AWS SAP · Domain 1 of 4

AWS SAP Domain 1: Design Solutions for Organizational Complexity

This domain tests enterprise-scale design: connecting and governing many AWS accounts, VPCs and on-premises networks at once. It covers network connectivity strategies, cross-account security controls, reliable multi-account architectures and the design of a well-governed multi-account environment.

Exam weight
26%
Official task statements
4
Estimated questions estimate
~17
Suggested study time estimate
35–50 hrs

About 11 min read Reviewed October 2026

Overview

Design Solutions for Organizational Complexity is where SAP-C02 separates a senior architect from an associate. It has four task statements. Architecting network connectivity covers connecting many VPCs and on-premises networks with Transit Gateway, PrivateLink, VPC peering, Direct Connect and VPN, hybrid DNS, and sharing resources across accounts with Resource Access Manager. Prescribing security controls covers cross-account IAM, service control policies, and centralized governance. Designing reliable architectures covers multi-account resilience, central logging and backup. Designing a multi-account environment covers AWS Organizations, organizational units, landing zones and Control Tower.

At 26%, this is the second-heaviest domain. Its questions give a complex enterprise scenario with competing constraints and ask for the design that best satisfies them. The exam rewards knowing when to use Transit Gateway versus peering, how service control policies and IAM interact, and how to share resources with Resource Access Manager, which is a frequent missing piece in wrong answers.

How it's tested

SAP-C02 questions are long scenarios with competing constraints, asking for the design that BEST meets all of them, often where several options technically work. In this domain they describe a multi-account or multi-network situation and reward the most scalable, well-governed connectivity and control design. Read every constraint before choosing.

  • Scale the connectivity

    A many-VPC or hybrid scenario is described, and you choose Transit Gateway, PrivateLink or Direct Connect over point-to-point options.

  • Govern across accounts

    A multi-account governance need is described, and you choose Organizations, service control policies and cross-account roles.

  • Share the resource

    A cross-account resource-sharing need is described, and you choose Resource Access Manager.

Reasoning it through

A company has twenty VPCs across several accounts that must all communicate, plus an on-premises data center. A full mesh of VPC peering would require many connections and does not scale or route transitively. AWS Transit Gateway acts as a central hub connecting all VPCs and, via Direct Connect or VPN, the data center, with centralized routing, which is the scalable enterprise answer the exam expects over a peering mesh.

Task statements 4

Official task statements from the Amazon Web Services outline, in outline order.

1.1 Architect network connectivity strategiesTransit Gateway, PrivateLink, peering, Direct Connect, VPN, hybrid DNS and Resource Access Manager.
What it means
This covers connecting multiple VPCs and on-premises networks: Transit Gateway hub-and-spoke topologies, VPC peering, AWS PrivateLink for private service access, Direct Connect and VPN for hybrid connectivity, hybrid DNS with Route 53 Resolver, transitive routing, and sharing network resources across accounts with AWS Resource Access Manager (RAM).
What to understand
Transit Gateway scales many-VPC and hybrid connectivity centrally, where a peering mesh does not and is not transitive. PrivateLink exposes a service privately through a Network Load Balancer. Resource Access Manager shares subnets, Transit Gateways and other resources across accounts, which is a common missing element in wrong answers. Direct Connect gives consistent bandwidth; VPN is encrypted over the internet.
How it shows up
A multi-VPC or hybrid scenario is described, and you must choose the scalable connectivity design and remember Resource Access Manager for sharing.
Common confusion
Using VPC peering for a large mesh; peering is point-to-point and non-transitive, while Transit Gateway connects many networks centrally.
1.2 Prescribe security controlsCross-account IAM, service control policies, and centralized governance.
What it means
This covers cross-account access with IAM roles and role assumption, service control policies for organization-wide guardrails, permission boundaries, centralized identity with IAM Identity Center, and governance across many accounts, including allow-list versus deny-list SCP strategies.
What to understand
Service control policies cap the maximum permissions for accounts in an organization and never grant access themselves, while IAM policies grant permissions to identities. Cross-account access uses role assumption with least privilege. The deny-list strategy allows broadly at the root and denies specific actions in child OUs, while the allow-list strategy denies broadly and allows specific services, a real architectural choice the exam tests.
How it shows up
A cross-account or governance requirement is described, and you must choose SCPs, cross-account roles or the right guardrail strategy.
Common confusion
Confusing service control policies with IAM policies; SCPs set guardrails, while IAM policies grant permissions.
1.3 Design reliable and resilient architecturesMulti-account resilience, central logging and backup strategies.
What it means
This covers designing reliability across accounts and Regions, centralized logging and event notifications, cross-account and cross-Region backup with AWS Backup, disaster-recovery strategies at enterprise scale, and designing for recovery objectives across a multi-account estate.
What to understand
At enterprise scale, logging, backup and recovery are centralized across accounts for consistency and auditability. Cross-Region and cross-account backup protect against account-level and Regional failures. Disaster-recovery strategy still follows RTO and RPO, but must be designed for many accounts and shared services.
How it shows up
A multi-account reliability requirement is described, and you must choose centralized logging, backup or the recovery strategy.
Common confusion
Designing reliability per account rather than centralizing logging, backup and recovery across the organization.
1.4 Design a multi-account AWS environmentOrganizations, organizational units, landing zones and Control Tower.
What it means
This covers AWS Organizations, structuring accounts into organizational units, consolidated billing, landing zones, AWS Control Tower for governed multi-account setup, and account vending for new accounts with guardrails.
What to understand
Organizations groups accounts into organizational units to apply policies and billing centrally. A landing zone, often set up with Control Tower, provides a secure, governed multi-account foundation with guardrails, centralized logging and account provisioning. Separating workloads into accounts provides blast-radius isolation and clear governance boundaries.
How it shows up
A multi-account setup or governance requirement is described, and you must choose Organizations, organizational units, a landing zone or Control Tower.
Common confusion
Confusing Control Tower with Organizations; Organizations is the account grouping and policy service, while Control Tower sets up a governed landing zone on top of it.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Transit Gateway

    A central hub connecting many VPCs and on-premises networks.

    Remember
    It scales where a peering mesh does not and supports transitive routing.
    Tested as
    Connectivity questions.
    Trap
    Using peering for many VPCs.

  • VPC peering

    A point-to-point connection between two VPCs.

    Remember
    It is not transitive and does not scale to a large mesh.
    Tested as
    Connectivity questions.
    Trap
    Expecting transitive routing through peering.

  • AWS PrivateLink

    Private access to a service through a Network Load Balancer endpoint.

    Remember
    It exposes a specific service privately, not a whole network.
    Tested as
    Private connectivity questions.
    Trap
    Confusing it with peering or Transit Gateway.

  • Resource Access Manager (RAM)

    Shares resources such as subnets and Transit Gateways across accounts.

    Remember
    It is the common missing piece in cross-account sharing answers.
    Tested as
    Sharing questions.
    Trap
    Forgetting RAM when sharing network resources.

  • Direct Connect vs. VPN

    Direct Connect is a dedicated private link; VPN is encrypted over the internet.

    Remember
    Direct Connect gives consistent bandwidth and latency.
    Tested as
    Hybrid connectivity questions.
    Trap
    Using VPN where consistent performance is required.

  • Hybrid DNS

    Route 53 Resolver connects AWS and on-premises DNS.

    Remember
    Resolver endpoints enable name resolution both ways.
    Tested as
    Hybrid questions.
    Trap
    Overlooking DNS integration in hybrid designs.

  • Service control policies

    Organization-wide guardrails capping account permissions.

    Remember
    They never grant access, only cap it.
    Tested as
    Governance questions.
    Trap
    Confusing them with IAM policies.

  • Allow-list vs. deny-list SCP strategy

    Deny-list allows broadly then denies specifics; allow-list denies broadly then allows specifics.

    Remember
    The choice is an architectural decision the exam tests.
    Tested as
    Governance questions.
    Trap
    Not recognizing the two strategies.

  • Cross-account roles

    Roles assumed across accounts for least-privilege access.

    Remember
    They avoid sharing long-lived credentials.
    Tested as
    Access questions.
    Trap
    Sharing credentials instead of assuming roles.

  • AWS Organizations

    Central multi-account management, organizational units and billing.

    Remember
    It is the foundation for SCPs and consolidated billing.
    Tested as
    Multi-account questions.
    Trap
    Confusing it with Control Tower.

  • Control Tower and landing zones

    Control Tower sets up a governed multi-account landing zone.

    Remember
    It provisions guardrails, logging and account vending on Organizations.
    Tested as
    Multi-account setup questions.
    Trap
    Confusing it with Organizations itself.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Transit Gateway vs. VPC peering vs. PrivateLink

ConceptMeaningKey differenceCommon trap
Transit Gateway Central hub for many VPCs and on-premises Scales, transitive routing Using peering instead for many VPCs
VPC peering Point-to-point between two VPCs Non-transitive, does not scale Expecting transitive routing
PrivateLink Private access to one service Exposes a service, not a network Confusing it with peering

Service control policy vs. IAM policy

ConceptMeaningKey differenceCommon trap
Service control policy Caps permissions for accounts in an org Guardrail, never grants Expecting it to grant access
IAM policy Grants permissions to an identity Enables actions Confusing it with an SCP

Organizations vs. Control Tower

ConceptMeaningKey differenceCommon trap
AWS Organizations Account grouping, SCPs and billing The underlying service Confusing it with Control Tower
Control Tower Governed landing zone on Organizations Sets up guardrails and account vending Treating it as the same as Organizations

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Peering mesh

    What candidates pick
    Build a full mesh of VPC peering for many VPCs.
    Why it looks right
    Peering connects VPCs.
    Why it's wrong
    A peering mesh does not scale and is not transitive. Transit Gateway connects many VPCs centrally.

    Clue to watch for Many VPCs, and possibly on-premises, must all communicate.

  2. Forget RAM

    What candidates pick
    Share a subnet or Transit Gateway across accounts without Resource Access Manager.
    Why it looks right
    The resource seems shareable directly.
    Why it's wrong
    Resource Access Manager is required to share these resources across accounts.

    Clue to watch for A resource must be used by multiple accounts.

  3. SCP grants access

    What candidates pick
    Use a service control policy to grant an account new permissions.
    Why it looks right
    SCPs are permission policies.
    Why it's wrong
    SCPs only cap maximum permissions; IAM policies grant access.

    Clue to watch for The need is to grant, not restrict, permissions.

  4. VPN for consistent bandwidth

    What candidates pick
    Use a VPN where consistent, high bandwidth is required.
    Why it looks right
    VPN is quick to set up.
    Why it's wrong
    VPN runs over the internet with variable performance; Direct Connect gives consistent bandwidth and latency.

    Clue to watch for The requirement is predictable, high-throughput connectivity.

  5. Per-account reliability

    What candidates pick
    Configure logging and backup separately in each account.
    Why it looks right
    Each account manages its own.
    Why it's wrong
    At enterprise scale, centralized logging and cross-account backup provide consistency and auditability.

    Clue to watch for The estate spans many accounts needing consistent governance.

  6. Control Tower is Organizations

    What candidates pick
    Treat Control Tower and Organizations as interchangeable.
    Why it looks right
    Both relate to multi-account.
    Why it's wrong
    Organizations is the account and policy service; Control Tower sets up a governed landing zone on top of it.

    Clue to watch for The question distinguishes the foundation from the governed setup.

Answer framework

For any Domain 1 enterprise-scale scenario, use these steps to find the answer SAP-C02 expects.

  1. Read every constraint, since several options may work and the exam wants the one that best satisfies all of them at scale.
  2. For connectivity, choose Transit Gateway for many VPCs and hybrid, PrivateLink for private service access, and Direct Connect for consistent bandwidth, remembering Resource Access Manager to share resources across accounts.
  3. For governance, use Organizations with service control policies as guardrails and cross-account roles for least-privilege access, choosing the allow-list or deny-list strategy that fits.
  4. For reliability, centralize logging, event notifications and cross-account, cross-Region backup rather than configuring each account separately.
  5. For the account foundation, use Organizations and organizational units, and Control Tower for a governed landing zone, isolating workloads into accounts for blast-radius control.

Practice question

An enterprise has 25 VPCs spread across multiple AWS accounts that must all communicate with each other and with an on-premises data center, with centralized routing and minimal operational overhead. Which connectivity design is MOST appropriate?

Want more like this? The AWS SAP practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Approach this domain by thinking at enterprise scale, since the exam punishes single-account thinking. Start with networking, the heaviest area: master Transit Gateway topologies and why they beat a peering mesh, PrivateLink for private services, and Direct Connect versus VPN. Make Resource Access Manager automatic, because forgetting it is the single most common wrong answer in cross-account sharing.

Next, learn multi-account governance: Organizations and organizational units, service control policies as guardrails distinct from IAM, the allow-list versus deny-list strategies, and Control Tower landing zones. Then study centralized reliability, logging and cross-account backup.

Because questions give competing constraints with several workable options, practice long scenario questions and justify why one design beats the others, not just that it works. The AWS multi-account and Organizations best-practices whitepapers map directly here. Afterwards, move to Domain 2, designing new solutions, the largest domain. Because the exam is scenario-heavy, drilling long questions and justifying why the chosen design beats the alternatives matters far more than memorizing services, and reviewing missed questions by domain shows where to focus next.

FAQ

How much of SAP-C02 is Domain 1?

Design Solutions for Organizational Complexity is 26% of the scored content, the second-largest domain, focused on enterprise multi-account and multi-network design.

When should I use Transit Gateway instead of VPC peering?

When many VPCs, and often on-premises networks, must all communicate. Transit Gateway is a central hub with transitive routing, while peering is point-to-point and does not scale or route transitively.

What is Resource Access Manager for?

Sharing resources such as subnets, Transit Gateways and other resources across AWS accounts. It is frequently the missing element in incorrect cross-account answers.

What is the difference between an SCP and an IAM policy?

A service control policy caps the maximum permissions for accounts in an organization and never grants access. An IAM policy grants permissions to an identity.

What is the difference between Organizations and Control Tower?

AWS Organizations groups accounts, applies policies and consolidates billing. Control Tower sets up a governed multi-account landing zone with guardrails, logging and account provisioning on top of Organizations.

Why is this domain considered hard?

It tests choosing among options that all technically work, under competing enterprise constraints, rather than recalling whether a service exists.

How does Domain 1 connect to the rest of the exam?

The multi-account and connectivity foundation here underpins the new solutions, continuous improvement and migration domains, which all operate within this enterprise structure.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered multi-account connectivity, cross-account security, centralized reliability and multi-account governance. Test whether you can choose the best enterprise-scale design under competing constraints.

Take the AWS SAP practice test Check your AWS SAP readiness

Keep going