AWS · SAP-C02
AWS Certified Solutions Architect - Professional (SAP-C02) Practice Tests
Validates advanced technical skills and experience in designing optimized AWS solutions based on the AWS Well-Architected Framework.
Exam Details
Practice Questions
592
≈ 9 practice exams
Duration
180 minutes
Passing Score
750/1000
Difficulty
ProfessionalLast Updated
Jan 2025
Topics Covered
Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
AWS Certified Solutions Architect - Professional (SAP-C02) Practice Exam
SAP-C02 weights Design for New Solutions heaviest at 29 percent of scored content, followed by Design Solutions for Organizational Complexity at 26 percent, Continuous Improvement for Existing Solutions at 25 percent, and Accelerate Workload Migration and Modernization at 20 percent. This practice bank of 592 questions is built to match that split, so multi-account, multi-team architecture scenarios get real depth instead of an even split across four domains.
On test day you face 75 questions in 180 minutes: 65 scored and 10 unscored questions AWS mixes in to evaluate future content, including newer generative and agentic AI scenarios (AWS added pretest questions covering services like Bedrock Guardrails). Scoring is scaled from 100 to 1,000, and you need 750 to pass. Beyond standard multiple-choice and multiple-response questions, this is the professional tier: expect long scenario stems describing an organization's constraints, existing architecture, and competing priorities, where the "best" answer depends on trade-offs, not textbook recall.
AWS recommends 2 or more years of hands-on experience using AWS services to design and implement cloud solutions, though there is no formal prerequisite (the associate-level Solutions Architect Associate exam is not required, just recommended background). The exam costs $300 and the certification is valid for 3 years. Start with the 30 free questions, then work through the full 592-question bank until your accuracy holds steady across all four domains.
Exam Domain Breakdown
Design Solutions for Organizational Complexity26%
Design for New Solutions29%
Continuous Improvement for Existing Solutions25%
Accelerate Workload Migration and Modernization20%
Exam Overview
The AWS Certified Solutions Architect – Professional (SAP-C02) is a professional-level certification that validates advanced technical skills and experience in designing optimized, complex AWS solutions. It tests the ability to evaluate cloud application requirements, make architectural recommendations, and provide expert guidance across multiple applications and projects within large, complex organizations — all grounded in the AWS Well-Architected Framework. The credential specifically assesses competency in handling organizational complexity, architecting new solutions from scratch, continuously improving existing workloads, and accelerating migration and modernization initiatives.
The SAP-C02 version of the exam represents the current iteration of this credential and is recognized across the industry as one of the most rigorous cloud certifications available. Unlike the Associate-level counterpart, this exam demands multi-dimensional mastery — candidates must demonstrate judgment in ambiguous, trade-off-heavy scenarios, design for large-scale enterprise environments, and integrate a broad range of AWS services into cohesive, production-ready architectures. The certification is valid for three years, after which recertification is required by passing the then-current version of the exam.
Who Should Take This Exam
This certification is designed for experienced cloud professionals performing a solutions architect role who have two or more years of hands-on experience designing and implementing cloud solutions on AWS. Ideal candidates include senior cloud architects, principal engineers, and cloud consultants who routinely provide architectural guidance across multiple teams, applications, or projects within complex organizational structures.
Professionals targeting roles such as Enterprise Cloud Architect, Principal Solutions Architect, Cloud Infrastructure Lead, or Senior DevOps Engineer will find this credential directly aligned with their career trajectory. It is also well-suited for individuals responsible for cloud migration strategies, governance frameworks, or leading cloud adoption programs within enterprises. Those who have already earned the AWS Certified Solutions Architect – Associate and have accumulated significant real-world AWS design experience are the most natural candidates.
Prerequisites
AWS does not enforce formal prerequisites for the SAP-C02 exam, but the official exam guide recommends that candidates have two or more years of experience using AWS services to design and implement cloud solutions. Candidates should be comfortable evaluating application requirements and translating them into AWS architectural recommendations across diverse use cases.
In practice, most successful candidates hold the AWS Certified Solutions Architect – Associate credential and have deep familiarity with a wide range of AWS services, including networking (VPC, Direct Connect, Transit Gateway), security (IAM, Organizations, SCPs), compute, storage, databases, and messaging. Experience designing multi-account architectures, hybrid connectivity models, disaster recovery strategies, and cost optimization frameworks is strongly recommended before attempting this exam.
Exam Format
The SAP-C02 exam consists of 75 total questions — 65 scored questions that contribute to your final result and 10 unscored experimental questions that are not identified and do not affect your score. Questions are presented in two formats: multiple choice (one correct answer from four options) and multiple response (two or more correct answers from five or more options, requiring all correct selections for full credit). Unanswered questions are scored as incorrect, but there is no penalty for guessing.
Candidates have 180 minutes to complete the exam. It is delivered via Pearson VUE, either at an authorized testing center or through an online proctored session. The exam is available in English, Japanese, Korean, Portuguese (Brazil), Simplified Chinese, and Spanish (Latin America). Scores are reported on a scaled range of 100–1,000, with a minimum passing score of 750. A compensatory scoring model is used, meaning candidates must achieve an overall passing score but are not required to pass each domain individually. Results are reported as Pass or Fail. The exam costs $300 USD, though holders of an active AWS Certification receive a 50% discount on subsequent exams.
Skills Measured
- 1.Domain 1 – Design Solutions for Organizational Complexity (26%): Covers architecting for multi-account AWS environments using AWS Organizations and Service Control Policies (SCPs), designing hybrid network connectivity (Direct Connect, VPN, Transit Gateway), implementing identity federation and cross-account access patterns, and creating governance and compliance frameworks for large enterprises.
- 2.Domain 2 – Design for New Solutions (29%): Focuses on selecting appropriate AWS services and architectural patterns to meet requirements for security, scalability, performance, reliability, and cost. Includes designing event-driven architectures, serverless solutions, container-based workloads, data analytics pipelines, and applying the AWS Well-Architected Framework pillars to greenfield solution design.
- 3.Domain 3 – Continuous Improvement for Existing Solutions (25%): Addresses evaluating and improving deployed architectures across the five Well-Architected pillars. Includes implementing operational excellence practices, optimizing cost with Reserved Instances, Savings Plans, and rightsizing, improving fault tolerance and resiliency, and integrating observability tooling such as CloudWatch, AWS Config, and AWS Trusted Advisor.
- 4.Domain 4 – Accelerate Workload Migration and Modernization (20%): Covers strategies for migrating on-premises workloads to AWS using tools such as AWS Migration Hub, AWS Application Migration Service (MGN), AWS Database Migration Service (DMS), and AWS Snow Family. Also includes modernization approaches such as re-platforming to containers or serverless, and evaluating migration readiness across organizational and technical dimensions.
Study Tips
- Download and thoroughly study the official SAP-C02 Exam Guide from AWS (available on the AWS Certification exam page and docs.aws.amazon.com), paying close attention to the task statements within each domain — exam questions are written directly against these objectives.
- Complete the official AWS Exam Prep course on AWS Skill Builder, which is purpose-built for SAP-C02 and includes structured lessons, knowledge checks, and alignment to each exam domain. Follow it with the Official Practice Question Set (20 questions) to calibrate your readiness.
- Take the AWS Certified Solutions Architect – Professional Official Practice Exam on AWS Skill Builder (65 questions, timed, scored) to simulate real exam conditions and identify knowledge gaps before your actual attempt.
- Prioritize hands-on experience with complex, multi-service architectures: build multi-account environments using AWS Organizations, configure Direct Connect and Transit Gateway topologies, and practice disaster recovery scenarios using RTO/RPO targets across AWS regions using AWS Builder Labs and AWS CloudFormation.
- Study AWS whitepapers and reference architectures directly relevant to exam domains: 'AWS Well-Architected Framework,' 'Organizing Your AWS Environment Using Multiple Accounts,' 'AWS Security Reference Architecture,' and 'Migrating to AWS: Best Practices and Strategies' are all high-yield resources.
- When practicing questions, focus on eliminating distractors by identifying constraints in the scenario (cost sensitivity, compliance requirements, existing on-premises systems) rather than looking for the 'best' AWS service in isolation — the exam heavily rewards trade-off reasoning.
- Review the official list of in-scope AWS services published in the exam guide and ensure you understand not just what each service does, but how it integrates with others at architectural scale — particularly IAM, VPC, Route 53, CloudFront, S3, RDS, Aurora, DynamoDB, ECS, EKS, Lambda, SNS, SQS, EventBridge, and AWS Control Tower.
Career Benefits
The AWS Certified Solutions Architect – Professional is consistently ranked among the highest-paying IT certifications globally. According to Skillsoft's IT Skills and Salary Survey (2024), professionals holding this credential earn an average of approximately $155,000 per year in the United States, with ZipRecruiter reporting an average of around $146,000 annually. AWS-certified professionals overall earn an average of $12,000 more per year than non-certified peers, according to Global Knowledge salary survey data. The certification is recognized as one of the top-ten most pursued cloud credentials and frequently appears on lists of the top-paying certifications in the IT industry.
Job roles directly aligned with this credential include Enterprise Cloud Architect, Principal Solutions Architect, Cloud Infrastructure Lead, and Senior Cloud Consultant. With AWS holding approximately 32% of the global cloud market share as of 2024, demand for validated AWS expertise — especially at the professional level — remains strong across industries including financial services, healthcare, retail, and government. Compared to the Associate-level credential, the Professional designation signals the ability to handle enterprise-scale complexity, making it particularly valuable for senior-level hiring and promotion decisions. The certification also serves as a prerequisite or strong differentiator for AWS Specialty certifications.
Sample Questions
5 sample questions with answers and explanations. The full bank has 592 questions, enough for 9 full-length practice exams.
Preview — answers shown1. A major online retail company, 'ShopEasy Inc.', experienced a critical service disruption when a junior DevOps engineer inadvertently terminated a key EC2 instance in their production environment. The company's policy dictates that only Solutions Architects should have the permissions to stop or terminate instances in the production environment. A post-incident review also revealed that a large number of developers currently possess full administrative access (`AdministratorAccess` policy) to the production AWS account, which contributed to this incident. Which TWO of the following corrective actions will effectively address this security vulnerability and prevent similar accidental terminations from recurring in the future, adhering to the principle of least privilege?
Multiple correct answersAFor the IAM role or group assigned to developers, modify the attached IAM policies to explicitly remove or deny the `ec2:TerminateInstances` and `ec2:StopInstances` permissions specifically for production resources. Solutions Architects would retain these permissions in their distinct IAM role.
BImplement resource tagging for all EC2 instances in the production environment (e.g., `Environment:Production`). Then, create or update an IAM policy for the developers' IAM role that includes a condition explicitly denying `ec2:TerminateInstances` and `ec2:StopInstances` actions if the EC2 instance resource has the tag `Environment:Production`.
CFor all EC2 instances in the production environment, replace their existing Security Groups with new, highly restrictive Security Groups that prevent developers from establishing network connections (like SSH or RDP) to these instances, thereby indirectly preventing termination.
DFor the IAM group or role assigned to developers, replace their current broad permissions (like `AdministratorAccess`) with the AWS managed policy `PowerUserAccess`. This policy grants full access to most AWS services but typically denies management of IAM users and groups, which should be sufficient for development tasks.
EModify the IAM policies for all developers to require Multi-Factor Authentication (MFA) specifically before they can perform sensitive actions like `ec2:TerminateInstances` or `ec2:StopInstances` on any EC2 instance.
Explanation
The combination of modifying IAM policies to remove specific permissions and implementing tag-based access control provides effective, granular protection against unauthorized termination of production instances, aligning with the principle of least privilege. Here's why: Modifying IAM Roles/Policies to Remove/Deny Specific Permissions: - This represents a direct application of the principle of least privilege. Instead of granting broad permissions like `AdministratorAccess`, developers should have IAM roles/policies that only grant the permissions necessary for their development tasks. - Specifically removing (if they had explicit allows) or adding an explicit `Deny` statement for `ec2:TerminateInstances` and `ec2:StopInstances` actions on production resources in the developers' IAM policies will prevent them from performing these actions. Solutions Architects would have a separate role with these permissions. Implementing Tag-Based Access Control with IAM Policy Conditions: - Tagging resources (e.g., `Environment:Production`) allows for fine-grained access control using IAM policy conditions. - You can create an IAM policy for developers that allows them general EC2 actions but includes a `Deny` statement with a condition like: `"Condition": { "StringEquals": { "ec2:ResourceTag/Environment": "Production" } }` for actions `ec2:TerminateInstances` and `ec2:StopInstances`. This means they can terminate instances in, say, a 'Development' environment but not in 'Production'. - This is a very flexible and scalable way to manage permissions based on resource attributes. Why other approaches are less effective or miss the point: Replacing Security Groups: Security Groups control network ingress and egress traffic to EC2 instances. They do not control IAM permissions for actions like starting, stopping, or terminating instances. Restricting network access doesn't prevent someone with IAM permissions from terminating an instance via the API/CLI/Console. Attaching PowerUserAccess Policy: The `PowerUserAccess` AWS managed policy still grants extensive permissions, including the ability to stop and terminate EC2 instances (`ec2:*` on all resources, typically). While it restricts IAM user/group management, it doesn't solve the problem of developers being able to terminate production EC2 instances. It's still too permissive for this scenario. Requiring MFA for Deleting Instances: While requiring MFA for sensitive actions is a good security practice (and can be enforced with IAM policy conditions), it doesn't *prevent* an authorized user (even if MFA'd) from performing an action they have permission for. The core issue is that developers *have* the permission to terminate; MFA just adds an authentication step. The permission itself needs to be removed or restricted through direct policy modification or tag-based conditions.
2. A major bank, TransactSecure Bank, hosts its primary online banking platform in a single AWS Region. This platform utilizes EC2 instances with an Application Load Balancer, an Amazon RDS for Oracle database, and Amazon S3 for storing transaction archives. The bank's risk assessment team frequently runs complex analytical queries against the production RDS database, which sometimes degrades platform performance for customers. Stringent regulatory compliance mandates minimal data loss (low RPO) and rapid recovery (low RTO) in the event of a regional outage. A solutions architect needs a DR plan that ensures data integrity, quick regional failover, and isolates the analytical workload. What strategy best meets all these requirements?
ADeploy Amazon RDS for Oracle with Multi-AZ in the primary region. For DR, replicate RDS snapshots to a secondary region hourly. Use S3 Cross-Region Replication for archives. For analytics, allow the team to query the standby RDS instance in the Multi-AZ setup.
BMigrate the RDS for Oracle database to Amazon Aurora (Oracle compatible) and enable Aurora Global Database, with a secondary region. Use the secondary region's Aurora cluster for analytical queries. Use S3 Cross-Region Replication. Deploy EC2 instances and an ALB in the DR region as a warm standby.
CIn a different AWS Region, establish an Amazon RDS for Oracle Read Replica. Direct all analytical queries from the risk assessment team to this Read Replica. Implement S3 Cross-Region Replication for the transaction archives. Maintain AMIs of the EC2 instances, replicated to the DR region. In case of a primary region failure, promote the Read Replica to a standalone instance, launch EC2 instances from the replicated AMIs, and update DNS to point to the new ALB in the DR region.
DUse AWS Database Migration Service (DMS) for continuous replication of the RDS for Oracle database to an EC2 instance running Oracle in the DR region. Allow analytics queries on this EC2-based Oracle instance. Replicate S3 data and EC2 AMIs to the DR region.
Explanation
The cross-region RDS Read Replica approach provides a robust and practical solution. Creating an RDS Read Replica in a different region isolates the analytical workload, preventing performance impact on the primary production database. This Read Replica can also be promoted to a standalone, writable instance in the DR region during a disaster, contributing to a low RTO and RPO (depending on replication lag). S3 Cross-Region Replication ensures transaction archives are available. Replicating AMIs allows for quick restoration of the application tier in the DR region. Querying the Multi-AZ standby is generally not recommended or easily possible for user queries; Multi-AZ is designed for high availability, not read scaling. The Aurora Global Database approach is an excellent solution for DR and read scaling but involves a migration from RDS Oracle to Aurora, which might be a larger undertaking than requested. Using DMS to replicate to an EC2-based Oracle instance adds management overhead for the DR database compared to a managed RDS Read Replica.
3. DataScience Research Institute is planning a one-time data analysis project using Elastic MapReduce to process 300 TB of experimental data. The cluster will consist of 200 EC2 instances running for approximately 8 hours, with results temporarily stored before transfer to their Redshift database. They need the most cost-effective solution without compromising data integrity. Which instance combination provides optimal cost-effectiveness for this one-time EMR cluster?
AUse Reserved EC2 instances for both the master and core nodes and use Spot EC2 instances for the task nodes
BUse On-Demand EC2 instances for both the master and core nodes and use Spot EC2 instances for the task nodes
CUse a combination of On-Demand instance and Spot instance types for both the master and core nodes. Use Spot EC2 instances for the task nodes
DUse Reserved EC2 instances for the master node; On-Demand instances for the core nodes; and use Spot EC2 instances for the task nodes
Explanation
On-Demand instances for master and core nodes with Spot instances for task nodes provide the optimal balance of reliability and cost-effectiveness for one-time EMR clusters. Master nodes coordinate the entire cluster and must remain stable throughout the 8-hour processing window. On-Demand instances ensure master node availability without interruption risk. Core nodes store HDFS data and run essential cluster services, requiring stability to maintain data integrity. On-Demand pricing ensures these critical nodes remain available. Task nodes perform additional processing but don't store persistent data, making them ideal candidates for Spot instances that can provide significant cost savings. Spot instance interruptions on task nodes don't compromise data integrity since HDFS data remains on stable core nodes. For one-time, 8-hour workloads, the cost savings from Spot task nodes outweigh the interruption risks, especially with proper cluster configuration. This configuration maintains cluster stability while maximizing cost savings for the large-scale data processing requirement. Reserved instances are designed for long-term committed usage (1-3 years) and provide no cost benefit for one-time 8-hour jobs. Using Spot instances for master or core nodes risks cluster failure and data loss, potentially requiring complete job restart and negating any cost savings. The 8-hour duration doesn't justify Reserved instance commitments that require long-term usage to achieve cost benefits.
4. A prominent media production and distribution company, 'CineMotion Studios,' offers a specialized service that allows independent filmmakers and content creators to upload large media files, such as raw video footage and high-resolution master images, through a secure web portal. The existing on-premises architecture involves web servers that accept these media file uploads and initially store them on a high-capacity Network Attached Storage (NAS) device. For each successfully uploaded media file, a corresponding message containing metadata about the file (e.g., filename, size, uploader ID) is sent to an on-premises message queuing system. A dedicated, single processing server then polls this queue, retrieves messages, and performs various processing tasks on the associated media files, such as video transcoding, quality checks, thumbnail generation, and content analysis. These processing tasks are often computationally intensive and can take up to 30 minutes to complete per individual file. The company has observed that the number of media files awaiting processing in the queue becomes significantly high during peak submission periods (e.g., after film festival deadlines), but the single processing server eventually manages to clear the accumulated backlog during off-peak hours. To significantly improve processing throughput, reduce operational costs associated with maintaining the on-premises infrastructure, and enhance overall scalability and resilience, the company has made a strategic decision to migrate this entire media processing workload to the AWS Cloud. Which of the following AWS architectural options provides the MOST cost-effective, highly scalable, and resilient solution for this demanding media processing workflow?
AAdapt the media file upload mechanism so that the web servers (or a new front-end service) first upload all incoming media files directly into an Amazon S3 bucket. For each successful upload to S3, ensure a message (containing critical S3 object details such as the bucket name and the object key) is promptly sent to a standard queue on Amazon Simple Queue Service (SQS). Create and configure an Auto Scaling group of Amazon EC2 instances. These EC2 instances should be configured to use EC2 Spot Instances for significant cost savings on compute. These worker instances will be programmed to continuously poll the SQS queue for messages. Upon retrieving a message, an EC2 worker instance will download the referenced media file from S3, perform the necessary processing tasks (which can take up to 30 minutes per file), and then store the processed output file (and any derivatives) back into a designated Amazon S3 bucket. Crucially, configure the Auto Scaling group to dynamically scale its number of active EC2 instances based on the `ApproximateNumberOfMessagesVisible` metric (which represents the current depth or backlog) of the SQS queue.
BArrange for the web servers to publish messages (containing details of media files now stored in S3) to a dedicated queue in Amazon MQ. Set up an Auto Scaling group of Amazon EC2 instances. These instances will be responsible for pulling messages from this Amazon MQ queue and processing the referenced media files from S3. Configure this Auto Scaling group to scale its compute capacity based on the length of a separate SQS queue (this part of the description introduces an inconsistency, as the primary queue is stated to be Amazon MQ). Store all processed media files on an Amazon EFS mount point that is shared among all the EC2 instances in the Auto Scaling group. To further minimize costs, ensure that individual EC2 instances are configured to shut down immediately after they have finished processing each file.
CReconfigure the existing web servers (or implement a new cloud-native upload mechanism using, for example, Amazon S3 presigned URLs) to ensure that all uploaded media files are first stored directly in an Amazon S3 bucket. Upon each successful S3 upload, publish a message (containing S3 object details like bucket name and key) to a designated queue in Amazon MQ (which could be configured for RabbitMQ or ActiveMQ compatibility if needed). Develop an AWS Lambda function, carefully configured with an event source mapping to this Amazon MQ queue. This Lambda function will be responsible for pulling messages from the queue and then attempting to process the referenced media files from S3. Store all processed media files and their derivatives in an Amazon EFS volume to provide easy, shared file system access for any downstream applications or workflows.
DModify the web servers or implement a new upload mechanism (e.g., using Amplify Storage or S3 presigned URLs) to ensure that all incoming media files are uploaded directly to an Amazon S3 bucket. After each successful S3 upload, arrange for a message containing essential file details to be sent to a standard queue on Amazon Simple Queue Service (SQS). Create an AWS Lambda function that is specifically designed to poll this SQS queue for new messages. Upon retrieving a message, this Lambda function will then process the referenced media file from S3. Configure an Amazon S3 event notification (specifically for `s3:ObjectCreated:*` events) to directly trigger this Lambda function every time a new media file is uploaded, with the message in SQS serving as a durable record of the task and its metadata. Store all processed media files and their derivatives back into a designated Amazon S3 bucket.
Explanation
The Auto Scaling group with EC2 Spot Instances approach is correct. Uploading files to Amazon S3, sending messages to Amazon SQS, and using an Auto Scaling group of EC2 Spot Instances to process messages from SQS (scaling based on queue depth) is a highly scalable, resilient, and cost-effective pattern for long-running batch processing. Amazon S3 is ideal for media storage. AWS Lambda has a 15-minute maximum execution timeout, making it unsuitable for processing tasks that can take up to 30 minutes per file. Amazon MQ introduces unnecessary complexity compared to Amazon SQS for this straightforward queuing use case. Amazon EFS is significantly more expensive than Amazon S3 for storing processed output files and derivatives. Additionally, some solutions contain inconsistent scaling logic that would not function properly in practice.
5. A financial services portal is migrating its legacy web application to AWS. As an interim measure before a full refactor, the team configured Amazon CloudFront with a custom origin pointing to the HTTPS endpoint URL of the legacy application. This setup functioned correctly for several weeks. However, recently, all browser connections started displaying an HTTP 502 (Bad Gateway) error, accompanied by the distinctive 'X-Cache: Error from CloudFront' header. Network diagnostics confirm that the HTTPS port 443 on the legacy web application server is open and actively responding to requests. As the AWS Solutions Architect, what is the most probable cause of this error, and what is your primary recommendation to resolve it?
AThe SSL/TLS certificate on the legacy web application server has expired. The team should generate and install a new self-signed certificate, including its full certificate chain, onto the origin server.
BThe SSL/TLS certificate installed on the legacy web application server (the custom origin) has likely expired or is no longer trusted by CloudFront. The resolution is to obtain and install a new SSL/TLS certificate on the origin server, signed by a publicly recognized Certificate Authority (CA), ensuring the full certificate chain (including intermediate certificates) is correctly installed.
CThe SSL/TLS certificate on the legacy web application server has expired. A new certificate should be requested and issued for the origin server via AWS Certificate Manager (ACM) in the `us-east-1` Region and then installed on the origin.
DThe SSL/TLS certificate associated with the CloudFront distribution itself has expired. The team needs to request a new certificate for the CloudFront distribution via AWS Certificate Manager (ACM) in the `us-east-1` Region and associate it with the distribution.
Explanation
The solution involving a publicly trusted CA-signed certificate correctly identifies the likely cause and the appropriate resolution. Here's why: - The HTTP 502 error with 'X-Cache: Error from CloudFront' specifically indicates an issue where CloudFront successfully received the request but encountered a problem when trying to connect to or get a response from the origin server. When the origin is HTTPS, a common cause for this is an SSL/TLS negotiation failure. - CloudFront requires that custom HTTPS origins present a valid SSL/TLS certificate signed by a trusted public Certificate Authority (CA). If the origin's certificate has expired, is self-signed (and CloudFront is not configured to accept it, which is not best practice), or if the certificate chain is incomplete or invalid, CloudFront will fail the SSL/TLS handshake, resulting in the 502 error. - Installing a new, valid certificate from a public CA, along with the complete intermediate certificate chain, on the origin server will resolve this SSL/TLS negotiation issue. Why other approaches are incorrect: Self-signed certificate approach: While CloudFront can be configured to work with self-signed certificates on the origin under specific viewer protocol policies, it's generally not recommended for production or publicly trusted setups. More importantly, if it was working before and suddenly stopped, an expired *trusted* certificate is a more likely cause than a sudden switch to a self-signed one being the fix. CloudFront by default expects a CA-signed cert. AWS Certificate Manager (ACM) certificate for the origin server: AWS Certificate Manager (ACM) provides certificates that can be easily deployed on AWS managed services like Elastic Load Balancers, CloudFront distributions, API Gateways, etc. You *cannot* directly export the private key of an ACM-issued certificate to install it on your own custom origin server (like a legacy web server not fronted by an ELB). You need to obtain a certificate from a CA through other means for such origins. CloudFront distribution certificate replacement: If the CloudFront distribution's own SSL certificate (used for viewer-to-CloudFront HTTPS) expired, users would typically see SSL warnings directly from their browser when trying to connect to the CloudFront domain, or the connection would fail before CloudFront even attempts to contact the origin. The error 'X-Cache: Error from CloudFront' points to an issue between CloudFront and the origin, not between the viewer and CloudFront.
Frequently Asked Questions
How many questions are on the SAP-C02 exam?
75 questions in 180 minutes: 65 scored plus 10 unscored questions AWS uses to evaluate future content, including newer generative and agentic AI scenarios.
What is the passing score for SAP-C02?
750 on AWS’s scaled score of 100 to 1,000, using a compensatory model — no need to pass each domain individually.
How much does the SAP-C02 exam cost?
$300 USD.
What are the SAP-C02 domains and weights?
Design for New Solutions (29%), Design Solutions for Organizational Complexity (26%), Continuous Improvement for Existing Solutions (25%), and Accelerate Workload Migration and Modernization (20%).
Do I need the Solutions Architect Associate certification before SAP-C02?
No formal prerequisite. AWS recommends 2 or more years of hands-on experience designing and implementing AWS solutions; the Associate exam is common prior experience but not required.
What question formats appear on SAP-C02?
Multiple choice (one correct answer, three distractors) and multiple response (two or more correct answers among five or more options).
Does the Solutions Architect Professional certification expire?
Yes, after 3 years. Recertify by passing the current version of the exam before it expires.
Is SAP-C02 hard?
It is AWS’s flagship professional-level architecture exam, widely considered one of the hardest AWS certifications, since it tests trade-off judgment across long, multi-constraint scenarios rather than single-service recall.
More AWS Practice Exams
AWS Certified Machine Learning - Specialty (MLS-C01)
MLS-C01 · 860 questions
AWS Certified Security - Specialty (SCS-C03)
SCS-C03 · 2069 questions
AWS Certified Solutions Architect - Associate (SAA-C03)
SAA-C03 · 600 questions
AWS Certified SysOps Administrator - Associate (SOA-C02)
SOA-C02 · 2141 questions
AWS Certified Advanced Networking - Specialty (ANS-C01)
ANS-C01 · 1453 questions
AWS Certified AI Practitioner (AIF-C01)
AIF-C01 · 426 questions
$17.99
One-time access to this exam
592 questions (9 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available