SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment with a centralized security account. The security team wants to ensure that any IAM role created in any account with a trust policy allowing access from another AWS account must be approved by the security team. Which approach should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use service control policies (SCPs) to deny role creation unless the trust policy meets conditions
Service Control Policies (SCPs) can be applied at the organizational unit (OU) or account level to deny the creation of roles with trust policies that allow access from another AWS account unless the trust policy meets specific conditions (e.g., requiring approval or restricting to accounts within the organization). Option B is wrong because IAM policies are account-level and cannot prevent role creation across accounts; they can only control who within an account can create roles, not the content of the trust policy. Option C is wrong because AWS Lambda can automatically delete non-compliant roles after creation, but it cannot prevent the initial creation, which is the requirement. Option D is wrong because AWS Config rules can detect and alert on risky trust policies, but they cannot deny or prevent role creation; they are detective, not preventive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use service control policies (SCPs) to deny role creation unless the trust policy meets conditions
Why this is correct
SCPs can deny IAM role creation if the trust policy includes a principal that is not part of the organization, effectively requiring approval.
- ✗
Use IAM policies to restrict who can create roles
Why it's wrong here
IAM policies can restrict actions but cannot evaluate the content of the trust policy during creation.
- ✗
Use AWS Lambda to automatically delete non-compliant roles
Why it's wrong here
Deleting after creation is reactive and may cause disruption.
- ✗
Use AWS Config rules to detect and alert on risky trust policies
Why it's wrong here
Detecting after creation is not preventing.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a production AWS account and a development AWS account under AWS Organizations. The development team wants to deploy a CloudFormation stack that creates an S3 bucket with a bucket policy that grants access to the production account's IAM roles. The development account has an SCP that denies all s3:PutBucketPolicy actions. The development team has full administrator access in their account. When they try to create the stack, it fails. What is the most likely reason and how should they proceed?
medium- A.The development team does not have IAM permissions to create buckets. They need to attach an IAM policy that allows s3:PutBucketPolicy.
- ✓ B.The SCP denies s3:PutBucketPolicy and overrides the administrator permissions. They need to request an exception to the SCP from the security team.
- C.CloudFormation service role is missing. They need to create a service role with appropriate permissions.
- D.The production account's IAM roles are not trusted. They need to update the trust policy.
Why B: SCPs apply to all principals in the account, including administrators, and deny actions even if IAM policies allow them. Since the SCP denies s3:PutBucketPolicy, the development team cannot create the bucket policy despite having full admin access. Option A is incorrect because the team does have IAM permissions (admin), but the SCP overrides them. Option C is incorrect because CloudFormation's service role is not the issue; the SCP restriction affects all principals, including CloudFormation. Option D is incorrect because the trust policy of the production account's IAM roles is unrelated to the SCP in the development account.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.