Most 30-Day Study Plans Are Built Backwards

Every SAA-C03 study plan I've seen online has the same structure: watch videos for three weeks, then cram practice tests in the last week and hope for the best.

That's backwards.

The people who pass the SAA-C03 in 30 days don't spend 80% of their time watching content. They spend 80% of their time testing themselves against real exam-style questions and reading the explanations for every wrong answer. The video course is the warm-up. The practice tests are the workout.

This plan is built on one principle: the SAA-C03 tests decision-making, not recall. You don't need to memorize 200 AWS service definitions. You need to look at a scenario with four plausible answers and identify which architecture best balances security, cost, performance, and resilience. That's a skill you build through practice, not through passive watching.

Quick exam facts before we start:

• Exam code: SAA-C03
• Questions: 65 (multiple choice and multiple response)
• Time: 130 minutes
• Passing score: 720 out of 1000
• Cost: $150 USD

---

Who This Plan Is For

This plan assumes you have some prior exposure to AWS. You don't need to be an expert, but you should know what EC2 and S3 are at a basic level.

This works if you:

• Have used AWS at work or through personal projects, even briefly
• Can commit 2 to 3 hours per day for 30 consecutive days
• Have passed Cloud Practitioner or have equivalent knowledge
• Are willing to take practice tests early and often, even when the scores are painful

This is not for you if:

• You've never heard of AWS before today (start with Cloud Practitioner first)
• You can only study 30 minutes a day (extend this to a 60-day plan at half pace)

The non-negotiable rule: You must take your first full practice test on Day 4. Not Day 25. Not "when I feel ready." Day 4. You will score somewhere between 40% and 55%, and that's exactly right. The diagnostic score tells you which domains to hit hardest for the remaining 26 days. Without it, you're guessing where to spend your time.

---

The Four Domains and Why Order Matters

The SAA-C03 is split into four domains, each with a different weight. This plan allocates study time proportionally to those weights. Most people study all four equally and over-prepare in areas they're already strong in.

Days 27 through 30 are for final practice tests, weak-domain review, and exam day.

Security gets the most days because it's worth the most points. Cost optimization gets the fewest because it's worth the fewest. That's not a coincidence. It's math.

---

Week 1: Secure Architectures (Days 1-8)

30% of your score comes from security. If you get this domain right, you can afford to be weaker elsewhere.

Day 1: Orientation and Baseline

Morning: Download and read the official SAA-C03 exam guide. Read the entire thing. This is the syllabus. Print it or save it. You'll reference it daily.

Afternoon: Set up your study environment. Bookmark the AWS documentation for the top 15 services. Create a tracking sheet: four columns (one per domain), and after every practice session, log which domains you got right and wrong.

The 15 services that appear most on SAA-C03:

• Compute: EC2, Lambda, ECS/Fargate, Auto Scaling
• Storage: S3, EBS, EFS
• Database: RDS/Aurora, DynamoDB, ElastiCache
• Networking: VPC, CloudFront, Route 53, ELB (ALB/NLB)
• Security: IAM, KMS

Day 2-3: IAM Deep Dive

IAM shows up in almost every question on the SAA-C03, either directly or as part of the answer.

Cover these concepts:

• Users, groups, and roles. Know when to use each.
• IAM policies: the JSON structure. Learn to read Effect, Action, Resource, and Condition blocks without guessing.
• Identity-based policies vs. resource-based policies. The exam loves this distinction.
• Cross-account access using IAM roles (sts:AssumeRole).
• AWS Organizations, Service Control Policies (SCPs), and how they interact with IAM policies.
• IAM Identity Center (formerly AWS SSO) and when to use it versus IAM roles.

Day 3 exercise: Write three IAM policies from scratch. One that allows read-only access to a specific S3 bucket. One that denies all actions except from a specific IP range. One that allows EC2 instances to read from DynamoDB using a role. If you can write these without looking at documentation, you understand IAM.

Day 4: First Diagnostic Practice Test

Take a full 65-question test. Timed. No pausing. No looking anything up.

Your score will be low. That's the entire point. Write down your domain scores. This is your baseline. The domains below 60% are your priority targets.

After the test, go through every single wrong answer. Read the explanation. Understand why the correct answer is correct and why each wrong answer is wrong. This review takes longer than the test itself. That's normal. This is where the real learning happens.

Day 5-6: VPC Networking and Security

VPC questions have the highest wrong-answer rate on the SAA-C03. The exam expects you to understand how traffic flows through a VPC at a granular level.

Cover these concepts:

• VPC, subnets, route tables, and the relationship between them
• Public vs. private subnets (the difference is a route table entry pointing to an Internet Gateway, nothing else)
• Security Groups (stateful, instance-level) vs. NACLs (stateless, subnet-level)
• NAT Gateway vs. Internet Gateway: when you need each
• VPC Peering vs. Transit Gateway for connecting multiple VPCs
• VPC Endpoints (Gateway endpoints for S3/DynamoDB, Interface endpoints for everything else)
• VPN and Direct Connect for hybrid connectivity

The VPC trap: The exam will describe an EC2 instance in a private subnet that can't reach the internet. Four answers will offer different fixes. If you don't understand the relationship between route tables, NAT Gateways, and Internet Gateways, you'll pick the answer that sounds right instead of the one that's architecturally correct. Trace the traffic path mentally. Start at the instance, follow it through the subnet route table, through the NAT Gateway, through the public subnet route table, out through the Internet Gateway. If any link is broken, that's your answer.

Day 7-8: Encryption and Security Services

Day 7 (Encryption):

• KMS: customer managed keys, AWS managed keys, key rotation
• Encryption at rest: S3 (SSE-S3, SSE-KMS, SSE-C), EBS encryption, RDS encryption
• Encryption in transit: TLS, ACM, HTTPS enforcement
• CloudHSM: when KMS isn't enough (regulatory requirements for dedicated hardware)

Day 8 (Security Services):

• WAF: protecting web applications from SQL injection, XSS
• Shield: Standard (free, automatic) vs. Advanced ($3,000/month, dedicated response team)
• GuardDuty: threat detection through log analysis
• Config: compliance tracking and resource configuration auditing
• CloudTrail: API call logging (management events vs. data events)

End of Week 1: Take 30 domain-specific practice questions on security. Compare to your Day 4 baseline.

---

Week 2: Resilient Architectures (Days 9-16)

This domain tests whether you can design systems that survive failures. The exam assumes things will break. Your job is to design architectures where failures don't bring down the whole application.

Day 9-10: EC2, Auto Scaling, and Load Balancing

• EC2 instance families: General Purpose, Compute Optimized, Memory Optimized, Storage Optimized. Know when to recommend each.
• EC2 pricing: On-Demand, Reserved Instances (Standard vs. Convertible), Savings Plans, Spot Instances.
• Auto Scaling Groups: launch templates, scaling policies (target tracking, step scaling, scheduled), cooldown periods
• ALB (HTTP/HTTPS, path-based routing) vs. NLB (TCP/UDP, ultra-low latency, static IP) vs. Gateway Load Balancer (third-party appliances)
• Placement groups: Cluster (low latency), Spread (high availability), Partition (distributed workloads)

Day 11: Serverless Compute

• Lambda: execution model, concurrency limits, cold starts, integration with API Gateway, S3, SQS, DynamoDB
• Fargate: serverless containers, when to use Fargate vs. EC2-backed ECS
• The decision framework: Lambda for event-driven short tasks (under 15 minutes), Fargate for long-running containers, EC2 for full OS control

Day 12-13: Storage Deep Dive

Day 12 (S3):

• Storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive. Know the retrieval times and cost differences.
• Lifecycle policies for automatic transitions
• Cross-Region Replication vs. Same-Region Replication
• Versioning, MFA Delete, Object Lock (compliance mode vs. governance mode)
• Transfer Acceleration for fast uploads across long distances

Day 13 (Block and File Storage):

• EBS volume types: gp3, io2, st1, sc1. Know the IOPS and throughput numbers.
• EBS snapshots: incremental, stored in S3, can copy cross-region
• EFS: shared file storage for Linux, scales automatically
• FSx: Windows File Server (SMB, Active Directory) and Lustre (HPC)
• Instance store: ephemeral. Data lost on stop or terminate.

Day 14: Second Full Practice Test

Full 65-question test. Timed. Compare to Day 4. You should be 10 to 15 points higher. If not, slow down and spend more time on wrong answer explanations.

Day 15-16: Decoupling and Application Integration

The exam wants you to pick loosely coupled architectures over tightly coupled ones. Every time.

• SQS: Standard queues (at-least-once, best-effort ordering) vs. FIFO (exactly-once, strict ordering, 300 TPS limit)
• SNS: pub/sub messaging, fan-out pattern (one SNS topic to multiple SQS queues)
• EventBridge: event-driven architectures, routing events between services
• Step Functions: multi-step workflows with retry logic and error handling
• The fan-out pattern: API Gateway → Lambda → SNS → 3 SQS queues for parallel processing. Know this cold.

---

Week 3: High-Performing Architectures (Days 17-22)

This domain tests whether you can pick the right service for the right job based on performance requirements.

Day 17-18: Databases

Day 17 (Relational):

• RDS Multi-AZ (synchronous standby, automatic failover) vs. Read Replicas (asynchronous, read scaling, up to 15 replicas)
• Aurora: MySQL/PostgreSQL compatible, 6 copies across 3 AZs, up to 128 TB, Aurora Serverless for unpredictable workloads
• The pattern: "needs high availability with automatic failover" = Multi-AZ. "needs to scale read capacity" = Read Replicas.

Day 18 (Non-relational and Caching):

• DynamoDB: key-value/document store, single-digit ms latency, provisioned vs. on-demand
• DAX: in-memory cache for DynamoDB, microsecond reads
• ElastiCache: Redis (complex data types, persistence) vs. Memcached (simple caching, multi-threaded)
• Decision framework: SQL + joins + transactions = RDS/Aurora. Key-value at scale = DynamoDB. Session/query cache = ElastiCache.

Day 19: Content Delivery and DNS

• CloudFront: edge caching, Origin Access Control for S3, Lambda@Edge
• Route 53 routing policies: Simple, Weighted, Latency-based, Failover, Geolocation, Geoproximity, Multivalue Answer. Know when to use each.
• Route 53 health checks and automated failover

Day 20-21: Migration and Management Services

• DMS: database migrations, continuous replication
• Snow Family: Snowcone (8 TB), Snowball Edge (80 TB), Snowmobile (100 PB). Know the volume thresholds.
• DataSync: automated data transfer (NFS, SMB to S3, EFS, FSx)
• CloudFormation and Systems Manager basics
• CloudWatch: metrics, alarms, logs, dashboards

Day 22: Third Full Practice Test

Target: 75%+. If you're consistently hitting 80%, you're on track. If you're below 70%, add study hours for Week 4.

---

Week 4: Cost Optimization, Review, and Exam (Days 23-30)

The sprint. You know the material. Now sharpen the edges.

Day 23-24: Cost-Optimized Architectures

Day 23 (Pricing):

• EC2 pricing comparison: On-Demand vs. Reserved (up to 72% discount) vs. Spot (up to 90% discount, interruptible)
• Savings Plans: Compute (flexible) vs. EC2 Instance (specific family/region)
• Right-sizing with CloudWatch and Compute Optimizer
• Exam pattern: "predictable steady-state workload" = Reserved/Savings Plans. "fault-tolerant, can handle interruptions" = Spot.

Day 24 (Storage and Transfer):

• S3 storage class selection based on access patterns
• Data transfer costs: inbound free, outbound charged, cross-AZ charged
• VPC Endpoints to reduce NAT Gateway data transfer costs
• AWS Budgets and Cost Explorer

Day 25: Fourth Full Practice Test

Target: 85%+. If you're here, book the exam for Day 30. If you're at 75-84%, focus the next two days on your weakest areas. Below 75%, consider pushing the exam out another week.

Day 26-27: Targeted Review

Go back to your tracking sheet. Which domains are consistently below 80%? Which specific topics keep tripping you up?

Spend these two days only on your weak spots. Don't re-study things you already know.

Day 27 exercise: Without looking anything up, write a one-page summary of each domain covering the key services and decision patterns. If you can't fill the page, you have gaps.

Day 28: Fifth Full Practice Test (Final)

Score 85%+? You're ready. Make a single page of notes covering only the things you keep getting wrong. That's your Day 29 review sheet.

Day 29: Light Review and Rest

Do not study more than one hour. Read your review sheet. Skim your weakest topics. Then stop.

Get a full night of sleep. This matters more than one more hour of cramming. A rested mind with 85% knowledge beats an exhausted mind with 90% knowledge.

Day 30: Exam Day

During the exam:

• 130 minutes for 65 questions = 2 minutes each. If a question takes more than 3 minutes, flag it and move on.
• Read the last sentence of every question first. It tells you what they're asking.
• Eliminate two wrong answers first, then choose between the remaining two.
• If two answers seem correct, pick the one more specific to AWS.

---

The Full 30-Day Calendar

---

The Numbers Behind This Method

This plan has you taking five full-length practice tests (325 questions total) plus domain-specific sessions throughout. By exam day, you'll have seen roughly 500 to 600 questions.

Research on the testing effect shows that active retrieval (answering questions and reviewing explanations) produces about 50% better retention than passive review. That's not an opinion. That's cognitive science.

The candidates who pass the SAA-C03 on their first attempt almost universally report the same thing: practice tests mattered more than any course they took.

---

After You Pass

Three things happen when you pass:

1. AWS emails you a 50% discount voucher for your next certification. Valid for 12 months.
2. Your certification is valid for 3 years. Set a reminder at month 30 to prepare for recertification.
3. Update your LinkedIn headline immediately. "AWS Certified Solutions Architect" is a keyword recruiters search for daily.

---

I'm building CloudDojo to help people pass AWS certifications with practice tests, free lessons, and progress tracking. If this study plan helped you, check it out.