Complete guide
SAP-C02 Solutions Architect Professional
Tap any service to see more details and official docs.
Exam breakdown
40–60
Questions
~65
Min read
700
Passing score
Organizational complexity
24–28% of the examMulti-account strategy with AWS Organizations
At the Professional level, account design is the first architectural decision. A single account doesn't scale in terms of limits, isolation, or security.
Click any service to see more details
Recommended OU structure
| OU | Contains | Purpose |
|---|---|---|
| Root | Management Account | Billing and management only — no workloads |
| Security | Audit Account, Log Archive Account | Centralizes CloudTrail, Config, GuardDuty |
| Infrastructure | Network Account, Shared Services Account | Transit Gateway, DNS, AD Connector |
| Workloads/Prod | One account per application or business domain | Isolation between production apps |
| Workloads/Dev | One or several development accounts | Freedom to experiment, flexible guardrails |
| Sandbox | Ephemeral accounts for experimentation | With aggressive budgets and automatic TTL |
Multi-account networking at scale
Click any service to see more details
| Option | Scenario | Trade-off |
|---|---|---|
| VPC Peering | Few VPCs (2-3), same owner | Cheaper, not transitive, doesn't scale |
| Transit Gateway | Many VPCs / multi-account | Cost per hour + GB, centralized, transitive |
| AWS PrivateLink | Exposing a service to other VPCs/accounts | No access to the whole network — only to the specific service |
| AWS RAM | Sharing subnets or TGW across accounts | Avoids duplicating network resources across accounts |
Federated identity and cross-account access
🔑 AWS IAM Identity Center
SSO to access multiple accounts with a single login. Integrates with AD, Okta, Azure AD.
🔑 Cross-account Roles
A role in the target account that the source account assumes. Standard pattern for automation.
🔑 AWS Directory Service
Managed Microsoft AD on AWS. For apps that require Kerberos or LDAP.
🔑 Resource Policies
Allow cross-account access to specific resources (S3, KMS, SNS) without assuming a role.
The SAP-C02 exam gives scenarios with hundreds of accounts. The answer almost always involves Control Tower + Organizations + TGW + IAM Identity Center. If there are only 2-3 accounts, VPC Peering and cross-account roles may be enough.
Design for new solutions
27–31% of the examEvent-driven architectures at scale
At the Professional level, designing decoupled, reactive systems is critical. The choice between messaging and orchestration services defines scalability.
Click any service to see more details
| Pattern | Tool | When |
|---|---|---|
| Choreography | EventBridge / SNS / SQS | Reactive services, no central coordinator |
| Orchestration | Step Functions | Complex logic flow, retries, human approvals |
| Streaming | Kinesis Data Streams | Real-time data with replay and parallel processing |
| Batch async | SQS + Lambda/ECS | Decouple load spikes, automatic retries |
Analytics and data at scale
Click any service to see more details
Modern data lake architecture on AWS
Microservices and containers
Click any service to see more details
| Decision | ECS Fargate | EKS |
|---|---|---|
| Management | AWS manages the control plane | AWS manages master nodes (paid) |
| Learning curve | Low — native AWS API | High — you need to know Kubernetes |
| Flexibility | Less extensible | Maximum — the whole K8s ecosystem |
| K8s migration | Not compatible | Ports existing K8s workloads |
| Recommended for | New apps with no existing K8s | You already use K8s or need its ecosystem |
On the Professional exam, design questions always have explicit cost vs. complexity vs. performance trade-offs. There's no single correct answer — justify it with the scenario's specific requirement.
Continuous improvement for existing solutions
23–27% of the examSecurity and compliance at scale
Click any service to see more details
| Control | Type | Service |
|---|---|---|
| Preventive | Blocks before it happens | SCPs, SGs/NACLs, IAM Deny, AWS WAF |
| Detective | Detects after it has happened | GuardDuty, Config Rules, CloudTrail, Macie |
| Corrective | Fixes it automatically | Config Remediation, Lambda, Systems Manager |
| Deterrent | Makes an action less likely | MFA, IAM Password Policy, visible alerts |
Advanced observability
Click any service to see more details
📊 CloudWatch Container Insights
Automatic metrics and logs for ECS, EKS, and K8s
📊 CloudWatch Lambda Insights
Detailed performance and errors per Lambda function
📊 AWS X-Ray
Distributed traces to debug latency in microservices
📊 AWS AppConfig (feature flags)
Feature flags with gradual rollout and automatic rollback (Evidently was retired in 2025)
Infrastructure as Code at org scale
Click any service to see more details
| Tool | When to use it |
|---|---|
| CloudFormation StackSets | Deploy the same stack to 100 accounts and 3 regions with one command |
| AWS CDK | Define infrastructure with TypeScript/Python/Java — generates CloudFormation |
| AWS Service Catalog | Teams can create pre-approved resources without direct AWS access |
| Terraform | Multi-cloud or team preference. Generates explicit plans before applying |
CloudFormation StackSets + Organizations = automatically deploy guardrails and security configurations to every account as soon as it's created. A fundamental pattern for the exam.
Migration and modernization
18–22% of the examThe 7 Rs of migration
| Strategy | Description | Tool |
|---|---|---|
| Rehost | Lift-and-shift with no code changes | MGN (Application Migration Service) |
| Replatform | Small tweaks to take advantage of the cloud | RDS instead of DB on EC2, Elastic Beanstalk |
| Repurchase | Switch to SaaS (e.g. on-prem CRM → Salesforce) | Marketplace, SaaS vendors |
| Refactor | Redesign for cloud-native (microservices) | Lambda, ECS, DynamoDB, API Gateway |
| Relocate | Move VMs from VMware to VMware Cloud on AWS | VMware Cloud on AWS |
| Retire | Shut down apps that are no longer needed | Discovery with AWS Transform |
| Retain | Keep on-premises for now | Connect via VPN/Direct Connect |
Migration tools
Click any service to see more details
Modernizing toward cloud-native
The SAP-C02 exam evaluates how to modernize existing monolithic apps into more scalable, manageable architectures, with clear trade-offs.
| Pattern | From | To | Benefit |
|---|---|---|---|
| Strangler Fig | Monolith | Gradual microservices | No big bang, incremental migration |
| Containerization | VMs with app | ECS/EKS Fargate | Density, portability, lower cost |
| DB modernization | Oracle/SQL Server | Aurora PostgreSQL/MySQL | Eliminates costly licenses, better performance |
| Event-driven | Synchronous calls | SQS/SNS/EventBridge + Lambda | Decoupling, independent scaling |
| Serverless | Always-on app on EC2 | Lambda + API Gateway | Pay only for usage, scales to zero |
Large-scale data transfer
| Scenario | Solution | Approx. speed |
|---|---|---|
| < 1 TB over the internet | S3 Transfer Acceleration / AWS DataSync | Depends on available bandwidth |
| 1-10 TB, internet available | AWS DataSync over VPN/Direct Connect | Maximum use of the channel |
| 10-100 TB, no fast internet | AWS Data Transfer Terminal or DataSync | Snowball Edge no longer accepts new customers |
| > 100 TB or petabytes | Dedicated Direct Connect + DataSync | Snowmobile was retired |
| Continuous DB replication | AWS DMS with CDC | Latency of seconds |
Physical transfer (formerly Snowball/Snowmobile, now Data Transfer Terminal) is only for the initial mass migration. For continuous replication after migration, use DataSync (files) or DMS (databases). The exam distinguishes both cases.
Tips for exam day
Multi-account is the foundation of the Professional level. Memorize Organizations → Control Tower → SCPs → Landing Zone. The order matters.
Transit Gateway is transitive. VPC Peering is NOT. For N VPCs across multiple accounts: always TGW. For 2 simple VPCs: Peering is cheaper.
Kinesis Streams = you process it (Lambda/Flink). Firehose = automatic delivery to S3/Redshift/OpenSearch. EventBridge = events from AWS services and SaaS.
Step Functions orchestrates steps. EventBridge routes events. They're complementary: EventBridge can trigger a Step Functions workflow.
The 6 Rs of migration: Rehost (lift-and-shift, MGN), Replatform (RDS instead of EC2+DB), Repurchase (SaaS), Refactor (new architecture), Retire, Retain.
Detective controls: GuardDuty (threats), Config (compliance), CloudTrail (auditing). Preventive controls: SCPs, IAM, SG/NACL. Know which one does what.
OLTP → RDS/Aurora. OLAP → Redshift. NoSQL → DynamoDB. Streaming → Kinesis. ETL → Glue. Data Catalog → Glue Catalog (shared with Athena and Spectrum).
CloudFormation StackSets deploys stacks across multiple accounts and regions simultaneously. Essential for governance in Organizations.
For the professional exam: always think at scale (thousands of accounts, petabytes, millions of users). The elegant solution for 10 resources doesn't work for 10,000.
Consolidated billing: Reserved Instances and Savings Plans are shared across the entire organization. Buy RIs in the account that needs them most.
Want to go deeper?
This guide is a quick summary. Visit the Deep Dive section for an exhaustive walkthrough with real cases, cost analysis and architecture decisions.
Ready to practice?
Put what you learned to the test with original SAP-C02 exam questions.
Start SAP-C02 mock examUnlimited mock exams with the Pro plan
Was this guide helpful?
Not ready to start yet?
Save your email so you don't have to type it again — pick up later and unlock SAP-C02 with a Pro plan or individual purchase.