2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

AWS SAP-C02 Exam Practice Questions, practice question pack
AWS · SAP-C02

AWS SAP-C02 Exam Practice Questions

99% pass rateUpdated 1 Nov 2026529 questions2 PDFs, instant download
4.913 reviews
(13 customer reviews)

US$39

Every question with the correct answer and why the other options are wrong.

Download the free sample

Card, Apple Pay, Google Pay or PayPal. Download links are on your order page and in your email the moment you pay.

99% pass rate. Pass or your money back.Fail the exam after using this pack and we refund it, or swap it for any other pack. How the guarantee works
I am very happy as I just got my SAP-C02 exam result today and I passed with a great score. All the credit goes to this Cert Stash site as it has 100% real questions
Kelly BrookSAP-C02
Category:
TRY BEFORE YOU BUY

Three of the 529 questions in this pack

Question 1

A company needs to architect a hybrid DNS solution. This solution will use an Amazon Route 53 private hosted zone for the domain cloud.example.com for the resources stored within VPCs. The company has the following DNS resolution requirements: On-premises systems should be able to resolve and connect to cloud.example.com. All VPCs should be able to resolve cloud.example.com. There is already an AWS Direct Connect connection between the on-premises corporate network and AWS Transit Gateway. Which architecture should the company use to meet these requirements with the HIGHEST performance?

  1. Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.
  2. Associate the private hosted zone to all the VPCs. Deploy an Amazon EC2 conditional forwarder in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the conditional forwarder.
  3. Associate the private hosted zone to the shared services VPC. Create a Route 53 outbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the outbound resolver.
  4. Associate the private hosted zone to the shared services VPC. Create a Route 53 inbound resolver in the shared services VPC. Attach the shared services VPC to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.
Show answer and explanation

Correct answer: A. Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.

Option A correctly addresses all requirements with highest performance: it associates the private hosted zone to ALL VPCs (enabling all VPCs to resolve cloud.example.com), creates a Route 53 inbound resolver in the shared services VPC (enabling on-premises systems to resolve via the existing Direct Connect), and uses the transit gateway for connectivity. The inbound resolver specifically handles DNS queries coming from on-premises over the Direct Connect connection. Option D fails because it only associates the private hosted zone to the shared services VPC, preventing other VPCs from directly resolving the domain.

Why the other options are wrong

  • B. EC2 conditional forwarders are not managed AWS services and require manual maintenance, reducing performance and reliability compared to Route 53 resolvers.
  • C. Outbound resolvers are for resolving external/on-premises domains from AWS, not for receiving queries from on-premises systems.
  • D. Associating the private hosted zone only to the shared services VPC prevents other VPCs from resolving cloud.example.com directly.

Question 2

A company is providing weather data over a REST-based API to several customers. The API is hosted by Amazon API Gateway and is integrated with different AWS Lambda functions for each API operation. The company uses Amazon Route 53 for DNS and has created a resource record of weather.example.com. The company stores data for the API in Amazon DynamoDB tables. The company needs a solution that will give the API the ability to fail over to a different AWS Region. Which solution will meet these requirements?

  1. Deploy a new set of Lambda functions in a new Region. Update the API Gateway API to use an edge-optimized API endpoint with Lambda functions from both Regions as targets. Convert the DynamoDB tables to global tables.
  2. Deploy a new API Gateway API and Lambda functions in another Region. Change the Route 53 DNS record to a multivalue answer. Add both API Gateway APIs to the answer. Enable target health monitoring. Convert the DynamoDB tables to global tables.
  3. Deploy a new API Gateway API and Lambda functions in another Region. Change the Route 53 DNS record to a failover record. Enable target health monitoring. Convert the DynamoDB tables to global tables.
  4. Deploy a new API Gateway API in a new Region. Change the Lambda functions to global functions. Change the Route 53 DNS record to a multivalue answer. Add both API Gateway APIs to the answer. Enable target health monitoring. Convert the DynamoDB tables to global tables.
Show answer and explanation

Correct answer: C. Deploy a new API Gateway API and Lambda functions in another Region. Change the Route 53 DNS record to a failover record. Enable target health monitoring. Convert the DynamoDB tables to global tables.

Option C correctly implements a failover solution by deploying a new API Gateway and Lambda functions in another Region, converting DynamoDB tables to global tables for data replication, and using a Route 53 failover routing policy with health monitoring. The failover policy automatically routes traffic to the secondary Region when the primary Region's health check fails, providing the desired failover capability with minimal RTO. Global DynamoDB tables enable data consistency across regions.

Why the other options are wrong

  • A. Edge-optimized endpoints with multiple region targets do not provide automatic failover; they perform routing based on geography, not health. This requires manual intervention during outages.
  • B. Multivalue answer routing returns multiple healthy records but does not provide automatic failover; clients must retry independently. It's not designed for active-passive failover scenarios.
  • D. Lambda functions cannot be made global; they must be deployed in specific regions. The approach is otherwise similar to B, which lacks true automatic failover semantics.

Question 3

A company uses AWS Organizations with a single OU named Production to manage multiple accounts. All accounts are members of the Production OU. Administrators use deny list SCPs in the root of the organization to manage access to restricted services. The company recently acquired a new business unit and invited the new unit’s existing AWS account to the organization. Once onboarded, the administrators of the new business unit discovered that they are not able to update existing AWS Config rules to meet the company’s policies. Which option will allow administrators to make changes and continue to enforce the current policies without introducing additional long-term maintenance?

  1. Remove the organization’s root SCPs that limit access to AWS Config. Create AWS Service Catalog products for the company’s standard AWS Config rules and deploy them throughout the organization, including the new account.
  2. Create a temporary OU named Onboarding for the new account. Apply an SCP to the Onboarding OU to allow AWS Config actions. Move the new account to the Production OU when adjustments to AWS Config are complete.
  3. Convert the organization’s root SCPs from deny list SCPs to allow list SCPs to allow the required services only. Temporarily apply an SCP to the organization’s root that allows AWS Config actions for principals only in the new account.
  4. Create a temporary OU named Onboarding for the new account. Apply an SCP to the Onboarding OU to allow AWS Config actions. Move the organization’s root SCP to the Production OU. Move the new account to the Production OU when adjustments to AWS Config are complete.
Show answer and explanation

Correct answer: D. Create a temporary OU named Onboarding for the new account. Apply an SCP to the Onboarding OU to allow AWS Config actions. Move the organization’s root SCP to the Production OU. Move the new account to the Production OU when adjustments to AWS Config are complete.

SCP evaluation means a deny at the organization root applies to every account below it, and an allow SCP on a child OU cannot override it. Moving the root deny SCP down to the Production OU keeps the policy enforced for all existing accounts while the new account in the Onboarding OU can update its AWS Config rules. Once the changes are done, moving the account into Production applies the same policy with nothing extra to maintain.

Why the other options are wrong

  • A. Removing the root SCPs and relying on Service Catalog weakens enforcement and adds ongoing product maintenance.
  • B. The deny SCP at the root still applies to the Onboarding OU, so an allow SCP there cannot unblock AWS Config actions.
  • C. Converting to allow list SCPs requires listing every permitted service and adds long-term maintenance.

See all 132 free questions Get the full pack, US$39

REVIEWS

13 reviews for AWS SAP-C02 Exam Practice Questions

  1. Kelly Brook –

    I am very happy as I just got my SAP-C02 exam result today and I passed with a great score. All the credit goes to this Cert Stash site as it has 100% real questions

  2. tess –

    Worth every cent. Passed!

  3. Mona –

    Passed :)

    This dump is legit. Passed my exam doing most of my study on my phone! Went through the dump during commutes.

  4. Aaron cole –

    Luckily I discovered Cert Stash ten days before the exam and I managed to pass it with 943/1000. 90% of the questions were in the exam. It’s worth it.

  5. José Mehta –

    Finally passed

    Passed my SAP-C02! This is a brutal exam and I failed it once before. Added this dump to my prep the second time and it made a real difference. Some questions were almost word for word. Worth every cent.

  6. Levi Perry –

    The AWS SAP-C02 file balanced detail and brevity perfectly. It never felt overwhelming, yet covered every necessary topic. Cert Stash ensured that the content stayed complete but concise.

  7. Espinoza –

    Exam cleared! Recommend this to anyone.

  8. E Harris –

    SAP-C02 passed

    A lot of what I studied in this dump came up in the actual exam. Tough but having real questions beforehand made a huge difference.

  9. Courtney –

    Certstash is the best website that provides the best exam guides. The dumps they provide include information that is most recent and explained in detail. They are in PDF format which anyone from anywhere can access. The information in these dumps helps solve your queries. It is safe to say that this website provides the most authentic dumps at a budget-friendly cost.

  10. Kris –

    The dumps I purchased from this website were of SAP-C02 and I can say that this website sells the most authentic dumps with the latest information. The format of these dumps is pdf which can be accessed anywhere. I purchased these dumps at very low rates. They even have a refund policy which normally not every website has.

  11. Timothy Bailes –

    Solving 75 questions at one time is not an easy task especially when you don’t have any idea how to solve multiple response questions. But this became possible when I got connected with the Certstash website. I made my timetable to solve their recommended dumps for SAP exams. So after having a meal, I took my laptop and went to my favorite corner to solve the series. In just two to three months, I not only completed my preparation but also ended up getting an ace in the exam.

  12. Martha Gibbs –

    As someone who learns best by doing, Certstash’s AWS SAP dumps were the perfect fit for my learning style. The realistic questions felt just like the real exam, and the fact that they were also updated helped me focus more on my studies without having to worry too much about losing precious marks due to preparation from outdated materials. Plus, it wasn’t just testing your memory but if you were able to apply knowledge in different exam question settings. Really appreciate these dumps and how they’ve boosted my prep!

  13. Marion Yoshida –

    The best thing about this website is that they provide free demos for their customers which normally not every website does. The answers inside the dumps are explained in detail and help with solving your queries. It also gives you an idea of how to solve the exam and at what crucial level the questions would be asked in exams.

Only logged in customers who have purchased this product may leave a review.

How much of the AWS SAP-C02 bank is free?

529 questions in the bank

Each step includes the one before, so buying only adds new questions.

  • You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
  • 13225% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
  • 264the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
  • 529100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
ABOUT THIS PACK

What’s in the AWS SAP-C02 pack

  • 529 questions across all four SAP-C02 domains
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Instant delivery by email the moment you check out
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

A failed SAP-C02 attempt costs the full US$300 again, with no retake discount. This pack is US$39, paid once, and refunded if you fail.

What makes the SAP-C02 hard

The SAP-C02 is AWS's hardest architecture exam. It does not test what you use day to day: it tests your ability to architect across more than a dozen service categories at once (compute, storage, networking, databases, security, migration, analytics and application integration) inside the same question. Years of AWS experience is not a guarantee of a pass; what matters is whether you have seen how the exam structures its scenarios.

AWS is updating this exam: registration for SAP-C03 opens 27 October 2026, and the last day to take SAP-C02 is 17 November 2026. This pack has 529 practice questions for the SAP-C02, so the scenario format is familiar well before test day.

About the exam

The SAP-C02 is AWS's most advanced architecture certification. It validates the ability to design complex, optimised and scalable solutions across the full AWS service catalogue, covering organisational complexity, multi-account environments, migration and modernisation, and continuous improvement of existing architectures. AWS recommends two or more years of hands-on experience; most candidates hold the Solutions Architect Associate first.

Read the AWS SAP-C02 study guide

Questions before you buy

How quickly do I receive it?

Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

What is your pass rate?

99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products