AWS SAA-C03
CloudExamPro · Premium Edition 2026
The Ultimate
SAA-C03 Masterclass
Guide
Clear. Direct. Exam-focused. Zero corporate filler.
Secure 30%
Resilient 26%
High-Performing 24%
Cost-Optimized 20%
65+Exam Traps
20+Decision Matrices
4Battlefield Scenarios
3Visual Flowcharts
100Trigger Words
"Master the patterns. Recognize the traps. Build the decision reflexes."
Front Matter
Coach’s Opening — Let’s Get Real About This Exam
Alright, let’s cut to it.
This is not a textbook. It wasn’t built to teach you AWS history. It was built to help you pass — efficiently, and with real understanding. No filler. No encyclopedias. Just the decision patterns that matter.
Here’s the thing most candidates never figure out: The SAA-C03 is not asking what a service does. It’s asking which service to pick, why you’d pick it, and under exactly what constraint. One wrong word in a scenario flips your answer. Engineers with years of AWS production experience fail because they read questions like documentation instead of reading them like a lawyer.
This guide trains you to read like a surgeon.
What Makes This Guide Different
| What You’re Getting | Standard Guides Give You | This Guide Gives You |
|---|---|---|
| Approach | A tour of AWS services | Scenario-based decision training — pick the right service, every time |
| Traps | Zero warning | 40 exam traps catalogued — why you’d fall for each, and how to disarm it |
| Decision Matrices | Walls of explanation | One trigger word → one answer. No deliberation. |
| Scenarios | Watered-down examples | 4 business-grade Battlefield Scenarios — one per domain, built like the real exam |
| Flowcharts | None | 3 visual decision flowcharts wired directly into the chapters they belong in |
| Modern content | 2022 material recycled | Bedrock, ABAC, SCPs, Global Accelerator — patterns emphasized in current AWS documentation |
| Memory system | Good luck with your notes | 20 Rhythmic Anchors you say OUT LOUD the night before. They work. |
| Last Day | Review everything again (panic) | A 24-Hour Cram Sheet that covers the whole exam in one focused read |
Your 21-Day War Plan
Don’t grind linearly. Attack the highest-weighted domain first, while your energy and focus are at their peak.
Days 1–6
Chapter 1 — Secure Architectures (30%)
Highest-weighted domain. IAM, VPC security, KMS, SCPs, cross-account patterns. Start here while fresh.
Days 7–11
Chapter 2 — Resilient Architectures (26%)
Multi-AZ, decoupling, DR strategies, stateless design. Second-highest weight.
Days 12–15
Chapter 3 — High-Performing Architectures (24%)
Storage tiers, database selection, caching, networking. Run decision matrices daily.
Days 16–18
Chapter 4 — Cost-Optimized Architectures (20%)
Smallest domain but constraint-heavy. Practice elimination patterns.
Day 19
Chapter 5 + Chapter 6 — Elimination & Traps
Rehearse kill phrases. Mark personal weak traps. Review them twice.
Day 20
Chapter 7 + Appendix B
Read anchors OUT LOUD. Run the 24-Hour Cram Sheet end-to-end. Sleep 7+ hours.
Day 21
Full timed practice exam (65 questions, 130 min)
Every wrong answer goes back into this guide. No new material.
The SAA-C03 Exam — 60-Second Briefing
Exam Format
65 questions · 130 minutes · Passing score ~720/1000.
Four domains — Secure Architectures 30%, Resilient Architectures 26%, High-Performing 24%, Cost-Optimized 20%.
Security is 30%. That’s your biggest single investment.
You get roughly 120 seconds per question on average. With enough pattern recognition, most answers land in under 30 seconds.
Watch for multi-select questions — AWS says ‘Choose TWO’ or ‘Choose THREE.’ Some questions are unscored pilot questions — answer every one anyway.
Four domains — Secure Architectures 30%, Resilient Architectures 26%, High-Performing 24%, Cost-Optimized 20%.
Security is 30%. That’s your biggest single investment.
You get roughly 120 seconds per question on average. With enough pattern recognition, most answers land in under 30 seconds.
Watch for multi-select questions — AWS says ‘Choose TWO’ or ‘Choose THREE.’ Some questions are unscored pilot questions — answer every one anyway.
Part I — The Four SAA-C03 Domains
Domain 1
Design Secure Architectures
Coach’s Mission
Thirty percent. That’s your biggest single investment in this exam. The SAA doesn’t ask what GuardDuty does — it asks you to architect a solution that uses it correctly. This chapter covers current exam-relevant patterns: ABAC, Bedrock architecture, advanced SCPs, and the CloudFront vs Global Accelerator deep-dive.
1.1 IAM Deep Dive
| IAM Entity | Use It For… | The SAA-Level Nuance |
|---|---|---|
| IAM User | Individual humans needing permanent credentials | Never use for EC2 apps or cross-account access. That’s what Roles are for. |
| IAM Role | EC2 apps, Lambda, cross-account, federation | Temp credentials via STS. Always preferred for anything that isn’t a human. |
| IAM Group | Assigning policies to multiple users at once | Groups have no credentials. You can’t assume a group. |
| Resource-Based Policy | Attached directly to an AWS resource (S3, KMS, Lambda) | Enables cross-account access WITHOUT needing to assume a role. |
| Permission Boundary | Capping the maximum permissions an IAM entity can ever have | It doesn’t grant — it caps. |
| SCP (via Organizations) | Restricting what entire accounts or OUs can do | Does NOT grant permissions. Only restricts. This is tested constantly. |
Gotcha — Policy Evaluation Order
Explicit DENY always wins. Then: SCPs → Resource-based policies → Identity-based policies → Permission boundaries. No explicit Allow anywhere = implicit Deny.
1.2 ★ ABAC vs RBAC
RBAC — Role-Based Access Control
Access defined by the ROLE a user holds
IAM Roles + Policies per role (Admin, Dev, ReadOnly)
Grows linearly with team count
Right fit for small teams with stable permission sets
Trigger: ‘separate roles per team’
ABAC — Attribute-Based Access Control
Access defined by TAGS on both user and resource
Policy condition: aws:PrincipalTag must match aws:ResourceTag
One policy covers all tagged resources
Right fit for large orgs, many teams, multi-tenant
Trigger: ‘tag-based access’, ‘scale IAM for hundreds of teams’
Condition: {
"StringEquals": {
"aws:PrincipalTag/team": "${aws:ResourceTag/team}"
}
}
"StringEquals": {
"aws:PrincipalTag/team": "${aws:ResourceTag/team}"
}
}
Translation: ‘You can only access this resource if your team tag matches its team tag.’ One policy. All teams. All resources.
1.3 VPC Security — Six Layers of Defense
| Layer | Service | Level | State | What It Controls |
|---|---|---|---|---|
| Perimeter | AWS WAF | HTTP Request | Stateful | Blocks SQLi, XSS, bots, rate limits, geo-blocks |
| Edge | AWS Shield | Network/Transport | Always-on | Blocks DDoS floods at Layer 3 and 4 |
| Subnet | Network ACL (NACL) | Subnet | Stateless | Allow AND Deny rules — configure both directions |
| Instance | Security Group | Instance/ENI | Stateful | Allow rules only — return traffic automatically allowed |
| DNS | Route 53 Resolver DNS Firewall | DNS | — | Blocks DNS resolution to known malicious domains |
| Data | KMS / ACM / TLS | Data Layer | — | Encryption at rest (KMS) and in transit (ACM/TLS) |
Pro Tip
Key gotcha: if a question says ‘block a specific IP address’ — the answer is always NACL, because Security Groups cannot deny. Security Groups only allow.
1.4 Encryption — KMS, ACM, CloudHSM, Secrets Manager
| Trigger in the Question | Answer | Why |
|---|---|---|
| ‘encryption keys’ / ‘manage and audit keys’ | AWS KMS | Key lifecycle management lives in KMS. |
| ‘auto-rotate database credentials’ | AWS Secrets Manager | Auto-rotation = Secrets Manager. ONLY Secrets Manager. |
| ‘store config values’ / ‘non-secret parameters’ | SSM Parameter Store | Config storage = Parameter Store. Not Secrets Manager. |
| ‘SSL/TLS certs for ALB or CloudFront’ | AWS Certificate Manager (ACM) | SSL certs for AWS services = ACM. |
| ‘FIPS 140-2 Level 3’ / ‘dedicated HSM hardware’ | AWS CloudHSM | Dedicated HSM = CloudHSM. Compliance only. |
| ‘share encryption key across accounts’ | KMS Customer Managed Key (CMK) | CMK key policy can list other accounts. AWS Managed Keys can’t. |
Gotcha — Secrets Manager vs Parameter Store
Secrets Manager: costs money, built-in auto-rotation for RDS, Redshift, DocumentDB.
Parameter Store: free tier, stores any config value — ZERO built-in rotation.
‘Auto-rotate RDS password’ = Secrets Manager. Every time.
Parameter Store: free tier, stores any config value — ZERO built-in rotation.
‘Auto-rotate RDS password’ = Secrets Manager. Every time.
1.5 ★ Modern SCP Patterns
| The SCP Pattern | What It Locks Down | Exam Trigger |
|---|---|---|
| Deny all non-approved regions | Blocks any action where aws:RequestedRegion isn’t in your allowed list | ‘restrict services to approved regions across the org’ |
| Prevent GuardDuty from being disabled | Denies guardduty:DeleteDetector | ‘prevent member accounts from disabling security monitoring’ |
| Force S3 server-side encryption | Denies s3:PutObject where the SSE header is null | ‘enforce encryption at rest for all S3 uploads org-wide’ |
| Block all public S3 buckets | Denies s3:PutBucketPublicAccessBlock = false | ‘prevent any account from making S3 buckets public’ |
| Require MFA for all console access | Denies non-STS actions when aws:MultiFactorAuthPresent is false | ‘enforce MFA for console access across the organization’ |
Gotcha — SCPs Do NOT Apply to the Management Account
SCPs apply ONLY to member accounts and OUs. The management (root) account is exempt from all SCPs — always.
1.6 Cross-Account Access
| Access Pattern | The Mechanism | Exam Trigger |
|---|---|---|
| Assume a role in another account | IAM Role in Account B with trust policy listing Account A. PLUS identity policy in Account A allowing sts:AssumeRole. | ‘cross-account access’, ‘assume role from another account’ |
| Direct S3 access across accounts | Resource-based policy on S3 bucket listing the other account as principal | ‘S3 cross-account without assuming a role’ |
| Restrict S3 to entire org | S3 bucket policy with aws:PrincipalOrgID condition | ‘restrict to all accounts in our organization’ |
| Share VPC subnets across accounts | AWS RAM (Resource Access Manager) | ‘share VPC subnet across accounts in the org’ |
1.7 Security Services — The Verb Map
| Service | Its One Job | Does It Block? | Exam Trigger |
|---|---|---|---|
| AWS WAF | HTTP-layer filter — SQLi, XSS, bots, rate limit, geo-block | YES | ‘SQL injection’, ‘bot traffic’, ‘rate limit’ |
| AWS Shield Advanced | Enhanced DDoS protection + DRT access | YES + DRT | ‘DDoS Response Team’, ‘DRT’ |
| Amazon GuardDuty | Continuous ML threat detection across logs and network | NO — DETECTS only | ‘threat detection’, ‘malicious activity’ |
| Amazon Inspector | Automated CVE scanning across EC2, ECR, and Lambda | NO — ASSESSES only | ‘CVE scan’, ‘vulnerability assessment’ |
| Amazon Macie | Sensitive data discovery in S3 — PII, PHI, financial data | NO — DISCOVERS only | ‘PII in S3’, ‘sensitive data’ |
| AWS CloudTrail | Records every AWS API call with caller identity | NO — LOGS only | ‘who changed’, ‘API audit’ |
| AWS Config | Tracks resource configuration state and evaluates compliance | NO — TRACKS only | ‘configuration compliance’, ‘drift detection’ |
| AWS Security Hub | Aggregates findings from all security services | NO — AGGREGATES only | ‘centralized security findings’ |
| Amazon Detective | Investigates the root cause of a security finding | NO — INVESTIGATES only | ‘investigate finding’, ‘root cause’ |
The Lock
BLOCK HTTP = WAF. BLOCK DDoS = Shield. DETECT threat = GuardDuty. SCAN CVEs = Inspector. DISCOVER PII = Macie. AUDIT API = CloudTrail. TRACK config = Config. INVESTIGATE = Detective. AGGREGATE all = Security Hub.
1.8 ★ GenAI Architecture — Bedrock vs SageMaker
Amazon Bedrock
Fully managed GenAI API — pick a Foundation Model and call it
Use when you need GenAI without training anything yourself
Completely serverless. Zero infra to manage.
Pay per input/output token
Trigger: ‘foundation model’, ‘GenAI via API’, ‘no ML expertise’, ‘RAG’
Amazon SageMaker
Full ML platform — build, train, fine-tune, deploy any model
Use when you need custom model training
You configure instances, clusters, and endpoints
Pay for instance-hours
Trigger: ‘train custom model’, ‘fine-tune on our data’, ‘MLOps’
Gotcha — The Lock Words
Words that lock Bedrock: pre-trained, no training, API, no ML expertise.
Words that lock SageMaker: custom training, fine-tune, our data, MLOps.
Words that lock SageMaker: custom training, fine-tune, our data, MLOps.
1.9 ★ CloudFront vs Global Accelerator
Amazon CloudFront
CDN — CACHES content at 400+ edge PoPs worldwide
HTTP, HTTPS, and WebSocket only
Best for cacheable content (images, video, JS, APIs)
No fixed IP — dynamic per edge PoP
Shield Standard + WAF integration built in
Trigger: ‘CDN’, ‘cache’, ‘reduce load on origin’
AWS Global Accelerator
Routes LIVE TRAFFIC over the AWS private backbone — no caching
TCP and UDP — any protocol
Best for non-cacheable, dynamic, real-time traffic
YES — 2 static anycast IPs globally
Health checks → failover under 30 seconds
Trigger: ‘fixed IP’, ‘TCP/UDP’, ‘gaming’, ‘instant failover’
The Lock
Does the scenario say ‘static IP required’? → Global Accelerator. Does it say ‘cache responses’? → CloudFront. No contest.
1.10 ★ Battlefield: $2B/Day FinTech Compliance Architecture
★ Battlefield Scenario — Domain 1
$2B/Day FinTech Compliance Architecture
🚨 The Situation
$2 billion a day flows through your systems across 40 AWS accounts. PCI-DSS Level 1, SOC 2 Type II, GDPR. Requirements: no root account usage anywhere, all S3 encrypted and private, every API call logged, secrets never hardcoded, centralized threat monitoring across all 40 accounts.
✅ How You Architect This
| Security Layer | AWS Service | How It Enforces the Requirement |
|---|---|---|
| Account Governance | AWS Organizations + Control Tower | SCPs block root usage, restrict regions, enforce tagging |
| Identity | AWS IAM Identity Center (SSO) | Central SSO across all 40 accounts |
| Threat Detection | GuardDuty — org-wide delegated admin | Security account aggregates findings from all 40 member accounts |
| Vulnerability Mgmt | Amazon Inspector — org-wide | EC2, ECR, and Lambda CVE scans across every account |
| Config Compliance | AWS Config + PCI-DSS Conformance Pack | Auto-remediates non-compliant resources via SSM Automation |
| Secret Management | AWS Secrets Manager | All DB passwords stored · auto-rotation every 30 days |
| Key Management | AWS KMS — CMK per workload | Customer-managed keys · annual rotation |
| Data Discovery | Amazon Macie — org-wide | Scans S3 for PII and PHI across all 40 accounts |
| API Audit | AWS CloudTrail — single org trail | One trail in security account captures every API call |
| Incident Response | Security Hub + EventBridge → Lambda | Findings auto-routed → EventBridge → Lambda → PagerDuty |
1.11 Chapter 1 Mastery Checklist
Chapter 1 — Secure Architectures
0/10 complete
Domain 1 Complete — Design Secure Architectures
Prove It Under Pressure: Secure Architectures
At 30% of the exam, security is where the SAA-C03 is won or lost. You’ve worked through IAM, ABAC, VPC defense layers, KMS, SCPs, cross-account access, and the full security service verb map. The only way to know if it sticks is to answer questions — now, while it’s fresh.
Domain 1-focused questions on IAM policies, SCPs, GuardDuty, WAF, KMS, and Bedrock
Multi-account governance scenarios with SCP gotchas and trust policy traps
Security verb map questions — DETECT vs BLOCK vs AUDIT vs INVESTIGATE under exam pressure
Current content including ABAC, Bedrock vs SageMaker, and CloudFront vs Accelerator
Detailed explanations that reinforce the elimination logic, not just the right answer
390 practice questions · organized by exam domain · CloudExamPro
Domain 2
Design Resilient Architectures
Coach’s Mission
Resilience is the architecture of trust. This domain asks the same question in a hundred different costumes: What happens when something breaks? Your answer is almost always some combination of Multi-AZ, decoupling via SQS or SNS, Auto Scaling, stateless design, and redundant data stores.
2.1 HA vs Fault Tolerance — RPO & RTO
Candidates confuse RPO and RTO and lose points on questions that were basically free. This is a vocabulary test disguised as an architecture question.
| Concept | What It Actually Means | How AWS Implements It |
|---|---|---|
| High Availability (HA) | Your system stays up even when a component fails — maybe with brief hiccups | Multi-AZ RDS, ALB across AZs, Auto Scaling groups |
| Fault Tolerance (FT) | Zero-downtime, zero degradation — not even a hiccup during failure | Active-active multi-region, redundant Lambda, S3 11-nines durability |
| Disaster Recovery (DR) | Getting back up after catastrophic failure — measured by RPO and RTO | S3 CRR, Aurora Global, Route 53 failover routing |
RPO vs RTO
| Metric | Full Name | It Answers… | You Reduce It By… |
|---|---|---|---|
| RPO | Recovery Point Objective | How much DATA can you afford to lose? | More frequent backups, synchronous replication, Aurora Global |
| RTO | Recovery Time Objective | How much DOWNTIME can you afford? | Warm standby, active-active multi-region, pre-scaled ASG |
Gotcha — AWS Loves This Trap
‘Minimize data loss’ = RPO question. ‘Minimize downtime’ = RTO question. The word loss (data) versus the word downtime (time) — that’s the deciding factor.
2.2 Decoupling — SQS, SNS, EventBridge
When AWS shows you a system where one component is hammering another or where a spike is bringing things down, your instinct should be: put a queue or a topic in between them. The question is which one.
| Service | The Pattern | Exam Trigger | Key Characteristic |
|---|---|---|---|
| Amazon SQS | Queue — point-to-point | ‘decouple’, ‘buffer’, ‘handle spikes’ | Pull-based. Multiple consumers can poll the same queue; each message delivered to one consumer. No fan-out to independent pipelines. |
| SQS FIFO | Ordered queue | ‘exactly-once’, ‘ordering guaranteed’ | Exactly-once processing. Strict FIFO order. Capped at 300 msg/s (3,000 with batching). |
| Amazon SNS | Pub/sub fan-out | ‘notify multiple’, ‘fan-out’, ‘broadcast’ | Push-based. Every subscriber gets every message simultaneously. |
| Amazon EventBridge | Event bus | ‘event-driven’, ‘SaaS events’, ‘decoupled microservices’ | Rule-based routing. 90+ AWS event sources. Scheduling built in. |
| SNS + SQS Fanout | Fan-out with durability | ‘multiple queues + fan-out + durable’ | SNS fans out to multiple SQS queues. Each consumer is independent. |
Gotcha
SQS = pull-based. One message goes to one consumer. SNS = push-based. ALL subscribers get EVERY message at the same time. ‘One service needs to process this message’ = SQS. ‘Five services all need this message simultaneously’ = SNS or SNS+SQS fanout.
2.3 Load Balancers — ALB, NLB, GLB
| Load Balancer | Layer | Protocol | Its Superpower | Exam Trigger |
|---|---|---|---|---|
| ALB | Layer 7 | HTTP / HTTPS / WebSocket | Path-based + host-based routing. Targets Lambda. Sticky sessions. | ‘path-based routing’, ‘microservices’, ‘WebSocket’ |
| NLB | Layer 4 | TCP / UDP / TLS | Millions of requests/sec. Static IP. Preserves source IP. | ‘TCP’, ‘static IP’, ‘ultra-low latency’ |
| GLB | Layer 3+ | All IP traffic | Sends traffic through third-party firewalls/IDS/IPS inline. | ‘firewall appliance’, ‘IDS/IPS’, ‘inline inspection’ |
Pro Tip
ALB is the only load balancer that can target Lambda functions. NLB cannot target Lambda.
2.4 Auto Scaling — Policies That Actually Matter
| Policy Type | How It Works | Exam Trigger |
|---|---|---|
| Target Tracking | Keeps a metric at your target — say, CPU at 50%. Most hands-off option. | ‘automatically maintain’, ‘keep CPU at X%’, ‘simplest setup’ |
| Step Scaling | Add or remove instances in defined steps based on alarm thresholds. | ‘add 2 instances if CPU > 70%’ |
| Scheduled Scaling | Scale at specific times regardless of current load. | ‘scale every Monday at 8am’, ‘predictable traffic pattern’ |
| Predictive Scaling | ML-based. Scales BEFORE the load hits. | ‘anticipate traffic’, ‘proactive scaling’, ‘ML-based’ |
2.5 Multi-AZ vs Multi-Region — The Geography Trap
AZs share the same geographic area. If an earthquake hits the region, all AZs go down together. Multi-AZ does NOT protect you from regional disasters. Multi-Region does.
| Trigger in the Question | Answer | Why It Wins |
|---|---|---|
| ‘high availability’ / ‘survive AZ failure’ | Multi-AZ deployment | AZ failure = local. Multi-AZ covers it. |
| ‘survive regional disaster’ / ‘earthquake’ | Multi-Region | Whole Region can go down. That’s the only answer. |
| ‘RDS automatic failover’ | RDS Multi-AZ | Synchronous standby + auto failover = Multi-AZ. |
| ‘active-active global database’ | Aurora Global Database | Active-active cross-region = Aurora Global only. |
| ‘near-zero RPO across regions’ | Aurora Global or DynamoDB Global Tables | Sub-second RPO = these two only. |
2.6 Stateless Sessions — Stop Gluing Users to Servers
| The Problem | The Fix | Why It Works |
|---|---|---|
| Users lose sessions when ALB routes to different instances | ElastiCache for Redis | Shared in-memory session store. Any instance reads it. |
| Shopping cart disappears on instance failure | Persist in DynamoDB | Persistent, scalable, low-latency. Survives instance death. |
| File uploads need to be accessible from any instance | Amazon S3 + pre-signed URLs | Central object storage. Every instance can reach it. |
| Someone tells you to use sticky sessions | Last resort only | If that one instance dies, the session dies too. Not really HA. |
Pro Tip
If a question asks for the MOST SCALABLE or MOST AVAILABLE session solution — ElastiCache or DynamoDB beats sticky sessions every single time.
2.7 ★ Battlefield: 50M-User Global E-Commerce Platform
★ Battlefield Scenario — Domain 2
50M-User Global E-Commerce Platform
🚨 The Situation
You’re the lead architect at a fashion retailer. 15 countries. 50M monthly active users. Black Friday hits and traffic spikes 20× in under 10 minutes. The CTO walks in: 99.99% availability, sub-100ms target globally, zero data loss. No stateful sessions anywhere.
✅ How You Win This
| Layer | AWS Service(s) | What It Does | How You Configure It |
|---|---|---|---|
| DNS + Routing | Route 53 (Latency + Failover) | Sends users to the nearest healthy region | Health checks every 10s · failover policy |
| CDN + Edge | CloudFront + WAF + Shield Advanced | Caches static assets at edge · blocks DDoS | OAC for S3 · WAF rate-limiting rules |
| Load Balancing | Application Load Balancer | Spreads requests across AZs · path-routes API vs static | Cross-zone LB on · minimum 2 AZs |
| Compute | EC2 Auto Scaling — Predictive Mode | Scales UP before the traffic spike hits | Predictive scaling · 5-min warm-up |
| Session State | ElastiCache Redis — Multi-AZ | Externalizes sessions so compute stays stateless | TTL per session · Multi-AZ cluster |
| Primary DB | Aurora Global Database — MySQL | Active reads in every region · writes replicate globally | Primary: us-east-1 · Replica: eu-west-1 |
| Object Storage | S3 + Cross-Region Replication | Product images and assets live in every region | CRR to all active regions |
| Order Processing | Amazon SQS Standard | Buffers order spikes so the payment service doesn’t choke | Visibility timeout = order processing time |
How the Traffic Flows
User (Global)→
Route 53→
CloudFront Edge→
WAF→
ALB→
EC2 ASG→
ElastiCache→
Aurora Global→
SQS→
Lambda
2.8 ★ DR Strategies — From Cheap to Zero-Downtime
Backup & Restore
RTO4–24 hrs
RPOHours
$ Cheapest
S3 backups & snapshots. Restore from scratch when disaster hits.
Pilot Light
RTO10–30 min
RPOMinutes
$$ Low-Med
DB always running. AMIs ready. Compute is OFF until needed.
Warm Standby
RTO5–15 min
RPOSeconds
$$$ Medium
Scaled-DOWN but LIVE copy always running. Scale UP on disaster.
Multi-Site Active-Active
RTONear-zero
RPONear-zero
$$$$ Highest
Full production in 2+ regions. Route 53 sends live traffic to both NOW.
Gotcha — Pilot Light vs Warm Standby
Pilot Light = the database is running — compute is OFF. Warm Standby = a smaller but LIVE version is already running. One-word test: is compute running? YES = Warm Standby. NO = Pilot Light.
2.9 Chapter 2 Mastery Checklist
Chapter 2 — Resilient Architectures
0/8 complete
Domain 2 Complete — Design Resilient Architectures
Test Your Knowledge: Resilient Architectures
You’ve covered HA vs Fault Tolerance, decoupling patterns, load balancers, Auto Scaling, Multi-AZ vs Multi-Region, stateless sessions, and all four DR strategies. Before moving to Domain 3, validate your pattern recognition is sharp — not just your reading comprehension.
Domain 2-focused questions on SQS, SNS, RDS Multi-AZ, DR strategies, and ALB vs NLB
Real exam-style scenarios with multi-service answers and constraint-driven traps
Detailed explanations for every answer — including why the wrong choices fail
Identify your weak areas before they cost you points on exam day
390 total questions organized by domain, so you practice what you just studied
390 practice questions · organized by exam domain · CloudExamPro
Domain 3
Design High-Performing Architectures
Coach’s Mission
Performance is about picking the right tool for the right data at the right scale. This chapter closes the gap with visual flowcharts wired directly into the sections where they belong.
3.1 Storage Tiers — Pick Wrong and It Costs You Points
| Service | Type | When to Use It | Exam Trigger |
|---|---|---|---|
| S3 Standard | Object | Data you touch all the time — daily or more | ‘frequent access’, ‘active data’ |
| S3 Standard-IA | Object | Infrequent access but must be available immediately | ‘infrequent’ + ‘immediate retrieval’ |
| S3 One Zone-IA | Object | Infrequent + you can recreate it if the AZ dies | ‘infrequent’ + ‘reproducible’ |
| S3 Intelligent-Tiering | Object | You genuinely don’t know how often it’ll be accessed | ‘unknown pattern’, ‘unpredictable access’ |
| S3 Glacier Instant | Archive | Rarely accessed — but when you need it, you need it NOW | ‘rare’ + ‘milliseconds’ |
| S3 Glacier Flexible | Archive | Rarely accessed; Expedited (1–5 min), Standard (3–5 hr), or Bulk (5–12 hr) | ‘archive’ + ‘expedited available’ |
| S3 Glacier Deep Archive | Archive | 7–10 year compliance holds. Standard 12 hr, Bulk 48 hr. No Expedited. | ‘compliance’, ‘7 years’, ‘no expedited’ |
| EBS gp3 | Block | General-purpose EC2 — tweak IOPS independently | ‘general purpose’, ‘independent IOPS’ |
| EBS io2 Block Express | Block | Mission-critical DB needing maximum IOPS | ‘high IOPS’, ‘sub-millisecond’ |
| EBS st1 | Block | Big sequential reads — logs, data warehouses | ‘throughput-optimized’, ‘sequential reads’ |
| Amazon EFS | File/NFS | Multiple EC2 instances sharing the same filesystem | ‘shared’, ‘thousands of EC2’, ‘NFS’ |
| FSx for Lustre | HPC File | High-performance computing, ML training, parallel IO | ‘HPC’, ‘parallel processing’ |
| FSx for Windows | SMB File | Windows apps that need SMB and Active Directory | ‘Windows’, ‘SMB protocol’, ‘Active Directory’ |
3.2 ★ S3 Decision Flowchart
S3 Storage Class Decision Flowchart
1
Is this data accessed FREQUENTLY — daily or more?
→ S3 Standard
2
Is the access pattern UNKNOWN or UNPREDICTABLE?
→ Intelligent-Tiering
3a
INFREQUENT — and can you recreate it if one AZ dies?
YES → One Zone-IA
3b
INFREQUENT — data is critical and cannot be recreated?
NO → Standard-IA
4a
ARCHIVE — must retrieve in MILLISECONDS?
→ Glacier Instant
4b
ARCHIVE — need expedited retrieval (1–5 min) or hours OK?
→ Glacier Flexible
4c
Compliance archive, 7–10 years, no expedited needed?
→ Deep Archive
The Lock
FREQUENTLY → Standard | UNKNOWN pattern → Intelligent-Tiering | INFREQUENT + REPRODUCIBLE → One Zone-IA | INFREQUENT + CRITICAL → Standard-IA | RARE + IMMEDIATELY → Glacier Instant | RARE + EXPEDITED OK → Glacier Flexible | COMPLIANCE + NO EXPEDITED → Deep Archive
3.3 Database Selection — The Matrix That Ends the Guessing
| Trigger in the Question | Answer | Why |
|---|---|---|
| ‘relational’ / ‘SQL’ / ‘ACID transactions’ | Amazon RDS or Aurora | SQL = RDS/Aurora. Every time. |
| ‘5× faster than MySQL’ | Amazon Aurora | That’s Aurora’s positioning. |
| ‘serverless SQL’ / ‘scale to zero’ | Aurora Serverless v2 | Serverless relational = Aurora Serverless. |
| ‘NoSQL’ / ‘key-value’ / ‘single-digit milliseconds’ | Amazon DynamoDB | Serverless NoSQL = DynamoDB. |
| ‘DynamoDB reads need microsecond latency’ | DynamoDB DAX | DAX = in-memory READ cache for DynamoDB. Only reads. |
| ‘in-memory’ / ‘microsecond latency’ | ElastiCache for Redis | Microsecond = ElastiCache. |
| ‘petabyte analytics’ / ‘data warehouse’ / ‘OLAP’ | Amazon Redshift | Warehouse = Redshift. Never use Redshift for OLTP. |
| ‘graph’ / ‘relationships’ / ‘fraud detection’ | Amazon Neptune | Graph = Neptune. Every time. |
| ‘IoT sensors’ / ‘time-series’ | Amazon Timestream | Time-series = Timestream. |
| ‘MongoDB-compatible’ | Amazon DocumentDB | MongoDB = DocumentDB. |
| ‘Lambda → RDS’ / ‘too many connections’ | Amazon RDS Proxy | Connection pooling = RDS Proxy. |
Gotcha — Multi-AZ vs Read Replicas
Multi-AZ = SYNCHRONOUS replication → automatic failover → HIGH AVAILABILITY. Read Replicas = ASYNCHRONOUS → no automatic failover → READ PERFORMANCE. These are not interchangeable. Ever.
3.4 ★ Database Flowchart
| If You Need This… | Pick This | Key Differentiator |
|---|---|---|
| SQL + maximum performance + 15 read replicas | Amazon Aurora | 5× MySQL performance · auto-healing |
| SQL + variable load + scale to zero | Aurora Serverless v2 | Pay per ACU-hour · zero idle cost |
| SQL + managed MySQL/PostgreSQL/Oracle | Amazon RDS | AWS manages OS + patching |
| SQL + active-active reads in multiple regions | Aurora Global Database | < 1 second RPO across regions |
| SQL + petabyte analytics + OLAP | Amazon Redshift | Warehouse ONLY. Never for transactions. |
| NoSQL + serverless + single-digit ms | Amazon DynamoDB | Serverless NoSQL. Default for key-value. |
| DynamoDB reads need microsecond latency | DynamoDB + DAX | READ cache only — DAX does nothing for writes |
| Sub-millisecond cache for sessions | ElastiCache (Redis/Memcached) | In-memory only. Not a primary DB. |
| Graph traversal + fraud detection | Amazon Neptune | Graph = Neptune. No exceptions. |
| IoT sensor data + time-series | Amazon Timestream | Purpose-built time-series engine. |
| MongoDB-compatible document store | Amazon DocumentDB | MongoDB API compatibility. |
| Immutable audit ledger | Amazon QLDB | Ledger database with cryptographic verification. |
3.5 Caching — Three Layers, Three Different Tools
| Cache Layer | Service | What It Caches | Exam Trigger |
|---|---|---|---|
| CDN Edge Cache | Amazon CloudFront | Static + cacheable HTTP content at 400+ edge PoPs | ‘CDN’, ‘edge’, ‘reduce origin load’ |
| Application Cache | ElastiCache (Redis/Memcached) | DB query results, user sessions, computed data | ‘app cache’, ‘reduce DB load’, ‘session store’ |
| Database Cache | DynamoDB DAX | DynamoDB read results in microseconds. READ ONLY. | ‘DynamoDB latency’, ‘microsecond reads’ |
3.6 Networking Performance
| Trigger in the Question | Answer | Why It Wins |
|---|---|---|
| ‘dedicated private link’ / ‘no public internet’ | AWS Direct Connect | ‘Dedicated’ + ‘no internet’ = Direct Connect. |
| ‘encrypted tunnel’ / ‘quick setup’ | Site-to-Site VPN | ‘Quick’ + ‘encrypted’ + ‘internet’ = VPN. |
| ‘route live traffic over AWS backbone globally’ | AWS Global Accelerator | Live traffic + AWS private network = Accelerator. |
| ‘CDN’ / ‘cache content globally’ | Amazon CloudFront | Content caching at edge = CloudFront. |
| ‘private S3 access from VPC’ / ‘free’ | VPC Gateway Endpoint (FREE) | Private S3 = Gateway Endpoint. Free. Always. |
| ‘connect many VPCs’ / ‘hub-and-spoke’ | AWS Transit Gateway | Hub-and-spoke at scale = Transit Gateway only. |
| ‘connect exactly two VPCs directly’ | VPC Peering | Two VPCs = Peering. Non-transitive. Doesn’t scale. |
3.7 Compute Costs — EC2 Purchasing Done Right
| Option | Max Savings | The Workload It Fits | Trigger |
|---|---|---|---|
| On-Demand | — | Unpredictable. Short-term. Dev and test. | ‘flexible’, ‘no commitment’ |
| Reserved Standard — 3-Year | 72% | Steady 24/7. Predictable. Fixed family. | ‘steady-state’, ‘24/7’, ‘3-year’ |
| Compute Savings Plans | 66% | Flexibility across EC2, Lambda, and Fargate. | ‘flexible’, ‘multiple services’ |
| Spot Instances | 90% | Batch jobs. Fault-tolerant. Can be interrupted. | ‘cheapest’, ‘can be interrupted’, ‘batch’ |
| Dedicated Host | BYOL | Physical server for license compliance. | ‘BYOL’, ‘dedicated hardware’ |
Pro Tip
Lambda MAX timeout = 15 minutes. Hard stop. No exceptions. Any job running longer = Fargate or AWS Batch.
Lambda + RDS connection issues = RDS Proxy.
Lambda + RDS connection issues = RDS Proxy.
3.8 ★ Battlefield: Real-Time Analytics at 2.5M Events/Minute
★ Battlefield Scenario — Domain 3
Real-Time Analytics at 2.5M Events/Minute
🚨 The Situation
500,000 delivery trucks each emitting GPS and telemetry every 5 seconds = 2.5M events/minute. Real-time dashboards under 2 seconds. 3 years of historical data queryable on demand. Nightly ML anomaly detection. Zero infrastructure to manage.
✅ The Architecture
| Layer | AWS Service | Its Job | Key Config |
|---|---|---|---|
| Event Ingest | Kinesis Data Streams | Absorbs 2.5M events/minute | 500 shards |
| Real-Time Processing | Kinesis Data Analytics (Flink) | SQL queries running live on the stream | Tumbling 30-second windows |
| Live Store | DynamoDB + DAX | Current vehicle state · sub-ms dashboard reads | TTL = 24 hours |
| Data Lake Delivery | Kinesis Firehose → S3 | Buffers data, converts to Parquet | Date/region partitions |
| Historical Query | Amazon Athena + AWS Glue | Ad-hoc SQL on 3 years of data | Glue crawler runs daily |
| BI Dashboards | Amazon QuickSight — SPICE | Business dashboards every 15 minutes | SPICE import from Athena |
| ML Anomaly Detection | Amazon SageMaker | Trains route anomaly model on S3 historical data | Batch transform runs nightly |
Pro Tip — The Kinesis Split
Kinesis Data Streams → custom consumer apps = real-time, multiple independent consumers, replay.
Kinesis Firehose → managed delivery to S3/Redshift = no consumer code, auto-scales, no replay.
‘Multiple apps consume the same stream’ = Data Streams. ‘Load streaming data to S3 automatically’ = Firehose.
Kinesis Firehose → managed delivery to S3/Redshift = no consumer code, auto-scales, no replay.
‘Multiple apps consume the same stream’ = Data Streams. ‘Load streaming data to S3 automatically’ = Firehose.
3.9 Chapter 3 Mastery Checklist
Chapter 3 — High-Performing Architectures
0/9 complete
Domain 3 Complete — Design High-Performing Architectures
Validate What You Know: High-Performing Architectures
Storage tiers, S3 decision flowcharts, database selection matrices, caching layers, networking performance, and serverless compute — you’ve built the mental framework. Now put it under pressure with questions that mirror what AWS actually tests in Domain 3.
Domain 3-focused questions on S3 classes, database selection, ElastiCache, and Kinesis
Flowchart-style scenarios that require multi-step decision reasoning — just like the real exam
CloudFront vs Global Accelerator traps and DAX write-cache gotchas covered in detail
Pinpoint exactly which topics need reinforcement before you sit
390 total practice questions spanning all four SAA-C03 domains
390 practice questions · organized by exam domain · CloudExamPro
Domain 4
Design Cost-Optimized Architectures
Coach’s Mission
Cost optimization at the SAA level isn’t about memorizing pricing. It’s about architectural decisions. The exam gives you a scenario and asks which architecture delivers the same result at the lowest cost.
4.1 Compute Cost — Spot, RIs, Savings Plans
| Trigger in the Question | Answer | Why It Wins |
|---|---|---|
| ‘lowest cost’ / ‘tolerates interruption’ / ‘batch jobs’ | Spot Instances | Up to 90% off On-Demand. Can be interrupted. |
| ‘steady 24/7’ / ‘committed’ / ‘predictable workload’ | Reserved Instances — 3-Year | 72% off. Committing to a family for 3 years. |
| ‘flexible compute across EC2+Lambda+Fargate’ | Compute Savings Plans | 66% off. Flexes across multiple compute types. |
| ‘auto-terminate idle’ / ‘scale to zero’ | Auto Scaling + Lambda | Zero idle cost. Pay only when it runs. |
| ‘right-size over-provisioned instances’ | AWS Compute Optimizer | ML-based rightsize recommendations. Free. |
| ‘24/7 steady containerized workload’ | ECS on EC2 Reserved Instances | Fargate is more expensive for steady 24/7 loads. |
4.2 Storage Cost — Lifecycle Rules and the Deep Archive Floor
| Scenario | Cost-Optimal Answer | Why |
|---|---|---|
| Data frequently accessed for 30 days, then rarely | S3 Lifecycle: Standard → Standard-IA | Automatically transitions to cheaper tier. |
| Unknown access pattern, want AWS to handle tiering | S3 Intelligent-Tiering | Auto-moves objects between tiers. |
| 7-year compliance archive | S3 Glacier Deep Archive | ~$0.001/GB. Cheapest storage in all of AWS. |
| Infrequent + reproducible + single AZ is fine | S3 One Zone-IA | ~20% cheaper than Standard-IA. |
4.3 Database Cost — Serverless Wins the Variable Fight
| Scenario | Cost-Optimal Answer | Why |
|---|---|---|
| Unpredictable DB workload / needs to scale to zero | Aurora Serverless v2 | Pay per ACU-hour. Scales to zero. Zero idle cost. |
| Read-heavy DB workload on RDS | RDS Read Replicas | Offload reads. Cheaper than scaling the primary up. |
| Replace expensive Oracle license | Amazon Aurora or RDS PostgreSQL | Zero license cost. Same SQL capabilities. |
| Redshift cluster sitting idle during off-hours | Redshift Serverless or Pause/Resume | Zero cost when paused. |
4.4 Architecture Decisions — Free Endpoints and Other Wins
| Trigger in the Question | Answer | Why It Wins |
|---|---|---|
| ‘move to serverless’ / ‘eliminate idle EC2 cost’ | Lambda + API Gateway + DynamoDB | No servers = no idle cost ever. |
| ‘reduce data transfer costs’ / ‘serve content globally cheaper’ | CloudFront (cache at edge) | Cache hits don’t cost origin transfer fees. |
| ‘cheapest batch processing’ | Spot Instances + AWS Batch | Spot = 90% off. Batch handles retries automatically. |
| ‘eliminate NAT Gateway cost for S3’ | VPC Gateway Endpoint for S3 | Gateway endpoints are FREE. Always. |
| ‘volume discounts across accounts’ | AWS Organizations + Consolidated Billing | Combined usage = volume discounts. RI sharing. |
Pro Tip
Gateway VPC Endpoints for S3 and DynamoDB are completely free. They eliminate NAT Gateway data processing cost for private subnet traffic. Free cost reduction AND improved security in one move.
4.5 ★ Battlefield: $300K Oracle License Elimination
★ Battlefield Scenario — Domain 4
$300K Oracle License Elimination
🚨 The Situation
Healthcare company. 40 on-premises servers running a Java monolith. $1.2M/year. Oracle DB license: $300K on top. Storage: 200 TB NAS. Workload: maxed out 8am–6pm, almost idle nights and weekends. CFO: 60% cost reduction in 18 months.
✅ The Cost Strategy
| Component | Today (On-Prem) | AWS Target | The Cost Strategy |
|---|---|---|---|
| Compute — Peak | 40 bare-metal servers | EC2 M6i + Auto Scaling | 3-year Compute Savings Plans — 66% off On-Demand |
| Compute — Off-hours | 40 servers sitting idle | Scheduled Auto Scaling → 2 instances off-hours | ~70% idle cost eliminated |
| Database | Oracle license $300K/yr | Amazon Aurora PostgreSQL | Zero license cost. Aurora = 1/10th total Oracle cost. |
| DB Migration | Oracle schema + data | AWS SCT converts schema · AWS DMS migrates live data | SCT runs first. DMS migrates with minimal downtime. |
| Storage — Hot | 200 TB NAS | Amazon EFS Standard | Pay per GB actually used. Zero over-provisioning. |
| Storage — Warm Archive | NAS archive tiers | S3 Standard-IA → Glacier Flexible lifecycle | IA after 30 days, Glacier after 90. |
| Storage — Cold Tape | Physical tape library | S3 Glacier Deep Archive | $0.001/GB. 95% cheaper than tape. |
| Batch Jobs | Dedicated batch servers always on | AWS Batch + Spot Instances | Spot = 90% off. Batch handles instance management. |
Pro Tip — Migration Sequence
AWS SCT → AWS DMS. SCT converts the schema. DMS moves the data. That’s the order. If a question asks about Oracle to Aurora migration — both tools, that sequence.
4.6 Chapter 4 Mastery Checklist
Chapter 4 — Cost-Optimized Architectures
0/8 complete
Domain 4 Complete — Design Cost-Optimized Architectures
Lock In the Wins: Cost-Optimized Architectures
Spot vs Reserved vs Savings Plans, S3 lifecycle economics, serverless cost decisions, and the free Gateway Endpoint trick — Domain 4 rewards candidates who can spot the cheapest architecture for a given constraint. Practice questions turn these patterns into automatic reflexes.
Domain 4-focused questions on EC2 purchasing, S3 lifecycle, Aurora Serverless, and DMS
Constraint-driven cost scenarios where two answers work — but only one is cheapest
Migration cost patterns — SCT → DMS, Spot + Batch, and VPC Endpoint elimination questions
Identify any remaining gaps across all 4 domains before your exam date
Full 390-question set — domain-organized, explanation-rich, exam-ready
390 practice questions · organized by exam domain · CloudExamPro
Part II — Elimination & Mastery System
Part II
The Elimination Playbook
You do not need to know the right answer to eliminate three wrong ones. AWS builds wrong answers with tells — kill phrases and scope mismatches that mark them as incorrect before you’ve even finished reading.
5.1 Kill-on-Sight Phrases
Every phrase below is always wrong on SAA-C03. The moment you see one, eliminate that answer.
✕
Manually patch the RDS database OSRDS is fully managed. AWS owns the OS entirely. You never touch it.
✕
Use Read Replicas for high availability or automatic failoverRead Replicas = async read performance. HA failover = Multi-AZ only.
✕
GuardDuty automatically blocks the trafficGuardDuty DETECTS and alerts only. It never blocks anything.
✕
Lambda for a multi-hour batch jobLambda max = 15 minutes. Hard ceiling. Multi-hour = Fargate or AWS Batch.
✕
Store RDS credentials in EC2 user data or environment variablesUser data is plaintext. It shows up in logs. Use Secrets Manager + IAM Role.
✕
Use NAT Gateway for private subnet S3 accessGateway VPC Endpoint is free and routes S3 traffic privately.
✕
CloudWatch to find who deleted a resourceWHO = CloudTrail. Always. CloudWatch = performance metrics.
✕
S3 Glacier for real-time or immediate accessGlacier = archive. Retrieval takes time. Immediate = S3 Standard or Standard-IA.
✕
Create an IAM User for an EC2 applicationEC2 apps use IAM Roles. Always. IAM Users are for humans.
✕
VPC Peering to connect dozens of VPCsVPC Peering is non-transitive. Doesn’t scale. Scale = Transit Gateway.
✕
SCP grants permissions to child accountsSCPs RESTRICT. They never grant permissions.
✕
EBS volume attached to multiple EC2 instances simultaneouslyStandard EBS = one EC2. Multi-instance shared storage = EFS.
✕
CloudFront for live TCP/UDP gaming trafficCloudFront = HTTP cache. Live TCP/UDP = Global Accelerator.
✕
AWS Config to find who changed a resourceConfig tracks WHAT the config state is. WHO = CloudTrail.
✕
DAX for DynamoDB write performanceDAX is a READ cache. It does nothing for writes.
5.2 Confusing Pair — Kinesis Data Streams vs Kinesis Firehose
Kinesis Data Streams
Your consumer code processes the stream (KCL, Lambda, EC2)
Multiple INDEPENDENT apps can read the same stream
Retention: 1 to 365 days — full replay capability
Shard-based — you provision shard count
Sub-second true real-time latency
Kinesis Data Firehose
Zero consumer code — managed delivery service end-to-end
Auto-scales with no shard management
No replay — delivers once to the destination
Destinations: S3, Redshift, OpenSearch, Splunk
Built-in Parquet/ORC conversion
#1 Differentiator
CUSTOM CONSUMERS + REPLAY = Data Streams. MANAGED DELIVERY TO DESTINATION = Firehose.
5.3 Confusing Pair — SQS Standard vs SQS FIFO
SQS Standard
At-least-once delivery — duplicates possible
Best-effort ordering — NOT guaranteed
Virtually unlimited throughput
No built-in deduplication
SQS FIFO
Exactly-once processing with built-in deduplication
Strict FIFO ordering guaranteed
300 msg/s standard · 3,000/s with batching
Message Group ID enables parallel ordered lanes
#1 Differentiator
EXACTLY-ONCE + ORDERED = FIFO. HIGH THROUGHPUT + DUPLICATES OK = Standard.
5.4 Confusing Pair — Network ACL vs Security Group
Network ACL (NACL)
SUBNET level — applies to every resource in the subnet
STATELESS — configure BOTH inbound AND outbound
Supports ALLOW and DENY rules
CAN block a specific IP address
Security Group
INSTANCE level — applies to a specific ENI
STATEFUL — return traffic automatically allowed
ALLOW rules ONLY — no deny rules
CANNOT block a specific IP address
#1 Differentiator
DENY RULE or BLOCK SPECIFIC IP = NACL. STATEFUL or INSTANCE-LEVEL = Security Group.
5.5 Confusing Pair — AWS Config vs AWS CloudTrail
AWS Config
Tracks WHAT a resource’s configuration IS over time
Evaluates compliance against rules
CAN auto-remediate non-compliant resources
Answers: WHAT the configuration state was
AWS CloudTrail
Tracks WHO did WHAT action and WHEN
Records every AWS API call with caller identity
Forensic audit trail for security investigations
Answers: WHO performed the action
#1 Differentiator
CONFIG = resource state + compliance. CLOUDTRAIL = who did what (API audit).
5.6 Six Ways AWS Tricks You Into Wrong Answers
T01The Scope Trap
AWS shows you a correct service at the wrong scale. VPC Peering works for two VPCs. Not 50. Scale words like ‘dozens,’ ‘centralized,’ ‘hundreds’ are locking you to Transit Gateway.
T02The Constraint Flip
Two services are both correct in isolation — but only one satisfies the stated constraint. Identify the constraint word first. Then eliminate.
T03The Cost Trap
AWS gives you an option that WORKS but costs more. NAT Gateway works for private subnet S3 access — but charges you. Gateway Endpoint is free. Eliminate anything that costs more for the same result.
T04The Managed Service Boundary
‘Who patches the RDS OS?’ Customer (wrong) vs AWS (right — it’s managed). Managed = AWS owns the OS. EC2 = you own the OS.
T05The Near-Right Architecture
90% correct architecture with one bad component. ALB + EC2 + Sticky Sessions (wrong) vs ALB + EC2 + ElastiCache (right). For scalable + stateful: externalize state.
T06The Multi-Select Confidence Trick
In Choose TWO questions, AWS adds a plausible-but-wrong third option. Lock in what you’re 100% certain about first. Then eliminate from what’s left.
· · ·
Part II
Advanced Exam Traps Library
Read every trap and honestly ask yourself: would I have fallen for that? If yes — mark it, review it twice, and move on.
Core SAA Traps T01–T30
T01 [D2]Read Replicas for High Availability
Multi-AZ = SYNCHRONOUS standby + automatic failover = HIGH AVAILABILITY. Read Replicas = ASYNCHRONOUS = read performance only. Not interchangeable. Ever.
T02 [D2]SQS for Fan-Out Messaging
SQS delivers each message to ONE consumer. Fan-out to multiple services = SNS (push to all subscribers) or SNS+SQS fanout (fan-out with durability).
T03 [D2]Multi-AZ for Geographic Disasters
AZs share the same geographic area. Earthquake or hurricane = all AZs go down together. Geographic resilience = Multi-Region only.
T04 [D2]Lambda for Hours-Long Batch Jobs
Lambda MAX = 15 minutes. Hard ceiling. No workaround. Multi-hour batch = AWS Batch or Fargate. Every time.
T05 [D2]VPC Peering to Scale to Hundreds of VPCs
VPC Peering is non-transitive. A connects to B, B connects to C — A cannot reach C through B. Hundreds of VPCs = Transit Gateway.
T06 [D2]NAT Gateway for Private Subnet S3 Access
Gateway VPC Endpoint routes S3 traffic privately and for FREE. NAT Gateway charges data processing fees.
T07 [D2]Sticky Sessions for Scalable HA Sessions
Sticky sessions reduce availability — if that instance dies, the session dies too. Scalable + HA sessions = externalize to ElastiCache or DynamoDB.
T08 [D3]EBS Volume Shared Across Multiple EC2
Standard EBS = ONE EC2 instance at a time. Multi-instance shared file system = EFS.
T09 [D3]On-Demand for Steady 24/7 Workloads
Steady, predictable 24/7 workloads = Reserved Instances (up to 72% off). On-Demand for unpredictable or short-term only.
T10 [D3]S3 One Zone-IA for Critical Non-Reproducible Data
One Zone-IA = single AZ. If that AZ fails, your data may be gone. Only correct when the question explicitly says data can be recreated.
T11 [D3]DAX for DynamoDB Write Performance
DynamoDB DAX is a read cache. It does nothing for writes. Stop looking at it for write acceleration.
T12 [D3]CloudFront for Live Dynamic TCP/UDP Traffic
CloudFront caches HTTP content. Live TCP/UDP dynamic traffic = Global Accelerator. Completely different purposes.
T13 [D1]SCP Granting Permissions
SCPs are guardrails that RESTRICT. They never grant permissions. Permissions come from IAM policies.
T14 [D1]Config for Finding Who Changed a Resource
Config tracks WHAT the configuration state is. WHO made the change = CloudTrail. Always.
T15 [D1]Storing Credentials in EC2 User Data
User data is plaintext visible in logs and instance metadata. Use Secrets Manager + IAM Role.
T16 [D1]GuardDuty Blocking Malicious Traffic
GuardDuty DETECTS and alerts only. It never blocks anything. Blocking = WAF (HTTP) or Security Group.
T17 [D1]Security Group Denying a Specific IP
Security Groups = ALLOW only. No deny rules. To DENY a specific IP = Network ACL. Only option.
T18 [D1]IAM User for Cross-Account Application Access
Cross-account application access = IAM Role with trust policy. IAM Users are for humans with permanent credentials.
T19 [D1]Parameter Store for Auto-Rotating DB Passwords
Parameter Store has zero built-in auto-rotation. Auto-rotate = Secrets Manager only.
T20 [D1]Inspector for Active Threat Detection
Inspector = proactive vulnerability ASSESSMENT (scans for CVEs). Active threat DETECTION = GuardDuty.
T21 [D4]Reserved Instances for Unpredictable Workloads
RIs require commitment. Unpredictable or spiky = On-Demand. Interruptible = Spot. RIs for steady 24/7 only.
T22 [D4]S3 Glacier for Frequently Accessed Data
Glacier = archive. Retrieval takes minutes to hours. Frequently accessed = S3 Standard.
T23 [D4]Interface Endpoint for Cost-Efficient S3 Access
Interface Endpoints cost ~$7/AZ/month. Gateway Endpoint for S3 and DynamoDB = FREE.
T24 [D2]Lambda Direct Invocation vs DynamoDB Streams
DynamoDB Streams + Lambda = decoupled, event-driven, scalable. Direct Lambda invocation = tightly coupled and fragile.
T25 [D3]FSx for Lustre vs EFS for HPC
FSx for Lustre = HPC parallel processing with sub-millisecond latency. EFS = general Linux NFS. HPC always means Lustre.
T26 [D3]ALB for TCP/UDP Gaming Traffic
ALB = HTTP/HTTPS at Layer 7. TCP/UDP gaming = NLB (Layer 4). Don’t load-balance gaming through ALB.
T27 [D3]S3 Transfer Acceleration vs DataSync
Transfer Acceleration = speed up global S3 uploads via CloudFront edge. DataSync = bulk migration from on-premises to S3/EFS/FSx.
T28 [D1]CloudHSM vs KMS for General Encryption
KMS = managed shared HSM. Great for most use cases. CloudHSM = FIPS 140-2 Level 3 dedicated hardware. Use only when compliance specifically demands it.
T29 [D2]S3 Versioning Alone Prevents All Data Loss
Versioning + MFA Delete prevents accidental deletion. Versioning alone still allows deletion via delete markers.
T30 [D3]Redshift for OLTP Transactional Workloads
Redshift = columnar storage, analytics, OLAP. OLTP transactions = RDS or Aurora. Never Redshift for transactions.
Advanced Traps AT01–AT10
AT01Cross-Account Role Fails Without a Trust Policy
Two requirements: (1) Trust policy on the ROLE in Account B listing Account A. (2) Identity policy in Account A allowing sts:AssumeRole. Miss either → access denied.
AT02AWS RAM Shares Subnets — Not Entire VPCs
RAM shares SPECIFIC RESOURCES — subnets, Transit Gateways, Route 53 Resolver rules. Participant accounts launch resources INTO shared subnets but cannot modify them.
AT03SCPs Do Not Apply to the Management Account
SCPs apply ONLY to member accounts and OUs. The management account is exempt from all SCPs — always.
AT04Consolidated Billing RI Sharing Can Be Turned Off
RI benefit sharing across linked accounts is ON by default — but can be disabled per account.
AT05Provisioned vs Reserved Concurrency — Opposite Jobs
Reserved Concurrency = a LIMIT (throttles above ceiling, FREE). Provisioned Concurrency = pre-initialized instances that eliminate cold starts (COSTS MONEY even idle).
AT06Fargate Is Not Always the Cheapest Container Option
For steady 24/7 containers, ECS on EC2 Reserved Instances beats Fargate. Fargate’s advantage is for variable or intermittent workloads.
AT07API Gateway Cache vs CloudFront Cache
API Gateway response cache = regional. ‘Reduce Lambda cost by caching’ = API Gateway cache. ‘Distribute API responses globally’ = CloudFront in front of API Gateway.
AT08AWS Managed Keys Cannot Be Shared Cross-Account
AWS Managed Keys: cannot modify key policy, cannot share cross-account. Customer Managed Keys (CMKs): CAN share cross-account by listing the other account as principal. Cost $1/month.
AT09Key Rotation Does Not Re-Encrypt Existing Data
KMS rotation creates a new backing key but retains all previous ones. Existing ciphertext is NOT automatically re-encrypted. Deleting a CMK = permanent data loss.
AT10Envelope Encryption — The DEK Pattern
KMS has a 4 KB limit per Encrypt API call. Large data needs envelope encryption: KMS generates a Data Encryption Key (DEK) → DEK encrypts the large data locally → KMS encrypts the DEK itself.
· · ·
Night Before
Rhythmic Memory Anchors
Coach’s Protocol
Stop all new material 12 hours before the exam. Read every anchor below out loud. Speaking reinforces recall more effectively than silent reading.
01
If it’s WHO — it’s CloudTrail. If it’s WHAT performance — it’s CloudWatch. If it’s WHAT config state — it’s Config. Three services. Three verbs. They never overlap.
02
If it goes UP and DOWN automatically — Elasticity. If it only GROWS — Scalability. Bidirectional + automatic = Elasticity only.
03
If it RECOVERS from failure automatically — Reliability pillar. If it IMPROVES PROCESSES — Operational Excellence.
04
If the data is RARE and you need it IMMEDIATELY — Glacier Instant Retrieval. If RARE and expedited retrieval OK — Glacier Flexible. The only word that matters is ‘immediately.’
05
DEDICATED PHYSICAL LINK + no public internet = Direct Connect. ENCRYPTED TUNNEL + quick + still uses internet = Site-to-Site VPN.
06
SQS = pull-based. One message to one consumer. SNS = push-based. Every subscriber gets every message simultaneously. Fan-out + durable = SNS feeding multiple SQS queues.
07
Multi-AZ = same region, synchronous standby, automatic failover = HIGH AVAILABILITY. Multi-Region = geographic disaster resilience. Not the same thing.
08
DETECT threats = GuardDuty. SCAN for CVEs = Inspector. BLOCK HTTP attacks = WAF. BLOCK DDoS = Shield. Four verbs. Four services. Never mix them.
09
CACHE content at the edge = CloudFront. ROUTE live traffic over the AWS backbone = Global Accelerator. Cache vs Route. Never swap these.
10
CODE without servers = Lambda. Maximum 15 minutes. CONTAINERS without servers = Fargate. BATCH JOBS that run for hours = AWS Batch.
11
Graph queries = Neptune. Data warehouse analytics = Redshift. NoSQL serverless = DynamoDB. In-memory microsecond = ElastiCache.
12
Auto-rotate database credentials = Secrets Manager ONLY. Store config values = Parameter Store. Different tools, different jobs.
13
STATEFUL + INSTANCE = Security Group. Allow only. STATELESS + SUBNET = Network ACL. Allow AND deny. Configure both directions.
14
SCP restricts what accounts can do. It NEVER grants permissions. Permissions come from IAM policies only.
15
EBS = one EC2 only. EFS = thousands of EC2 via NFS. FSx Lustre = HPC parallel. FSx Windows = SMB + Active Directory.
16
VPC Gateway Endpoint for S3 and DynamoDB = FREE. Always. Eliminates NAT Gateway cost for private subnet traffic.
17
RDS Multi-AZ = SYNCHRONOUS replication = HIGH AVAILABILITY. RDS Read Replicas = ASYNCHRONOUS = READ PERFORMANCE. Completely different.
18
Lambda hitting too many RDS connections = RDS Proxy. Proxy pools connections so Lambda spikes don’t overwhelm the database.
19
Cognito User Pools = WHO you are. Authentication. Cognito Identity Pools = WHAT you can access. Temporary AWS credentials.
20
Amazon Bedrock = pre-trained Foundation Model via API. No training required. Amazon SageMaker = custom training + fine-tuning + full ML lifecycle.
Exam-Day Protocol
T-12 hours
Stop all new material. Read anchors out loud once. Sleep early.
T-2 hours
Read Appendix D. Read anchors out loud once more.
At T-0
Read every question STEM completely. Find the constraint word first. THEN look at answer choices.
When stuck
Apply Kill-on-Sight from Chapter 5. Flag it. Move forward. Never stall.
Multi-select
Lock in what you’re 100% certain about. Eliminate from the rest.
During review
Change an answer only if you have a specific, concrete reason. First instinct with good reasoning usually holds.
Part III — Quick-Access Appendices
Appendix A
100 Must-Know Trigger Words
Cover the Answer column. Read the trigger phrase out loud. Say your answer before you look. That’s the level of automaticity you need.
| # | Trigger Phrase | Answer |
|---|---|---|
| 1 | who changed / who deleted / API audit | AWS CloudTrail |
| 2 | configuration compliance / drift detection | AWS Config |
| 3 | CPU / memory metrics / performance alarms | Amazon CloudWatch |
| 4 | compliance reports / SOC / PCI / ISO | AWS Artifact |
| 5 | best-practice recommendations | AWS Trusted Advisor |
| 6 | rightsizing / underutilized EC2 | AWS Compute Optimizer |
| 7 | threat detection / malicious activity | Amazon GuardDuty |
| 8 | vulnerability scan / CVE / network exposure | Amazon Inspector |
| 9 | sensitive data / PII / PHI in S3 | Amazon Macie |
| 10 | DDoS protection / flood attack | AWS Shield |
| 11 | DRT / DDoS Response Team access | AWS Shield Advanced |
| 12 | SQL injection / XSS / bots / geo-block / rate limit | AWS WAF |
| 13 | encryption keys / manage and audit keys | AWS KMS |
| 14 | auto-rotate DB credentials or API keys | AWS Secrets Manager |
| 15 | investigate root cause / security finding | Amazon Detective |
| 16 | aggregate all security findings centrally | AWS Security Hub |
| 17 | workforce SSO / multiple AWS accounts | AWS IAM Identity Center |
| 18 | app user sign-up / sign-in / authentication | Amazon Cognito User Pools |
| 19 | app user gets AWS temp credentials | Amazon Cognito Identity Pools |
| 20 | stateful firewall / instance level | Security Group |
| 21 | stateless / subnet level / deny specific IP | Network ACL (NACL) |
| 22 | serverless functions / event-driven code | AWS Lambda |
| 23 | serverless containers / no cluster management | AWS Fargate |
| 24 | long-running jobs / hours / batch compute | AWS Batch |
| 25 | deploy web app / no infrastructure to manage | AWS Elastic Beanstalk |
| 26 | IaC / infrastructure as code / templates | AWS CloudFormation |
| 27 | cheapest compute / tolerates interruption / batch | EC2 Spot Instances |
| 28 | steady 24/7 / committed / 1 or 3 year | Reserved Instances |
| 29 | flexible compute across EC2+Lambda+Fargate | Compute Savings Plans |
| 30 | dedicated physical server / BYOL | Dedicated Host |
| 31 | unknown access pattern / auto-tiering | S3 Intelligent-Tiering |
| 32 | infrequent access + immediate retrieval | S3 Standard-IA |
| 33 | rare access + millisecond retrieval required | S3 Glacier Instant Retrieval |
| 34 | archive + expedited (1-5 min) or hours OK | S3 Glacier Flexible Retrieval |
| 35 | 7–10 year compliance archive + no expedited needed | S3 Glacier Deep Archive |
| 36 | infrequent + reproducible + cheaper than Standard-IA | S3 One Zone-IA |
| 37 | shared file system / multiple EC2 / NFS protocol | Amazon EFS |
| 38 | block storage / attached to single EC2 | Amazon EBS |
| 39 | HPC / parallel processing / sub-ms file system | Amazon FSx for Lustre |
| 40 | Windows apps / SMB protocol / Active Directory | Amazon FSx for Windows |
| 41 | on-premises NAS extension to cloud | AWS Storage Gateway (File Gateway) |
| 42 | no internet / petabyte migration offline | AWS Snow Family |
| 43 | bulk file migration from on-premises to S3 or EFS | AWS DataSync |
| 44 | accelerate global S3 uploads via CloudFront edge | S3 Transfer Acceleration |
| 45 | graph database / fraud detection / relationships | Amazon Neptune |
| 46 | data warehouse / petabyte analytics / OLAP | Amazon Redshift |
| 47 | NoSQL / key-value / single-digit ms / serverless DB | Amazon DynamoDB |
| 48 | DynamoDB reads need microsecond latency | Amazon DynamoDB DAX |
| 49 | in-memory cache / microsecond / Redis or Memcached | Amazon ElastiCache |
| 50 | IoT sensors / time-series data / telemetry | Amazon Timestream |
| 51 | MongoDB-compatible / document database | Amazon DocumentDB |
| 52 | Apache Cassandra / wide-column workloads | Amazon Keyspaces |
| 53 | HA / automatic failover for RDS | RDS Multi-AZ |
| 54 | read performance / read scaling for RDS | RDS Read Replicas |
| 55 | serverless relational DB / variable load / scale to zero | Aurora Serverless v2 |
| 56 | global active-active relational database | Aurora Global Database |
| 57 | Lambda to RDS connection pooling issues | Amazon RDS Proxy |
| 58 | dedicated private link / no public internet / weeks to set up | AWS Direct Connect |
| 59 | quick encrypted tunnel / internet-based / set up in days | Site-to-Site VPN |
| 60 | Direct Connect backup or redundancy | VPN as Direct Connect backup |
| 61 | connect many VPCs / hub-and-spoke / centralized routing | AWS Transit Gateway |
| 62 | cache content globally / CDN / edge delivery | Amazon CloudFront |
| 63 | route live TCP/UDP traffic / AWS private backbone | AWS Global Accelerator |
| 64 | DNS / routing policies / health checks / failover | Amazon Route 53 |
| 65 | private S3 access from VPC / free / eliminate NAT cost | VPC Gateway Endpoint (FREE) |
| 66 | private access to other AWS services from VPC | VPC Interface Endpoint |
| 67 | HTTP/HTTPS/WebSocket LB / path-based routing | Application Load Balancer (ALB) |
| 68 | TCP/UDP extreme performance / static IP | Network Load Balancer (NLB) |
| 69 | inline third-party firewall or IDS/IPS appliance | Gateway Load Balancer (GLB) |
| 70 | estimate cost before building | AWS Pricing Calculator |
| 71 | analyze past costs / visualize spending trends | AWS Cost Explorer |
| 72 | set spending limit / alert when threshold hit | AWS Budgets |
| 73 | granular billing data / chargeback / raw cost data | Cost and Usage Report (CUR) |
| 74 | consolidated billing / single monthly invoice | AWS Organizations |
| 75 | SCPs / restrict member accounts / org-wide guardrails | AWS Organizations + SCPs |
| 76 | new multi-account setup / landing zone / governance | AWS Control Tower |
| 77 | share resources across accounts in the org | AWS Resource Access Manager (RAM) |
| 78 | speech to text / transcribe audio files | Amazon Transcribe |
| 79 | text to speech / generate voice output | Amazon Polly |
| 80 | image analysis / face detection / object recognition | Amazon Rekognition |
| 81 | extract text from documents / forms / OCR | Amazon Textract |
| 82 | chatbot / conversational AI interface | Amazon Lex |
| 83 | serverless SQL queries on S3 / no ETL needed | Amazon Athena |
| 84 | ETL pipeline / data catalog / data prep | AWS Glue |
| 85 | real-time streaming / continuous event ingestion | Amazon Kinesis Data Streams |
| 86 | managed streaming delivery to S3 or Redshift | Amazon Kinesis Firehose |
| 87 | build, train, and deploy ML models / full lifecycle | Amazon SageMaker |
| 88 | GenAI / foundation models / LLM via API | Amazon Bedrock |
| 89 | on-premises deployment with AWS APIs / hybrid hardware | AWS Outposts |
| 90 | auto-recover from failure / test recovery procedures | Reliability Pillar (Well-Architected) |
| 91 | decouple components / buffer requests / handle spikes | Amazon SQS |
| 92 | notify multiple subscribers at once / fan-out | Amazon SNS |
| 93 | ordered processing + exactly-once delivery | Amazon SQS FIFO |
| 94 | event-driven architecture / react to AWS events / schedule | Amazon EventBridge |
| 95 | migrate database with minimal downtime | AWS Database Migration Service (DMS) |
| 96 | lift-and-shift server migration to AWS | AWS Application Migration Service (MGN) |
| 97 | restrict S3 bucket access to entire org | S3 Bucket Policy + aws:PrincipalOrgID |
| 98 | FIPS 140-2 Level 3 / dedicated HSM hardware | AWS CloudHSM |
| 99 | SSL/TLS certificates for ALB / CloudFront / API GW | AWS Certificate Manager (ACM) |
| 100 | patch instances / run commands / manage EC2 fleet | AWS Systems Manager (SSM) |
Appendix B
24-Hour Emergency Cram Sheet
24 Hours Out
Do not open any other section. Do not watch YouTube. Read this page. Say the anchors out loud. Sleep 7+ hours. Walk in. Execute.
Domain 1 — Secure Architectures (30%)
✓
SCP = RESTRICT only · Permission Boundary = max cap on an IAM entity
✓
GuardDuty DETECTS · Inspector SCANS · WAF BLOCKS HTTP · Shield BLOCKS DDoS
✓
CloudTrail = WHO did WHAT · Config = WHAT config state · Detective = WHY it happened
✓
SCPs do NOT apply to the management account — always exempt
✓
Bedrock = pre-trained FM via API · SageMaker = custom training and fine-tuning
Domain 2 — Resilient Architectures (26%)
✓
RPO = data loss tolerance · RTO = downtime tolerance
✓
SQS = pull/decouple · SNS = push/fan-out · FIFO = ordered+exactly-once · EventBridge = event-driven
✓
Multi-AZ = HA within region · Multi-Region = geographic disaster
✓
DR order: Backup (restore) < Pilot Light (DB only) < Warm Standby (live small) < Active-Active
Domain 3 — High-Performing Architectures (24%)
✓
Glacier Instant = rare+immediately · Flexible = expedited or hours · Deep Archive = no expedited
✓
DynamoDB DAX = READ cache ONLY — does absolutely nothing for write performance
✓
CloudFront = cache content at edge · Global Accelerator = route live TCP/UDP traffic
✓
Gateway VPC Endpoint (S3/DynamoDB) = FREE — eliminates NAT Gateway cost
Domain 4 — Cost-Optimized Architectures (20%)
✓
Spot = 90% off, interruptible · 3-yr All Upfront RI = maximum savings · Savings Plans = most flexible
✓
24/7 steady containers → ECS on EC2 Reserved, NOT Fargate
✓
AWS SCT converts the schema → AWS DMS migrates the data (that exact order)
Kill-on-Sight — Your Final 10
✕
‘Read Replicas for HA/failover’→ Multi-AZ only. Always.
✕
‘GuardDuty blocks traffic’→ GuardDuty never blocks. It detects.
✕
‘Lambda for multi-hour batch’→ Lambda max is 15 minutes.
✕
‘SCP grants permissions’→ SCPs restrict only.
✕
‘EBS shared across multiple EC2’→ EBS = one EC2. Multi-instance = EFS.
✕
‘NAT Gateway for private subnet S3’→ Gateway VPC Endpoint is free.
✕
‘CloudWatch to find who changed a resource’→ WHO = CloudTrail.
✕
‘S3 Glacier for frequently accessed data’→ Glacier is archive. Frequent = Standard.
✕
‘IAM User for EC2 application’→ EC2 apps use IAM Roles.
✕
‘VPC Peering for dozens of VPCs’→ Transit Gateway. Peering doesn’t scale.
Appendix C
The 80/20 Priority Guide
Here’s where to put your time if you’re running short on study days.
🏋 Tier 1 — Must Own These (60% of study time)
| Concept or Service | Domains | Why It’s Tier 1 |
|---|---|---|
| VPC architecture — subnets, SGs, NACLs, IGW, NAT, endpoints | D1, D2 | It’s in nearly every SAA scenario |
| S3 storage classes + lifecycle rules | D3, D4 | 2–5 questions per exam. Highly predictable. |
| RDS Multi-AZ vs Read Replicas | D2, D3 | Most common DB trap. Appears multiple times. |
| IAM — Roles, Policies, Boundaries, SCPs, ABAC | D1 | Shows up across all question types |
| SQS vs SNS vs EventBridge — decoupling patterns | D2 | Decoupling is the core SAA pattern. |
| EC2 purchasing — Spot, RI, Savings Plans | D4 | 2–4 cost optimization questions per exam. |
| Load balancers — ALB vs NLB vs GLB | D2, D3 | Required for every scalable architecture scenario |
| Encryption — KMS, Secrets Manager, ACM, SSE modes | D1 | 30% of the exam is security. Encryption everywhere. |
| CloudFront vs Global Accelerator | D3 | Global architecture questions hit this pair frequently |
| Direct Connect vs VPN — hybrid connectivity | D3 | Every hybrid architecture question uses one of these |
🥈 Tier 2 — High Value (30% of study time)
| Concept or Service | Domain | Frequency |
|---|---|---|
| Database selection — Neptune, Redshift, DynamoDB, Aurora, Serverless | D3 | 2–3 Qs |
| ElastiCache — Redis vs Memcached patterns | D2, D3 | 1–3 Qs |
| Transit Gateway + VPC Peering topology decisions | D2, D3 | 1–2 Qs |
| S3 security — bucket policies, OAC, pre-signed URLs, CORS | D1 | 2–3 Qs |
| Lambda — Provisioned vs Reserved concurrency, RDS Proxy | D2, D3 | 2–3 Qs |
| ECS, EKS, Fargate — container architecture decisions | D2, D3 | 1–2 Qs |
| CloudTrail + Config + Security Hub + GuardDuty combined | D1 | 2–3 Qs |
| Cross-account access — RAM, role assumption, org policies | D1 | 1–2 Qs |
| Kinesis Streams vs Firehose — streaming architecture | D3 | 1–2 Qs |
| Bedrock vs SageMaker — GenAI architecture decision | D1, D3 | 1–2 Qs |
Appendix D
Morning-Of Checklist
1
Verify your exam slot and time zone
Log into Pearson VUE. Confirm the exact start time in YOUR local time zone.
2
Prepare your government-issued ID
Two forms if testing online. Primary: passport or driver’s license.
3
Test your webcam and microphone
Run Pearson VUE’s system check at least 30 minutes before your exam.
4
Close all background applications
Before launching the exam browser: close everything. Slack, email, browser tabs, music.
5
Check your internet connection
Wired ethernet if you have it. Run a speed test — minimum 3 Mbps stable.
6
Clear your workspace
Proctors do a webcam room scan. No papers, no notes, no second monitors.
7
Hydrate and eat a real meal
Balanced meal 60–90 minutes before you sit down. Hydrate.
8
Trust your sleep
If you slept 7+ hours, your preparation is better encoded than if you stayed up cramming.
9
Read the Rhythmic Anchors one final time
Open Chapter 7. Read the anchor pairs out loud — once. Five minutes.
10
Set your pace and breathe
130 minutes for 65 questions = 120 seconds each. Take one slow breath before you click Start.
Final Brief
You have the patterns. You have the traps. You have the anchors. 65 architectural challenges. Walk in. Execute. You’re ready.
CloudExamPro · SAA-C03 Premium Practice
Ready for the AWS Solutions Architect
Associate Exam?
Transform your knowledge into exam confidence with domain-focused practice questions and realistic exam scenarios — designed to close the gap between studying and passing.
390 Practice Questions
Organized by Domain
Detailed Explanations
Real Exam Scenarios
Track Weak Areas
Improve Exam Readiness
Instant access · Domain-organized · Exam-ready for 2026