A six-week plan assuming eight to ten hours a week, written for engineers who already operate AWS in production — the reading is weighted toward the parts of the exam that day-to-day platform work does not touch. If that background is thinner, double the timeline rather than the weekly hours.
The exam
| Code | SAP-C02 |
| Questions | 75, of which 65 are scored |
| Time | 180 minutes |
| Passing score | 750 on a 100 to 1000 scale |
| Cost | 300 USD |
| Valid for | 3 years |
| Format | Multiple choice and multiple response, all long scenarios |
| Prerequisite | None |
Domain weights: organizational complexity 26 percent, design for new solutions 29 percent, continuous improvement 25 percent, migration and modernization 20 percent.
The thing that makes this exam hard is not obscure services. It is that every question has two or three answers that would work, and exactly one that satisfies a constraint buried in the third sentence. You will spend most of your practice time learning to find that constraint, not learning new services.
Where a production background helps and where it does not
Engineers who run AWS day to day are likely already strong on VPC design, EKS and container platform decisions, IaC and deployment strategy, CloudWatch and observability, IAM policy mechanics, cost tagging and Savings Plans.
Likely thin, and where the marginal study hour pays best:
- Migration tooling. Application Discovery Service, Migration Hub, Application Migration Service, DMS with SCT, Snow Family sizing, the 7Rs vocabulary. This is 20 percent of the exam and it is mostly service trivia you cannot reason your way to.
- Hybrid networking specifics. Direct Connect resiliency models, virtual interface types, Direct Connect gateway limits, Route 53 Resolver endpoint direction, Transit Gateway route table propagation and association.
- Disaster recovery by the numbers. The four named strategies and which RTO and RPO each one actually delivers.
- Windows and commercial workloads. FSx for Windows, AWS Managed Microsoft AD, License Manager, Babelfish, Dedicated Hosts for BYOL.
- Elastic Disaster Recovery and AWS Backup, including Vault Lock modes.
Weekly rhythm
Three sessions of two to three hours works better than one long block. A repeatable shape:
- Read the AWS documentation or FAQ for the session’s topic, 60 to 90 minutes.
- Build something small, 60 minutes. Terraform is fine and often faster than the console, but build at least a few things in the console so you recognize the option names the exam uses.
- Answer 15 to 20 practice questions and read every explanation, including for the ones you got right. 45 minutes.
The third step is the one people skip and it is the one that moves the score.
The plan
Week 1, calibration and organizational complexity
Read the official exam guide end to end, including the in-scope service list. Anything on that list you cannot describe in a sentence is a gap to note.
Then Domain 1 in both halves. Hybrid and multi-VPC connectivity: Transit Gateway route tables, associations and propagations, inter-Region peering, Direct Connect gateway and transit virtual interfaces, the four Direct Connect resiliency models, PrivateLink versus peering versus Transit Gateway, Route 53 Resolver inbound and outbound endpoints. And multi-account governance: AWS Organizations, OU design, SCP evaluation logic including how SCPs intersect with IAM rather than granting anything, Control Tower landing zone components, IAM Identity Center permission sets, Resource Access Manager and VPC sharing, centralized CloudTrail, Config aggregators, and Security Hub and GuardDuty delegated administration.
Build: a Transit Gateway with two VPCs and segmented route tables so a shared services VPC reaches both spokes but the spokes cannot reach each other. If time allows, an SCP restricting a sandbox OU to two Regions with the correct global-service carve-out.
Checkpoint: drill Domain 1 practice questions until comfortable — this domain is where the exam separates professional from associate.
Week 2, disaster recovery, reliability, and security depth
Read the Disaster Recovery of Workloads on AWS whitepaper. Learn the four strategies with their actual RTO and RPO ranges. Aurora global database, DynamoDB global tables, cross-Region snapshot copy, S3 replication including Batch Replication for existing objects, AWS Backup with Vault Lock, Elastic Disaster Recovery. Then the Reliability Pillar: static stability, failure isolation boundaries, cell-based design, service quotas as a failure mode, health check design, Route 53 versus Global Accelerator for failover.
Security depth: KMS key policies, grants, cross-account key use, multi-Region keys, custom key stores with CloudHSM. Secrets Manager rotation versus Parameter Store. IAM Access Analyzer for external and unused access. Shield Advanced, WAF, Firewall Manager, Network Firewall versus security groups versus network ACLs versus Gateway Load Balancer, and ACM including private CA.
Build: fail over an Aurora global database and time it, or work a cross-account KMS key until the key policy and IAM policy interaction is boring.
Checkpoint: a first full timed mock. Expect a rough result. Log every miss by domain and task.
Week 3, migration and modernization
This is the biggest-gap week — protect it from work overrun. Application Discovery Service collector types and what each one gathers, Migration Hub, Application Migration Service, Elastic Disaster Recovery, DMS full load and change data capture, Schema Conversion Tool, Snow Family device capacities, DataSync versus Storage Gateway versus Transfer Family versus S3 Transfer Acceleration.
Practise the bandwidth arithmetic until it is instant. Terabytes over a link in days is a question type, not a concept. One useful rule: at 1 Gbps with perfect utilisation you move roughly 10 TB per day, so scale from there and apply the utilisation percentage the question gives you. Learn the 7Rs by name and be able to give a one-line trigger for each.
Then modernization targets: ECS versus EKS versus Fargate versus App Runner and when each is the exam’s answer, serverless patterns with EventBridge, SQS, SNS, and Step Functions, and purpose-built databases with the trigger phrase for each.
Build: run a DMS task from a small RDS MySQL instance to Aurora PostgreSQL with SCT, just to see the assessment report.
Checkpoint: drill Domain 4 questions until it is your strongest domain rather than your weakest.
Week 4, performance, cost, and operations
Performance: caching layers, ElastiCache strategies, DAX, CloudFront behaviours and functions, storage performance across EBS volume type ceilings, FSx variants, and EFS modes.
Cost: Savings Plans versus Reserved Instance types, Cost and Usage Report with Athena, Cost Anomaly Detection, Budgets and budget actions, Compute Optimizer, S3 Storage Lens, data transfer pricing including NAT gateway processing, cross-AZ charges, and VPC endpoint economics.
Operations: Config with conformance packs and Automation remediation, Systems Manager across State Manager, Patch Manager, Session Manager and Automation, CloudWatch Synthetics, and deployment strategies with alarm-triggered rollback.
Checkpoint: a second full timed mock. You want 70 percent or better here. If you are below 60, the problem is usually reading speed and constraint spotting rather than knowledge.
Week 5, consolidation
No new material. Weak-areas practice until the misses stop repeating. Re-read the exam guide’s task statements and, for each one, say out loud which services answer it. Any task statement where you hesitate gets an hour.
Take the AWS official practice question set on Skill Builder if you have not already, and take one more timed mock.
Week 6, exam week
Two light sessions of review earlier in the week. Nothing new after Wednesday. Sit the exam.
Booking and logistics
Book the exam in week 2 or 3, for a date in week 6. A date on the calendar changes how you study, and you can reschedule once without a fee up to 24 hours before.
Pearson VUE test centre or online proctoring both work. If you take it online, the check-in is fussy about a clear desk and lighting, so do the system test in advance.
180 minutes for 75 long questions is about 2 minutes 20 seconds each. Flag anything you are not sure of within 90 seconds and move on. Most people finish with 20 to 40 minutes left and spend it on flagged questions.
If you already hold an active AWS certification, check your AWS Certification account for a 50 percent discount voucher before you pay.
Reading list, in priority order
- The SAP-C02 exam guide itself, including the in-scope service list.
- Disaster Recovery of Workloads on AWS whitepaper.
- AWS Well-Architected Framework, Reliability and Security pillars.
- Building a Scalable and Secure Multi-VPC AWS Network Infrastructure whitepaper.
- Service FAQs for Transit Gateway, Direct Connect, Organizations, DMS, Aurora, DynamoDB, S3. FAQs are dense in exactly the distinguishing details the exam tests.
- Amazon Builders’ Library, particularly the articles on timeouts and retries, static stability, and workload isolation.
How to know you are ready
Not a percentage on a practice test. The signal is that when you read a scenario, you can name the constraint that decides it before you look at the options. When that happens consistently, book the exam if you have not already.