AWS Solutions Architect

Distinguish IAM users, groups, roles, identity-based policies, and resource-based policies.

Interpret the Effect, Action, Resource, Principal, and Condition elements of an IAM policy.

Use an IAM role and temporary credentials instead of long-lived access keys for an AWS workload.

Configure a cross-account role with matching trust and permissions policies.

Explain how AWS Organizations organizational units and service control policies limit account permissions.

Determine an authorization result using explicit deny, identity and resource policies, permissions boundaries, and service control policies.

Revise an overly broad IAM policy to enforce least-privilege access.

Select IAM Identity Center or external identity federation for a workforce-access scenario.

Divide a VPC CIDR block into appropriately sized, non-overlapping subnets.

Determine whether a subnet is public or private by inspecting its route table.

Select an internet gateway, NAT gateway, or egress-only internet gateway for a connectivity requirement.

Apply security-group statefulness and network-ACL statelessness to troubleshoot allowed and denied traffic.

Select a gateway endpoint, interface endpoint, or AWS PrivateLink service for private service access.

Configure Route 53 public and private hosted zones to resolve names for internet-facing and internal VPC workloads.

Compare VPC peering and AWS Transit Gateway for connecting multiple networks.

Select Site-to-Site VPN, Client VPN, or Direct Connect for a hybrid-connectivity scenario.

Select an EC2 instance family and size from a workload's CPU, memory, storage, and networking requirements.

Choose among EBS volume types and instance store based on durability and performance requirements.

Create a reusable EC2 deployment definition with an AMI, user data, and a launch template.

Distinguish Application, Network, and Gateway Load Balancers by protocol and use case.

Configure load-balancer health checks and target-group routing for an application tier.

Choose an Auto Scaling policy from target tracking, step scaling, scheduled scaling, and predictive scaling.

Design a Multi-AZ EC2 application tier that automatically replaces unhealthy instances.

Select ECS or EKS as a container orchestrator and EC2 or Fargate as its capacity model for a stated workload.

Select S3 bucket policies, access points, and Block Public Access settings for a stated access requirement.

Choose S3 server-side encryption with Amazon S3 managed keys, KMS keys, or customer-provided keys.

Select S3 versioning, MFA Delete, or Object Lock to meet a data-protection requirement.

Select an S3 storage class from access frequency, retrieval time, resilience, and minimum-duration requirements.

Create an S3 lifecycle policy that transitions and expires objects at specified times.

Select same-Region or cross-Region S3 replication for a compliance or resilience scenario.

Compare EBS, EFS, FSx for Windows File Server, and FSx for Lustre for a workload's storage interface.

Select AWS DataSync, Storage Gateway, Transfer Family, or Snow Family for a data-transfer requirement.

Select RDS, Aurora, DynamoDB, Redshift, or a self-managed EC2 database from a workload's data model and operational requirements.

Distinguish RDS Multi-AZ deployments from read replicas by their availability and scaling purposes.

Select an Aurora topology and replica option for a highly available relational workload.

Design a DynamoDB partition key that avoids uneven traffic distribution.

Choose DynamoDB read consistency, capacity mode, and capacity settings for a stated workload.

Select ElastiCache for Redis or Memcached for a database-caching requirement.

Select Athena, Redshift, or OpenSearch Service for an analytics or search scenario.

Choose AWS DMS and AWS SCT components for a heterogeneous database migration.

Choose Lambda execution-role, timeout, memory, concurrency, and VPC settings for a stated requirement.

Select an API Gateway REST, HTTP, or WebSocket API and an appropriate backend integration.

Use an SQS queue and dead-letter queue to decouple components and isolate failed messages.

Choose between SNS fan-out and SQS buffering for a message-delivery requirement.

Create an EventBridge rule that routes matching events to a target.

Model a retrying multi-step workflow with AWS Step Functions.

Select Kinesis Data Streams or Amazon Data Firehose for real-time stream ingestion, processing, or delivery.

Design an event-driven order-processing flow using API Gateway, Lambda, SQS, SNS, and a managed database.

Distinguish availability, durability, fault tolerance, backup, and disaster recovery in an architecture scenario.

Derive recovery time objective and recovery point objective requirements from a business scenario.

Choose a single-AZ, Multi-AZ, or multi-Region deployment from stated availability requirements.

Select backup scope, retention, vault, and cross-Region copy settings with AWS Backup.

Compare backup-and-restore, pilot-light, warm-standby, and multi-site disaster-recovery strategies.

Select a Route 53 routing policy and health-check configuration for failover or traffic distribution.

Build a cross-Region recovery design using appropriate replication options for S3, relational databases, and DynamoDB.

Design a disaster-recovery test that validates failover, data restoration, and return to normal operation.

Select an AWS KMS key type and key policy for an encryption requirement.

Explain how envelope encryption protects data while limiting direct KMS operations.

Choose Secrets Manager or Systems Manager Parameter Store for storing and rotating application secrets.

Use CloudTrail event history and trails to investigate an account-level API action.

Construct a CloudWatch monitoring plan using metrics, logs, alarms, and dashboards for a workload symptom.

Use AWS Config rules to detect configuration drift and noncompliant resources.

Select GuardDuty, Inspector, Macie, or Security Hub for a stated security finding requirement.

Select AWS WAF, Shield, or Network Firewall for a network or application threat.

Select CloudFront or Global Accelerator from protocol, caching, and global-routing requirements.

Choose CloudFront, ElastiCache, or DynamoDB DAX as the caching layer for a stated access pattern.

Use CloudWatch evidence to identify whether compute, storage, database, or network capacity is a workload bottleneck.

Choose On-Demand Instances, Spot Instances, Reserved Instances, or Savings Plans for a compute-usage pattern.

Use Cost Explorer, Cost Anomaly Detection, Compute Optimizer, and Trusted Advisor findings to identify a cost issue.

Calculate the cost effect of rightsizing, stopping idle resources, or changing purchase commitments in a scenario.

Reduce storage and data-transfer costs by changing placement, access patterns, or lifecycle settings.

Revise an architecture to improve cost efficiency without violating its security, resilience, or performance requirements.

Use an AWS CloudFormation template and change set to deploy or update a small, repeatable infrastructure stack.

Classify a workload migration using the retire, retain, rehost, relocate, repurchase, replatform, or refactor strategies.

Select Migration Evaluator, Migration Hub, or Application Discovery Service for a migration-assessment task.

Choose Application Migration Service for a server-rehost scenario.

Configure Route 53 Resolver inbound and outbound endpoints and rules for hybrid DNS resolution between a VPC and an on-premises network.

Explain how Control Tower establishes accounts, controls, identity access, and centralized logging in a landing zone.

Design a multi-account structure that separates production, nonproduction, security, and log-archive responsibilities.

Choose centralized or distributed VPC connectivity for a growing multi-account environment.

Translate an SAA-C03 scenario into explicit security, resilience, performance, cost, and operational constraints.

Eliminate implausible SAA-C03 answer choices by identifying service limitations and unmet requirements.

Draw an AWS architecture diagram that shows network boundaries, data flows, trust boundaries, and managed services.

Design a secure, highly available three-tier web architecture from a written business scenario.

Design a serverless architecture for a bursty event-driven workload with failure handling.

Justify an architecture's key service choices using measurable requirements and trade-offs.

Review an architecture against the six AWS Well-Architected pillars and prioritize improvements.

Classify errors from a timed SAA-C03 practice set and create a targeted remediation plan.