The AWS Certified Solutions Architect - Professional (SAP-C02) is the exam that separates people who can spin up a VPC from people who can architect a multi-account, multi-region platform under real constraints. It's a professional-level beast: 75 questions, 180 minutes, a scaled passing score of 750/1000, and a $300 registration fee.
What trips most engineers up isn't AWS trivia. It's that SAP-C02 questions are long, scenario-heavy, and often have two "correct" answers where you have to pick the one that best fits cost, operational overhead, or migration risk. You can't cram your way through it. You have to think like the architect the scenario is describing.
This SAP-C02 study guide walks through all four exam domains, what each one actually tests, and the services you need to be fluent in. If you want to calibrate where you stand before committing to a full study plan, run through a free SAP-C02 practice test first — the scenario length alone tells you a lot about the gap you're closing.
Let's break it down domain by domain.
Domain 1: Design Solutions for Organizational Complexity (26%)
This is the "you run a company, not a single app" domain. It's the largest single-topic block after new solutions, and it's where a lot of developers-turned-architects lose points because it's less about code and more about governance, networking at scale, and identity.
What it really tests: connecting many accounts, many VPCs, and often on-prem into one coherent, secure, cost-attributed whole.
Core topics and services to master:
- AWS Organizations — OUs, service control policies (SCPs), consolidated billing, and how policy inheritance actually resolves.
-
Multi-account identity — IAM roles, cross-account
AssumeRole, AWS IAM Identity Center (formerly SSO), and permission boundaries. - Hybrid & multi-VPC networking — Transit Gateway, VPC peering vs. Transit Gateway trade-offs, Direct Connect, Site-to-Site VPN, PrivateLink, and Route 53 Resolver for hybrid DNS.
- Centralized governance — AWS Config, CloudTrail organization trails, and centralized logging patterns.
Study tip: draw the topologies by hand. If you can't sketch how three accounts share a centralized egress VPC through Transit Gateway, you'll misread the diagrams the exam hides inside a wall of text.
Domain 2: Design for New Solutions (29%)
The biggest domain by weight. This is greenfield architecture: someone hands you requirements — availability targets, latency budgets, compliance rules, cost ceilings — and you design the system.
What it really tests: picking the right primitives and wiring them into an architecture that meets all stated non-functional requirements simultaneously, not just the obvious one.
Core topics and services to master:
- Compute selection — when to reach for Lambda vs. ECS/Fargate vs. EKS vs. EC2 Auto Scaling, and the cost/ops implications of each.
- Decoupling & event-driven design — SQS, SNS, EventBridge, Step Functions, and Kinesis for streaming.
- Data stores — Aurora, DynamoDB (including global tables), ElastiCache, RDS Proxy, and choosing consistency vs. scale.
- Resilience & DR — multi-AZ vs. multi-region, RTO/RPO targets, and the four DR strategies (backup/restore, pilot light, warm standby, active/active).
- Security by design — KMS, Secrets Manager, WAF, Shield, and encryption in transit/at rest.
Expect questions that give you an RPO of "seconds" and an RTO of "minutes" and ask for the most cost-effective design that still hits both. Memorizing services isn't enough — you need to map requirements to patterns instinctively. Working through scenario questions on the SAP-C02 exam page is the fastest way to build that reflex.
Domain 3: Continuous Improvement for Existing Solutions (25%)
This domain assumes the system already exists and something about it is wrong — it's too slow, too expensive, too fragile, or too manual. Your job is to improve it without a full rewrite.
What it really tests: diagnosing bottlenecks and applying the highest-leverage fix with the least operational disruption.
Core topics and services to master:
- Observability — CloudWatch metrics/alarms/Logs Insights, X-Ray tracing, and CloudWatch Synthetics for canaries.
- Performance tuning — CloudFront and caching strategies, read replicas, DynamoDB Accelerator (DAX), and Auto Scaling policies.
- Cost optimization — Savings Plans vs. Reserved Instances, Spot, S3 storage classes + lifecycle policies, Compute Optimizer, and Cost Explorer.
- Operational excellence — Systems Manager, automated remediation with Config rules + Lambda, and reducing manual toil.
- Reliability hardening — health checks, circuit breakers, and removing single points of failure.
The trap here is over-engineering. The exam frequently rewards the smallest change that solves the stated problem. If a question complains about cost and the answer is "re-architect everything to serverless," it's usually wrong. Look for the S3 lifecycle policy or the right Savings Plan first.
Domain 4: Accelerate Workload Migration and Modernization (20%)
The smallest domain, but don't skip it — 20% is roughly 15 questions, enough to fail on. This is the "get it off the datacenter and make it cloud-native" domain.
What it really tests: choosing migration strategies and modernization paths that balance speed, risk, and long-term value.
Core topics and services to master:
- Migration strategy — the 7 Rs (rehost, replatform, repurchase, refactor, relocate, retain, retire) and when each applies.
- Migration tooling — AWS Migration Hub, Application Migration Service (MGN), Database Migration Service (DMS) + Schema Conversion Tool, and DataSync for data transfer.
- Large-scale data movement — Snow Family, Storage Gateway, and Transfer Family.
- Modernization — breaking monoliths into containers/microservices, moving to managed databases, and adopting serverless incrementally.
Know the difference between MGN (lift-and-shift servers) and DMS (databases), and know when a Snowball beats pushing terabytes over Direct Connect. These distinctions show up as clean, answerable points if you've studied them — and as coin flips if you haven't.
How to Actually Prep for SAP-C02
A domain map is useless without a study loop. Here's the workflow that works for most engineers clearing this exam:
- Baseline with practice questions. Take a scored set cold to see which domains bleed points. Don't study evenly — study your weaknesses.
- Read the AWS whitepapers that match your gaps. The Well-Architected Framework, the disaster recovery whitepaper, and the Organizations best-practices guides map directly to Domains 1–3.
- Build something. Even a small Transit Gateway hub-and-spoke in a sandbox account cements Domain 1 better than any video.
- Drill scenarios until pattern recognition kicks in. The real skill is reading a 120-word scenario and immediately knowing it's a "warm standby DR" or "SCP guardrail" question.
- Time yourself. 75 questions in 180 minutes is 2.4 minutes each. Long scenarios eat that fast, so practice pacing.
The exam rewards judgment over recall, which is exactly why hands-on reps and realistic questions beat passive reading. When you're ready to pressure-test your readiness, a free SAP-C02 practice test will show you whether your pattern recognition is fast and accurate enough for the clock.
Final Word
SAP-C02 isn't about knowing every AWS service — it's about knowing which service is right given a stack of competing constraints. Anchor your prep to the four domains, weight your time toward Design for New Solutions (29%) and Organizational Complexity (26%), and treat every practice scenario as a design exercise rather than a trivia question.
Get the reps in, learn to read the constraints, and the Professional cert stops feeling like a gamble and starts feeling like a formality.
Top comments (0)