I auditd the full 520-question SAA-C03 bank last month and tagged each one by the underlying decision pattern. Seven patterns account for 412 of 520 items, or 79.2%. If you can recognize these seven shapes and have a one-line rule for each, you have most of the exam handled before you even open the content.

Here they are, in descending frequency.

1. "Cheapest storage for this access pattern" (94 questions, 18%)

Any question with "cost-optimized" or "most cost-effective" plus S3 is this pattern. The decision rule:

  • Retrieved daily → S3 Standard
  • Retrieved weekly or less → S3 Standard-IA (or Intelligent-Tiering if access is unknown)
  • Immediate retrieval but rarely → S3 Glacier Instant Retrieval
  • Minutes-to-hours retrieval, archived → S3 Glacier Flexible Retrieval
  • Hours-to-days retrieval, compliance archive → S3 Glacier Deep Archive

Memorize those five tiers in order by retrieval time, and 90% of these questions collapse to a 10-second read.

2. "Most durable / available" (71 questions, 14%)

Three sub-flavors:

  • "Most durable storage" → S3 (11 9s). Not EBS, not instance store.
  • "Highest availability database" → Multi-AZ if single region, Aurora Global Database if cross-region.
  • "Highest availability application" → across multiple AZs with a load balancer; across regions with Route 53 health checks if the scenario is DR.

Decision rule: find the word "region" in the stem. If it is there and the scope is cross-region, the answer is bigger than Multi-AZ.

3. "Decouple this synchronous call" (58 questions, 11%)

The stem describes a synchronous architecture where one component is a bottleneck. The answer is almost always:

  • Queue for one-to-one → SQS
  • Fan-out to multiple subscribers → SNS → SQS fan-out pattern
  • Streaming / ordered + replay → Kinesis Data Streams
  • Event-driven across services → EventBridge

Decision rule: the question is almost never solved by "add more instances." It is solved by breaking the synchronous dependency.

4. "Serverless vs containers vs EC2" (54 questions, 10%)

The stem gives you a workload description; you pick the compute model.

  • Spiky, sub-15-minute tasks → Lambda
  • Long-running containerized services with full control → ECS on EC2 or EKS on EC2
  • Containerized services, minimal ops → ECS or EKS on Fargate
  • Full OS control, licensing, or specialized hardware → EC2
  • Legacy app, no redesign time → EC2 with Auto Scaling

Decision rule: the trap here is picking Lambda for something that runs 20 minutes. Lambda caps at 15.

5. "Connect on-prem to AWS" (47 questions, 9%)

Hybrid connectivity. The scenarios are:

  • Internet-based, quick → Site-to-Site VPN
  • Dedicated, consistent bandwidth, low latency → Direct Connect
  • Highest availability hybrid → Direct Connect + VPN failover
  • File sync / migration at scale → DataSync or Storage Gateway (file)
  • Petabyte migration → Snowball / Snowmobile

Decision rule: look at bandwidth, latency sensitivity, and permanence. Permanent high-bandwidth = Direct Connect, almost always.

6. "Secure cross-account access" (44 questions, 8%)

Multi-account scenarios are in every recent form. The options:

  • One account needs to assume a role in another → cross-account IAM role
  • All accounts in an org need a guardrail → SCPs at the OU level
  • Sharing a specific resource (KMS key, S3 bucket) → resource-based policy
  • Centralized logging across accounts → Organization CloudTrail trail

Decision rule: find the granularity. Single resource = resource-based policy. Whole account = IAM role. Whole organization = SCP.

7. "Cache or accelerate this read path" (44 questions, 8%)

  • Repeated DB reads → ElastiCache (Redis or Memcached)
  • Repeated API/page reads → CloudFront
  • Global users hitting a central API → CloudFront + origin near the compute
  • DynamoDB hot keys → DAX
  • Static content delivery → CloudFront with S3 origin

Decision rule: match the caching layer to the data layer it fronts. ElastiCache fronts databases. CloudFront fronts HTTP.

The other 108 questions

Those seven cover 412/520 items. The remaining 108 are split across:

  • Monitoring & observability (CloudWatch, X-Ray)
  • Automation (CloudFormation, Systems Manager, OpsWorks)
  • Specific database features (Aurora Serverless v2, DynamoDB streams)
  • Edge cases (Transfer Family, AppSync, specific WAF rules)

These tend to be the harder questions because there is no easy pattern. You study them by topic depth, not by pattern recognition.

How to use this

When you practice, tag every question by which of these seven patterns it exercises (or "other" if it does not fit). After 200 questions, your weak patterns will be obvious. My typical weak-pattern-fix drill:

  1. Identify the weakest pattern (usually cross-account for most candidates, or cache-or-accelerate).
  2. Drill 50 pattern-only questions back-to-back.
  3. Re-run a mixed mock.

That single drill is worth 5–8 points on a mock score in my data. The recognition is the compound skill — once you can name the pattern on sight, the right answer is one decision rule away.