Amazon SAP-C02 Exam Questions

Exam Name: AWS Certified Solutions Architect – Professional Exam

Exam Code: SAP-C02

Related Certification(s): Amazon Professional Certifications, Amazon AWS Certified Solutions Architect Professional Certifications

Certification Provider: Amazon

Actual Exam Duration: 180 Minutes

Number of SAP-C02 Practice Questions: 629 (updated: )

Expected SAP-C02 Exam Topics, as suggested by Amazon:
Topic 1: Design Solutions for Organizational Complexity
In this topic, AWS solutions architects learn to architect network connectivity strategies tailored to complex organizational needs. It emphasizes prescribing security controls, designing resilient architectures, building multi-account AWS environments, and determining cost optimization and visibility strategies to balance functionality and efficiency within large-scale organizations.
Topic 2: Design for New Solutions
This topic equips AWS solutions architects with the ability to design deployment strategies that align with business objectives. It focuses on planning secure and scalable architectures, implementing proper security controls, and ensuring reliability and operational continuity for newly deployed AWS solutions.
Topic 3: Continuous Improvement for Existing Solutions
This topic focuses on improving operational excellence for existing AWS workloads. It emphasizes enhancing security, performance, cost optimization, and reliability through continuous monitoring, evaluation, and architectural improvements.
Topic 4: Accelerate Workload Migration and Modernization
This topic enables AWS solutions architects to identify workloads suitable for migration and modernization. It covers migration strategies, re-architecting legacy systems, improving existing architectures, and leveraging AWS services to modernize workloads efficiently.
Free AWS SAP-C02 Exam Actual Questions
Note: AWS SAP-C02 Premium Questions were last updated on

Question #1

A company hosts a metadata API on Amazon EC2 instances behind an internet-facing Application Load Balancer (ALB).
Only internal applications that run on EC2 instances in separate AWS accounts need to access the metadata API.
All the internal EC2 instances use NAT gateways.
A new policy requires that traffic between internal applications must not travel across the public internet.

Which solution will meet this requirement?

Creating an internal ALB and configuring it as a PrivateLink endpoint service enables private connectivity between internal applications and the metadata API, ensuring traffic does not traverse the public internet. PrivateLink provides secure, private access across AWS accounts.

Question #2

An EC2-based ticketing service pulls a frequently updated pricing file (stored in S3) on startup.
Sometimes EC2 instances have stale pricing, causing charge issues.

Which solution will resolve this issue?

Mountpoint for Amazon S3 allows EC2 instances to mount S3 buckets as POSIX file systems so they always read the latest file without copying or syncing data.

Question #3

A company runs a web application on EC2 instances behind an ALB with AWS WAF.
External customers must connect using IP addresses instead of DNS.

Which solution provides static IPs with the least operational overhead?

AWS Global Accelerator provides static Anycast IP addresses while routing traffic to ALB endpoints globally with high availability and low latency.

Question #4

A company deploys applications across multiple VPCs connected through a Transit Gateway.
Security audit shows EC2 instances can communicate with all VPCs.
Traffic must be limited so VPCs can communicate only with authorized VPCs.

Which solution will meet this requirement?

Transit Gateway supports multiple route tables. By creating dedicated route tables per VPC attachment you can segment traffic and allow communication only with authorized VPCs.

Question #5

A company uses AWS Organizations and has a central VPC with a Site-to-Site VPN to on-premises.
A new AWS account must use the same networking resources.

Which solution is the most cost-effective?

AWS Resource Access Manager allows sharing VPC subnets across accounts so multiple accounts can use centralized networking resources.