Domain 1: Design Solutions for Organizational Complexity
This domain accounts for 26% of scored content in the current official exam guide. Design boundaries across teams, networks and accounts before choosing individual services. The pages are sourced revision lessons, not a comprehensive course or a guarantee of an exam result.
Prerequisites
Review networking, security and Organizations. Explain the service contracts before attempting the integrated scenario.
Task lessons
- 1.1 Architect Network Connectivity Strategies
- 1.2 Prescribe Security Controls
- 1.3 Design Reliable and Resilient Architectures
- 1.4 Design a Multi-Account AWS Environment
- 1.5 Cost Optimization & Visibility
Each task lesson maps to its official task and includes a distinct scenario, rationale, rejected alternatives and a proposed drill.
Key areas and evidence
| Task | Evidence to produce |
|---|---|
| 1.1 Connectivity | Address/route/DNS matrix with failure paths |
| 1.2 Security | Cross-account identity, resource and key-policy evaluation |
| 1.3 Resilience | Recovery timeline and recovery-point verification |
| 1.4 Multi-account | Account/OU ownership and protected logging flow |
| 1.5 Visibility | Allocation, utilization and post-rightsizing commitment model |
The acquisition exercise is complete only when shared ERP remains reachable through approved paths, research stays isolated and audit/cost ownership survives account onboarding. A working network cannot compensate for an incorrect trust policy or inaccessible recovery key.
Integrated scenario
An acquired business must join shared ERP without exposing research workloads or losing audit ownership. Combine route segmentation, federated roles, account boundaries, recovery objectives and cost allocation. Reject a single shared administrator account and a flat transitive network: both obscure ownership and expand the blast radius.
Domain drill
Produce an account tree, allowed-traffic matrix, cross-account access worksheet, recovery timeline and cost-ownership model. For each, name the decision owner and a rejected design. Check that the network, identity and recovery plans agree rather than optimizing each in isolation. The exercise is tabletop/design work; deployments or disruptive tests require a separate authorized sandbox and cost controls.
References and review
Return to SAP-C02 study overview. Review task references for current quotas, service eligibility and pricing rather than memorizing unsourced numerical tables.