SAA-C03 — Solutions Architect Associate — AWS Study Hub

Exam Overview

Exam Details

Duration: 130 minutes
Questions: 65
Passing Score: 720/1000
Format: Multiple choice & multiple response
Cost: ~$150-300 USD
Validity: 3 years

🎓 Official Resources

Exam Domains

Domain	Weight
Design Secure Architectures	30%
Design Resilient Architectures	26%
Design High-Performing Architectures	24%
Design Cost-Optimized Architectures	20%

EC2 Deep Dive

Instance Type Families

Family	Types	Use Cases
General Purpose	T, M	Web servers, dev, code repos
Compute Optimized	C	Batch processing, ML, HPC, gaming
Memory Optimized	R, X, z	In-memory DBs, big data analytics
Storage Optimized	I, D, H	NoSQL DBs, data warehousing, Hadoop
Accelerated	P, G, Inf	GPU-based ML, video encoding

EC2 Storage Options

Storage	Type	Persistence	Key Facts
EBS gp3	Block	Persistent	Default SSD; 3,000 IOPS baseline; 16,000 max IOPS
EBS io2	Block	Persistent	High IOPS; 64,000 IOPS; Multi-Attach capable
EBS st1	Block	Persistent	Throughput HDD; big data, log processing
Instance Store	Block	Ephemeral	Physically attached; lost on stop; very high IOPS
EFS	File (NFS)	Persistent	Shared across many EC2; auto-scales; Linux only

S3 Deep Dive

Storage Classes

Class	Availability	Retrieval	Use Case
S3 Standard	99.99%	Instant	Frequently accessed data
S3 Intelligent-Tiering	99.9%	Instant	Unknown access patterns
S3 Standard-IA	99.9%	Instant	Infrequent, rapid retrieval
S3 One Zone-IA	99.5%	Instant	Reproducible infrequent data
S3 Glacier Instant	99.9%	Milliseconds	Archive, instant retrieval
S3 Glacier Flexible	99.99%	1-12 hours	Archive, flexible retrieval
S3 Glacier Deep Archive	99.99%	12-48 hours	Compliance archive, cheapest

💡 S3 Key Facts to Memorize

Max object size: 5 TB (multipart upload required for >5 GB)
Durability: 11 9s (99.999999999%)
S3 is region-scoped, bucket names are globally unique
Enable versioning to protect against accidental deletes
S3 Transfer Acceleration uses CloudFront edges to speed up uploads

VPC & Networking

Component	Function	Key Details
VPC	Isolated virtual network	Region-scoped; CIDR /16 to /28
Public Subnet	Has route to IGW	Resources can have public IPs
Private Subnet	No IGW route	Use NAT Gateway for outbound internet
Internet Gateway	Public subnet ↔ internet	Highly available; attach one per VPC
NAT Gateway	Private subnet → internet	Managed, per-AZ; needs Elastic IP
Security Group	Stateful firewall (instance)	Allow only; return traffic auto-allowed
NACL	Stateless firewall (subnet)	Allow & Deny; numbered rules
VPC Peering	Connect two VPCs	No transitive routing
Transit Gateway	Hub-and-spoke for VPCs	Transitive routing; scales to thousands
VPC Endpoint (Gateway)	Private S3/DynamoDB access	No NAT needed; free
VPC Endpoint (Interface)	Private access to 150+ services	PrivateLink; costs money

High Availability & Resilient Design

Load Balancers

Type	Layer	Protocols	Features
ALB	7	HTTP, HTTPS, gRPC	Path/host-based routing, Lambda targets, WAF
NLB	4	TCP, UDP, TLS	Static IP, ultra-low latency, PrivateLink
GLB	3	All IP	Inline inspection; route through firewalls/IDS

RDS Multi-AZ vs Read Replicas

Multi-AZ (HA)

Synchronous replication to standby
Automatic failover (~1-2 min)
Same Region only
Standby is NOT readable
For: disaster recovery

Read Replicas (Performance)

Asynchronous replication
Up to 15 replicas (Aurora), 5 (RDS)
Cross-Region possible
Replicas ARE readable
For: read-heavy workloads

Serverless Architecture

Service	Purpose	Key Limits
Lambda	Event-driven functions	15 min timeout, 10 GB memory, 1000 concurrent
API Gateway	HTTP API front door	29s timeout (REST), 10MB payload
DynamoDB	NoSQL database	400KB max item; unlimited storage
S3	Object storage	5TB max object; unlimited buckets
SQS	Message queue	256KB max message; 14-day retention
SNS	Pub/Sub notifications	256KB message; 10M subscribers per topic
EventBridge	Event bus	Schedule or pattern-based routing to 20+ targets
Step Functions	Workflow orchestration	Visual workflow; Lambda chaining; error handling

Security Services

Service	What It Does	Think of It As
KMS	Key Management Service — encryption keys	Encryption key vault
Secrets Manager	Store/rotate secrets, DB passwords, API keys	Password manager for apps (auto-rotation)
ACM	SSL/TLS certificate management	Free HTTPS certificates
WAF	Block SQLi, XSS, rate limiting at Layer 7	Web application firewall
Shield	DDoS protection (Standard=free, Advanced=paid)	DDoS protection
GuardDuty	Threat detection — analyzes VPC/DNS/CloudTrail logs	Automated threat detective
Inspector	Vulnerability scanning for EC2/ECR/Lambda	Security scanner
Macie	Discover sensitive data (PII) in S3	S3 data privacy guard