SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to share a VPC subnet in the network account with the workload accounts so that they can launch EC2 instances directly into the shared subnet. The network team has created a VPC with a subnet and shared it using AWS Resource Access Manager (RAM) with the workload accounts. However, the workload accounts cannot see the shared subnet when launching EC2 instances. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The workload accounts have not accepted the resource share invitation.
AWS RAM requires workload accounts to accept the resource share invitation before they can see and use the shared subnet. Option B is incorrect because having a default VPC in the workload account does not prevent visibility of shared subnets; the subnet will appear in the VPC list regardless. Option C is incorrect because the primary issue is the acceptance of the resource share, not IAM permissions; while IAM permissions may be needed to launch instances, the subnet itself will not be visible until the share is accepted. Option D is incorrect because AWS RAM supports sharing across regions, so a different region would not prevent the subnet from being visible after acceptance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The workload accounts have not accepted the resource share invitation.
Why this is correct
AWS RAM requires the workload accounts to accept the resource share invitation before they can see and use the shared subnet. Until acceptance, the subnet is not visible.
- ✗
The workload accounts have a default VPC that conflicts with the shared subnet.
Why it's wrong here
A default VPC in the workload account does not conflict with or hide a shared subnet. The subnet is shared via RAM and is independent of any existing VPCs.
- ✗
The workload accounts do not have the necessary IAM permissions to use shared subnets.
Why it's wrong here
While IAM permissions are necessary to launch instances, the inability to see the shared subnet is typically due to not accepting the RAM share, not missing IAM permissions. The workload accounts already have RAM permissions to view shared resources if they have accepted.
- ✗
The subnet is in a different AWS Region than the workload accounts.
Why it's wrong here
Subnet sharing via AWS RAM is limited to the same region. If the subnet were in a different region, the network team would not have been able to share it with the workload accounts. Since the share was created, the regions match, so this is not the cause.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.