Most candidates walking into the SAA-C03 spend their prep time on high-availability patterns and Auto Scaling groups because those feel like "architect" topics. But Design Secure Architectures carries 30% of the exam on its own, more than any other domain, and it's the section where well-prepared candidates still lose points because IAM policy evaluation logic and VPC security layering don't get the same study hours as EC2 and S3. If you've been treating security as a warm-up section before the architecture questions, that's the gap this practice test is built to close.
SAA-C03 is organized into four scored domains, and the split isn't even close to equal:
Design Secure Architectures (30%) — IAM policy logic (identity-based vs. resource-based, explicit deny precedence), VPC security groups vs. NACLs, encryption at rest and in transit using KMS, and least-privilege access patterns for cross-account and third-party scenarios.
Design Resilient Architectures (26%) — Multi-AZ and multi-Region failover, decoupling with SQS, SNS, and EventBridge, and choosing between RDS Multi-AZ, read replicas, and Aurora Global Database depending on the failure scenario in the question.
Design High-Performing Architectures (24%) — Storage class selection (S3 storage tiers, EBS volume types, EFS vs. FSx), caching layers (ElastiCache, CloudFront), and database choice based on access patterns rather than just "which database is faster."
Design Cost-Optimized Architectures (20%) — Savings Plans vs. Reserved Instances vs. Spot, S3 Lifecycle policies, and right-sizing decisions that show up as "which option meets requirements at the lowest cost" rather than pure cost-cutting.
None of these domains are tested in isolation. A single scenario question will often touch security, resilience, and cost at once, which is exactly why memorizing service feature lists doesn't work here.
SAA-C03 candidates split into two groups with very different failure points. The first is systems administrators and infrastructure engineers moving from on-prem or basic AWS usage into architecture roles, who tend to know individual services well but struggle with the "design a solution that satisfies three competing constraints" framing of the questions. The second is developers and DevOps engineers who understand application architecture but haven't spent much hands-on time in the AWS console with VPC routing tables or IAM policy JSON, which is where they lose points in Domain 1.
Very few people take SAA-C03 as their first AWS credential. Most either hold AWS Certified Cloud Practitioner already or have 6-plus months of hands-on AWS exposure through work, because the exam assumes you already know what a VPC, subnet, and security group are and tests what you do with that knowledge under a business constraint.
The official SAA-C03 exam runs 65 questions in 130 minutes, split between straight multiple-choice and multiple-response questions where you must select exactly N correct answers — AWS tells you the number in the question stem. There's no partial credit on multiple-response items, which changes how you should approach practice: getting 3 of 4 correct answers on a 4-answer question is a full miss, not a partial win, so practicing to identify the exact set rather than "the closest sounding" answers matters more here than on single-answer questions.
Budget your practice pace at roughly 2 minutes per question, but expect multiple-response and long scenario stems to eat 3–4 minutes. A common pacing mistake is spending too long on the first 10–15 questions because they feel unfamiliar, then rushing the back third of the exam where fatigue and time pressure combine.
The passing score is 720 out of a scaled 1000, and AWS uses compensatory scoring — you don't need to individually pass each domain, but a poor showing in the 30%-weighted Security domain is very hard to make up for with strong performance elsewhere. That's the mathematical reason Domain 1 deserves more of your practice time than its "one out of four domains" framing suggests.
Don't just track your overall score — track your accuracy by domain. Because Security is weighted at 30%, a 90% score built on strong Cost and Resilience performance but weak Security performance is masking the exact failure pattern the exam will punish. After each practice session, sort your missed questions by domain and check whether Security questions are disproportionately represented.
Pay close attention to multiple-response questions in your results. If you're getting the right services but the wrong count of answers (for example, selecting 3 options on a "choose 2" question), that's a reading-the-stem problem, not a knowledge problem, and it's fixable by slowing down on the instruction line before you look at the answer choices.
Re-run questions you got right for the wrong reason. SAA-C03 scenario questions are written so that two answers often sound plausible, and one is a distractor built around a common misconception — like assuming a Multi-AZ RDS deployment protects against something it doesn't (data corruption, for instance, rather than infrastructure failure). Getting the right answer by elimination without understanding why the distractor is wrong will fail you on the next question that flips the same concept.
The single most common failure pattern is treating Security domain questions like a checklist rather than a decision tree. Candidates memorize "S3 bucket policies" and "IAM roles" as facts but freeze when a question asks them to choose between a resource-based policy and cross-account IAM role for the same access requirement — because the exam is testing the decision logic, not the vocabulary.
A close second is underestimating how many questions hinge on a single disqualifying detail in the stem — a mention of "no internet access allowed," a compliance requirement, or a specific RTO/RPO number that eliminates two of the four answers immediately. Candidates who skim scenarios for keywords instead of reading the full constraint list tend to pick an answer that's technically valid but violates a requirement buried in the second sentence.
Third, many candidates default to the most expensive or most "enterprise" sounding answer under the assumption that architects always want maximum redundancy. SAA-C03 frequently rewards the answer that meets the stated requirement at the lowest reasonable cost, not the most bulletproof possible design — over-engineering a solution when the question specifies cost-conscious constraints is a point-loser.
Build a one-page IAM policy evaluation reference (explicit deny beats explicit allow, no statement means implicit deny) and drill it until you can evaluate a policy JSON snippet in under 30 seconds — this single skill resolves a disproportionate share of Domain 1 questions.
Get comfortable distinguishing RTO from RPO in scenario language before you touch a single resilience question, since almost every Domain 2 scenario encodes its actual requirement as a disaster-recovery number rather than saying "use Multi-Region" outright.
Study S3 storage classes and EBS volume types side by side rather than separately, because Domain 3 questions frequently ask you to choose between them based on access-frequency and latency clues embedded in the scenario, not by name recognition.
Practice reading multiple-response question stems out loud (or at least twice) before looking at answer choices, specifically to catch the "select TWO" or "select THREE" instruction — this is the fastest fix for the most common format-based point loss on this exam Take a free AWS DOP-C02 mock exam test.
Work through the domain-tagged question sets below in the same proportion as the exam — spend roughly a third of your practice time in Security, then move through Resilience, Performance, and Cost in that order. After your first full run, come back to this page and re-take only the domains where your accuracy fell under 80%. That domain-by-domain retest is a more reliable signal of exam readiness than a single overall practice score, because SAA-C03's compensatory scoring means your weakest weighted domain is what actually decides pass or fail.
Last updated on Oct, 9 2026
