AWS • SAP-C02
AWS Certified Solutions Architect - Professional (SAP-C02) Practice Test
Validates advanced technical skills and experience in designing optimized AWS solutions based on the AWS Well-Architected Framework.
Exam Details
Questions
592
Duration
180 minutes
Passing Score
750/1000
Difficulty
ProfessionalLast Updated
Jan 2025
Topics Covered
Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
Exam Domain Breakdown
Design Solutions for Organizational Complexity26%
Design for New Solutions29%
Continuous Improvement for Existing Solutions25%
Accelerate Workload Migration and Modernization20%
Exam Overview
The AWS Certified Solutions Architect – Professional (SAP-C02) is a professional-level certification that validates advanced technical skills and experience in designing optimized, complex AWS solutions. It tests the ability to evaluate cloud application requirements, make architectural recommendations, and provide expert guidance across multiple applications and projects within large, complex organizations — all grounded in the AWS Well-Architected Framework. The credential specifically assesses competency in handling organizational complexity, architecting new solutions from scratch, continuously improving existing workloads, and accelerating migration and modernization initiatives.
The SAP-C02 version of the exam represents the current iteration of this credential and is recognized across the industry as one of the most rigorous cloud certifications available. Unlike the Associate-level counterpart, this exam demands multi-dimensional mastery — candidates must demonstrate judgment in ambiguous, trade-off-heavy scenarios, design for large-scale enterprise environments, and integrate a broad range of AWS services into cohesive, production-ready architectures. The certification is valid for three years, after which recertification is required by passing the then-current version of the exam.
Who Should Take This Exam
This certification is designed for experienced cloud professionals performing a solutions architect role who have two or more years of hands-on experience designing and implementing cloud solutions on AWS. Ideal candidates include senior cloud architects, principal engineers, and cloud consultants who routinely provide architectural guidance across multiple teams, applications, or projects within complex organizational structures.
Professionals targeting roles such as Enterprise Cloud Architect, Principal Solutions Architect, Cloud Infrastructure Lead, or Senior DevOps Engineer will find this credential directly aligned with their career trajectory. It is also well-suited for individuals responsible for cloud migration strategies, governance frameworks, or leading cloud adoption programs within enterprises. Those who have already earned the AWS Certified Solutions Architect – Associate and have accumulated significant real-world AWS design experience are the most natural candidates.
Prerequisites
AWS does not enforce formal prerequisites for the SAP-C02 exam, but the official exam guide recommends that candidates have two or more years of experience using AWS services to design and implement cloud solutions. Candidates should be comfortable evaluating application requirements and translating them into AWS architectural recommendations across diverse use cases.
In practice, most successful candidates hold the AWS Certified Solutions Architect – Associate credential and have deep familiarity with a wide range of AWS services, including networking (VPC, Direct Connect, Transit Gateway), security (IAM, Organizations, SCPs), compute, storage, databases, and messaging. Experience designing multi-account architectures, hybrid connectivity models, disaster recovery strategies, and cost optimization frameworks is strongly recommended before attempting this exam.
Exam Format
The SAP-C02 exam consists of 75 total questions — 65 scored questions that contribute to your final result and 10 unscored experimental questions that are not identified and do not affect your score. Questions are presented in two formats: multiple choice (one correct answer from four options) and multiple response (two or more correct answers from five or more options, requiring all correct selections for full credit). Unanswered questions are scored as incorrect, but there is no penalty for guessing.
Candidates have 180 minutes to complete the exam. It is delivered via Pearson VUE, either at an authorized testing center or through an online proctored session. The exam is available in English, Japanese, Korean, Portuguese (Brazil), Simplified Chinese, and Spanish (Latin America). Scores are reported on a scaled range of 100–1,000, with a minimum passing score of 750. A compensatory scoring model is used, meaning candidates must achieve an overall passing score but are not required to pass each domain individually. Results are reported as Pass or Fail. The exam costs $300 USD, though holders of an active AWS Certification receive a 50% discount on subsequent exams.
Skills Measured
- 1.Domain 1 – Design Solutions for Organizational Complexity (26%): Covers architecting for multi-account AWS environments using AWS Organizations and Service Control Policies (SCPs), designing hybrid network connectivity (Direct Connect, VPN, Transit Gateway), implementing identity federation and cross-account access patterns, and creating governance and compliance frameworks for large enterprises.
- 2.Domain 2 – Design for New Solutions (29%): Focuses on selecting appropriate AWS services and architectural patterns to meet requirements for security, scalability, performance, reliability, and cost. Includes designing event-driven architectures, serverless solutions, container-based workloads, data analytics pipelines, and applying the AWS Well-Architected Framework pillars to greenfield solution design.
- 3.Domain 3 – Continuous Improvement for Existing Solutions (25%): Addresses evaluating and improving deployed architectures across the five Well-Architected pillars. Includes implementing operational excellence practices, optimizing cost with Reserved Instances, Savings Plans, and rightsizing, improving fault tolerance and resiliency, and integrating observability tooling such as CloudWatch, AWS Config, and AWS Trusted Advisor.
- 4.Domain 4 – Accelerate Workload Migration and Modernization (20%): Covers strategies for migrating on-premises workloads to AWS using tools such as AWS Migration Hub, AWS Application Migration Service (MGN), AWS Database Migration Service (DMS), and AWS Snow Family. Also includes modernization approaches such as re-platforming to containers or serverless, and evaluating migration readiness across organizational and technical dimensions.
Study Tips
- Download and thoroughly study the official SAP-C02 Exam Guide from AWS (available on the AWS Certification exam page and docs.aws.amazon.com), paying close attention to the task statements within each domain — exam questions are written directly against these objectives.
- Complete the official AWS Exam Prep course on AWS Skill Builder, which is purpose-built for SAP-C02 and includes structured lessons, knowledge checks, and alignment to each exam domain. Follow it with the Official Practice Question Set (20 questions) to calibrate your readiness.
- Take the AWS Certified Solutions Architect – Professional Official Practice Exam on AWS Skill Builder (65 questions, timed, scored) to simulate real exam conditions and identify knowledge gaps before your actual attempt.
- Prioritize hands-on experience with complex, multi-service architectures: build multi-account environments using AWS Organizations, configure Direct Connect and Transit Gateway topologies, and practice disaster recovery scenarios using RTO/RPO targets across AWS regions using AWS Builder Labs and AWS CloudFormation.
- Study AWS whitepapers and reference architectures directly relevant to exam domains: 'AWS Well-Architected Framework,' 'Organizing Your AWS Environment Using Multiple Accounts,' 'AWS Security Reference Architecture,' and 'Migrating to AWS: Best Practices and Strategies' are all high-yield resources.
- When practicing questions, focus on eliminating distractors by identifying constraints in the scenario (cost sensitivity, compliance requirements, existing on-premises systems) rather than looking for the 'best' AWS service in isolation — the exam heavily rewards trade-off reasoning.
- Review the official list of in-scope AWS services published in the exam guide and ensure you understand not just what each service does, but how it integrates with others at architectural scale — particularly IAM, VPC, Route 53, CloudFront, S3, RDS, Aurora, DynamoDB, ECS, EKS, Lambda, SNS, SQS, EventBridge, and AWS Control Tower.
Career Benefits
The AWS Certified Solutions Architect – Professional is consistently ranked among the highest-paying IT certifications globally. According to Skillsoft's IT Skills and Salary Survey (2024), professionals holding this credential earn an average of approximately $155,000 per year in the United States, with ZipRecruiter reporting an average of around $146,000 annually. AWS-certified professionals overall earn an average of $12,000 more per year than non-certified peers, according to Global Knowledge salary survey data. The certification is recognized as one of the top-ten most pursued cloud credentials and frequently appears on lists of the top-paying certifications in the IT industry.
Job roles directly aligned with this credential include Enterprise Cloud Architect, Principal Solutions Architect, Cloud Infrastructure Lead, and Senior Cloud Consultant. With AWS holding approximately 32% of the global cloud market share as of 2024, demand for validated AWS expertise — especially at the professional level — remains strong across industries including financial services, healthcare, retail, and government. Compared to the Associate-level credential, the Professional designation signals the ability to handle enterprise-scale complexity, making it particularly valuable for senior-level hiring and promotion decisions. The certification also serves as a prerequisite or strong differentiator for AWS Specialty certifications.
Sample Questions
Preview — answers shown5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 592 questions.
1. A VMware vCenter environment must migrate its VMs to AWS to produce EC2 AMIs. Which two steps form the core of the migration plan? (Select TWO.)
Multiple correct answersAUse AWS SAM to port VMs into an ECS cluster.
BProvision Direct Connect and manage migration with AWS Service Catalog.
CMirror the environment in CloudFormation templates.
DInstall the AWS Replication Agent on each on-premises VM host.
EUse AWS Application Migration Service (MGN) to replicate and launch the VMs as EC2 instances.
Explanation
D installs the agent needed for block-level replication. E uses MGN to automate VM replication, conversion, and AMI creation, giving a straightforward path to EC2. A, B, and C do not relate directly to VM replication.
2. An architect needs to create a health check in Route 53 for an EC2 instance that resides in a private subnet and has no public IP address. How can the architect configure this health check?
ACreate a CloudWatch metric that monitors the `StatusCheckFailed` metric and configure a health check to directly monitor the metric's status.
BCreate a CloudWatch alarm that monitors the EC2 instance's `StatusCheckFailed` metric. Then, create a Route 53 health check that is configured to monitor the state of that CloudWatch alarm.
CConfigure a Route 53 health check to monitor an SNS topic, which is triggered by a CloudWatch alarm.
DCreate a Route 53 health check that directly targets the private IP address of the EC2 instance inside the VPC.
Explanation
This is the standard and recommended pattern for monitoring the health of non-public resources with Route 53. The CloudWatch alarm approach is correct: Route 53 health checkers are located in various locations around the world on the public internet. They cannot directly reach a private IP address inside a VPC. The solution is to use another service as a proxy. You can create a CloudWatch alarm based on a metric that is available within the VPC, such as the `StatusCheckFailed` instance metric. Then, you can create a special type of Route 53 health check that doesn't check an endpoint directly, but instead monitors the state of the CloudWatch alarm. If the alarm goes into the `ALARM` state, the Route 53 health check will become unhealthy, allowing for DNS failover. Why direct private IP monitoring is incorrect: This is technically not possible. The public Route 53 health checkers have no network path to a private IP address. Why direct CloudWatch metric monitoring is incorrect: Route 53 health checks cannot directly monitor a CloudWatch metric. They can only monitor a CloudWatch *alarm*. Why the SNS topic approach is incorrect: A Route 53 health check cannot monitor an SNS topic.
3. A global aerospace and defense contractor, 'StellAero Industries,' is dedicated to enhancing the reliability and fault tolerance of its critical cloud services platform, which is securely hosted on AWS. An integral part of their complex infrastructure involves virtually extending two of their existing, physically separate on-premises data centers into their AWS cloud environment. This robust and private connectivity is absolutely essential to support a real-time online flight-tracking and telemetry service that is utilized by numerous international airline companies and governmental aviation authorities. This online service has significant, low-latency dependencies on existing on-premises IT resources (databases, specialized processing systems) located in these multiple data centers, as well as on static informational content (e.g., aeronautical charts, technical manuals) served from an Amazon S3 bucket. To establish the initial secure and private connectivity, the network engineering team has successfully launched a dual-tunnel AWS Site-to-Site VPN connection between their primary on-premises Customer Gateway (CGW) device (located in their main data center) and an AWS Virtual Private Gateway (VGW) attached to their main AWS Virtual Private Cloud (VPC). In this current AWS Site-to-Site VPN architecture, which specific component, primarily on the *customer's side* of the connection, represents the most significant potential single point of failure that should be addressed by implementing a redundant solution to make the overall VPN connectivity more highly available and resilient against potential on-premises hardware failures or network path disruptions?
AThe AWS Virtual Private Gateway (VGW) that is attached to the VPC within the AWS environment. To improve the resilience of this AWS-side component, a second, independent VGW should be provisioned, ideally in a different Availability Zone within the same VPC (if architecturally feasible for VPNs, though VGWs are already HA). Subsequently, another independent dual-tunnel VPN connection should be established from the existing on-premises Customer Gateway (CGW) device to this new, redundant VGW.
BThe AWS Virtual Private Gateway (VGW) itself, as a logical construct. To achieve higher availability for the VGW component on the AWS side, ensure that it is internally configured by AWS to operate with inherent redundancy across multiple Availability Zones (which is standard VGW behavior). Then, to further enhance connection diversity, establish a second, completely independent dual-tunnel VPN connection from the *existing* on-premises Customer Gateway (CGW) device to the *same* highly available VGW, making sure to utilize different tunnel endpoints provided by the VGW for this second connection.
CThe on-premises Customer Gateway (CGW) device itself, which is the router or firewall on the customer's premises that terminates the VPN tunnels. To mitigate this critical single point of failure, the company should deploy a second, physically separate, and redundant Customer Gateway device. This second CGW should ideally be located in a different physical location within their on-premises network (or, even better, in their secondary data center if one is available and connected to the primary). Following the deployment of this redundant CGW, an additional, independent dual-tunnel AWS Site-to-Site VPN connection should be established from this new, redundant CGW device to the *same* AWS Virtual Private Gateway (VGW) that is attached to the VPC in AWS.
DThe primary network path from the on-premises data center to the internet, which the VPN traffic traverses. To mitigate this, set up a secondary internet egress point, possibly involving a NAT Gateway deployed in a different physical data center on the on-premises side (if such a setup is relevant to VPN routing). Then, establish another dual-tunnel VPN connection originating from this new data center location (using a separate CGW device there) to the existing AWS Virtual Private Gateway (VGW), thus providing an alternate internet path for VPN traffic.
Explanation
The on-premises Customer Gateway (CGW) device is the primary single point of failure on the customer's side in a VPN setup. AWS Virtual Private Gateways are inherently highly available across multiple Availability Zones. To achieve true end-to-end redundancy, a second, independent CGW device should be deployed on-premises, ideally with a separate internet connection, and a new VPN connection established from this second CGW to the same AWS Virtual Private Gateway. Routing protocols (e.g., BGP) would then manage failover between the two connections. The Virtual Private Gateway redundancy approach is incorrect because AWS already manages VGW high availability internally. Attempting to create multiple VGWs or multiple connections to the same VGW from a single CGW does not address the actual single point of failure, which exists on the customer's premises. The NAT Gateway approach is irrelevant to VPN endpoint redundancy. While diverse internet paths can improve overall resilience, a NAT Gateway does not address the fundamental issue of having a single physical device (the CGW) terminating all VPN tunnels on the customer's side.
4. A large financial institution, 'GlobalBank Corp,' has an Oracle Real Application Clusters (RAC) database running in their on-premises data center. They are planning to migrate this critical database to AWS. The Chief Information Security Officer (CISO) has mandated that the migration plan must include automated patch management for the operating system on which the database will run in AWS. Additionally, a robust, scheduled backup solution must be implemented to comply with the company’s stringent disaster recovery plan. Which of the following AWS deployment and management strategies should the solutions architect implement to meet these Oracle RAC migration, patching, and backup requirements with the LEAST amount of ongoing operational effort?
ADevelop an AWS Lambda function that automates the creation of EBS snapshots for the EC2 instances running the Oracle RAC database. Use AWS CodeDeploy and AWS CodePipeline services to build a CI/CD pipeline for automating the OS patch management process for these EC2 instances.
BMigrate the Oracle RAC database to a cluster of EBS-backed Amazon EC2 instances, deployed across multiple Availability Zones to mimic the RAC architecture. Automate the creation of EBS snapshots from the EBS volumes attached to these EC2 instances by using Amazon Data Lifecycle Manager policies. Install the SSM Agent on each EC2 instance and use AWS Systems Manager Patch Manager (with defined patch baselines and maintenance windows) to automate the OS patch management process.
CMigrate the Oracle RAC database to Amazon RDS for Oracle, which provides a Multi-AZ failover feature suitable for RAC-like availability. RDS also offers automated OS patching and managed backups, reducing RPO and RTO in case of failure.
DMigrate the Oracle RAC database to Amazon Aurora (Oracle-compatible edition, if available, or a suitable Aurora edition with migration) and enable automated backups for the Aurora cluster. Patching for the underlying OS in Aurora is automatically handled by AWS during scheduled system maintenance windows.
Explanation
The EC2-based deployment with Data Lifecycle Manager and Systems Manager represents the most appropriate AWS-native approach for migrating and managing an Oracle RAC database (which typically requires specific OS-level configurations and shared storage constructs not directly supported by managed database services for RAC itself) while addressing automated patching and backups. Here's why: - Oracle RAC on EC2: Oracle RAC has specific requirements (shared storage, interconnect) that are generally best met by deploying it on a cluster of EC2 instances, often with specialized storage solutions like Amazon FSx for NetApp ONTAP or other shared block storage options if needed, or by configuring Oracle ASM on EC2 with EBS. This gives the necessary control over the OS and clustering software. - EBS Snapshots with Amazon Data Lifecycle Manager: For backups of the EC2 instances and their EBS volumes (which would contain the Oracle datafiles, OS, etc.), Amazon Data Lifecycle Manager (DLM) allows you to automate the creation, retention, and deletion of EBS snapshots. This provides a managed, scheduled backup solution. - AWS Systems Manager Patch Manager for OS Patching: By installing the SSM Agent on the EC2 instances, you can use AWS Systems Manager Patch Manager to automate OS patching. You can define patch baselines (what patches to apply) and schedule patching operations using Maintenance Windows. This meets the automated patch management requirement with minimal effort compared to custom solutions. Why other approaches are less suitable for Oracle RAC specifically: - Amazon RDS for Oracle: Amazon RDS for Oracle does not support Oracle RAC. RDS provides its own high availability through Multi-AZ deployments (a single primary with a synchronous standby), which is different from RAC's active-active clustering architecture. While RDS handles patching and backups for its instances, it's not a platform for running RAC. - Amazon Aurora: Amazon Aurora (MySQL or PostgreSQL compatible) also does not support Oracle RAC. Like RDS, it has its own architecture for high availability and scalability. Migrating Oracle RAC to Aurora would be a significant re-platforming/re-factoring effort, not a direct migration of RAC. - Lambda for Snapshots with CodeDeploy/CodePipeline for Patching: While Lambda can create snapshots, DLM is a more managed and purpose-built service for automating EBS snapshot lifecycle. Using CodeDeploy/CodePipeline for OS patching is overly complex; Systems Manager Patch Manager is designed for this specific task and is simpler to implement for OS patching.
5. An international humanitarian aid organization, 'GlobalRelief Ops,' needs to store approximately 20 TB of scanned historical documents related to their relief operations. This dataset is expected to grow to about 50 TB over time. A crucial requirement is to implement a search feature that allows staff to easily find specific documents or information within these thousands of scanned files. The new system is intended to be operational for more than three years, and cost-effectiveness is a major consideration. Which of the following AWS solutions is the MOST cost-effective for storing the scanned files and implementing the required search functionality?
ACreate a new Amazon S3 bucket using the S3 Standard storage class to store and serve the scanned files. For search capabilities, ingest the content (after OCR) into Amazon CloudSearch and build a search index. Host any search interface website on AWS Elastic Beanstalk, configured across multiple availability zones for high availability.
BStore the scanned files in Amazon S3. Utilize S3's native metadata tagging and S3 Select capabilities for searching through the files. For more complex queries, use Amazon Athena to query file contents if they are in a queryable text format after OCR.
CDesign the new system using an AWS CloudFormation template. Provision an Amazon EC2 instance running an NGINX web server and an open-source search application (like Apache Solr or Elasticsearch). Store the scanned files and their search index on multiple standard Amazon EBS volumes configured in a RAID array for performance and capacity.
DUse Amazon EFS (Elastic File System) to store and serve the scanned files, providing a shared file system accessible by multiple EC2 instances. Install third-party search software on an Auto Scaling group of On-Demand EC2 Instances, fronted by an Elastic Load Balancer, to handle search queries against the EFS-stored files.
Explanation
The Amazon S3 with CloudSearch solution offers a balanced, scalable, and cost-effective approach using managed AWS services for storage, search, and web hosting. Here's why: - Amazon S3 for Storage: S3 is highly durable, scalable, and cost-effective for storing large volumes of scanned documents. S3 Standard is suitable for data that might be accessed, especially if a search interface needs to retrieve documents. - Amazon CloudSearch for Search: CloudSearch is a fully managed search service that makes it simple to set up, manage, and scale a search solution for your website or application. You would typically extract text from the scanned files (using OCR, e.g., Amazon Textract, though not explicitly mentioned as part of this solution, it's a necessary pre-step for searching content) and then upload this text data to CloudSearch to build a searchable index. This directly meets the 'search feature' requirement. - AWS Elastic Beanstalk for Web Hosting: If a web interface is needed for users to interact with the search functionality and view documents, Elastic Beanstalk provides an easy way to deploy and manage the web application across multiple AZs for high availability, handling load balancing and auto-scaling. - Cost-Effectiveness: Using managed services like S3, CloudSearch, and Elastic Beanstalk generally leads to lower operational overhead and can be more cost-effective than self-managing search engines or storage infrastructure on EC2, especially considering the scaling and availability requirements. Why other approaches are less optimal: - The S3 metadata and Athena approach: While S3 metadata tagging and S3 Select can be used for some filtering, they are not a full-fledged search engine solution for searching *within* the content of thousands of scanned files. Athena is for querying structured or semi-structured data in S3, usually in formats like CSV, JSON, Parquet, ORC. It's not designed for full-text search of OCR'd document content in the same way CloudSearch or OpenSearch Service is. - The EC2 with open-source search solution: Managing an open-source search application (Solr/Elasticsearch) on EC2, along with EBS storage and RAID configurations, incurs significant operational overhead for setup, scaling, patching, and maintenance. Managed services like CloudSearch or Amazon OpenSearch Service are generally preferred for ease of use and lower TCO. - The EFS with third-party search software approach: EFS is a file storage service, good for shared access. However, running third-party search software on EC2 still carries the management overhead mentioned above. For searching the content of files, a dedicated search service is usually more efficient than custom software indexing files on EFS.
$7
One-time access to this exam
Full access to all 592 questions
Or $15/mo for all 201 exams
Detailed explanations
Free preview stays available