SAA-C03 Cheat Sheet

#	Domain	Weight	Questions	Practice
1.0	Design Secure Architectures	30%	440	Practice →
2.0	Design Resilient Architectures	26%	361	Practice →
3.0	Design High-Performing Architectures	24%	316	Practice →
4.0	Design Cost-Optimized Architectures	20%	277	Practice →
Total	100%	1,394

Domain

Weight

Questions

Practice

1.0

Design Secure Architectures

30%

440

Practice →

2.0

Design Resilient Architectures

26%

361

Practice →

3.0

Design High-Performing Architectures

24%

316

Practice →

4.0

Design Cost-Optimized Architectures

20%

277

Practice →

Total

100%

1,394

Domain Quick Reference

1.0Design Secure Architectures

Secure architecture questions test IAM policies, VPC security controls, encryption at rest and in transit, and the right AWS security service for a given threat.

30%

Key concepts

✓IAM policies: identity-based, resource-based, permission boundaries.
✓VPC security: security groups vs NACLs, route tables, VPC endpoints.
✓Encryption: KMS, SSE-S3, SSE-KMS, client-side encryption.
✓AWS security services: GuardDuty, Inspector, Macie, Shield, WAF.

Watch out for

⚠Security groups are stateful; NACLs are stateless.
⚠KMS manages keys; it does not encrypt data directly.
⚠GuardDuty detects threats; Inspector assesses vulnerabilities; Macie finds sensitive data.
⚠A VPC endpoint keeps traffic off the public internet; it does not encrypt traffic.

2.0Design Resilient Architectures

High availability and resilience questions test multi-AZ vs multi-Region patterns, Auto Scaling, load balancing and the right service for a given recovery time objective.

26%

Key concepts

✓Multi-AZ vs multi-Region deployment trade-offs.
✓Auto Scaling policies and when to scale horizontally vs vertically.
✓Elastic Load Balancing: ALB, NLB, CLB and their use cases.
✓RTO and RPO targets matched to the correct AWS architecture.

Watch out for

⚠Multi-AZ protects against AZ failure; multi-Region protects against Region failure.
⚠Auto Scaling does not guarantee zero downtime without a load balancer.
⚠ALB operates at Layer 7; NLB operates at Layer 4.
⚠Pilot light is cheaper than warm standby but has longer recovery time.

3.0Design High-Performing Architectures

Pick EC2 instance families, EBS volume types (gp3, io2), S3 storage classes, ElastiCache, and RDS/Aurora read replicas to hit latency and throughput targets, then right-size with Auto Scaling and CloudWatch metrics so you never over-provision.

24%

Key concepts

✓Selecting EC2 instance families, burstable vs fixed performance, and placement groups for compute workloads
✓Choosing EBS volume types (gp3, io2, st1) and S3 storage classes or transfer acceleration for throughput
✓Deciding between ElastiCache Redis/Memcached, CloudFront, and Global Accelerator for latency reduction
✓Matching RDS/Aurora, DynamoDB, and Redshift engines with read replicas, DAX, or partitioning for scale

Watch out for

⚠Assuming a bigger instance always fixes performance when the bottleneck is actually IOPS, network, or a single-threaded application design.
⚠Confusing CloudFront (HTTP caching at edge) with Global Accelerator (TCP/UDP anycast routing) and picking the wrong one for the workload.
⚠Treating DynamoDB provisioned throughput like RDS and missing that hot partitions or poor key design cause throttling regardless of capacity.

4.0Design Cost-Optimized Architectures

Match workloads to the cheapest AWS option that still meets requirements: S3 lifecycle rules to Glacier, Spot/Reserved/Savings Plans for EC2, gp3 over gp2, and Aurora Serverless. Get right that cost decisions never break availability, durability, or performance.

20%

Key concepts

✓Selecting EC2 purchasing options: On-Demand, Reserved, Savings Plans, Spot, and Dedicated Hosts
✓Choosing S3 storage classes and lifecycle transitions, including Intelligent-Tiering and Glacier tiers
✓Matching EBS volume types (gp3, io2, st1, sc1) and snapshot costs to workload needs
✓Reducing cost with Auto Scaling, Lambda, serverless, and avoiding cross-AZ or NAT data transfer

Watch out for

⚠Assuming Spot Instances suit any workload; they can be interrupted, so they fail for stateful or uptime-critical systems unless architected for interruption.
⚠Ignoring data transfer and NAT Gateway charges, which can exceed compute costs in multi-AZ or internet-heavy designs.
⚠Overlooking S3 lifecycle minimum storage durations and retrieval fees, making Glacier or Infrequent Access more expensive than expected.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For SAA-C03, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

#	Domain	Weight	Questions	Practice
1.0	Design Secure Architectures	30%	440	Practice →
2.0	Design Resilient Architectures	26%	361	Practice →
3.0	Design High-Performing Architectures	24%	316	Practice →
4.0	Design Cost-Optimized Architectures	20%	277	Practice →
Total	100%	1,394

Domain

Weight

Questions

Practice

1.0

Design Secure Architectures

30%

440

Practice →

2.0

Design Resilient Architectures

26%

361

Practice →

3.0

Design High-Performing Architectures

24%

316

Practice →

4.0

Design Cost-Optimized Architectures

20%

277

Practice →

Total

100%

1,394

Domain Quick Reference

1.0Design Secure Architectures

Secure architecture questions test IAM policies, VPC security controls, encryption at rest and in transit, and the right AWS security service for a given threat.

30%

Key concepts

✓IAM policies: identity-based, resource-based, permission boundaries.
✓VPC security: security groups vs NACLs, route tables, VPC endpoints.
✓Encryption: KMS, SSE-S3, SSE-KMS, client-side encryption.
✓AWS security services: GuardDuty, Inspector, Macie, Shield, WAF.

Watch out for

⚠Security groups are stateful; NACLs are stateless.
⚠KMS manages keys; it does not encrypt data directly.
⚠GuardDuty detects threats; Inspector assesses vulnerabilities; Macie finds sensitive data.
⚠A VPC endpoint keeps traffic off the public internet; it does not encrypt traffic.

2.0Design Resilient Architectures

High availability and resilience questions test multi-AZ vs multi-Region patterns, Auto Scaling, load balancing and the right service for a given recovery time objective.

26%

Key concepts

✓Multi-AZ vs multi-Region deployment trade-offs.
✓Auto Scaling policies and when to scale horizontally vs vertically.
✓Elastic Load Balancing: ALB, NLB, CLB and their use cases.
✓RTO and RPO targets matched to the correct AWS architecture.

Watch out for

⚠Multi-AZ protects against AZ failure; multi-Region protects against Region failure.
⚠Auto Scaling does not guarantee zero downtime without a load balancer.
⚠ALB operates at Layer 7; NLB operates at Layer 4.
⚠Pilot light is cheaper than warm standby but has longer recovery time.

3.0Design High-Performing Architectures

24%

Key concepts

✓Selecting EC2 instance families, burstable vs fixed performance, and placement groups for compute workloads
✓Choosing EBS volume types (gp3, io2, st1) and S3 storage classes or transfer acceleration for throughput
✓Deciding between ElastiCache Redis/Memcached, CloudFront, and Global Accelerator for latency reduction
✓Matching RDS/Aurora, DynamoDB, and Redshift engines with read replicas, DAX, or partitioning for scale

Watch out for

⚠Assuming a bigger instance always fixes performance when the bottleneck is actually IOPS, network, or a single-threaded application design.
⚠Confusing CloudFront (HTTP caching at edge) with Global Accelerator (TCP/UDP anycast routing) and picking the wrong one for the workload.
⚠Treating DynamoDB provisioned throughput like RDS and missing that hot partitions or poor key design cause throttling regardless of capacity.

4.0Design Cost-Optimized Architectures

20%

Key concepts

✓Selecting EC2 purchasing options: On-Demand, Reserved, Savings Plans, Spot, and Dedicated Hosts
✓Choosing S3 storage classes and lifecycle transitions, including Intelligent-Tiering and Glacier tiers
✓Matching EBS volume types (gp3, io2, st1, sc1) and snapshot costs to workload needs
✓Reducing cost with Auto Scaling, Lambda, serverless, and avoiding cross-AZ or NAT data transfer

Watch out for

⚠Assuming Spot Instances suit any workload; they can be interrupted, so they fail for stateful or uptime-critical systems unless architected for interruption.
⚠Ignoring data transfer and NAT Gateway charges, which can exceed compute costs in multi-AZ or internet-heavy designs.
⚠Overlooking S3 lifecycle minimum storage durations and retrieval fees, making Glacier or Infrequent Access more expensive than expected.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For SAA-C03, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

SAA-C03 Exam Blueprint — At a Glance

Domain Quick Reference

1.0Design Secure Architectures

2.0Design Resilient Architectures

3.0Design High-Performing Architectures

4.0Design Cost-Optimized Architectures

Exam Day Reminders

More SAA-C03 resources

SAA-C03 Cheat Sheet

SAA-C03 Exam Blueprint — At a Glance

Domain Quick Reference

1.0Design Secure Architectures

2.0Design Resilient Architectures

3.0Design High-Performing Architectures

4.0Design Cost-Optimized Architectures

Exam Day Reminders

More SAA-C03 resources