SAA-C03 — AWS Certified Solutions Architect – Associate Cheat Sheet

The SAA-C03 exam is not mainly a memorization test. It rewards choosing the AWS service or architecture pattern that best satisfies requirements such as:

• High availability and fault tolerance
• Security and least privilege
• Performance and scalability
• Cost optimization
• Operational simplicity
• Migration constraints
• Data durability, retention, and access patterns

This page is IT Mastery review support and is not affiliated with AWS.

Load Balancer Selection

EC2 Purchasing and Capacity

Amazon S3 Quick Decisions

EBS, EFS, and Instance Store

S3 high-yield concepts

S3 storage class selection

Common trap: Do not choose One Zone-IA for data that must remain resilient to AZ loss unless the scenario says the data is easily re-created.

EBS, EFS, FSx, and instance store

Trap: EBS volumes are AZ-scoped. If an EC2 instance needs access in another AZ, snapshots can be used to create a new volume there, but EBS is not a regional shared file system.

Storage decision path

    flowchart TD
	    A[Need storage?] --> B{Object, block, or file?}
	    B -->|Object| C[S3]
	    B -->|Block for EC2| D[EBS]
	    B -->|Shared Linux file| E[EFS]
	    B -->|Windows file share| F[FSx for Windows File Server]
	    B -->|HPC fast file processing| G[FSx for Lustre]
	    C --> H{Access pattern known?}
	    H -->|Frequent| I[S3 Standard]
	    H -->|Unknown or changing| J[S3 Intelligent-Tiering]
	    H -->|Archive| K[S3 Glacier classes]

RDS and Aurora Exam Traps

DynamoDB Cheat Sheet

Security Group vs NACL

VPC Endpoint Selection

Hybrid and Multi-VPC Connectivity

Edge and DNS

Messaging and event services

SQS review points

Common trap: If one message must be delivered to many subscribers, use SNS fanout, not a single SQS queue with multiple competing consumers.

Security Service Selection

Encryption and Key Management

Minimal Policy Pattern Examples

Deny non-TLS access to an S3 bucket:

{
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": [
    "arn:aws:s3:::example-bucket",
    "arn:aws:s3:::example-bucket/*"
  ],
  "Condition": {
    "Bool": {
      "aws:SecureTransport": "false"
    }
  }
}

Role trust policy concept for an AWS service assuming a role:

{
  "Effect": "Allow",
  "Principal": {
    "Service": "ec2.amazonaws.com"
  },
  "Action": "sts:AssumeRole"
}

IAM essentials

Common trap: Applications running on EC2 should usually use an IAM role attached to the instance profile, not stored access keys.

AWS Organizations controls

Trap: An SCP does not grant permissions. It only limits what can be granted by identity/resource policies.

KMS and secrets

Logging and detection

Trap: CloudWatch is not the same as CloudTrail. CloudWatch monitors metrics/logs; CloudTrail records API activity.

DR Strategy Comparison

Common Availability Traps

Trap 1: Ignoring “managed” and “least operational overhead”

If two answers work technically, the exam often favors the one with less administration when the scenario requests minimal operations.

Trap 2: Confusing HA with scalability

An Auto Scaling group may improve both availability and scalability, but an RDS read replica mostly improves read scalability, while Multi-AZ improves availability.

Trap 3: Choosing public access when private access is required

If the question asks for private connectivity to AWS services, consider:

• VPC gateway endpoints for supported services such as S3 and DynamoDB
• VPC interface endpoints powered by PrivateLink for many AWS services
• Private subnets with no direct inbound internet route
• Direct Connect or VPN for hybrid connectivity

Trap 4: Misreading “real-time”

“Real-time” can point to different services:

Trap 5: Overusing Multi-Region

Multi-Region designs can improve disaster recovery and latency but add cost and complexity. If the question only requires high availability within a Region, Multi-AZ is often enough.

Trap 6: Forgetting state

Stateless compute is easier to scale and replace. Store state in managed external services:

Monitoring, operations, and governance

Trap: For secure shell access without opening inbound SSH, Systems Manager Session Manager is often a better answer than a bastion host, assuming prerequisites are met.

Cost levers

Cost tools

Common trap: “Cheapest” is not always “best.” If the scenario requires high availability, durability, or compliance, avoid options that save money by violating stated requirements.

Shared responsibility model

AWS is responsible for security of the cloud. Customers are responsible for security in the cloud.

Exam trap: AWS manages more for serverless and managed services, but customers still configure identity, access, data classification, network exposure, and logging.

Security groups vs network ACLs

Common candidate mistake: Choosing a network ACL when the question asks for normal application access control. Security groups are the default control for instance-level access.

Public, private, and database subnets

VPC connectivity options

Trap: VPC peering is not transitive. If VPC A peers with B and B peers with C, A does not automatically reach C through B.

Route 53, CloudFront, and edge networking

Route 53 routing policy quick table

Auto Scaling

Trap: Auto Scaling improves elasticity and availability, but it does not by itself make a stateful application safe. Store state outside instances, such as in RDS, DynamoDB, EFS, S3, or ElastiCache.

Elastic Load Balancing

Containers and serverless compute

Decision rule: If the question emphasizes “run containers without managing servers,” look for Fargate. If it emphasizes “Kubernetes,” look for EKS.

Trap: Multi-AZ is for availability/failover, not read scaling in the usual SAA-C03 decision pattern. Read replicas are for read scaling.

NoSQL and purpose-built databases

Database decision rules

Disaster recovery approaches

Exam decision rule: If the question asks for the lowest cost DR option and can tolerate slower recovery, backup and restore is usually favored. If it asks for very fast recovery, warm standby or active-active may be more appropriate.

ALB vs NLB vs CloudFront

SQS vs SNS vs EventBridge vs Kinesis

RDS Multi-AZ vs read replica