AWS Certified Solutions Architect - Professional SAP-C02

By Amazon · Browse Mode
About the Exam

This professional-level exam is intended for people who perform a solutions architect role and have 2 or more years of experience designing and implementing cloud solutions on AWS. It validates advanced technical skills in designing optimized AWS solutions based on the AWS Well-Architected Framework. Passing demonstrates the ability to design for organizational complexity, design new solutions, continuously improve existing solutions, and accelerate workload migration and modernization.

Exam Topics

  • Design Solutions for Organizational Complexity26%
  • Design for New Solutions29%
  • Continuous Improvement for Existing Solutions25%
  • Accelerate Workload Migration and Modernization20%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated July 10, 2026 at 12:14 AM

Topic filter
Retired questions
Question sort
Questions per page

QuestionQ1

Continuous Improvement for Existing Solutions

A company's solutions architect is reviewing an AWS-hosted web application. The application refers to static assets in an Amazon S3 bucket in the us-east-1 Region. The company requires resilience across multiple AWS Regions. The company has already created an S3 bucket in a second Region.

Which solution meets these requirements with the LEAST operational overhead?

Explanation

Amazon S3 Cross-Region Replication automatically replicates objects to a bucket in another Region. A CloudFront origin group uses a primary and secondary origin and automatically routes requests to the secondary origin when the primary origin is unavailable or returns configured failure responses. Together, these managed services provide replicated static assets and failover without custom replication code or application changes.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Continuous Improvement for Existing Solutions

A company needs to run a custom network-analysis software package to inspect traffic as it enters and leaves a VPC. The company deployed the solution with AWS CloudFormation on three Amazon EC2 instances in an Auto Scaling group. All network routes are configured to direct traffic to the EC2 instances.

Whenever the analysis software ceases to work, the Auto Scaling group replaces an instance. The network routes are not updated when an instance is replaced.

Which combination of steps will resolve this problem?

Choose three
Explanation

The Amazon CloudWatch agent's procstat plugin collects metrics for individual application processes, allowing an alarm to detect analysis-software failure. CloudWatch alarms can publish to an Amazon SNS topic, which can invoke a Lambda-driven remediation workflow. The function can remove the failed instance from service so the Auto Scaling group maintains capacity by launching a replacement, and it can update the VPC routes to target that replacement. EC2 status checks monitor instance-level health rather than the custom application process, Systems Manager Agent is not the appropriate process-metrics mechanism, and CloudFormation conditions do not perform runtime route updates for Auto Scaling replacements.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Accelerate Workload Migration and Modernization

A company is building a centralized logging service on Amazon EC2 that will receive and analyze logs from hundreds of AWS accounts. AWS PrivateLink provides connectivity between the client services and the logging service.

In every AWS account that contains a client, an interface endpoint for the logging service has been created and is available. The EC2 instances running the logging service and the Network Load Balancer (NLB) are deployed in separate subnets. Clients cannot submit logs through the VPC endpoint.

Which combination of actions should a solutions architect take to fix this issue?

Choose two
Explanation

For traffic sent through a PrivateLink interface endpoint, the EC2 targets behind the Network Load Balancer receive traffic sourced from the NLB nodes. Network ACLs must therefore permit traffic in both directions between the NLB subnets and the logging-service EC2 subnets, and the EC2 instances’ security group must allow inbound traffic from the NLB subnets.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Continuous Improvement for Existing Solutions

A company’s solutions architect is assessing an AWS workload that was deployed several years ago. The application tier is stateless and operates on one large Amazon EC2 instance launched from an AMI. The application stores its data in a MySQL database running on a single EC2 instance.

CPU utilization on the application-server EC2 instance frequently reaches 100%, causing the application to become unresponsive. The company installs instance patches manually, and patching has previously caused downtime. The company must make the application highly available.

Which solution meets these requirements with the LEAST development time?

Explanation

An Application Load Balancer distributing traffic to smaller EC2 instances in an Auto Scaling group provides horizontal scaling and high availability for the stateless application tier; a CPU-based scaling policy adds capacity as utilization rises. AWS Systems Manager, using SSM Agent, supports automated patch management. Amazon Aurora MySQL maintains MySQL compatibility while providing resilient storage across Availability Zones and automatic failover options, avoiding the substantial application and data-model changes required by Lambda, containers, DynamoDB, DocumentDB, or Neptune.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Design Solutions for Organizational Complexity

A company operates an application on a fleet of Amazon EC2 instances in private subnets behind an internet-facing Application Load Balancer (ALB). The ALB serves as the origin for an Amazon CloudFront distribution. An AWS WAF web ACL containing various AWS managed rules is associated with the CloudFront distribution.

The company requires a solution that prevents internet traffic from accessing the ALB directly.

Which solution meets these requirements with the LEAST operational overhead?

Explanation

An ALB security-group inbound rule that uses the AWS-managed CloudFront origin-facing prefix list permits only traffic from CloudFront origin-facing servers and prevents non-CloudFront traffic from reaching the ALB. AWS maintains the IP ranges in that prefix list, avoiding the ongoing maintenance required for manually configured CloudFront IP ranges. Duplicating managed WAF rules in another web ACL adds rule-management overhead.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home