The plan follows the exam weights. Domain 1 (30%) comes first and gets two full weeks, and every week ends with a measurable checkpoint.
How each week works
A standard week has five sessions of about 1.5–2 hours each:
| Session | What you do |
|---|---|
| 1 and 2 | Lessons for the week’s topics, plus one short hands-on lab (30–40 minutes) |
| 3 | Topic banks for the week’s topics, untimed. Read every explanation, including those for items you got right. |
| 4 | Flashcards (15 minutes a day, every day, also counts here), then retry every missed bank item |
| 5 | Timed mixed set at 100 seconds per question, then update your error log |
Error log rule: log every miss with its cause: K (knowledge gap), Q (missed the qualifier), R (misread a constraint) or C (changed a right answer). Review the log at the start of each week.
Week-by-week plan
Week 1: Baseline and access control (Domain 1, part 1)
- Diagnostic test: 24 questions in 48 minutes, on day 1, before any study. Record your score and the domain breakdown. Typical first scores are 450–650, so a low result is normal.
- Lessons: IAM identities and policies; roles, STS and federation; Organizations, SCPs and Control Tower; VPC security (subnets, SGs, NACLs, NAT); VPC endpoints and hybrid connections.
- Lab: build a VPC with public and private subnets, a NAT gateway and an S3 gateway endpoint. Then create a role in a second account and assume it.
- Checkpoint: 70%+ on these five banks.
Week 2: Protection and data security (Domain 1, part 2)
- Lessons: WAF, Shield and Network Firewall; GuardDuty, Inspector, Macie, Detective and Security Hub; Secrets Manager, Parameter Store and Cognito; KMS and CloudHSM; S3 access control and Object Lock; ACM, CloudTrail, Config and AWS Backup.
- Lab: create a customer managed KMS key, encrypt a bucket with SSE-KMS, and add a bucket policy that denies non-TLS requests.
- Checkpoint: 75%+ on all 11 Domain 1 banks at first attempt. Domain 1 is worth 15 scored questions, so do not move on below 70%.
Week 3: Scalable, loosely coupled design (Domain 2, part 1)
- Lessons: SQS, SNS, EventBridge and Amazon MQ; Lambda, API Gateway and Step Functions; ECS, EKS and Fargate; load balancers and Auto Scaling; stateless design and purpose-built managed services.
- Lab: an SQS queue with a dead-letter queue, and a Lambda consumer. Then an ALB in front of an Auto Scaling group using target tracking.
- Checkpoint: 75%+ on these five banks.
Week 4: High availability and DR (Domain 2, part 2)
- Lessons: multi-AZ design and single points of failure; Route 53 routing and hybrid DNS; DR strategies; CloudWatch, X-Ray, CloudFormation and service quotas.
- Lab: create an RDS Multi-AZ instance, reboot it with failover and time the outage. Configure Route 53 failover with a health check.
- Checkpoint: a timed mixed set of 30 Domain 1 and 2 items in 50 minutes, scoring 75%+.
Week 5: Storage, compute and databases (Domain 3, part 1)
- Lessons: EBS, instance store, EFS and FSx; S3 performance and Storage Gateway; EC2 families, placement groups, Batch and EMR; RDS and Aurora; DynamoDB and purpose-built databases; caching.
- Lab: change a gp2 volume to gp3 with provisioned IOPS; create a DynamoDB table with a GSI.
- Checkpoint: 75%+ on these six banks.
Week 6: Networks and data (Domain 3, part 2)
- Lessons: CloudFront and Global Accelerator; VPC design, peering, Transit Gateway and Direct Connect; Kinesis, Data Firehose and MSK; data lakes with Glue, Athena and Lake Formation; DataSync, the Snow Family, DMS and Application Migration Service.
- Lab: put CloudFront with origin access control in front of a private S3 bucket. Query a CSV file in S3 with Athena.
- Checkpoint: a timed mixed set of 30 Domain 1–3 items in 50 minutes, scoring 80%+.
Week 7: Cost optimization and full mock 1 (Domain 4)
- Lessons (days 1–4): cost-management tools; S3 storage classes and lifecycle; block, file and backup cost; EC2 purchasing options; cost-optimized compute; database cost; network and data-transfer cost. Much of this builds on weeks 1–6, so it moves quickly.
- Lab: an S3 lifecycle rule, and a monthly budget alert in AWS Budgets.
- Full mock 1 (day 5 or 6): 65 questions in 130 minutes, in one sitting, with your real pacing plan. Target: 780+. Floor: 720.
- Day 7: review every mock item, including the ones you got right by guessing, and log each miss.
Week 8: Remediation, full mock 2 and the exam
- Days 1–3: work only on your error log. Reread the lessons for your top three weak topics, redo their banks and write new flashcards for every K miss.
- Day 4: Full mock 2, which is calibrated slightly harder than mock 1. Target: 850+, with no domain below 75%.
- Day 5: review mock 2 in full.
- Day 6: a light review of the service comparisons cheat sheet and your error log. No new material.
- Day 7 (or early week 9): the exam.
Checkpoint targets
| Checkpoint | When | Target | If you miss it |
|---|---|---|---|
| Diagnostic | Week 1, day 1 | Baseline only | Nothing to fix yet; it sets your priorities |
| Domain 1 banks | End of week 2 | 75%+ | Spend 2 extra sessions on KMS, IAM policy logic and VPC security before week 3 |
| Domain 1–2 mixed set | End of week 4 | 75%+ | Redo the DR and decoupling banks timed |
| Domain 1–3 mixed set | End of week 6 | 80%+ | Add a networking catch-up session (endpoints, TGW, DX) |
| Full mock 1 | End of week 7 | 780+ | Below 720: move the exam back 2 weeks and repeat the plan for your weakest domain |
| Full mock 2 | Week 8, day 4 | 850+ | 780–849: you can sit the exam and should pass. Below 780: reschedule. |
If you fall behind
- Never skip a Domain 1 or Domain 2 topic to catch up. Compress the lighter Domain 3 data topics (streaming, data lakes) instead. Together they carry about 3% of the syllabus weight.
- Drop labs before you drop banks. Question practice converts to points faster once you have seen each service once.
- If you lose a whole week, move full mock 1 back a week instead of cramming two content weeks into one.
4-week fast track (experienced candidates)
This track is for people with a year or more of hands-on AWS experience who can study 15–18 hours a week.
| Week | Plan | Checkpoint |
|---|---|---|
| 1 | Diagnostic; all 11 Domain 1 lessons and banks | D1 banks 75%+ |
| 2 | All Domain 2 lessons and banks; Domain 4 purchasing options and S3 classes | D2 banks 75%+ |
| 3 | All Domain 3 lessons and banks; the rest of Domain 4; full mock 1 at the end of the week | Mock 1: 780+ |
| 4 | Error-log remediation, full mock 2 on day 3, cheat sheet review, exam on day 6 or 7 | Mock 2: 850+ |
Experienced candidates usually lose points on cost and security details that they rarely handle at work: S3 minimum storage durations, NAT and endpoint pricing, SCP evaluation and KMS key policies. Give those topics extra bank time even if they feel familiar.
The daily non-negotiables
- 15 minutes of flashcards every day, including weekends. Spaced repetition is what makes trigger-to-answer rules automatic.
- Read every explanation, including those for correct answers. You may have been right for the wrong reason.
- One timed set a week at 100 seconds per question, so that exam pacing is familiar before mock 1.