AWS SAA-C04 Exam Guide 2026: Format, Domains, and Pass Score

The AWS SAA-C04 is the current version of the AWS Certified Solutions Architect Associate exam, a 65-question, 130-minute assessment that validates your ability to design secure, resilient, high-performing, and cost-optimized architectures on Amazon Web Services. This guide covers every structural detail you need to understand before registering, including the four domain areas and their exact weights, the scoring model, question formats, exam policies, and the specific services AWS expects you to know.

This is not a study plan. If you want a week-by-week preparation schedule, read our complete SAA-C04 study plan. This article answers the question that comes before studying: what exactly is this exam, and what does it measure?

What Is the AWS SAA-C04 Exam?

The SAA-C04 is the fourth iteration of the AWS Solutions Architect Associate certification exam. AWS released it in March 2024, replacing the SAA-C03. As of July 2026, it remains the current exam version with no announced successor. The certification is valid for three years from the date you pass.

The exam code breaks down simply: SAA stands for Solutions Architect Associate, C04 means it is the fourth version of the content outline. When AWS updates the exam, they increment the version number and retire the previous one after a transition period. There is no SAA-C05 on the horizon as of this writing.

Who Should Take This Exam

AWS designed the SAA-C04 for professionals with at least one year of hands-on experience designing distributed systems on AWS. That said, disciplined self-studiers with six months of focused lab work and project experience have passed it consistently. The exam does not require any prerequisite certifications. You do not need the AWS Cloud Practitioner first, though having it earns you a 50% discount voucher on your next exam.

The target audience includes:

• Cloud engineers building and deploying workloads on AWS who want formal validation
• Solutions architects at consulting firms who need the credential for client-facing roles
• DevOps engineers expanding into architecture decisions beyond CI/CD pipelines
• IT professionals transitioning from on-premises infrastructure to cloud
• Developers who design their own infrastructure and want to formalize that knowledge
• Career changers entering cloud computing who need a recognized credential on their resume

If you are already an experienced AWS architect designing multi-account, multi-region systems, skip the Associate and go directly to the SAP-C02 Professional exam.

SAA-C04 Exam Format: The Complete Breakdown

Question Count and Time Limit

The exam contains 65 questions with a 130-minute time limit. Of the 65 questions, 50 are scored and 15 are unscored. The unscored questions are experimental — AWS uses them to evaluate potential future exam questions. You cannot identify which questions are unscored, so treat every question as if it counts.

That math gives you exactly 2 minutes per question. In practice, about 40 of the 65 questions are straightforward if you know the material. The remaining 25 require careful reading of multi-sentence scenarios. Budget 90 seconds for quick questions and 3 minutes for scenario-heavy ones, then use remaining time to review flagged questions.

Question Types

The SAA-C04 uses two question formats:

Single-answer multiple choice (approximately 50 questions): You are presented with a scenario and four answer options labeled A through D. Only one answer is correct. There is no partial credit.

Multiple-response (approximately 15 questions): You are presented with a scenario and five or six answer options. The question specifies how many to select, typically two or three. You must select exactly the right combination. There is no partial credit for getting some but not all answers correct.

Both question types are scenario-based. You will not see trivial recall questions like "What is the maximum size of an S3 object?" Instead, you will see something like: "A company stores 50 TB of medical imaging data that is accessed frequently for the first 30 days, then rarely accessed for the next 5 years before being deleted. The data must be available within 12 hours when accessed after the initial period. Which storage solution meets these requirements at the lowest cost?"

Language and Accessibility

The exam is available in English, Japanese, Korean, Simplified Chinese, Traditional Chinese, Bahasa Indonesian, Spanish, French, German, Italian, and Portuguese. If English is not your first language, you can request an additional 30 minutes of exam time (ESL +30 accommodation) through your AWS certification account before scheduling.

Testing Format

You have two options:

Pearson VUE test center: In-person at a proctored testing facility. You present two forms of ID, store personal items in a locker, and take the exam on a provided computer. You cannot bring notes, phones, or any materials into the testing room. Available in most major cities globally.

Online proctored (OnVUE): Take the exam from your home or office. You need a webcam, microphone, stable internet connection, and a clean desk. A proctor monitors you via video throughout the exam. Your room must be free of papers, additional screens, and other people. OnVUE is available 24/7, which makes it the preferred option for candidates in locations without nearby test centers.

Exam Cost

The exam costs $150 USD (or equivalent in local currency). If you hold any active AWS certification, you receive a 50% discount voucher, bringing the cost to $75. AWS also offers free practice exams for certification holders.

If you fail, you must wait 14 days before retaking the exam. There is no limit on the number of retake attempts, but each attempt costs the full fee (or discounted fee if you have a voucher).

The Four Domains: What the SAA-C04 Actually Tests

The SAA-C04 exam blueprint divides content into four domains. Each domain has a specific weight that determines how many scored questions come from that area. Understanding these weights is critical for allocating study time.

Domain 1: Design Secure Architectures — 30%

This is the heaviest domain. Approximately 15 of your 50 scored questions will come from security topics. AWS increased the security weight in the C04 version compared to C03, reflecting the industry's shift toward security-first architecture.

What this domain covers:

• IAM design: Writing and evaluating IAM policies, understanding policy evaluation logic (explicit deny > explicit allow > implicit deny), using permission boundaries, implementing least-privilege access, cross-account access with IAM roles
• Network security: VPC security groups vs NACLs, public vs private subnets, NAT gateways, VPC endpoints (gateway and interface), AWS PrivateLink, VPC peering vs Transit Gateway
• Encryption: KMS customer-managed keys vs AWS-managed keys, envelope encryption, S3 server-side encryption options (SSE-S3, SSE-KMS, SSE-C), EBS encryption, RDS encryption at rest and in transit, ACM for TLS certificates
• Data protection: Secrets Manager vs Systems Manager Parameter Store, Macie for PII detection, S3 Object Lock for compliance, CloudTrail for API auditing, AWS Config for compliance monitoring
• Application security: Cognito user pools and identity pools, WAF rules, Shield Standard vs Advanced, API Gateway authorization (IAM, Cognito, Lambda authorizers)

Common trap questions in Domain 1: The exam frequently tests the difference between security groups (stateful, allow rules only, instance-level) and NACLs (stateless, allow and deny rules, subnet-level). It also tests when to use KMS with SSE-KMS versus SSE-S3 for S3 encryption — the key differentiator is whether you need key rotation control, audit logging via CloudTrail, or cross-account access to encrypted objects.

Domain 2: Design Resilient Architectures — 26%

Approximately 13 scored questions test your ability to design systems that survive failures. This domain focuses on high availability, fault tolerance, disaster recovery, and decoupled architectures.

What this domain covers:

• High availability: Multi-AZ deployments for RDS, ElastiCache, and Elasticsearch; Application Load Balancer health checks; Route 53 health checks and failover routing; Aurora Multi-AZ and read replicas
• Scaling: Auto Scaling groups with target tracking, step scaling, and scheduled scaling policies; scaling ECS services; DynamoDB on-demand vs provisioned capacity with auto scaling
• Decoupling: SQS standard vs FIFO queues, SNS topics for fan-out, EventBridge for event-driven architectures, Step Functions for orchestration, dead-letter queues for failed message handling
• Disaster recovery: Backup and restore, pilot light, warm standby, multi-site active-active patterns; RPO and RTO trade-offs; cross-region replication for S3, DynamoDB global tables, Aurora global databases
• Data durability: S3 durability (11 nines) vs availability (4 nines for Standard), EBS snapshots, RDS automated backups and manual snapshots, AWS Backup

Common trap questions in Domain 2: The exam loves testing disaster recovery patterns. You need to know the RPO/RTO trade-offs between backup-and-restore (cheapest, longest recovery), pilot light (core infrastructure running, everything else stopped), warm standby (scaled-down full environment), and multi-site active-active (most expensive, near-zero downtime). Questions will describe specific RPO and RTO requirements and expect you to choose the most cost-effective DR strategy that meets them.

Domain 3: Design High-Performing Architectures — 24%

Approximately 12 scored questions focus on selecting the right services for performance requirements. This domain tests your knowledge of compute, storage, database, and networking services and when each is the optimal choice.

What this domain covers:

• Compute selection: EC2 instance families (compute-optimized C-series, memory-optimized R-series, storage-optimized I/D-series, general-purpose M/T-series), Lambda execution limits, ECS/Fargate sizing, Elastic Beanstalk
• Storage performance: EBS volume types (gp3, io2, st1, sc1), instance store (ephemeral, highest IOPS), EFS performance modes (general purpose vs max I/O), FSx for Windows and Lustre
• Database selection: RDS (relational workloads), Aurora (MySQL/PostgreSQL with higher performance), DynamoDB (key-value, single-digit millisecond latency), ElastiCache Redis vs Memcached, Neptune (graph), Timestream (time series), DocumentDB (MongoDB-compatible)
• Caching: CloudFront edge caching, ElastiCache for database query caching, DAX for DynamoDB acceleration, API Gateway caching
• Networking performance: Enhanced networking, placement groups (cluster for low latency, spread for high availability, partition for large distributed workloads), Global Accelerator, Direct Connect

Common trap questions in Domain 3: EC2 instance store vs EBS is a frequent topic. Instance store provides the highest IOPS but data is lost when the instance stops. If the question says "data can be recreated" or "temporary processing," instance store is likely the answer. If data must persist, EBS is correct. Also watch for gp3 vs io2: gp3 is the default general-purpose SSD, io2 is for applications requiring sustained IOPS above 16,000 or sub-millisecond latency.

Domain 4: Design Cost-Optimized Architectures — 20%

Approximately 10 scored questions test your ability to choose the cheapest solution that meets requirements. This is the lightest domain by weight but often the trickiest because cost optimization questions require understanding pricing models across many services.

What this domain covers:

• EC2 pricing: On-Demand (baseline), Reserved Instances (1-year or 3-year commitment, up to 72% savings), Savings Plans (flexible commitment), Spot Instances (up to 90% savings, can be interrupted), Dedicated Hosts (licensing compliance)
• Storage cost optimization: S3 storage classes (Standard, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive), S3 Intelligent-Tiering, Lifecycle policies
• Right-sizing: AWS Compute Optimizer recommendations, CloudWatch metrics for identifying underutilized instances, trusted advisor cost optimization checks
• Serverless cost models: Lambda pricing per invocation and duration, API Gateway pricing per request, DynamoDB on-demand vs provisioned pricing
• Data transfer costs: Data transfer out to internet pricing, VPC endpoint cost savings vs NAT Gateway data processing charges, CloudFront as a cost-effective alternative to direct S3 data transfer

Common trap questions in Domain 4: S3 storage class selection is nearly guaranteed. You must know: Standard-IA has a 30-day minimum storage charge and a per-GB retrieval fee; One Zone-IA is cheaper but stores data in a single AZ; Glacier Instant Retrieval provides millisecond access but costs more than Glacier Flexible Retrieval (which takes 1-5 minutes to hours); Glacier Deep Archive is cheapest but retrieval takes 12 hours minimum. Intelligent-Tiering automatically moves objects but charges a small monitoring fee per object.

Passing Score and Scoring Methodology

The 720 Threshold

You need 720 out of 1000 to pass. AWS uses a scaled scoring model, which means the raw percentage of correct answers does not directly map to your score. Different questions carry different weights based on difficulty and statistical calibration.

In practical terms, candidates who pass typically answer 72-75% of scored questions correctly. Since you cannot identify which 15 questions are unscored, aim for at least 75% accuracy across all 65 questions to give yourself a comfortable margin.

How AWS Calculates Your Score

AWS uses a psychometric model called Item Response Theory (IRT). Here is what that means for you:

1. Each question has a pre-calculated difficulty rating based on historical test-taker performance
2. Correctly answering a harder question earns more scaled points than correctly answering an easier question
3. There is no penalty for guessing — an unanswered question is scored the same as a wrong answer, so always select something
4. The 15 unscored questions do not affect your score at all, but since you cannot identify them, answer every question

Score Report

After completing the exam, you receive a pass/fail result immediately on screen. Your detailed score report appears in your AWS certification account within 5 business days. The report shows your overall scaled score and a performance indicator for each domain (Meets Competency, Needs Improvement, or Below Competency). You will not see which specific questions you got right or wrong.

If you score between 650 and 720 (fail but close), focus your restudy on domains marked "Needs Improvement" or "Below Competency." One focused week of study on your weakest domain is usually enough to close the gap.

AWS Services You Must Know for SAA-C04

The SAA-C04 exam content outline lists specific services under each domain. Here is the consolidated list of services that appear most frequently, organized by category.

Compute

• EC2 (instance types, AMIs, placement groups, ENIs)
• Lambda (execution model, limits, layers, destinations)
• ECS and Fargate (task definitions, services, capacity providers)
• Elastic Beanstalk (platform management, deployment policies)
• Batch (job queues, compute environments)

Storage

• S3 (storage classes, lifecycle policies, versioning, replication, access points)
• EBS (volume types, snapshots, encryption)
• EFS (performance modes, lifecycle management)
• FSx (Windows File Server, Lustre)
• Storage Gateway (File, Volume, Tape)
• Snow Family (Snowcone, Snowball, Snowmobile)

Database

• RDS (Multi-AZ, read replicas, automated backups, Aurora)
• DynamoDB (partition keys, GSI/LSI, streams, DAX, global tables)
• ElastiCache (Redis vs Memcached)
• Redshift (data warehousing, Spectrum)
• Neptune, DocumentDB, QLDB, Timestream

Networking

• VPC (subnets, route tables, internet gateways, NAT gateways)
• Route 53 (routing policies: simple, weighted, latency, failover, geolocation, geoproximity)
• CloudFront (distributions, origins, behaviors, OAC)
• API Gateway (REST, HTTP, WebSocket)
• Direct Connect (dedicated connections, hosted connections)
• Transit Gateway, VPC Peering, PrivateLink
• Global Accelerator, ELB (ALB, NLB, CLB)

Security

• IAM (policies, roles, groups, identity federation)
• KMS (key management, encryption)
• Cognito (user pools, identity pools)
• Secrets Manager, Systems Manager Parameter Store
• WAF, Shield, GuardDuty, Inspector, Macie
• CloudTrail, AWS Config, Security Hub
• ACM (certificate management)

Application Integration

• SQS (standard, FIFO, dead-letter queues)
• SNS (topics, subscriptions, fan-out)
• EventBridge (event buses, rules, targets)
• Step Functions (state machines, workflow orchestration)
• AppSync (GraphQL APIs)

Analytics

• Athena (S3 query engine)
• Kinesis Data Streams and Kinesis Data Firehose
• Glue (ETL, data catalog)
• EMR (managed Hadoop/Spark)
• OpenSearch (log analytics, full-text search)

Management and Governance

• CloudWatch (metrics, alarms, logs, dashboards)
• CloudFormation (IaC, stack sets)
• AWS Organizations (SCPs, organizational units)
• Control Tower (landing zones)
• Systems Manager (patch management, run command, session manager)
• Trusted Advisor, Compute Optimizer, Cost Explorer

How to Register for the SAA-C04

Step-by-Step Registration

1. Create an AWS certification account at aws.amazon.com/certification using your personal email (not your company email, so the certification stays with you)
2. Sign in to the AWS certification portal and select "Schedule an exam"
3. Choose the exam: AWS Certified Solutions Architect - Associate (SAA-C04)
4. Select a testing provider: Pearson VUE (test center or online proctored)
5. Pick a date and time — for online proctored, slots are available 24/7; for test centers, availability depends on location
6. Apply any vouchers (50% discount from existing certification, or employer-provided vouchers)
7. Pay the fee ($150 USD or discounted rate)

Day-of-Exam Checklist

For test centers: - Arrive 15 minutes early - Bring two valid forms of ID (passport + driver's license, for example) - Store personal items in the provided locker - You receive a whiteboard or scratch paper for notes during the exam

For online proctored: - Close all applications except the OnVUE software - Clear your desk completely — no papers, phones, second monitors, or watches - Ensure your webcam and microphone are working - Test your internet connection (minimum 2 Mbps) - Run the system test at onvue.com/system-test at least 24 hours before your exam

Strategic Approaches for Exam Day

Time Management

With 130 minutes and 65 questions, you cannot afford to get stuck. Use this approach:

1. First pass (80 minutes): Answer every question you can answer confidently. Flag anything that requires deep analysis. Do not spend more than 2 minutes on any single question during this pass.
2. Second pass (40 minutes): Return to flagged questions. Read the scenario carefully, eliminate obviously wrong answers, and make your best choice.
3. Final review (10 minutes): Skim through all answers looking for patterns — did you choose answer C 20 times in a row? That is statistically unlikely and worth double-checking.

Elimination Strategy

For questions where you are uncertain, eliminate first:

• Eliminate answers mentioning services not in the exam scope. If an answer references a service you have never heard of, it is likely a distractor.
• Eliminate answers that violate cost optimization. If the question mentions "most cost-effective" and one answer includes multi-region replication when single-region meets the stated requirements, eliminate it.
• Eliminate answers that over-provision. The exam rewards choosing the simplest architecture that meets all stated requirements. A solution using 5 services is usually wrong when a 2-service solution exists.
• Watch for "fully managed" traps. AWS frequently offers a fully managed service alongside a self-managed option. If the question does not explicitly require customization that the managed service cannot provide, the managed service is almost always correct.

Reading Questions Carefully

SAA-C04 questions include specific constraints that narrow the correct answer. Look for these keywords:

• "Most cost-effective" — eliminates more expensive solutions even if they work
• "Least operational overhead" — favors managed services over self-managed
• "Minimum latency" — favors caching, edge locations, or placement groups
• "Regulatory compliance" — may require specific encryption, data residency, or audit logging
• "Existing infrastructure" — the solution must integrate with what is already described, not replace it
• "Without modifying application code" — eliminates solutions requiring code changes

What Happens After You Pass

When you pass the SAA-C04, you receive:

• Digital badge through Credly that you can share on LinkedIn and your resume
• 50% discount voucher for your next AWS exam (valid for one exam, no expiration)
• Free practice exam voucher for any AWS certification
• Access to the AWS Certified community with exclusive events and content
• Certification valid for 3 years from the pass date

To maintain your certification, you must recertify before the 3-year expiration by either passing the same exam again or passing a higher-level exam in the same track (the Solutions Architect Professional automatically renews your Associate).

Common Misconceptions About the SAA-C04

"You need production AWS experience to pass." Incorrect. Many candidates pass with only hands-on lab experience using the AWS Free Tier. What you need is the ability to analyze scenarios and select services — not production deployment experience.

"The exam tests service limits and pricing numbers." AWS rarely asks you to recall specific numbers. The exam tests conceptual understanding — you need to know that S3 Standard-IA is cheaper to store but more expensive to access than S3 Standard, but you do not need to memorize the exact per-GB prices.

"If you fail, it goes on your record." Failed attempts are not visible to employers or anyone else. Only passed certifications appear on your public profile. You can retake the exam after 14 days with no stigma.

"Online proctored exams are easier." The questions are identical regardless of testing format. The only difference is your environment. Some candidates find online proctoring more comfortable; others find the environmental restrictions (clear desk, no breaks, webcam monitoring) more stressful than a test center.

"The SAA-C04 will be replaced soon." AWS typically maintains exam versions for 2-3 years. The C04 launched in March 2024. Based on historical patterns, expect it to remain current until at least late 2026 or early 2027. AWS provides at least 6 months of notice before retiring an exam version.

FAQ

How long should I study for the SAA-C04?

Most candidates need 6-12 weeks of dedicated study. If you already work with AWS daily, 4-6 weeks may be sufficient. If you are new to cloud computing, plan for 10-12 weeks. The key variable is hands-on practice — candidates who only watch videos without doing labs consistently underperform. See our complete study plan for a week-by-week schedule.

Can I use the SAA-C04 to get a job with no experience?

The certification alone will not land you a job, but it significantly increases your chances of getting interviews. Pair it with a portfolio of 3-5 AWS projects (deployed on the Free Tier) and hands-on lab documentation. Employers use the SAA as a minimum filter — without it, your resume may not make it past initial screening. Check our free cloud courses for guided project ideas.

What is the difference between SAA-C04 and SAA-C03?

The SAA-C04 increased emphasis on serverless and container architectures, added data analytics services to the exam scope, and expanded coverage of multi-account architectures using AWS Organizations. Read our detailed SAA-C04 vs SAA-C03 comparison for a complete breakdown.

Is the AWS Solutions Architect Associate worth the money?

For most cloud professionals, the SAA-C04 provides the highest ROI of any entry-level cloud certification. AWS-certified Solutions Architects earn a median salary premium of $15,000-$20,000 over non-certified peers in equivalent roles. The $150 exam fee pays for itself within weeks of a salary increase. See our SAA-C04 salary and ROI analysis for detailed numbers.

What score do I need to pass on the first try?

You need 720 out of 1000. Since the scoring is scaled and you cannot control which questions appear, aim for 80% accuracy in practice exams to give yourself a comfortable margin. If you consistently score 75%+ on timed practice tests from multiple sources, you are ready.

Key Takeaway

The SAA-C04 is a scenario-based, 65-question exam with a 720/1000 passing threshold where Domain 1 (Security) carries the most weight at 30% — allocate your study time proportionally, master IAM and VPC security first, and never leave a question unanswered since there is no penalty for guessing.