AWS Certified Solutions Architect - Professional (SAP-C02) practice questions

Domain coverage 4 domains

• Design Solutions for Organizational Complexity (26%)
• Design for New Solutions (29%)
• Continuous Improvement for Existing Solutions (25%)
• Accelerate Workload Migration and Modernization (20%)

Sample questions 9 of 85 shown

1. Q1 Design Solutions for Organizational Complexity (26%)

   A company has 200 AWS accounts and wants to implement a centralized logging strategy. All CloudTrail logs should be consolidated into a dedicated logging account and must be tamper-proof. Which architecture achieves this?

   1. Enable CloudTrail in each account and export to per-account S3 buckets
   2. Use CloudTrail organization trail delivering logs to S3 in a dedicated logging account with S3 Object Lock
   3. Use CloudWatch Logs cross-account observability
   4. Use AWS Config aggregator in the logging account

   AWS Organizations CloudTrail organization trail automatically enables CloudTrail across all accounts and delivers all events to a single S3 bucket in the management/logging account. S3 Object Lock in compliance mode makes logs tamper-proof (cannot be deleted or modified).
2. Q2 Design Solutions for Organizational Complexity (26%)

   A financial company needs to migrate on-premises workloads to AWS. Strict compliance requirements dictate that certain data must never leave a specific AWS Region. How should they enforce this requirement?

   1. Use IAM policies with resource-based conditions
   2. Implement SCPs that deny operations outside the specific Region
   3. Use VPC endpoint policies
   4. Configure CloudTrail to alert on cross-Region activity

   SCPs in AWS Organizations can use the aws:RequestedRegion condition key to deny all actions in all Regions except the allowed ones. This provides a preventive guardrail that even account administrators cannot bypass.
3. Q3 Design Solutions for Organizational Complexity (26%)

   A company uses AWS Organizations to manage 50 accounts. They need to ensure all accounts only use approved EC2 instance types to control costs. How should they implement this policy with minimal operational overhead?

   1. Create IAM policies in each account restricting instance types
   2. Use an SCP that denies launching non-approved instance types
   3. Use AWS Budgets with instance type filters
   4. Use AWS Config rules in each account

   SCPs can use the ec2:InstanceType condition to deny ec2:RunInstances when the type is not in the approved list. This applies to all accounts in the organization/OU with a single policy.
4. Q4 Design Solutions for Organizational Complexity (26%)

   A company implements a multi-account strategy. They want to separate billing, security, logging, and workloads into dedicated accounts. What is the recommended AWS Organizations structure?

   1. All accounts in a single flat OU under the management account
   2. Management account > Security OU (security tools, logging) + Workload OU (dev, staging, prod) with separate SCPs
   3. Separate Organizations for each department
   4. Single account with resource tags for separation

   AWS recommends the landing zone structure: Management account (billing/gov only), Security OU (containing security tool and log archive accounts), and Workload OUs (containing dev/staging/prod accounts), each with tailored SCPs.
5. Q5 Design Solutions for Organizational Complexity (26%)

   A company uses AWS Organizations and wants all accounts to have centralized DNS. All accounts should be able to resolve internal domain names. What is the recommended architecture?

   1. Deploy Route 53 private hosted zones in each account
   2. Share Route 53 Resolver rules via AWS RAM; centrally manage DNS in the shared services account
   3. Use public hosted zones for all internal DNS
   4. Deploy DNS servers on EC2 in each account

   The recommended architecture creates Route 53 Resolver outbound endpoint rules in the shared services account that forward queries to on-premises DNS. Resolver rules are shared via AWS RAM so all accounts can use them, centralizing DNS management.
6. Q6 Design Solutions for Organizational Complexity (26%)

   A company has strict encryption requirements. All data at rest must be encrypted with customer managed keys. Key rotation must be automatic and auditable. How should they implement this?

   1. Use AWS managed KMS keys (aws/s3, etc.)
   2. Use customer managed KMS keys with automatic key rotation enabled, and log all key usage via CloudTrail
   3. Use SSE-C (customer-provided keys) for S3
   4. Use client-side encryption with application-managed keys

   Customer managed KMS keys (CMKs) with automatic annual rotation enabled provide auditable, customer-controlled encryption. CloudTrail automatically records all KMS API calls (every Encrypt/Decrypt operation), providing a complete audit trail.
7. Q7 Design Solutions for Organizational Complexity (26%)

   A company needs to comply with PCI DSS requirements. Their payment processing application runs on AWS. The cardholder data environment (CDE) must be isolated from other workloads. Which architecture achieves this?

   1. Use separate security groups for CDE workloads
   2. Isolate the CDE in a separate AWS account with strict SCPs and a dedicated Direct Connect or VPN for all CDE traffic
   3. Use network ACLs to isolate the CDE VPC
   4. Use S3 bucket policies to restrict CDE data access

   PCI DSS requires strict CDE isolation. A separate AWS account provides the strongest isolation boundary — different blast radius, separate audit trail, dedicated IAM and network controls. SCPs ensure the CDE account cannot be misconfigured.
8. Q8 Design Solutions for Organizational Complexity (26%)

   A multi-account organization needs to enforce that no account can create public S3 buckets, regardless of the account administrator's permissions. How should this be implemented?

   1. Set S3 Block Public Access in each account
   2. SCP denying s3:PutBucketPublicAccessBlock set to false
   3. SCP denying s3:PutBucketAcl and s3:PutBucketPolicy that grant public access, combined with SCP-enforced S3 Block Public Access
   4. Set AWS Config rules in each account

   SCPs can deny operations that would make buckets public. SCPs can also enforce that s3:PutAccountPublicAccessBlock must always have BlockPublicAcls: true. This prevents any account administrator from disabling Block Public Access.
9. Q9 Design Solutions for Organizational Complexity (26%)

   A company has complex IAM permissions and needs to understand what a specific IAM role can do and whether it follows least privilege. Which tool provides this analysis?

   1. AWS IAM Access Analyzer
   2. AWS CloudTrail last accessed information
   3. AWS IAM Policy Simulator
   4. All of the above serve different purposes

   Each tool serves a different purpose: (1) IAM Access Analyzer identifies externally shared resources and generates least-privilege policies from CloudTrail activity. (2) CloudTrail last accessed info identifies unused permissions. (3) IAM Policy Simulator tests which API operations are allowed/denied.

Answer all 85 questions with instant feedback →

Reader reviews 143 ratings

• I bought the SAP-C02 question bank a week before my exam and passed with 90%+. The questions are that good.

  ★★★★★ Maria V.

• I had almost given up on SAP-C02 after failing twice. These questions pinpointed exactly what I was missing. Third time’s the charm!

  ★★★★★ Noah S.

• The SAP-C02 certification opened up a promotion for me at work. These practice questions were a big part of that success.

  ★★★★★★ Ryan J.

• Amazing resource for SAP-C02! The unlimited practice attempts and detailed tracking helped me focus my study time effectively.

  ★★★★★★ Thomas B.

• I was skeptical about paying for exam prep, but the SAP-C02 bank saved me. Covered everything I needed.

  ★★★★★★ Nathan R.

• I used this for three months on and off for SAP-C02. The progress tracker helped me stay consistent.

  ★★★★★★ Hannah K.

Frequently asked questions

Free study resources

Community-verified analysis of 131 questions from real test-taker discussions — 73 deep analyses and 0 FAQs.

More Amazon exams