SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment and wants to centralize the management of IAM roles. The security team needs to ensure that all IAM roles across all accounts trust the same identity provider (IdP) for federated access. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which solution should be implemented?
⚠ Common exam trap
Many candidates confuse SCPs as a mechanism to enforce trust policies, but SCPs cannot modify IAM role trust relationships; they only control the maximum permissions for IAM users and roles within an account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS IAM Identity Center to create permission sets that grant access to accounts. IAM Identity Center automatically creates and manages the necessary IAM roles with the IdP trust.
AWS IAM Identity Center (formerly AWS SSO) is designed to centralize user access across multiple AWS accounts. When you create permission sets in IAM Identity Center, it automatically provisions the necessary IAM roles in each target account with a trust policy that trusts the IAM Identity Center's own identity provider. This eliminates the need to manually create or manage IAM roles and their trust policies, ensuring all accounts use the same IdP for federated access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS IAM Identity Center to create permission sets that grant access to accounts. IAM Identity Center automatically creates and manages the necessary IAM roles with the IdP trust.
Why this is correct
IAM Identity Center centralizes federation and role management.
- ✗
Use an SCP to require that all IAM roles trust the corporate IdP.
Why it's wrong here
SCPs cannot modify trust policies.
- ✗
Create IAM roles in each account with a trust policy that allows the corporate IdP.
Why it's wrong here
Requires manual setup in each account.
- ✗
Use AWS CloudFormation StackSets to deploy IAM roles with the IdP trust policy to all accounts.
Why it's wrong here
Still requires manual management of trust policies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.