SAP-C02 — AWS Certified Solutions Architect - Professional
Amazon

AWS Certified Solutions Architect - Professional (SAP-C02) Practice Questions

★★★★★★ 4.5 109 verified reviews
85 questions
June 13, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Design Solutions for Organizational Complexity (26%)
  • Design for New Solutions (29%)
  • Continuous Improvement for Existing Solutions (25%)
  • Accelerate Workload Migration and Modernization (20%)

Sample Questions (9 of 85 shown)

Q1 Design Solutions for Organizational Complexity (26%)
A company has 200 AWS accounts and wants to implement a centralized logging strategy. All CloudTrail logs should be consolidated into a dedicated logging account and must be tamper-proof. Which architecture achieves this?
  1. Enable CloudTrail in each account and export to per-account S3 buckets
  2. Use CloudTrail organization trail delivering logs to S3 in a dedicated logging account with S3 Object Lock
  3. Use CloudWatch Logs cross-account observability
  4. Use AWS Config aggregator in the logging account
✓ Correct Answer: B
AWS Organizations CloudTrail organization trail automatically enables CloudTrail across all accounts and delivers all events to a single S3 bucket in the management/logging account. S3 Object Lock in compliance mode makes logs tamper-proof (cannot be deleted or modified).
Q2 Design Solutions for Organizational Complexity (26%)
A financial company needs to migrate on-premises workloads to AWS. Strict compliance requirements dictate that certain data must never leave a specific AWS Region. How should they enforce this requirement?
  1. Use IAM policies with resource-based conditions
  2. Implement SCPs that deny operations outside the specific Region
  3. Use VPC endpoint policies
  4. Configure CloudTrail to alert on cross-Region activity
✓ Correct Answer: B
SCPs in AWS Organizations can use the aws:RequestedRegion condition key to deny all actions in all Regions except the allowed ones. This provides a preventive guardrail that even account administrators cannot bypass.
Q3 Design Solutions for Organizational Complexity (26%)
A company uses AWS Organizations to manage 50 accounts. They need to ensure all accounts only use approved EC2 instance types to control costs. How should they implement this policy with minimal operational overhead?
  1. Create IAM policies in each account restricting instance types
  2. Use an SCP that denies launching non-approved instance types
  3. Use AWS Budgets with instance type filters
  4. Use AWS Config rules in each account
✓ Correct Answer: B
SCPs can use the ec2:InstanceType condition to deny ec2:RunInstances when the type is not in the approved list. This applies to all accounts in the organization/OU with a single policy.
Q4 Design Solutions for Organizational Complexity (26%)
A company implements a multi-account strategy. They want to separate billing, security, logging, and workloads into dedicated accounts. What is the recommended AWS Organizations structure?
  1. All accounts in a single flat OU under the management account
  2. Management account > Security OU (security tools, logging) + Workload OU (dev, staging, prod) with separate SCPs
  3. Separate Organizations for each department
  4. Single account with resource tags for separation
✓ Correct Answer: B
AWS recommends the landing zone structure: Management account (billing/gov only), Security OU (containing security tool and log archive accounts), and Workload OUs (containing dev/staging/prod accounts), each with tailored SCPs.
Q5 Design Solutions for Organizational Complexity (26%)
A company uses AWS Organizations and wants all accounts to have centralized DNS. All accounts should be able to resolve internal domain names. What is the recommended architecture?
  1. Deploy Route 53 private hosted zones in each account
  2. Share Route 53 Resolver rules via AWS RAM; centrally manage DNS in the shared services account
  3. Use public hosted zones for all internal DNS
  4. Deploy DNS servers on EC2 in each account
✓ Correct Answer: B
The recommended architecture creates Route 53 Resolver outbound endpoint rules in the shared services account that forward queries to on-premises DNS. Resolver rules are shared via AWS RAM so all accounts can use them, centralizing DNS management.
Q6 Design Solutions for Organizational Complexity (26%)
A company has strict encryption requirements. All data at rest must be encrypted with customer managed keys. Key rotation must be automatic and auditable. How should they implement this?
  1. Use AWS managed KMS keys (aws/s3, etc.)
  2. Use customer managed KMS keys with automatic key rotation enabled, and log all key usage via CloudTrail
  3. Use SSE-C (customer-provided keys) for S3
  4. Use client-side encryption with application-managed keys
✓ Correct Answer: B
Customer managed KMS keys (CMKs) with automatic annual rotation enabled provide auditable, customer-controlled encryption. CloudTrail automatically records all KMS API calls (every Encrypt/Decrypt operation), providing a complete audit trail.
Q7 Design Solutions for Organizational Complexity (26%)
A company needs to comply with PCI DSS requirements. Their payment processing application runs on AWS. The cardholder data environment (CDE) must be isolated from other workloads. Which architecture achieves this?
  1. Use separate security groups for CDE workloads
  2. Isolate the CDE in a separate AWS account with strict SCPs and a dedicated Direct Connect or VPN for all CDE traffic
  3. Use network ACLs to isolate the CDE VPC
  4. Use S3 bucket policies to restrict CDE data access
✓ Correct Answer: B
PCI DSS requires strict CDE isolation. A separate AWS account provides the strongest isolation boundary — different blast radius, separate audit trail, dedicated IAM and network controls. SCPs ensure the CDE account cannot be misconfigured.
Q8 Design Solutions for Organizational Complexity (26%)
A multi-account organization needs to enforce that no account can create public S3 buckets, regardless of the account administrator's permissions. How should this be implemented?
  1. Set S3 Block Public Access in each account
  2. SCP denying s3:PutBucketPublicAccessBlock set to false
  3. SCP denying s3:PutBucketAcl and s3:PutBucketPolicy that grant public access, combined with SCP-enforced S3 Block Public Access
  4. Set AWS Config rules in each account
✓ Correct Answer: C
SCPs can deny operations that would make buckets public. SCPs can also enforce that s3:PutAccountPublicAccessBlock must always have BlockPublicAcls: true. This prevents any account administrator from disabling Block Public Access.
Q9 Design Solutions for Organizational Complexity (26%)
A company has complex IAM permissions and needs to understand what a specific IAM role can do and whether it follows least privilege. Which tool provides this analysis?
  1. AWS IAM Access Analyzer
  2. AWS CloudTrail last accessed information
  3. AWS IAM Policy Simulator
  4. All of the above serve different purposes
✓ Correct Answer: D
Each tool serves a different purpose: (1) IAM Access Analyzer identifies externally shared resources and generates least-privilege policies from CloudTrail activity. (2) CloudTrail last accessed info identifies unused permissions. (3) IAM Policy Simulator tests which API operations are allowed/denied.

You've viewed 3 of 85 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

The AWS Certified Solutions Architect - Professional (SAP-C02) is the most advanced and prestigious AWS certification, representing the pinnacle of cloud architecture expertise. This Professional-level certification validates your ability to design optimized, complex solutions across the entire AWS ecosystem based on the AWS Well-Architected Framework. It is the definitive credential for senior architects who architect at the enterprise level.

The target candidate has 2 or more years of experience designing and implementing cloud solutions on AWS, with the ability to evaluate requirements and make architectural recommendations extending across multiple applications and projects within complex organizations. The exam covers four domains reflecting real-world architectural challenges: designing for organizational complexity (multi-account strategies, governance, cost management), designing for new solutions (compute, storage, database, networking, security, and migration decisions), continuously improving existing solutions (performance optimization, cost reduction, reliability enhancements), and accelerating workload migration and modernization (assessments, migration strategies, post-migration validation). A distinguishing feature of the SAP-C02 is its emerging topics section, which now includes designing security and responsible AI controls using Amazon Bedrock Guardrails, AgentCore Identity, and Step Functions.

Our SAP-C02 practice test product delivers advanced preparation with 500+ exam-quality questions covering all four domains. Each question simulates the complex, multi-service decision-making scenarios that define Professional-level exams, with detailed explanations that examine architectural tradeoffs, service integration patterns, and Well-Architected Framework principles. The package includes domain-wise practice modules, full-length simulation exams (75 questions, 180 minutes) matching the real exam format and difficulty, and a downloadable PDF study guide featuring enterprise architecture patterns, migration decision trees, multi-account governance frameworks, and advanced Well-Architected Framework review templates for comprehensive offline study.

Official Exam Domains & Weighting

To successfully pass the SAP-C02 exam, candidates must demonstrate advanced architectural expertise across the following four domains:
  • Domain 1: Design Solutions for Organizational Complexity (26%)
Design multi-account strategies using AWS Organizations, SCPs, and consolidated billing; implement complex network architectures with Transit Gateway, Direct Connect, VPN, VPC peering, and PrivateLink; design centralized governance with Service Catalog, Control Tower, and License Manager; implement cost optimization frameworks across accounts using Cost Explorer, Budgets, and Savings Plans; and design secure access patterns with IAM, SSO, and identity federation at enterprise scale.
  • Domain 2: Design for New Solutions (29%)
Design compute strategies across EC2, Lambda, ECS, EKS, and Fargate with appropriate purchasing options; design multi-tier storage architectures with S3 (all classes, replication, Object Lock), EBS, EFS, FSx, and AWS Backup; design database architectures with RDS, Aurora, DynamoDB (global tables, DAX), ElastiCache, Redshift, and Neptune; design decoupled, event-driven architectures using SQS, SNS, EventBridge, Step Functions, and Kinesis; design edge services with CloudFront, Global Accelerator, and Route 53; design security and compliance architectures using WAF, Shield, GuardDuty, Inspector, Security Hub, and Config.
  • Domain 3: Continuous Improvement for Existing Solutions (25%)
Evaluate and optimize existing architectures for performance, cost, and reliability; implement observability strategies with CloudWatch, X-Ray, CloudTrail, and VPC Flow Logs; design self-healing architectures using Auto Scaling, health checks, and automation; apply the Well-Architected Framework Review process; implement blue/green and canary deployment strategies; and optimize data transfer costs and network performance through CDN, caching, and compression strategies.
  • Domain 4: Accelerate Workload Migration and Modernization (20%)
Assess on-premises workloads using AWS Migration Evaluator and Application Discovery Service; design migration strategies using the 7 Rs (rehost, replatform, refactor, repurchase, retain, retire, relocate); execute large-scale migrations using AWS Migration Hub, DMS, Server Migration Service, and CloudEndure; design modernization strategies including containerization with ECS/EKS, database modernization with Aurora and DynamoDB, and serverless transformation; implement post-migration validation, optimization, and operational readiness reviews.

What Our Customers Say 109 verified reviews

4.5 ★★★★★★ Based on 109 reviews
★★★★★
These Amazon exam dumps for SAP-C02 saved me weeks of study time. The questions cover every domain thoroughly.
— Jessica W.
★★★★★★
Solid Amazon prep material. The SAP-C02 questions are well-written and the answer rationales are thorough.
— Madison T.
★★★★★
Ended up buying three different SAP-C02 prep resources and this was by far the most helpful one. Don’t waste money on others.
— Penelope W.
★★★★★★
Good bang for your buck on the SAP-C02 practice exam. Unlimited attempts means you can really drill the material.
— Zoey L.
★★★★★★
Took the SAP-C02 exam today and passed with 87%. Used this as my main prep material for about a month.
— Grace L.
★★★★★★
I studied for SAP-C02 with this bank and passed comfortably. The questions are well-organized and the UI is clean.
— Lauren C.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

AWS recommends 2+ years of hands-on experience designing and implementing cloud solutions on AWS, along with SAA-C03 (Solutions Architect Associate) certification. The SAP-C02 is intentionally the most challenging AWS exam, designed for experienced architects who have worked with complex, multi-account, multi-region environments. You should be deeply familiar with the Well-Architected Framework, enterprise networking (Transit Gateway, Direct Connect), organizational governance (Organizations, SCPs, Control Tower), migration strategies (7 Rs), and advanced security patterns. Without the Associate-level foundation, the Professional exam is extremely difficult.

The difference is scope, depth, and complexity. SAA-C03 tests foundational architectural knowledge across individual AWS services — selecting the right service for a given use case. SAP-C02 tests enterprise-scale architectural decision-making — designing solutions that span multiple accounts, regions, and services simultaneously. While SAA-C03 asks "which service should I use?", SAP-C02 asks "how do I design a globally distributed, multi-account, compliant, cost-optimized, and secure architecture that serves 10,000+ users across 5 regions?" The Professional exam requires deep understanding of service interactions, tradeoffs, and operational implications at scale.

Yes — Domain 4 (Accelerate Workload Migration and Modernization) is 20% of the exam and represents a critical skill for enterprise architects. You should understand the full migration lifecycle: assessment (Migration Evaluator, ADS), planning (7 Rs strategy selection), execution (Migration Hub, DMS, SMS, CloudEndure/MGN), and post-migration validation. Migration strategies for databases (DMS), servers (MGN), and entire data centers are tested. Modernization is equally important — transitioning from EC2 to containers (ECS/EKS), from self-managed databases to Aurora/DynamoDB, and from monolithic to event-driven architectures.

Our product provides 500+ practice questions organized across all four domains with correct weightings, designed to replicate the difficulty and complexity of the real exam. Each question includes detailed explanations that explore architectural tradeoffs, multi-service integration patterns, and Well-Architected Framework principles. You get full-length simulation exams (75 questions, 180 minutes), domain-wise practice modules (organizational complexity, new solutions, continuous improvement, migration/modernization), and a downLOADABLE PDF study guide with enterprise architecture blueprints, migration strategy decision trees, multi-account governance frameworks, and advanced Well-Architected Framework review templates.

SAP-C02 requires the most preparation of any AWS exam. Candidates with SAA-C03 and 2+ years of experience typically need 10-14 weeks (150-200 hours). Those with SAA-C03 but limited enterprise experience may need 16-20 weeks (200-280 hours). We recommend: (1) Master the SAA-C03 content first; (2) Study the official SAP-C02 exam guide and in-scope services thoroughly; (3) Complete AWS Skill Builder's SAP-C02 Exam Prep course; (4) Gain hands-on experience with enterprise-scale patterns (multi-account, hybrid networking, large-scale migration); (5) Use our practice tests for domain-wise assessment across all four domains; (6) Take multiple full-length simulation exams under timed conditions; (7) Review all detailed explanations systematically.

The SAP-C02 exam guide now includes emerging topics related to AI and generative AI governance. These appear as pretest questions (not scored) but signal important architectural directions. Topics include: implementing content filtering and regulatory compliance controls for generative AI using Amazon Bedrock Guardrails; implementing access controls for generative and agentic AI applications using AgentCore Identity; and designing human oversight workflows with approval mechanisms for AI operations using AWS Step Functions. This reflects AWS's focus on helping enterprise architects design safe, secure, and compliant AI-enabled architectures.

The SAP-C02 is the most valuable and respected AWS certification in the industry. It positions you for the highest-level cloud roles such as Enterprise Architect, Chief Cloud Architect, Principal Solutions Architect, Cloud Advisor, and CTO-level consulting positions. Certified professionals are recognized as experts who can design and lead the most complex cloud initiatives. The certification is a career milestone that significantly impacts earning potential — SAP-C02 holders typically command the highest salaries in the cloud computing field. It also unlocks speaking, writing, and thought leadership opportunities in the cloud architecture community.