SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is adopting AWS Organizations and wants a baseline set of IAM roles, a standard VPC, and a security agent deployed automatically into every new account the moment it is created. The operations team does not want to run scripts manually after each account creation. Which AWS service should they use to meet this requirement?
⚠ Common exam trap
The trap here is assuming AWS Config conformance packs or Service Catalog deploy resources, when they only evaluate compliance or offer on-demand products.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudFormation StackSets with automatic deployment enabled for the organization.
AWS CloudFormation StackSets is designed for multi-account, multi-Region provisioning from a central administrator account. Enabling automatic deployment ties stack deployment to organization membership, so each newly created account automatically receives the baseline IAM roles, VPC, and security agent. This removes the need for manual or scripted post-creation steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Control Tower Account Factory for Terraform pipelines triggered per account.
Why it's wrong here
Account Factory for Terraform can customize accounts, but it introduces a Terraform pipeline to build and maintain, and it is not the simplest native mechanism for pushing a CloudFormation baseline. The requirement is met more directly by StackSets with automatic deployment, without an additional toolchain.
- ✓
AWS CloudFormation StackSets with automatic deployment enabled for the organization.
Why this is correct
StackSets deploy a CloudFormation template to many accounts and Regions from a single administration account, and with automatic deployment enabled, new accounts joining the organization receive the baseline stacks without manual intervention. It is the standard mechanism for provisioning consistent resources such as roles, VPCs, and agents across an organization.
- ✗
AWS Service Catalog portfolios shared with each organizational unit.
Why it's wrong here
Service Catalog lets users launch approved products on demand, but it does not automatically push resources into accounts when they are created. Someone must still select and provision each product, so it does not satisfy the requirement for hands-off baseline deployment to every new account.
- ✗
AWS Config conformance packs applied at the organization level.
Why it's wrong here
Conformance packs evaluate resource configuration against rules and report compliance; they do not create or deploy the IAM roles, VPC, or agent. Using them alone would detect drift after the fact rather than establish the baseline automatically in newly created accounts.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.