SAA-C03 Exam Guide: Domains, Format and Prep

By Rostyslav Myronenko, holder of 14 active AWS certifications.
17 October 2026. 9 min read

SAA-C03 is the exam code for AWS Certified Solutions Architect – Associate. It tests whether you can design an architecture on AWS that is secure, resilient, fast enough and no more expensive than it needs to be. This guide covers the format, the four domains and what each one asks of you, the services that show up, one question worked through, and a study plan you can fit around a job.

The short answer

65 questions in 130 minutes. 50 are scored and 15 aren't, and you can't tell which is which.
You pass at a scaled score of 720 out of 1,000. The score is for the whole exam, so a weak domain can be made up elsewhere.
Four domains: secure architectures (30%), resilient architectures (26%), high-performing architectures (24%) and cost-optimized architectures (20%).
The fee is $150, and you can sit it at a Pearson VUE test centre or online.
AWS recommends at least a year of hands-on experience designing cloud solutions on AWS.
SAA-C03 is still the current version. The AWS exam page announces no successor and no retirement date (checked 17 October 2026).

If you're still deciding whether this is the right first exam, the AWS certification path compares it with the others by level and role.

SAA-C03 exam format

	SAA-C03
Questions	65 (50 scored, 15 unscored)
Time	130 minutes
Question types	Multiple choice (one right answer of four) and multiple response (two or more right answers of five or more)
Passing score	720 on a scaled score of 100–1,000
Fee	$150
Delivery	Pearson VUE test centre, or online with a remote proctor
Languages	English, French, Italian, Japanese, Korean, Portuguese (Brazil), Spanish (Latin America and Spain), Simplified and Traditional Chinese
Result	Pass or fail, posted within five business days

An unanswered question counts as wrong and a wrong answer costs nothing extra, so answer every question, even when you have to guess. Scoring is compensatory: you pass on the overall score, and no single domain has a pass mark of its own. The score report does break your result down by domain, but the exam guide warns you to read that breakdown with caution. It's most useful for choosing what to revise before a retake.

AWS says the Italian version will be retired after 31 December 2026. The other languages carry no such note.

The four SAA-C03 domains

The exam guide splits each domain into task statements. Below are the task statements for each domain, with the services and skills the guide names under them.

Domain 1: Design secure architectures (30%)

The largest domain, with three task statements:

Secure access to AWS resources: IAM users, groups, roles and policies, MFA on root, cross-account access with roles and STS, IAM Identity Center for federation, and multi-account control with AWS Control Tower and service control policies.
Secure workloads and applications: VPC design with security groups, network ACLs, route tables and NAT gateways, public and private subnets, AWS WAF and AWS Shield against outside threats, Secrets Manager for credentials, and VPN or Direct Connect for the link to your own network.
Data security controls: Encryption at rest with AWS KMS, in transit with ACM certificates, key policies and key rotation, backups and replication, and lifecycle rules that meet a compliance requirement.

Least privilege runs through all three: for users and roles, for network traffic and for access to encryption keys.

Domain 2: Design resilient architectures (26%)

Two task statements:

Scalable and loosely coupled architectures: SQS, SNS and event-driven designs, API Gateway, Lambda and Fargate, ECS and EKS, Step Functions, load balancers, read replicas, caching and CloudFront. Most of this task statement comes down to which service removes a dependency between two parts of a system.
Highly available and fault-tolerant architectures: Multi-AZ and multi-Region designs, Route 53 failover, RDS Proxy, service quotas in a standby environment, and the four disaster recovery strategies: backup and restore, pilot light, warm standby and active-active. You choose between those four by the RPO and RTO in the question.

Domain 3: Design high-performing architectures (24%)

The domain with the most task statements, five:

Storage: S3, EFS and EBS, and which one fits a performance requirement or future growth.
Compute: EC2 instance types, Auto Scaling, Lambda memory sizing, Batch, EMR and Fargate, and decoupling components so each scales on its own.
Databases: Aurora, RDS, DynamoDB and ElastiCache, read replicas, Provisioned IOPS and capacity units, and read-heavy versus write-heavy access patterns.
Networking: CloudFront, Global Accelerator, PrivateLink, subnet and routing design, and choosing a load balancer.
Data ingestion and transformation: Kinesis for streams, Glue for transformation, Athena and Lake Formation for a data lake, and DataSync and Storage Gateway for moving data in.

Domain 4: Design cost-optimized architectures (20%)

Four task statements, one each for storage, compute, databases and networking. The exam guide lists the same cost tools under every one: Cost Explorer, AWS Budgets, the Cost and Usage Report, cost allocation tags and multi-account billing.

Storage: S3 storage classes and lifecycle rules, EBS volume types, FSx and EFS, and the cheapest way to move data into AWS.
Compute: Spot Instances, Reserved Instances and Savings Plans, instance families and sizes, and Lambda or Fargate against EC2.
Databases: DynamoDB against RDS, serverless options, snapshot frequency and retention.
Networking: NAT gateway placement, VPC endpoints instead of internet traffic, Direct Connect against VPN, Transit Gateway against VPC peering, and the cost of traffic between Availability Zones and Regions.

It's the smallest domain, and the one closest to day-to-day work on an AWS bill. If you want the long version of Savings Plans against Reserved Instances, the AWS Savings Plans post covers it.

Which services SAA-C03 covers

The exam guide publishes an in-scope list and an out-of-scope list. The in-scope list is long. The task statements above are built mostly around a shorter set: IAM, VPC, EC2 and Auto Scaling, S3, EBS, EFS, RDS and Aurora, DynamoDB, ElastiCache, Lambda, SQS, SNS, API Gateway, CloudFront, Route 53, Elastic Load Balancing and KMS. Know those well before you spread out.

The out-of-scope list is worth reading too. Anything on it won't be the right answer, which helps when you have to eliminate an option you don't recognise.

How SAA-C03 questions work

Every question is a short scenario with one constraint that decides the answer: the lowest cost, the least operational overhead, a recovery time, or a rule that traffic must not cross the internet. Often more than one option would work. Only one meets the constraint, and the distractors are, in the exam guide's words, "plausible responses that match the content area".

Here's a question in the exam's style. I wrote it to match task statement 4.4, and it isn't taken from the exam.

A company runs a production VPC and a development VPC, each with private subnets in three Availability Zones. Instances in both need outbound internet access for software updates. The company wants to reduce NAT costs without lowering the availability of production. What should a solutions architect do?

A. Replace the NAT gateways in both VPCs with a single NAT instance in each VPC. B. Keep a NAT gateway in each Availability Zone for production, and use a single NAT gateway for development. C. Use one NAT gateway in production and one in development, both in the same Availability Zone. D. Move the development instances to public subnets and remove its NAT gateway.

The answer is B. A NAT gateway lives in one Availability Zone, so production keeps one per zone in case a zone fails. Development can share one, because a zone outage there costs some time and nothing else. A swaps a managed service for one you have to patch and keep running, C takes production's availability down with development's, and D puts instances on the internet to save money, which a security reviewer would refuse.

The keyword was "without lowering the availability of production". Read each question for that phrase first, then read the options.

An SAA-C03 study plan by week

AWS doesn't publish study hours. In the certification path post, my estimate for SAA-C03 is 60 to 90 hours, or 6 to 11 weeks at 8 to 10 hours a week, for someone with the year of experience AWS recommends. Here's the 8-week version, weighted by domain:

Week	Focus	Domain weight
1	Read the exam guide end to end. Take the free official practice question set cold, to find your gaps	All
2–3	IAM, VPC design, KMS and encryption, WAF and Shield	Secure, 30%
4	Decoupling with SQS and SNS, multi-AZ designs and the four DR strategies	Resilient, 26%
5	Storage, compute and database choices, caching, CloudFront and Kinesis	High-performing, 24%
6	Purchasing options, S3 lifecycles, NAT and data transfer costs	Cost-optimized, 20%
7	Build one small three-tier app in your own account, then tear it down	All
8	Full-length practice exam under time, review every wrong answer, book the slot	All

Use week 7 to build things. SAA-C03 asks why you'd pick a service, and that's easier to answer once you've used it. Book the exam before week 8 starts, so the last week has a date at the end of it.

Official SAA-C03 practice resources

AWS publishes two practice resources on AWS Skill Builder: the AWS Certification Official Practice Question Set, which is free, and the AWS Certification Official Practice Exam, a full-length exam in the real format. Skill Builder also has a four-step exam prep plan for SAA-C03. Start with these. AWS writes them to the same exam guide as the real questions.

Booking and exam day

You can reschedule or cancel up to 24 hours before the appointment. After that you can do neither, and each appointment can be rescheduled only twice.
Non-native English speakers can have 30 extra minutes on an exam in English. Request it before you book.
The ID rules for online testing differ from the test-centre ones, and online you'll need to talk to the proctor during the appointment.

After SAA-C03

A pass shows you know the services and the trade-offs the exam guide lists. It doesn't show you can defend a design out loud, which is what an interview tests. The AWS solutions architect interview questions post shows the same topics asked both ways. For the next exam, the certification path lists what comes after the Associate for each role.

FAQ

How many questions can I get wrong on SAA-C03?

AWS doesn't publish a number. The exam has 65 questions, but only 50 count, and the 15 unscored ones aren't marked. Your result is a scaled score from 100 to 1,000, and you pass at 720. Scaling evens out small differences in difficulty between exam forms, so the same raw score can land a little differently on two forms.

Can I take SAA-C03 online?

Yes. Pearson VUE runs every AWS exam online with a remote proctor, as well as in test centres. You have to talk to the proctor during the appointment, and the ID rules for online testing differ from the test-centre ones, so check them before you book.

Is SAA-C03 harder than Cloud Practitioner?

Yes. Cloud Practitioner checks that you know what the services are. SAA-C03 gives you a design scenario and asks which option meets its constraint, and AWS recommends a year of hands-on design experience before you sit it.

Can I get extra time if English isn't my first language?

Yes. AWS gives non-native English speakers 30 extra minutes on exams taken in English. You have to request it before you schedule. Once it's granted, it applies to all your future registrations.

When do I get my SAA-C03 result?

AWS posts the final result to your AWS Certification account within five business days of the exam. A result under security or technical review can take longer.