AWS SAA-C03 Certification

Apply the AWS shared responsibility model to a workload scenario.

Use resource tags and Cost Explorer to attribute AWS lab costs.

Determine effective access from identity policies, resource policies, permissions boundaries, session policies, and service control policies.

Design least-privilege access with IAM roles and temporary credentials.

Select IAM Identity Center or IAM federation for workforce access requirements.

Design cross-account access within an AWS Organizations structure.

Select AWS KMS key types and key policies for an encryption requirement.

Select Secrets Manager, Systems Manager Parameter Store, or CloudHSM for a secrets or key-management requirement.

Select CloudTrail, AWS Config, GuardDuty, Security Hub, and Amazon Inspector for a stated detection or audit requirement.

Select AWS WAF, AWS Shield, or AWS Network Firewall for a stated threat-protection requirement.

Create a non-overlapping IPv4 and IPv6 subnet plan spanning multiple Availability Zones.

Determine packet paths by interpreting VPC route tables and longest-prefix matching.

Select an internet gateway, egress-only internet gateway, NAT gateway, or NAT instance for an egress requirement.

Apply security groups and network ACLs to implement layered network controls.

Select gateway or interface VPC endpoints for private access to AWS services.

Configure VPC Flow Logs and use them to diagnose an allowed or rejected connection.

Design a highly available single-VPC network with public, private, and isolated subnets.

Select VPC peering, AWS Transit Gateway, or AWS PrivateLink for a connectivity requirement.

Design a resilient Site-to-Site VPN connection between an on-premises network and AWS.

Select an AWS Direct Connect architecture from bandwidth, resilience, and encryption requirements.

Use Route 53 public and private hosted zones to satisfy a DNS requirement.

Select Route 53 routing policies and health checks for a traffic-management scenario.

Select CloudFront or AWS Global Accelerator for a global application requirement.

Design centralized egress and traffic inspection across multiple VPCs.

Select an EC2 instance family and processor architecture for a workload profile.

Select EBS volume types, instance store, and EC2 placement strategies for a compute requirement.

Create a reusable EC2 launch template from configuration requirements.

Configure an Auto Scaling policy from demand and availability requirements.

Select an Application Load Balancer, Network Load Balancer, or Gateway Load Balancer for a traffic pattern.

Select On-Demand Instances, Savings Plans, Reserved Instances, or Spot Instances for a compute purchasing requirement.

Select Amazon ECS, Amazon EKS, AWS Fargate, Elastic Beanstalk, or AWS App Runner for a deployment scenario.

Configure S3 bucket policies, Block Public Access, object ownership, and encryption for secure object storage.

Select an S3 storage class and lifecycle policy from access-pattern and retention requirements.

Configure S3 versioning, replication, and Object Lock for a data-protection requirement.

Select EBS, EFS, FSx, or S3 for a workload's storage semantics.

Select AWS Backup features and vault controls for a centralized backup requirement.

Select DataSync, Storage Gateway, or AWS Transfer Family for an online data-transfer scenario.

Select an AWS Snow Family device for an offline migration scenario.

Choose S3 multipart upload, Transfer Acceleration, or CloudFront to improve object-transfer performance.

Select an RDS database engine from workload compatibility and operational requirements.

Distinguish RDS Multi-AZ deployments from read replicas in availability and scaling scenarios.

Select Aurora features for a high-availability, read-scaling, or cross-Region requirement.

Choose DynamoDB partition keys and capacity modes for a stated access pattern.

Select DynamoDB global tables, DAX, or Streams for a replication, caching, or event requirement.

Select ElastiCache for Redis or Memcached for an application caching requirement.

Select Redshift, Athena, OpenSearch Service, or EMR for an analytics scenario.

Select AWS DMS and AWS SCT for a homogeneous or heterogeneous database migration.

Select SQS Standard or FIFO queues and configure dead-letter handling for a messaging requirement.

Select Amazon SNS for fan-out and filtering requirements.

Select Amazon EventBridge for event routing and scheduled automation.

Select Kinesis Data Streams, Data Firehose, or Amazon MSK for a streaming-data requirement.

Design an AWS Step Functions workflow for a multi-step application process.

Configure a Lambda function's memory, timeout, concurrency, versions, and aliases for a stated requirement.

Select an API Gateway API type and authorization method for a serverless endpoint.

Design a loosely coupled application using queues, events, and idempotent consumers.

Derive recovery time objective and recovery point objective from business requirements.

Map a workload to backup-and-restore, pilot-light, warm-standby, or active-active disaster recovery.

Design a Multi-AZ application that tolerates an Availability Zone failure.

Design cross-Region recovery for EC2-based workloads using backups, replication, or Elastic Disaster Recovery.

Design cross-Region recovery for RDS or Aurora workloads.

Configure Route 53 failover logic for a regional outage scenario.

Design a multi-Region architecture while identifying consistency, failover, and cost trade-offs.

Select CloudWatch metrics, logs, alarms, dashboards, and synthetic checks for an observability requirement.

Use CloudTrail event history and AWS Config timelines to investigate a configuration change.

Select AWS X-Ray or CloudWatch Application Signals for application tracing requirements.

Use Compute Optimizer and Trusted Advisor findings to identify rightsizing opportunities.

Calculate the architectural impact of inter-AZ, inter-Region, internet, NAT gateway, and data-transfer charges.

Select caching at the client, edge, application, database, or storage layer for a performance bottleneck.

Recommend a cost-optimized redesign without violating stated availability and performance requirements.

Recommend a performance-optimized redesign without violating stated security and cost requirements.

Produce an architecture diagram for a highly available single-VPC three-tier workload.

Build a multi-AZ VPC with public, private, and isolated subnets from an address plan.

Deploy an internet-facing load-balanced EC2 tier that uses Auto Scaling.

Provide private workloads with controlled outbound and AWS-service access.

Apply least-privilege identity, encryption, and network controls to the capstone workload.

Validate the capstone's connectivity, monitoring, failure behavior, and estimated cost.

Produce a multi-account, multi-VPC, multi-Region architecture diagram for a hybrid enterprise scenario.

Remove capstone resources and verify that no unexpected billable resources remain.

Classify an exam scenario by its dominant security, resilience, performance, or cost requirement.

Translate qualifiers such as “most operationally efficient” and “least cost” into solution-selection criteria.

Eliminate plausible distractors by identifying the requirement each one violates.

Solve multiple-response questions by evaluating each option independently.

Complete a 65-question practice exam within the 130-minute exam limit.

Categorize practice-exam errors by service gap, architecture gap, or question-reading error.

Create a final revision plan from domain-level practice results and the 720 scaled-score requirement.