SAP-C03 Domains Explained With Examples

The short version

AWS published the SAP-C03 exam guide on October 27, 2026. It lists five domains, weighted 25%, 25%, 15%, 15% and 20%, and the passing score is 720. This page explains each domain using AWS’s announcement of new skills plus general architecture practice. Treat the topic lists as study pointers, not as the exam outline; the exam guide has the task statements.

How to read this page

For each domain you get what it covers, typical traps and what to practice. Topics marked “announced” come from AWS’s list of new skills. Everything else is general knowledge about this kind of exam, and the exam guide will override it.

Domain 1: Architecture Design and Implementation Built for the Cloud (25%)

What it covers. Designing applications that use managed and serverless services instead of servers you patch. Think containers on ECS, EKS and Fargate, Lambda, Step Functions, event-driven designs, API layers, data stores and messaging.

Announced additions. Serverless data pipelines, Step Functions durable workflows, service mesh with VPC Lattice and ECS Service Connect, container image security, multi-tenant architectures, real-time data architectures. The announcement also lists generative AI design with Amazon Bedrock, Bedrock AgentCore, RAG and guardrails, and lakehouse architectures with Lake Formation and Apache Iceberg.

Typical traps.

  • Picking a familiar service when a newer managed one fits the requirement better.
  • Missing a networking detail, for example the load balancer target type a Fargate task needs.
  • Choosing a design that works but needs more operations work than the question allows.

What to practice. Build one small event-driven app, one container service behind a load balancer, and one cross-account service connection. Compare service pairs side by side: Step Functions Standard and Express, VPC Lattice and Transit Gateway, Kinesis Data Streams and Data Firehose.

Domain 2: Security, Compliance, and Governance (25%)

What it covers. Controlling who can do what across many accounts, protecting data, and proving compliance. Typical topics: Organizations, service control policies, IAM roles and policy evaluation, IAM Identity Center, KMS, encryption in transit and at rest, logging and threat detection.

Announced additions. Post-quantum cryptography in AWS KMS (AWS names ML-DSA and ML-KEM), pipeline vulnerability scanning, container image security and Bedrock Guardrails.

Typical traps.

  • Confusing a permission boundary, an SCP and an identity policy. An SCP never grants access; it only limits what is possible.
  • Forgetting that a control must apply to the right resource, not just the right service.
  • Ignoring how a service gets enabled by default, which can make a “deny subscription” approach miss the point.

What to practice. Write an SCP, test it in a sandbox organization, and trace how a request is evaluated. Create a KMS key policy that allows cross-account use and explain which statements matter.

Domain 3: Cost-Optimized Architecture Design (15%)

What it covers. Meeting requirements at the lowest sensible cost. That means purchase options (On-Demand, Savings Plans, Reserved Instances, Spot, capacity reservations), storage classes and lifecycle rules, data transfer paths, rightsizing and cost visibility.

Typical traps.

  • Choosing the cheapest unit price when a data transfer charge dominates.
  • Mixing up a discount and a capacity reservation. A discount does not guarantee that capacity exists.
  • Optimizing cost in a way that breaks a stated requirement, such as availability.

What to practice. Price the same workload three ways with the AWS Pricing Calculator. Work out when a gateway endpoint beats a NAT gateway and when it cannot be used. Read the cost lens of the Well-Architected Framework.

Domain 4: Resilience, Migration, and Business Continuity (15%)

What it covers. Staying up and recovering. Recovery time and recovery point objectives, backup and restore, pilot light, warm standby and active-active, multi-Region design, and migrating workloads (rehost, replatform, refactor) with the right tools.

Announced additions. AWS Fault Injection Service, AWS Resilience Hub, AWS Application Recovery Controller and automated runbooks in Systems Manager.

Typical traps.

  • Choosing a recovery strategy that is stronger, and more expensive, than the stated objectives require.
  • Treating a backup as a disaster recovery plan without thinking about the restore time.
  • Overlooking that some protections can be removed by a privileged user, which matters in ransomware scenarios.

What to practice. Write the RTO and RPO for a sample workload and match them to a strategy. Run a restore from a backup vault. Try a simple fault injection experiment in a test account.

Domain 5: Operational Excellence and Automation (20%)

What it covers. Running workloads well: infrastructure as code, deployment pipelines, monitoring, alerting and automation of routine work.

Announced additions. Multi-account deployment pipelines, pipeline vulnerability scanning, container monitoring, AI and machine learning metrics monitoring, and synthetic and real-user monitoring.

Typical traps.

  • Reading a metric or SLO question too quickly. Some are small calculations, such as a burn rate.
  • Picking a tool that logs data when the question asks for a trace, an alarm or an action.
  • Forgetting that a feature can need a one-time account setting before data shows up.

What to practice. Deploy a stack with CloudFormation or CDK across two accounts, add alarms, and set up a basic service-level objective.

How our practice sets map to these domains

Our SAP-C03 practice tests contain 500 questions in five sets. The mix across our sets is 28 percent cloud-native, 22 percent security, 14 percent cost, 20 percent resilience and 16 percent operations. That is our own question mix, not the exam’s weightings; the AWS exam guide weights the domains 25, 25, 15, 15 and 20 percent.

More guides for SAP-C03

Next step

Test your reading of these domains with the five sample questions, then see the SAP-C03 practice tests for a full baseline.

Frequently asked questions

Which domain is the largest?

Domains 1 and 2 are the largest at 25% each, according to the AWS exam guide published October 27, 2026. Domain 5 follows at 20%, and Domains 3 and 4 are 15% each.

Do I need to know the new generative AI services?

AWS lists them among the new skills, so yes, at least at the level of choosing the right pattern. Check the exam guide for depth.

Is hands-on experience required?

Not formally, but AWS recommends two or more years of design experience, and the scenario style rewards it.

Try these practice exams