How I Passed the AWS Certified Solutions Architect - Professional (SAP-C02) Exam

From Knowing the Services to Defending the Design

After DOP-C02, SAP-C02 brought many familiar services into a different conversation. Deployment automation and operational reliability still matter, but so do an acquisition’s account structure, a migration deadline, a licensing constraint, and the cost of keeping a second Region ready.

Two answers can both be technically possible. The deciding detail might be least operational overhead, no application changes, or a recovery objective that one design cannot actually meet.

My shorthand for that distinction:

A good architecture is not the one with the most AWS services. It is the one whose trade-offs you can explain.

This post follows the four SAP-C02 domains. To connect the notes, I use a fictional retailer expanding into a second Region while integrating an acquired business. Each domain becomes a small design review: a constraint, a decision, and the reason a tempting alternative falls short.

Each domain ends with three practice questions, followed by five additional scenario questions for final review. These are original study exercises, not reproduced exam questions.

Exam Overview and Domain Breakdown

SAP-C02 has 75 questions, a 180-minute time limit, and a minimum passing scaled score of 750 out of 1,000. Of those questions, 65 are scored and 10 are unscored. A scaled score is not a raw percentage of correct answers.

My Study Workflow: One Guide, Two Cheat Sheets

I used a detailed study guide for coverage and built two shorter references: one organized around practice-question decisions, and another focused on easy-to-miss distinctions in the guide.

Each served a different purpose:

The important part is the explanation, not the answer letter. A note saying “use a read replica” is incomplete until it says which reads move there, how much replication lag is acceptable, and whether promotion is required during recovery.

The Four-Pass Design Review

This is the framework I recommend for long scenarios:

Hard requirements come before preferences. A cheaper archive tier is not a valid answer if retrieval takes longer than the application permits. A managed service is not a valid answer if it cannot support the required protocol.

Domain 1: Design Solutions for Organizational Complexity (26% Weighting)

Domain 1 focuses on designing account structures, identity boundaries, shared services, hybrid connectivity, and governance that continue to work as an organization grows.

Design review: Our retailer has acquired another company. Teams need autonomy, but networking, security, and audit requirements must remain consistent.

1. Separate Permission Grants from Guardrails

• IAM policies grant permissions; SCPs set the maximum permissions available to principals in member accounts. An SCP does not grant access.
• An explicit deny inherited from the organization root cannot be undone by an allow in a child OU.
• SCPs do not constrain the management account or service-linked roles. Keep workloads out of the management account and design exceptions deliberately.
• IAM Identity Center handles workforce access through groups and permission sets. It is not interchangeable with Cognito customer identities.

For cross-account access, trace the entire authorization chain. An assumed role needs an appropriate trust policy and caller permission; the resulting role session still needs permission to use the resource. If the resource uses a customer-managed KMS key, encryption authorization is another boundary to check.

Example: A temporary onboarding OU cannot escape a deny attached at the root. If an acquired account needs an exception, place the production-specific restriction at an appropriate OU boundary and preserve the common baseline separately. Adding another allow is not an exception mechanism for an inherited explicit deny.

2. Centralize the Right Things

Sharing an existing VPC and connecting independently managed VPCs solve different problems. Choose shared subnets when the infrastructure team owns the network. Choose Transit Gateway when the accounts retain their own VPCs but need controlled connectivity. Use PrivateLink when the requirement is access to a particular service, not general network transit.

3. Hybrid DNS and Network Segmentation

• Inbound Resolver endpoints: Receive on-premises DNS queries for AWS names. Configure on-premises conditional forwarding and permit the necessary TCP/UDP 53 traffic.
• Outbound endpoints and forwarding rules: Send matching queries from AWS to on-premises resolvers. Associate or share the rules with the consuming VPCs.
• Private hosted zones: Must be associated with the relevant VPCs. Peering or a TGW attachment does not automatically make a private zone visible.
• TGW route tables: Association selects the table used for traffic entering an attachment; propagation determines which attachment routes populate a table. Restrict both when separating production and development.

My troubleshooting order is name resolution -> route -> network controls -> application permissions. A DNS response containing a private IP does not prove that the client has a working route to it.

4. Audit, Ownership, and Chargeback

Tag policies standardize supported tag values, but do not by themselves require every resource to have every tag. Prevention needs appropriate request-tag conditions for supported actions; existing resources need detection and remediation.

Domain 1 Practice Questions

Question 1

The acquired company joins the retailer’s AWS organization. Its application team must create EC2 instances in subnets managed by the central infrastructure account, without managing the VPC’s route tables. Which design fits?

• A. Share the required subnets from the infrastructure account through AWS RAM.
• B. Peer the accounts’ VPCs and make the application team manage both networks.
• C. Give the application team administrator access to the infrastructure account.
• D. Create an IAM Identity Center permission set without sharing any network resources.

Question 2

An analytics role in Account B must read reports from an S3 bucket in Account A. The objects use a customer-managed KMS key in Account A. The role and bucket policies already permit the required S3 reads, but neither the role policy nor the KMS key policy grants the necessary cross-account decryption access. Which combination completes the authorization? (Select TWO)

• A. Enable CORS on the report bucket.
• B. Allow kms:Decrypt for the specified key in the analytics role’s IAM policy.
• C. Attach the FullAWSAccess SCP to Account B and make no other changes.
• D. Allow only kms:Encrypt for the analytics role.
• E. Update the KMS key policy to permit the analytics role’s required decryption access.

Question 3

Corporate users must resolve an AWS private namespace over an existing Direct Connect connection. The private hosted zone is already associated with the application and shared-services VPCs, and network routes are in place. Which managed configuration lets the corporate DNS servers resolve that namespace without deploying DNS servers on EC2?

• A. Create only a Resolver outbound endpoint and point corporate DNS forwarding at it.
• B. Publish the private records in a public hosted zone.
• C. Create a Resolver inbound endpoint and configure corporate conditional forwarding to its reachable IP addresses.
• D. Enable Route 53 latency-based routing for the private records.

Domain 2: Design for New Solutions (29% Weighting)

Domain 2 connects application requirements to secure, resilient, scalable architectures. The key is choosing compatible services and then configuring the relationships between them correctly.

Design review: The retailer is launching a new service and adding a private integration with a supplier. Traffic is uncertain, but correctness and recovery requirements are not optional.

1. Start with Access Patterns, Not Favorite Services

Compute choice follows the same logic. Lambda suits short event-driven processing, ECS on Fargate suits container workloads without host management, and EKS suits requirements that justify Kubernetes compatibility. A two-hour job does not become a valid Lambda workload because it is packaged as a container image.

Separate the system of record from its acceleration layer. A cache can reduce repeated reads, but the design must still explain cache misses, stale values, invalidation, and what happens if the cache is unavailable. Use MemoryDB when the requirement is a durable in-memory primary database, rather than assuming every Redis-compatible service has the same durability model.

2. Security and Network Boundaries

For traffic distribution, protocol requirements eliminate options quickly. An ALB understands HTTP routing and supports features such as path rules and application authentication. An NLB handles TCP, UDP, or TLS listeners and can provide static addresses per AZ. A friendly DNS name does not make an ALB support UDP.

3. Design the Failure Path Alongside the Happy Path

• RPO measures acceptable data loss in time; RTO measures acceptable recovery time.
• Multi-AZ resilience does not automatically provide recovery from a Region outage.
• Cross-Region replication, secondary application capacity, secrets, certificates, quotas, and routing all belong in the recovery plan.
• A DNS failover record does not promote a database or start an Auto Scaling group. Those steps need tested orchestration.

These are patterns, not guaranteed recovery times. An asynchronous replica cannot promise zero data loss during an unplanned regional failure simply because its normal lag is small.

The recovery sequence must account for detecting failure, promoting or restoring data, updating application configuration, scaling capacity, and directing clients to a ready endpoint. Plan how to avoid conflicting writers and how to fail back, not just how to leave the primary Region.

The dashed paths represent failover and replication. They do not imply automatic database promotion: the standby must have a writable, validated data path before it accepts production writes.

4. Global Entry Points and Content Delivery

• Route 53 failover routing: Active-passive DNS selection driven by health. Client caching and application reconnection still affect recovery.
• Route 53 latency routing: Select a low-latency healthy Region for an appropriate active-active design. It does not provision additional capacity.
• Global Accelerator: Static global IP entry points for supported TCP/UDP architectures, with endpoint health-based routing over the AWS network.
• CloudFront: Cache and deliver HTTP(S) content close to users. Origin-group failover has supported-method restrictions; it is not general failover for every write request.

A regional application’s data, application capacity, and entry point need compatible recovery behavior. Improving only the global routing layer leaves a broken design if the secondary cannot serve the request.

Domain 2 Practice Questions

Question 1

The supplier exposes an NLB-backed inventory service. The retailer must access it privately, but the two VPCs have overlapping IPv4 ranges. The supplier must not initiate connections to the retailer’s application instances. Which approach is appropriate?

• A. Create VPC peering and propagate all routes.
• B. Consume the supplier’s endpoint service through an interface VPC endpoint with restricted access.
• C. Add both VPCs to the same Transit Gateway route table.
• D. Assign public IP addresses and allow-list the retailer’s instances.

Question 2

A customer-facing application must have a reduced but fully functional deployment running in a second Region before an outage. The business accepts scaling that deployment during recovery and paying for continuous data replication, but does not want both Regions serving full production traffic. Which recovery strategy best matches this requirement?

• A. Backup and restore, with infrastructure created after the primary Region fails.
• B. Pilot light, with the application tier absent or stopped until a disaster.
• C. Warm standby, with a smaller running application stack and replicated data.
• D. Full-capacity active-active operation across both Regions.

Question 3

Warehouse devices send UDP traffic to a new service deployed behind NLBs in two Regions. Customers need static global IPv4 entry points for firewall allow lists, and unhealthy regional endpoints must be avoided without relying on DNS changes. Which solution is appropriate?

• A. Put CloudFront in front of both NLBs.
• B. Replace the NLBs with ALBs and use path-based routing.
• C. Use only Route 53 latency records and assume every client immediately refreshes DNS after a failure.
• D. Use a standard Global Accelerator with the regional NLBs as endpoints.

Domain 3: Continuous Improvement for Existing Solutions (25% Weighting)

Domain 3 evaluates how to improve an existing workload’s reliability, performance, security, and cost without replacing components unnecessarily. Start with evidence about the constraint, then choose the smallest effective architectural change.

Design review: The service is live. Promotions create bursts, database connections spike, and the NAT bill is growing. The task is to improve the system without rewriting everything.

1. Name the Bottleneck Before Choosing the Fix

Scaling the wrong component can make an incident more expensive. Adding Lambda concurrency when the database is connection-bound can increase failures. Adding database read replicas does not help if the application keeps sending every query to the writer. A cache needs an access pattern and a consistency policy, not just a place in the diagram.

2. Optimize Commitments After Understanding Usage

• Compute Savings Plans cover eligible EC2, Lambda, and Fargate usage; they are not a discount for every AWS service.
• Buy commitments against a dependable baseline. Use elastic capacity for peaks and Spot for work that tolerates interruption.
• Capacity Reservations assure EC2 capacity in an AZ; they are not inherently a pricing discount.
• Apply and activate cost allocation tags before expecting team-level billing reports.
• Storage savings need an access model: object size, request volume, retrieval latency, minimum duration, and recovery requirements all affect the result.

Rightsizing comes before committing to the bill. Collect guest-memory metrics where needed, review workload peaks rather than only averages, and use tools such as Compute Optimizer to identify candidates. A discount on an oversized instance is still spending on unused capacity.

For storage, I use four checks: how often it is read, how quickly it must be retrieved, how large the objects are, and how long it must be retained. A lower per-GB storage price can lose its advantage through retrieval fees, minimum-duration charges, or an unacceptable restore delay.

3. Decoupling, Backpressure, and Long-Running Work

For comparable EC2 queue workers, scale on visible backlog per in-service processing instance, with a target derived from acceptable wait time and processing time. Queue age measures delay; CPU alone may miss a growing backlog caused by I/O waits.

The queue-consumer contract matters just as much as scaling. Delete messages after successful processing, size/extend visibility timeout for the work, isolate poison messages with a DLQ, and make business operations idempotent. FIFO ordering and deduplication do not remove the need to handle repeated side effects safely.

4. Observability and Safer Changes

• CloudWatch: Metrics, application logs, alarms, and the evidence needed to understand saturation or errors. Guest memory requires an appropriate collection mechanism.
• Distributed tracing: Follow request paths and downstream latency; distinguish a slow dependency from a cold start or network failure.
• CloudTrail: Identify AWS API activity and the principal involved. It is not a substitute for application traces or database query logs.
• AWS Config: Inspect resource configuration and compliance history. An evaluation result is not the same as a preventive control.

For releases, a stable Lambda alias lets clients avoid embedding every new version ARN. SAM/CodeDeploy can shift traffic gradually, run validation hooks, and use alarms for rollback. A CloudFormation change set previews infrastructure changes; it does not test the application’s behavior.

For termination-sensitive work, a lifecycle hook can hold an instance while final logs are uploaded. Signal completion when the work finishes, send heartbeats when appropriate, and do not assume periodic local copies will survive an unexpected failure.

Domain 3 Practice Questions

Question 1

The retailer accepts asynchronous order processing. During promotions, request bursts overwhelm the database. Each worker uses at most one database connection, and load testing establishes a safe concurrent-worker limit. Which TWO changes provide durable buffering and enforce that limit?

• A. Put accepted work into SQS and acknowledge receipt after successful enqueueing.
• B. Process the queue with Lambda using a reserved-concurrency ceiling sized for the database, with retry and idempotency handling.
• C. Increase Lambda provisioned concurrency and assume it limits simultaneous execution.
• D. Reduce the SQS retention period to make the database process messages faster.
• E. Add a read replica and continue sending all processing to the writer.

Question 2

Private EC2 workers read large amounts of data from an S3 bucket in the same Region through NAT gateways. The application must keep its current S3 API calls and private subnet placement. Which change most directly removes NAT processing charges for those S3 requests without introducing a managed endpoint’s hourly/data-processing charges?

• A. Replace every NAT gateway with a self-managed NAT instance and keep the same traffic path.
• B. Create an S3 interface endpoint and route every S3 request through it.
• C. Create an S3 gateway endpoint, associate the workers’ route tables, and configure the required endpoint/resource permissions.
• D. Move the S3 bucket to another Region and keep using the NAT gateways.

Question 3

An image-processing workload now needs about 45 minutes for each large file and cannot be split into independent short steps. Its current Lambda invocation times out at the maximum setting. The processor is already available as a container, and the team does not want to manage servers. Which change best addresses the execution limit?

• A. Raise the Lambda timeout to 60 minutes.
• B. Configure Lambda provisioned concurrency to remove the maximum runtime.
• C. Deploy the container as a Lambda container image and keep the processing unchanged.
• D. Run the processor as an ECS task on Fargate with suitable event orchestration, permissions, and retry handling.

Domain 4: Accelerate Workload Migration and Modernization (20% Weighting)

Domain 4 focuses on assessing an application estate, choosing an appropriate migration strategy, and executing a cutover that preserves required behavior. Modernization decisions must account for dependencies, compatibility, downtime, and organizational readiness.

Design review: The acquired business has legacy servers, shared Windows files, and a deadline. The source code is unavailable for some applications. Rebuilding everything is not a realistic first move.

1. Separate Migration Strategy from Migration Tool

Rehost, replatform, refactor, repurchase, relocate, retire, and retain describe different decisions. Modernization is not automatically a rewrite; sometimes the useful first step is preserving behavior while removing a specific operational burden.

2. Match the Tool to the Asset

DMS moves database data; it does not automatically convert every stored procedure. DataSync supports repeated incremental transfers, but it does not become a live shared filesystem. A successful replication job is not the same as a successful application cutover.

3. Discover Dependencies and Plan Migration Waves

Inventory alone is not enough. Capture the communication paths, scheduled jobs, authentication dependencies, shared storage, license restrictions, and unusual peak periods that make applications work together.

• Application Discovery Service: Collect configuration, utilization, and appropriate process/network dependency data. Agent-based collection is useful when that detailed dependency evidence is required.
• Migration Hub: Organize the portfolio and migration progress; use discovered relationships to inform application groups and waves.
• Migration Evaluator: Support a migration business case and sizing/cost assessment; validate assumptions about the actual target architecture.
• Test launches: Check a migrated application’s behavior in an isolated target environment before changing production traffic. Replicating a bootable server does not prove that its external dependencies are available.

Move tightly coupled dependencies together when splitting them would create unacceptable latency or availability risks. A useful migration wave reflects the dependency graph, not just a list of servers with the same operating system.

4. Validate the Cutover, Not Just the Copy

For a database migration with ongoing writes, the sequence generally includes:

1. Assess compatibility, convert the schema/code where needed, and resolve unsupported features.
2. Establish private network paths and the required source/target credentials and permissions.
3. Perform the initial load and maintain CDC with suitable source-log retention.
4. Validate representative data, application behavior, and target performance.
5. Quiesce or control source writes, let changes catch up, and switch application endpoints in the planned window.
6. Monitor the new environment and follow a tested rollback plan that avoids conflicting writers.

For shared files, verify protocols, AD integration, ACLs, metadata, mount paths, name resolution, and remaining changes. For servers, include boot configuration, attached data, service dependencies, and license requirements. For recovery, test restores rather than assuming a backup’s existence proves recoverability.

Existing Direct Connect bandwidth can make online file transfer practical, but the network path still needs suitable encryption where required. Offline transfer is a trade-off involving data volume, usable bandwidth, shipping time, service availability, and ongoing changes, not a universal rule based on a fixed dataset size.

Domain 4 Practice Questions

Question 1

A legacy application runs on several VMs and uses a shared SMB folder. The source code is unavailable. The company already has sufficient Direct Connect bandwidth, and the goal is to migrate with minimal application changes. Which TWO actions are appropriate?

• A. Replicate the supported servers with MGN, validate test launches, and plan the cutover.
• B. Transfer the shared files to FSx for Windows File Server with DataSync, preserve the required permissions, and remap the share during cutover.
• C. Use DMS to replicate the VMs’ operating systems.
• D. Replace SMB with an EFS mount and assume Windows file permissions behave identically.
• E. Rewrite the application as Lambda functions before starting migration.

Question 2

A company has an incomplete inventory of on-premises Windows and Linux workloads. Before assigning migration waves, it needs running-process and network-connection information to identify applications that must move together. Which approach supplies the most relevant discovery evidence?

• A. Use Cost Explorer to infer every on-premises network dependency from the AWS bill.
• B. Install only replication agents and assume successful disk replication produces an application dependency map.
• C. Run Trusted Advisor against the existing AWS accounts and treat the results as an inventory of the data center.
• D. Collect detailed workload information with Application Discovery Service agents and organize application groups in Migration Hub.

Question 3

An application uses Oracle on premises and must move to RDS for PostgreSQL. The business permits necessary compatibility changes but wants to minimize the final write outage. Which approach best supports this migration?

• A. Use a DMS full-load-only task and assume it automatically converts all Oracle stored procedures.
• B. Assess and convert compatible schema/code with SCT, resolve unsupported features, and use DMS full load plus CDC before a validated cutover.
• C. Copy the running Oracle database files to PostgreSQL storage with DataSync.
• D. Rehost the Oracle server with MGN and consider the engine conversion complete.

The Answer That Almost Works

Some of the most useful study notes are not service definitions. They explain why a plausible architecture still fails one requirement.

I also keep a separate list of rules that have aged badly. For example, Object Lock can be enabled on an existing versioned S3 general purpose bucket, and current KMS documentation specifies FIPS 140-3 Security Level 3 validated HSMs. The old “new bucket only” and “KMS is only Level 2” shortcuts should not drive a new design.

Final Review Strategy: Read for the Constraint

At 180 minutes for 75 questions, the average budget is about 2 minutes 24 seconds per question. That is a pacing reference, not a requirement to spend the same time on every scenario.

My recommended reading order:

1. Find the requested outcome. Lowest cost and least operational overhead are different priorities.
2. Mark the non-negotiables. Protocols, data residency, compatibility, RPO/RTO, and allowed application changes.
3. Trace the complete path. Identity, DNS, routing, data access, and failure recovery must all work.
4. Eliminate one broken assumption at a time. Explain why each discarded option fails.
5. Check the response count. A multi-select answer must form a complete solution, not just contain familiar services.

Resources and Further Reading

• SAP-C02 exam guide for the version-specific domain outline.
• AWS Well-Architected Framework for evaluating design trade-offs.
• AWS Architecture Center for reference patterns and architectural guidance.
• AWS Prescriptive Guidance for migration and modernization approaches.
• CloudFront origin failover, Object Lock configuration, and KMS overview for the specific boundaries discussed above.
• My earlier DOP-C02 study notes and SOA-C03 study notes for the delivery and operations side of these architectures.

Five Scenario Questions for Final Review

These scenarios combine requirements across domains. Choose the complete architecture, then check whether your explanation addresses permissions, operational effort, data behavior, and failure recovery.

Scenario 1: Audit Baselines for the Next Acquisition

A company expects more accounts to join its organization. It needs centralized management-event logging across member accounts and Regions, plus a standard IAM role in current and future accounts in the Workloads OU. Which combination minimizes custom onboarding automation? (Select TWO)

• A. Configure a multi-Region organization CloudTrail trail with the appropriate central logging destination.
• B. Ask each account administrator to create an independent trail and manually provision the role after joining.
• C. Attach a tag policy and assume it creates the required logging and IAM resources.
• D. Deploy the IAM role through a service-managed StackSet in a designated Region, target the Workloads OU, and enable automatic deployment.
• E. Use a Config aggregator as the mechanism that creates the IAM role in every account.

Scenario 2: Multi-Region Recovery Is More Than DNS

An application has an ALB and an Auto Scaling group in a secondary Region, but the group currently has zero instances. A cross-Region RDS read replica receives the data. A team adds Route 53 failover routing and considers recovery complete. Which additional design is necessary before the secondary can reliably accept application writes?

• A. Reduce the DNS TTL and assume that routing promotes the database and starts the instances.
• B. Orchestrate database promotion, application configuration, and compute scale-up, then expose readiness to the health/routing mechanism.
• C. Enable another Multi-AZ standby in the primary Region and leave the secondary unchanged.
• D. Send production write traffic to the unpromoted read replica whenever the primary health check fails.

Scenario 3: Fast Analytics Without Permanent Scratch Capacity

A periodic parallel-processing job runs on EC2 for several hours. It reads a subset of a large S3 dataset and needs a high-throughput shared POSIX filesystem while running. The source and results must persist, but the scratch filesystem is unnecessary between jobs. Which design best avoids paying for idle filesystem capacity?

• A. Keep an EC2-hosted NFS cluster running continuously and copy every S3 object to it before each run.
• B. Attach one EBS volume simultaneously to workers in multiple Availability Zones.
• C. Create an S3-linked FSx for Lustre filesystem for the run, load the required data, export required results to S3, and delete the filesystem after completion.
• D. Replace the filesystem with Glacier Deep Archive and treat archived objects as immediately mountable POSIX files.

Scenario 4: Immutable Reports After Privileged Access Is Compromised

An existing S3 general purpose bucket contains financial reports. Selected existing versions and future reports must remain undeletable for seven years, even by privileged users or the bucket account’s root user. Which S3 configuration addresses that retention requirement?

• A. Enable versioning alone and let administrators delete versions when storage runs low.
• B. Use Object Lock governance mode while allowing administrators to bypass retention.
• C. Rely only on a bucket policy denying deletion, which the same administrators can edit.
• D. Enable versioning and Object Lock, apply compliance-mode retention to the required existing versions, and configure appropriate retention for future reports.

Scenario 5: Stateless Scaling for Stateful Checkout

A checkout application runs on one EC2 instance behind an ALB. It keeps session state on the instance, while completed orders are already stored in an RDS Multi-AZ database. The application must tolerate instance replacement and an AZ failure without depending on the failed instance’s session files. The session-access code can be changed. Which TWO actions address the application-tier requirements?

• A. Run the application in a multi-AZ Auto Scaling group behind the ALB.
• B. Enable ALB stickiness and keep the only session copy on the original instance.
• C. Move session state to an appropriate shared service such as DynamoDB and update the application to use it.
• D. Replace the instance with a larger instance in the same AZ and disable automated replacement.
• E. Store sessions only on instance store and assume the data follows a replacement instance.

Final Thoughts

Passing SAP-C02 is a milestone I am glad to add to this certification journey. The more useful takeaway is a clearer way to discuss architecture: state the constraint, explain the trade-off, and show how the design behaves when conditions change.

DOP-C02 and SAP-C02 complement each other. One emphasizes delivering and operating systems; the other broadens the design conversation across business requirements, organizational boundaries, and migration choices.

The badge marks the exam result. The habit I want to keep is asking why this design, for this business, under these constraints?