SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is migrating to a multi-account AWS environment using AWS Control Tower. The security team must ensure that all accounts have AWS Config enabled and that logs are delivered to a central S3 bucket. Which THREE steps should the security team take?
⚠ Common exam trap
A common mix-up: candidates think they need to create IAM roles in each account for cross-account logging, but AWS Config's native cross-account delivery only requires a properly configured S3 bucket policy and does not rely on IAM roles in the member accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an SCP to prevent disabling of AWS Config in any account.
AWS Control Tower uses Service Control Policies (SCPs) to enforce guardrails. An SCP can be applied to the root or OUs to prevent any account from disabling AWS Config, ensuring compliance across the multi-account environment without requiring per-account manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually create an S3 bucket in each account to store Config logs.
Why it's wrong here
Centralized logging requires a single bucket; per-account buckets would defeat centralization.
- ✓
Use an SCP to prevent disabling of AWS Config in any account.
Why this is correct
SCPs can deny actions that disable Config.
- ✓
Configure the central S3 bucket policy to allow cross-account log delivery from all accounts in the organization.
Why this is correct
The bucket policy must grant write access to AWS Config service principal from all accounts.
- ✓
Enable AWS Config in the management account and use Control Tower's account factory to propagate the configuration to all accounts.
Why this is correct
Control Tower's account factory can automatically enable Config.
- ✗
Create an IAM role in each account to allow the management account to access Config logs.
Why it's wrong here
The central bucket policy can grant access without per-account roles.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have a specific AWS Config rule enabled and that any drift is automatically remediated. Which approach should be used?
medium- A.Use EC2 Auto Scaling to apply the Config rule to all accounts.
- ✓ B.Use AWS Control Tower lifecycle events and customizations to deploy the Config rule and set up automatic remediation.
- C.Use AWS CloudTrail to monitor for accounts without the Config rule and trigger a Lambda function to add it.
- D.Use AWS Config to create a conformance pack that applies the rule, and use an SCP to require it.
Why B: AWS Control Tower provides lifecycle events and customizations (via AWS Control Tower Lifecycle Events and Customizations for AWS Control Tower) that allow you to automatically deploy and remediate AWS Config rules across all accounts in the organization. This approach ensures that the Config rule is applied consistently when new accounts are created or when drift is detected, meeting the security team's requirement for automatic remediation without manual intervention.
Variation 2. A company uses AWS Organizations with a dedicated security account. They want to centralize the management of AWS Config rules and ensure that all accounts are compliant with the same set of rules. Which THREE steps should they take?
hard- A.Apply a service control policy (SCP) that requires AWS Config to be enabled.
- ✓ B.Create an AWS Config aggregator in the security account to view compliance status across accounts.
- ✓ C.Use AWS CloudFormation StackSets to deploy the desired AWS Config rules to all accounts.
- ✓ D.Enable AWS Config in all accounts across the organization.
- E.Use AWS CloudTrail to monitor compliance status.
Why B: An AWS Config aggregator in the security account collects compliance data from all member accounts, providing a centralized view of rule compliance across the organization. This enables the security team to monitor and audit compliance without logging into each account individually.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.