Objective 1.1 · high
Architect network connectivity
Choose scalable connectivity, routing, DNS, segmentation, inspection, hybrid, and multi-Region patterns for complex organizations.
- Lesson
- d1-lesson
- Practice pool
- d1-questions
- Application
- sap-l02
SAP-C02 · D1 · 26%
Design Solutions for Organizational Complexity
Design organization-wide connectivity, security, resilience, governance, and cost visibility across accounts, Regions, workloads, and business boundaries.
Provider facts checked 2026-08-03
Objective coverage
Objective 1.2 · high
Prescribe security controls
Establish organization-wide identity, detective, preventive, data, network, and delegated-administration controls with clear ownership.
- Lesson
- d1-lesson
- Practice pool
- d1-questions
- Application
- sap-l01
Objective 1.3 · high
Design reliable and resilient architectures
Set availability, dependency, failure-isolation, recovery, quota, and operational patterns across organizational workloads.
- Lesson
- d1-lesson
- Practice pool
- d1-questions
- Application
- sap-l03
Objective 1.4 · high
Design a multi-account environment
Structure organizations, OUs, accounts, shared services, landing zones, guardrails, identity, logging, and account vending.
- Lesson
- d1-lesson
- Practice pool
- d1-questions
- Application
- sap-l01
Objective 1.5 · normal
Determine cost visibility and control
Allocate, attribute, forecast, govern, and optimize cost across accounts and business ownership boundaries.
- Lesson
- d1-lesson
- Practice pool
- d1-questions
- Application
- sap-l01, sap-l07
title: "Organizational Complexity" summary: "Architecture decisions for multi-account governance, shared services, hybrid connectivity, identity, and enterprise-scale operations on AWS."
Architecture starts with boundaries
Map business ownership, regulatory scope, autonomy, blast radius, quotas, billing, data residency, networking, identity, and operational responsibility before drawing accounts or VPCs. AWS accounts are strong ownership, isolation, and quota boundaries; organizational units group policy inheritance and administration.
Design account vending, identity federation, permission sets, organization policies, delegated administration, logging, security operations, backup, network, shared services, exceptions, acquisitions, and closure as lifecycles. Avoid routine workload administration from the management account.
Connectivity at scale
Trace sites, Regions, VPCs, addresses, routes, DNS, inspection, encryption, bandwidth, latency, convergence, failure paths, and costs. Compare Site-to-Site VPN, Direct Connect, Transit Gateway, Cloud WAN, peering, PrivateLink, endpoints, and service-specific patterns from requirements. Centralization can improve governance while increasing shared-fate and routing complexity.
Resilience, security, and cost ownership
Set service and business objectives, dependency tolerances, quota headroom, recovery, and validation at the organizational level. Establish preventive, detective, response, data, network, and identity ownership. Use account tags, cost categories, budgets, allocation data, and unit economics so the people who can change demand can see its cost.
Self-check
Design an organization for regulated and unregulated products across three business units and two Regions. Explain every account, OU, network, identity, security, logging, and billing boundary.