title: "SAP-C02 Guided Labs"
summary: "A set of review-gated professional architecture labs with validation, teardown, cost, recovery, and evidence requirements."
Architecture workshop discipline
Every workshop begins with business constraints and ends with validation, rejected alternatives, ownership, and a rollback or exit path. Service diagrams alone are insufficient.
Use architecture-only mode unless an isolated account, budget, permissions, Region, and teardown owner are available. Optional sandbox implementations must use synthetic data and infrastructure as code. Record quota, cost, dependency, and cleanup assumptions before creation.
Validate through failure and change: lose a connection, component, Availability Zone, Region, dependency, permission, quota, or deployment. Trace user impact, detection, automated behavior, operator decision, recovery, data reconciliation, and evidence.
The current workshop procedures remain noindex because named architecture review and current-service execution validation are pending. This separates a complete learning draft from a publication claim.
sap-l01 · technical-review
Design a governed multi-account landing zone 120 min Map business ownership to OUs/accounts, identity, guardrails, delegated administration, logging, network, and cost controls.
Objectives 1.2, 1.4, 1.5, 2.3, 3.2
Cost Architecture-only mode costs nothing. Optional sandbox deployment cost varies; estimate it before creation and delete all resources.
Validation not-run: Architecture workshop is complete; optional AWS implementation needs named validation before publication. Architecture or scenario Identity and management accounts → OU/account hierarchy → shared security/logging/network services → workload accounts.
Prerequisites Use an architecture workshop or isolated non-production AWS account. Write business constraints before selecting services. Do not create billable resources without a budget and teardown owner. Procedure Capture regulatory, isolation, ownership, autonomy, and growth requirements. Design OUs/accounts and document why each boundary exists. Assign identity, log, security, network, backup, and billing ownership. Map preventive, detective, and recovery controls to lifecycle events. Validate Walk a new-account request from approval to evidence. Test one exception and one compromised-workload-account scenario on paper. Show cost and security ownership without granting broad workload access. Teardown or closeout Export only sanitized architecture decisions and validation evidence. Destroy every optional sandbox stack, retained snapshot, endpoint, log group, key, and test account resource. Mark application complete on this device sap-l02 · technical-review
Design hybrid transit, inspection, and DNS 120 min Choose Direct Connect/VPN, Transit Gateway, Cloud WAN, routing, inspection, private endpoints, and DNS based on scale and failure requirements.
Objectives 1.1, 2.3
Cost Architecture-only mode costs nothing. Optional sandbox deployment cost varies; estimate it before creation and delete all resources.
Validation not-run: Architecture workshop is complete; optional AWS implementation needs named validation before publication. Architecture or scenario Sites and Regions → redundant hybrid connectivity → transit and inspection → spoke VPCs → centralized/hybrid DNS.
Prerequisites Use an architecture workshop or isolated non-production AWS account. Write business constraints before selecting services. Do not create billable resources without a budget and teardown owner. Procedure Write bandwidth, latency, encryption, availability, segmentation, and growth requirements. Draw forward and return paths for five traffic classes. Place inspection and DNS components with failure domains. Document route propagation, overlapping CIDR, and asymmetric-routing risks. Validate Simulate loss of one link, one Region, and one inspection component. Confirm every path has a route, authorization, name-resolution, and evidence story. Teardown or closeout Export only sanitized architecture decisions and validation evidence. Destroy every optional sandbox stack, retained snapshot, endpoint, log group, key, and test account resource. Mark application complete on this device sap-l03 · technical-review
Design and test a multi-Region recovery strategy 120 min Translate BIA, RTO, RPO, dependency, data-consistency, failover, failback, and operations into a testable design.
Objectives 1.3, 2.2, 2.4, 3.4
Cost Architecture-only mode costs nothing. Optional sandbox deployment cost varies; estimate it before creation and delete all resources.
Validation not-run: Architecture workshop is complete; optional AWS implementation needs named validation before publication. Architecture or scenario Primary Region and dependencies → replicated data/configuration → recovery Region → health/failover and operator control.
Prerequisites Use an architecture workshop or isolated non-production AWS account. Write business constraints before selecting services. Do not create billable resources without a budget and teardown owner. Procedure Define workload-tier RTO/RPO and allowable data loss. Choose backup/restore, pilot light, warm standby, or active/active per component. Design DNS/traffic, identity, secrets, data, queue, and dependency behavior. Write failover, validation, reconciliation, and failback steps. Validate Tabletop a partial failure and a false-positive health signal. Prove the design can meet RTO/RPO with realistic dependencies and quotas. Teardown or closeout Export only sanitized architecture decisions and validation evidence. Destroy every optional sandbox stack, retained snapshot, endpoint, log group, key, and test account resource. Mark application complete on this device sap-l04 · technical-review
Design an event-driven service and safe deployment 120 min Select event, queue, stream, workflow, retry, idempotency, deployment, and rollback behavior.
Objectives 2.1, 2.4
Cost Architecture-only mode costs nothing. Optional sandbox deployment cost varies; estimate it before creation and delete all resources.
Validation not-run: Architecture workshop is complete; optional AWS implementation needs named validation before publication. Architecture or scenario Producer → event bus/topic → queue/workflow → idempotent consumers → dead-letter and replay path.
Prerequisites Use an architecture workshop or isolated non-production AWS account. Write business constraints before selecting services. Do not create billable resources without a budget and teardown owner. Procedure Define ordering, delivery, latency, fan-out, retention, and failure requirements. Choose integration primitives and document delivery semantics. Design idempotency, retry, backoff, DLQ, replay, observability, and schema evolution. Add progressive deployment and rollback for consumers. Validate Trace duplicate, poison, out-of-order, delayed, and schema-changed events. Demonstrate that replay cannot create unintended duplicate business effects. Teardown or closeout Export only sanitized architecture decisions and validation evidence. Destroy every optional sandbox stack, retained snapshot, endpoint, log group, key, and test account resource. Mark application complete on this device sap-l05 · technical-review
Select a data platform from workload evidence 120 min Compare relational, key-value, document, graph, object, search, warehouse, streaming, cache, and transfer choices.
Objectives 2.5, 2.6
Cost Architecture-only mode costs nothing. Optional sandbox deployment cost varies; estimate it before creation and delete all resources.
Validation not-run: Architecture workshop is complete; optional AWS implementation needs named validation before publication. Architecture or scenario Sources → ingestion/transfer → operational and analytical stores → processing → consumers with governance.
Prerequisites Use an architecture workshop or isolated non-production AWS account. Write business constraints before selecting services. Do not create billable resources without a budget and teardown owner. Procedure Record access patterns, consistency, scale, latency, retention, query, recovery, and governance requirements. Map each requirement to at least two viable AWS service families. Model data movement, replication, backup, lifecycle, and unit cost. Choose a design and document rejected alternatives. Validate Test the choice against growth, Region failure, hot partition, schema evolution, and cost shock. Confirm the system of record and data ownership are unambiguous. Teardown or closeout Export only sanitized architecture decisions and validation evidence. Destroy every optional sandbox stack, retained snapshot, endpoint, log group, key, and test account resource. Mark application complete on this device sap-l06 · technical-review
Plan a migration wave and reversible cutover 120 min Select workloads, migration strategies, dependencies, tooling, data movement, tests, cutover, rollback, and modernization timing.
Objectives 4.1, 4.2, 4.3
Cost Architecture-only mode costs nothing. Optional sandbox deployment cost varies; estimate it before creation and delete all resources.
Validation not-run: Architecture workshop is complete; optional AWS implementation needs named validation before publication. Architecture or scenario Portfolio discovery → dependency groups/waves → landing zone and migration services → validation → cutover/rollback.
Prerequisites Use an architecture workshop or isolated non-production AWS account. Write business constraints before selecting services. Do not create billable resources without a budget and teardown owner. Procedure Inventory workloads, dependencies, owners, constraints, and business windows. Assign a migration strategy with evidence, not preference. Sequence waves and define entry/exit criteria. Write data sync, validation, cutover, communications, rollback, and decommission steps. Validate Tabletop a failed data reconciliation and a missed dependency. Show how rollback meets the business window without split-brain behavior. Teardown or closeout Export only sanitized architecture decisions and validation evidence. Destroy every optional sandbox stack, retained snapshot, endpoint, log group, key, and test account resource. Mark application complete on this device sap-l07 · technical-review
Prioritize an existing workload improvement backlog 120 min Use telemetry and Well-Architected evidence to choose safe operational, security, reliability, performance, and cost improvements.
Objectives 1.5, 2.5, 2.6, 3.1, 3.2, 3.3, 3.4, 3.5
Cost Architecture-only mode costs nothing. Optional sandbox deployment cost varies; estimate it before creation and delete all resources.
Validation not-run: Architecture workshop is complete; optional AWS implementation needs named validation before publication. Architecture or scenario Existing workload evidence → risk and constraint analysis → prioritized change backlog → experiment/release → outcome measurement.
Prerequisites Use an architecture workshop or isolated non-production AWS account. Write business constraints before selecting services. Do not create billable resources without a budget and teardown owner. Procedure Collect sanitized architecture, demand, incidents, cost, performance, and ownership evidence. Identify risks across all pillars and name the affected business outcome. Rank changes by risk reduction, dependency, reversibility, effort, and evidence quality. Define experiment, rollout, rollback, and success measures for the top three. Validate Reject at least one attractive change that violates a higher-priority constraint. Verify every selected change has an owner and measurable outcome. Teardown or closeout Export only sanitized architecture decisions and validation evidence. Destroy every optional sandbox stack, retained snapshot, endpoint, log group, key, and test account resource. Mark application complete on this device sap-l08 · technical-review
Choose a modernization pattern and operating model 120 min Decide whether and when to replatform, refactor, decouple, containerize, go serverless, or retain an existing design.
Objectives 3.1, 4.4
Cost Architecture-only mode costs nothing. Optional sandbox deployment cost varies; estimate it before creation and delete all resources.
Validation not-run: Architecture workshop is complete; optional AWS implementation needs named validation before publication. Architecture or scenario Existing application boundaries → target service/integration patterns → delivery platform → observability and team ownership.
Prerequisites Use an architecture workshop or isolated non-production AWS account. Write business constraints before selecting services. Do not create billable resources without a budget and teardown owner. Procedure Document business driver, change tolerance, team skill, compliance, release, and operational constraints. Identify the current bottleneck and coupling boundaries. Compare retain, rehost, replatform, and refactor options. Design the target operating model, incremental strangler path, tests, and rollback. Validate Demonstrate that modernization addresses the stated bottleneck. Show a staged path that produces value before the entire rewrite completes. Teardown or closeout Export only sanitized architecture decisions and validation evidence. Destroy every optional sandbox stack, retained snapshot, endpoint, log group, key, and test account resource. Mark application complete on this device 