SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment with a centralized security account. The security team needs to have read-only access to all Amazon S3 buckets across all accounts for auditing purposes. Which solution is the MOST secure and scalable?
⚠ Common exam trap
It's easy for candidates to choose Option B thinking bucket policies are simpler, but they overlook the scalability and maintenance burden of managing individual bucket policies across hundreds or thousands of buckets, and the fact that bucket policies do not support cross-account access without explicitly listing the principal ARN, which is less flexible than IAM roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role in each account with read-only S3 permissions and a trust policy that allows the security account to assume the role.
It uses IAM roles with cross-account trust policies, which is the most secure and scalable approach for granting read-only S3 access across multiple accounts. The security account assumes the role in each target account, avoiding long-term credentials and allowing centralized control via AWS Organizations or manual role creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM role in each account with read-only S3 permissions and a trust policy that allows the security account to assume the role.
Why this is correct
A cross-account IAM role with a trust policy scoped to the security account lets auditors assume read-only S3 permissions without distributing long-term credentials. This satisfies the security and scalability constraints by centralising access through role assumption across every account.
- ✗
Attach a bucket policy to each S3 bucket that grants read-only access to the security team's IAM user in the security account.
Why it's wrong here
Per-bucket policies granting a single security-account IAM user require editing every bucket, including future ones, so coverage breaks as accounts and buckets grow. It tempts because resource policies are the standard cross-account access mechanism, but that suits a small, fixed set of buckets rather than organisation-wide auditing.
- ✗
Use the root user of each account to access the buckets.
Why it's wrong here
Root user credentials bypass IAM policy restrictions, cannot be scoped to read-only S3 actions, and are not designed for delegated auditing access, so this fails least-privilege and auditability requirements. It tempts as a universal fallback, but root access is intended only for account-level tasks such as closing the account.
- ✗
Create an IAM user in each account with read-only S3 permissions and share the credentials with the security team.
Why it's wrong here
Distributing long-lived IAM user credentials across accounts creates secret sprawl, no central revocation, and per-account user lifecycle overhead, failing the security and scalability requirements. It tempts because IAM users with read-only S3 policies do grant access, but that pattern suits isolated single-account setups, not centralised multi-account auditing.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a production AWS account and a development AWS account. The development team needs to assume an IAM role in the production account to deploy resources. What is the correct way to set up this cross-account access?
easy- ✓ A.Create an IAM role in the production account with a trust policy that specifies the development account as a trusted entity
- B.Apply a service control policy to allow cross-account access
- C.Create an IAM user in the production account and share the credentials with the development team
- D.Configure security group rules to allow access from the development account
Why A: Cross-account IAM role access requires creating an IAM role in the production (trusting) account with a trust policy that explicitly lists the development (trusted) account as a principal. The development team then assumes that role using the AWS STS AssumeRole API, which returns temporary security credentials. This follows the AWS recommended pattern for delegating access without sharing long-term credentials.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.