SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment. The security team wants to enforce that all IAM roles in the production accounts can only be assumed from a specific IP range (the corporate network). Which TWO approaches can achieve this?
⚠ Common exam trap
Many candidates confuse SCPs with resource-based policies, thinking SCPs can be attached to individual IAM roles, or they mistakenly believe WAF or VPC endpoints can control IAM API calls, when in fact only SCPs and trust policies directly enforce source IP restrictions on sts:AssumeRole.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach a Service Control Policy (SCP) to the production OU that denies sts:AssumeRole unless the request source IP is within the corporate range.
An SCP attached to the production OU can deny sts:AssumeRole actions unless the request's source IP falls within the corporate range. SCPs operate at the organization level and apply to all accounts in the OU, providing a centralized guardrail that cannot be overridden by account administrators. This enforces the IP restriction across all IAM roles in the production accounts without modifying individual role trust policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach a Service Control Policy (SCP) to the production OU that denies sts:AssumeRole unless the request source IP is within the corporate range.
Why this is correct
SCPs can enforce conditions on API calls.
- ✗
Use a VPC endpoint for STS and restrict access to the endpoint.
Why it's wrong here
VPC endpoints do not restrict source IP; they restrict network path.
- ✗
Configure AWS WAF to block requests from IPs outside the corporate range.
Why it's wrong here
WAF is for web application traffic, not IAM API calls.
- ✓
Add a condition to the trust policy of each IAM role that requires the source IP to be in the corporate range.
Why this is correct
Trust policy conditions can restrict who can assume the role.
- ✗
Attach a Service Control Policy (SCP) to each IAM role that denies assume role unless the source IP is corporate.
Why it's wrong here
SCPs cannot be attached to IAM roles.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.