SAA-C03 rarely asks "what is service X." It asks "which service fits this requirement," which means the exam is a set of decision rules more than a set of facts. This cheat sheet organizes those rules by the choice the exam makes you make, for final-week review and as a checkpoint while you study. For depth on anything here, the domains breakdown and the topic guides carry it.
Find out where you stand first
Take the free SAA-C03 sample questions cold (no signup, real exam style), then read on with your gaps in mind. When you are ready for full rehearsal, Preporato's SAA-C03 practice tests include 6 full-length exams (401 questions in total, domain-proportional, every answer explained) for a one-time $19.99 with lifetime access.
Exam Quick Facts
The Four Trigger Words
Every scenario question optimizes for one thing, and a keyword in the stem tells you which domain lens to apply:
| Stem says... | Optimize for | Domain |
|---|---|---|
| "most secure," "least privilege," "encrypted" | Security | 30% |
| "highly available," "fault tolerant," "no downtime" | Resilience | 26% |
| "high performance," "low latency," "scale" | Performance | 24% |
| "cost-effective," "minimize cost," "cheapest" | Cost | 20% |
Read the stem for the trigger word first; it eliminates answers that solve a different problem well.
Test yourself before you memorise anything. These three questions come from the free SAA-C03 sampler and use the real exam format.
Three quick SAA-C03 questions
An organization wants to delegate access to a set of users from the development environment so that they can access some resources in the production environment which is managed under another AWS account. As a solutions architect, which of the following steps would you recommend?
Create a new IAM role with the required permissions to access the resources in the production environment. The users can then assume this IAM role while accessing the resources from the production environment IAM roles allow you to delegate access to users or services that normally don't have access to your organization's AWS resources. IAM users or AWS services can assume a role to obtain temporary security credentials that can be used to make AWS API calls. Consequently, you don't have to share long-term credentials for access to a resource. Using IAM roles, it is possible to access cross-account resources.
A company has a web application that runs on Amazon EC2 instances in an Auto Scaling group. The application connects to an Amazon RDS for MySQL DB instance. A solutions architect needs to design a solution to protect the database credential. The solution must rotate the credentials automatically every 30 days. Which solution meets these requirements?
AWS Secrets Manager is designed to securely store, retrieve, and rotate database credentials and other secrets. It supports automatic rotation out-of-the-box for Amazon RDS.
A company plans to migrate a legacy application to AWS. The application requires a shared file system that supports the SMB protocol and integrates with Microsoft Active Directory. Which storage service should the solutions architect recommend?
Amazon FSx for Windows File Server provides fully managed shared storage built on Windows Server, supports SMB, and integrates with Active Directory.
Full SAA-C03 set: 6 timed exams, every answer explained, $19.99 one-time.
See the practice testsPreparing for SAA-C03? Practice with 390+ exam questions
Compute Selection
- EC2: full control, long-running, predictable load. Reserved/Savings Plans for steady, Spot for interruptible, On-Demand for spiky.
- Lambda: event-driven, short tasks, no server management, pay-per-invocation. The "cost-effective" answer for sporadic workloads.
- ECS/EKS/Fargate: containers; Fargate when "no infrastructure to manage" is in the stem.
- Auto Scaling + ELB: the default "make it resilient and elastic" pairing. ALB for HTTP/L7, NLB for TCP/UHP and static IP, GWLB for inline appliances.
Storage Decision Rules
Storage: pick by access pattern
| Need | Service / class | Key rule |
|---|---|---|
| Object store, frequent access | S3 Standard | Default for web assets, data lakes |
| Unknown / changing access | S3 Intelligent-Tiering | Auto-moves tiers; the safe cost answer when access is unpredictable |
| Infrequent, needs fast retrieval | S3 Standard-IA / One Zone-IA | One Zone = cheaper, no multi-AZ durability |
| Archive, minutes-to-hours retrieval | S3 Glacier Flexible / Deep Archive | Cheapest; Deep Archive for rarely-touched compliance data |
| Block storage for one EC2 | EBS (gp3 default, io2 for high IOPS) | Single-AZ; snapshot to S3 for durability |
| Shared file system, many EC2 (Linux) | EFS | Multi-AZ, elastic; NFS |
| Windows / high-perf file | FSx | FSx for Windows or Lustre (HPC) |
S3 durability is eleven nines; One Zone classes trade an AZ for lower cost. Lifecycle policies move objects between classes on a schedule. See the S3 storage classes guide.
Database Decision Rules
Databases: pick by shape
| Need | Service | Key rule |
|---|---|---|
| Relational, managed | RDS | Multi-AZ for HA (sync standby), read replicas for read scaling |
| Relational, cloud-native, high throughput | Aurora | 5x MySQL throughput; up to 15 read replicas; Serverless v2 for variable load |
| Key-value / document, single-digit ms, massive scale | DynamoDB | Serverless; partition key design matters; DAX for microsecond reads; global tables for multi-Region |
| In-memory cache | ElastiCache | Redis (persistence, pub/sub) vs Memcached (simple, sharded) |
| Data warehouse / analytics | Redshift | Columnar OLAP, not OLTP |
The classic exam trap: Multi-AZ is for availability, read replicas are for scaling reads. They are not interchangeable, and a question that says "improve read performance" wants replicas while "survive an AZ failure" wants Multi-AZ. Details in the databases guide.
Networking Quick Rules
- Security group = stateful, instance-level, allow rules only. NACL = stateless, subnet-level, allow and deny.
- NAT gateway = private subnets reach the internet outbound; Internet gateway = public subnet two-way.
- VPC endpoints keep traffic to AWS services off the public internet: Gateway endpoints (S3, DynamoDB, free) vs Interface endpoints (PrivateLink, most others).
- Route 53 policies: simple, weighted (A/B), latency (nearest Region), failover (HA), geolocation, geoproximity.
- Cross-VPC: peering (non-transitive) vs Transit Gateway (hub-and-spoke at scale). See the VPC guide.
Master These Concepts with Practice
Our SAA-C03 practice bundle includes:
- 6 full practice exams (390+ questions)
- Detailed explanations for every answer
- Domain-by-domain performance tracking
30-day money-back guarantee
Security Quick Rules
- IAM policy evaluation: explicit deny always wins; otherwise deny-by-default unless an allow matches.
- Prefer roles over long-lived access keys; roles for EC2, cross-account, and federation.
- KMS for managed keys and envelope encryption; enable encryption at rest (EBS, S3, RDS) and in transit (TLS).
- WAF for L7 filtering, Shield for DDoS, GuardDuty for threat detection, Security Hub for posture aggregation.
- Secrets go in Secrets Manager (rotation) or SSM Parameter Store, never in code or AMIs. See the IAM and security guide.
Resilience & Decoupling Quick Rules
- SQS: queue, pull-based, decouples producers from consumers, buffers load spikes. Standard (at-least-once) vs FIFO (ordered, exactly-once).
- SNS: pub/sub, push, fan-out to many subscribers. SNS + SQS fan-out is a canonical pattern.
- EventBridge: event bus with routing rules, SaaS and AWS event sources, schema registry. The "route events by content to different targets" answer.
- Multi-AZ survives an AZ failure; multi-Region survives a Region failure and cuts latency. DR spectrum: backup/restore < pilot light < warm standby < multi-site active/active (cost and RTO/RPO trade off). See HA and DR and decoupling.
Cost Quick Rules
- Compute commitment: Savings Plans / Reserved for steady (up to ~72% off), Spot for interruptible (up to ~90% off), On-Demand for unpredictable.
- S3 Intelligent-Tiering when access patterns are unknown; lifecycle to Glacier for archives.
- NAT gateway has an hourly and per-GB cost; a common "reduce cost" answer is a Gateway VPC endpoint for S3/DynamoDB traffic.
- Right-size with Compute Optimizer; find waste with Trusted Advisor and Cost Explorer. See the cost guide.
Final-Week Usage
Read the sheet top to bottom and mark any rule that produces hesitation, then take a timed practice exam and compare your misses against the marks. Two or three passes and the decision rules become reflex. Preporato's SAA-C03 practice exams supply the measurement half with 24 tests, explanations for every answer, and per-domain scoring.
Frequently asked questions
Sources:
Last updated: July 10, 2026
Ready to Pass the SAA-C03 Exam?
Join thousands who passed with Preporato practice tests