SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has multiple AWS accounts and wants to ensure that all resources are tagged with a cost center tag. Which THREE steps should they take to enforce this?
⚠ Common exam trap
Candidates often confuse detective controls (like AWS Config rules) with preventive controls (like tag policies or SCPs), and may select option B thinking it enforces tagging, when it only remediates after the fact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Organizations to define a tag policy that mandates the cost center tag.
AWS Organizations tag policies allow you to define rules for tagging resources across accounts in your organization. By specifying the cost center tag as mandatory in a tag policy, you can enforce that all resources must have this tag, and any non-compliant resources can be reported or prevented from being created, depending on the policy's enforcement mode.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Organizations to define a tag policy that mandates the cost center tag.
Why this is correct
Tag policies can enforce tags on resources during creation and prevent non-compliant resource creation.
- ✗
Use AWS Config rules to detect untagged resources and trigger a Lambda function to add the tag.
Why it's wrong here
While this can add tags, it does not prevent creation of untagged resources; it's reactive.
- ✓
Use AWS CloudFormation templates that enforce tagging and use StackSets to deploy across accounts.
Why this is correct
CloudFormation can mandate tags during resource creation.
- ✓
Create a service control policy (SCP) that denies resource creation if the required tag is not present, for supported services.
Why this is correct
SCPs can deny actions that do not include specific tags.
- ✗
Enable AWS Cost Explorer to report on untagged resources.
Why it's wrong here
Reporting does not enforce tagging.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.