SAP-C02 — AWS Certified Solutions Architect - Professional
Amazon

AWS Certified Solutions Architect - Professional (SAP-C02) Practice Questions

★★★★★★ 4.3 113 verified reviews
85 questions
June 13, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Design Solutions for Organizational Complexity (26%)
  • Design for New Solutions (29%)
  • Continuous Improvement for Existing Solutions (25%)
  • Accelerate Workload Migration and Modernization (20%)

Sample Questions (9 of 85 shown)

Q1 Design Solutions for Organizational Complexity (26%)
A company has 200 AWS accounts and wants to implement a centralized logging strategy. All CloudTrail logs should be consolidated into a dedicated logging account and must be tamper-proof. Which architecture achieves this?
  1. Enable CloudTrail in each account and export to per-account S3 buckets
  2. Use CloudTrail organization trail delivering logs to S3 in a dedicated logging account with S3 Object Lock
  3. Use CloudWatch Logs cross-account observability
  4. Use AWS Config aggregator in the logging account
✓ Correct Answer: B
AWS Organizations CloudTrail organization trail automatically enables CloudTrail across all accounts and delivers all events to a single S3 bucket in the management/logging account. S3 Object Lock in compliance mode makes logs tamper-proof (cannot be deleted or modified).
Q2 Design Solutions for Organizational Complexity (26%)
A financial company needs to migrate on-premises workloads to AWS. Strict compliance requirements dictate that certain data must never leave a specific AWS Region. How should they enforce this requirement?
  1. Use IAM policies with resource-based conditions
  2. Implement SCPs that deny operations outside the specific Region
  3. Use VPC endpoint policies
  4. Configure CloudTrail to alert on cross-Region activity
✓ Correct Answer: B
SCPs in AWS Organizations can use the aws:RequestedRegion condition key to deny all actions in all Regions except the allowed ones. This provides a preventive guardrail that even account administrators cannot bypass.
Q3 Design Solutions for Organizational Complexity (26%)
A company uses AWS Organizations to manage 50 accounts. They need to ensure all accounts only use approved EC2 instance types to control costs. How should they implement this policy with minimal operational overhead?
  1. Create IAM policies in each account restricting instance types
  2. Use an SCP that denies launching non-approved instance types
  3. Use AWS Budgets with instance type filters
  4. Use AWS Config rules in each account
✓ Correct Answer: B
SCPs can use the ec2:InstanceType condition to deny ec2:RunInstances when the type is not in the approved list. This applies to all accounts in the organization/OU with a single policy.
Q4 Design Solutions for Organizational Complexity (26%)
A company implements a multi-account strategy. They want to separate billing, security, logging, and workloads into dedicated accounts. What is the recommended AWS Organizations structure?
  1. All accounts in a single flat OU under the management account
  2. Management account > Security OU (security tools, logging) + Workload OU (dev, staging, prod) with separate SCPs
  3. Separate Organizations for each department
  4. Single account with resource tags for separation
✓ Correct Answer: B
AWS recommends the landing zone structure: Management account (billing/gov only), Security OU (containing security tool and log archive accounts), and Workload OUs (containing dev/staging/prod accounts), each with tailored SCPs.
Q5 Design Solutions for Organizational Complexity (26%)
A company uses AWS Organizations and wants all accounts to have centralized DNS. All accounts should be able to resolve internal domain names. What is the recommended architecture?
  1. Deploy Route 53 private hosted zones in each account
  2. Share Route 53 Resolver rules via AWS RAM; centrally manage DNS in the shared services account
  3. Use public hosted zones for all internal DNS
  4. Deploy DNS servers on EC2 in each account
✓ Correct Answer: B
The recommended architecture creates Route 53 Resolver outbound endpoint rules in the shared services account that forward queries to on-premises DNS. Resolver rules are shared via AWS RAM so all accounts can use them, centralizing DNS management.
Q6 Design Solutions for Organizational Complexity (26%)
A company has strict encryption requirements. All data at rest must be encrypted with customer managed keys. Key rotation must be automatic and auditable. How should they implement this?
  1. Use AWS managed KMS keys (aws/s3, etc.)
  2. Use customer managed KMS keys with automatic key rotation enabled, and log all key usage via CloudTrail
  3. Use SSE-C (customer-provided keys) for S3
  4. Use client-side encryption with application-managed keys
✓ Correct Answer: B
Customer managed KMS keys (CMKs) with automatic annual rotation enabled provide auditable, customer-controlled encryption. CloudTrail automatically records all KMS API calls (every Encrypt/Decrypt operation), providing a complete audit trail.
Q7 Design Solutions for Organizational Complexity (26%)
A company needs to comply with PCI DSS requirements. Their payment processing application runs on AWS. The cardholder data environment (CDE) must be isolated from other workloads. Which architecture achieves this?
  1. Use separate security groups for CDE workloads
  2. Isolate the CDE in a separate AWS account with strict SCPs and a dedicated Direct Connect or VPN for all CDE traffic
  3. Use network ACLs to isolate the CDE VPC
  4. Use S3 bucket policies to restrict CDE data access
✓ Correct Answer: B
PCI DSS requires strict CDE isolation. A separate AWS account provides the strongest isolation boundary — different blast radius, separate audit trail, dedicated IAM and network controls. SCPs ensure the CDE account cannot be misconfigured.
Q8 Design Solutions for Organizational Complexity (26%)
A multi-account organization needs to enforce that no account can create public S3 buckets, regardless of the account administrator's permissions. How should this be implemented?
  1. Set S3 Block Public Access in each account
  2. SCP denying s3:PutBucketPublicAccessBlock set to false
  3. SCP denying s3:PutBucketAcl and s3:PutBucketPolicy that grant public access, combined with SCP-enforced S3 Block Public Access
  4. Set AWS Config rules in each account
✓ Correct Answer: C
SCPs can deny operations that would make buckets public. SCPs can also enforce that s3:PutAccountPublicAccessBlock must always have BlockPublicAcls: true. This prevents any account administrator from disabling Block Public Access.
Q9 Design Solutions for Organizational Complexity (26%)
A company has complex IAM permissions and needs to understand what a specific IAM role can do and whether it follows least privilege. Which tool provides this analysis?
  1. AWS IAM Access Analyzer
  2. AWS CloudTrail last accessed information
  3. AWS IAM Policy Simulator
  4. All of the above serve different purposes
✓ Correct Answer: D
Each tool serves a different purpose: (1) IAM Access Analyzer identifies externally shared resources and generates least-privilege policies from CloudTrail activity. (2) CloudTrail last accessed info identifies unused permissions. (3) IAM Policy Simulator tests which API operations are allowed/denied.

You've viewed 3 of 85 questions. Start the free practice exam to answer all questions with instant feedback.

What Our Customers Say 113 verified reviews

4.3 ★★★★★★ Based on 113 reviews
★★★★★
I passed SAP-C02 on my first try thanks to these practice questions. The unlimited retakes were essential for building confidence.
— Nicole K.
★★★★★★
Comparing this with other Amazon practice tests, this one feels the most like the real SAP-C02 exam.
— Mia R.
★★★★★★
Took the SAP-C02 exam today and passed with 87%. Used this as my main prep material for about a month.
— Grace L.
★★★★★★
SAP-C02 was harder than I expected but these questions prepared me well. The multi-select ones in particular were really close to the exam.
— Chloe D.
★★★★★★
Bought lifetime access for the SAP-C02 bank and it’s been great. Still use it to brush up even after passing the cert.
— Sophie L.
★★★★★★
Straightforward and effective. No fluff in the SAP-C02 practice set, just relevant questions with solid answer keys.
— Owen P.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

AWS recommends 2+ years of hands-on experience designing and implementing cloud solutions on AWS, along with SAA-C03 (Solutions Architect Associate) certification. The SAP-C02 is intentionally the most challenging AWS exam, designed for experienced architects who have worked with complex, multi-account, multi-region environments. You should be deeply familiar with the Well-Architected Framework, enterprise networking (Transit Gateway, Direct Connect), organizational governance (Organizations, SCPs, Control Tower), migration strategies (7 Rs), and advanced security patterns. Without the Associate-level foundation, the Professional exam is extremely difficult.

The difference is scope, depth, and complexity. SAA-C03 tests foundational architectural knowledge across individual AWS services — selecting the right service for a given use case. SAP-C02 tests enterprise-scale architectural decision-making — designing solutions that span multiple accounts, regions, and services simultaneously. While SAA-C03 asks "which service should I use?", SAP-C02 asks "how do I design a globally distributed, multi-account, compliant, cost-optimized, and secure architecture that serves 10,000+ users across 5 regions?" The Professional exam requires deep understanding of service interactions, tradeoffs, and operational implications at scale.

Yes — Domain 4 (Accelerate Workload Migration and Modernization) is 20% of the exam and represents a critical skill for enterprise architects. You should understand the full migration lifecycle: assessment (Migration Evaluator, ADS), planning (7 Rs strategy selection), execution (Migration Hub, DMS, SMS, CloudEndure/MGN), and post-migration validation. Migration strategies for databases (DMS), servers (MGN), and entire data centers are tested. Modernization is equally important — transitioning from EC2 to containers (ECS/EKS), from self-managed databases to Aurora/DynamoDB, and from monolithic to event-driven architectures.

Our product provides 500+ practice questions organized across all four domains with correct weightings, designed to replicate the difficulty and complexity of the real exam. Each question includes detailed explanations that explore architectural tradeoffs, multi-service integration patterns, and Well-Architected Framework principles. You get full-length simulation exams (75 questions, 180 minutes), domain-wise practice modules (organizational complexity, new solutions, continuous improvement, migration/modernization), and a downLOADABLE PDF study guide with enterprise architecture blueprints, migration strategy decision trees, multi-account governance frameworks, and advanced Well-Architected Framework review templates.

SAP-C02 requires the most preparation of any AWS exam. Candidates with SAA-C03 and 2+ years of experience typically need 10-14 weeks (150-200 hours). Those with SAA-C03 but limited enterprise experience may need 16-20 weeks (200-280 hours). We recommend: (1) Master the SAA-C03 content first; (2) Study the official SAP-C02 exam guide and in-scope services thoroughly; (3) Complete AWS Skill Builder's SAP-C02 Exam Prep course; (4) Gain hands-on experience with enterprise-scale patterns (multi-account, hybrid networking, large-scale migration); (5) Use our practice tests for domain-wise assessment across all four domains; (6) Take multiple full-length simulation exams under timed conditions; (7) Review all detailed explanations systematically.

The SAP-C02 exam guide now includes emerging topics related to AI and generative AI governance. These appear as pretest questions (not scored) but signal important architectural directions. Topics include: implementing content filtering and regulatory compliance controls for generative AI using Amazon Bedrock Guardrails; implementing access controls for generative and agentic AI applications using AgentCore Identity; and designing human oversight workflows with approval mechanisms for AI operations using AWS Step Functions. This reflects AWS's focus on helping enterprise architects design safe, secure, and compliant AI-enabled architectures.

The SAP-C02 is the most valuable and respected AWS certification in the industry. It positions you for the highest-level cloud roles such as Enterprise Architect, Chief Cloud Architect, Principal Solutions Architect, Cloud Advisor, and CTO-level consulting positions. Certified professionals are recognized as experts who can design and lead the most complex cloud initiatives. The certification is a career milestone that significantly impacts earning potential — SAP-C02 holders typically command the highest salaries in the cloud computing field. It also unlocks speaking, writing, and thought leadership opportunities in the cloud architecture community.

Free Study Resources

Community-verified analysis of 119 topics from real test-taker discussions — 63 deep analyses and 0 FAQs.

Full Study Guide 119 topics, exam overview & domain breakdown Most Debated Topics Ranked by community disagreement