Amazon SAP-C02 AWS Certified Solutions Architect – Professional (SAP-C02) Free Practice Test — 30 Questions
This practice bank exercises the ability to design cost-optimized, secure, and highly available AWS architectures using a mix of compute, storage, networking, and serverless services. You will analyze cost savings from Reserved and Spot Instances, evaluate compliance requirements like GDPR and PCI DSS, design multi-tier VPCs with proper subnetting, and implement event-driven patterns with Lambda and Step Functions. The questions also test understanding of DynamoDB capacity planning, API Gateway throttling, Kubernetes autoscaling, and hybrid connectivity with Direct Connect and VPN. Master these scenarios to build robust, exam-relevant decision-making skills.
What this SAP-C02 practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Cost Optimization and Pricing Models
Multiple questions assess the ability to calculate total cost of ownership and savings when combining On-Demand, Reserved, and Spot Instances. You must compute hourly and annual costs for EC2 instances, understand discount percentages, and apply them to mixed workloads. Additionally, questions cover storage class transitions in S3 (Standard, IA, Glacier) and serverless cost estimation for Lambda based on memory, duration, and invocation rate. These exercises reinforce the importance of matching resource procurement to usage patterns while minimizing waste.
- Compute annual savings when switching from On-Demand to 1-year RIs with a 30% discount.
- Blend RIs (70% of instances at 40% discount) with Spot Instances (60% cheaper) to find blended hourly cost.
- Estimate Lambda cost for 10,000 req/s with 512 MB memory and 200 ms execution.
- Calculate total storage cost for 10 TB transitioning from Standard (1 month) to IA (6 months) to Glacier (5 months).
Security, Compliance, and Encryption
Several questions focus on meeting regulatory standards like GDPR and PCI DSS. They require selecting the right AWS services for encryption at rest and in transit, such as AWS KMS for key management and ACM for SSL/TLS certificates. Database encryption, secure key storage, and proper use of TLS are emphasized. Multi-account governance with Service Control Policies (SCPs) is also covered to enforce compliance across departments while maintaining operational independence.
- Use AWS KMS for encryption at rest and ACM for SSL/TLS to meet GDPR requirements.
- For PCI DSS, combine KMS-managed keys with server-side encryption in S3 and TLS for data in transit.
- Implement SCPs at the OU level to restrict services per department while enabling independent operation.
- Avoid storing encryption keys in local databases or using unencrypted HTTP.
High Availability and Scalability Patterns
Architecture design for high availability and fault tolerance is heavily tested. This includes multi-AZ deployments for RDS, Auto Scaling groups with Application Load Balancers, and blue-green deployment strategies for zero-downtime migrations. Containerized workloads on EKS leverage Cluster Autoscaler and multi-AZ node groups. Event-driven architectures use Event Sourcing for eventual consistency and Step Functions for error handling and state management. Scaling strategies combine scheduled and dynamic scaling to handle variable traffic.
- Deploy ELB across multiple AZs with RDS Multi-AZ to ensure fault tolerance and low latency.
- Use blue-green deployment to migrate with minimal downtime and full rollback capability.
- Configure EKS with multi-AZ ASG and Cluster Autoscaler to automatically scale nodes based on pod resource requests.
- Adopt Event Sourcing to enable asynchronous communication and eventual consistency in microservices.
Networking and Hybrid Connectivity
VPC design, subnet placement, and security groups are tested to ensure tiers are properly isolated. Multi-region and multi-VPC connectivity via Transit Gateway is covered, along with CIDR planning to avoid overlap. Hybrid architectures use Direct Connect for dedicated low-latency links with VPN as backup. Bandwidth limitations and encryption overhead of VPN are important considerations. API Gateway throttling with rate and burst limits is applied to protect backends.
- Place web tier in public subnet, app and database tiers in private subnets with security group rules.
- Use a single Transit Gateway to connect multiple VPCs and on-premises networks without overlapping CIDRs.
- Implement Direct Connect for high throughput with a VPN backup for resilience.
- Set API Gateway rate limit to 100 req/s per client with burst limit of 200 req/s to prevent abuse.
Practice Amazon SAP-C02 AWS Certified Solutions Architect – Professional (SAP-C02) with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 30-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
A company is evaluating its cloud expenditure on AWS services and is considering switching from an On-Demand pricing model to a Reserved Instances (RIs) pricing model for its EC2 instances. The company currently runs 10 m5.large instances, each costing $0.096 per hour under the On-Demand model. If the company opts for a 1-year Reserved Instance, which offers a significant discount of 30% compared to the On-Demand pricing, what will be the total cost savings over the year if the company runs these instances continuously?
Study workflow
Turn one SAP-C02 attempt into a study plan
- 1
Analyze Cost Trade-offs
For any cost-related question, first identify the instance type, quantity, on-demand price, and any discounts. Calculate annual on-demand cost, then apply discount percentages for RIs or Spot. For Lambda, compute GB-seconds (memory in GB × duration in seconds × invocations) and multiply by the price per GB-second. For S3, multiply storage (GB) by class rate and number of months, then sum.
- 2
Map Compliance Requirements to AWS Services
When a question mentions GDPR, PCI DSS, or encryption, immediately think of AWS KMS for key management, ACM for TLS certificates, and S3 server-side encryption. Use SCPs for multi-account governance. Avoid storing keys in code or local databases. Always pair encryption at rest with encryption in transit.
- 3
Design for High Availability
For HA, always use at least two Availability Zones. For databases, use Multi-AZ RDS or read replicas. For compute, use Auto Scaling groups with ELB. For containers, use EKS with multi-AZ node groups and Cluster Autoscaler. For migration, use blue-green or rolling deployments. Think about fault isolation and automated failover.
- 4
Configure Networking Securely
Divide VPC into public and private subnets per tier. Use security groups as virtual firewalls: allow only necessary traffic between tiers. For cross-VPC or on-premises connectivity, use Transit Gateway with non-overlapping CIDRs. For hybrid, prefer Direct Connect for latency-sensitive traffic and add VPN backup. For API protection, set rate limits and burst limits.
- 5
Calculate Capacity and Scale
For DynamoDB, compute RCUs based on item size and consistency model: one RCU = two eventually consistent reads per second for items ≤ 4 KB. For Lambda, estimate invocation rate and memory. For Step Functions, account for state transitions. For event-driven systems, compute backlog as (arrival rate - processing rate) × time. Adjust for overhead like encryption.
FAQ
Questions about this SAP-C02 practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
How do I calculate Lambda cost for high-throughput serverless applications?+
Compute total GB-seconds: invocations per second × 3600 × memory (GB) × average duration (seconds). Multiply by Lambda price per GB-second (e.g., $0.0000166667). Remember the free tier covers 400,000 GB-seconds monthly. For peak cost, assume constant traffic at the specified rate.
What is the difference between Amazon RDS Multi-AZ and read replicas for disaster recovery?+
Multi-AZ provides high availability by automatically failing over to a standby in another AZ with the same endpoint. Read replicas are primarily for scaling read traffic, but can be promoted to primary for DR if data loss is acceptable. For cross-region DR, use cross-region read replicas or DMS continuous replication.
When should I use AWS Step Functions over direct Lambda invocations?+
Use Step Functions when your workflow involves multiple steps, error handling, retries, parallel branches, or waiting. Step Functions automatically retry failed tasks on defined intervals, maintain state across executions, and provide a visual orchestration layer. Direct Lambda invocations are simpler but lack built-in workflow management.
How do I choose between SCPs and IAM policies for multi-account governance?+
SCPs define the maximum permissions for all accounts in an organizational unit, enabling centralized guardrails (e.g., disallow certain services). IAM policies grant permissions within those boundaries. Use SCPs at the OU level to enforce compliance, and let individual accounts manage IAM roles and policies for fine‑grained access.
What is the recommended hybrid network design for low latency and high availability?+
Use AWS Direct Connect as the primary path for dedicated, low‑latency connectivity. Implement a VPN connection over the internet as a backup in case Direct Connect fails. This combination ensures high availability and secure encrypted communication via the VPN when needed, while Direct Connect provides consistent performance.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.