Passing SAP-C02 Before It Retires: Study Resources, Exam Tactics, and 3 Deep-Dive Questions

SAP-C02 has a hard deadline: the last day to sit it is November 16, 2026, and registration for SAP-C03 opens October 27, 2026. I passed on September 29, 2026, after a bit over a month of prep at 20 to 30 hours per week. What got me through: Stephane Maarek's Udemy course, Tutorials Dojo practice exams reviewed question by question, and a lab for every topic I kept getting wrong.

Nghi Danh

AI Engineer at Renova Cloud - AWS Premiere Partner - 8x AWS Certified - First Cloud AI Journey

Published Oct 3, 2026

Last modified Oct 3, 2026

SAP-C02 has a hard deadline: the last day to sit it is November 16, 2026, and registration for SAP-C03 opens October 27, 2026.
I passed on September 29, 2026, after a bit over a month of prep at 20 to 30 hours per week.
What got me through: Stephane Maarek's Udemy course, Tutorials Dojo practice exams reviewed question by question, and a lab for every topic I kept getting wrong.
The exam is not about remembering services. It is about reading constraints. Below are 3 original scenario questions, worked end to end, with the CLI or policy you can run to prove the answer to yourself.

1. Why this post, and why now

AWS has announced that the Solutions Architect - Professional exam is being updated. Registration for SAP-C03 opens on October 27, 2026, and November 16, 2026 is the last day to take SAP-C02. I sat SAP-C02 on September 29, 2026 and passed. If you are halfway through your prep, you have about six weeks to decide: sprint for C02, or reset for C03.

My short answer:

Scoring 75%+ on timed practice sets: book SAP-C02 now. Prep material, community notes, and practice sets are mature for C02.
Below 60%, with more than 6 weeks of gaps: wait for SAP-C03. Cramming a retiring blueprint is a bad trade.
Somewhere in between: book C02, but keep a fallback date. You can reschedule, and a booked date is the best motivator I know.

One more signal: the current SAP-C02 exam guide already lists "emerging topics" as unscored pretest items, such as content filtering with Amazon Bedrock Guardrails, access control for agentic AI with AgentCore Identity, and human approval workflows with AWS Step Functions. That is a strong hint of where the next version is heading. Whichever exam you take, learn these.

2. About me (so you can calibrate my advice)

AI Engineer at Renova Cloud, an AWS Partner in Vietnam. Day to day I work on GenAI workloads, cost visibility, and customer provisioning for Amazon Quick and Kiro.
Certification path before SAP-C02: AWS Certified Data Engineer - Associate (DEA-C01, Feb 2026) and AWS Certified Security - Specialty (SCS-C03, Sep 2026).
SAP-C02: passed on September 29, 2026, after a bit over one month of focused preparation at roughly 20 to 30 hours per week (around 100 to 150 hours in total).
AWS Community Builder and Student Builder Group leader, so I also see where students get stuck when they jump to Professional level.

Doing Security Specialty first helped a lot. IAM policy evaluation, SCPs, KMS key policies, and logging architecture show up all over SAP-C02, and I barely had to re-study them.

3. The exam at a glance (from the official exam guide)

Duration: 180 minutes
Questions: 75 total, 65 scored and 10 unscored (you cannot tell which)
Types: multiple choice (1 correct of 4) and multiple response (2 or more correct of 5 or more)
Passing score: 750 on a 100 to 1,000 scale, compensatory (no per-domain minimum)
Domain weights:
- D1 Design Solutions for Organizational Complexity: 26%
- D2 Design for New Solutions: 29%
- D3 Continuous Improvement for Existing Solutions: 25%
- D4 Accelerate Workload Migration and Modernization: 20%
Cost: 300 USD (50% discount voucher if you already hold an AWS Certification)
Delivery: Pearson VUE test center or online proctored

Two rules that change how you should answer:

No penalty for guessing. Unanswered questions are scored as wrong. Never leave anything blank.
Multiple response is all or nothing. You must pick every correct option to get credit.

4. Study resources: what I used and what each one is for

I kept the stack small on purpose. Two paid resources did the heavy lifting, and the official AWS material filled the gaps and settled every argument.

The two resources I actually relied on

1. Stephane Maarek's Ultimate AWS Certified Solutions Architect Professional course (Udemy)

Job: learn the material.
How I used it: watched once at 1x and took notes per domain, then rewatched only my weak sections at 1.5x to 2x.

2. Tutorials Dojo SAP-C02 practice exams (Jon Bonso)

Job: learn the exam style and find gaps.
How I used it: timed mode first to build stamina, then review mode. I read the explanation for every question, including the ones I got right.

The Tutorials Dojo review loop was where most of the learning happened. Each explanation that surprised me went into a "red topics" list, and each red topic got a short lab or a docs read before the next practice set.

Official AWS material I used alongside them

Official SAP-C02 exam guide and the in-scope services list: defines the scope. I turned every task statement into a checklist row and marked it green, yellow, or red.
AWS Skill Builder Official Practice Question Set (free): shows the real question style and wording. Good as a baseline on day one.
AWS whitepapers and docs (Disaster Recovery of Workloads on AWS, Organizations SCP docs, Aurora Global Database docs): when the course and a practice explanation disagreed, the docs won.
A sandbox account under AWS Organizations: SCPs, PrivateLink, and Aurora failover make much more sense after you break them once.

What I would skip

Brain dumps. Sites that publish "real exam questions" are tempting at Professional level. AWS states that accessing this type of content, even unintentionally, violates the AWS Certification Program Agreement, and they actively remove it. Beyond the policy risk, dumps train you to recognize answers instead of reasoning about constraints, which is the exact skill SAP-C02 tests. Stick to scenario questions written by trainers, then verify the logic in docs or a lab.

5. My study plan (about 5 weeks, 20 to 30 hours per week)

This is roughly how my month looked. With a full-time job, that meant 2 to 3 hours on weekday evenings and longer blocks on weekends.

Week 1: scope, baseline, and Domain 1

Focus: exam guide checklist, Official Practice Question Set as a baseline, then the Udemy course for Domain 1 (Organizations, SCPs, Control Tower, IAM Identity Center, TGW, PrivateLink, Direct Connect, Route 53 Resolver).
Output: baseline score, red topic list, one SCP lab in a test OU.

Week 2: Domain 2

Focus: HA and DR, data stores, caching, event-driven design, security by design.
Output: a one-page DR decision sheet (RPO and RTO vs cost).

Week 3: Domains 3 and 4

Focus: cost optimization, observability, the 7Rs, Application Migration Service, DMS and SCT, data transfer options.
Output: a one-page migration decision tree.

Week 4: first practice round

Focus: Tutorials Dojo practice exams in timed mode, then full review of every explanation.
Output: red topics re-studied in the course or docs.

Week 5: second practice round and rest

Focus: second round of practice sets, rewatch weak sections at 2x, rest the day before.
Output: book the exam once practice scores are consistently 80% or higher.

Security Specialty a few weeks earlier meant I could move fast through IAM, KMS, and logging, and spend that time on migration and networking instead.

6. Exam tactics that actually moved my score

Read the last sentence first. It holds the real ask: "MOST cost-effective", "LEAST operational overhead", "MINIMUM downtime". Then read the scenario looking only for constraints.
Write constraints on the whiteboard/noteboard. For example: RPO<1m | RTO<15m | multi-account | no internet | lowest cost. Then strike out options that break any single constraint.
Translate keywords into patterns. My cheat sheet:
- "Enforce across all accounts, including admins" usually points to an SCP (and remember: SCPs do not apply to the management account).
- "New accounts must start with the right limits" points to Service Quotas request templates with Organizations.
- "Overlapping CIDR" or "acquired company" points to PrivateLink, a private NAT gateway, or a re-IP.
- "RPO in seconds, RTO in minutes, relational" points to Aurora Global Database in a warm standby setup.
- "RTO in hours, cheapest" points to backup and restore with IaC.
- "Minimal downtime database migration" points to DMS full load plus CDC.
- "Least operational overhead" points to managed or serverless options with fewer moving parts.
Budget the clock. 180 minutes / 75 questions is 2.4 minutes each. Aim to finish a first pass in about 120 minutes, flag anything that needs a second read, and keep the remaining time for flagged questions only.
Non-native English speaker? Request ESL +30. It adds 30 minutes and you request it once in your AWS Certification account, before you schedule. This is the single easiest win for many of us in Vietnam and across APJ.
Use the service short-name list. The exam uses short service names, and AWS publishes the list. Read it once so "DMS" or "MGN" never costs you a second.
Two answers look right? Pick the one with fewer custom parts. If option A uses Lambda + cron + custom scripts and option B uses a native feature, B wins in most cases unless a constraint rules it out.

7. Three deep-dive questions (original, written by me)

These are my own scenarios, modeled on the style of the exam, not taken from it. For each one, I explain why the distractors fail and give you something to run.

Deep dive 1: Region lockdown across an organization (Domain 1)

Scenario. A company runs 120 accounts in AWS Organizations with all features enabled. Compliance requires that workloads run only in ap-southeast-1 and ap-southeast-2. The security team must keep a break-glass role that can act in any Region. Global services such as IAM, Route 53, and CloudFront must keep working. The solution must have the LEAST operational overhead and must also apply to account administrators.

A. Attach an IAM policy that denies other Regions to every role in every account, using a StackSet.
B. Create an SCP with Effect: Deny, a NotAction list of global services, a StringNotEquals condition on aws:RequestedRegion, and an ArnNotLike exception for the break-glass role. Test it on a sandbox OU, then attach it to the workload OUs.
C. Replace FullAWSAccess with an SCP that allows only actions in the two Regions.
D. Deploy an AWS Config rule that detects resources in other Regions and deletes them with SSM Automation.

Answer: B.

Why the others fail.

A: an account admin can simply detach or edit the IAM policy. The requirement says the control must bind admins too. Per-role IAM also means drift across 120 accounts.
C: an allow-list SCP in this shape breaks global services whose endpoints live in us-east-1, and it gives you no clean break-glass exception.
D: detective and reactive, not preventive. Resources exist, possibly with data, before they get deleted.

The traps the exam likes to hide here.

SCPs never grant permissions. They set the maximum. Users still need IAM policies.
SCPs do not affect the management account, and do not affect service-linked roles. If a question says "including the management account", SCP alone is not the answer.
AWS recommends testing on a separate OU before attaching anything to the root.
If you use AWS Control Tower, use its Region deny control instead of a hand-written SCP.

Run it yourself (sandbox org only). This is a trimmed version of the official example from the Organizations docs. Extend NotAction with the global services your org really uses (check IAM last accessed data).

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{

  "Version": "2012-10-17",

  "Statement": [

    {

      "Sid": "DenyOutsideApprovedRegions",

      "Effect": "Deny",

      "NotAction": [

        "iam:*", "organizations:*", "sts:*", "route53:*", "cloudfront:*",

        "waf:*", "wafv2:*", "shield:*", "globalaccelerator:*",

        "budgets:*", "ce:*", "cur:*", "health:*", "support:*",

        "trustedadvisor:*", "kms:*", "acm:*", "s3:ListAllMyBuckets"

      ],

      "Resource": "*",

      "Condition": {

        "StringNotEquals": {

          "aws:RequestedRegion": ["ap-southeast-1", "ap-southeast-2"]

        },

        "ArnNotLike": {

          "aws:PrincipalARN": ["arn:aws:iam::*:role/BreakGlassAdmin"]

        }

      }

    }

  ]

}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# From the management account

aws organizations create-policy \

  --name RegionDenyApac \

  --type SERVICE_CONTROL_POLICY \

  --description "Allow only ap-southeast-1 and ap-southeast-2" \

  --content file://region-deny.json



aws organizations attach-policy \

  --policy-id p-xxxxxxxx \

  --target-id ou-xxxx-sandbox



# From a member account in that OU

aws ec2 describe-instances --region us-west-2      # expect AccessDenied (explicit deny in an SCP)

aws ec2 describe-instances --region ap-southeast-1 # expect success

aws iam list-roles                                 # expect success (global service exempted)

Deep dive 2: Aurora Global Database, failover vs switchover (Domain 2 / 3)

Scenario. A fintech runs Aurora PostgreSQL in ap-southeast-1. The business requires RPO measured in seconds and RTO measured in minutes for a Regional outage. A regulator also requires the company to run from the DR Region for one month every year, with zero data loss during that planned move. The team wants the least custom code.

A. RDS for PostgreSQL with a cross-Region read replica, promoted manually during an outage and for the annual drill.
B. Aurora Global Database with a secondary cluster in ap-southeast-2. Use failover for unplanned outages and switchover for the annual regulator drill. Point the app at the global writer endpoint.
C. AWS Backup with hourly cross-Region copies, restored by Lambda when needed.
D. AWS DMS with ongoing replication into a second Aurora cluster.

Answer: B.

Why it works. Aurora replicates at the storage layer to secondary Regions, typically with under one second of lag. AWS documents RPO for an unplanned global failover as typically seconds and non-zero, while a switchover first synchronizes the secondary with the primary, so RPO is 0. That maps one to one onto the two requirements. The global writer endpoint keeps pointing at whichever cluster is primary, so the application does not need a config change.

Why the others fail.

A: promoting a read replica breaks replication and needs manual rework to fail back. It does not give a clean zero data loss planned move.
C: hourly backups mean RPO up to one hour, and restore time pushes RTO well beyond minutes.
D: works, but it is more moving parts to run and monitor than a native feature. "Least custom code" rules it out.

Gotchas worth testing in a lab before exam day.

A headless secondary (no DB instance) is a cheap way to keep data replicated, but you must add an instance before you can fail over or switch over to it. Count that time in your RTO.
Managed switchover and failover need matching major and minor engine versions on both sides.
The DR whitepaper advises relying on data plane operations during failover, since control planes have lower availability goals. Practice the runbook, and prefer pre-provisioned capacity over "create it during the incident".

Run it yourself.

1
2
3
4
5
6
7
8
9
10
# Planned move (regulator drill): RPO = 0

aws rds switchover-global-cluster \

  --global-cluster-identifier fintech-global \

  --target-db-cluster-identifier arn:aws:rds:ap-southeast-2:111122223333:cluster:fintech-dr



# Unplanned Regional outage: accept data loss up to the replication lag

aws rds failover-global-cluster \

  --global-cluster-identifier fintech-global \

  --target-db-cluster-identifier arn:aws:rds:ap-southeast-2:111122223333:cluster:fintech-dr \

  --allow-data-loss

Deep dive 3: Overlapping CIDRs after an acquisition (Domain 1 / 4)

Scenario. Company A acquires Company B. Both use 10.0.0.0/16 in their main VPCs, in separate AWS accounts. Applications in Company B must call one internal REST API that runs on EC2 behind an internal load balancer in Company A. Traffic is one direction only (B calls A). The solution must be delivered quickly, with the least change to either network.

A. Create a VPC peering connection and add more specific routes to avoid conflicts.
B. Attach both VPCs to a shared Transit Gateway and use separate route tables.
C. Put a Network Load Balancer in front of the API, create a VPC endpoint service in Account A, and create an interface VPC endpoint in Company B's VPC. Allow-list Account B as a principal.
D. Re-IP Company B's VPC to 10.1.0.0/16, then use VPC peering.

Answer: C.

Why it works. PrivateLink exposes a service, not a network. Company B gets an ENI with an address from its own subnet, so the overlapping ranges never meet in a route table.

Why the others fail.

A: VPC peering cannot be created between VPCs with overlapping CIDR blocks. No route trick fixes that.
B: when a VPC with an identical or overlapping CIDR attaches to a Transit Gateway, its routes are not propagated to the TGW route table. You end up needing NAT anyway.
D: the correct long-term fix in many mergers, but it is neither quick nor least change.

When C is NOT the right answer (watch for these words).

"Bidirectional", "many services", "full network integration": look at private NAT gateways in front of the overlapping range with a Transit Gateway, or plan a re-IP.
"UDP" or non-TCP protocols: check what the endpoint service and load balancer support before choosing PrivateLink.

Run it yourself.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# Account A (service provider)

aws ec2 create-vpc-endpoint-service-configuration \

  --network-load-balancer-arns arn:aws:elasticloadbalancing:ap-southeast-1:111122223333:loadbalancer/net/api-nlb/abc123 \

  --acceptance-required



aws ec2 modify-vpc-endpoint-service-permissions \

  --service-id vpce-svc-0123456789abcdef0 \

  --add-allowed-principals arn:aws:iam::444455556666:root



# Account B (consumer)

aws ec2 create-vpc-endpoint \

  --vpc-id vpc-0bbbbbbbbbbbbbbbb \

  --vpc-endpoint-type Interface \

  --service-name com.amazonaws.vpce.ap-southeast-1.vpce-svc-0123456789abcdef0 \

  --subnet-ids subnet-0aaa subnet-0bbb \

  --security-group-ids sg-0ccc



# Account A: accept the connection request

aws ec2 accept-vpc-endpoint-connections \

  --service-id vpce-svc-0123456789abcdef0 \

  --vpc-endpoint-ids vpce-0ddddddddddddddd

8. Wrap-up

If I had to compress everything into one line: read for constraints, eliminate by constraints, then prove it in a lab. SAP-C02 rewards people who have broken something in a sandbox and know why it broke.

If you are deciding between C02 and C03, or you want a deep dive on a specific domain, tell me in the comments. The most requested topic becomes my next post.

Good luck, and see you on the other side of 750.

References

AWS Certified Solutions Architect - Professional, exam page and update notice: https://aws.amazon.com/certification/certified-solutions-architect-professional/
SAP-C02 exam guide: https://docs.aws.amazon.com/aws-certification/latest/solutions-architect-professional-02/solutions-architect-professional-02.html
Service control policies (SCPs): https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
SCP examples, Region deny: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html
Aurora Global Database, switchover and failover: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-disaster-recovery.html
Disaster Recovery of Workloads on AWS whitepaper: https://docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/disaster-recovery-options-in-the-cloud.html
How VPC peering works: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html
Transit Gateway VPC attachments: https://docs.aws.amazon.com/vpc/latest/tgw/tgw-vpc-attachments.html
What is AWS PrivateLink: https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html
Service Quotas request templates: https://docs.aws.amazon.com/servicequotas/latest/userguide/organization-templates.html
Protecting AWS Certification value (brain dumps): https://aws.amazon.com/blogs/training-and-certification/protecting-aws-certification-value-through-security-measures/

Tags: #aws #certification #sap-c02 #solutions-architect #community-builders

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.

Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article

Builder Center

Passing SAP-C02 Before It Retires: Study Resources, Exam Tactics, and 3 Deep-Dive Questions

Nghi Danh

1. Why this post, and why now

2. About me (so you can calibrate my advice)

3. The exam at a glance (from the official exam guide)

4. Study resources: what I used and what each one is for

The two resources I actually relied on

Official AWS material I used alongside them

What I would skip

5. My study plan (about 5 weeks, 20 to 30 hours per week)

6. Exam tactics that actually moved my score

7. Three deep-dive questions (original, written by me)

Deep dive 1: Region lockdown across an organization (Domain 1)

Deep dive 2: Aurora Global Database, failover vs switchover (Domain 2 / 3)

Deep dive 3: Overlapping CIDRs after an acquisition (Domain 1 / 4)

8. Wrap-up

References