AWS Solutions Architect Course in Pune — SAA-C03 Certification

How the SAA-C03 exam actually scores you (the four domains and their weightings), the question-writing patterns AWS uses (best vs least-bad answers, scenario keywords that signal which service is expected), test-day logistics. Then a foundations review — IAM principals / policies / roles, AWS Organizations + SCPs, Control Tower for multi-account, plus the shared responsibility model. By the end of week 1 every student has done their first 50-question diagnostic exam to establish baseline.

SAA-C03 is a design exam, not a services exam — but it assumes you already know what each service does, and a candidate who is still learning what an internet gateway is cannot evaluate an architecture that contains one. This week levels that floor in the console and the CLI rather than in slides.

You launch instances and understand the families and pricing models, work through S3 buckets, versioning and lifecycle, build a small VPC by hand, and set up IAM users, groups and roles. Anyone arriving from the AWS Cloud Computing course can treat this as revision; anyone arriving from a Cloud Practitioner background will need it.

The resilience material the exam tests hardest, framed the way its questions are framed: given an RTO and an RPO, which architecture meets them at the lowest cost. That pairing is the key — almost every resilience question is really a cost question with a constraint attached.

You work through the four documented DR strategies — backup and restore, pilot light, warm standby, multi-site active-active — and their real recovery times and price. Then Multi-AZ against read replicas and why they solve different problems, Route 53 failover and health checks, cross-region replication, and the difference between a highly available architecture and a fault-tolerant one, which the exam distinguishes and most candidates do not.

Resilience is the largest exam domain. Cover Multi-AZ vs Multi-Region patterns, Auto Scaling with target tracking and step scaling, Application Load Balancer + Network Load Balancer use cases, Route 53 routing policies (simple, weighted, latency, failover, geolocation, multi-value), RDS Multi-AZ vs read replicas vs Aurora Global, S3 replication (CRR, SRR, RTC), DynamoDB Global Tables, plus the disaster-recovery patterns (backup-restore, pilot light, warm standby, multi-site active-active). Domain-specific question drills throughout.

The pattern the exam rewards more than any other. A question that describes a tightly coupled system with a failing component almost always has a queue in the correct answer, and recognising that shape quickly is worth several marks.

SQS standard against FIFO, visibility timeout, dead-letter queues and long polling; SNS fan-out and the SNS-to-SQS pattern; EventBridge for event-driven routing and scheduled rules; and Step Functions for orchestration where a state machine beats application code. Kinesis is covered for streaming, with the distinction from SQS made explicit, because the exam tests exactly that boundary.

Performance domain. Cover compute selection (EC2 instance families and when each fits, Lambda performance tuning, ECS / EKS / Fargate trade-offs), storage selection (EBS volume types — gp3 / io2 / st1 / sc1, S3 storage classes and Intelligent-Tiering, EFS performance modes, FSx options), database performance (RDS instance scaling vs read replicas vs caching, DynamoDB capacity modes and DAX, ElastiCache Redis vs Memcached), plus content delivery and caching (CloudFront, Global Accelerator, ElastiCache). Domain-specific question drills throughout.

Storage questions are among the most reliably answerable on the exam, provided you know the selection criteria rather than the marketing. Block, file and object storage and which problems each is actually for; EBS volume types and the IOPS and throughput each delivers; EFS for shared POSIX access; and FSx for Windows and Lustre workloads.

S3 storage classes get the most time, including the retrieval charges and minimum durations that make Glacier Deep Archive the wrong answer for anything accessed monthly. Lifecycle policies, Intelligent-Tiering, Transfer Acceleration and Storage Gateway close the module, along with the migration services the exam expects you to distinguish.

The other reliably answerable family, and the one where a wrong choice in a scenario costs the whole question. Relational against non-relational and the access patterns that decide it; RDS engines, Multi-AZ, read replicas and backup behaviour; Aurora's storage architecture and why its failover characteristics differ.

DynamoDB gets proper treatment because the exam probes it: partition keys and hot partitions, on-demand against provisioned capacity, global and local secondary indexes, DynamoDB Streams and global tables. ElastiCache for Redis and Memcached covers caching strategies, and the module closes on the purpose-built services — Redshift, Neptune, DocumentDB, Timestream — at the level the exam actually tests, which is knowing which one a scenario is describing.

The single largest scored domain rests on this, and it is where careless candidates lose marks they could have kept. Policy evaluation logic taught precisely — explicit deny beats everything, then organisation SCPs, then permission boundaries, then identity and resource policies — because the exam writes questions that turn on exactly this order.

Roles and `sts:AssumeRole` for cross-account access; instance profiles so an application never holds a key; resource-based policies and where they differ from identity-based; Organizations, service control policies and permission boundaries; and identity federation with SAML, Cognito and IAM Identity Center. The rule enforced throughout is least privilege, which is also the exam's default correct answer.

The largest exam domain. IAM in depth — policy evaluation logic, permission boundaries, conditions, IAM Access Analyzer. Network security — Security Groups, NACLs, VPC endpoints (Gateway and Interface), PrivateLink, Direct Connect, VPN. Data security — KMS (CMKs, key rotation, envelope encryption), Secrets Manager vs Parameter Store, ACM, S3 encryption options, RDS encryption. Plus AWS WAF, Shield Standard / Advanced, GuardDuty, Macie, Inspector, Security Hub, plus the compliance baselines (PCI DSS, HIPAA, SOC 2). Domain-specific question drills throughout.

The rest of the security domain, and the part that appears in scenario questions about compliance. KMS keys — AWS-managed, customer-managed and customer-provided — key policies, envelope encryption, rotation and multi-region keys, plus CloudHSM and the narrow set of cases that genuinely require it.

Encryption at rest across S3, EBS, RDS and DynamoDB; encryption in transit with ACM, TLS termination choices and where the exam expects it terminated. Secrets Manager against Parameter Store, including the rotation difference that is usually the deciding factor. The module closes on the detective controls — CloudTrail, Config, GuardDuty, Security Hub, Macie and WAF — at the level of knowing which one a scenario needs.

Cost optimisation. Compute pricing (on-demand, spot, savings plans, reserved instances), storage tiering (S3 Intelligent-Tiering, lifecycle rules, Glacier classes), data-transfer costs (the often-forgotten exam topic), plus cost-optimisation tooling (Cost Explorer, Trusted Advisor, AWS Budgets, Cost Anomaly Detection). Domain-specific question drills throughout. Plus the discipline of reading exam questions for cost-optimisation keywords ('most cost-effective', 'minimise cost').

The framework the exam is written against, used as the review instrument it is meant to be. The six pillars — operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability — and the design principles under each, which is where a surprising number of question stems come from directly.

You then run a review on your own architecture from earlier weeks: identify the risks, propose remediation, and state the trade-off each one costs. That exercise is the closest thing the course has to the actual job, and it is also the best preparation for the exam's recurring shape — several technically valid answers, one that best matches a stated priority.

First full-length timed mock exam (65 questions, 130 minutes) under real exam conditions — including the Pearson VUE-style interface. Detailed answer review for every question, focusing on why the wrong options are wrong (the SAA-C03 grading model rewards understanding-of-trade-offs more than memorisation). Plus 5 architecture walkthroughs of common scenarios — three-tier web app, serverless event-driven app, BFSI compliance-aware setup, multi-region active-active, hybrid cloud — at whiteboard depth.

Second full-length mock exam under real exam conditions — students who score 75–85% on this mock typically pass the real exam first attempt. Final gap-closure on weak domains, exam-booking guidance (Pearson VUE registration, ID requirements, online vs centre considerations), test-day mental-prep, plus a 30-minute strategy session on time management during the exam. Includes 'what to do if you don't pass on first attempt' coaching.