AWS SAP-C02: Solutions Architect Professional Practice Exam

What the AWS SAP-C02 exam covers

• Design Solutions for Organizational Complexity192 questions
• Design for New Solutions175 questions
• Continuous Improvement for Existing Solutions218 questions
• Accelerate Workload Migration and Modernization111 questions

Free AWS SAP-C02 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 696.

1. Question 1Design Solutions for Organizational Complexity

   Which AWS service lets you centrally govern many accounts and apply guardrails that RESTRICT the maximum permissions in member accounts?

   • AAmazon Inspector
   • BIAM groups in a single account
   • CSecurity groups
   • DAWS Organizations with Service Control Policies (SCPs)Correct
   ✓ Correct answer: D

   Option D is the correct choice because it directly addresses the scenario. This service or feature provides the required functionality and aligns with AWS best practices. Understanding when to use this service versus alternatives is essential for architectural decisions. The implementation and configuration follow AWS recommended patterns for this use case.

   Why the other options are wrong

   • AAmazon Inspector is incorrect because it does not provide the required functionality or proper architectural pattern for the scenario.
   • BIAM groups in a single account is incorrect because it lacks the scalability or resilience required for production workloads.
   • CSecurity groups is incorrect because it does not provide the required functionality or proper architectural pattern for the scenario.
2. Question 2Design for New Solutions

   You are creating a DynamoDB table for a serverless app and want on-demand (pay-per-request) capacity from the start. Which CLI flag sets this?

   • A--billing-mode PAY_PER_REQUESTCorrect
   • B--capacity-mode SERVERLESS
   • C--provisioned-throughput Mode=OnDemand
   • D--billing-mode ON_DEMAND
   ✓ Correct answer: A

   Option A is the correct choice because it directly addresses the scenario. This service or feature provides the required functionality and aligns with AWS best practices. Understanding when to use this service versus alternatives is essential for architectural decisions. The implementation and configuration follow AWS recommended patterns for this use case.

   Why the other options are wrong

   • B--capacity-mode SERVERLESS is incorrect because it does not provide the required functionality or proper architectural pattern for the scenario.
   • C--provisioned-throughput Mode=OnDemand is incorrect because it lacks the scalability or resilience required for production workloads.
   • D--billing-mode ON_DEMAND is incorrect because it does not provide the required functionality or proper architectural pattern for the scenario.
3. Question 3Continuous Improvement for Existing Solutions

   An organization wants to enforce, across all accounts, that EBS volumes are encrypted and S3 buckets block public access, and to be alerted with automatic remediation when a resource drifts. Which service combination is best?

   • AA single CloudWatch dashboard aggregating EBS and S3 status that an engineer reviews occasionally to catch drift
   • BAWS Config rules with automatic remediation actions (SSM Automation), deployed org-wide via conformance packsCorrect
   • CManual quarterly compliance audits driven by exported resource inventory spreadsheets that are reviewed by hand
   • DTrusted Advisor security best-practice checks reviewed manually on an annual basis for each account in the organization
   ✓ Correct answer: B

   Option B is the correct choice because it directly addresses the scenario. This service or feature provides the required functionality and aligns with AWS best practices. Understanding when to use this service versus alternatives is essential for architectural decisions. The implementation and configuration follow AWS recommended patterns for this use case.

   Why the other options are wrong

   • AAn occasionally reviewed dashboard detects nothing automatically and cannot remediate drift org-wide.
   • CQuarterly spreadsheet audits are manual, slow, and provide no automatic detection or remediation.
   • DAnnual Trusted Advisor reviews are infrequent and do not enforce or auto-remediate encryption and public-access rules.
4. Question 4Accelerate Workload Migration and ModernizationSelect all that apply

   A company migrating many applications wants to track migration status centrally and choose appropriate strategies and tools for each application. Which TWO statements are correct? (Choose TWO)

   • AReplatform (lift, tinker, and shift) makes targeted optimizations, such as moving to a managed database, without a full re-architectureCorrect
   • BAWS Migration Hub provides a single location to track the progress of migrations across tools and accountsCorrect
   • CRepurchase means keeping the existing self-managed software unchanged
   • DRehost requires rewriting the application into microservices
   ✓ Correct answer: A, B

   In the 7 Rs framework, Replatform (lift, tinker, and shift) describes making targeted optimizations - such as moving a self-managed database to Amazon RDS - without completely rearchitecting the application. AWS Migration Hub complements this by providing a single centralized dashboard where migration progress across multiple accounts and tools (DMS, MGN, etc.) can be tracked, giving visibility into all migration waves from one location.

   Why the other options are wrong

   • CRepurchase means replacing existing software with a different product, typically a SaaS alternative (for example moving from a self-hosted CRM to Salesforce) - it does not mean keeping existing self-managed software unchanged.
   • DRehost (lift-and-shift) means moving servers to AWS with no changes - rewriting the application into microservices is the definition of Refactor, not Rehost.
5. Question 5Design for New SolutionsSelect all that apply

   A solutions architect is designing a customer-facing mobile app that needs sign-up/sign-in, social and SAML identity federation, and short-lived AWS credentials so the app can call DynamoDB directly. Which TWO components form the correct identity design? (Choose TWO)

   • AIAM users created for each mobile customer at sign-up
   • BEmbedding a shared IAM access key in the mobile app binary
   • CAmazon Cognito user pools to authenticate users and federate social/SAML identitiesCorrect
   • DAmazon Cognito identity pools to exchange tokens for temporary, scoped AWS credentials via STSCorrect
   ✓ Correct answer: C, D

   Amazon Cognito user pools handle user directory, sign-up/sign-in flows, and federation with social providers (Google, Facebook) and SAML identity providers, returning JWT tokens after authentication. Amazon Cognito identity pools (federated identities) accept those tokens and exchange them with AWS STS for short-lived, scoped IAM credentials, allowing the mobile app to call AWS services such as DynamoDB directly and securely without embedding long-lived keys in the app binary.

   Why the other options are wrong

   • ACreating individual IAM users for each mobile customer does not scale to millions of users and is an anti-pattern - IAM users carry long-lived credentials and lack native support for social or SAML federation.
   • BEmbedding a shared IAM access key in the mobile app binary exposes that key to anyone who decompiles the app, giving all users and attackers the same broad permissions with no per-user scoping.
6. Question 6Design for New Solutions

   You need to enable AWS Config to record configuration changes for all supported resources in a new account and deliver the configuration snapshots and change history to a central S3 bucket in another account. Which AWS Config resource must be created?

   • AAn AWS Config Rule referencing the central S3 bucket as the evaluation target.
   • BA Delivery Channel that specifies the central S3 bucket ARN (and optionally an SNS topic) for delivering configuration history and snapshots.Correct
   • CA Config Aggregator in the source account pointing to the central S3 bucket as the aggregation destination.
   • DAn S3 Event Notification on the central bucket triggering a Lambda function to pull Config data from the source account.
   ✓ Correct answer: B

   AWS Config requires two core resources: a Configuration Recorder (to track resource changes) and a Delivery Channel (to specify where to deliver configuration snapshots and history). The Delivery Channel is configured with an S3 bucket ARN and an optional SNS topic. The central S3 bucket in the target account must have a bucket policy allowing the source account's Config service to deliver objects to it.

   Why the other options are wrong

   • AAWS Config Rules define compliance evaluation logic (e.g., check if S3 bucket versioning is enabled); they do not control where configuration data is delivered.
   • CA Config Aggregator collects compliance and configuration data from multiple accounts/Regions into a single view within the aggregator account - it does not control delivery of raw configuration snapshots to S3.
   • DS3 Event Notifications trigger downstream processing after objects arrive; they cannot pull data from another account and are not a Config delivery mechanism.
7. Question 7Design Solutions for Organizational ComplexitySelect all that apply

   An architect is standing up a new multi-account environment and wants AWS-native, best-practice landing-zone capabilities with minimal custom code. Which TWO services/features directly support automated provisioning and governance of the landing zone? (Choose TWO)

   • AAWS Control Tower for automated landing-zone setup and guardrailsCorrect
   • BAWS Service Catalog/Account Factory for standardized, self-service account provisioningCorrect
   • CAmazon EMR for governance reporting
   • DAWS Snowball for account onboarding
   ✓ Correct answer: A, B

   AWS Control Tower automates the creation of a multi-account landing zone with preventive and detective guardrails, while its Account Factory (built on AWS Service Catalog) lets teams provision new accounts that automatically inherit baseline networking, logging, and guardrails. Together they deliver native, low-code landing-zone governance.

   Why the other options are wrong

   • CAmazon EMR is a big-data processing platform and has no role in landing-zone provisioning or governance.
   • DAWS Snowball is for physical data transfer/edge compute and is unrelated to account onboarding.
8. Question 8Design Solutions for Organizational Complexity

   A central networking account owns a Transit Gateway shared with spoke accounts via AWS RAM. A new spoke VPC has been associated with the Transit Gateway, but instances in that VPC still cannot reach other spokes. Routing on the Transit Gateway route tables is correct. What is the most likely missing configuration?

   • AThe spoke VPC's own subnet route tables lack routes pointing destination CIDRs to the Transit Gateway attachmentCorrect
   • BThe Transit Gateway must be recreated to recognize the new attachment
   • CAWS RAM sharing must be disabled and re-enabled for routing to take effect
   • DA VPC peering connection must also be created between the new VPC and each other spoke
   ✓ Correct answer: A

   Even with correct TGW route tables and a valid attachment, traffic only leaves a subnet if its route table directs the destination CIDR to the Transit Gateway. Without those VPC-level routes, packets never reach the TGW.

   Why the other options are wrong

   • BTransit Gateways accept new attachments dynamically; recreation is unnecessary and disruptive.
   • CRAM sharing only grants attachment permission; toggling it does not influence VPC route tables.
   • DPeering is the opposite of the hub-and-spoke pattern and is not required when using a Transit Gateway.
9. Question 9Continuous Improvement for Existing Solutions

   An existing serverless application uses API Gateway and Lambda. Cost analysis shows API Gateway REST API request charges dominate the bill for a high-volume, low-latency public HTTP endpoint with no need for usage plans or request validation. Which change reduces cost the most?

   • AReplace the REST API with an API Gateway HTTP APICorrect
   • BEnable API Gateway caching with a 1 GB cache
   • CAdd a usage plan with API keys to throttle clients
   • DMove the integration from Lambda proxy to Lambda non-proxy
   ✓ Correct answer: A

   HTTP APIs are priced well below REST APIs and provide lower latency, making them ideal when advanced REST features (request validation, API keys with usage plans, request/response transformations) are not required. For a high-volume public endpoint that only proxies to Lambda, switching to an HTTP API directly cuts the per-request charge that dominates the bill.

   Why the other options are wrong

   • BCaching adds an hourly charge per cache size and helps latency, not the per-request cost of a high-volume API.
   • CUsage plans throttle clients but do not lower the per-request price; they add the very features the scenario says are unneeded.
   • DProxy versus non-proxy integration does not change API Gateway request pricing.
10. Question 10Continuous Improvement for Existing SolutionsSelect all that apply

    A team is improving observability of an existing production workload. They must (1) be automatically alerted when an application metric deviates from its normal daily and weekly pattern, and (2) drill into end-to-end request latency across microservices to find the slow segment. Which TWO AWS capabilities should they use? (Choose TWO)

    • ACloudWatch anomaly detection alarmsCorrect
    • BAWS X-Ray service map and trace analysisCorrect
    • CCloudWatch static threshold alarms set to the all-time maximum
    • DAmazon S3 server access logs
    ✓ Correct answer: A, B

    CloudWatch anomaly detection builds a model of a metric's expected daily and weekly pattern and alarms on deviations, satisfying the adaptive-alerting requirement. AWS X-Ray produces a service map and end-to-end traces that pinpoint which segment adds latency across microservices. Together they cover both observability goals.

    Why the other options are wrong

    • CA static threshold at the all-time maximum will rarely fire and ignores normal pattern variation, defeating the goal.
    • DS3 access logs record object requests, not application metric anomalies or distributed request latency.

Related AWS resources

• AWS SAP-C02 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS CLF-C02 practice examRelated

AWS SAP-C02 practice exam FAQ