CLF-C02 Billing, Pricing, and Support Practice Question
A company uses AWS Organizations with consolidated billing across multiple member accounts. The finance team requires that only the management account (payer account) can view and modify payment methods and receive invoices. Member accounts must be prevented from accessing billing and payment information in the AWS Billing and Cost Management console. Which AWS feature should be configured to enforce this restriction?
⚠ Common exam trap
Many exam-takers confuse enabling consolidated billing (Option A) with actually restricting access, not realizing that consolidated billing alone does not enforce any access controls on member accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a Service Control Policy (SCP) to deny billing-related actions for all member accounts.
Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict the AWS services and actions that member accounts can use. By applying an SCP that denies billing-related actions (e.g., `aws-portal:*` or `awsbilling:*`) to all member accounts, the management account can enforce that only the payer account can view and modify payment methods and receive invoices. This directly meets the requirement without affecting the management account, which is not subject to SCPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable all features in AWS Organizations, including consolidated billing.
Why it's wrong here
Enabling all features in AWS Organizations is a necessary prerequisite for using SCPs, but this action alone does not change IAM permissions or automatically restrict member-account access to the Billing and Cost Management console. Consolidated billing aggregates usage and costs into the management account, but member-account users keep any IAM privileges they already have, including access to billing pages if their policies permit it. This option is incomplete because it only sets up the structure; it still requires an SCP or similar policy to enforce the access restriction.
When this WOULD be correct
A question asking how to enable consolidated billing across multiple accounts or how to centrally manage policies and services in AWS Organizations would have this as the correct answer.
- ✓
Apply a Service Control Policy (SCP) to deny billing-related actions for all member accounts.
Why this is correct
An SCP applied at the root, OU, or member-account level is a preventive control that explicitly denies billing-related IAM actions, such as aws-portal:ViewBilling and aws-portal:ModifyBilling, for all principals in member accounts. Because SCPs filter permissions granted by IAM policies, even an administrator with Allow on its role cannot bypass the deny unless the management account removes the SCP. This leaves full control of consolidated billing, payment methods, and cost data to the management account while blocking member-account users from viewing or changing billing information.
- ✗
Enable AWS CloudTrail to log billing events for all accounts.
Why it's wrong here
AWS CloudTrail is a detective control that records API activity for auditing, and enabling it to log billing events would capture calls like DescribeBilling, ViewBilling, or ModifyBilling for all accounts. However, logging does not prevent member-account users from performing those actions; it merely creates a secure audit trail of what occurred. This option fails to satisfy the requirement because it addresses visibility and forensics, not the needed preventive access control, which is why a deny SCP is required.
When this WOULD be correct
A question asks: 'Which AWS service should be used to record all billing-related API calls for compliance auditing?' In that case, enabling CloudTrail with billing events would be correct.
- ✗
Configure AWS Cost Explorer to grant cross-account access only to the management account.
Why it's wrong here
AWS Cost Explorer allows viewing of cost and usage data, but it does not restrict access to the billing console or payment methods. It is not a mechanism to prevent member accounts from modifying billing settings.
When this WOULD be correct
A scenario where the finance team needs to allow the management account to view cost data across all member accounts while restricting member accounts from seeing each other's costs. In that case, configuring Cost Explorer with cross-account access for the management account only would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Apply a Service Control Policy (SCP) to deny billing-related actions for all member accounts.Correct answer▾
Why this is correct
An SCP applied at the root, OU, or member-account level is a preventive control that explicitly denies billing-related IAM actions, such as aws-portal:ViewBilling and aws-portal:ModifyBilling, for all principals in member accounts. Because SCPs filter permissions granted by IAM policies, even an administrator with Allow on its role cannot bypass the deny unless the management account removes the SCP. This leaves full control of consolidated billing, payment methods, and cost data to the management account while blocking member-account users from viewing or changing billing information.
✗Enable all features in AWS Organizations, including consolidated billing.Wrong answer — click to see why▾
Why this is wrong here
Enabling all features in AWS Organizations, including consolidated billing, does not by itself restrict member accounts from accessing billing information; it only enables centralized management and consolidated billing features.
★ When this WOULD be the correct answer
A question asking how to enable consolidated billing across multiple accounts or how to centrally manage policies and services in AWS Organizations would have this as the correct answer.
Why candidates choose this
Candidates may think that enabling all features automatically applies restrictions, but it only provides the capability to apply policies; the actual restriction requires an SCP.
✗Enable AWS CloudTrail to log billing events for all accounts.Wrong answer — click to see why▾
Why this is wrong here
AWS CloudTrail logs API activity but does not enforce access restrictions; it only provides auditing, not prevention of billing access.
★ When this WOULD be the correct answer
A question asks: 'Which AWS service should be used to record all billing-related API calls for compliance auditing?' In that case, enabling CloudTrail with billing events would be correct.
Why candidates choose this
Candidates may confuse logging with access control, thinking that logging billing events can prevent unauthorized access, or they may overestimate CloudTrail's capabilities.
✗Configure AWS Cost Explorer to grant cross-account access only to the management account.Wrong answer — click to see why▾
Why this is wrong here
AWS Cost Explorer is a tool for visualizing and managing costs, not for controlling access to billing and payment information. It does not prevent member accounts from accessing billing details.
★ When this WOULD be the correct answer
A scenario where the finance team needs to allow the management account to view cost data across all member accounts while restricting member accounts from seeing each other's costs. In that case, configuring Cost Explorer with cross-account access for the management account only would be appropriate.
Why candidates choose this
Candidates may confuse Cost Explorer's cross-account access feature with a method to restrict billing access, thinking it can be used to grant exclusive billing access to the management account.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.