AWS SA Associate prep
For architects and engineers who design secure, resilient, high-performing and cost-optimized systems on AWS, and want to prove it with the most popular associate-level cloud certification.
The real exam
| Exam code | SAA-C03 (exam guide v1.1, 29 Oct 2026) |
|---|---|
| Questions | 65 (50 scored, 15 unscored and unidentified) |
| Time | 130 minutes |
| Pass mark | 720 on a 100 to 1000 scaled score |
| Question types | Multiple choice (1 of 4) and multiple response (2 or more of 5 or more) |
| Scoring | Compensatory: you pass on the overall score, not per domain. No penalty for guessing |
| Fee | USD 150 |
| Delivery | Pearson VUE test centre or online proctored |
| Results | Provisional pass or fail on screen, scaled score within 5 business days |
| Retake | Wait 14 days after a fail, full fee each time |
| Valid for | 3 years |
What you get
Mocks follow the real rules: 65 questions in 130 minutes, flag and review.
Syllabus
Secure access with IAM and multi-account controls, protect workloads and networks, and encrypt and govern data.
Build loosely coupled, scalable systems and design for high availability, fault tolerance and disaster recovery.
Pick storage, compute, database, network and data ingestion services that meet performance and scale needs.
Choose the cheapest storage, compute, database and network designs that still meet requirements, and use cost tools.
Course outline
- Identity and access · 5 lessons
- Network and threat protection · 3 lessons
- Data protection · 2 lessons
- Scalable, loosely coupled architectures · 5 lessons
- High availability and disaster recovery · 5 lessons
- High-performing storage and compute · 5 lessons
- High-performing databases, networks and data pipelines · 5 lessons
- Cost-optimized storage and compute · 4 lessons
- Cost-optimized databases, networks and cost management · 5 lessons
Try a question
A logistics company has an IAM group named DataTeam with the AmazonS3FullAccess managed policy attached. A data analyst in that group also has an inline policy that explicitly denies s3:DeleteObject on the bucket named ledger-prod. The bucket has no bucket policy. The analyst tries to delete an object in ledger-prod from the console. What will happen?A. The delete succeeds because the managed policy on the group is evaluated after the inline policy on the user.B. The delete succeeds because AmazonS3FullAccess is an AWS managed policy and takes priority over customer policies.C. The delete fails because an explicit deny in any applicable policy overrides every allow for that request.D. The delete fails because a user who belongs to a group cannot have an inline policy attached at the same time.Show answer
A healthcare company uses AWS Organizations with 40 member accounts in several OUs. A new data residency rule says no workload can run outside the eu-west-1 and eu-central-1 Regions. The rule must apply even to users who have AdministratorAccess in a member account. Global services such as IAM must keep working. Which solution meets these requirements?A. Attach an IAM policy that denies other Regions to every administrator group in each member account.B. Attach an SCP to the OUs that denies requests when aws:RequestedRegion is outside the two Regions, exempting global services.C. Turn on AWS Config in every account with a custom rule and remediation that terminates resources outside the two Regions.D. Enable the EU Regions only and ask AWS Support to disable all other Regions for the organization.Show answer
Passwell is not affiliated with Amazon Web Services or Amazon.com, Inc. AWS, Amazon Web Services and all related marks belong to Amazon.com, Inc. or its affiliates. All questions are original practice items, not real exam questions. Facts checked 2026-11-14.