SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs to ensure that all accounts use a specific set of IAM roles for cross-account access. What is the most scalable way to enforce this?
⚠ Common exam trap
Candidates often choose AWS Config (Option A) because it is a common compliance tool, but they fail to recognize that Config is detective, not preventive, and the question specifically asks for 'enforce,' which requires a preventive control like an SCP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an SCP that denies iam:CreateRole unless the role has the required trust policy.
An SCP (Service Control Policy) that denies `iam:CreateRole` unless the role has the required trust policy is the most scalable enforcement mechanism. SCPs are applied at the organizational unit (OU) or account level in AWS Organizations, allowing the central security team to centrally prevent the creation of non-compliant IAM roles across all business unit accounts without requiring per-account configuration or manual intervention. This approach enforces compliance proactively (preventive control) rather than reactively (detective control), and it scales automatically as new accounts are added to the organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config rules to detect non-compliant roles and send alerts.
Why it's wrong here
Detective, not preventive; non-compliant roles can still exist.
- ✗
Deploy the IAM roles using AWS CloudFormation StackSets.
Why it's wrong here
Deploys roles but does not enforce their use; non-compliant roles can still be created.
- ✗
Request each business unit to create the required IAM roles manually.
Why it's wrong here
Not scalable and prone to human error.
- ✓
Apply an SCP that denies iam:CreateRole unless the role has the required trust policy.
Why this is correct
SCPs can enforce conditions on role creation centrally.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a decentralized IT structure where each business unit manages its own AWS accounts. The central IT team wants to enforce security policies across all accounts but allow business units to retain administrative control. Which solution should the central IT team implement?
easy- A.Deploy AWS CloudFormation StackSets to each account with security templates.
- B.Create a shared services account and use IAM cross-account roles for each business unit.
- ✓ C.Use AWS Organizations with service control policies (SCPs) to enforce baseline permissions, and delegate administration to organizational units (OUs) for each business unit.
- D.Migrate all workloads to a single AWS account and use IAM roles for each business unit.
Why C: AWS Organizations with SCPs allows the central IT team to enforce baseline security policies across all accounts without removing administrative control from business units. By delegating administration to OUs for each business unit, the central team sets guardrails while business units retain full IAM management within their accounts, satisfying the decentralized structure requirement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.