10 beginner questions on the SAP-C02 domains: Design Solutions for Organizational Complexity (SCPs, Transit Gateway, VPC peering), Design for New Solutions (disaster recovery strategies, Aurora Global Database), Continuous Improvement for Existing Solutions (Systems Manager, Compute Optimizer) and Accelerate Workload Migration and Modernization (AWS DMS, migration strategies).

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. A company uses AWS Organizations. It must stop every account in one organizational unit (OU) from using AWS Regions outside an approved list, even if an account administrator tries. What should a solutions architect use?

    • A. An IAM permissions boundary on each user
    • B. An AWS Config rule that reports Region use in each account
    • C. A service control policy attached to the OU ✔ correct
    • D. Amazon GuardDuty in every approved Region

    Answer: C. A service control policy (SCP) sets the maximum available permissions for all IAM users and roles in the accounts of an OU, including administrators. AWS Config only detects and reports; it does not prevent actions.

    Source: docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.htm · Domain: Design Solutions for Organizational Complexity

  2. A company has dozens of VPCs in several accounts plus a VPN to its data center. It wants a central hub that routes traffic between all of these networks. Which service fits best?

    • A. AWS Transit Gateway ✔ correct
    • B. A full mesh of VPC peering connections
    • C. A NAT gateway in each VPC
    • D. An internet gateway shared by all VPCs

    Answer: A. AWS Transit Gateway is a regional hub that connects VPCs and on-premises networks (VPN or Direct Connect) and routes between them. A peering mesh grows quickly and does not route on-premises traffic through peered VPCs.

    Source: docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html · Domain: Design Solutions for Organizational Complexity

  3. If VPC A is peered with VPC B, and VPC A is also peered with VPC C, then VPC B can send traffic to VPC C through VPC A.

    • A. True
    • B. False ✔ correct

    Answer: B. False. VPC peering does not support transitive peering. B and C need their own peering connection, or the VPCs can be connected through a transit gateway.

    Source: docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html · Domain: Design Solutions for Organizational Complexity

  4. For disaster recovery, a company replicates its database continuously to a second Region and keeps its application servers there switched off until a disaster happens. Which DR strategy is this?

    • A. Backup and restore
    • B. Multi-site active/active
    • C. Warm standby
    • D. Pilot light ✔ correct

    Answer: D. Pilot light keeps core data live and replicated in the recovery Region while application servers stay off and are started during failover. Warm standby runs a scaled-down but working copy of the whole workload.

    Source: docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/disast · Domain: Design for New Solutions

  5. A global application needs a relational database with fast local reads in several AWS Regions and the ability to recover quickly in another Region if the primary Region fails. Which option fits best?

    • A. An Amazon RDS Multi-AZ DB instance
    • B. An Amazon Aurora global database ✔ correct
    • C. Amazon DynamoDB global tables
    • D. An Amazon ElastiCache cluster

    Answer: B. An Aurora global database spans multiple Regions: one primary Region and read-only secondary Regions with low-latency local reads, which can take over after a Regional outage. RDS Multi-AZ stays within one Region; DynamoDB is NoSQL.

    Source: docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html · Domain: Design for New Solutions

  6. A company wants to reduce the operational effort and risk of managing a large EC2 fleet: patching is manual and administrators connect over SSH from the internet. Which two actions should a solutions architect recommend? (Select TWO)

    • A. Use Systems Manager Patch Manager to automate operating system patching ✔ correct
    • B. Use Amazon Macie to classify the data stored on the instances
    • C. Use Systems Manager Session Manager for shell access without open inbound ports ✔ correct
    • D. Use AWS DataSync to copy configuration files between the instances
    • E. Add a security group rule that allows port 22 from 0.0.0.0/0

    Answer: A, C. Systems Manager Patch Manager automates patching of managed nodes, and Session Manager gives audited shell access without opening inbound ports or running bastion hosts. Macie scans S3 data, DataSync copies data, and opening port 22 to the internet increases risk.

    Source: docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html · Domain: Continuous Improvement for Existing Solutions

  7. A company suspects many of its EC2 instances are over-provisioned. Which service analyzes utilization metrics and recommends better-sized instance types?

    • A. AWS Artifact
    • B. AWS Control Tower
    • C. Amazon Inspector
    • D. AWS Compute Optimizer ✔ correct

    Answer: D. AWS Compute Optimizer analyzes the configuration and utilization metrics of resources such as EC2 instances and recommends optimal sizes to reduce cost and improve performance. Inspector scans for vulnerabilities.

    Source: docs.aws.amazon.com/compute-optimizer/latest/ug/what-is-compute-optimizer.html · Domain: Continuous Improvement for Existing Solutions

  8. A company must migrate an on-premises Oracle database to Amazon RDS with minimal downtime, keeping the source in use until cutover. Which service should it use?

    • A. AWS DataSync
    • B. AWS Database Migration Service with ongoing replication ✔ correct
    • C. AWS Backup cross-Region copy
    • D. Amazon S3 Transfer Acceleration

    Answer: B. AWS DMS can run a full load and then replicate ongoing changes to keep the source and target in sync, so applications keep using the source until cutover. DataSync moves files and objects, not live database changes.

    Source: docs.aws.amazon.com/dms/latest/userguide/Welcome.html · Domain: Accelerate Workload Migration and Modernization

  9. During migration, a team moves a self-managed MySQL database from virtual machines to Amazon RDS for MySQL, without changing the application's core architecture. Which migration strategy is this?

    • A. Replatform ✔ correct
    • B. Rehost
    • C. Repurchase
    • D. Relocate

    Answer: A. Replatforming (lift and reshape) moves a workload to the cloud with some optimization, such as switching to a managed database service, without re-architecting it. Rehosting would move the VMs unchanged.

    Source: docs.aws.amazon.com/prescriptive-guidance/latest/large-migration-guide/migration · Domain: Accelerate Workload Migration and Modernization

  10. Refactoring (re-architecting) an application during migration usually needs more effort than rehosting it, but lets it use cloud-native features.

    • A. True ✔ correct
    • B. False

    Answer: A. True. Refactoring modernizes the application during migration, so it is the most complex strategy; AWS does not recommend it for large migrations. In return, the application can fully use cloud-native capabilities.

    Source: docs.aws.amazon.com/prescriptive-guidance/latest/large-migration-guide/migration · Domain: Accelerate Workload Migration and Modernization

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public AWS exam objectives (SAP-C02 exam guide (docs.aws.amazon.com, current edition; SAP-C03 announced, SAP-C02 available until 2026-11-16)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by AWS; exam names are trademarks of their owners. Official exam page: aws.amazon.com/certification/certified-solutions-architect-professiona.

Last modified: Sunday, 25 October 2026, 9:57 PM