SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is migrating to AWS and plans to use a multi-account strategy. The management account will be used solely for administrative purposes. Which best practice should be followed when setting up AWS Organizations?
⚠ Common exam trap
Watch out — candidates often confuse the management account's billing role with a permission to host workloads, or they assume that central management requires enabling all services in the management account, when in fact the management account should be kept as a lightweight, resource-free administrative container.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict access to the management account and use it only for organization management tasks.
The management account in AWS Organizations should be strictly restricted and used only for organization-wide administrative tasks, such as managing member accounts, applying service control policies (SCPs), and consolidating billing. This follows the AWS Well-Architected Framework's security pillar, which recommends isolating the management account from any workload or resource deployment to minimize the blast radius of a potential compromise. Using the management account for anything other than organization management violates the principle of least privilege and increases security risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable all AWS services in the management account to centrally manage them.
Why it's wrong here
Enabling all services in the management account expands its attack surface and violates the practice of keeping it minimal, since it should hold only billing and organisation-level controls. It tempts because centralised service management sounds administrative, but that belongs in dedicated member accounts or delegated administrator accounts.
- ✗
Use the management account as the payer account and also host production workloads.
Why it's wrong here
Running production workloads in the management account violates AWS guidance that it hold only administrative and billing responsibilities, since a compromise there endangers the whole organisation. It tempts because the payer account already exists, yet production belongs in dedicated member accounts with separate guardrails.
- ✓
Restrict access to the management account and use it only for organization management tasks.
Why this is correct
The management account holds root-level control over every member account, so credentials there grant sweeping privileges. Restricting access and limiting its use to organisation management tasks satisfies the stem's requirement that it serve solely administrative purposes, reducing blast radius if compromised.
- ✗
Use the management account for development environments to avoid creating additional accounts.
Why it's wrong here
Hosting development workloads in the management account breaches the principle that it serves only administrative and billing functions, exposing organisation-wide controls to workload risk. It tempts as a shortcut to avoid creating accounts, but development environments belong in separate member accounts under an organisational unit.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 984 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.