SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a production AWS account and a development AWS account. The development team needs to assume an IAM role in the production account to deploy resources. What is the correct way to set up this cross-account access?
⚠ Common exam trap
Candidates often confuse network-level controls (security groups) or organizational policies (SCPs) with IAM-based cross-account trust, or mistakenly think sharing IAM user credentials is acceptable for cross-account access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role in the production account with a trust policy that specifies the development account as a trusted entity
Cross-account IAM role access requires creating an IAM role in the production (trusting) account with a trust policy that explicitly lists the development (trusted) account as a principal. The development team then assumes that role using the AWS STS AssumeRole API, which returns temporary security credentials. This follows the AWS recommended pattern for delegating access without sharing long-term credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM role in the production account with a trust policy that specifies the development account as a trusted entity
Why this is correct
This allows users from the development account to assume the role and gain permissions.
- ✗
Apply a service control policy to allow cross-account access
Why it's wrong here
SCPs restrict permissions, they do not grant access.
- ✗
Create an IAM user in the production account and share the credentials with the development team
Why it's wrong here
Sharing credentials is insecure and not a best practice.
- ✗
Configure security group rules to allow access from the development account
Why it's wrong here
Security groups are for network-level access, not IAM.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.