SAA-C03 rarely asks "what is service X." It asks "which service fits this requirement," which means the exam is a set of decision rules more than a set of facts. This cheat sheet organizes those rules by the choice the exam makes you make, for final-week review and as a checkpoint while you study. For depth on anything here, the domains breakdown and the topic guides carry it.
Exam Quick Facts
The Four Trigger Words
Every scenario question optimizes for one thing, and a keyword in the stem tells you which domain lens to apply:
| Stem says... | Optimize for | Domain |
|---|---|---|
| "most secure," "least privilege," "encrypted" | Security | 30% |
| "highly available," "fault tolerant," "no downtime" | Resilience | 26% |
| "high performance," "low latency," "scale" | Performance | 24% |
| "cost-effective," "minimize cost," "cheapest" | Cost | 20% |
Read the stem for the trigger word first; it eliminates answers that solve a different problem well.
Preparing for SAA-C03? Practice with 390+ exam questions
Compute Selection
- EC2: full control, long-running, predictable load. Reserved/Savings Plans for steady, Spot for interruptible, On-Demand for spiky.
- Lambda: event-driven, short tasks, no server management, pay-per-invocation. The "cost-effective" answer for sporadic workloads.
- ECS/EKS/Fargate: containers; Fargate when "no infrastructure to manage" is in the stem.
- Auto Scaling + ELB: the default "make it resilient and elastic" pairing. ALB for HTTP/L7, NLB for TCP/UHP and static IP, GWLB for inline appliances.
Storage Decision Rules
Storage: pick by access pattern
| Need | Service / class | Key rule |
|---|---|---|
| Object store, frequent access | S3 Standard | Default for web assets, data lakes |
| Unknown / changing access | S3 Intelligent-Tiering | Auto-moves tiers; the safe cost answer when access is unpredictable |
| Infrequent, needs fast retrieval | S3 Standard-IA / One Zone-IA | One Zone = cheaper, no multi-AZ durability |
| Archive, minutes-to-hours retrieval | S3 Glacier Flexible / Deep Archive | Cheapest; Deep Archive for rarely-touched compliance data |
| Block storage for one EC2 | EBS (gp3 default, io2 for high IOPS) | Single-AZ; snapshot to S3 for durability |
| Shared file system, many EC2 (Linux) | EFS | Multi-AZ, elastic; NFS |
| Windows / high-perf file | FSx | FSx for Windows or Lustre (HPC) |
S3 durability is eleven nines; One Zone classes trade an AZ for lower cost. Lifecycle policies move objects between classes on a schedule. See the S3 storage classes guide.
Database Decision Rules
Databases: pick by shape
| Need | Service | Key rule |
|---|---|---|
| Relational, managed | RDS | Multi-AZ for HA (sync standby), read replicas for read scaling |
| Relational, cloud-native, high throughput | Aurora | 5x MySQL throughput; up to 15 read replicas; Serverless v2 for variable load |
| Key-value / document, single-digit ms, massive scale | DynamoDB | Serverless; partition key design matters; DAX for microsecond reads; global tables for multi-Region |
| In-memory cache | ElastiCache | Redis (persistence, pub/sub) vs Memcached (simple, sharded) |
| Data warehouse / analytics | Redshift | Columnar OLAP, not OLTP |
The classic exam trap: Multi-AZ is for availability, read replicas are for scaling reads. They are not interchangeable, and a question that says "improve read performance" wants replicas while "survive an AZ failure" wants Multi-AZ. Details in the databases guide.
Master These Concepts with Practice
Our SAA-C03 practice bundle includes:
- 6 full practice exams (390+ questions)
- Detailed explanations for every answer
- Domain-by-domain performance tracking
30-day money-back guarantee
Networking Quick Rules
- Security group = stateful, instance-level, allow rules only. NACL = stateless, subnet-level, allow and deny.
- NAT gateway = private subnets reach the internet outbound; Internet gateway = public subnet two-way.
- VPC endpoints keep traffic to AWS services off the public internet: Gateway endpoints (S3, DynamoDB, free) vs Interface endpoints (PrivateLink, most others).
- Route 53 policies: simple, weighted (A/B), latency (nearest Region), failover (HA), geolocation, geoproximity.
- Cross-VPC: peering (non-transitive) vs Transit Gateway (hub-and-spoke at scale). See the VPC guide.
Security Quick Rules
- IAM policy evaluation: explicit deny always wins; otherwise deny-by-default unless an allow matches.
- Prefer roles over long-lived access keys; roles for EC2, cross-account, and federation.
- KMS for managed keys and envelope encryption; enable encryption at rest (EBS, S3, RDS) and in transit (TLS).
- WAF for L7 filtering, Shield for DDoS, GuardDuty for threat detection, Security Hub for posture aggregation.
- Secrets go in Secrets Manager (rotation) or SSM Parameter Store, never in code or AMIs. See the IAM and security guide.
Resilience & Decoupling Quick Rules
- SQS: queue, pull-based, decouples producers from consumers, buffers load spikes. Standard (at-least-once) vs FIFO (ordered, exactly-once).
- SNS: pub/sub, push, fan-out to many subscribers. SNS + SQS fan-out is a canonical pattern.
- EventBridge: event bus with routing rules, SaaS and AWS event sources, schema registry. The "route events by content to different targets" answer.
- Multi-AZ survives an AZ failure; multi-Region survives a Region failure and cuts latency. DR spectrum: backup/restore < pilot light < warm standby < multi-site active/active (cost and RTO/RPO trade off). See HA and DR and decoupling.
Cost Quick Rules
- Compute commitment: Savings Plans / Reserved for steady (up to ~72% off), Spot for interruptible (up to ~90% off), On-Demand for unpredictable.
- S3 Intelligent-Tiering when access patterns are unknown; lifecycle to Glacier for archives.
- NAT gateway has an hourly and per-GB cost; a common "reduce cost" answer is a Gateway VPC endpoint for S3/DynamoDB traffic.
- Right-size with Compute Optimizer; find waste with Trusted Advisor and Cost Explorer. See the cost guide.
Final-Week Usage
Read the sheet top to bottom and mark any rule that produces hesitation, then take a timed practice exam and compare your misses against the marks. Two or three passes and the decision rules become reflex. Preporato's SAA-C03 practice exams supply the measurement half with 24 tests, explanations for every answer, and per-domain scoring.
Sources:
Last updated: July 10, 2026
Ready to Pass the SAA-C03 Exam?
Join thousands who passed with Preporato practice tests