A company has introduced a new policy that allows employees to work remotely from their homes if they connect by using a VPN. The company is hosting internal applications with VPCs in multiple AWS accounts. Currently, the applications are accessible from the company's on-premises office network through an AWS Site-to-Site VPN connection. The VPC in the company's main AWS account has peering connections established with VPCs in other AWS accounts. A solutions architect must design a scalable AWS Client VPN solution for employees to use while they work from home. What is the most cost-effective solution that meets these requirements?

Create a Client VPN endpoint in the main AWS account. Configure required routing that allows access to internal applications.

A company is planning to migrate an application to AWS. The application runs as a Docker container and uses an NFS version 4 fileshare. A solutions architect must design a secure and scalable containerized solution that does not require provisioning or management of the underlying infrastructure. Which solution will meet these requirements?

Deploy the application containers by using Amazon ECS with the Fargate launch type. Use Amazon EFS for shared storage.

A company is migrating applications to AWS and wants to modernize quickly after networking and security strategies are finalized. They have set up a Direct Connect connection in a central network account and expect to have hundreds of AWS accounts and VPCs. The corporate network must access AWS resources seamlessly and communicate with all VPCs. Additionally, the company wants to route all cloud resources to the internet through its on-premises data center. Which combination of steps will meet these requirements? (Choose three.)

Create a Direct Connect gateway and a Transit Gateway in the central network account and connect them using a transit VIF. | Share the Transit Gateway with other accounts and attach VPCs to it. | Use private subnets and route internet-bound traffic through on-premises NAT via Direct Connect.

A solutions architect is designing an AWS account structure for multiple teams in the same region. The company needs a VPC connected to the on-premises network and expects less than 50 Mbps of total traffic. Which combination of steps will meet these requirements most cost-effectively? (Choose two.)

Deploy CloudFormation in a shared services account and share subnets using AWS RAM. | Use AWS Site-to-Site VPN for connectivity.

A research center has moved 1PB of object storage to an S3 bucket used by 100 scientists, each with a personal folder. All scientists are in a single IAM user group. The compliance officer needs to ensure scientists cannot access each other's work and requires reporting on all document access with minimal operational overhead. Which combination of actions should be taken? (Choose two.)

Use IAM policy with ${aws:username} condition for S3 path restriction. | Use CloudTrail to capture object-level events and store logs in S3 for Athena queries.

A company is deploying a big data analytics cluster across many Linux EC2 instances in multiple Availability Zones. All nodes require read and write access to common, POSIX-compatible file storage that is highly available and can handle high throughput. Which storage solution will meet these requirements?

Amazon EFS max I/O performance mode.

A company uses AWS Transfer Family with an S3 bucket to receive PGP-encrypted updates from a third-party supplier. They need to automatically decrypt the data upon receipt using a managed workflow. What should be done next?

Store private key and use nominal step for decryption.

An entertainment company's ticketing service runs on EC2 instances and uses a pricing file stored in S3. The file is updated every 1 to 15 minutes, but instances currently only download it at launch, leading to outdated pricing. What is the most cost-effective way to ensure instances always use the latest information?

Mount S3 bucket using Mountpoint for Amazon S3.

An application pulls an EFS file system for new files, selects a Docker image based on the file data, and runs the container for up to 2 hours. The company wants to eliminate EC2 instances and refactor to a more efficient model. Which solution meets these requirements?

Lambda + S3 event triggers + ECS Fargate.

A ticketing platform runs on an ECS cluster (EC2 On-Demand instances) and frequently requests ticket assets from S3 via a NAT gateway. The company knows the exact date and time of traffic spikes for events. How can they optimize costs without decreasing availability? (Choose two.)

Create a gateway VPC endpoint for S3. | Use scheduled scaling policies.

Free Practice · No Signup Required

30 Free AWS SAP-C02 Practice Questions

Real practice questions for the AWS Solutions Architect Professional (SAP-C02) exam, with answers and detailed explanations. Updated 2026.

Start Timed Exam Mode Unlock all 247+ Questions

Free questions

Passing score

750 out of 1000

Exam time

180 minutes

Question pool

247+ Questions

Below are 30 real practice questions for the AWS Solutions Architect Professional (SAP-C02) exam. Each question shows the correct answer and a detailed explanation when you reveal it. Use these to benchmark your readiness — if you score below 70% on these 30 questions, plan for at least 4 more weeks of study before booking.

SAP-C02 Practice Questions

FreePracticeQuiz.questionLabelNetworking
A company has introduced a new policy that allows employees to work remotely from their homes if they connect by using a VPN. The company is hosting internal applications with VPCs in multiple AWS accounts. Currently, the applications are accessible from the company's on-premises office network through an AWS Site-to-Site VPN connection. The VPC in the company's main AWS account has peering connections established with VPCs in other AWS accounts. A solutions architect must design a scalable AWS Client VPN solution for employees to use while they work from home. What is the most cost-effective solution that meets these requirements?
A
Create a Client VPN endpoint in each AWS account. Configure required routing that allows access to internal applications.
B
Create a Client VPN endpoint in the main AWS account. Configure required routing that allows access to internal applications.
C
Create a Client VPN endpoint in the main AWS account. Provision a Transit Gateway that is connected to each AWS account. Configure required routing that allows access to internal applications.
D
Create a Client VPN endpoint in the main AWS account. Establish connectivity between the Client VPN endpoint and the AWS Site-to-Site VPN.
FreePracticeQuiz.questionLabelCompute
A company is planning to migrate an application to AWS. The application runs as a Docker container and uses an NFS version 4 fileshare. A solutions architect must design a secure and scalable containerized solution that does not require provisioning or management of the underlying infrastructure. Which solution will meet these requirements?
A
Deploy the application containers by using Amazon ECS with the Fargate launch type. Use Amazon EFS for shared storage.
B
Deploy the application containers by using Amazon ECS with the Fargate launch type. Use Amazon FSx for Lustre for shared storage.
C
Deploy the application containers by using Amazon ECS with the EC2 launch type and autoscaling turned on. Use Amazon EFS for shared storage.
D
Deploy the application containers by using Amazon ECS with the EC2 launch type and autoscaling turned on. Use Amazon EBS volumes with multi-attach enabled for shared storage.
FreePracticeQuiz.questionLabelNetworking
A company is migrating applications to AWS and wants to modernize quickly after networking and security strategies are finalized. They have set up a Direct Connect connection in a central network account and expect to have hundreds of AWS accounts and VPCs. The corporate network must access AWS resources seamlessly and communicate with all VPCs. Additionally, the company wants to route all cloud resources to the internet through its on-premises data center. Which combination of steps will meet these requirements? (Choose three.)
A
Create a Direct Connect gateway in the central account and associate it with virtual private gateways.
B
Create a Direct Connect gateway and a Transit Gateway in the central network account and connect them using a transit VIF.
C
Provision an internet gateway and attach it to subnets.
D
Share the Transit Gateway with other accounts and attach VPCs to it.
E
Provision VPC peering as necessary.
F
Use private subnets and route internet-bound traffic through on-premises NAT via Direct Connect.
FreePracticeQuiz.questionLabelNetworking
A solutions architect is designing an AWS account structure for multiple teams in the same region. The company needs a VPC connected to the on-premises network and expects less than 50 Mbps of total traffic. Which combination of steps will meet these requirements most cost-effectively? (Choose two.)
A
Deploy a CloudFormation template per account.
B
Deploy CloudFormation in a shared services account and share subnets using AWS RAM.
C
Use AWS Transit Gateway with Site-to-Site VPN.
D
Use AWS Site-to-Site VPN for connectivity.
E
Use AWS Direct Connect for connectivity.
FreePracticeQuiz.questionLabelSecurity
A research center has moved 1PB of object storage to an S3 bucket used by 100 scientists, each with a personal folder. All scientists are in a single IAM user group. The compliance officer needs to ensure scientists cannot access each other's work and requires reporting on all document access with minimal operational overhead. Which combination of actions should be taken? (Choose two.)
A
Use IAM policy with ${aws:username} condition for S3 path restriction.
B
Use CloudTrail to capture object-level events and store logs in S3 for Athena queries.
C
Enable S3 server access logging and analyze with Athena.
D
Use S3 bucket policy for group-wide access.
E
Send CloudTrail logs to CloudWatch and query via Athena connector.
FreePracticeQuiz.questionLabelStorage
A company is deploying a big data analytics cluster across many Linux EC2 instances in multiple Availability Zones. All nodes require read and write access to common, POSIX-compatible file storage that is highly available and can handle high throughput. Which storage solution will meet these requirements?
A
AWS Storage Gateway file gateway with S3.
B
Amazon EFS general-purpose mode.
C
Amazon EBS io2 volume shared across instances.
D
Amazon EFS max I/O performance mode.
FreePracticeQuiz.questionLabelSecurity
A company uses AWS Transfer Family with an S3 bucket to receive PGP-encrypted updates from a third-party supplier. They need to automatically decrypt the data upon receipt using a managed workflow. What should be done next?
A
Store public key in Secrets Manager and use nominal step for decryption.
B
Store private key and use exception handler for decryption.
C
Store private key and use nominal step for decryption.
D
Store public key and use exception handler for decryption.
FreePracticeQuiz.questionLabelStorage
An entertainment company's ticketing service runs on EC2 instances and uses a pricing file stored in S3. The file is updated every 1 to 15 minutes, but instances currently only download it at launch, leading to outdated pricing. What is the most cost-effective way to ensure instances always use the latest information?
A
Use Lambda + DynamoDB.
B
Use Lambda + EFS.
C
Mount S3 bucket using Mountpoint for Amazon S3.
D
Use EBS multi-attach volume.
FreePracticeQuiz.questionLabelServerless
An application pulls an EFS file system for new files, selects a Docker image based on the file data, and runs the container for up to 2 hours. The company wants to eliminate EC2 instances and refactor to a more efficient model. Which solution meets these requirements?
A
ECS Fargate with EventBridge on EFS.
B
ECS Fargate with EFS event notifications.
C
Lambda + S3 event triggers + ECS Fargate.
D
Lambda container images only.
FreePracticeQuiz.questionLabelNetworking
A ticketing platform runs on an ECS cluster (EC2 On-Demand instances) and frequently requests ticket assets from S3 via a NAT gateway. The company knows the exact date and time of traffic spikes for events. How can they optimize costs without decreasing availability? (Choose two.)
A
Create a gateway VPC endpoint for S3.
B
Add Spot capacity provider.
C
Create On-Demand Capacity Reservations.
D
Enable S3 Transfer Acceleration.
E
Use scheduled scaling policies.
FreePracticeQuiz.questionLabelNetworking
A company runs an application in the cloud that consists of a database and a website. Users can post data to the website, have the data processed, and have the data sent back to them in an email. Data is stored in a MySQL database running on an Amazon EC2 instance. The database is running in a VPC with two private subnets. The website is running on Apache Tomcat in a single EC2 instance in a different VPC with one public subnet. There is a single VPC peering connection between the database and website VPC. The website has suffered several outages during the last month due to high traffic. Which actions should a solutions architect take to increase the reliability of the application? (Choose three.)
A
Place the Tomcat server in an autoscaling group with multiple EC2 instances behind an application load balancer.
B
Provision an additional VPC peering connection.
C
Migrate the MySQL database to Amazon Aurora with one Aurora replica.
D
Provision two NAT gateways in the database VPC.
E
Move the Tomcat server to the database VPC.
F
Create an additional public subnet in a different availability zone in the website VPC.
FreePracticeQuiz.questionLabelIoT
A retail company is mounting IoT sensors in all of its stores worldwide. During manufacturing, each sensor receives an X.509 certificate issued by the company's private certificate authority (CA) containing a unique serial number. The company needs to ensure devices can only send data to AWS after installation. Which solution meets these requirements?
A
Use a Lambda pre-provisioning hook without CA registration.
B
Use Step Functions for validation during installation.
C
Use Lambda pre-provisioning hook with CA registration and allow auto registration.
D
Use fleet provisioning with claim certificates only.
FreePracticeQuiz.questionLabelMachine Learning
A team of data scientists is using Amazon SageMaker in a VPC without internet access. They need occasional access to PyPI for Python packages while maintaining network isolation. Which solution meets these requirements?
A
Use AWS CodeCommit repositories for PyPI packages.
B
Use a NAT gateway with restricted NACL rules.
C
Use a NAT instance with firewall restrictions.
D
Use AWS CodeArtifact with an external connection to PyPI and a VPC endpoint.
FreePracticeQuiz.questionLabelManagement & Governance
A company uses AWS Organizations and needs to move 540 developer accounts into a new developer organization. Which combination of steps should be taken? (Choose three.)
A
Use move account operation from old organization.
B
Remove accounts from old organization.
C
Remove accounts from within each member account.
D
Create placeholder accounts in new organization.
E
Invite accounts to new organization.
F
Users accept invitations from their accounts.
FreePracticeQuiz.questionLabelArchitecture
A travel company experiences heavy load spikes during quarterly content updates. The system uses EC2 instances, DynamoDB, and Redis. Which solution provides high availability and load handling?
A
DAX + Auto Scaling Group + ALB + Route 53 simple routing.
B
ElastiCache Redis + CloudFront + manual scaling.
C
Memcached + ALB + scheduled scaling.
D
DAX + CloudFront + manual scaling.
FreePracticeQuiz.questionLabelSecurity
A security audit reveals that an Application Load Balancer is accepting requests from unauthenticated users. What is the best solution to ensure only authenticated users can access backend services?
A
Enable ALB authentication with OIDC identity provider.
B
Use CloudFront signed URLs.
C
Use AWS WAF to block unauthenticated requests.
D
Use CloudTrail and Lambda for reactive blocking.
FreePracticeQuiz.questionLabelSecurity
A company wants to allow developers to use AWS Marketplace Private Marketplace but restrict administration to a specific role. What is the most efficient solution?
A
Inline deny policies for all users.
B
Permissions boundary for all roles.
C
SCP restricting all except procurement-manager-role.
D
SCP applied only to shared accounts.
FreePracticeQuiz.questionLabelDatabase
A company needs to separate product data and session data, with cross-region disaster recovery and high performance. Which solution meets these requirements?
A
RDS only with read replicas.
B
RDS + ElastiCache Memcached.
C
Two DynamoDB global tables.
D
RDS for product data and DynamoDB global table for session data.
FreePracticeQuiz.questionLabelCompute
An EC2 cluster placement group returns an insufficient capacity error when launching new instances. What should be done?
A
Use spread placement group.
B
Stop and start all instances and retry launch.
C
Merge placement groups.
D
Use dedicated hosts.
FreePracticeQuiz.questionLabelServerless
A media application using S3, Lambda, and DynamoDB fails under high upload traffic due to Lambda concurrency and DynamoDB write limits. Which actions improve performance and reliability? (Choose two.)
A
Increase DynamoDB RCUs.
B
Increase DynamoDB WCUs.
C
Add ElastiCache layer.
D
Add SQS queue between S3 and Lambda.
E
Use S3 Transfer Acceleration.
FreePracticeQuiz.questionLabelIoT
A company is building a solution in the AWS cloud. Thousands of devices will connect to the solution and send data. Each device needs to be able to send and receive data in real time over the MQTT protocol. Each device must authenticate by using a unique X.509 certificate. Which solution will meet these requirements with the least operational overhead?
A
Set up AWS IoT Core for each device. Create a corresponding Amazon MQ and provision a certificate. Connect each device to Amazon MQ.
B
Create a network load balancer (NLB) and configure it with an AWS Lambda authorizer. Run an MQTT broker on Amazon EC2 instances in an Auto Scaling group. Set the Auto Scaling group as the target for the NLB. Connect each device to the NLB.
C
Set up AWS IoT Core for each device. Create a corresponding AWS IoT thing and provision a certificate. Connect each device to AWS IoT Core.
D
Set up an Amazon API Gateway HTTP API and a network load balancer (NLB). Create integration between API Gateway and the NLB. Configure a mutual TLS certificate authorizer on the HTTP API. Run an MQTT broker on an Amazon EC2 instance that the NLB targets. Connect each device to the NLB.
FreePracticeQuiz.questionLabelServerless
A utility company collects usage data every 5 minutes from smart meters. Data is sent to Amazon API Gateway, processed by an AWS Lambda function, and stored in an Amazon DynamoDB table. As more meters are deployed, Lambda functions are taking longer and there are throughput and throttling errors in Lambda and DynamoDB. Which combination of changes will resolve these issues? (Choose two.)
A
Increase the write capacity units (WCUs) to the DynamoDB table.
B
Increase the memory available to the Lambda functions.
C
Increase the payload size from the smart meters to send more data.
D
Stream the data into an Amazon Kinesis Data Stream from API Gateway and process the data in batches.
E
Collect data in an Amazon SQS FIFO queue which triggers a Lambda function to process each message.
FreePracticeQuiz.questionLabelNetworking
A company has services in its on-premises data center connected to AWS via Direct Connect and VPN. Data is sensitive and must not traverse the public internet. The company wants to expose services to other companies using AWS. Which solution meets these requirements?
A
Create a VPC endpoint service behind a Network Load Balancer (NLB) and expose it over Direct Connect.
B
Create a VPC endpoint service behind an Application Load Balancer (ALB) and expose it over Direct Connect.
C
Attach an internet gateway to the VPC and configure security rules.
D
Attach a NAT gateway to the VPC and configure security rules.
FreePracticeQuiz.questionLabelManagement & Governance
A QA department needs to launch short-lived environments using a CloudFormation template. Users should be able to deploy environments without having permissions to directly create AWS resources. What solution meets these requirements?
A
Upload the template to S3 and allow users to assume a privileged role.
B
Create an AWS Service Catalog product with a launch constraint role and allow users to use Service Catalog APIs.
C
Upload the template to S3 and grant CloudFormation permissions with restrictions.
D
Use AWS Elastic Beanstalk and allow users to deploy environments via CLI.
FreePracticeQuiz.questionLabelNetworking
A website uses CloudFront with a primary origin and a failover DR region. Failover currently takes more than one minute due to DNS TTL. What is the fastest failover solution?
A
Use multiple CloudFront distributions with Route 53 failover.
B
Reduce Route 53 TTL to 4 seconds.
C
Use latency-based routing for backend origins.
D
Use a CloudFront origin group with failover configured.
FreePracticeQuiz.questionLabelAnalytics
A company runs SQL queries on EMR using Presto only during specific hours. What is the most cost-effective solution?
A
Use Amazon Redshift Spectrum.
B
Use Amazon Athena with AWS Glue Data Catalog and store data in S3.
C
Use EMR with EMRFS.
D
Use Amazon Redshift.
FreePracticeQuiz.questionLabelServerless
A company wants to enforce per-customer request quotas for a Lambda-based application, with varying limits per customer. Which solution meets this requirement?
A
Use API Gateway REST API with usage plans and API keys.
B
Use API Gateway HTTP API with usage plans.
C
Use Lambda aliases with concurrency limits.
D
Use ALB with AWS WAF rate-based rules.
FreePracticeQuiz.questionLabelSecurity
A financial company needs to inspect all VPC traffic in real time using a third-party security tool without affecting performance. Which combination of steps should be used? (Choose two.)
A
Deploy security tool on EC2 instances in an Auto Scaling group.
B
Deploy the application behind a Network Load Balancer.
C
Deploy an Application Load Balancer in front of security tools.
D
Use a Gateway Load Balancer to redirect traffic to security appliances.
E
Use a Transit Gateway for routing traffic.
FreePracticeQuiz.questionLabelDatabase
An ECS Fargate application with Aurora MySQL must support cross-region disaster recovery with no data loss and minimal operational overhead. What should be used?
A
Aurora cross-region replica
B
AWS DataSync
C
AWS DMS continuous replication
D
Automated snapshots every 5 minutes
FreePracticeQuiz.questionLabelNetworking
A company needs a hybrid DNS solution where on-premises systems resolve Route 53 private hosted zones and all VPCs also resolve the same domain. What is the highest performance architecture?
A
Associate private hosted zone with all VPCs and use Route 53 inbound resolver for on-premises.
B
Use EC2 conditional forwarders for DNS.
C
Use Route 53 outbound resolver.
D
Associate private hosted zone only with shared services VPC and use inbound resolver.

Progress: 0 of 30 questions completed

Ready for the full SAP-C02 exam?

Get all 247+ Questions, timed simulation, and weak-area analytics. Plans from $2.99 — credits never expire.

See pricing

Frequently Asked Questions

Are these real SAP-C02 practice questions?+

Yes. These 30 questions are taken directly from our 247+ Questions pool, written and reviewed by certified practitioners. They mirror the style, difficulty, and scope of the official AWS SAP-C02 exam.

Is the SAP-C02 exam hard?+

The AWS Solutions Architect Professional (SAP-C02) is considered a pass-mark exam (passing score: 750 out of 1000). Most candidates need 4–8 weeks of focused preparation. Use these free questions to gauge where you stand before committing to a full study plan.

How many questions are on the real SAP-C02 exam?+

The official SAP-C02 exam has 75 questions (65 scored, 10 unscored).

Do I need to sign up to use these questions?+

No. These 30 questions are free and require no signup. If you want timed simulation, performance analytics, and access to all 247+ Questions, our paid plans start at $2.99 per exam with credits that never expire.

Keep studying

Full exam

AWS Solutions Architect Professional (SAP-C02) details

Free practice

AWS SAA-C03

Free practice

AWS SCS-C02

Free practice

AWS ANS-C01

Pass SAP-C02 on your first try

Join candidates using DummyExams to practice with realistic timed exams, detailed explanations, and weak-area analytics.

Start full SAP-C02 practice exam

30 Free AWS SAP-C02 Practice Questions

SAP-C02 Practice Questions

A company uses AWS Transfer Family with an S3 bucket to receive PGP-encrypted updates from a third-party supplier. They need to automatically decrypt the data upon receipt using a managed workflow. What should be done next?

An application pulls an EFS file system for new files, selects a Docker image based on the file data, and runs the container for up to 2 hours. The company wants to eliminate EC2 instances and refactor to a more efficient model. Which solution meets these requirements?

A ticketing platform runs on an ECS cluster (EC2 On-Demand instances) and frequently requests ticket assets from S3 via a NAT gateway. The company knows the exact date and time of traffic spikes for events. How can they optimize costs without decreasing availability? (Choose two.)

A team of data scientists is using Amazon SageMaker in a VPC without internet access. They need occasional access to PyPI for Python packages while maintaining network isolation. Which solution meets these requirements?

A company uses AWS Organizations and needs to move 540 developer accounts into a new developer organization. Which combination of steps should be taken? (Choose three.)

A travel company experiences heavy load spikes during quarterly content updates. The system uses EC2 instances, DynamoDB, and Redis. Which solution provides high availability and load handling?

A security audit reveals that an Application Load Balancer is accepting requests from unauthenticated users. What is the best solution to ensure only authenticated users can access backend services?

A company wants to allow developers to use AWS Marketplace Private Marketplace but restrict administration to a specific role. What is the most efficient solution?

A company needs to separate product data and session data, with cross-region disaster recovery and high performance. Which solution meets these requirements?

An EC2 cluster placement group returns an insufficient capacity error when launching new instances. What should be done?

A media application using S3, Lambda, and DynamoDB fails under high upload traffic due to Lambda concurrency and DynamoDB write limits. Which actions improve performance and reliability? (Choose two.)

A company has services in its on-premises data center connected to AWS via Direct Connect and VPN. Data is sensitive and must not traverse the public internet. The company wants to expose services to other companies using AWS. Which solution meets these requirements?

A QA department needs to launch short-lived environments using a CloudFormation template. Users should be able to deploy environments without having permissions to directly create AWS resources. What solution meets these requirements?

A website uses CloudFront with a primary origin and a failover DR region. Failover currently takes more than one minute due to DNS TTL. What is the fastest failover solution?

A company runs SQL queries on EMR using Presto only during specific hours. What is the most cost-effective solution?

A company wants to enforce per-customer request quotas for a Lambda-based application, with varying limits per customer. Which solution meets this requirement?

A financial company needs to inspect all VPC traffic in real time using a third-party security tool without affecting performance. Which combination of steps should be used? (Choose two.)

An ECS Fargate application with Aurora MySQL must support cross-region disaster recovery with no data loss and minimal operational overhead. What should be used?

A company needs a hybrid DNS solution where on-premises systems resolve Route 53 private hosted zones and all VPCs also resolve the same domain. What is the highest performance architecture?

Ready for the full SAP-C02 exam?

Frequently Asked Questions

Keep studying

Pass SAP-C02 on your first try