AWS Certified Solutions Architect - Professional (SAP-C02) Practice Exam
Elevate your career with the AWS Certified Solutions Architect - Professional Exam Simulator. Get ready to ace the most popular Professional AWS exam with our realistic practice exams. Assess your readiness, boost your confidence, and ensure your success.
Exam domains
The SAP-C02 questions are grouped into 4 domains divided into 20 tasks.
SAP-C02 example questions
One example question per domain from the SAP-C02 question bank, with the correct answer and its explanation. Sign in to the simulator to answer them with all answer options.
A company is onboarding a third-party cost-optimization provider that serves many customers from one AWS account. The provider's Collector IAM role will obtain temporary credentials to assume a CostReader role in each of the company's accounts. Each CostReader role grants only the required read permissions and trusts the provider's Collector role. The Collector role has permission to assume the customer roles. The provider's API allows authenticated customers to register target role ARNs. A security review identifies that another customer could register one of the company's role ARNs and cause the provider to collect the company's data on that customer's behalf. Role ARNs and onboarding configuration values must not be treated as secrets. The provider can modify its application and onboarding process. Which solution prevents this misuse while preserving automated cross-account collection?
Show answer
CORRECT ANSWERHave the provider generate a unique external ID for the company and bind it to the company's authenticated customer record. Require that value through an sts:ExternalId condition in each CostReader trust policy, while retaining trust in the Collector role. Have the provider supply the external ID from the authenticated customer's stored record when calling AWS STS AssumeRole, without allowing customers to select another customer's value.
This prevents the cross-account confused deputy problem. The trust policy checks both the provider principal and the customer-specific external ID. The provider must select that ID from its trusted customer association, not from arbitrary request input. Another customer submitting the company's role ARN will therefore cause a request with the wrong external ID. External IDs need not be secret.
A healthcare company is deploying an Amazon ECS service on AWS Fargate platform version 1.4.0 in two private subnets across two Availability Zones. Tasks pull Linux container images from a private Amazon ECR repository in the same AWS Region and send application logs to Amazon CloudWatch Logs by using the awslogs driver. All image layers are stored in Amazon ECR; the repository does not use pull-through caching. Security policy prohibits internet access and routed connectivity to other VPCs. The task subnets have no default routes, and the company must not add NAT gateways or internet gateways. Tasks must continue to use the standard Regional service hostnames without application or DNS overrides. Task execution role permissions are already configured correctly. VPC DNS support and DNS hostnames are enabled. Which configuration will allow new tasks to pull images and deliver logs while maintaining the required network isolation?
Show answer
CORRECT ANSWERCreate interface VPC endpoints for the Regional ECR API, ECR Docker registry, and CloudWatch Logs services with private DNS enabled. Allow HTTPS from the task security group to the endpoint security group. Create an S3 gateway endpoint and associate it with both task subnet route tables. Permit the required endpoint traffic in task security groups, network ACLs, and endpoint policies.
Fargate platform version 1.4.0 requires private connectivity to both ECR endpoints for private image pulls, and an S3 path for downloading image layers. The CloudWatch Logs interface endpoint supports the awslogs driver. Private DNS lets the existing service hostnames resolve to interface endpoint addresses, and the S3 gateway endpoint routes layer-download traffic privately without adding internet or inter-VPC connectivity.
A company operates a stateless HTTP API on an Amazon EC2 Auto Scaling group behind an Application Load Balancer (ALB). The group uses a target tracking scaling policy based on average CPU utilization. The ALB target group uses round robin routing with stickiness disabled. The Auto Scaling group's default instance warmup is explicitly set to 0 seconds. During unpredictable traffic increases, newly launched instances quickly become healthy and enter the InService state. However, each instance needs approximately 180 additional seconds of production traffic to populate an in-memory cache. Receiving a full share of requests during this period causes high response latency. The initializing instances also have low CPU utilization, which lowers the group's average CPU metric and delays further scale-out while established instances remain overloaded. The company wants to gradually introduce traffic to newly healthy instances and prevent their initialization period from distorting scaling decisions. The solution must not require application changes or additional idle instances. Which solution meets these requirements?
Show answer
CORRECT ANSWERConfigure the target group's slow start duration to 180 seconds. Set the Auto Scaling group's default instance warmup to 180 seconds.
ALB slow start gradually increases a newly healthy target's share of requests, giving its cache time to populate before it receives its full share. Default instance warmup prevents initializing instances from contributing to the aggregated CPU metric during warmup. Together, these settings address both the traffic distribution problem and the delayed scale-out decisions.
A company is migrating application waves into 60 member accounts in an AWS Organizations organization with all features enabled. Workloads run in two AWS Regions, and new accounts are added each month. Before each cutover, a central governance team must evaluate deployed resources against a version-controlled baseline of 12 configuration rules. Auditors also require configuration history that preserves changes even when a resource becomes noncompliant and is corrected later the same day. The solution must automatically extend governance to new accounts, provide organization-wide compliance reporting, and leave remediation under application-team control. No resource configuration recording is currently enabled. Which solution meets these requirements with the LEAST ongoing operational effort?
Show answer
CORRECT ANSWERRegister a governance account as an AWS Config delegated administrator. Use service-managed CloudFormation StackSets with automatic deployment to enable continuous configuration recording in both Regions of member accounts. Deploy the baseline as an organization conformance pack in each Region without remediation actions. Create an organization aggregator in the governance account.
Continuous recording preserves configuration changes rather than only a daily configuration state. StackSets can automatically provision recording prerequisites in new member accounts. Organization conformance packs centrally deploy the baseline rules to existing and new member accounts, but must be deployed in each required Region. The organization aggregator provides centralized compliance visibility without performing remediation.
Exam mode and practice mode
| Exam mode | Practice mode | |
|---|---|---|
| Questions count | 75 | 1 - 75 |
| Time limit | 180 minutes | Optional, 10 - 300 minutes |
| Exam scope | 4 domains with the official questions ratio | Selected domains with the official questions ratio |
| Correct answers | After exam submission | After exam submission or after each answer |
| Question types | Mix of single and multiple correct answers | Single, multiple or both |
| Question hints | Never | Optional |
| Question domain | Revealed after exam submission | Revealed after submission or during the exam |
| Scoring | 15 of 75 questions do not count towards the result | Official AWS method or mathematical mean |
See all simulator features on the AWS Exam Simulator page.
About the SAP-C02 exam
The AWS Certified Solutions Architect - Professional (SAP-C02) exam is considered one of the most difficult of all AWS certification exams.
The difficulty of the exam stems from several key factors. First, the breadth and depth of knowledge required are substantial. You must have a deep understanding of a wide range of AWS services, including, but not limited to, compute, storage, databases, networking, security, and application services. Additionally, you need to understand how these services integrate to form scalable, reliable, and cost-effective solutions.
Passing the exam requires a deep understanding of AWS best practices for architectural design. This includes knowledge of security, compliance, and governance as it pertains to AWS architectures. You need to be proficient in defining and designing architectures that adhere to AWS’s Well-Architected Framework, ensuring operational excellence, security, reliability, performance efficiency, and cost optimization.
Second, the exam emphasizes real-world scenarios and complex problem-solving. It tests your ability to design multi-tier applications, evaluate and recommend architectures for performance, security, and cost, and automate processes using AWS services. It demands a strong understanding of AWS architecture principles, service capabilities, and the ability to make trade-offs in design choices.
You must demonstrate your ability to design and deploy dynamically scalable, highly available, fault-tolerant, and reliable applications on AWS. This includes selecting appropriate AWS services to design and deploy applications based on specific requirements, migrating complex multi-tier applications to AWS, and implementing cost-control strategies.
Preparation for the exam requires extensive study. Many candidates spend months preparing, using a variety of resources such as AWS whitepapers, online courses, practice exams, and hands-on labs to gain the necessary knowledge and experience. However, doing practice exams with the AWS Exam Simulator and its premium features like repetitions and custom scope is often sufficient to pass this exam.
Technologies and concepts
Compute
In the cloud, compute provides on-demand CPU, memory, and optional accelerators through virtual machines, containers, and managed execution environments. Choosing an appropriate compute model helps engineers balance performance, cost, scaling behavior, and operational responsibility.
Cost management
In the cloud, cost management connects resource consumption and pricing choices to business outcomes. It helps engineers compare deployment options, eliminate waste, and balance spending against performance, availability, security, and operational effort.
Database
Databases give applications controlled access to persistent information, such as customer records, orders, and device readings. Choosing the right database model and operating approach affects correctness, performance, availability, security, and cost.
Disaster recovery
Disaster recovery combines recoverable data, replacement infrastructure, documented procedures, and testing to restore technology services after failures, attacks, or operational mistakes. In the cloud, it uses capabilities such as backups, replication, automated provisioning, and geographically separate deployments to balance recovery requirements against cost and complexity.
Management and governance
Management handles activities such as provisioning, monitoring, configuration, and remediation, while governance defines who may act, which standards apply, and how compliance is demonstrated. Together, they help organizations give engineers useful autonomy without losing accountability, cost visibility, or control over risk.
Microservices and component delivery
Microservices divide an application into services organized around business capabilities, while component delivery provides the processes and automation needed to release those services safely. This approach supports independent team ownership and targeted scaling, but introduces distributed-system complexity and requires disciplined interface design, observability, and deployment practices.
Migration and data transfer
Cloud migration combines workload placement, application changes, and data movement to achieve business and technical goals. Engineers must choose an appropriate migration strategy, maintain data consistency, and account for transfer charges that depend on traffic direction, network path, and location.
Networking, connectivity, and content delivery
This concept combines network isolation, addressing, routing, name resolution, hybrid connectivity, traffic distribution, and delivery from geographically distributed edge locations. Engineers use these capabilities to balance reachability, security, latency, availability, and cost across public-facing applications and private systems.
Security
Security combines technical controls, operational processes, and clearly assigned responsibilities to preserve confidentiality, integrity, and availability. In the cloud, providers secure the underlying infrastructure while customers configure and operate their workloads securely, using capabilities such as identity controls, encryption, network protection, and threat detection.
Serverless
Serverless shifts infrastructure operations to the cloud provider so engineers can focus on application behavior, data, and configuration. It can reduce operational work and align costs with usage, but scaling behavior, billing, execution limits, and customer responsibilities vary by service.
Storage
Cloud storage provides data capacity through managed services rather than requiring engineers to operate all underlying disks and storage systems. Choosing an appropriate storage model and tier requires balancing access patterns, performance, resilience, retention requirements, and total cost.
High availability
High availability reduces service interruptions by combining redundant components, isolated failure domains, health monitoring, and recovery mechanisms. In the cloud, it commonly involves distributing workloads across multiple Availability Zones so that a failure in one location does not stop the entire application.
Services on the exam
All 154 AWS services that can appear on the SAP-C02 exam.