SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment and wants to enforce that all IAM roles in member accounts must include a specific tag (e.g., CostCenter). Which THREE steps should be taken to enforce this policy using AWS Organizations?
⚠ Common exam trap
Watch out — candidates often confuse AWS Budgets (a cost alerting tool) with a governance enforcement mechanism, or think that per-account IAM policies are sufficient for centralized control, missing the fact that SCPs are the only way to enforce organization-wide guardrails that cannot be overridden by account administrators.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach the SCP to the root organizational unit to apply it to all accounts
AWS Organizations allows you to attach a service control policy (SCP) to the root organizational unit (OU), which applies the policy to all member accounts in the organization. This ensures that the tag enforcement is centrally managed and cannot be bypassed by individual account administrators, as SCPs set permission boundaries that override IAM policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM policy in each account that requires tags on role creation
Why it's wrong here
IAM policies are not effective for preventing role creation across accounts.
- ✗
Set up AWS Budgets to alert on untagged roles
Why it's wrong here
Budgets do not enforce tagging.
- ✓
Attach the SCP to the root organizational unit to apply it to all accounts
Why this is correct
Attaching to root ensures all accounts are covered.
- ✓
Create a service control policy (SCP) that denies iam:CreateRole if the request does not include the required tag
Why this is correct
SCP can deny API calls that don't meet tag requirements.
- ✓
Use AWS Config rules to detect roles missing the tag and trigger automatic remediation
Why this is correct
Config can detect and remediate non-compliance.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.