TL;DR: Both certs test the same cloud grammar with different vocabularies: regions and zones, the shared responsibility line, IaaS vs PaaS vs SaaS, scaling models, and pay-as-you-go pricing. Learn each concept once in provider-neutral words, then attach both names (EC2 and Virtual Machines, S3 and Blob Storage). Check current exam formats on the vendor pages linked under Sources; question counts and times change more often than concepts.
Why one sheet for two certs
AZ-900 teaches cloud concepts with Azure names. SAA-C03 teaches architecture decisions with AWS names. Underneath, the tested ideas rhyme: every region question is a latency-and-resilience question, every shared-responsibility question is a line-drawing question, every service-model question is a control-vs-convenience question. Candidates taking both (common for career switchers proving breadth) waste weeks relearning the same idea twice. This sheet teaches it once, then maps the names.
Concept 1: regions, zones, and edge
- Region. A geographic cluster of datacenters (US East, West Europe). Choosing a region answers latency (near your users), compliance (data stays in-country), and price (regions cost differently). Both exams ask where to place workloads and why.
- Availability Zone. Isolated datacenter(s) inside a region with independent power and networking. AWS names them explicitly (us-east-1a, 1b); Azure uses zone-redundant services over the same idea. Multi-AZ deployment is the standard answer to "survive a datacenter failure."
- Edge / CDN. Cached copies near users for static content and media. AWS CloudFront and Azure Front Door plus CDN are the same answer to "cut global load times."
- Exam phrasing. AZ-900 asks what a region or zone IS. SAA asks which placement survives a failure or meets a residency rule. Same facts, different verbs.
Concept 2: shared responsibility (the line)
- Provider side. Physical datacenters, hardware, hypervisors, and the managed service itself. "Security OF the cloud" in AWS words.
- Customer side. Data, identities, access rules, firewall configuration, and anything you install. "Security IN the cloud."
- The line moves with the service model. IaaS leaves you the OS and up; PaaS takes the OS and runtime; SaaS leaves you nearly only data and access. Both exams test this sliding line constantly: "who patches the OS" is IaaS-you, PaaS-provider.
- Never-shared items. Your data classification, your user accounts, your firewall rules. Any answer blaming the provider for an open storage bucket or a leaked key is wrong on both exams.
Concept 3: IaaS, PaaS, SaaS with both names
- IaaS (rent the machine). AWS EC2, Azure Virtual Machines. You manage OS, patching, scaling logic. Exam cue words: full control, lift-and-shift, custom OS.
- PaaS (rent the platform). AWS Elastic Beanstalk or RDS, Azure App Service or Azure SQL Database. You deploy code or use the database; the provider runs the runtime. Cue words: no server management, deploy code, managed database.
- SaaS (rent the app). Microsoft 365, Salesforce, AWS-managed SaaS offerings. You configure users and data. Cue words: subscribe, no infrastructure, per-user.
- Containers sit between. ECS/EKS and Azure Container Instances or AKS package apps portably. Both exams place containers between PaaS convenience and IaaS control; know them as the portability answer.
- Serverless is event-driven PaaS-plus. AWS Lambda and Azure Functions run code on triggers with no servers to see. Both exams test the billing twist: pay per execution, scale to zero, wrong for steady heavy loads that reserve cheaper capacity.
Concept 4: storage and database mapping
- Object storage. AWS S3, Azure Blob Storage. Files, backups, static sites, versioned and effectively limitless. The exam's default answer for unstructured data at scale.
- Block storage. EBS volumes, Azure Managed Disks. Disks attached to one VM at a time; the answer for databases and boot volumes.
- File storage. EFS/FSx, Azure Files. Shared folders many machines mount at once; the answer for lift-and-shift file shares.
- Relational managed DB. RDS (including Aurora), Azure SQL Database. Choose managed when the scenario says "minimize administration."
- NoSQL. DynamoDB, Cosmos DB. Massive scale, flexible schema, single-digit latency stories. The exam pairs them with global apps and spiky workloads.
- Security theme across all of it. Encryption at rest, private endpoints, and public-access blocks appear on both exams; open buckets and over-shared disks are the canonical misconfigurations.
Concept 5: networking and identity mapping
- Virtual networks. AWS VPC, Azure Virtual Network (VNet). Subnets, route tables, gateways, peering: the same SDN concepts with different console labels. Our subnetting cheat sheet covers the addressing math both assume.
- Hybrid links. Direct Connect and ExpressRoute are private pipes from on-premises to cloud; Site-to-Site VPN is the cheaper encrypted alternative. Exam logic: steady heavy traffic favors the private pipe, variable or small traffic favors VPN.
- Identity. AWS IAM and Azure Entra ID (formerly Azure AD) both test least privilege, roles over users, MFA everywhere, and federation with on-premises directories. The CIA and AAA guide explains the principles behind these services.
- DDoS and edge protection. AWS Shield, Azure DDoS Protection, and both WAF offerings answer the same "absorb the flood" scenarios.
Concept 6: scaling, resilience, and pricing
- Vertical vs horizontal. Bigger machine vs more machines. Both exams favor horizontal (more instances behind a load balancer: ELB or Azure Load Balancer) for availability, vertical for simple legacy apps.
- Auto Scaling. Scale sets and Auto Scaling groups add capacity on metrics. Know scale-out triggers (CPU, queue depth) and cooldowns; the exam asks what happens during sudden spikes.
- Backup and disaster recovery. Snapshots, geo-redundant storage, pilot-light and multi-site strategies. RTO/RPO define the target; both exams ask which strategy meets a stated RTO cheapest.
- Pricing models. Pay-as-you-go for variable loads, reserved or savings-plan capacity for steady loads, spot or low-priority for interruptible batch work. The TCO and pricing-calculator questions on both exams reduce to: steady means commit, spiky means elastic, idle means stop paying.
- Governance tooling. Cost Management plus Billing on either side, policy guardrails (AWS Organizations SCPs, Azure Policy), and tagging for chargeback. Tagging discipline is the unglamorous answer to "attribute cloud spend."
How to study both without doubling the work
Learn provider-neutral first (this sheet), then do one mapping pass per service family, then practice in each vendor's words. The cloud security career guide explains which cert to take first for a security career; the Security+ study plan remains the right prerequisite if networking and identity basics feel shaky.
Sources
- AWS Certified Solutions Architect Associate page
- Microsoft Azure Fundamentals AZ-900 page
- AWS shared responsibility documentation
- Microsoft Cloud Adoption Framework: shared responsibility
By SecLern Editorial. Published October 18, 2026. Updated October 18, 2026. Service mappings verified against current vendor documentation; exam formats change often, so confirm question counts and durations on the vendor pages above.