SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a management account and several member accounts in AWS Organizations. They want to allow a developer in a member account to create an organization trail. What should they do?
⚠ Common exam trap
It's easy for candidates to assume creating an IAM role in the management account (Option C) is sufficient, but they miss that organization trails require the member account to be explicitly registered as a delegated administrator in AWS Organizations to bypass the default restriction that only the management account can create organization trails.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Register the member account as a delegated administrator for CloudTrail in AWS Organizations.
Registering a member account as a delegated administrator for CloudTrail in AWS Organizations allows that account to create organization trails on behalf of the management account. This delegation grants the member account the necessary permissions to call CreateTrail with the OrganizationTrail parameter set to true, which is required for organization-wide logging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Register the member account as a delegated administrator for CloudTrail in AWS Organizations.
Why this is correct
Allows the member account to create organization trails.
- ✗
Create a resource-based policy on the CloudTrail service to allow the member account to create trails.
Why it's wrong here
CloudTrail does not support resource-based policies.
- ✗
Create an IAM role in the management account and grant the developer permission to assume it.
Why it's wrong here
An IAM role in the management account does not grant the developer the necessary permissions to create an organization trail, because only a service-linked role named `AWSServiceRoleForCloudTrail` can be created by CloudTrail in the management account to enable an organization trail; the developer’s assumed role lacks the `organizations:EnableAWSServiceAccess` and `iam:CreateServiceLinkedRole` actions required for that specific operation. This option is tempting because assuming a cross-account role is the standard method for granting a developer access to resources in another account, and it would be correct for delegating access to read or manage resources such as S3 buckets or EC2 instances in the management account, but it fails here because the action of creating an organization trail demands management account-level service-linked role creation, not merely resource-level permissions.
- ✗
Attach an SCP to the member account that allows CloudTrail actions.
Why it's wrong here
SCPs cannot grant actions; they only deny.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.