SAP-C02 is the capstone of the AWS architecture track and a real step up from SAA-C03 rather than more of it. AWS assumes two or more years of hands-on experience designing and running production estates, and the exam reads that way from the first question.
Questions are long, multi-constraint scenarios set across an organisation rather than a single workload, and very little of the exam is single-service recall. You are asked to hold an organisation-sized problem in view at once: governance across many accounts, a migration strategy for an estate that already exists, and trade-offs between cost, performance and resilience where several answers work and only one fits every stated constraint.
Design for New Solutions is the largest of the four domains, but organisational complexity and continuous improvement of existing solutions sit close behind it, with migration and modernisation making up the rest. The pass mark is higher than the associate exams use, so there is less room for a domain you have not practised. If you hold only CLF-C02, SAA-C03 comes first.
6 questions
Question 1 of 25
A SaaS company connects 80 customer-facing VPCs and 3 shared-service VPCs (logging, CI/CD, secrets) through a central Transit Gateway. The platform team wants customer VPCs to reach shared services but never reach each other. What Transit Gateway design achieves this?
Answer: D
Two route tables - one associated with customer VPCs (propagating only shared-service routes) and one for shared-services (propagating from every customer VPC) - lets each customer reach shared services while remaining unable to route to any other customer VPC, since no customer-to-customer routes are ever propagated.
Question 2 of 25
The retail company's central security team also wants visibility into every elevated access grant made this way across all 15 accounts, without manually checking each account's Identity Center configuration. What closes this visibility gap?
Answer: D
Centrally configured access reviews give structured, aggregated visibility across every account's assignments - relying on ad hoc manager reporting reintroduces the same inconsistency problem the whole redesign was meant to solve.
Question 3 of 25
An enterprise's board requires that critical workloads could be moved off AWS within a defined period if commercially necessary. What design principle addresses this without sacrificing AWS-native benefits today?
Answer: B
Isolating provider-specific dependencies and documenting an exit path per workload satisfies the board's portability requirement while still allowing managed-service benefits today - avoiding all managed services or running everything twice imposes a heavy permanent cost for a contingency.
Question 4 of 25
That consulting firm must fully delete a client's data at engagement end and prove it. What does the per-engagement account model make possible?
Answer: B
Because the engagement's data lives entirely in its own account, closing that account is a clean, provable deletion - in a shared account, proving every file was found and removed is far harder.
Question 5 of 25
A law firm must place a legal hold on specific client data across multiple AWS accounts, preventing deletion even by account owners until the hold is lifted. What enforces this?
Answer: A
Object Lock legal hold prevents deletion regardless of who attempts it until explicitly removed, which is what a legal hold obligation requires - a written instruction or an owner-modifiable policy provides no enforcement.
Question 6 of 25
A retail company operates 15 AWS accounts for regional business units, each with its own security team applying inconsistent IAM password and MFA policies. Central security wants one identity source enforcing consistent authentication policy across all 15 accounts. What should be implemented first?
Answer: C
Only a single federated identity source genuinely enforces one consistent authentication policy across every account - a shared document or independently-applied per-account configuration both depend on 15 separate teams staying in sync manually, which is exactly the inconsistency already observed.
8 questions
Question 7 of 25
A mining company is designing monitoring for equipment at remote sites with only a low-bandwidth satellite link, where operators need near-real-time alerts but full telemetry only weekly. What design fits?
Answer: C
Alerts computed at the edge arrive immediately regardless of link capacity, while bulk telemetry uses the link on a schedule - streaming everything saturates the link, and weekly-only transfer delays the alerts that matter.
Question 8 of 25
For that same document platform, the company wants to guarantee no two identical documents (checked by content hash) are ever processed twice, even if a customer accidentally uploads the same file multiple times, to avoid wasting NLP processing cost. What should be added?
Answer: B
A content-hash check before triggering the expensive pipeline is what actually catches a genuine duplicate regardless of filename - filename-based deduplication misses a renamed identical file, and relying on the customer's own vigilance provides no real technical guarantee against wasted reprocessing cost.
Question 9 of 25
A company is designing a new architecture for a workload requiring encryption keys it fully controls, generated and stored in a dedicated, single-tenant hardware security module, for the strictest possible regulatory key-custody requirement beyond what a standard managed KMS key provides. What should be used?
Answer: B
CloudHSM specifically provides dedicated, single-tenant hardware security modules under direct customer control, meeting a stricter key-custody bar than even a customer managed KMS key (which still uses AWS's shared HSM infrastructure underneath) - embedding a key in source code is a serious security anti-pattern, not a legitimate option at any regulatory tier.
Question 10 of 25
That satellite operator must process each pass's imagery within 20 minutes to be useful to customers, with pass sizes varying tenfold. What compute approach fits?
Answer: C
Scaling parallelism to each pass's actual volume keeps every pass within the 20-minute window regardless of size - a fixed processor either wastes capacity on small passes or misses the deadline on large ones.
Question 11 of 25
That news platform must correct a factual error in a live story within seconds across every edge location. What design supports rapid correction?
Answer: C
Invalidation or a versioned URL propagates a correction immediately without waiting out TTLs - disabling caching sacrifices the scale property the platform depends on.
Question 12 of 25
That fleet-management system must also let shore-based operators send configuration changes to a vessel that may be offline when the change is issued. What design handles this?
Answer: A
A queued desired-state model with confirmation on application handles intermittent connectivity by design - discarding changes or relying on manual retry both make the system's behavior depend on connectivity timing rather than operator intent.
Question 13 of 25
A company preparing a major product launch must ensure sufficient EC2 capacity is genuinely available in a specific AZ at launch time, not merely that its Auto Scaling group is configured to request it. What should be arranged in advance?
Answer: D
Capacity Reservations actually hold capacity in a specific AZ, which is different from an Auto Scaling group merely being permitted to request it - during a high-demand event, an unreserved request can genuinely fail to be fulfilled.
Question 14 of 25
A collaboration platform is designing multi-Region active-active document editing where two users in different Regions may edit the same document simultaneously. What approach handles concurrent edits without arbitrarily discarding one user's work?
Answer: A
CRDTs or operational transformation merge concurrent edits deterministically without data loss, which is what collaborative editing requires - whole-document last-writer-wins silently destroys one participant's work, which is precisely the failure mode to avoid.
6 questions
Question 15 of 25
An existing application's S3-based static asset delivery shows high origin load because CloudFront's cache hit ratio is unexpectedly low for content that rarely changes. What is a likely cause worth investigating first?
Answer: A
A low cache hit ratio for genuinely static, rarely-changing content most often traces back to how caching behavior is actually configured - overly short TTLs, a Cache-Control header preventing caching, or a cache policy including unnecessary variance keys - not a fundamental CloudFront/S3 incompatibility or S3 storage class, which don't govern CDN cache behavior.
Question 16 of 25
An existing ride-hailing platform computes surge pricing from a database query that runs every 30 seconds per city, and query load now limits how many cities can be supported. What improvement fits?
Answer: C
Maintaining demand state incrementally from a stream replaces repeated full queries with continuous updates, scaling to more cities without the per-query load - a bigger instance defers rather than removes the ceiling.
Question 17 of 25
An existing application's Aurora database experiences degraded performance during nightly batch reporting queries, which compete with the application's real-time transactional traffic on the same primary instance. What improvement addresses this without a major rewrite?
Answer: D
Routing batch reporting queries to a Read Replica offloads that contention from the primary instance handling real-time transactional traffic - a targeted, low-risk fix rather than a full platform migration for a well-understood bottleneck.
Question 18 of 25
An existing shared Kubernetes cluster runs workloads from ten teams, and finance cannot attribute cluster cost to teams. What improvement enables attribution?
Answer: D
Namespace or label-based allocation attributes shared cluster cost to actual per-team usage without abandoning the shared cluster's efficiency - an even split charges light users for heavy users' consumption.
Question 19 of 25
An existing e-commerce platform's checkout service calls an inventory service synchronously, and during flash sales, inventory-service slowdowns cause checkout failures to cascade broadly across the whole platform, not just inventory-related features. What is the most effective architectural improvement?
Answer: C
A circuit breaker specifically prevents a slow or failing downstream call from exhausting the caller's own resources and cascading broadly - simply adding capacity to either service doesn't address the actual coupling mechanism causing the cascade, and removing inventory validation trades a reliability problem for a correctness one.
Question 20 of 25
That genomics pipeline currently stages its 200 GB inputs onto each compute node's EBS volume before processing, and the team finds provisioning time dominates short analysis stages. What improvement reduces this overhead?
Answer: D
FSx for Lustre linked to S3 lets compute nodes read data directly at high throughput without each staging a full local copy, removing exactly the provisioning overhead identified - a larger EBS volume does not make the copy faster.
5 questions
Question 21 of 25
A company modernizing a legacy application currently running on a fixed schedule of batch jobs wants to move toward an event-driven architecture as part of the migration, triggering processing immediately when new data arrives rather than waiting for the next scheduled run. What migration strategy best characterizes this change?
Answer: D
Moving from scheduled batch processing to genuine event-driven architecture is a meaningful re-architecture of how the application actually processes data, correctly characterized as refactoring - rehosting would preserve the existing batch schedule unchanged, which is the opposite of what's being described.
Question 22 of 25
After replacing the queue technology, the telecom company wants to validate that message ordering guarantees critical to correct billing (charges must apply in the order events occurred) are preserved under the new queue technology before cutting over production billing traffic. What should be done?
Answer: C
A dedicated test specifically targeting the ordering guarantee, under realistic concurrent load, is what actually validates the property billing correctness depends on - assuming default behavior or testing without concurrency both risk missing a genuine ordering problem before it reaches production billing traffic.
Question 23 of 25
A retailer decomposing a monolith into services finds that several new services all need read access to customer data currently owned by the monolith's single shared database. What pattern avoids recreating tight coupling through the database?
Answer: C
Publishing changes as events lets each service own its read model, avoiding the shared-database coupling that would otherwise prevent independent schema evolution - direct table access recreates exactly the coupling decomposition was meant to remove.
Question 24 of 25
A retailer migrating its point-of-sale backend must keep 2,000 stores transacting throughout, with stores that cannot tolerate even a brief outage during business hours. What cutover approach fits?
Answer: A
Cutting over store groups outside their local trading hours, with per-group rollback, respects each store's no-outage constraint - a single global time inevitably lands in some stores' business hours.
Question 25 of 25
A company migrating a large number of on-premises Oracle databases to AWS wants to evaluate whether each should move to Aurora, RDS for Oracle, or remain on a self-managed EC2-hosted Oracle instance, based on each workload's specific compatibility and licensing needs. What is a reasonable approach to this decision at scale?
Answer: D
SCT-based compatibility assessment per workload gives an evidence-based basis for choosing the right target platform for each specific database's needs - a single blanket choice ignores real per-workload differences in compatibility and licensing that a proper assessment would surface.
20 more free after signup, then the full 400-question bank for $15.
Get 20 more free questions