AWS SAP-C02: Solutions Architect Professional Practice Exam

What the AWS SAP-C02 exam covers

• Design Solutions for Organizational Complexity199 questions
• Design for New Solutions181 questions
• Continuous Improvement for Existing Solutions226 questions
• Accelerate Workload Migration and Modernization115 questions

Free AWS SAP-C02 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 721.

1. Question 1Design Solutions for Organizational Complexity

   Which AWS service lets you centrally govern many accounts and apply guardrails that RESTRICT the maximum permissions in member accounts?

   • AAmazon Inspector
   • BIAM groups in a single account
   • CSecurity groups
   • DAWS Organizations with SCPsCorrect
   ✓ Correct answer: D

   Option D is the correct choice because it directly addresses the scenario. This service or feature provides the required functionality and aligns with AWS best practices. Understanding when to use this service versus alternatives is essential for architectural decisions. The implementation and configuration follow AWS recommended patterns for this use case.

   Why the other options are wrong

   • AAmazon Inspector is incorrect because it does not provide the required functionality or proper architectural pattern for the scenario.
   • BIAM groups in a single account is incorrect because it lacks the scalability or resilience required for production workloads.
   • CSecurity groups is incorrect because it does not provide the required functionality or proper architectural pattern for the scenario.
2. Question 2Design for New Solutions

   You are deploying a Lambda function and want it to scale predictably with no cold starts for a baseline of concurrent executions. Which CLI command configures this?

   • Aaws lambda put-function-concurrency --function-name myFn --reserved-concurrent-executions 50 --qualifier prod --region us-east-1
   • Baws lambda put-provisioned-concurrency-config --function-name myFn --qualifier prod --provisioned-concurrent-executions 50Correct
   • Caws lambda update-function-configuration --function-name myFn --provisioned-concurrency 50
   • Daws lambda put-provisioned-concurrency --function-name myFn --qualifier prod --executions 50
   ✓ Correct answer: B

   Option B is the correct choice because it directly addresses the scenario. This service or feature provides the required functionality and aligns with AWS best practices. Understanding when to use this service versus alternatives is essential for architectural decisions. The implementation and configuration follow AWS recommended patterns for this use case.

   Why the other options are wrong

   • Aput-function-concurrency sets reserved concurrency, which caps scaling but does not pre-warm to eliminate cold starts.
   • Cupdate-function-configuration has no provisioned-concurrency parameter; provisioned concurrency is its own API.
   • DThe command is put-provisioned-concurrency-config with --provisioned-concurrent-executions, not this shortened form.
3. Question 3Continuous Improvement for Existing Solutions

   You purchased a Standard Reserved Instance for m5.large in us-east-1a, but workloads now run as m5.xlarge in us-east-1b. Coverage seems wrong. What is true about Standard RIs?

   • AStandard RIs can be freely exchanged for a different instance family at any time, exactly like Convertible RIs, so coverage follows the workload
   • BReserved Instances apply their billing discount automatically across all AWS Regions, so the AZ and Region on the reservation never matter
   • CStandard RIs apply only to the exact instance type and AZ on the reservation and provide no size flexibility within the family at all
   • DStandard RIs cannot change instance family but a Regional Standard RI applies across AZs and supports instance size flexibility within the same familyCorrect
   ✓ Correct answer: D

   Option D is the correct choice because it directly addresses the scenario. This service or feature provides the required functionality and aligns with AWS best practices. Understanding when to use this service versus alternatives is essential for architectural decisions. The implementation and configuration follow AWS recommended patterns for this use case.

   Why the other options are wrong

   • AOnly Convertible RIs can be exchanged for a different family; Standard RIs cannot change instance family.
   • BReserved Instances are scoped to a single Region and do not apply their discount across all Regions.
   • CA Regional Standard RI does offer size flexibility within a family across AZs, so this understates their flexibility.
4. Question 4Design for New Solutions

   A new global read-heavy application needs single-digit millisecond reads worldwide and the ability to write in multiple Regions with conflict resolution, fully managed. Which design is best?

   • AAmazon DynamoDB global tables with on-demand capacityCorrect
   • BA single-Region Amazon RDS instance with read replicas in each Region
   • CAmazon Aurora with a single writer and cross-Region snapshots
   • DAmazon ElastiCache cluster in one Region
   ✓ Correct answer: A

   DynamoDB global tables provide fully managed, multi-Region, multi-active replication. Any Region can accept writes, and DynamoDB automatically replicates changes to all other Regions using last-write-wins conflict resolution, delivering single-digit millisecond reads globally. On-demand capacity mode further eliminates the need to predict or pre-provision capacity, making this the best-fit fully managed solution for a new globally distributed read/write workload.

   Why the other options are wrong

   • BA single-Region RDS instance with cross-Region read replicas supports reads in remote regions but all writes must go to the primary Region - this introduces write latency for global users and does not provide multi-active write capability.
   • CAmazon Aurora with a single writer and cross-Region snapshots does not replicate writes actively to other Regions - snapshots are point-in-time backups, not active replication, so remote regions cannot serve low-latency writes.
   • DAmazon ElastiCache in one Region serves low-latency reads only in that Region - it is not a primary database, does not support global multi-Region writes, and lacks the durability and consistency guarantees of DynamoDB global tables.
5. Question 5Continuous Improvement for Existing Solutions

   An existing AWS account is flagged in a compliance audit because the root user has an access key and lacks MFA. Which set of remediation actions follows AWS best practices for the root user?

   • AKeep the root access keys but rotate them weekly and skip enabling MFA on root
   • BDelete the root access keys, enable MFA on root, and use IAM roles/Identity Center for daily workCorrect
   • CRestrict the root user with a permissions boundary and keep its access keys active
   • DCreate a second IAM administrator and copy the root access keys to it for daily use
   ✓ Correct answer: B

   AWS best practices explicitly state that the root user should never have access keys because they cannot be restricted by IAM policies or SCPs and provide unrestricted account access. Deleting root access keys, enabling hardware or virtual MFA on the root user, and using IAM Identity Center or individual IAM roles for all operational tasks removes the highest-risk credential from daily use and ensures the root account is only accessed for the small number of tasks that require it.

   Why the other options are wrong

   • ABest practice is to remove root access keys entirely and enable MFA, not to retain keys and skip MFA.
   • CThe root user is not constrained by permissions boundaries, and its access keys should be deleted, not kept.
   • DCopying root keys to another identity spreads long-lived root credentials instead of eliminating them.
6. Question 6Continuous Improvement for Existing Solutions

   A company wants to validate that all deployed AWS infrastructure matches the approved CloudFormation templates and receive a daily report of any drift. Which set of actions implements this with native AWS services?

   • AUse the AWS Config managed rule cloudformation-stack-drift-detection-check and review the resulting Config compliance dashboard once each day for drift.
   • BEnable CloudTrail data events for CloudFormation and run daily Amazon Athena queries over the event history to infer which resources have drifted.
   • CSchedule a daily EventBridge rule that triggers a Lambda function which calls DetectStackDrift on each stack, then DescribeStackResourceDrifts.Correct
   • DRun AWS Trusted Advisor on a daily schedule and review its checks, relying on them to report any CloudFormation stack drift findings.
   ✓ Correct answer: C

   CloudFormation drift detection is initiated via the DetectStackDrift API and results are retrieved with DescribeStackDriftDetectionStatus and DescribeStackResourceDrifts. Scheduling a Lambda via EventBridge to call these APIs daily across all stacks, then publishing results to SNS, is the correct native pattern.

   Why the other options are wrong

   • AThe Config rule flags whether drift detection ran but does not itself produce the daily detailed drift report described.
   • BCloudTrail plus Athena shows API activity, not the actual configuration drift between the deployed resources and the template.
   • DTrusted Advisor does not perform CloudFormation drift detection, so its checks cannot produce the drift findings required.
7. Question 7Design Solutions for Organizational Complexity

   During a planned migration, a company must move an AWS account from one AWS Organization (source) into a different AWS Organization (target). What is required for the account to successfully join the target organization?

   • AThe account must first be removed from the source organization, then accept an invitation (or be invited and accept) to the target organizationCorrect
   • BThe target management account invites the member account and it joins automatically without leaving the source organization first
   • CThe account must be closed in the source organization and a brand-new account created under the target organization
   • DBoth organizations must be merged by AWS Support before the account can be moved between them
   ✓ Correct answer: A

   An AWS account can belong to only one organization at a time, so it must be removed from the source org and then join the target via the standard invitation/acceptance flow. This preserves the account and its resources.

   Why the other options are wrong

   • BAn account can belong to only one organization at a time, so it must leave the source before it can accept the target's invitation.
   • CClosing and recreating the account loses all resources and history and is unnecessary; the account simply leaves one org and joins the other.
   • DOrganizations cannot be merged by AWS Support; the account is moved by leaving the source and accepting the target's invitation.
8. Question 8Design for New Solutions

   A new application requires guaranteed message delivery between a producer and a single consumer with at-least-once delivery, and the consumer must control how long it has to process each message before it becomes visible again. Which SQS feature controls the reprocessing window?

   • AVisibility timeoutCorrect
   • BMessage retention period
   • CDelay seconds
   • DLong polling wait time
   ✓ Correct answer: A

   When a consumer receives a message, SQS hides it for the visibility timeout. If the consumer does not delete the message within that window, it becomes visible again for reprocessing. Tuning this value to match processing time prevents premature redelivery while preserving at-least-once semantics.

   Why the other options are wrong

   • BThe retention period controls how long unconsumed messages remain in the queue, not the per-message reprocessing window.
   • CDelay seconds postpone the initial delivery of a new message, not redelivery after receipt.
   • DLong polling wait time affects how long a receive call waits for messages, not visibility after receipt.
9. Question 9Continuous Improvement for Existing Solutions

   An existing Auto Scaling group launches instances that take eight minutes to become healthy due to bootstrapping. During traffic surges the group scales too slowly. Which change most directly improves responsiveness without adding always-on cost?

   • ASwitch the launch template to a larger instance type so instances bootstrap faster
   • BPre-bake a golden AMI so new instances are ready in under a minute, and use warm poolsCorrect
   • CIncrease the desired capacity permanently so surge capacity is always running
   • DLower the health check grace period to 30 seconds to mark instances healthy sooner
   ✓ Correct answer: B

   Baking dependencies into a golden AMI removes lengthy boot-time installation, and EC2 Auto Scaling warm pools keep pre-initialized, stopped instances that resume quickly. This improves scale-out speed while you pay only the reduced stopped-instance cost.

   Why the other options are wrong

   • AA larger instance type does not eliminate the eight-minute bootstrapping process, so scale-out is still slow.
   • CPermanently raising desired capacity keeps surge capacity always on, adding the very always-on cost the requirement excludes.
   • DShortening the grace period marks still-bootstrapping instances healthy prematurely and can cause failed requests, not faster readiness.
10. Question 10Continuous Improvement for Existing Solutions

    An existing application uses Amazon SQS standard queues, and the team sees a large number of empty ReceiveMessage responses inflating API costs. Which configuration change reduces these empty receives most effectively?

    • AEnable long polling by setting ReceiveMessageWaitTimeSeconds to a value greater than zeroCorrect
    • BSwitch to FIFO queues so consumers only receive strictly ordered message batches
    • CRaise the visibility timeout so in-flight messages stay hidden from other consumers
    • DIncrease MaxNumberOfMessages so each ReceiveMessage call returns a full batch of ten
    ✓ Correct answer: A

    With short polling, SQS samples a subset of servers and may return empty even when messages exist, causing frequent empty receives. Setting ReceiveMessageWaitTimeSeconds (long polling) makes the call wait up to the configured time for messages, reducing empty responses and the number of paid requests.

    Why the other options are wrong

    • BFIFO queues enforce ordering and exactly-once processing but do not change how often ReceiveMessage returns empty when the queue is momentarily idle.
    • CA longer visibility timeout only affects how long consumed messages stay hidden and has no effect on the empty-receive rate from short polling.
    • DRequesting up to ten messages per call reduces call volume when messages exist but still returns empty immediately on idle queues under short polling.

Who this AWS SAP-C02 practice exam is for

This practice set is for anyone preparing for the AWS SAP-C02: Solutions Architect Professional exam at the advanced level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS SAP-C02 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS SAP-C02 exam.

Related AWS resources

• AWS SAP-C02 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• AWS SAA-C03 vs SAP-C02Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS Certified CloudOps Engineer - Associate (SOA-C03) practice examRelated

AWS SAP-C02 practice exam FAQ