SAP-C02 study plan

Your step-by-step plan

1. Map the four domains and book a date

   Day 1

   Read the official AWS exam guide and the four domains with their weights. Book a provisional date now: a fixed date converts open-ended study into a plan and is the strongest predictor of actually sitting. Note that Design for New Solutions and Design Solutions for Organizational Complexity are the two heaviest domains and together carry over half the marks, so plan the deepest study there. Be honest about the jump from associate: this exam reads long multi-constraint scenarios, not single-service questions.

2. Build the estate-scale decision trees

   Week 1

   Before drilling any domain, build the cross-service decision trees the whole exam rests on: connectivity (Transit Gateway versus PrivateLink versus peering), governance (SCP versus permission boundary versus Config), safe deployment (CloudFormation change set), event-driven auto-remediation (EventBridge to Systems Manager Automation), migration tooling (MGN versus DMS and the 7Rs), and the disaster-recovery ladder against RTO and RPO. Use the recall prompts in this guide: cover the answer, choose the design from the constraint, then reveal. If you cannot pick from the requirement alone, you do not own it yet.

3. Go deep on organisational complexity (Domain 1)

   Weeks 1 to 2

   This is where associate intuition runs out, so it gets early, heavy time. Drill multi-account connectivity, the SCP-as-preventative-guardrail reflex, AWS Control Tower landing zones, centralised security and logging, AWS Backup across accounts and Regions, and cost-allocation tagging with Organizations tag policies. Practise on full scenario questions and read the worked explanation on every one, including the ones you got right, naming the constraint that picked the answer and the reason each distractor fails.

4. Master new-solution design (Domain 2)

   Weeks 2 to 3

   The largest domain by weight, so it earns the most practice. Fix safe deployment with CloudFormation change sets, layered least-privilege access (interface endpoint security group plus VPC endpoint policy), managed and serverless scaling for spiky load, multi-AZ and multi-Region resilience with Route 53 routing, and edge attack mitigation with WAF, Shield and GuardDuty. Drill the multiple-response questions until you reliably pick both correct halves, because a half-right pairing scores nothing.

5. Lock continuous improvement and migration (Domains 3 and 4)

   Weeks 3 to 4

   Treat the event-driven auto-remediation pattern (finding to EventBridge to Systems Manager Automation) as the spine of Domain 3, alongside CloudWatch anomaly detection, Secrets Manager rotation including custom rotation Lambdas, and right-sizing with Compute Optimizer. For Domain 4, memorise the 7Rs, the MGN-versus-DMS split, DataSync versus Snow Family by volume, and EventBridge as the cross-account SaaS event router. Do the trickiest discriminations by hand until the constraint alone decides them.

6. Drill weak domains, then space the review

   Week 5

   Use your per-domain accuracy to attack the domains dragging you down, not to re-read what you already know. Then space it: revisit each domain's recall prompts after a few days and again a week later. Spacing roughly doubles what sticks compared with cramming, and on a professional exam with this much surface area it is the cheapest gain available before the exam.

7. Sit a timed mock and calibrate

   Weeks 5 to 6

   Take at least one full timed mock under exam conditions to rehearse pacing across long stems and the flag-and-return habit, because reading fatigue is real over a professional-length paper. Treat the score as a per-domain readiness signal, not a single number, and review every missed question, naming the binding constraint you misread, before you book or sit.

Frequently asked questions