AWS Solutions Architect Professional Course Notes

SAP-C02 multi-account design starts by deciding where governance boundaries belong. AWS Organizations gives the account hierarchy, AWS Control Tower creates a governed landing zone, and SCPs set maximum permissions for accounts or OUs. Use separate accounts to reduce blast radius for production, security tooling, shared services, logging, and regulated workloads instead of trying to separate everything with IAM policies inside one account.

• Using SCPs as if they grant permissions when they only set maximum permissions for accounts and OUs.

• Use separate accounts and OUs to reduce blast radius and apply governance boundaries.

Resilience design starts with failure domains and recovery targets. Multi-AZ patterns reduce local infrastructure failure inside a Region, while multi-Region patterns address regional isolation, customer proximity, and stricter recovery objectives. A workload with minutes of RTO and low RPO usually needs warm or active recovery architecture rather than backup-only recovery.

• Choosing backup-only recovery for workloads with low RTO or low RPO requirements.

• Map every DR answer to RTO, RPO, failure domain, and consistency needs.

Security design for SAP-C02 is about choosing the control at the right layer. The Well-Architected Security Pillar frames identity, detection, infrastructure protection, data protection, and incident response as separate design concerns. A mature design does not rely on one perimeter; it limits identity scope, protects network paths, encrypts data, rotates secrets, and leaves usable evidence when something fails.

• Using Direct Connect alone when the requirement specifically needs encrypted tunnels over the dedicated connection.

• Use VPN over Direct Connect when encryption is required over dedicated connectivity.

Enterprise network design starts by choosing where routing decisions are centralized. Transit Gateway is the hub for many VPCs, VPNs, and Direct Connect attachments when point-to-point peering becomes unmanageable. A shared services VPC can host inspection, directory, DNS, and tooling services, but the design must control which spokes can reach it and which east-west paths are allowed.

• Building full-mesh VPC peering when Transit Gateway is the scalable hub for many VPCs and hybrid attachments.

• Transit Gateway is the scalable private routing hub; Global Accelerator improves public application entry.

Modernization strategy starts with a migration portfolio, not with a tool. Migration wave planning groups applications by dependency, business risk, data gravity, identity coupling, and rollback tolerance. Application Discovery Service helps collect server and dependency data, while Migration Hub gives progress visibility across migration work, but neither service decides whether a workload should be rehosted, replatformed, or refactored.

• Starting with AWS DMS or Migration Hub before dependency mapping and migration wave planning are clear.

• Discovery and dependency mapping come before migration wave sequencing.

SAP-C02 cost design starts with workload behavior. Savings Plans fit steady compute commitment across supported services, while Spot Instances fit interruption-tolerant compute and Instance Scheduler fits predictable nonproduction shutdown windows. These choices reduce different kinds of waste, so the answer should follow whether usage is steady, flexible, or time-bound.

• Buying Savings Plans before proving steady eligible usage with cost and utilization evidence.

• Savings Plans fit steady eligible compute usage; Spot fits interruption-tolerant workloads.