AWS Certified Solutions Architect Professional (SAP-C02) Exam Guide (2026)

If you can say why a Transit Gateway is the hub instead of a peering mesh, which of the seven migration strategies still keeps the same database engine, and what RTO actually forces a warm standby instead of a backup plan, you are in the right exam.

SAP-C02 is the current AWS Solutions Architect Professional code. It replaced SAP-C01 on 15 November 2022. The official exam guides index still lists SAP-C02 as the professional Solutions Architect sitting. The September 2026 Training and Certification blog names SAP-C03 for general availability on 17 November 2026. The last day to sit SAP-C02 on that blog is 16 November 2026.

This guide is for people who will sit SAP-C02 on the current blueprint, including Design for New Solutions as the heaviest domain, organizational complexity as the multi-account and hybrid-network home, and migration work that continues into modernization.

Who this exam is for

Take it if the job is already the architecture across more than one application and more than one account. The exam guide describes the target candidate as having 2 or more years using AWS services to design and implement cloud solutions. That person evaluates requirements, recommends a deployment architecture, and gives guidance that stretches across projects inside a complex organization. The certification page repeats that mix.

The recommended knowledge list is a gap check. Multi-account governance. Hybrid connectivity. Well-Architected tradeoffs on a live workload. If those are not already weekly work, sit Solutions Architect Associate first. The 2022 Training and Certification blog that opened C02 says the same thing for people whose experience is still on-premises or another cloud.

Three job tasks are explicitly out of scope. Frontend development for mobile apps. 12-factor app methodology. In-depth knowledge of operating systems. Security still appears, as IAM at organization scale, encryption, and centralized audit. Operating systems still appear, as the thing you stop patching when a managed service is the better fit. Application code still appears, as the artifact a pipeline ships or a 7 R decision modernizes. The sitting punishes people who treat those stems as a chance to write a screen or tune a kernel.

Skip it if the work is one account and one VPC with no hybrid path. That is still Associate ground. Skip it if the question you actually want answered is how to operate the fleet after the design is live. That is CloudOps. Skip it if the stem is a failed deploy and the answer is a log line. Troubleshooting was removed from this outline on purpose. The 2022 blog sends that work to Developer Associate and CloudOps or SysOps Associate.

The candidate AWS wants can read a stem and name the constraint. Account boundary, network path, recovery objective, or migration strategy. Then pick the service that matches that constraint. The sitting punishes people who recognize a service logo but cannot say which constraint the question is actually asking about.

Exam shape

SAP-C02 has four domains:

Design for New Solutions is the single heaviest domain at 29%. Organizational Complexity is next at 26%. Those two carry 55% of the scored content. If a study plan gives equal calendar time to all four, the math is already against you.

The sitting is 75 questions over 180 minutes. AWS scores 65 of them. Ten are unscored research questions, they are not identified on the exam, and they do not affect the result. The cost is 300 USD.

The passing score is 750 on a scaled range of 100 to 1,000. That matches several other professional and specialty sittings and is higher than the 720 used on several AWS associate exams. Scoring is compensatory, so a weak Domain 4 can still pass if Domain 2 is clean. Unanswered questions score as incorrect and there is no separate penalty for guessing, so leave nothing blank.

The exam guide lists two question types:

1. Multiple choice. One correct response and three distractors.
2. Multiple response. Two or more correct responses out of five or more options.

The marketing overview box agrees. Unlike Security Specialty, this outline does not add ordering or matching. Prepare for stems that ask for one action and stems that ask for a combination.

Languages are English, Japanese, Korean, Portuguese (Brazil), Simplified Chinese, and Spanish (Latin America). The credential lasts 3 years. Recertify by passing the latest version of this exam, or maintain it for one year on AWS Skill Builder. Passing this exam recertifies Solutions Architect Associate.

One practical detail from the certification page: the exam uses short names for some AWS services, and a short name to full name list is available behind the Help button during the sitting. Read that list before exam day so the abbreviations do not cost reading time.

The current exam guide also lists emerging topics. Those items can appear as pretest questions. They do not affect the score. The named skills are Bedrock Guardrails, AgentCore Identity, and Step Functions for human oversight of AI operations. They are not a fifth scored domain. Study the four scored domains.

What changed from SAP-C01 to SAP-C02

The Training and Certification blog that opened registration is the official delta. C01 last sat on 14 November 2022. C02 first sat on 15 November 2022. The domain names stayed close. The job of the sitting moved.

The blog names three changes to act on:

• Modernization and acceleration of migrations gained weight. Domain 4 is not "lift and stop." After the move, the outline still asks for serverless, containers, purpose-built databases, and decoupling.
• Troubleshooting left the domains. The sitting is architecting aligned to the AWS Well-Architected Framework. A stem that wants a log filter or a failed CodeDeploy root cause belongs on Developer Associate or CloudOps, not here.
• Cost Control stopped being its own domain. Cost now lives in Domain 1 as visibility and tagging, in Domain 2 as a design strategy for a new workload, and in Domain 3 as improvement of an existing bill. A C01 habit of saving cost for last will miss scored items in every other domain.

The current C02 weights are the part to plan around.

C01 study notes still cover Organizations, VPC design, and Well-Architected reviews. They are thin on cost as a habit inside every domain, on troubleshooting being out of scope, and on post-migration modernization as scored Domain 4 work.

The 2026 calendar did change the code, but not yet. Sit C02 through 16 November 2026. SAP-C03 begins on 17 November 2026. The full C03 outline is scheduled to land when registration opens on 27 October 2026. This page is the C02 sitting.

How a multi-account network gets picked

Domain 1 is not a logo list. It is a constraint list. The stem will tell you how many VPCs exist, whether on-premises is already in the path, and whether the accounts share a bill or only a peering request.

Two VPCs that need to talk can use VPC peering. That path does not transit. It also does not stay sane once the stem names six VPCs, a Direct Connect pipe, and a VPN backup. Transit Gateway is the hub that interconnects VPCs and on-premises networks. Attachments include VPCs, Direct Connect gateways, VPN connections, and peering to another transit gateway. Each attachment associates with exactly one transit gateway route table. If the stem already said "transitive routing," peering is already the wrong family.

Hybrid DNS sits next to that choice. Route 53 Resolver is the named tool for on-premises DNS integration. Service endpoints are the named path when the constraint is private access to an AWS API, not another VPC.

The account model is the other half of Domain 1. AWS Organizations gives you a management account, member accounts, a root, and OUs. All features mode is what turns on SCPs and service integrations. An SCP is a permissions ceiling on principals in member accounts. It does not apply to the management account. Control Tower orchestrates Organizations, Service Catalog, and IAM Identity Center into a landing zone with Account Factory. RAM shares a resource across accounts or OUs without copying it. Sharing inside an enabled organization does not wait on an invitation. Sharing only by attaching a resource-based policy does not give RAM console visibility.

Cost in this domain is visibility, not a pricing-page quiz. Tag so Cost Explorer can map spend to a business unit. Trusted Advisor, Budgets, Compute Optimizer, and S3 Storage Lens are the named watchers. Reserved Instances, Savings Plans, and Spot change the bill only after the architecture is already legal.

How RTO and RPO pick a recovery

Domain 1.3 and Domain 2.2 use the same four families. The constraint is the number, not the service logo.

The disaster recovery whitepaper names backup and restore, pilot light, warm standby, and multi-site active/active. The exam outline uses the same four. A well-architected multi-AZ design can treat loss of one data center as backup and restore. A Regional disaster, or a regulatory requirement that names a second Region, pushes the sitting to pilot light, warm standby, or multi-site.

Read the numbers before the options. A long RTO and a loose RPO is backup and restore. Infrastructure as code rebuilds the stack. AWS Backup copies the data. Pilot light keeps data replication and core infrastructure warm and leaves application servers off until failover. Warm standby keeps a scaled-down production stack running. Multi-site serves traffic from more than one Region before the event. Elastic Disaster Recovery is the named lift for a host-level recovery when the stem is an existing server, not a cloud-native replica.

Route 53 is how users find the surviving stack. Latency-based routing sends a client to the closest healthy Region. Geolocation routing sends a client based on where the user sits. Failover routing is the active-passive DNS pair. Simple routing is one record and no health-based cut. If the stem already named an RTO in minutes and the option is "restore from an S3 snapshot after the event," that option is already too slow.

Domain 2 also asks you to test the failover. A design that has never failed over is not a design the outline will reward. Prefer data-plane operations for the cut itself. Control-plane creates during an event are the trap.

How to study without wasting a month

Order the weeks by weight, not by the order the domains are printed in.

Week 1. Design for New Solutions, because it is 29%. Draw one greenfield workload and keep it. CloudFormation or another IaC path, a CI/CD rollback, a managed service where patching used to be the job. Write the RTO and the RPO on the DR box before you pick Elastic Disaster Recovery, a read replica, or a Route 53 record. Add least-privilege IAM, security groups, and a WAF or Shield control when the stem is a public app. Finish the week with the cost strategy for that same workload. Storage tiering and data-transfer modeling belong here, not in a later "cost week."

Week 2. Organizational Complexity, 26%. One organization. A management account that does not run production. Member accounts in OUs. An SCP on the OU, not on the management account. Control Tower as the landing zone when the stem wants Account Factory and controls. Transit Gateway as the hub when the stem already named many VPCs or a hybrid path. RAM when the resource should exist once. Route 53 Resolver when DNS has to cross the same path. Tag every account so Domain 1.5 has something to report.

Week 3. Continuous Improvement, 25%. Domain 3 is the same Well-Architected pillars, pointed at a stack that already exists. CloudWatch, Config rules, and Systems Manager for operations. Secrets Manager and least-privilege audits for security. Global Accelerator or CloudFront when the bottleneck is distance. Auto scaling and a removed single point of failure for reliability. Cost and Usage Reports and a billing alarm for the bill you already have. The trap is answering a Domain 3 stem with a greenfield redesign. The outline wants the next improvement, not a new account.

Week 4. Migration and modernization, 20%. Memorize the 7 Rs as decisions, not as a poster. Retire and retain stay on-premises on purpose. Rehost is lift and shift, often Application Migration Service. Relocate moves to a cloud version of the same platform, or to another VPC, Region, or account. Repurchase replaces the product. Replatform changes the platform under the same app, such as SQL Server to RDS. Refactor or re-architect modernizes during the move and is the expensive option. The large-migration guide tells you to rehost, relocate, or replatform first, then modernize after the cut. Domain 4.4 is that second move: Lambda, containers, Aurora Serverless or DynamoDB, SQS, SNS, EventBridge, and Step Functions.

Do not spend the month building a second organization "for the cert." Spend it reading stems and naming the constraint before looking at the options.

Traps that look like easy elimination

Professional items rarely give you one plausible answer and three absurd ones. They give you two architectures that both work and one constraint that picks between them.

• VPC peering is point to point. It does not transit. Transit Gateway is the hub once the stem names many VPCs or an on-premises attachment.
• An SCP limits principals in member accounts. It does not limit the management account. A permissions boundary limits what a delegated admin can grant. A resource policy speaks for the resource. They are not interchangeable.
• RAM shares one resource. Recreating the same subnet or the same transit gateway in every account is the trap.
• Multi-AZ is not multi-Region. Loss of one Availability Zone is not the same disaster as loss of a Region.
• Backup and restore, pilot light, warm standby, and multi-site are picked by RTO and RPO. A multi-site option on a 24-hour RTO is usually overbuilt. A backup option on a 15-minute RTO is usually too slow.
• Domain 2 designs a new solution. Domain 3 improves an existing one. "Create a new account and rebuild" is rarely the Domain 3 answer.
• Cost is scored in Domains 1, 2, and 3. Saving it for a fictional fifth domain leaves points on the table.
• Rehost keeps the app. Replatform changes the platform. Refactor changes the architecture. A stem that wants RDS under the same schema is replatform, not refactor.
• Application Migration Service moves servers. DMS and SCT move databases. DataSync, Transfer Family, Snow Family, and S3 Transfer Acceleration move files. The tool follows the payload.
• Troubleshooting a failed deploy is out of scope for this candidate. If an option asks you to read a log line or rewrite application code, look for the architecture or the migration decision instead.
• Bedrock Guardrails and AgentCore Identity appear as unscored emerging-topic items. They do not replace Organizations, Transit Gateway, or the 7 Rs on the scored outline.

If deleting the scenario still lets you pick the answer from the service name, the question is easier than the live exam.

How this maps to CloudFluently

Start with the official outline. The AWS Certified Solutions Architect Professional (SAP-C02) exam guide carries the task statements and weights. Domain pages sit next to it for Organizational Complexity, New Solutions, Continuous Improvement, and Migration and Modernization. The certification page carries the logistics. The October 2022 update post carries the C01 to C02 map. The September 2026 certification update carries the C03 date. Browse the AWS certification prep index for the official practice question set and pretest.

Solutions Architect Professional sits on top of associate and specialty ground, and that ground is already live here. Domain 1 and Domain 2 assume VPC, multi-AZ, Route 53, and Well-Architected tradeoffs are already reflexes, which is the AWS Solutions Architect Associate practice exam sets and the Solutions Architect Associate study notes. Domain 2.1 and Domain 4.4 assume CloudFormation, CI/CD, and application decoupling are already reflexes, which is the AWS Developer Associate practice exam sets and the Developer Associate study notes. Domain 3 assumes CloudWatch, Config, and Systems Manager are already reflexes, which is the AWS CloudOps Associate practice exam sets and the CloudOps Associate study notes. Domain 1.2 and Domain 2.3 assume IAM, KMS, GuardDuty, and Security Hub are already reflexes, which is the AWS Security Specialty SCS-C03 practice exam sets and the Security Specialty SCS-C03 study notes.

Work those banks until the fundamentals are automatic, then use this page and the official outline for the professional-only skills: Transit Gateway versus peering, Organizations and Control Tower, RTO-driven recovery, the Domain 2 and Domain 3 split, and the 7 Rs through modernization.

Frequently Asked Questions

Is the exam code still SAP-C02 in 2026? Yes, through 16 November 2026. The exam guides index lists SAP-C02 as the professional Solutions Architect sitting. The September 2026 Training and Certification blog names 16 November 2026 as the last SAP-C02 day and 17 November 2026 as the first SAP-C03 day. SAP-C01 ended on 14 November 2022. SAP-C02 began on 15 November 2022.

What is the passing score? 750 on a scaled range of 100 to 1,000. Scoring is compensatory, so there is no per-domain pass requirement.

How many questions count? Sixty-five scored questions. Ten additional unscored research questions are included and are not identified on the exam. The sitting is 75 questions over 180 minutes and costs 300 USD.

Are there ordering and matching questions? The SAP-C02 exam guide lists two response types: multiple choice and multiple response. The marketing overview box says the same. Prepare for both. Do not study this sitting as if it added the ordering and matching forms that appear on some newer outlines.

Which domain is heaviest? Design for New Solutions at 29%. Design Solutions for Organizational Complexity follows at 26%.

Does passing this exam recertify an associate? Yes. The recertification page says passing the latest Solutions Architect Professional exam recertifies Solutions Architect Associate.

Do SAP-C01 study notes still work? Partly. Multi-account design, VPC patterns, and Well-Architected reviews carry over. They are thin on cost as a habit inside every domain, on troubleshooting being out of scope, and on modernization as scored Domain 4 work after the migration.

Where is the official outline? AWS Certified Solutions Architect Professional (SAP-C02). Use AWS for task statements and weights. Use this page for what changed and how to sequence the study.