AWS Solutions Architect Professional (SAP-C02) Certification Guide

The AWS Solutions Architect Professional certification is the pinnacle of AWS architecture certifications. It validates your ability to design complex, enterprise-grade solutions on AWS.

Prerequisites

• AWS Solutions Architect Associate certification
• 2+ years of hands-on experience with AWS
• Experience designing and deploying cloud architecture

Exam Overview

Aspect	Details
Exam Code	SAP-C02
Duration	180 minutes
Questions	75 questions
Passing Score	750/1000
Format	Multiple choice, multiple response
Cost	$300 USD

Exam Domains

Domain 1: Design Solutions for Organizational Complexity (26%)

• Cross-account architectures
• Multi-region deployments
• Organizational governance

Domain 2: Design for New Solutions (29%)

• Business requirements translation
• Architecture design for performance
• Cost-optimized architectures

Domain 3: Continuous Improvement for Existing Solutions (25%)

• Optimize existing architectures
• Migration strategies
• Modernization approaches

Domain 4: Accelerate Workload Migration and Modernization (20%)

• Migration planning
• Application modernization
• Data migration strategies

Advanced Architecture Patterns

Multi-Account Strategy

AWS Organization
├── Management Account
│   └── AWS Organizations, SSO, CloudTrail
│
├── Security OU
│   ├── Log Archive Account
│   │   └── Centralized logs (CloudTrail, VPC Flow)
│   └── Security Tooling Account
│       └── GuardDuty, Security Hub, Config
│
├── Infrastructure OU
│   ├── Network Account
│   │   └── Transit Gateway, Direct Connect
│   └── Shared Services Account
│       └── Active Directory, DNS
│
├── Workloads OU
│   ├── Production OU
│   │   ├── Prod Account 1
│   │   └── Prod Account 2
│   └── Non-Production OU
│       ├── Dev Account
│       └── Test Account
│
└── Sandbox OU
    └── Developer Sandbox Accounts

Global Architecture with Route 53

                    ┌─────────────────┐
                    │    Route 53     │
                    │ Latency Routing │
                    └────────┬────────┘
                             │
        ┌────────────────────┼────────────────────┐
        │                    │                    │
        ▼                    ▼                    ▼
┌───────────────┐  ┌───────────────┐  ┌───────────────┐
│  us-east-1    │  │  eu-west-1    │  │ ap-southeast-1│
│               │  │               │  │               │
│ ┌───────────┐ │  │ ┌───────────┐ │  │ ┌───────────┐ │
│ │CloudFront │ │  │ │CloudFront │ │  │ │CloudFront │ │
│ └─────┬─────┘ │  │ └─────┬─────┘ │  │ └─────┬─────┘ │
│       │       │  │       │       │  │       │       │
│ ┌─────▼─────┐ │  │ ┌─────▼─────┐ │  │ ┌─────▼─────┐ │
│ │    ALB    │ │  │ │    ALB    │ │  │ │    ALB    │ │
│ └─────┬─────┘ │  │ └─────┬─────┘ │  │ └─────┬─────┘ │
│       │       │  │       │       │  │       │       │
│ ┌─────▼─────┐ │  │ ┌─────▼─────┐ │  │ ┌─────▼─────┐ │
│ │   EKS     │ │  │ │   EKS     │ │  │ │   EKS     │ │
│ └─────┬─────┘ │  │ └─────┬─────┘ │  │ └─────┬─────┘ │
│       │       │  │       │       │  │       │       │
│ ┌─────▼─────┐ │  │ ┌─────▼─────┐ │  │ ┌─────▼─────┐ │
│ │  Aurora   │◄┼──┼─┤  Aurora   │◄┼──┼─┤  Aurora   │ │
│ │  Global   │ │  │ │  Replica  │ │  │ │  Replica  │ │
│ └───────────┘ │  │ └───────────┘ │  │ └───────────┘ │
└───────────────┘  └───────────────┘  └───────────────┘

Hybrid Connectivity

# Transit Gateway Configuration
Resources:
  TransitGateway:
    Type: AWS::EC2::TransitGateway
    Properties:
      AutoAcceptSharedAttachments: enable
      DefaultRouteTableAssociation: enable
      DefaultRouteTablePropagation: enable
      DnsSupport: enable
      VpnEcmpSupport: enable
      Tags:
        - Key: Name
          Value: enterprise-tgw

  # VPN to on-premises
  CustomerGateway:
    Type: AWS::EC2::CustomerGateway
    Properties:
      BgpAsn: 65000
      IpAddress: 203.0.113.1  # On-prem router IP
      Type: ipsec.1

  VPNConnection:
    Type: AWS::EC2::VPNConnection
    Properties:
      CustomerGatewayId: !Ref CustomerGateway
      TransitGatewayId: !Ref TransitGateway
      Type: ipsec.1
      Options:
        EnableAcceleration: true
        TunnelOptions:
          - TunnelInsideCidr: 169.254.10.0/30
          - TunnelInsideCidr: 169.254.11.0/30

Migration Strategies (7 Rs)

Strategy	Description	Use Case
Rehost	Lift and shift	Quick migration
Replatform	Lift, tinker, shift	Minor optimizations
Repurchase	Move to SaaS	Replace with cloud service
Refactor	Re-architect	Cloud-native transformation
Retire	Decommission	Remove unused apps
Retain	Keep on-premises	Not ready to migrate
Relocate	VMware Cloud on AWS	VM-level migration

Migration Wave Planning

Wave 1: Foundation (Weeks 1-4)
├── Landing Zone setup
├── Network connectivity
├── Security baseline
└── Monitoring setup

Wave 2: Non-Critical Apps (Weeks 5-8)
├── Development environments
├── Test systems
└── Internal tools

Wave 3: Business Apps (Weeks 9-16)
├── Customer-facing apps
├── Business applications
└── Data migration

Wave 4: Core Systems (Weeks 17-24)
├── Mission-critical systems
├── Database migrations
└── Final cutover

Cost Optimization Strategies

Reserved Instances Planning

# Cost optimization analysis
def analyze_ri_opportunity(usage_data):
    """
    Analyze EC2 usage for RI recommendations
    """
    recommendations = []

    for instance_type, hours in usage_data.items():
        monthly_hours = hours / 12

        # If running more than 50% of time, consider RI
        if monthly_hours > 360:  # 720 hours * 50%
            on_demand_cost = monthly_hours * ON_DEMAND_RATES[instance_type]
            ri_cost = RI_RATES[instance_type] * 720

            savings = on_demand_cost - ri_cost
            savings_percent = (savings / on_demand_cost) * 100

            if savings_percent > 20:
                recommendations.append({
                    'instance_type': instance_type,
                    'current_cost': on_demand_cost,
                    'ri_cost': ri_cost,
                    'monthly_savings': savings,
                    'savings_percent': savings_percent
                })

    return sorted(recommendations,
                  key=lambda x: x['monthly_savings'],
                  reverse=True)

Disaster Recovery

DR Strategies Comparison

Strategy	RTO	RPO	Cost
Backup & Restore	Hours	Hours	$
Pilot Light	10s of minutes	Minutes	$$
Warm Standby	Minutes	Seconds	$$$
Multi-Site Active/Active	Real-time	Near-zero	$$$$

Pilot Light Implementation

# DR Region Resources (minimal footprint)
Resources:
  # Database replica (always running)
  DRDatabase:
    Type: AWS::RDS::DBInstance
    Properties:
      SourceDBInstanceIdentifier: !Sub arn:aws:rds:us-east-1:${AWS::AccountId}:db:primary
      DBInstanceClass: db.t3.medium  # Smaller instance

  # AMIs ready to launch
  DRLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        ImageId: !Ref LatestAMI
        InstanceType: t3.large

  # Auto Scaling Group (zero capacity until DR)
  DRAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: 0
      MaxSize: 10
      DesiredCapacity: 0
      LaunchTemplate:
        LaunchTemplateId: !Ref DRLaunchTemplate

Practice with ExamCert

Ready for the most challenging AWS certification? ExamCert offers 900+ practice questions for the SAP-C02 exam covering enterprise architecture, migrations, and complex multi-account scenarios.

👉 Practice AWS Solutions Architect Professional at ExamCert

Conclusion

The AWS Solutions Architect Professional certification validates your expertise in designing complex, enterprise-grade AWS solutions. Focus on understanding architectural trade-offs and practice with real-world scenarios to succeed.