SAP-C02 AWS Control Tower Practice Question
A company has multiple AWS accounts managed via AWS Control Tower. The DevOps team wants to deploy a shared CI/CD pipeline that can deploy applications across all accounts. The pipeline must use the same source repository and artifact store. What is the MOST secure and scalable approach?
⚠ Common exam trap
Candidates may think that both A and C are correct, but the question asks for the 'most secure and scalable' approach. Option A explicitly centralizes the pipeline in a dedicated account, which is superior for governance and scalability in a Control Tower setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the pipeline in a central DevOps account. Use cross-account IAM roles to deploy to target accounts.
The most secure and scalable approach is to deploy the CI/CD pipeline in a central DevOps account and use cross-account IAM roles to deploy to target accounts. This centralizes management, simplifies governance, follows least privilege, and scales easily as new accounts are added. Option C, while technically possible, does not necessarily centralize the pipeline in a dedicated account, which can lead to governance challenges and increased complexity. Therefore, only Option A fully meets the requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy the pipeline in a central DevOps account. Use cross-account IAM roles to deploy to target accounts.
Why this is correct
Correct. A central DevOps account with cross-account IAM roles aligns with AWS best practices for multi-account environments, especially with Control Tower, providing centralized management and security.
- ✗
Create a separate pipeline in each account using the same source repository.
Why it's wrong here
Duplicating pipelines increases maintenance overhead and does not centralize management.
- ✗
Use AWS CodePipeline with cross-account actions by assuming IAM roles in each target account.
Why it's wrong here
Incorrect. Although cross-account actions via IAM roles are possible, this approach does not inherently centralize the pipeline, potentially complicating governance and auditing. It is less secure and scalable than Option A.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.