Domain 3 · Continuous improvement
25% of the exam. Improving a system that already runs, with the smallest change that fixes the problem.
Domain 3 questions describe a running system and a pain point: slow pages, a failed audit, a surprise bill, 2 a.m. outages. The best answer fixes the pain with the least disruption. Rebuilding everything is almost never correct.
| Task | What it's really asking | Pages |
|---|---|---|
| 3.1 Operational excellence | Better monitoring, automated remediation, safer deployments | Observability, Auto-remediation, Deployment strategies |
| 3.2 Security | Secrets, least privilege, traceability, patching, backups | Secrets and least privilege, App authentication, Backup automation, Configuration and patching |
| 3.3 Performance | Finding bottlenecks and rightsizing | Performance and rightsizing, Caching |
| 3.4 Reliability | Removing single points of failure, self-healing | Disaster recovery, Decoupling, Load balancers |
| 3.5 Cost optimization | Finding waste and fixing it | Cost optimization, Cost visibility |
The rewrite
Options that re-platform the whole application, such as "migrate to microservices on EKS", are rarely right in Domain 3 unless the question explicitly asks for modernization. Look for the configuration change, the managed feature or the added layer.
Pricing models
On-Demand, Reserved Instances, Savings Plans, Spot and Capacity Reservations for compute, S3 storage classes and lifecycle, and how to model data transfer costs.
Observability
Adding the right CloudWatch metrics, alarms, log pipelines, tracing and synthetic checks to an existing workload, across many accounts.