Exam Overview
Exam Details
- Duration: 180 minutes
- Questions: 75
- Passing Score: 750/1000
- Format: Multiple choice & multiple response
- Cost: ~$150-300 USD
- Validity: 3 years
Exam Domains
| Domain | Weight |
|---|---|
| Design for Org Complexity | 26% |
| Design for New Solutions | 29% |
| Migration Planning | 15% |
| Cost Control | 20% |
| Continuous Improvement | 10% |
Prerequisites & Study Tips
Hardest AWS Exam
SAP-C02 is widely considered the hardest AWS cert. Questions present complex multi-service architectures with subtle trade-offs. You need deep SAA-level experience.
Recommended Before Attempting
- Active SAA-C03 + 2+ years real AWS experience
- Adrian Cantrill SAP course or Stephane Maarek SAP course on Udemy
- Complete all Tutorials Dojo SAP practice exams (target 75%+ before booking)
AWS Organizations & Multi-Account
- SCPs - org-level guardrails; restrict max permissions; never grant permissions
- OUs - group accounts hierarchically; SCPs inherit down the tree
- Control Tower - sets up governed multi-account landing zones; uses SCPs + Config Rules
- RAM (Resource Access Manager) - share subnets, TGWs, Route 53 rules across accounts without VPC Peering
- Delegated Admin - member account manages a service (e.g., GuardDuty) for the org
Identity Federation
| Pattern | When to Use |
|---|---|
| IAM Identity Center (SSO) | Internal employees, multiple AWS accounts; SAML 2.0 with corporate IdP |
| Web Identity Federation | Mobile/web app users (millions); Cognito → AWS STS tokens |
| SAML 2.0 Federation | Enterprise with existing IdP; STS AssumeRoleWithSAML |
Advanced Networking
Transit Gateway (TGW)
- Regional hub; connect VPCs and on-premises at scale
- Transitive routing — VPC A → TGW → VPC B (unlike VPC Peering)
- TGW Route Tables — isolate VPC groups (prod vs dev)
- Inter-Region Peering — connect TGWs across regions
Direct Connect
- Dedicated Connection: 1/10/100 Gbps — physical port at DX location
- Hosted Connection: 50 Mbps – 10 Gbps via DX partner
- VIF Types: Private VIF (VPC), Public VIF (AWS public services), Transit VIF (TGW)
- DX Gateway: Connect one DX to multiple VPCs across regions
- Resilience: 2 DX locations + Site-to-Site VPN backup for critical workloads
Migration Strategies (7 Rs)
| Strategy | Description | Effort |
|---|---|---|
| Retire | Decommission — app no longer needed | None |
| Retain | Keep on-premises for now | None |
| Rehost (Lift & Shift) | Move to EC2 with no changes | Low |
| Replatform (Lift & Reshape) | Minor optimizations (move DB to RDS) | Low-Medium |
| Repurchase (Drop & Shop) | Move to SaaS (Salesforce, ServiceNow) | Medium |
| Refactor / Re-architect | Rebuild for cloud-native (microservices) | High |
| Relocate | Move VMware VMs to VMware Cloud on AWS | Low |
Migration Tools
| Tool | Use For |
|---|---|
| Application Migration Service (MGN) | Continuous replication; cutover with minimal downtime |
| Database Migration Service (DMS) | Migrate databases; supports heterogeneous (Oracle → Aurora) |
| DataSync | Migrate/sync NFS/SMB data to S3/EFS/FSx |
| Snowball / Snowmobile | Physical data transfer for large datasets (TB – EB) |
Cost Optimization
- Compute Optimizer — ML-based right-sizing for EC2, EBS, Lambda, ECS
- Cost Allocation Tags — see cost breakdown per team/project
- S3 Lifecycle — auto-move to cheaper storage classes
- Spot for fault-tolerant workloads — up to 90% savings
- Reserved Instances for steady-state — up to 72% savings
- Savings Plans — Compute (most flexible), EC2 Instance (most discount)
📋 Study Checklist
Progress0%
- Explain AWS Organizations: OUs, SCPs, delegated admin, Control Tower
- Know all identity federation patterns and when to use each
- Understand RAM — what can be shared and how
- Design Transit Gateway with route table isolation
- Know Direct Connect: connection types, VIFs, DX Gateway
- Design Route 53 hybrid DNS with Resolver Endpoints
- Know the 7 Rs of migration and when to use each
- Understand Application Migration Service (MGN) vs DMS vs DataSync
- Design cost-optimized architectures with Savings Plans and Spot
- Use Compute Optimizer for right-sizing
- Design event-driven patterns: fan-out, CQRS, Saga, Strangler Fig
- Understand Step Functions Standard vs Express workflows
- Design multi-region active-active architectures
- Understand Global Accelerator vs CloudFront use cases
- Design disaster recovery: pilot light, warm standby, active-active
- Know Kinesis Data Streams vs Firehose vs MSK
- Understand AWS Service Catalog for governed self-service
- Know Lake Formation for data lake governance
- Design EKS/ECS advanced deployment patterns
- Understand Outposts and Local Zones for edge scenarios