SAP-C02 Scenario Questions: How to Read and Answer Them (2026)
Most of the SAP-C02 is a reading test. Here is how to find the constraint, the qualifier and the noise in a stem, with three examples taken apart option by option.
- 75 (65 scored)Questions
- 180 minTime
- 750 / 1000Pass mark
- ~2.4 minPer question
- LEAST overheadKey qualifier
Table of Contents
SAP-C02 gives you 180 minutes for 75 questions, about 2.4 minutes each, and a large share of that time goes to reading. A typical stem is a full paragraph: a company, its account structure, its current architecture, three or four requirements and a detail or two that does not matter. The options underneath often share most of their words. Knowing that an SCP can restrict a member account's root user is necessary; noticing that only one option attaches it to the right OU is what earns the mark.
This page treats the exam as a reading test. It gives you a five-step routine built on reading the question sentence first, a lexicon of the phrases that point at specific AWS answers, the qualifiers that rank surviving options, and three original worked scenarios that show where the constraints, the noise and the near-identical options sit inside a long stem.
The one rule for reading SAP-C02 stems
Read every stem as evidence for eliminating options: each sentence either kills an option, ranks the survivors, or can be ignored.
Most SAP-C02 options describe something AWS can actually do, so asking which one works rarely separates them. The mark goes to the option that breaks no stated requirement and best fits the qualifier. Reading for eliminations stops you re-reading a 160-word paragraph three times.
Read it like this
- Read the question sentence and its qualifier first
- Write constraints as a terse list: scope, numbers, musts
- Compare options clause by clause, not top to bottom
Not like this
- Default to the most sophisticated architecture
- Treat account counts, history or tooling as requirements
- Re-read the whole stem when one clause is in doubt
The 5-step decode routine
Run the same five steps on every scenario. The time on each step is a target for a practised reader, not a rule; the order is the part that matters.
- ~10s
Read the last sentence first
Find what is being asked, the qualifier (LEAST operational overhead, MOST cost-effective, minimal downtime) and whether it says Choose two. Now you know what to hunt for in the paragraph.
- ~45s
Extract the hard constraints
Scan the paragraph for scope, numbers and musts: which OU, which Region, RPO and RTO, the downtime window, no code changes, no public IPs. Keep three to five. Everything else is context or noise.
- ~30s
Diff the options
Line the options up and find the clauses that differ: attach point, replication mode, endpoint type, purchase option. Text the options share is not evidence; only the differences decide the answer.
- ~35s
Kill by constraint
Test each differing clause against your constraint list. One broken must eliminates an option, however good the rest of it is. For Choose two, decide whether the options are parts of one solution or alternatives.
- ~20s
Rank with the qualifier and commit
Use the qualifier to choose among survivors: fewer moving parts for overhead, cheapest compliant option for cost, smallest edit for least change. If two still survive at the budget, pick one, flag it and move on.
Anatomy of a SAP-C02 scenario
Every highlighted phrase below is pinned to a note. Four kinds of phrase matter:
- Constrainta hard requirement that eliminates options
- Qualifierthe word that ranks the survivors
- Keywordpoints at a specific service, control or concept
- Noiselooks important, changes nothing
A Region rule that must not reach the sandbox
A healthcare company manages its AWS accounts with AWS Organizations, with all features enabled1. Accounts are grouped into Workloads, Sandbox and Security OUs, and the management account is used only for consolidated billing2. A new data residency policy states that accounts in the Workloads OU must not create resources outside eu-west-1 and eu-central-13. The rule must apply even to the root user and IAM administrators of each account4. Sandbox accounts are used to evaluate new services and must keep access to every Region5. Global services such as IAM, Amazon Route 53 and Amazon CloudFront must keep working in every account6. Accounts that the platform team moves into the Workloads OU later must be covered without extra work. The company has not deployed AWS Control Tower. A solutions architect must recommend the solution that requires the LEAST operational overhead7.
Which solution meets these requirements with the LEAST operational overhead?
- 1Keyword. SCPs exist only when Organizations has all features enabled. This line confirms an SCP is available, so SCP options cannot be ruled out on that basis.
- 2Noise. Noise. SCPs never affect the management account, and the rule targets the Workloads OU. Nothing in the options depends on how billing is run.
- 3Constraint. The scope constraint. The control belongs on the Workloads OU; anything attached higher in the tree also reaches the Sandbox and Security OUs.
- 4Constraint. Kills identity-policy answers. Only an SCP restricts a member account's root user; IAM policies and permission boundaries cannot.
- 5Constraint. The other half of the scope rule. This is the clause that eliminates attaching the Region deny to the organization root.
- 6Constraint. IAM, Route 53 and CloudFront calls are made to the us-east-1 endpoint, so a Region deny needs a NotAction exception for them.
- 7Qualifier. Ranks the survivors. One policy on one OU, inherited by accounts moved in later, beats per-principal policies or building a landing zone.
- ACreate an SCP that denies all actions when aws:RequestedRegion is not eu-west-1 or eu-central-1, with a NotAction exception for IAM, Route 53, CloudFront and other global services. Attach the SCP to the organization root.OutEliminated by scope. A policy on the root is inherited by every OU, so Sandbox accounts lose the Regions they must keep. It differs from the correct option only in the attach point.
- BCreate an SCP that denies all actions when aws:RequestedRegion is not eu-west-1 or eu-central-1, with a NotAction exception for IAM, Route 53, CloudFront and other global services. Attach the SCP to the Workloads OU.AnswerCorrect. One SCP on the Workloads OU limits every principal in those accounts, including the root user, applies to accounts moved in later, and the NotAction exception keeps global services working.
- CCreate an SCP that denies all actions when aws:RequestedRegion is not eu-west-1 or eu-central-1. Attach the SCP to the Workloads OU.OutEliminated by the global-services constraint. IAM, Route 53 and CloudFront requests go to the us-east-1 endpoint, so this deny breaks them. Same attach point as the correct option; the missing exception is the whole difference.
- DCreate an IAM policy that denies all actions when aws:RequestedRegion is not eu-west-1 or eu-central-1, with a NotAction exception for global services. Use AWS CloudFormation StackSets to attach it to every IAM user and role in the Workloads accounts.OutEliminated by the root-user constraint and the qualifier. Identity policies cannot restrict the root user, account administrators can detach them, and every principal created later needs the policy attached again.
The lesson: When options share most of their wording, read only the clause that differs in each and test it against one constraint at a time.
Two more: decode them yourself
Read each one as you would on the day: mark the constraints, find the qualifier, cross out what fails, and commit to a letter before you open the decode.
A 15-minute cutover for a database that never sleeps
A retailer is moving its order-management system from an on-premises data center to AWS before the data center lease ends in 10 weeks. The system runs on 12 Linux application servers hosted on VMware vSphere 7 and a 6 TB Microsoft SQL Server database that takes orders around the clock. The team has no capacity to change application code before the deadline. The company wants the database to run on Amazon RDS for SQL Server to reduce administration effort. Leadership wants the move done with minimal downtime: the order system can be offline for no more than 15 minutes during cutover, and no order written during the migration can be lost. A 1 Gbps AWS Direct Connect connection links the data center to the target VPC.
Which combination of steps should the solutions architect take to meet these requirements with the LEAST downtime? (Choose two.)
- AInstall the AWS Replication Agent on the 12 application servers, use AWS Application Migration Service to replicate them continuously to AWS, launch test instances, and then launch cutover instances during the change window.
- BExport the 12 virtual machines from vCenter as OVA files, import them with VM Import/Export, and launch Amazon EC2 instances from the resulting AMIs during the change window.
- CCreate an AWS DMS full-load task from the on-premises SQL Server database to Amazon RDS for SQL Server. At cutover, stop writes and repoint the application once the load has finished.
- DCreate an AWS DMS task with full load and ongoing replication (CDC) from the on-premises SQL Server database to Amazon RDS for SQL Server. At cutover, stop writes and repoint the application once replication has caught up.
- EUse AWS Application Migration Service to replicate the database server along with the application servers, then cut over all 13 servers together.
Decode it and show the answer
A retailer is moving its order-management system from an on-premises data center to AWS before the data center lease ends in 10 weeks. The system runs on 12 Linux application servers hosted on VMware vSphere 71 and a 6 TB Microsoft SQL Server database that takes orders around the clock2. The team has no capacity to change application code3 before the deadline. The company wants the database to run on Amazon RDS for SQL Server4 to reduce administration effort. Leadership wants the move done with minimal downtime5: the order system can be offline for no more than 15 minutes6 during cutover, and no order written during the migration can be lost7. A 1 Gbps AWS Direct Connect connection links the data center to the target VPC.
- 1Noise. Noise. Application Migration Service replicates from any source through its agent; naming the hypervisor only makes VM Import/Export look relevant.
- 2Keyword. Size plus round-the-clock writes means no one-shot copy fits a short window. The database tier needs continuous replication.
- 3Constraint. Points to rehost for the application tier. Any option that refactors or rewrites code is out before you weigh it.
- 4Constraint. Rules out rehosting the database server with Application Migration Service, which lands on EC2. The database needs a data-level tool such as AWS DMS.
- 5Qualifier. The ranking word. Among options that work, prefer continuous replication with a short final switch over any point-in-time copy.
- 6Constraint. Turns 'minimal downtime' into a number. Any cutover that includes a bulk copy, image import or restore cannot fit inside it.
- 7Constraint. Demands change capture. A full load or backup without ongoing replication drops every order written after it starts.
- AInstall the AWS Replication Agent on the 12 application servers, use AWS Application Migration Service to replicate them continuously to AWS, launch test instances, and then launch cutover instances during the change window.AnswerCorrect. Continuous block-level replication keeps the AWS copies current, so cutover is a short launch and switch with no code changes. This is a rehost that fits the window.
- BExport the 12 virtual machines from vCenter as OVA files, import them with VM Import/Export, and launch Amazon EC2 instances from the resulting AMIs during the change window.OutEliminated by the 15-minute window. Export and import are point-in-time and take hours for 12 servers, and anything changed after export is missing. It is a rehost, just not a low-downtime one.
- CCreate an AWS DMS full-load task from the on-premises SQL Server database to Amazon RDS for SQL Server. At cutover, stop writes and repoint the application once the load has finished.OutEliminated by the no-lost-orders constraint. Without CDC, orders written after the load starts never reach RDS; stopping writes before the load instead means hours offline. One clause separates it from the correct DMS option.
- DCreate an AWS DMS task with full load and ongoing replication (CDC) from the on-premises SQL Server database to Amazon RDS for SQL Server. At cutover, stop writes and repoint the application once replication has caught up.AnswerCorrect. The full load runs while orders keep flowing, CDC applies every change made since, and the outage lasts only while the final changes drain, which fits the window and loses nothing.
- EUse AWS Application Migration Service to replicate the database server along with the application servers, then cut over all 13 servers together.OutEliminated by the RDS constraint. Application Migration Service lands servers on Amazon EC2, so SQL Server would stay self-managed on an instance rather than running on Amazon RDS.
The lesson: Turn 'minimal downtime' into a cutover window, then reject every option whose cutover contains a bulk copy, export or restore.
The NAT bill nobody planned for
A media analytics company runs nightly batch jobs on 60 Amazon EC2 instances that use Graviton-based instance types in private subnets of a single VPC in us-east-1. Each night the jobs read about 40 TB from Amazon S3 buckets in the same Region and write results back. The instances reach Amazon S3 through NAT gateways in each Availability Zone. AWS Cost Explorer shows that NAT gateway data processing charges are now the largest item on the monthly bill. The jobs are Python scripts that call the default regional S3 endpoint through the AWS SDK. Security policy states that the instances must not have public IP addresses. Every resource already carries a cost-center tag for chargeback. The company wants to cut this cost while making the LEAST amount of change to the application.
Which solution will reduce costs with the LEAST amount of change to the application?
- APurchase a 1-year Compute Savings Plan that covers the nightly usage of the 60 instances.
- BCreate an S3 interface endpoint in each Availability Zone and update the scripts to use the endpoint-specific DNS names.
- CCreate an S3 gateway endpoint in the VPC and associate it with the route tables of the private subnets.
- DMove the instances to public subnets and assign public IP addresses so that S3 traffic uses the internet gateway instead of the NAT gateways.
Decode it and show the answer
A media analytics company runs nightly batch jobs on 60 Amazon EC2 instances that use Graviton-based instance types1 in private subnets of a single VPC in us-east-1. Each night the jobs read about 40 TB from Amazon S3 buckets in the same Region2 and write results back. The instances reach Amazon S3 through NAT gateways3 in each Availability Zone. AWS Cost Explorer shows that NAT gateway data processing charges4 are now the largest item on the monthly bill. The jobs are Python scripts that call the default regional S3 endpoint through the AWS SDK. Security policy states that the instances must not have public IP addresses5. Every resource already carries a cost-center tag for chargeback6. The company wants to cut this cost while making the LEAST amount of change7 to the application.
- 1Noise. Noise. The instance family affects compute price, not the NAT bill. It nudges you toward compute-pricing answers.
- 2Keyword. Same-Region S3 access is exactly what an S3 gateway endpoint serves. Buckets in another Region would not route through one.
- 3Keyword. NAT gateways bill per GB processed. Forty terabytes a night through them is the cost driver the stem is pointing at.
- 4Constraint. Names the line item to fix. Options that cut a different line, such as EC2 compute, answer a different question.
- 5Constraint. Eliminates the shortcut of moving instances to public subnets, even though that would also remove the NAT processing charge.
- 6Noise. Noise. Tags attribute cost to teams; they do not reduce it. None of the options depends on them.
- 7Qualifier. Ranks the survivors. A route-table association beats anything that edits scripts, changes endpoints in code or moves instances.
- APurchase a 1-year Compute Savings Plan that covers the nightly usage of the 60 instances.OutAnswers a different question. A Compute Savings Plan discounts EC2 compute, but the stem names NAT gateway data processing as the cost to cut, and that charge is untouched.
- BCreate an S3 interface endpoint in each Availability Zone and update the scripts to use the endpoint-specific DNS names.OutWorks and keeps traffic private, but interface endpoints add hourly and per-GB charges and this option edits every script. A gateway endpoint does the job at no additional charge and without code changes.
- CCreate an S3 gateway endpoint in the VPC and associate it with the route tables of the private subnets.AnswerCorrect. The gateway endpoint adds a prefix-list route so same-Region S3 traffic bypasses the NAT gateways, carries no additional charge, and needs no code change because the SDK keeps calling the regional endpoint.
- DMove the instances to public subnets and assign public IP addresses so that S3 traffic uses the internet gateway instead of the NAT gateways.OutEliminated by the security constraint. It would remove the NAT processing charge, but the instances must not have public IP addresses.
The lesson: Find the cost line or metric the stem names, and discard options that improve something else, however sensible they look.
Now do it at exam speed
The SAP-C02 app has 2,900+ exam-style questions with an explanation for every option. Read each stem with the routine above and check whether your elimination matches the explanation.
App StoreGoogle PlayFree SAP-C02 practice testKeyword decoder: what the stem is telling you
These phrases recur in SAP-C02 stems. Each one narrows the answer before you read the options.
| When the stem says | It points to | Usually the wrong pick |
|---|---|---|
| Governance | ||
including the root user of each member account | An SCP; identity policies and permission boundaries cannot restrict a root user | IAM policies pushed to every user and role with StackSets |
accounts added to the OU later must be covered automatically | A policy or control attached at the OU, inherited by new accounts | A one-off script or Lambda run against today's account list |
prevent anyone, even administrators, from ... | A preventive control such as an SCP deny, not a detective alert | An AWS Config rule or EventBridge alarm that reports after the fact |
a single view of security findings across all accounts | A delegated administrator account for Security Hub or GuardDuty | Signing in to each account, or custom scripts that copy findings |
share subnets or a transit gateway with other accounts | AWS Resource Access Manager share within the organization | Duplicating the resource per account or peering every VPC pair |
access resources in another account without long-term credentials | An IAM role in the target account, assumed through AWS STS | IAM users with access keys created in each account |
set up a governed multi-account environment quickly | AWS Control Tower landing zone with OUs, controls and Account Factory | A hand-built Organizations structure plus custom account-vending code |
| Migration | ||
migrate the database with minimal downtime | AWS DMS full load plus ongoing replication (CDC), then a short cutover | A full-load-only task, or a backup restored during the window |
rehost the servers without code changes and with minimal downtime | AWS Application Migration Service continuous block-level replication | VM Import/Export of a point-in-time image |
migrate from Oracle to Amazon Aurora PostgreSQL | Schema conversion (DMS Schema Conversion or AWS SCT), then AWS DMS for data | AWS DMS alone; it moves data but does not convert stored procedures |
recurring copy of NFS or SMB shares to Amazon S3, EFS or FSx | AWS DataSync agent with scheduled tasks | Custom rsync scripts on EC2 that the team must monitor |
the application has no active users | Retire: decommission it instead of migrating it | Rehosting it because every server is in the migration scope |
replace the in-house application with a SaaS product | Repurchase: move the data to the SaaS product, then retire the old app | Rehosting or refactoring the in-house code first |
| Cost | ||
MOST cost-effective for a steady 24/7 baseline | Savings Plans or Reserved Instances for the baseline, scaling on top | On-Demand for predictable load, or Spot for stateful servers |
the jobs can tolerate interruption and restart | Spot Instances, diversified across several instance types | Reserved capacity for intermittent, interruptible work |
NAT gateway charges for traffic to Amazon S3 or DynamoDB | A gateway VPC endpoint; there is no additional charge for it | An interface endpoint, which adds hourly and per-GB charges |
map costs to business units for chargeback | Activated cost allocation tags, optionally grouped with AWS Cost Categories | Trusted Advisor checks, which flag savings but do not allocate cost |
identify over-provisioned instances | AWS Compute Optimizer rightsizing recommendations | Buying Savings Plans before rightsizing the fleet |
| Operations | ||
MOST operationally efficient | A managed service or native feature over code you must run and patch | A Lambda function or cron script rebuilding a feature AWS already has |
with the LEAST amount of change | A configuration change to the existing design, not a redesign | Refactoring to containers or serverless when a setting would do |
RPO of seconds and RTO of minutes in another Region | Aurora Global Database or DynamoDB global tables with a warm standby | Backup and restore, whose RPO and RTO run to hours |
The qualifier words
The qualifier decides between options that all work. On the SAP-C02 these words carry a specific meaning:
The fewest things the team must build, run, patch or watch afterwards. Managed services, policies and native features beat custom code, even when the custom option looks cheaper.
One SCP on an OU beats a nightly Lambda function that scans every account and deletes out-of-Region resources.
The cheapest option that still meets every stated constraint. Savings never justify breaking a must, and the cost line the stem names is the one to cut.
A free S3 gateway endpoint beats a Savings Plan when the bill problem is NAT gateway data processing.
The smallest edit to the existing application and architecture. A setting, route or policy change beats a redesign, even when the redesign is better in the long run.
Associating a gateway endpoint with route tables beats rewriting jobs to call a new endpoint name.
Continuous replication with a short final switch. Any option whose cutover includes a bulk copy, export, import or restore loses to one that does not.
AWS DMS full load plus CDC beats a full-load-only task run during a weekend window.
Read the ask. 'Which combination of steps' means the picks form one solution together; 'which solutions' means each pick works on its own. Every pick must be right to score.
Application Migration Service for the servers plus DMS with CDC for the database: two steps, one migration.
How the wrong answers are built
Distractors are not random. Most wrong options on the SAP-C02 fall into one of these patterns:
The near-twin
The tellTwo or three options share almost every word and differ by one clause: attach point, replication mode, endpoint type or purchase option.
Why it temptsYou read the first option carefully, skim the rest, and miss the single clause that breaks a constraint.
The point-in-time copy
The tellA backup, snapshot, image export, full load or device shipment with no ongoing replication behind it.
Why it temptsIt is a real, documented migration method that moves the data correctly. It just cannot fit the cutover window or keep up with new writes.
The right fix for the wrong problem
The tellA sound optimization aimed at a different cost line, metric or tier than the one the stem names.
Why it temptsIt is good practice and would save money or time somewhere, so it feels like a safe pick.
The custom build
The tellA Lambda function, cron job or EC2 fleet that re-creates something a managed feature or policy already does.
Why it temptsIt would work, and long, detailed options look more professional on a professional-level exam.
The constraint-breaking shortcut
The tellThe simplest or cheapest route to the goal that quietly violates a must stated mid-paragraph, such as public IPs or organization-wide scope.
Why it temptsIt solves the headline problem directly, and the violated constraint sits in the middle of a long stem where tired readers skim.
Time budget by question type
| Question type | Budget | Tactic |
|---|---|---|
| Short stem, single answer | 1.5 min | Usually one service-fit decision. Answer it, flag only if genuinely unsure, and bank the time for paragraph-length stems. |
| Long stem (a paragraph or more), single answer | 3 min | Read the ask first, list the constraints, diff the options. If two survive at three minutes, choose one, flag it and move on. |
| Choose two / Choose three | 3.5 min | Decide whether the picks are steps of one solution or independent alternatives, then kill by constraint. All selections must be right for credit. |
| Review of flagged questions | 15-20 min | Reserve this at the end. Revisit only flagged items, and change an answer only when you can name the constraint it breaks. |
How to practise reading, not just content
Knowing the material is half of it. These drills train the reading:
Ask-first reading
Take a long practice question, cover the stem and read only the final sentence and the options. Write down the clauses that differ and the facts that would decide them. Then read the stem and check whether you were hunting for the right facts.
Five-line constraint list
Give yourself 60 seconds per long stem and write its hard constraints as no more than five terse lines: scope, numbers, musts. Compare your list with the explanation; any constraint it used that you missed goes on a personal watch list.
Option diffing
Copy the options of a practice question into columns and strike out every word they share. Answer from the remaining clauses plus your constraint list before reading the explanation. This trains you to spend your time on the clause that differs.
The SAP-C02 at a glance
| Questions | 75 total: 65 scored, 10 unscored (not identified) |
| Time | 180 minutes; +30 min on request for non-native English speakers |
| Passing score | 750 on a 100-1,000 scaled score (compensatory) |
| Question types | Multiple choice (1 of 4); multiple response (2+ of 5+, all must be right) |
| Going back / flagging | Yes: flag for review, move back and forth, review screen at the end |
| Fee | 300 USD |
| Delivery | Pearson VUE test center or online proctored |
Practise the reading, not just the facts
Work SAP-C02 questions by domain on the app or try the free practice test. After each miss, find the phrase in the stem you read past.
App StoreGoogle PlayFree SAP-C02 practice testFAQ
Are these real SAP-C02 exam questions?
No. The three scenarios on this page are original. They were written for this guide to match the style and the published content outline of the SAP-C02 exam guide, not copied from the exam, dump sites, prep vendors or AWS's official sample questions. Their job is to show how a long stem is built so you can practise reading one, not to preview items you will see.
Is SAP-C02 being replaced?
Yes. AWS's certification page says the exam is being updated: registration for the new version, SAP-C03, opens October 27, 2026, and the last day to take SAP-C02 is November 16, 2026. AWS had not published the SAP-C03 exam guide when this page was written. The reading method here does not depend on the version, but check the new guide for content changes before booking SAP-C03.
How much time do I get per SAP-C02 question?
AWS gives 180 minutes for 75 questions, an average of 2.4 minutes each. Ten of the 75 are unscored and are not identified, so treat every question as if it counts. Non-native English speakers taking the exam in English can request a 30-minute extension. Answer short stems well under the average so you have time for paragraph-length stems and Choose two items.
How are Choose two questions scored?
The SAP-C02 exam guide says multiple-response questions have two or more correct responses out of five or more options, and you must select all the correct responses to receive credit, so a half-right answer earns nothing. There is no penalty for guessing, and unanswered questions are scored as incorrect. Never leave one blank; if one pick is certain, use it to work out which option completes the same solution.
Can I flag questions and come back to them?
Yes. AWS's testing policy describes a Flag for Review button, previous and next navigation throughout the exam unless a question says otherwise, and a review screen at the end that lists all, incomplete or flagged questions. Flag long stems where two options survive your time budget. Time spent typing comments on questions comes out of your exam time, so leave comments until the end.
Sources
Figures on this page come from AWS and the other primary sources below:
- AWS Certified Solutions Architect - Professional (certification page)
- AWS Certified Solutions Architect - Professional (SAP-C02) exam guide
- AWS Certification policies: During testing
- AWS Certification policies: Before testing
- AWS Organizations: Service control policies (SCPs)
- IAM User Guide: aws:RequestedRegion and global services
- AWS DMS: Creating tasks for ongoing replication
- Amazon VPC: Gateway endpoints
Checked October 14, 2026. Fees, outlines and eligibility rules change — confirm with AWS before you book.