ExamFinch.com My Study

Cheat sheet

AWS Solutions Architect Cheat Sheet

Practice this exam

Secure Architectures

  • 30% of exam
  • Secure Access Data Security Network Security IAM Role vs User KMS vs Secrets

Resilient Architectures

  • 26% of exam
  • Resilient Patterns Disaster Recovery Decoupling Multi-AZ vs Multi-Region SQS vs SNS

High-Performing Architectures

  • 24% of exam
  • Compute Storage Database Networking Performance Picker

Cost-Optimized Architectures

  • 20% of exam
  • Pricing Models Storage Cost Compute Cost Cost Tools Cost Picker

Quick Facts

  • Exam SAA-C03
  • Credential Solutions Architect Associate
  • Questions 65 total
  • Scored 50 questions
  • Time 130 min
  • Pass 720/1000
  • Cost $150 USD
  • Level Associate
  • Experience 1 year recommended
  • Validity 3 years

Domain Weights SE

  • Secure leads; cost finishes
  • Secure 30 Resilient 26 Performance 24 Cost 20

IAM User vs Role SE

IAM user

  • Long-term credentials
  • Human or workload
  • Avoid shared keys

IAM role

  • Temporary credentials
  • Assumed access
  • Preferred pattern
  • Permanent vs temporary

Security Picker SE

  • Human AWS access → Identity Center ( SSO )
  • Temporary app access → IAM role ( STS )
  • Cross-account access → IAM role ( Trust policy )
  • Account guardrails → SCP ( Organizations )
  • Encrypt S3 objects → SSE-KMS ( Audit keys )
  • Rotate database secret → Secrets Manager ( Managed rotation )
  • Find PII in S3 → Macie ( Discovery )
  • Block SQL injection → WAF ( Layer 7 )

Secure Access SE

  • Root user Break-glass only
  • MFA Extra factor
  • IAM user Long-term identity
  • IAM role Temporary access
  • Policy JSON permissions
  • STS Temporary credentials
  • SCP Account guardrail
  • Identity Center Workforce SSO
  • Resource policy Service-side access

SG vs NACL SE

Security group

  • Instance level
  • Stateful
  • Allow only

NACL

  • Subnet level
  • Stateless
  • Allow and deny
  • Instance vs subnet

Data Security SE

  • KMS Key management
  • SSE-S3 S3-managed keys
  • SSE-KMS KMS-managed keys
  • SSE-C Customer-provided keys
  • Client encryption Encrypt before upload
  • ACM TLS certificates
  • Secrets Manager Rotating secrets
  • Macie Sensitive data discovery
  • Object Lock WORM retention

KMS vs Secrets Manager SE

KMS

  • Encrypt keys
  • Envelope encryption
  • Key policies

Secrets Manager

  • Store secrets
  • Rotate credentials
  • Retrieve values
  • Keys vs secrets

Network Security SE

  • Security group Stateful instance firewall
  • NACL Stateless subnet firewall
  • Public subnet Route to IGW
  • Private subnet No inbound internet
  • NAT gateway Outbound private internet
  • VPC endpoint Private AWS access
  • WAF Layer 7 filtering
  • Shield DDoS protection
  • Network Firewall Managed VPC firewall

DR Ladder RE

  • Backup, pilot, warm, active
  • Cheapest Core Scaled Fastest

Multi-AZ vs Multi-Region RE

Multi-AZ

  • One Region
  • Fast failover
  • Lower complexity

Multi-Region

  • Region outage
  • Higher cost
  • DR strategy
  • Local vs regional

Resilience Picker RE

  • Remove instance SPOF → ALB + ASG ( Multi-AZ )
  • Relational failover → RDS Multi-AZ ( Standby )
  • Loose coupling → SQS ( Buffer )
  • Fanout messages → SNS ( Pub/sub )
  • Event routing → EventBridge ( Bus )
  • Ordered workflow → Step Functions ( State machine )
  • Low-cost DR → Backup restore ( Slowest )
  • Lowest RTO → Active-active ( Costliest )

Resilient Patterns RE

  • Multi-AZ Local failover
  • Multi-Region Regional disaster tolerance
  • Auto Scaling Fleet elasticity
  • ELB Traffic distribution
  • Route 53 DNS failover
  • Health checks Route around failure
  • Immutable deploy Replace, not patch
  • Pilot light Minimal standby
  • Warm standby Scaled-down standby

SQS vs SNS RE

SQS

  • Queue
  • Pull consumers
  • Buffer spikes

SNS

  • Topic
  • Push fanout
  • Many subscribers
  • Queue vs broadcast

Disaster Recovery RE

  • RPO Maximum data loss
  • RTO Maximum downtime
  • Backup restore Lowest cost DR
  • Pilot light Core always running
  • Warm standby Reduced live stack
  • Active-active Two live Regions
  • AWS Backup Central backup policies
  • S3 CRR Cross-Region object copy

Decoupling RE

  • SQS Message queue
  • SNS Pub/sub fanout
  • EventBridge Event routing
  • Step Functions Workflow orchestration
  • API Gateway Managed API front
  • Lambda Event functions
  • DLQ Failed message capture
  • RDS Proxy Connection pooling

Storage Types PE

  • S3 objects, EBS blocks, EFS files
  • Object Block File

ALB vs NLB PE

ALB

  • HTTP routing
  • Path rules
  • Layer 7

NLB

  • TCP/UDP
  • Static IPs
  • Layer 4
  • HTTP vs TCP

Performance Picker PE

  • Need OS tuning → EC2 ( Instances )
  • Short event work → Lambda ( Serverless )
  • Container no servers → Fargate ( Managed compute )
  • Static global content → CloudFront ( Cache )
  • TCP low latency → NLB ( Layer 4 )
  • HTTP path routing → ALB ( Layer 7 )
  • Read-heavy SQL → Read replicas ( Scale reads )
  • Hot key-value reads → DAX ( DynamoDB cache )

Compute PE

  • EC2 OS control
  • Lambda Short event code
  • Fargate Serverless containers
  • ECS AWS container orchestration
  • EKS Managed Kubernetes
  • Batch Batch scheduling
  • EMR Big data clusters
  • Beanstalk Managed app platform
  • Outposts AWS on-premises

Well-Architected PE

  • OPSERS frames better choices
  • Operations Security Reliability Performance Cost Sustainability

S3 vs EBS PE

S3

  • Object storage
  • Regional durability
  • HTTP access

EBS

  • Block volume
  • AZ scoped
  • Attach EC2
  • Objects vs blocks

Storage PE

  • S3 Object storage
  • EBS AZ block volume
  • EFS Regional Linux file
  • FSx Managed file systems
  • Glacier Archive storage
  • Storage Gateway Hybrid storage
  • DataSync Online transfer
  • Transfer Family Managed SFTP
  • Snow Family Offline transfer

RDS vs DynamoDB PE

RDS

  • Relational SQL
  • Joins
  • Instance sizing

DynamoDB

  • Key-value
  • Serverless scale
  • Single-digit ms
  • SQL vs NoSQL

Database PE

  • RDS Managed relational
  • Aurora AWS relational engine
  • DynamoDB Serverless key-value
  • ElastiCache In-memory cache
  • Redshift Data warehouse
  • DocumentDB Document database
  • Neptune Graph database
  • RDS replica Read scaling
  • DynamoDB DAX Microsecond cache

CloudFront vs Global Accelerator PE

CloudFront

  • Caches content
  • HTTP workloads
  • Edge TTL

Global Accelerator

  • No caching
  • Anycast ingress
  • TCP/UDP
  • Cache vs accelerate

Networking PE

  • ALB Layer 7 routing
  • NLB Layer 4 speed
  • GWLB Appliance insertion
  • CloudFront CDN cache
  • Global Accelerator Anycast acceleration
  • Direct Connect Private circuit
  • Site VPN Encrypted internet
  • Transit Gateway Network hub
  • PrivateLink Private service access

Analytics Ingest PE

  • Kinesis Streams Real-time records
  • Firehose Managed delivery
  • Glue ETL catalog
  • Athena SQL on S3
  • Lake Formation Data lake governance
  • OpenSearch Search analytics
  • QuickSuite BI dashboards
  • MSK Managed Kafka

Pricing Fit CO

  • Steady commits; interruptible spots
  • Reserved Savings Plans Spot On-Demand

Reserved vs Savings Plans CO

Reserved

  • Instance attributes
  • RDS supported
  • Capacity option

Savings Plans

  • Spend commitment
  • Compute flexible
  • No capacity
  • Specific vs flexible

Cost Picker CO

  • Steady EC2 use → Reserved ( Commitment )
  • Flexible compute use → Savings Plans ( Commitment )
  • Interruptible jobs → Spot ( Cheapest )
  • Unknown traffic → On-Demand ( Flexible )
  • Rare S3 access → Glacier ( Archive )
  • Unknown S3 access → Intelligent-Tiering ( Automatic )
  • Find waste → Cost Explorer ( Analysis )
  • Alert overspend → Budgets ( Thresholds )

Cost Optimization CO

  • On-Demand No commitment
  • Reserved Steady instances
  • Savings Plans Flexible commitment
  • Spot Interruptible savings
  • Compute Optimizer Rightsizing recommendations
  • Cost Explorer Spend analysis
  • Budgets Spend alerts
  • CUR Detailed cost data
  • Lifecycle Automatic tiering
  • Intelligent-Tiering Access-based S3 tiers

Common Traps

Shared responsibility

  • AWS secures infrastructure ≠ Customer secures data

Private subnet outbound

  • NAT for internet ≠ Endpoint for AWS APIs

SG vs NACL

  • SG is stateful ≠ NACL is stateless

Multi-AZ reads

  • DB instance standby: no reads ≠ Replica scales reads

SQS vs SNS

  • SQS buffers ≠ SNS fans out

Object lock modes

  • Compliance blocks root ≠ Governance permits bypass

Spot workloads

  • Spot can interrupt ≠ On-Demand stays available

Cost tools

  • Explorer analyzes ≠ Budgets alerts

CloudFront vs S3 TA

  • CloudFront downloads ≠ TA accelerates uploads

VPN vs Direct Connect

  • VPN uses internet ≠ DX uses private circuit

Last Minute

  • 1. Weights: 30/26/24/20
  • 2. 720 pass; 50 scored
  • 3. Role beats shared keys
  • 4. SCP limits accounts
  • 5. SG stateful; NACL stateless
  • 6. NAT outbound only; IGW both ways
  • 7. S3 objects; EBS blocks
  • 8. EFS spans multiple AZs
  • 9. RDS Multi-AZ is standby
  • 10. Read replicas scale reads
  • 11. SQS buffers; SNS fans out
  • 12. Spot fits interruptible jobs
  • 13. Budgets alert; Explorer analyzes
  • 14. CloudFront caches at edge