SAP-C02 tests architecture decisions across many accounts, Regions and teams: networking and governance, designing new solutions, improving running workloads and migrating or modernizing. This outline follows the 20 task statements in the official exam guide, grouped by domain. Tick topics off as you cover them. Your ticks are saved in this browser.
This outline follows the official SAP-C02 exam guide . Check it for the exact wording.
Design solutions for organizational complexity 26% Connecting networks, securing and sharing across many accounts, recovering from disasters, governing an organization and keeping costs visible. Five tasks, 26% of the exam.
Network connectivity (task 1.1) Choosing between VPC peering, Transit Gateway, PrivateLink, VPC Lattice, Cloud WAN and shared VPCs for many VPCs Transitive routing, appliance mode, centralized egress and inspection with Network Firewall or Gateway Load Balancer Hybrid connectivity: Site-to-Site VPN, Direct Connect, Direct Connect gateway, VIF types, resilience models, encryption over Direct Connect Hybrid DNS with Route 53 Resolver inbound and outbound endpoints, forwarding rules, Profiles, DNS Firewall Network segmentation: subnetting, CIDR planning, overlapping ranges, route tables Traffic monitoring and troubleshooting: Flow Logs, Traffic Mirroring, Reachability Analyzer, Network Access Analyzer Choosing Regions and Availability Zones by latency, compliance, service availability and cost Using gateway and interface endpoints and endpoint policies for service integrations Security controls (task 1.2) Cross-account access with roles, trust policies, external ID and resource policies IAM Identity Center with external identity providers, SAML, SCIM; Cognito for customers; OIDC federation Route tables, security groups and network ACLs as layers of control KMS key types, key policies, multi-Region keys, cross-account encrypted snapshots; ACM and Private CA Encryption at rest and in transit strategies Central security events and auditing: organization trails, delegated administrators, Security Hub, GuardDuty, Inspector, Access Analyzer, Config aggregators, Firewall Manager Reliability and disaster recovery (task 1.3) Multi-account environment (task 1.4) Account structure and OU design for security, infrastructure and workloads Organizations: SCPs, RCPs, tag, backup and declarative policies, delegated administrators Control Tower landing zone, Account Factory, controls, enrolling accounts, customizations Central logging and event notification across accounts Sharing resources with RAM, Service Catalog and StackSets Building a governance model with guardrails, conformance packs and policies Cost optimization and visibility (task 1.5) Cost Explorer, Budgets, Cost and Usage Reports, Anomaly Detection, Trusted Advisor, Pricing Calculator Purchasing options: On-Demand, Savings Plans, Reserved Instances, Spot, Capacity Reservations Rightsizing with Compute Optimizer and S3 Storage Lens Tagging strategy, tag policies, cost allocation tags and cost categories mapped to business units How purchasing choices affect cost and performance
Design for new solutions 29% Designing greenfield architectures for deployment, continuity, security, reliability, performance and cost. Six tasks, the largest domain at 29%.
Deployment strategy (task 2.1) CloudFormation, CDK, StackSets, Service Catalog and other infrastructure as code CI/CD with CodePipeline, CodeBuild, CodeDeploy, CodeArtifact and ECR Deployment patterns (all at once, rolling, immutable, blue/green, canary, linear) and rollback mechanisms Systems Manager for configuration management and change management Upgrade paths for new services and features Adopting managed services and delegating complex work (AI services, Bedrock) to AWS Business continuity (task 2.2) Security controls (task 2.3) Least privilege roles and users, ABAC, permission boundaries, Roles Anywhere Security group and network ACL rules for inbound and outbound flows Attack mitigation for large web apps: CloudFront, WAF, Shield Advanced, Firewall Manager Encryption at rest and in transit, KMS, CloudHSM, ACM Service endpoints and credential management with Secrets Manager and Parameter Store GuardDuty, Security Hub, Inspector, Macie, Detective Patch management with Patch Manager, Image Builder and immutable images Reliability (task 2.4) Highly available designs with Multi-AZ and multi-Region, load balancers and Auto Scaling policies Storage and database replication: S3, RDS, Aurora, DynamoDB, ElastiCache Loose coupling with SQS, SNS, EventBridge and Step Functions Designing for failure: retries, backoff, idempotency, static stability Failover operations for applications and databases Service quotas and limits DNS routing policies: latency, geolocation, simple, weighted, failover Performance (task 2.5) Instance families, Graviton, placement groups and enhanced networking Storage options: EBS types, EFS, FSx variants, S3 classes, instance store Purpose-built databases and choosing by access pattern Caching, buffering and read replicas (CloudFront, ElastiCache, DAX, RDS Proxy, queues) Elastic architectures, rightsizing and performance monitoring tools Cost optimization (task 2.6)
Continuous improvement for existing solutions 25% Improving workloads that already run: operations, security, performance, reliability and cost. Five tasks, 25% of the exam.
Operational excellence (task 3.1) Security improvement (task 3.2) Performance improvement (task 3.3) Turning business needs into metrics, SLIs, SLOs and SLAs Finding bottlenecks with X-Ray, Performance Insights, CloudWatch and Compute Optimizer Typical fixes: caching, replicas, RDS Proxy, CDN, Global Accelerator, queues Auto Scaling, instance fleets and placement groups Global offerings: CloudFront, Global Accelerator, edge computing Testing remediation, adopting new managed services and rightsizing Reliability improvement (task 3.4) Cost improvement (task 3.5)
Accelerate workload migration and modernization 20% Assessing portfolios, choosing migration tools, picking target platforms and modernizing. Four tasks, 20% of the exam.
Selecting workloads (task 4.1) Migration approach (task 4.2) Database transfer: DMS, SCT, DMS Schema Conversion, native tools, Aurora replicas Application and server transfer: Application Migration Service, VM Import, VMware options Data transfer: DataSync, Transfer Family, Snow Family, Storage Gateway, Transfer Acceleration Networking and DNS for migrations: Direct Connect, VPN, Route 53 cutover Identity: Identity Center, Managed Microsoft AD, AD Connector Security for migration tools and governance with Control Tower and Organizations New architecture for existing workloads (task 4.3) Choosing compute: EC2, Beanstalk, Lambda, App Runner Choosing container platforms: ECS, EKS, Fargate, ECR Choosing storage: EBS, EFS, FSx variants, S3, Storage Gateway Choosing databases: RDS, Aurora, DynamoDB, OpenSearch, self-managed on EC2 Modernization (task 4.4)