Lesson 333 · AWS Learning Path

AWS 333: SAP-C02 domain and question strategy

Anil Jalela · Published May 24, 2026 · 8 min read

Why this lesson matters

SAP-C02 tests architecture judgment across long scenarios, not command recall. Several options may be technically possible; the best answer satisfies every explicit constraint with the requested balance of security, reliability, performance, cost, and operational effort.

As of this technical review, AWS has announced SAP-C03. The AWS certification page states that SAP-C02 remains available until November 17, 2026, and SAP-C03 delivery begins November 17 after registration opens October 27. Learners must verify the current official page before booking. This lesson teaches SAP-C02's four-domain blueprint while emphasizing durable architecture reasoning that transfers to later versions.

Learning outcomes

By the end, you can:

• map scenarios to all four SAP-C02 domains and tasks;
• distinguish stated facts, requirements, constraints, and distractors;
• identify the exact decision scope and requested optimization;
• eliminate options that violate security, data, recovery, or operational boundaries;
• compare remaining options by AWS responsibility and trade-off;
• handle multiple-choice and multiple-response questions;
• manage confidence, time, flags, and answer review;
• build a remediation plan from reasoning errors rather than memorized wording.

1. Current exam blueprint

The current certification page describes 75 multiple-choice or multiple-response questions in 180 minutes. The exam guide uses a compensatory scoring model: overall performance matters; candidates do not have to pass every domain separately.

Weights guide study allocation, not question labeling. A scenario can combine domains. Build broad capability instead of predicting exact counts.

2. Question types

Multiple choice asks for one best answer from several options. Multiple response states how many answers to select. Treat a multiple-response set as a combined architecture: every selected item must be correct and jointly satisfy the question.

Read whether the prompt asks what to do first, the best design, the most secure, most cost-effective, least operationally complex, or a set of actions. These modifiers change ranking. “First” often requests discovery, containment, or prerequisite; it does not always request the final target architecture.

Never assume the real exam gives partial credit for selecting some correct responses. Follow the on-screen instructions and choose exactly the requested number.

3. The requirements-first method

Use this repeatable sequence:

1. Read the final question sentence first to identify decision scope and optimization.
2. Read the scenario once for actors, current state, desired state, and pain.
3. Mark hard constraints: compliance, residency, protocol, downtime, RTO/RPO, consistency, performance, budget, skills, timeline, and operating effort.
4. Identify workload behavior: synchronous/asynchronous, state, data access, scale, failure, and network.
5. State the minimum acceptable architecture in plain language before evaluating options.
6. Eliminate choices violating any hard constraint.
7. Compare survivors against the requested optimization and AWS shared responsibility.
8. Re-read the stem and selected answer for hidden contradiction.
9. Record confidence and flag only when review can help.

Do not begin by scanning for a familiar service name. Keyword matching fails because the same service can appear in correct and incorrect architectures.

4. Build a constraint ledger

Words such as always, immediately, no downtime, without changing, and all accounts are hard boundaries. Verify whether they apply to data, users, management, or one component.

5. Decision scope

Identify what layer is being selected:

• organization/account governance;
• workforce/workload identity;
• network routing/connectivity/DNS;
• compute and scaling;
• integration and delivery semantics;
• data store/access/consistency;
• backup, HA, or DR;
• migration strategy/tool/cutover;
• observability, security response, or cost control.

An answer can contain useful services but solve the wrong layer. If the question asks to prevent member accounts from disabling a control, a detective alarm alone does not provide prevention. If it asks to recover after deletion, a read replica alone is not point-in-time backup.

6. Elimination hierarchy

Apply high-confidence elimination before fine comparison:

1. violates explicit requirement;
2. breaks security, compliance, or data boundary;
3. cannot meet recovery, consistency, or availability behavior;
4. uses incompatible service semantics, scope, or Region;
5. creates unsupported operational action or hidden single point;
6. requires application change forbidden by the stem;
7. meets requirements but loses on requested cost/operation/performance optimization;
8. adds unnecessary services or complexity.

Do not reject an answer only because it is unfamiliar. Distinguish a knowledge gap from evidence of contradiction.

7. Service-boundary checks

Ask who owns and scopes each control:

• IAM identity policy grants to a principal; resource policy grants at a resource; SCP/RCP limit maximum permissions and do not grant access; KMS key policy remains essential.
• Security groups are stateful resource-level traffic controls; network ACLs are stateless subnet controls; neither creates routes.
• Multi-AZ addresses common infrastructure failure; read replicas scale reads; backups/PITR recover history; multi-Region strategies address different requirements.
• SQS buffers work; SNS fans out; EventBridge routes events; Step Functions orchestrates; semantics determine selection.
• CloudFront caches/content-delivers; Route 53 resolves/routes DNS; Global Accelerator uses anycast addresses and regional endpoints. They solve different traffic problems.
• Savings Plans/Reserved Instances optimize eligible steady usage; Capacity Reservations reserve capacity; Spot trades interruption risk for price.

Build these contrasts from official documentation and labs, not mnemonics alone.

8. Multiple-response strategy

Rewrite the prompt as independent acceptance tests. Evaluate each option true/false against them, then evaluate the chosen combination for overlap and conflict.

Watch for one option that supplies a prerequisite and another that supplies the action. Also watch for two individually useful choices where one is redundant or violates “least operational effort.” Select exactly the number requested.

If two answers appear equivalent, find scope differences: account versus organization, regional versus global, control versus data plane, synchronous versus asynchronous, encryption capability versus key authorization, or detection versus prevention.

9. Scenario mini-examples

Organization prevention

Requirement: all member accounts must be unable to disable a required security service, while security administrators manage it centrally. Look for organization integration, delegated administration, and preventive maximum-permission control. Reject “send an alert” as the sole prevention.

Burst protection

Requirement: absorb unpredictable requests and protect a database limited to 200 writes/second. A queue plus capped consumers can buffer and enforce backpressure. Unbounded Lambda concurrency may worsen the outage.

Recovery wording

Requirement: recover to within five minutes of data before accidental deletion. Multi-AZ failover does not restore deleted history. Evaluate PITR/backup and measured restore behavior.

Migration first action

Requirement: migrate 200 applications with unknown dependencies. Starting replication for every server skips assessment. Discover portfolio, owners, dependencies, and strategy, then plan waves and foundations.

10. Time and confidence

With 180 minutes for 75 questions, the arithmetic average is 2.4 minutes, but questions vary. Use a first pass that captures answer and confidence without allowing one scenario to consume the exam. Reserve review time.

Confidence categories:

• high: explicit requirements and service behavior clearly select one answer;
• medium: two remain and one trade-off decides;
• low: a service fact or interpretation is uncertain.

Flag medium/low questions when later review can resolve them. Do not change a high-confidence answer from anxiety. Change only after identifying a missed requirement, corrected fact, or stronger comparison.

11. Distractor patterns

Common distractors are technically possible but:

• solve a symptom rather than requirement;
• use self-managed components despite a “least operations” request;
• add active-active/multi-Region without need;
• confuse encryption with authorization;
• confuse replica, backup, and disaster recovery;
• centralize a service but omit cross-account trust/policy;
• ignore return routing, DNS, quota, or data transfer;
• require downtime or code change forbidden by the scenario;
• optimize price before mandatory resilience/security;
• use a deprecated or wrong-scope feature.

12. Remediation ledger

After original practice, classify every wrong or uncertain answer:

Review correct guesses and low-confidence correct answers too. A score can hide fragile reasoning.

13. Guided practice

Solve 30 original, non-dump scenarios spanning all domains. For each record domain/task, decision scope, hard constraints, question modifier, selected answer(s), every rejected option, confidence, time, changed-on-review status, error category, official source, and changed retest.

Create six cross-domain scenarios that combine organization, network, security, data, resilience, cost, and migration. Defend the answer aloud in under two minutes without relying on option wording.

Cost, ethics, and cleanup

No AWS resources are created. Do not use or distribute stolen exam questions, memorized live content, or dumps. Use AWS official practice resources and original scenarios. The objective is architecture competence, not answer-pattern memorization.

Knowledge check

1. What is evaluated before cost? Every mandatory constraint.
2. Why read the final sentence first? It identifies decision scope and requested optimization.
3. Should correct guesses be reviewed? Yes; correctness can hide weak reasoning.
4. What changes an answer during review? A corrected fact, missed constraint, or stronger comparison.
5. Does each question belong cleanly to one domain? No; scenarios can combine domains.

Lesson acceptance

Complete 30 original scenarios and six cross-domain defenses. Every answer must show constraints, elimination, trade-off, confidence, timing, and source-led remediation. No dump material is accepted.

Official sources

• SAP-C02 exam guide
• Domain 1: Organizational Complexity
• Domain 2: New Solutions
• Domain 3: Continuous Improvement
• Domain 4: Migration and Modernization
• In-scope SAP-C02 services
• AWS certification page and current transition dates