SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is designing a multi-account strategy for development, testing, and production environments. They want to ensure that developers can deploy resources in development and testing accounts but not in production. Which TWO methods should the company use to achieve this? (Choose TWO.)
⚠ Common exam trap
Many exam-takers confuse detective controls (CloudTrail, Config) with preventive controls (SCPs, IAM policies), leading them to select options that only alert or audit rather than block the action entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an SCP to the production OU that denies all actions to non-approved IAM roles.
An SCP attached to the production OU can explicitly deny all actions to any IAM role that is not on an approved list, effectively preventing developers from deploying resources in production. This leverages AWS Organizations to enforce a preventive control at the account level, which cannot be overridden by IAM policies within the account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable AWS CloudTrail to monitor and alert on production changes.
Why it's wrong here
CloudTrail is logging, not enforcement.
- ✓
Apply an SCP to the production OU that denies all actions to non-approved IAM roles.
Why this is correct
SCPs can effectively block all actions from developers in production.
- ✗
Use resource tags to identify development and production resources and enforce policies via SCPs.
Why it's wrong here
SCPs cannot condition on resource tags; they condition on request parameters.
- ✓
Create IAM roles in production with no permissions, and allow only a central CI/CD role to assume a privileged role.
Why this is correct
This ensures developers cannot directly access production.
- ✗
Use AWS Config rules to detect unauthorized deployments in production.
Why it's wrong here
Config rules are detective, not preventive.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.