SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment. The central IT team manages IAM roles in each account using AWS CloudFormation StackSets. The team needs to ensure that a specific IAM role exists in all member accounts. Which solution is the MOST efficient?
⚠ Common exam trap
Candidates often confuse AWS Config rules (detective control) with proactive resource creation, or assuming SCPs can create IAM roles when they only enforce permission boundaries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS CloudFormation StackSets to deploy the IAM role template across all accounts.
AWS CloudFormation StackSets allow you to deploy a single IAM role template across multiple accounts and Regions in a single operation, ensuring consistent role creation without manual effort. This is the most efficient solution because it automates the deployment, handles drift detection, and integrates with AWS Organizations for automatic account addition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS CloudFormation StackSets to deploy the IAM role template across all accounts.
Why this is correct
StackSets automate deployment across multiple accounts.
- ✗
Use AWS Config rules to enforce the IAM role creation in each account.
Why it's wrong here
Config rules evaluate compliance but do not create resources.
- ✗
Manually create the IAM role in each account using the AWS Management Console.
Why it's wrong here
Manual approach is error-prone and time-consuming.
- ✗
Use AWS Organizations to create the IAM role via a service control policy (SCP).
Why it's wrong here
SCPs are for permissions, not resource creation.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.