SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment. The security team needs to centrally manage and audit IAM roles that allow cross-account access. Which solution meets these requirements?
⚠ Common exam trap
Test-takers frequently confuse preventive controls (SCPs) with detective/audit controls, or they assume CloudTrail logging alone provides centralized auditing without considering the need for a purpose-built tool like IAM Access Analyzer to identify cross-account access configurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AWS IAM Access Analyzer in the management account and delegate admin to the security account.
AWS IAM Access Analyzer helps identify resources shared with external principals, including cross-account IAM roles. By enabling it in the management account and delegating administration to the security account, the security team gains a centralized view of all cross-account access findings across the organization without needing to enable it in each account individually. This meets the requirement for central management and auditing of cross-account IAM roles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Organizations service control policies to deny cross-account access.
Why it's wrong here
SCPs prevent but do not audit existing access.
- ✓
Enable AWS IAM Access Analyzer in the management account and delegate admin to the security account.
Why this is correct
Access Analyzer automatically discovers cross-account access and can be centrally managed.
- ✗
Use AWS Trusted Advisor to check for unused cross-account roles.
Why it's wrong here
Trusted Advisor does not audit all cross-account roles, only unused ones.
- ✗
Enable AWS CloudTrail across all accounts and use Athena to query for AssumeRole events.
Why it's wrong here
This is reactive and requires manual querying.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.