions
Highly Available Shared File Systems with EFS
S3 Replication and Versioned Object Recovery
Hybrid Storage Gateway for Backup and DR
Chaos Engineering and Resilience Testing

Design High-Performing Architectures24% practice balance

Explore Design High-Performing Architectures

Determine High-Performing and Scalable Storage Solutions

Data Transfer and Block Storage Performance
Scalable Shared File Storage
FSx for Lustre and HPC Storage
S3 Intelligent Management and Global Access
Storage Caching for Low-Latency Reads

Design High-Performing and Elastic Compute Solutions

ECS Services and Fargate Operations
EKS Scaling and Stateful Kubernetes Workloads
ECR Regional and Edge Image Delivery
Container Image Startup and Registry Optimization
EC2 Instance Families and Accelerated Compute
Auto Scaling and Purchase Option Strategies
AWS Batch Job Scheduling and Compute Environments
Lambda Performance and Cold Start Tuning

Determine High-Performing Database Solutions

Aurora Serverless and Relational Sharding
Aurora and RDS Read Scaling
DynamoDB and DAX Performance
Query Caching and Read Offload
Redshift and Athena Analytics
Database Performance Monitoring
Neptune and Purpose-Built Databases

Determine High-Performing and Scalable Network Architectures

AWS Direct Connect and Gateway Solutions
Amazon VPC Features for Performance
Network Troubleshooting and Optimization Tools
Content Delivery and Acceleration Techniques
Hybrid Networking and DNS Solutions

Determine High-Performing Data Ingestion and Transformation Solutions

Data Ingestion with Kinesis and Firehose
Data Transformation with AWS Glue
Data Migration Strategies
Data Processing with EMR and Spark
Data Storage and Querying with Athena

Design Cost-Optimized Architectures20% practice balance

Explore Design Cost-Optimized Architectures

Design Cost-Optimized Storage Solutions

Hybrid Storage Solutions with AWS Storage Gateway
EBS Snapshots and EFS Cost Management
Cost-Effective Object Storage with S3
Automated Cost Optimization with S3 Intelligent-Tiering
Storage Analytics with S3 Storage Lens

Design Cost-Optimized Compute Solutions

Serverless and Container Cost Optimization
EC2 Purchasing and Right Sizing
Lambda Cold-Start Optimization
Cost Allocation and Resource Grouping
Graviton Price Performance

Design Cost-Optimized Database Solutions

Amazon Aurora Serverless and Amazon RDS Proxy
Amazon DocumentDB Pricing Models
Amazon MemoryDB
Amazon Redshift Spectrum and Cost Optimization
Amazon Athena

Design Cost-Optimized Network Architectures

Cost-Effective Global Traffic Management
Hybrid Connectivity Cost Optimization
Cross-AZ Data Transfer Optimization
VPC Endpoint Cost Benefits
VPC Peering and Transit Gateway Economics

Percentages show ExamNova’s practice balance. Consult the official guide for the vendor’s current exam outline.

Try focused practice

Explore a topic with sample questions and explanations.

Design Highly Available and Fault-Tolerant Architectures Design Scalable and Loosely Coupled Architectures Design Secure Access to AWS Resources Design Secure Workloads and Applications Design Cost-Optimized Database Solutions Determine Appropriate Data Security Controls Determine High-Performing and Scalable Storage Solutions Design Secure Architectures Design Resilient Architectures Design High-Performing Architectures Design Cost-Optimized Architectures

Try a question before you start.

Read the scenario. Consider your answer, then reveal the reasoning.

When reviewing a scenario, identify the requirement that rules each alternative out. Knowing a service name is only the first step.

A media service is comparing a DynamoDB table in on-demand capacity mode with a single-Region MemoryDB for Redis OSS cluster. Which TWO statements correctly describe current direct pricing considerations for these specific configurations?

MemoryDB for Redis OSS receives Valkey's data-written allowance, so node-hours include its first 10 TB written each month.
DynamoDB on-demand bills read and write request units without requiring provisioned read or write throughput.
MemoryDB for Redis OSS bills node-hours and data written, plus snapshot storage beyond its included Regional allowance.
DynamoDB provisioned mode bills only consumed read and write capacity, so unused provisioned capacity has no charge.

Show answer and explanations

MemoryDB for Redis OSS receives Valkey's data-written allowance, so node-hours include its first 10 TB written each month. — MemoryDB pricing distinguishes the Valkey and Redis OSS engines. The advertised Valkey allowance for data written cannot be transferred to this Redis OSS estimate, whose data-written volume remains a direct pricing meter in addition to node-hours.

DynamoDB on-demand bills read and write request units without requiring provisioned read or write throughput. — DynamoDB on-demand automatically manages throughput capacity and bills reads and writes as request units. Storage and optional features can add other charges, but the customer does not reserve an hourly quantity of read or write capacity for this mode.

MemoryDB for Redis OSS bills node-hours and data written, plus snapshot storage beyond its included Regional allowance. — A MemoryDB for Redis OSS estimate includes the selected nodes for the time they run and the volume of data written. Snapshot storage up to the documented Regional allowance is included; storage beyond that allowance is a separate charge.

DynamoDB provisioned mode bills only consumed read and write capacity, so unused provisioned capacity has no charge. — DynamoDB provisioned capacity can be economical for steady, predictable traffic, but AWS bills the hourly read and write capacity that the customer provisions. Unused provisioned capacity therefore remains billable, unlike on-demand request-based throughput.

A clearer way to prepare.

One place to practise, understand your results and plan the next session.

Practise with purpose

Start with your free exam. Explore Exam, Endless and Custom practice modes as you build your study routine.

Understand the answer

Review the reasoning behind your answers and return to the decisions that need another look.

Find your next focus

Use domain-level performance and readiness to see strengths, gaps and areas you have yet to assess.

Put it into practice.

Explore hands-on tasks connected to SAA-C03. These are real Labs from the catalogue.

Lab

Give a private subnet access to Amazon S3

Repair network.yaml so the private subnet can reach Amazon S3 without an internet path. Keep the existing public route and the private subnet's safeguards.

medium · About 18 min

Lab

Keep checkout alive through an AZ failure

Update checkout-stack.yaml so checkout survives the loss of one Availability Zone and an instance that stops serving traffic is replaced. The application answers health checks on /health with HTTP 200. Run two instances steady-state, scaling no lower than two and no higher than four, and give a replacement instance up to two minutes to come into service. Keep the existing target-group traffic path, network, listener, security groups and private-only instances.

medium · About 18 min

Make SAA-C03 your next step.

Create your free account. Start practising.

Start Free