AWS SAP-C02 Practice Test

SAP-C02 practice test: what's covered

• Solutions Architect Professional

Free SAP-C02 sample questions

1. A enterprise running 60 accounts in AWS Organizations wants to guarantee that no member account, including its root user, can disable CloudTrail or delete the central logging S3 bucket. Which control enforces this most reliably?

   • A. Apply a Service Control Policy at the organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteBucket on the logging resources
   • B. Attach an IAM permissions boundary to every administrator role across all accounts to remove the CloudTrail delete actions
   • C. Enable an IAM identity-based deny policy in the management account that propagates to members automatically
   • D. Turn on AWS Config conformance packs that automatically re-create the trail whenever it is stopped
   Show answer

   Correct: A. SCPs are organization guardrails that cap the maximum permissions of member accounts, and they restrict even the account root user, so a deny on the CloudTrail and bucket actions cannot be overridden locally. IAM permissions boundaries are per-principal and do not bind the root user, so they are not a complete guardrail. Identity-based policies in the management account do not propagate to members. Config remediation reacts after the fact and does not prevent the action, so it is incorrect for a hard guarantee.

2. A central CI/CD account must deploy into 25 workload accounts without storing any long-lived credentials, while limiting blast radius if the pipeline is compromised. Which design choices meet these goals? (Choose TWO)

   • A. Create a deployment IAM role in each workload account whose trust policy allows sts:AssumeRole only from the CI/CD account principal
   • B. Attach a permissions boundary to the deployment roles that caps them to the specific services the pipeline manages
   • C. Generate IAM user access keys in each workload account and store them encrypted in the pipeline configuration
   • D. Embed the management account root access keys in the pipeline so it can assume into any account
   • E. Share a single IAM user across all 25 accounts and rotate its password every 90 days manually
   Show answer

   Correct: A and B. Cross-account roles assumed via STS provide temporary credentials and avoid static secrets, and a permissions boundary limits the deployment role to only the intended services, which contains blast radius if the pipeline is compromised. Long-lived IAM user access keys are exactly the static credentials the requirement forbids, so they are incorrect. Embedding root access keys is never acceptable because root cannot be scoped. A shared IAM user across accounts breaks auditability and is not a per-account isolation model.

3. An organization with 40 spoke VPCs across many accounts currently uses full-mesh VPC peering, and adding each new VPC now requires updating dozens of route tables. They need a scalable hub-and-spoke design with traffic segmentation. What should they implement?

   • A. Deploy a Transit Gateway in a central network account, attach each VPC, share it via Resource Access Manager, and use TGW route tables to segment traffic
   • B. Replace peering with a single large VPC and migrate every workload into separate subnets to remove cross-VPC routing
   • C. Configure Site-to-Site VPN tunnels between every pair of VPCs to replace the peering connections
   • D. Use VPC peering but enable transitive routing so packets can hop through an intermediate VPC
   Show answer

   Correct: A. Transit Gateway replaces the n-squared peering mesh with a hub-and-spoke model, and multiple TGW route tables provide segmentation between groups of attachments while RAM shares it across accounts. Collapsing everything into one VPC destroys account isolation and is operationally impractical. A full VPN mesh has the same scaling problem as peering plus added cost and latency. VPC peering is explicitly non-transitive, so routing through an intermediate VPC is not supported and is incorrect.

4. Compliance requires that workloads in a specific Organizational Unit can only create resources in eu-west-1 and eu-central-1, regardless of what permissions individual account admins grant. Which approach enforces the regional restriction?

   • A. Attach an SCP to the OU that denies actions when aws:RequestedRegion is not one of the two approved Regions
   • B. Create an IAM managed policy in each account that whitelists only the two Regions and attach it to every user
   • C. Use AWS Config rules to detect resources created outside the approved Regions and email the security team
   • D. Enable an AWS Control Tower dashboard that reports on Region usage across the organization weekly
   Show answer

   Correct: A. An SCP using a Deny with the aws:RequestedRegion condition key applies to every principal in the OU and cannot be bypassed by local IAM grants, which is exactly the guardrail required. Per-account IAM policies can be removed or overridden by account admins, so they do not meet the unconditional requirement. Config rules and Control Tower dashboards are detective controls that report violations after creation rather than preventing them, so they are incorrect for enforcement.

5. A stateless web tier on EC2 must absorb predictable morning traffic surges of roughly 10x within 60 seconds, but instances take about three minutes to fully initialize. Which approach minimizes cold-start impact most cost-effectively?

   • A. Use an Auto Scaling group with predictive scaling plus a warm pool of pre-initialized stopped instances
   • B. Over-provision the Auto Scaling group to the peak size continuously so capacity is always available
   • C. Replace target tracking with a single scheduled action that doubles capacity at a fixed time each day
   • D. Move the fleet to the largest available instance type so fewer instances are needed during the surge
   Show answer

   Correct: A. Predictive scaling forecasts the recurring surge and provisions ahead of it, while a warm pool keeps pre-initialized instances stopped so they can join in seconds rather than three minutes, addressing both timing and cost. Continuously over-provisioning to peak wastes money during the rest of the day. A single scheduled doubling cannot absorb a 10x spike and ignores variability. Larger instances do not solve the multi-minute initialization delay, so that option is incorrect.

Last updated: 2026-10-19

SAP-C02 practice test FAQ

Related practice tests

• AWS SAA-C03 practice test
• AWS DOP-C02 practice test
• AWS ANS-C01 practice test
• AWS SCS-C02 practice test
• Azure AZ-305 practice test
• Google Cloud Professional Cloud Architect practice test