AWS Certified Solutions Architect – Associate (SAA-C03) Study Guide: Domain Breakdown and Where Candidates Lose Points
Last updated October 24, 2026
AWS Certified Solutions Architect - Associate is the certification most candidates mean when they talk about "getting AWS certified," and it tests something genuinely different from the foundational Cloud Practitioner exam: not which service exists, but which one is the right architectural choice for a specific requirement, and why the three plausible alternatives fall short. Every domain is organized around a design goal -- secure, resilient, high-performing, cost-optimized -- and nearly every question is a scenario with a trade-off buried in it. Here's how it's weighted, what each domain actually tests, and where candidates lose points.
How the exam is weighted
AWS publishes an official domain breakdown for SAA-C03, and it should directly drive how you allocate study time:
- Design Secure Architectures (30%) — the largest domain by a wide margin. IAM policy conditions, KMS encryption enforcement, VPC-scoped access, and the security services that govern who and what can reach a resource.
- Design Resilient Architectures (26%) — Multi-AZ and multi-Region failover, decoupling with SQS and SNS, Auto Scaling, and disaster recovery patterns.
- Design High-Performing Architectures (24%) — the right data, caching, and compute service for a given access pattern: Athena, DynamoDB, ElastiCache, RDS Proxy, CloudFront, and storage performance tiers.
- Design Cost-Optimized Architectures (20%) — EC2 purchasing options, S3 storage class and lifecycle decisions, and the billing and cost-visibility tooling.
What each domain actually tests
Design Secure Architectures tests enforcement, not just configuration: a requirement to guarantee every uploaded object is encrypted with a specific customer-managed key points to a bucket policy that denies the upload otherwise, not a default encryption setting that a caller can simply omit. The same enforcement-first pattern shows up with access scoping (a bucket reachable only through a specific VPC endpoint needs a policy condition keyed on that endpoint, not a security group, since S3 has none) and with privileged actions (requiring MFA for sensitive IAM operations is enforced with a policy condition, not a passive audit trail).
Design Resilient Architectures tests matching the failure mode to the right layer of protection: a database that must survive an Availability Zone failure needs Multi-AZ with automatic DNS failover, not snapshots that require a manual restore, and an application that must survive a full Region outage needs an active architecture in a second Region with Route 53 health-check failover, since Multi-AZ alone does nothing once the entire Region is affected. Decoupling tiers with SQS so a traffic spike doesn't cascade into timeouts is one of the most frequently tested resilience patterns on the exam.
Design High-Performing Architectures tests picking the service built for the specific access pattern rather than a general-purpose one: ad hoc SQL against data sitting in S3 points to Athena's serverless query model, not a service that requires provisioning compute first, and a serverless application exhausting database connections points to RDS Proxy's connection pooling, not a storage or networking service that has no role in managing connections at all.
Design Cost-Optimized Architectures tests matching the purchasing or storage option to the workload's actual tolerance for interruption and commitment: interruption-tolerant batch work points to Spot Instances for the deepest discount, not a Reserved Instance term that doesn't fit a short job, and the most granular billing question always points to the Cost and Usage Report, since CloudTrail and CloudWatch record activity and performance, not cost.
How long should you study
Candidates with some hands-on AWS experience, even at the Cloud Practitioner level, typically prepare in five to seven weeks, concentrated on the security-enforcement patterns and resilience trade-offs that make up more than half the exam. Candidates with no prior AWS exposure often need nine to eleven weeks to build the architectural intuition the exam demands, since this is not a definitions exam -- it expects you to reason about which design actually satisfies the stated requirement.
Where candidates lose points
- Picking a service that's correct in general but doesn't enforce the specific requirement. Default encryption settings, passive logging, and network-layer controls all sound plausible but don't actually block the noncompliant action the question describes.
- Confusing AZ-level and Region-level resilience. Multi-AZ protects against an Availability Zone failure; it does nothing for a full Regional outage, and the exam tests this distinction directly and repeatedly.
- Defaulting to a familiar service instead of the one built for the access pattern. Candidates who've used EC2-centric architectures in a job tend to reach for compute-and-storage solutions even when a purpose-built managed service (Athena, RDS Proxy, DAX) is the better-justified answer.
- Mixing up cost, security, and operational log sources. CloudTrail, CloudWatch, WAF logs, and the Cost and Usage Report each answer a different question, and the exam tests picking the one source that actually contains the data the scenario needs.
Why full-rationale practice questions help
SAA-C03 rewards recognizing the specific architectural reason one service or configuration satisfies a scenario's requirement better than three plausible-sounding alternatives -- not just landing on the correct letter. Full rationale on every option, including why the three incorrect choices fall short for the scenario's exact constraints, builds exactly that judgment, which is what the real exam is testing.
AWS Certified Solutions Architect - Associate (SAA-C03) — $14.99, instant PDF download with full rationale on every answer.
View the practice questions →If you're building a broader cloud path
Solutions Architect - Associate builds directly on Cloud Practitioner fundamentals and pairs well with a parallel architecture credential from another major cloud provider, or a networking foundation underneath it: