Design for New Solutions – SAP-C02 Study Guide
This is the largest domain (29% of the exam) and covers architecting new workloads that are secure, reliable, high-performing, and cost-optimized — the AWS Well-Architected pillars applied to greenfield design. Expect scenarios asking for the best combination of compute, storage, database, networking, decoupling, DR, and cost choices. Know the DR spectrum and the messaging/decoupling services cold; they appear constantly.
Reliability and Resilience
- Multi-AZ compute — Auto Scaling group across AZs behind an ELB with health checks; survives an AZ failure with no downtime.
- Multi-AZ data — RDS Multi-AZ (synchronous standby + automatic failover); DynamoDB is inherently multi-AZ.
- Decoupling — insert SQS (buffer/queue, point-to-point) or SNS (pub/sub fan-out to many subscribers) so component failures don't cascade and spikes are absorbed.
Disaster recovery spectrum (increasing readiness and cost):
| Strategy | RTO/RPO | Cost |
|---|---|---|
| Backup & restore | Hours | Lowest |
| Pilot light | Tens of minutes | Low |
| Warm standby | Minutes | Medium |
| Multi-site active-active | Near zero | Highest |
Match the strategy to the stated RTO/RPO — a minutes-level RTO with seconds-level RPO points to warm standby or active-active, not backups.
Security
- Encryption — AWS KMS for auditable, rotatable keys integrated with S3, EBS, RDS; use customer-managed keys for control.
- Identity — IAM roles (never long-lived keys in code); least privilege.
- Network segmentation — tier-to-tier security groups (referencing each other), private subnets, NACLs so only intended paths exist.
- Edge protection — AWS WAF on CloudFront/ALB; Shield for DDoS.
Unlock with a paid plan
4 more sections (about 243 words) continue below. Every paid plan unlocks all SAP-C02 study guides, the full question bank and mock exams, from $4.97/month.