A focused command center for the current AWS Certified Solutions Architect - Professional exam: learn the domains, drill scenario questions, keep the official references close, and track readiness before booking the real thing.
OUs, SCPs, Control Tower, delegated admin, centralized logging, cross-account roles, resource sharing, and identity federation.
Transit Gateway, VPC peering, PrivateLink, Direct Connect, VPN, Route 53 Resolver, CloudFront, Global Accelerator, and hybrid DNS.
Multi-AZ versus multi-Region, backup and restore, pilot light, warm standby, active-active, RTO/RPO, and failover testing.
KMS, ACM, IAM Identity Center, GuardDuty, Security Hub, WAF, Shield, Detective, Inspector, CloudTrail, and least privilege design.
Aurora global database, DynamoDB global tables, S3 replication and lifecycle, EFS replication, FSx choices, DMS, and caching.
Migration Hub, Application Discovery Service, Application Migration Service, DataSync, Transfer Family, Snow Family, and modernization patterns.
The built-in question bank now contains 240 original scenario questions weighted to the SAP-C02 exam domains. Use these for daily drills, then validate readiness with official AWS practice exams and high-quality third-party practice sets.
Multi-account governance, network connectivity, centralized security, resilience, and cost visibility.
Deployment strategy, continuity, security, reliability, performance, cost, and requirements-driven service selection.
Operational excellence, security posture, reliability, performance efficiency, cost optimization, and refactoring decisions.
Discovery, migration planning, data transfer, cutover, rollback, modernization, and workload prioritization.
Prefer Transit Gateway for hub-and-spoke routing at scale. Use VPC peering for simple direct private connectivity without transitive routing.
Prefer AWS PrivateLink when consumers need private access without overlapping CIDR or full network-level routing.
Look for native cross-Region replication options such as Aurora global database, DynamoDB global tables, and S3 replication.
Use IAM Identity Center with external identity provider integration for workforce access across multiple AWS accounts.
DataSync is the high-yield answer for managed, repeatable online file transfer. Snow Family appears when network transfer is too slow or impractical.
When answers are otherwise close, managed services usually beat self-managed EC2 designs for SAP-C02 scenario wording.
Current overview, scheduling, preparation path, languages, and exam logistics.
Open AWS certification pageThe source of truth for domains, task statements, in-scope services, and out-of-scope knowledge.
Open exam guide PDFOfficial exam prep plans, question sets, practice exams, labs, and AWS-authored training.
Open Skill BuilderOfficial sample question style for understanding wording, distractors, and multi-response expectations.
Open sample PDFHigh-volume SAP-C02 practice exams with review, timed, section, and randomized modes.
Open practice examsAdditional SAP-C02 practice volume for finding weak domains and service-selection gaps.
Open Whizlabs prepDeep architecture instruction for concept repair when practice questions expose weak foundations.
Open courseModular advanced courses aligned to SAP-C02 domains for targeted review.
Open pathCore language for operational excellence, security, reliability, performance, cost, and sustainability.
Read Well-Architected docsReference architectures, guidance, and patterns for enterprise-scale AWS design decisions.
Open Architecture CenterMigration, modernization, security, data, and platform playbooks that map well to exam scenarios.
Open Prescriptive GuidanceMulti-account strategy, SCPs, delegated administration, consolidated billing, and governance.
Read Organizations docsTransit Gateway, peering, endpoints, NAT, routing, and hybrid networking decision support.
Read VPC docsBackup and restore, pilot light, warm standby, active-active, and DR planning concepts.
Read DR whitepaperMissed quiz answers automatically become review notes and weak topics. Use the save controls when you want the same study profile available from another browser.
These rise when you miss questions. The goal is to turn every repeat miss into a short, written rule you can recognize under time pressure.
Runs a 75-question, 180-minute practice pass using the current question bank. The bank repeats if needed, so treat this as a pacing and weak-domain simulator, then validate with official AWS practice exams.
Fast recognition reps for the service-selection traps that show up across long SAP-C02 scenarios.
High-yield distinctions to rehearse until the exam wording starts pointing at the right AWS service.
Last-mile rules for narrowing SAP-C02 answers when two choices both look technically possible.
Transit Gateway for scalable routing; PrivateLink for private service access without broad connectivity; Route 53 Resolver for hybrid DNS; Global Accelerator for static anycast IPs and non-HTTP acceleration.
Control Tower for landing zones; Organizations and SCPs for preventive account guardrails; StackSets for account-wide baselines; RAM for shared subnets and central network ownership.
Backup and restore is cheapest but slowest. Pilot light keeps core services ready. Warm standby runs scaled-down. Multi-site active-active is fastest and most expensive.
MGN rehosts servers. DMS migrates databases and ongoing replication. SCT converts schemas. DataSync moves files online. Snow handles large offline transfer. Transfer Family exposes managed SFTP/FTPS/FTP.
WAF filters layer 7 requests. Shield handles DDoS. GuardDuty detects threats. Security Hub aggregates findings. Macie finds sensitive S3 data. KMS controls encryption keys.
Use tags before cost allocation. Compute Optimizer rightsizes. Cost Explorer analyzes spend. Trusted Advisor checks broad account hygiene. Savings Plans fit steady compute; Spot fits interruptible work.
Site-to-Site VPN is fast to establish and encrypted over internet. Direct Connect gives private, predictable bandwidth. Use DX Gateway to reach multiple VPCs/Regions. Add VPN backup when resilience matters.
Inbound Resolver endpoints let on-prem DNS query AWS private zones. Outbound endpoints plus forwarding rules let VPC workloads resolve on-prem names. Private hosted zones are VPC-associated, not internet-visible.
Use delegated administrator for Security Hub, GuardDuty, Inspector, Macie, and IAM Access Analyzer where supported. Keep the management account quiet; centralize findings in a security tooling account.
SCPs never grant permissions; they set account or OU maximums. IAM policies grant principal permissions. Permissions boundaries cap what a principal can receive. Resource policies control access to the resource.
Cross-account key use needs key policy permission and IAM permission or grants. AWS managed keys are service/account scoped. Multi-Region keys help client-side or app-level portability, not automatic data replication.
Snapshots and backup copies imply higher RTO/RPO. Native replication lowers RPO. Active-active gives fastest recovery but highest cost. Always match the answer to the stated RTO, RPO, and operational overhead.
Aurora Global for low-lag cross-Region Aurora reads and recovery. DynamoDB global tables for active-active serverless NoSQL. RDS read replicas help reads and DR but promotion is not instant active-active.
SQS buffers work and smooths spikes. SNS fans out events. EventBridge routes application/SaaS events with rules. Step Functions orchestrates stateful workflows with branching, retries, and compensation.
ECS on Fargate when you want managed containers without nodes. EKS when Kubernetes compatibility is a hard requirement. App Runner for simple web services. Batch for scheduled or queue-based batch jobs.
Use RDS Proxy for Lambda connection storms to relational databases. Use ElastiCache for low-latency shared state or hot reads. Use EFS with Lambda only when POSIX shared files are truly required.
Gateway endpoints for private S3 access from VPCs. Lifecycle for storage-class transitions. Replication for Region/account copies. Object Lock for WORM retention. Storage Lens for org-wide storage visibility.
CloudWatch metrics/logs/alarms are the baseline. X-Ray traces distributed requests. CloudTrail records API activity. Config records resource configuration and compliance. Synthetics canaries test endpoints and flows.
GuardDuty detects threats. Inspector finds vulnerabilities in EC2/ECR/Lambda contexts. Macie discovers sensitive S3 data. Detective investigates. Security Hub aggregates, normalizes, and maps findings to standards.
Application Discovery Service gathers inventory and dependencies. Migration Hub tracks waves. Migration Evaluator supports business cases. Choose rehost, relocate, replatform, repurchase, refactor, retain, or retire deliberately.
Strangler pattern replaces monolith capabilities incrementally. Purpose-built databases beat one-size-fits-all persistence. Managed services usually win when wording says reduce operational overhead.
Underline hard requirements first: RTO/RPO, Region, account boundary, public internet, compliance, downtime, and operational overhead. Eliminate answers that violate a hard requirement before optimizing cost or simplicity.
Official source-of-truth docs to pair with misses and repeated weak topics. Third-party courses and practice sets are for volume and repair; AWS docs settle service behavior.
This estimate uses your saved profile: questions seen, quiz accuracy, simulator scores, domain balance, weak topics, written review notes, and checklist progress.
The estimate is not an official AWS score. It is a profile-based readiness model that answers whether the evidence collected here looks strong enough to schedule the exam.
The page calls you ready only when the estimate is at least 82%, you have seen at least 55% of the bank, answered at least 120 practice questions, scored 80%+ on a complete simulator, collected evidence in all four domains, kept the weakest domain at 70%+, and have six or fewer active weak topics.
0% complete