TL;DR
SAA-C03 is 65 questions in 130 minutes, pass mark 720 on the 100 to 1000 scale, across four domains: secure architectures 30%, resilient architectures 26%, high-performing architectures 24%, cost-optimized architectures 20%. That is exactly 2 minutes per question, so fluency decides expensive items. This 8-week plan assumes basic cloud vocabulary and comfort with a command line, at an hour a day plus one lab evening a week. Every domain is learned as trade-offs between services, because the exam asks which design fits, never which service exists. Map: AWS SAA cert page.
The two-minute economy
130 minutes over 65 questions means long scenario stems must be parsed fast. Train this from week 1: read the final sentence first (it states the requirement), then scan the stem for constraints (budget, latency, availability target, existing services), then eliminate two choices on constraint violation before comparing survivors. AWS questions embed decisive words: MOST cost-effective, LEAST operational overhead, HIGHEST availability, MINIMUM latency. Each points to a different winner, and missing the word is the top miss cause in our data. Hands-on matters more here than on any non-CompTIA exam in this series: candidates who build the ten core architectures in a free-tier account answer from memory while readers derive from principles. The exam fee is 150 dollars, so one failed attempt costs more than eight weeks of disciplined labs. Compare tracks on the which-cert tool if you are torn between AWS and Azure.
Weeks 1 to 2: Secure architectures (30%, the largest domain)
Identity first: IAM users, groups, roles, and policies with least-privilege design, permission boundaries, service control policies at the organization level, cross-account roles versus resource policies, and temporary credentials from STS. Then network security: security groups (stateful, instance-level) versus network ACLs (stateless, subnet-level), public versus private subnets, NAT gateways for outbound-only private access, VPC endpoints for private AWS service access, and AWS WAF plus Shield for application-layer and DDoS protection. Data protection: KMS keys and envelope encryption, S3 default encryption and bucket policies versus IAM policies, RDS encryption at rest and in transit, Secrets Manager versus Parameter Store for credentials. Logging and audit: CloudTrail for API history, Config for configuration drift, GuardDuty for threat detection, CloudWatch Logs and metrics with alarms. Design patterns to drill: three-tier VPC with public load balancer, private app tier, isolated data tier; bastion versus Systems Manager Session Manager for admin access (the managed answer usually wins). Lab line: build the three-tier VPC with aws ec2 describe-vpcs verification, attach restrictive security groups, and break your own access once to learn the failure mode.
Weeks 3 to 4: Resilient architectures (26%)
Availability math first: a single AZ is a single point of failure, two AZs is the exam minimum for anything called highly available, three AZs for the serious tier. Compute resilience: Auto Scaling groups across AZs with health checks, ALB for HTTP routing with path rules, NLB for extreme throughput and static IPs, multi-AZ RDS with automatic failover versus read replicas for scaling reads, Aurora with storage replicated across three AZs. Decoupling: SQS queues absorbing bursts, SNS fan-out to multiple consumers, EventBridge for event-driven routing, dead-letter queues preserving failed messages, idempotent consumers surviving redelivery. Storage resilience: S3 cross-region replication and versioning, EBS snapshots to S3, EFS for shared multi-AZ file access, AWS Backup centralizing policies. DNS and traffic: Route 53 routing policies (failover, latency-based, geolocation, weighted), health checks driving failover, CloudFront origin failover. Disaster recovery tiers in order: backup and restore, pilot light, warm standby, multi-site active-active, with RTO and RPO tightening along the sequence. Exam scenarios name the tier indirectly through recovery objectives, so map every objective pair to its tier until automatic. Lab line: kill one AZ in your lab (stop instances, simulate with security group blocks) and watch the architecture keep serving.
Weeks 5 to 6: High-performing architectures (24%)
Performance as service selection. Compute: EC2 instance families matched to workload (general, compute-optimized, memory-optimized, storage-optimized, accelerated), launch types for containers (Fargate serverless versus EC2-managed), Lambda for event-driven bursts with concurrency limits and cold-start awareness, placement groups for low-latency clusters. Storage performance: EBS gp3 versus io2 (baseline versus provisioned IOPS), instance store for ephemeral speed with no durability, S3 Transfer Acceleration, multipart uploads. Databases: RDS versus Aurora versus DynamoDB selection by access pattern, DynamoDB DAX for read caching, Global Tables for multi-region writes, ElastiCache Redis versus Memcached (persistence and data structures versus simplicity), Redshift for analytics. Networking performance: CloudFront caching with TTL behavior, Global Accelerator for non-HTTP global traffic, Direct Connect for consistent hybrid bandwidth, VPC peering versus Transit Gateway at scale. Elasticity mechanics: scaling policies (target tracking, step, scheduled), warm pools, lifecycle hooks. Messaging at scale: Kinesis Data Streams versus Firehose (processing versus delivery), MSK for Kafka workloads. The exam tests bottlenecks by symptom: read-heavy means cache or replicas, write-heavy means partition or provision IOPS, spiky means queue plus scale, global means edge plus replicate. Lab line: load-test your week-3 app with a simple loop, find the breaking tier, fix it with one service, measure the difference.
Week 7: Cost-optimized architectures (20%)
Cost as an architecture input, not an afterthought. Pricing models: On-Demand for unpredictability, Reserved Instances and Savings Plans for steady state (compute commitments beat instance commitments for flexibility), Spot for fault-tolerant batch (with interruption handling as the tested skill), dedicated hosts for licensing constraints. Storage tiers: S3 Standard, Intelligent-Tiering for unknown patterns, Standard-IA and One Zone-IA for infrequent access, Glacier Instant, Flexible, and Deep Archive by retrieval urgency, lifecycle policies automating transitions, Compute Optimizer rightsizing, Cost Explorer and Budgets for governance, tagging strategy enabling chargeback. Design answers: Graviton instances for price-performance, Aurora Serverless for variable database loads, S3 lifecycle over manual cleanup, scheduled scaling for business-hours workloads, NAT gateway versus NAT instance cost awareness, data transfer costs (in free, out metered, cross-AZ metered) shaping multi-tier designs. The exam loves MOST cost-effective stems where the cheapest correct architecture wins over the technically fanciest. Drill twenty such stems in a row; the pattern vocabulary (scheduled, serverless, Intelligent-Tiering, Spot with checkpointing) repeats. Check the ports and protocols reference only if hybrid networking stems mention on-premises connectivity ports; otherwise this week is pure AWS economics.
Week 8: Full simulations and service recall
Two full 65-question sittings in 130 minutes, three days apart, then patch-only review of missed services. Service recall drill: for each of the fifty core services, state its one-line job, its scaling story, and its cost gotcha from memory; anything needing derivation gets a card. Question-type rehearsal: single-answer, multiple-response (read whether it wants two or three), and long case stems with the final-sentence-first technique. Retake economics: at 150 dollars per attempt plus study weeks, passing one week later with margin beats booking one week early with hope; book when fresh simulations clear 80% twice. Final 48 hours: whiteboard the four domain weights (30, 26, 24, 20) and the ten architectures you built, confirm Pearson VUE logistics per the cloud exam-day checklist, and stop. Exam-day stamina is fine at 130 minutes, but decision fatigue is real, so schedule the exam at your personal peak-alertness hour.
Practise with labs and PBQs
SAA-C03 is a service-selection exam, and the fastest way to learn a service is to break a small version of it. The pack holds 20 performance-based questions and 25 labs, run in a cloud console with the matching command line, and graded on the end state of the account rather than on the route you took (counts from the live catalogue).
Match them to the blocks. Weeks 1 and 2 get the identity, permission and encryption tasks, which is where the secure-architecture domain lives. Weeks 3 and 4 get resilience: multi-AZ patterns, health checks, failover behaviour. Weeks 5 and 6 get performance, including the caching and decoupling decisions that separate a working answer from a good one. Week 7 gets cost, where a lab that shows the bill move teaches more than a pricing table. Week 8 is simulations only.
The SAA-C03 lab catalogue lists each task with its objective, and the current-status guide covers the exam's version history before you book.
Who wrote this
SecLern Editorial. Format, timing, scoring, and domain weights were checked against the AWS exam page and SAA-C03 exam guide on 2026-10-18. Trade-off emphasis reflects our simulation data: SAA misses come from constraint words (MOST cost-effective, LEAST overhead), not from unknown services.