AWS SAP-C02: Solutions Architect Professional Practice Exam

What the AWS SAP-C02 exam covers

• Design Solutions for Organizational Complexity199 questions
• Design for New Solutions180 questions
• Continuous Improvement for Existing Solutions226 questions
• Accelerate Workload Migration and Modernization115 questions

Free AWS SAP-C02 practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 720-question bank.

1. Question 1Design Solutions for Organizational Complexity

   Which AWS service lets you centrally govern many accounts and apply guardrails that RESTRICT the maximum permissions in member accounts?

   • AAmazon Inspector
   • BIAM groups in a single account
   • CSecurity groups
   • DAWS Organizations with SCPsCorrect
   ✓ Correct answer: D

   AWS Organizations with Service Control Policies is the governance layer for a multi-account estate. An SCP attached to the root or to an organizational unit sets the maximum permissions any principal in a member account can ever hold, so even an account administrator cannot exceed the guardrail. SCPs filter permissions and never grant them, so each account still needs its own IAM policies.

   Why the other options are wrong

   • AAmazon Inspector scans EC2 instances, container images and Lambda functions for software vulnerabilities and unintended network exposure. It reports findings and can cap nothing that a member account's principals are permitted to do.
   • BIAM groups attach policies to users inside one account only, so they cannot reach the other member accounts, and a group grants permissions rather than setting a ceiling an account administrator is unable to exceed.
   • CSecurity groups are stateful virtual firewalls that filter network traffic to and from an elastic network interface. They govern packets, not API permissions, so they place no limit on which actions an account may call.
2. Question 2Design for New Solutions

   You are deploying a Lambda function and want it to scale predictably with no cold starts for a baseline of concurrent executions. Which CLI command configures this?

   • Aaws lambda put-function-concurrency --function-name myFn --reserved-concurrent-executions 50 --qualifier prod --region us-east-1
   • Baws lambda put-provisioned-concurrency-config --function-name myFn --qualifier prod --provisioned-concurrent-executions 50Correct
   • Caws lambda update-function-configuration --function-name myFn --provisioned-concurrency 50
   • Daws lambda put-provisioned-concurrency --function-name myFn --qualifier prod --executions 50
   ✓ Correct answer: B

   Provisioned concurrency keeps a pool of execution environments initialized and ready, which is what removes cold starts for a baseline level of traffic. It is configured with put-provisioned-concurrency-config against a published version or alias named by --qualifier, with --provisioned-concurrent-executions setting the pool size. Reserved concurrency is a different control that caps a share of the account limit.

   Why the other options are wrong

   • Aput-function-concurrency sets reserved concurrency, which caps scaling but does not pre-warm to eliminate cold starts.
   • Cupdate-function-configuration has no provisioned-concurrency parameter; provisioned concurrency is its own API.
   • DThe command is put-provisioned-concurrency-config with --provisioned-concurrent-executions, not this shortened form.
3. Question 3Continuous Improvement for Existing Solutions

   You purchased a Standard Reserved Instance for m5.large in us-east-1a, but workloads now run as m5.xlarge in us-east-1b. Coverage seems wrong. What is true about Standard RIs?

   • AStandard RIs can be freely exchanged for a different instance family at any time, exactly like Convertible RIs, so coverage follows the workload
   • BReserved Instances apply their billing discount automatically across all AWS Regions, so the AZ and Region on the reservation never matter
   • CStandard RIs apply only to the exact instance type and AZ on the reservation and provide no size flexibility within the family at all
   • DStandard RIs cannot change instance family but a Regional Standard RI applies across AZs and supports instance size flexibility within the same familyCorrect
   ✓ Correct answer: D

   A Standard Reserved Instance is locked to its instance family, since changing family is the flexibility only a Convertible RI offers. A Regional reservation does apply across every Availability Zone in the Region and carries instance size flexibility within the family, so the discount can follow a move to a different zone and size. A zonal reservation stays pinned to its zone and reserves capacity there.

   Why the other options are wrong

   • AOnly Convertible RIs can be exchanged for a different family; Standard RIs cannot change instance family.
   • BReserved Instances are scoped to a single Region and do not apply their discount across all Regions.
   • CA Regional Standard RI does offer size flexibility within a family across AZs, so this understates their flexibility.
4. Question 4Design for New SolutionsSelect all that apply

   A new API on API Gateway plus Lambda must minimize cost and cold-start latency for a workload with steady traffic during business hours and near-zero traffic overnight. Which TWO actions help balance performance and cost? (Choose TWO)

   • AConfigure provisioned concurrency on the Lambda function during business hours using scheduled scalingCorrect
   • BSet provisioned concurrency to a high fixed value 24/7
   • CIncrease Lambda memory to the maximum for every function regardless of need
   • DEnable API Gateway caching for frequently requested, cacheable GET responsesCorrect
   ✓ Correct answer: A, D

   Configuring provisioned concurrency only during business hours via Application Auto Scaling scheduled actions ensures Lambda functions are pre-warmed when traffic is present, eliminating cold starts while avoiding the cost of provisioned concurrency during overnight idle periods. Enabling API Gateway caching for cacheable GET responses reduces the number of Lambda invocations entirely by serving repeated requests from the cache, lowering both latency and Lambda execution costs.

   Why the other options are wrong

   • BSetting provisioned concurrency to a high fixed value 24/7 pre-warms Lambda during overnight hours when there is near-zero traffic, resulting in high charges for idle provisioned capacity with no corresponding performance benefit.
   • CIncreasing Lambda memory to the maximum for every function raises the per-invocation cost proportionally - memory should be tuned to the function's actual needs using tools like Lambda Power Tuning, not blindly maximized.
5. Question 5Continuous Improvement for Existing Solutions

   An existing AWS account is flagged in a compliance audit because the root user has an access key and lacks MFA. Which set of remediation actions follows AWS best practices for the root user?

   • AKeep the root access keys but rotate them weekly and skip enabling MFA on root
   • BDelete the root access keys, enable MFA on root, and use IAM roles/Identity Center for daily workCorrect
   • CRestrict the root user with a permissions boundary and keep its access keys active
   • DCreate a second IAM administrator and copy the root access keys to it for daily use
   ✓ Correct answer: B

   AWS best practices explicitly state that the root user should never have access keys because they cannot be restricted by IAM policies or SCPs and provide unrestricted account access. Deleting root access keys, enabling hardware or virtual MFA on the root user, and using IAM Identity Center or individual IAM roles for all operational tasks removes the highest-risk credential from daily use and ensures the root account is only accessed for the small number of tasks that require it.

   Why the other options are wrong

   • ABest practice is to remove root access keys entirely and enable MFA, not to retain keys and skip MFA.
   • CThe root user is not constrained by permissions boundaries, and its access keys should be deleted, not kept.
   • DCopying root keys to another identity spreads long-lived root credentials instead of eliminating them.
6. Question 6Continuous Improvement for Existing Solutions

   An SQS-based processing system has a dead-letter queue (DLQ) accumulating messages. The team has fixed the bug causing failures and wants to replay DLQ messages through the original queue without writing a custom Lambda or script. Which feature achieves this?

   • AEnable SQS long polling on the DLQ to automatically forward messages back to the source queue.
   • BUse the SQS DLQ redrive feature (Start DLQ Redrive) from the console or CLI.Correct
   • CCreate an SQS message timer on the DLQ that delays each message by 0 seconds to trigger reprocessing.
   • DConfigure an SNS subscription on the DLQ that fans out messages to the source queue.
   ✓ Correct answer: B

   Amazon SQS introduced native DLQ redrive in 2021. Using the console or the StartMessageMoveTask API (CLI: aws sqs start-message-move-task), you can move messages from a DLQ back to the source queue or any other queue without writing custom code. You can also control throughput via the MaxNumberOfMessagesPerSecond parameter.

   Why the other options are wrong

   • ALong polling adjusts how SQS consumers receive messages (waiting up to 20 seconds for messages to arrive) - it does not move messages between queues.
   • CMessage timers delay message visibility after enqueue - they do not copy or move messages from the DLQ to another queue.
   • DSNS subscriptions send new publications to subscribers - they cannot retroactively route existing messages already sitting in an SQS DLQ.
7. Question 7Design Solutions for Organizational Complexity

   During a planned migration, a company must move an AWS account from one AWS Organization (source) into a different AWS Organization (target). What is required for the account to successfully join the target organization?

   • AThe account must first be removed from the source organization, then accept an invitation (or be invited and accept) to the target organizationCorrect
   • BThe target management account invites the member account and it joins automatically without leaving the source organization first
   • CThe account must be closed in the source organization and a brand-new account created under the target organization
   • DBoth organizations must be merged by AWS Support before the account can be moved between them
   ✓ Correct answer: A

   An AWS account can belong to only one organization at a time, so it must be removed from the source org and then join the target via the standard invitation/acceptance flow. This preserves the account and its resources.

   Why the other options are wrong

   • BAn account can belong to only one organization at a time, so it must leave the source before it can accept the target's invitation.
   • CClosing and recreating the account loses all resources and history and is unnecessary; the account simply leaves one org and joins the other.
   • DOrganizations cannot be merged by AWS Support; the account is moved by leaving the source and accepting the target's invitation.
8. Question 8Design for New Solutions

   A new application requires guaranteed message delivery between a producer and a single consumer with at-least-once delivery, and the consumer must control how long it has to process each message before it becomes visible again. Which SQS feature controls the reprocessing window?

   • AVisibility timeoutCorrect
   • BMessage retention period
   • CDelay seconds
   • DLong polling wait time
   ✓ Correct answer: A

   When a consumer receives a message, SQS hides it for the visibility timeout. If the consumer does not delete the message within that window, it becomes visible again for reprocessing. Tuning this value to match processing time prevents premature redelivery while preserving at-least-once semantics.

   Why the other options are wrong

   • BThe retention period controls how long unconsumed messages remain in the queue, not the per-message reprocessing window.
   • CDelay seconds postpone the initial delivery of a new message, not redelivery after receipt.
   • DLong polling wait time affects how long a receive call waits for messages, not visibility after receipt.
9. Question 9Continuous Improvement for Existing Solutions

   An existing Auto Scaling group launches instances that take eight minutes to become healthy due to bootstrapping. During traffic surges the group scales too slowly. Which change most directly improves responsiveness without adding always-on cost?

   • ASwitch the launch template to a larger instance type so instances bootstrap faster
   • BPre-bake a golden AMI so new instances are ready in under a minute, and use warm poolsCorrect
   • CIncrease the desired capacity permanently so surge capacity is always running
   • DLower the health check grace period to 30 seconds to mark instances healthy sooner
   ✓ Correct answer: B

   Baking dependencies into a golden AMI removes lengthy boot-time installation, and EC2 Auto Scaling warm pools keep pre-initialized, stopped instances that resume quickly. This improves scale-out speed while you pay only the reduced stopped-instance cost.

   Why the other options are wrong

   • AA larger instance type does not eliminate the eight-minute bootstrapping process, so scale-out is still slow.
   • CPermanently raising desired capacity keeps surge capacity always on, adding the very always-on cost the requirement excludes.
   • DShortening the grace period marks still-bootstrapping instances healthy prematurely and can cause failed requests, not faster readiness.
10. Question 10Continuous Improvement for Existing Solutions

    An existing application uses Amazon SQS standard queues, and the team sees a large number of empty ReceiveMessage responses inflating API costs. Which configuration change reduces these empty receives most effectively?

    • AEnable long polling by setting ReceiveMessageWaitTimeSeconds to a value greater than zeroCorrect
    • BSwitch to FIFO queues so consumers only receive strictly ordered message batches
    • CRaise the visibility timeout so in-flight messages stay hidden from other consumers
    • DIncrease MaxNumberOfMessages so each ReceiveMessage call returns a full batch of ten
    ✓ Correct answer: A

    With short polling, SQS samples a subset of servers and may return empty even when messages exist, causing frequent empty receives. Setting ReceiveMessageWaitTimeSeconds (long polling) makes the call wait up to the configured time for messages, reducing empty responses and the number of paid requests.

    Why the other options are wrong

    • BFIFO queues enforce ordering and exactly-once processing but do not change how often ReceiveMessage returns empty when the queue is momentarily idle.
    • CA longer visibility timeout only affects how long consumed messages stay hidden and has no effect on the empty-receive rate from short polling.
    • DRequesting up to ten messages per call reduces call volume when messages exist but still returns empty immediately on idle queues under short polling.

Who this AWS SAP-C02 practice exam is for

This practice set is for anyone preparing for the AWS SAP-C02: Solutions Architect Professional exam at the advanced level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS SAP-C02 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS SAP-C02 exam.

Related AWS resources

• AWS SAP-C02 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• AWS SAA-C03 vs SAP-C02Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS Certified CloudOps Engineer - Associate (SOA-C03) practice examRelated

AWS SAP-C02 practice exam FAQ