Design Resilient Architectures carries 26% of the SAA-C03 — roughly 13 of the 50 scored questions — and it is the domain that defines what this exam feels like. Security is nominally larger at 30%, but resilience is where the SAA-C03’s signature question lives: a short architecture scenario, four options that all describe real AWS patterns, and a single requirement sentence that makes exactly one of them the answer.
If you arrived here from the Cloud Practitioner, recalibrate. The CLF-C02 asks what a service is; the SAA-C03 asks which of several working designs you should recommend. Nothing in this domain is answerable by definition alone.
Four options that work — one that answers
Read the questions below and watch what the distractors are doing. In most of them, every option would function in production. Auto Scaling the overwhelmed service does help. A read replica in another Availability Zone is a copy of your data somewhere safer. Warm standby does beat a 30-minute RTO. The wrong answers are not wrong facts — they are correct architectures for a different requirement.
Which means the requirement sentence is the question. “Automatic failover” eliminates anything with a manual promotion step. “RTO of about 30 minutes” eliminates strategies measured in hours — and, combined with “costs as low as possible”, it also disqualifies the faster strategies that overshoot it. “Least operational overhead” is the exam’s standing instruction that the managed option which does the work for you beats the option where you build and maintain it yourself. Underline the constraint before you read the options; on this domain, the constraint does all the deciding.
Multi-AZ or a read replica — the domain’s most-tested line
No single distinction appears more often. The diagram above shows the mechanism the exam keeps returning to: a primary RDS instance in one Availability Zone, a synchronous standby in another, one DNS endpoint in front of both. When the AZ fails, RDS promotes the standby and repoints the endpoint automatically — the application reconnects to the same name and carries on. Multi-AZ is an availability feature: synchronous, automatic, invisible to the application, and not readable.
Read replicas are the mirror image: asynchronous, readable, deployable across Regions — and promotion is a deliberate act that produces a new endpoint. They exist to scale read traffic, not to survive failure. The exam probes this line relentlessly because the wrong answer sounds so reasonable: surely a replica in another AZ protects you? It holds your data, yes — but the moment the stem says “automatic” or “no application changes”, it is the wrong copy. When both appear as options, the requirement words decide, every time.
The DR ladder — and which rung the exam wants
Four strategies, in rising cost and falling recovery time. Backup and restore: data backed up to the recovery Region, everything built at recovery time — RTO in hours, cheapest. Pilot light: data replicated continuously, only the core (typically the database) kept alive — RTO in tens of minutes. Warm standby: a scaled-down but fully functional copy always running — RTO in minutes. Multi-site active-active: both environments serving live traffic — RTO and RPO near zero, at the highest standing cost.
The exam almost never asks you to define these. It hands you an RTO, an RPO and a cost posture, and asks which rung fits. The discipline is mechanical: pick the cheapest strategy that satisfies the numbers. Warm standby beating the stated RTO does not make it right when pilot light also meets it for less — overshooting the requirement is the most elegant trap this domain sets, and it catches people who studied the ladder but not the selection rule.
Decoupling — the exam’s favourite resilience pattern
When a stem pairs a burst (“flash sale”, “unpredictable spikes”) with a durability requirement (“no requests may be lost”) and a pace mismatch (“at its own rate”), the answer is a queue between producer and consumer — almost always SQS. Scaling the consumer is the standing distractor: it genuinely helps, but instances launch in minutes while bursts arrive in seconds, and scaling does nothing for the requests that already failed. A queue turns a hard failure boundary into a buffer. That is the entire pattern, and the exam rewards recognising it in one read.
The same instinct generalises across the domain. Route 53 failover routing decouples clients from a failed environment behind a stable name. S3 versioning decouples the current state of an object from your ability to recover an earlier one. Resilience on this exam is rarely “make it stronger” — it is “make the failure survivable”.
How to use the seven questions below
Answer each one before opening the explanation. When you get one wrong, do not just note the correct answer — find the requirement word you skimmed past, because that word was the question. Every explanation below names the constraint that decides the scenario and then dismantles the distractors one by one. That is the skill this domain examines: not whether you know the services, but whether you can hear which requirement is speaking.
Updated for SAA-C03 (July 2026). The sample questions above are our own work
in the style of the exam — not real exam items. The exam itself is set and marked
by the certification body.