This SAA-C03 study plan is for anyone preparing for the AWS Certified Solutions Architect – Associate exam in 2026. It covers what the exam looks like, how the domains are weighted, and a four week plan built around hands on labs. If you follow it and review every mistake you make, you will walk into the exam knowing why one design beats another, which is what the exam actually tests.
Quick answers
- Exam code: SAA-C03.
- Questions: 65, of which 50 are scored.
- Time: 130 minutes.
- Passing score: 720 out of 1000.
- Level: Associate.
- How long to study: about four weeks of steady practice if you already know basic cloud ideas. Add a week or two if you are new to AWS.
What the SAA-C03 exam tests
SAA-C03 is a design exam. Almost every question describes a company, a workload and a set of requirements, then asks which architecture meets all of them. The wrong answers usually work, but they break one requirement: they cost too much, need too much management, are not highly available, or are less secure than they should be.
That means memorizing service definitions is not enough. You need to recognize the requirement that decides the answer. Phrases like “least operational overhead”, “most cost effective” and “without code changes” are the real question.
SAA-C03 exam domains and weights
The exam guide (as of October 29, 2026) splits the exam into four domains:
| Domain | Weight |
|---|---|
| Design Secure Architectures | 30% |
| Design Resilient Architectures | 26% |
| Design High-Performing Architectures | 24% |
| Design Cost-Optimized Architectures | 20% |
Security is the largest domain, so do not leave IAM, encryption and network controls to the last week. Cost optimization is the smallest domain, but cost shows up as a tie breaker inside many other questions too.
The four week SAA-C03 study plan
The rule for every week: build small architectures in a sandbox account and break them on purpose. Delete resources when you finish to keep the bill low. Questions reward picking the simplest design that meets every requirement, and building is the fastest way to learn what simple looks like.
Week 1: Secure architectures (30%)
- Build a VPC with public and private subnets, a NAT gateway and an S3 gateway endpoint.
- Chain security groups for the load balancer, web and database tiers so each tier only accepts traffic from the one in front of it.
- Write a service control policy and an S3 bucket policy, then test exactly what they block.
- Encrypt an S3 bucket with SSE-KMS and store a database secret with rotation in Secrets Manager.
Week 2: Resilient architectures (26%)
- Deploy an Auto Scaling group across two Availability Zones behind an Application Load Balancer, then terminate an instance and watch it recover.
- Create an RDS Multi-AZ database and a read replica. Compare failover with read scaling. They solve different problems.
- Decouple two services with SQS, then add SNS fan out.
- Set up Route 53 failover routing with health checks.
Week 3: High-performing architectures (24%)
- Add ElastiCache in front of a relational database and DAX in front of DynamoDB.
- Put CloudFront in front of an S3 static site, then read how Global Accelerator differs.
- Stream test data through Kinesis Data Streams to a Lambda consumer.
- Compare EBS volume types, EFS, FSx for Lustre and FSx for Windows File Server.
Week 4: Cost optimization and review (20%)
- Write S3 Lifecycle rules and try S3 Intelligent-Tiering.
- Compare On-Demand, Savings Plans, Reserved Instances and Spot for three different workloads.
- Open Cost Explorer and AWS Compute Optimizer and read their recommendations.
- Do a full timed practice set, review every explanation, then take the official AWS practice exam on Skill Builder.
The service choices SAA-C03 tests most
Many questions come down to one requirement that points to one service. Learn these pairings until they are automatic:
| If the question says | Choose |
|---|---|
| Private access to S3 or DynamoDB from a VPC | Gateway VPC endpoint |
| Deny an action across all accounts | Service control policy |
| Rotate database credentials automatically | AWS Secrets Manager |
| Automatic database failover within a Region | RDS Multi-AZ |
| Cross Region relational disaster recovery | Aurora Global Database |
| Absorb traffic spikes and never lose work | SQS queue |
| Microsecond reads from DynamoDB | DAX |
| Static IP addresses for global users, UDP | Global Accelerator |
| Interruptible batch jobs at the lowest cost | Spot Instances |
| Unknown or changing access patterns in S3 | S3 Intelligent-Tiering |
Also know the classic comparison of security groups and network ACLs. Security groups are stateful, allow rules only, and apply to an instance or network interface. Network ACLs are stateless, allow and deny rules, and apply to a subnet.
Try two original SAA-C03 style questions
These are original practice examples written for this article, not real exam questions.
An application in private subnets reads large amounts of data from Amazon S3. The NAT gateway bill is high. What is the most cost effective way to reduce it?
Correct answer: C
A gateway endpoint sends S3 traffic over the AWS network without passing through the NAT gateway, and AWS charges nothing extra for gateway endpoints. Moving instances to public subnets would weaken security.
An order service must keep accepting orders during sudden traffic spikes, and no order may be lost if the processing tier is slow. Which design meets these requirements?
Correct answer: A
A queue buffers the spike and keeps every message until a worker processes it. Bigger instances still fail when traffic exceeds capacity.
Common SAA-C03 mistakes
- Confusing Multi-AZ with read replicas. Multi-AZ gives automatic failover for availability. Read replicas scale reads. If a question asks for both, you may need both.
- Picking the most powerful answer. A design with more services is not better. The exam usually wants the simplest design that meets every requirement.
- Ignoring the word “existing”. If the question says the company must keep an existing application unchanged, answers that require code changes are wrong, even if they are elegant.
- Studying only from videos. Watching someone build a VPC is not the same as building it. Every week in the plan above has hands on tasks for a reason.
Exam day tips
- Read the last sentence first. It tells you what to optimize for: cost, availability, performance or operational effort.
- Eliminate answers that break a requirement. Usually two options fall away quickly. Choose between the last two by checking every requirement in the question.
- Prefer managed services when the question mentions the least operational overhead.
- Flag and move on. With 130 minutes for 65 questions you have about two minutes each. Do not spend five minutes on one question in the first pass.
Frequently asked questions
Is SAA-C03 hard?
It is a step up from Cloud Practitioner because questions are long scenarios with several plausible answers. With hands on practice and a steady four week plan, it is very achievable. If you are completely new to AWS, start with our guide to choosing your first cloud certification.
Do I need Cloud Practitioner before SAA-C03?
No. There is no prerequisite. Cloud Practitioner helps if you have never used AWS, but many people go straight to the associate exam.
How long is SAA-C03 valid?
AWS certifications need recertification to stay active. Renewing an AWS certification extends it for three more years.
What should I study after SAA-C03?
If you want to move into AI, the AWS Generative AI Developer Professional (AIP-C01) builds on the same architecture skills. Our article on which AI certification to get first explains the options.
Practice before you book
Answer the free practice questions on our SAA-C03 page to see where you stand. When you are ready, the complete SAA-C03 guide ($19) gives you a full bank of original questions across all four domains, an explanation for every option, this four week plan with a cheat sheet, and interview questions for architect roles. Preparing for several exams? The All-Access Pass includes every guide.