Highest-weight domain after Domain 2. Focuses on multi-account governance, enterprise networking, and cross-account identity. Expect 17 questions.

What This Domain Tests

• Designing multi-account AWS environments using Organizations and Control Tower
• Implementing governance guardrails with SCPs and Resource Control Policies
• Architecting enterprise-scale networking with Transit Gateway, Direct Connect, and VPN
• Managing cross-account identity with IAM Identity Center and IAM roles
• Sharing resources across accounts with RAM
• Enforcing compliance with Config and Security Hub

Subdomain Breakdown

Task names aligned to the official SAP-C02 exam guide. The guide may change; recheck before exam day.

Files in This Domain

Organizations/

• Organizations-General.md — AWS Organizations, OUs, account management
• SCPs-General.md — Service Control Policies, guardrails, deny strategies

ControlTower/

• ControlTower-General.md — Landing zones, account factory, guardrails
• LandingZone-General.md — Landing zone design, customizations, AFT

IAM/

• IAM-General.md — IAM roles, policies, cross-account trust, federation
• IAM-IdentityCenter-General.md — SSO, permission sets, multi-account access
• ResourceControlPolicies-General.md — RCPs, data perimeter, vs SCPs

Networking/

• TransitGateway-General.md — Hub-and-spoke, inter-region peering, route tables
• DirectConnect-General.md — Dedicated/hosted connections, VIFs, resilience
• VPN-General.md — Site-to-Site VPN, Client VPN, accelerated VPN
• VPC-Advanced-General.md — VPC sharing, PrivateLink, peering, endpoints

Standalone

• RAM-General.md — Resource Access Manager, cross-account sharing
• Config-General.md — Config rules, conformance packs, aggregators
• SecurityHub-General.md — Findings aggregation, standards, automation
• Security-Services-Selector.md — GuardDuty, Inspector, Macie, WAF/Shield, Firewall Manager, response patterns
• KMS-General.md — key types, key policies vs grants, cross-account access, envelope encryption, CloudHSM
• Cost-Visibility-General.md — Cost Explorer, Budgets, billing exports, tags, commitments
• Route53-General.md — Routing policies, health checks, hybrid DNS, Resolver

Key Architecture Patterns

Multi-Account Landing Zone

Management Account
└── AWS Organizations
    ├── Root
    ├── Security OU
    │   ├── Log Archive Account
    │   └── Audit Account
    ├── Infrastructure OU
    │   └── Network Hub Account (Transit Gateway)
    ├── Sandbox OU
    └── Workloads OU
        ├── Dev Account
        ├── Staging Account
        └── Prod Account

Hub-and-Spoke Networking

On-Premises
    └── Direct Connect / VPN
            └── Transit Gateway (Network Hub Account)
                    ├── VPC Spoke 1 (Dev)
                    ├── VPC Spoke 2 (Prod)
                    └── VPC Spoke 3 (Shared Services)

Exam Tips

• SCPs deny — they never grant permissions. An explicit deny in an SCP overrides any IAM allow
• RCPs restrict what resources accept — SCPs restrict what principals can do
• Control Tower uses SCPs + Config rules as guardrails — know the difference between preventive and detective
• Transit Gateway supports inter-region peering — VPC peering does not scale to hundreds of VPCs
• Direct Connect does not encrypt by default — use MACsec or VPN over DX for encryption
• IAM Identity Center is the preferred solution for multi-account human access — not individual IAM users
• RAM shares resources within an Organization without needing cross-account IAM roles for every resource

Common Exam Traps

• Confusing SCP scope (applies to all principals in the OU except the management account)
• Using VPC peering instead of Transit Gateway for large-scale hub-and-spoke
• Forgetting that Direct Connect failover requires a second connection or VPN backup
• Mixing up IAM Identity Center permission sets with IAM roles (they provision IAM roles behind the scenes)
• Assuming Config rules are preventive — they are detective only (use SCPs or IAM for prevention)