Home
Amazon
SAP-C02: AWS Certified Solutions Architect - Professional Exam

Amazon SAP-C02 Exam Questions

Name: Amazon SAP-C02 Exam
Brand: Pass4Success
SKU: SAP-C02
Price: 69.00 USD
Availability: InStock
Rating: 5.0 (188 reviews)

Exam Name: Amazon AWS Certified Solutions Architect - Professional Exam

Exam Code: SAP-C02

Related Certification(s):

Amazon Professional Certifications
Amazon AWS Certified Solutions Architect Professional Certifications

Certification Provider: Amazon

Actual Exam Duration: 180 Minutes

Number of SAP-C02 practice questions in our database: 691 (updated: Oct. 08, 2026)

Disscuss Amazon SAP-C02 Topics, Questions or Ask Anything Related

0/2000 characters

Submit Cancel

Thomas Taylor

12 days ago

I passed the AWS Solutions Architect Professional exam by drilling scenario questions and then writing a short justification for why each wrong answer was wrong. The migration and modernization items were trickier than expected, especially when hybrid connectivity and cutover timing were part of the constraints.

upvoted 0 times

...

Daniel Hill

23 days ago

Design for New Solutions questions often give a fresh business requirement and expect you to pick the best architecture, so watch for subtle constraints like RPO, RTO, latency, and regulatory boundaries that invalidate obvious answers. Study Well-Architected pillars and map requirements to service capabilities, and practice diagrams that justify why you chose serverless, containers, or managed databases.

upvoted 0 times

...

Amit Iyer

1 month ago

SAP C02 felt less about memorizing services and more about tradeoffs across accounts, networking, and governance, so I spent time mapping decisions to the Well Architected pillars and still managed to pass. The hardest part was picking the least bad option when multiple designs seemed workable.

upvoted 0 times

...

Charles King

2 months ago

I found questions under Design Solutions for Organizational Complexity often present long scenarios where you must balance account boundaries, delegated admin, and service control policies, and the tricky part is spotting the organizational constraint that rules out several answers. Focus on AWS Organizations, SCPs, cross-account IAM roles, and account VPC isolation patterns so you can justify trade-offs. I passed the exam and thanks Pass4Success for providing good collection of exam questions for preparation in short time.

upvoted 0 times

...

Free Amazon SAP-C02 Exam Actual Questions

Note: Premium Questions for SAP-C02 were last updated On Oct. 08, 2026 (see below)

Question #1

A company runs applications in multiple AWS accounts in a single AWS Region. The accounts are members of an organization in AWS Organizations. The company is implementing security controls to manage cross-account access patterns in the company's AWS environment. The company wants to identify resources that might be unintentionally shared with external entities. The company wants to implement continuous monitoring for resource-based policies to detect external access. The company needs a solution that enforces multi-factor authentication (MFA) to assume cross-account IAM roles.

Which solution will meet these requirements?

AConfigure AWS IAM Access Analyzer to use the organization as the zone of trust. Configure an Amazon EventBridge rule to send a notification when IAM Access Analyzer generates new findings. Add the aws:MultiFactorAuthPresent condition key to the trust policies of employee IAM roles.

BConfigure AWS Config rules to monitor resource-based policies. Use IAM permissions boundaries to limit cross-account access. Add the aws:TokenIssueTime condition key to cross-account IAM roles.

CEnable AWS IAM Access Analyzer. Implement ExternalId in cross-account IAM roles. Create a resource-based policy that uses a wildcard principal to limit access based on the source IP.

DCreate an AWS Security Hub integration with AWS IAM Access Analyzer. Implement federated identity management for all cross-account IAM role access. Enforce MFA by using a third-party identity provider (IdP).

Reveal Solution Hide Solution

Correct Answer: A

Question #2

A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.

The company needs to query and analyze the data. The company does not access data that is more than 1-year-old. However, the company must retain all the data indefinitely for compliance reasons.

Which solution will meet these requirements MOST cost-effectively?

AUse S3 Select to query the data. Create an S3 Lifecycle policy to transition data that is more than 1 year old to S3 Glacier Deep Archive.

BUse Amazon Redshift Spectrum to query the data. Create an S3 Lifecycle policy to transition data that is more than 1 year old to S3 Glacier Deep Archive.

CUse an AWS Glue Data Catalog and Amazon Athena to query the data. Create an S3 Lifecycle policy to transition data that is more than 1 year old to S3 Glacier Deep Archive.

DUse Amazon Redshift Spectrum to query the data. Create an S3 Lifecycle policy to transition data that is more than 1 year old to S3 Intelligent-Tiering.

Reveal Solution Hide Solution

Correct Answer: C

Generally, unstructured data should be converted structured data before querying them. AWS Glue can do that. https://docs.aws.amazon.com/glue/latest/dg/schema-relationalize.html https://docs.aws.amazon.com/athena/latest/ug/glue-athena.html

Question #3

A company has used infrastructure as code (IaC) to provision a set of two Amazon EC2 instances. The instances have remained the same for several years.

The company's business has grown rapidly in the past few months. In response the company's operations team has implemented an Auto Scaling group to manage the sudden increases in traffic. Company policy requires a monthly installation of security updates on all operating systems that are running.

The most recent security update required a reboot. As a result, the Auto Scaling group terminated the instances and replaced them with new, unpatched instances.

Which combination of steps should a solutions architect recommend to avoid a recurrence of this issue? (Choose two.)

AModify the Auto Scaling group by setting the Update policy to target the oldest launch configuration for replacement.

BCreate a new Auto Scaling group before the next patch maintenance. During the maintenance window, patch both groups and reboot the instances.

CCreate an Elastic Load Balancer in front of the Auto Scaling group. Configure monitoring to ensure that target group health checks return healthy after the Auto Scaling group replaces the terminated instances.

DCreate automation scripts to patch an AMI, update the launch configuration, and invoke an Auto Scaling instance refresh.

ECreate an Elastic Load Balancer in front of the Auto Scaling group. Configure termination protection on the instances.

Reveal Solution Hide Solution

Correct Answer: C, D

Question #4

A company uses a load balancer to distribute traffic to Amazon EC2 instances in a single Availability Zone. The company is concerned about security and wants a solutions architect to re-architect the solution to meet the following requirements:

*Inbound requests must be filtered for common vulnerability attacks.

*Rejected requests must be sent to a third-party auditing application.

*All resources should be highly available.

Which solution meets these requirements?

AConfigure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Use Amazon Inspector to monitor traffic to the ALB and EC2 instances. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB. Use an AWS Lambda function to frequently push the Amazon Inspector report to the third-party auditing application.

BConfigure an Application Load Balancer (ALB) and add the EC2 instances as targets Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB name and enable logging with Amazon CloudWatch Logs. Use an AWS Lambda function to frequently push the logs to the third-party auditing application.

CConfigure an Application Load Balancer (ALB) along with a target group adding the EC2 instances as targets. Create an Amazon Kinesis Data Firehose with the destination of the third-party auditing application. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber.

DConfigure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Create an Amazon Kinesis Data Firehose with a destination of the third-party auditing application. Create a web ACL in WAF. Create an AWS WAF using the WebACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber.

Reveal Solution Hide Solution

Correct Answer: D

https://docs.aws.amazon.com/waf/latest/developerguide/marketplace-managed-rule-groups.html

Question #5

A company has Linux-based Amazon EC2 instances. Users must access the instances by using SSH with EC2 SSH Key pairs. Each machine requires a unique EC2 Key pair.

The company wants to implement a key rotation policy that will, upon request, automatically rotate all the EC2 key pairs and keep the key in a securely encrypted place. The company will accept less than 1 minute of downtime during key rotation.

Which solution will meet these requirement?

AStore all the keys in AWS Secrets Manager. Define a Secrets Manager rotation schedule to invoke an AWS Lambda function to generate new key pairs. Replace public Keys on EC2 instances. Update the private keys in Secrets Manager.

BStore all the keys in Parameter. Store, a capability of AWS Systems Manager, as a string. Define a Systems Manager maintenance window to invoke an AWS Lambda function to generate new key pairs. Replace public keys on EC2 instance. Update the private keys in parameter.

CImport the EC2 key pairs into AWS Key Management Service (AWS KMS). Configure automatic key rotation for these key pairs. Create an Amazon EventlBridge scheduled rule to invoke an AWS Lambda function to initiate the key rotation AWS KMS.

DAdd all the EC2 instances to Feet Manager, a capability of AWS Systems Manager. Define a Systems Manager maintenance window to issue a Systems Manager Run Command document to generate new Key pairs and to rotate public keys to all the instances in Feet Manager.

Reveal Solution Hide Solution

Correct Answer: A

To meet the requirements for automatic key rotation of EC2 SSH key pairs with minimal downtime, storing the keys in AWS Secrets Manager and defining a rotation schedule is the most suitable solution. AWS Secrets Manager supports automatic rotation of secrets, including SSH keys, by invoking a Lambda function that can handle the creation of new key pairs and the replacement of public keys on EC2 instances. Updating the corresponding private keys in Secrets Manager ensures secure and centralized management of SSH keys, complying with the key rotation policy and minimizing operational overhead.

AWS Secrets Manager Documentation: Describes how to store and rotate secrets, including SSH keys, using Secrets Manager and Lambda functions.

AWS Lambda Documentation: Provides information on creating Lambda functions for custom secret rotation logic.

AWS Best Practices for Security: Highlights the importance of key rotation and how AWS services like Secrets Manager can facilitate secure and automated key management.

Explore Other Amazon Exams

Unlock Premium SAP-C02 Exam Questions with Advanced Practice Test Features:

Select Question Types you want
Set your Desired Pass Percentage
Allocate Time (Hours : Minutes)
Create Multiple Practice tests with Limited Questions
Customer Support

Get Full Access Now

Unlock all SAP-C02 features

Just for $59 you get

Select Question Types you want
Set your Desired Pass Percentage
Allocate Time (Hours : Minutes)
Create Multiple Practice tests with Limited Questions
Customer Support

Get Full Access Now

Login First To Buy This Product

Password

Questions and Answers Demo

Web-Based Practice Test Demo

Start Demo