AWS SAP-C02 Solutions Architect Professional guide for organizational complexity, new solution design, continuous improvement, migration, modernization, governance, resilience, cost, security, and Well-Architected trade-offs.
This guide targets AWS Certified Solutions Architect - Professional (SAP-C02), AWS’s professional-level architecture exam for candidates who need to justify AWS designs under organizational scale, hybrid connectivity, resilience, modernization, cost, and operational constraints. As of May 17, 2026, AWS’s current exam guide lists four weighted domains, 65 scored questions, 10 unscored questions, 180 minutes, and a 750 minimum passing score. This guide follows that current four-domain structure directly.
SAP-C02 stays in the professional solutions-architect lane. AWS expects advanced technical skill designing optimized AWS solutions based on the AWS Well-Architected Framework. The exam is not about frontend mobile development, in-depth operating system administration, or applying 12-factor app methodology by rote. It is about making enterprise-safe architecture recommendations across multiple workloads, accounts, teams, networks, and migration phases.
SCP: Service control policy, the AWS Organizations guardrail that limits the maximum permissions available in an account or OU.
PrivateLink: Private service connectivity pattern that lets consumers reach a service without exposing it through public internet paths.
Warm standby: Reduced-capacity disaster-recovery environment that stays live and can scale up after failover.
| Exam fact | Current official signal |
|---|---|
| Exam code | SAP-C02 |
| Official exam name | AWS Certified Solutions Architect - Professional |
| Total questions | 75 |
| Scored questions | 65 |
| Unscored questions | 10 |
| Exam time | 180 minutes |
| Passing score | 750 on a scaled 100-1000 range |
| AWS recommended experience | 2+ years designing and implementing AWS cloud solutions |
| Guide model | 4 domains -> 20 task lessons -> support appendices |
SAP-C02 is not an advanced flash-card exam. It is a trade-off exam. Strong answers usually begin with the dominant organizational or architectural constraint, then pick the simplest enterprise-safe AWS pattern that satisfies it. The trap is often not choosing a totally wrong service. The trap is choosing a design that technically works but is too hard to govern, too expensive to operate, too slow to migrate, or too weak under failure.
| Official domain | Weight | What this guide emphasizes |
|---|---|---|
| 1. Design Solutions for Organizational Complexity | 26% | Multi-account strategy, hybrid connectivity, cross-account security, organization-wide resilience, shared services, cost visibility, DNS, and governance. |
| 2. Design for New Solutions | 29% | Deployment strategy, business continuity, security controls, reliability, performance objectives, and cost strategy for new workloads. |
| 3. Continuous Improvement for Existing Solutions | 25% | Operational excellence, security improvements, performance tuning, reliability improvement, cost optimization, and modernization without unnecessary rewrite. |
| 4. Accelerate Workload Migration and Modernization | 20% | Migration assessment, wave planning, migration approach, target architecture, refactoring decisions, cutover risk, and long-term modernization. |
AWS also notes that emerging topics may appear as unscored pretest questions. Current examples include security and responsible AI controls for generative AI services, access controls for generative and agentic AI applications, and human oversight workflows. Those topics should not replace the core four-domain study plan, but they are worth recognizing as architecture-control patterns.
Most SAP-C02 questions can be worked through this loop.
flowchart LR
R["Business and organizational constraint"] --> G["Governance, account, identity, and network boundary"]
G --> W["Well-Architected trade-off: security, reliability, performance, cost, operations"]
W --> M["Migration, modernization, or new-build path"]
M --> O["Operational model: ownership, observability, automation, recovery"]
O --> E["Eliminate designs that fail at enterprise scale"]
E --> R
At professional level, the best answer is often the one that survives governance, migration sequencing, failure behavior, and operational ownership, not merely the one that satisfies a single workload requirement.
AWS’s current exam guide breaks SAP-C02 into four domains. This guide follows that structure directly.
| Scenario pressure | Strong SAP-C02 reasoning |
|---|---|
| Many accounts need shared controls | Start with Organizations, OUs, SCPs, delegated administration, landing-zone patterns, identity federation, and centralized logging before workload tweaks. |
| Hybrid connectivity is complex | Separate Direct Connect, VPN, Transit Gateway, Cloud WAN, Route 53 Resolver, PrivateLink, routing domains, and failure paths before optimizing bandwidth. |
| A new workload has competing requirements | Balance Well-Architected pillars, then choose deployment, continuity, security, performance, and cost controls that satisfy the business constraint. |
| Existing workload is expensive or fragile | Improve incrementally: observe bottlenecks, reduce waste, add automation, improve resilience, and avoid rewrites without a business reason. |
| Migration must be accelerated | Use assessment, wave planning, dependencies, cutover risk, migration factory patterns, and 7-R decision logic before choosing tools. |
| DR answer choices all seem plausible | Translate RTO/RPO, data loss tolerance, Region dependency, operational burden, and testability before picking backup, pilot light, warm standby, or active-active. |
flowchart LR
A["1. Organizational complexity"] --> B["2. New-solution design"]
B --> C["3. Continuous improvement"]
C --> D["4. Migration and modernization"]
D --> E["Cheat sheet, glossary, FAQ, and live AWS checks"]
RTO / RPO, and operational burden| Failure pattern | Better instinct |
|---|---|
| choosing a design that works technically but ignores org-wide governance | read the account, OU, SCP, and delegated-admin model first |
| using VPC peering or ad hoc networking at organizational scale | decide whether the problem needs TGW, Cloud WAN, PrivateLink, DX, VPN, or Resolver before naming services casually |
| treating IAM allow alone as sufficient | remember SCPs, key policies, trust policies, and network boundaries can still block the action |
answering DR questions without translating RTO / RPO |
decide backup, pilot light, warm standby, or multi-site only after the recovery target is clear |
| choosing modernization patterns that overfit the current system | the best answer usually reduces long-term ops drag without forcing unnecessary rewrite effort |
| optimizing one pillar while breaking another required pillar | keep security, reliability, performance, cost, and operational excellence in play until the stem narrows them |
| treating migration as tool selection only | map dependencies, waves, cutover risk, target architecture, data movement, and rollback first |
| solving every org-scale issue inside one account | move recurring controls to the organization, network, identity, logging, or governance layer |
| If you are coming from… | Bias your review toward… |
|---|---|
| SAA-C03 or associate-level AWS background | multi-account governance, hybrid DNS, and professional-level trade-offs |
| platform or DevOps background | migration strategy, modernization judgment, and org-scale cost visibility |
| networking background | IAM, KMS, service integration, and workload modernization patterns |