SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has multiple AWS accounts managed through AWS Organizations. The security team requires that all VPC flow logs be enabled in every account and region. What is the MOST efficient way to enforce this requirement?
⚠ Common exam trap
It's easy for candidates to confuse SCPs with resource policies, thinking they can enforce resource configurations, but SCPs only control IAM permissions and cannot directly enable features like VPC Flow Logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS CloudFormation StackSets to deploy a stack that enables VPC Flow Logs in every account and region.
AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple accounts and regions in a single operation, making it the most efficient way to enforce VPC Flow Logs across all accounts and regions. This approach ensures consistent configuration without requiring manual per-account or per-region setup, and it integrates with AWS Organizations for automated deployment to new accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a service control policy (SCP) that requires all VPCs to have flow logs enabled.
Why it's wrong here
SCPs cannot enable resources; they only control permissions.
- ✓
Use AWS CloudFormation StackSets to deploy a stack that enables VPC Flow Logs in every account and region.
Why this is correct
StackSets can deploy stacks across accounts and regions from a single admin account.
- ✗
Create an AWS Config rule in each account to check for flow logs and trigger an auto-remediation action.
Why it's wrong here
Config can detect but auto-remediation requires additional setup and may not be as efficient as StackSets.
- ✗
Use AWS Service Catalog to create a VPC product that includes flow logs, and require accounts to use it.
Why it's wrong here
Service Catalog does not enforce existing VPCs to have flow logs.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.