SAP-C03 cheat sheet
Last-minute reference for the updated AWS Solutions Architect - Professional exam. Domain weights below come from the official AWS SAP-C03 exam guide. The decision tables are long-standing architecture patterns; verify service limits in current documentation.
Exam facts
| Questions | 75 (65 scored, 10 unscored) |
| Time | 180 minutes |
| Price | 300 USD |
| Types | Multiple choice, multiple response |
| Delivery starts | 17 November 2026 (SAP-C02 ends 16 November) |
| Passing score | 720 on a scale of 100 to 1,000 (SAP-C02 used 750) |
The five domains and weights
| Domain | Weight |
|---|---|
| 1. Architecture Design and Implementation Built for the Cloud | 25% |
| 2. Security, Compliance, and Governance | 25% |
| 3. Cost-Optimized Architecture Design | 15% |
| 4. Resilience, Migration, and Business Continuity | 15% |
| 5. Operational Excellence and Automation | 20% |
New skill areas (AWS announcement and exam guide)
| Area | Examples AWS names |
|---|---|
| Generative and agentic AI | Bedrock integrations, AgentCore, RAG, Guardrails, human oversight |
| Resilience engineering | Fault Injection Service, Resilience Hub, Application Recovery Controller |
| Cloud-native patterns | Step Functions, VPC Lattice, ECS Service Connect, multi-tenant designs |
| DevSecOps and observability | Pipeline scanning, multi-account pipelines, synthetic monitoring |
| Data and analytics | Lake Formation with Iceberg, Clean Rooms |
| Post-quantum cryptography | KMS with ML-DSA and ML-KEM |
Multi-account patterns
| Need | Answer |
|---|---|
| Guardrails across accounts | Organizations SCPs (they limit, never grant) |
| Central setup of new accounts | Control Tower landing zone |
| Share a resource without peering | Resource Access Manager |
| Central logging and security view | Dedicated log archive and security accounts, aggregated findings |
| Workforce sign-in to many accounts | IAM Identity Center |
Connectivity
| Requirement | Answer |
|---|---|
| Many VPCs and on-premises, transitive routing | Transit Gateway |
| Two VPCs, simple | VPC peering (non-transitive, no overlapping CIDRs) |
| Expose one service privately, overlapping CIDRs | PrivateLink |
| Private, consistent bandwidth to on-premises | Direct Connect (add VPN for encrypted backup) |
| Quick encrypted link | Site-to-Site VPN |
| Service-to-service routing in an app | VPC Lattice |
Disaster recovery
| Strategy | RTO / RPO | Cost |
|---|---|---|
| Backup and restore | Hours / hours | Lowest |
| Pilot light | Tens of minutes | Low |
| Warm standby | Minutes | Medium |
| Multi-site active-active | Near zero | Highest |
Pick the cheapest strategy that still meets the stated RTO and RPO.
Storage and database choices
| Requirement | Answer |
|---|---|
| Global relational, low-latency reads | Aurora Global Database |
| Key-value, multi-Region writes | DynamoDB global tables |
| Shared POSIX file system | EFS; FSx for Windows or Lustre for specialised needs |
| Archive, rarely read | S3 Glacier classes with lifecycle rules |
| Unknown access patterns | S3 Intelligent-Tiering |
Migration: the 7 Rs
| Strategy | Meaning |
|---|---|
| Rehost | Lift and shift |
| Replatform | Small optimisations, such as managed database |
| Refactor | Re-architect cloud-native |
| Repurchase | Move to SaaS |
| Retire | Switch it off |
| Retain | Keep on premises for now |
| Relocate | Move VMware or similar without changes |
Cost levers
| Lever | Use when |
|---|---|
| Savings Plans | Steady compute, flexible across services |
| Reserved Instances | Steady, specific instance usage |
| Spot | Interruptible, fault-tolerant work |
| Rightsizing and Graviton | Over-provisioned or portable workloads |
| Tiering and lifecycle | Data with falling access frequency |
Traps
- Every option may work. The question asks which meets all constraints with least operational effort.
- SCPs do not grant permissions. They only cap them.
- Peering is not transitive. Many VPCs means Transit Gateway.
- Over-building DR fails the cost constraint as surely as under-building fails the RTO.
- Keyword hunting (a service name in the stem) is weaker than reading the constraint.
Night-before checklist
- Five domains and weights: 25, 25, 15, 15, 20
- Passing score 720; compensatory scoring, no per-section pass
- DR ladder with RTO and RPO
- Transit Gateway versus peering versus PrivateLink
- The 7 Rs
- Pace: about 2.4 minutes per question
Plan with the study plan and see the sample questions.