SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is using AWS Control Tower to manage multiple accounts. The security team wants to enforce that all accounts use a specific AWS Region for data storage. Which TWO steps should be taken to enforce this requirement?
⚠ Common exam trap
It's easy for candidates to confuse IAM policies (which are account-level and can be bypassed by administrators) with SCPs (which are organization-wide and cannot be overridden by account admins), leading them to select Option B instead of Option E.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Config rules to detect resources in unapproved Regions and trigger automatic remediation.
AWS Control Tower uses Service Control Policies (SCPs) to centrally enforce restrictions across all accounts in an organization. An SCP that denies all actions in non-compliant Regions, attached to the root or OUs, prevents users in those accounts from performing any action in unapproved Regions, even if they have IAM permissions. AWS Config rules can detect non-compliant resources and trigger automatic remediation (e.g., deleting or stopping resources), providing a detective and corrective layer. Together, these two steps enforce the requirement proactively (SCP) and reactively (Config).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Config rules to detect resources in unapproved Regions and trigger automatic remediation.
Why this is correct
AWS Config can detect non-compliant resources and trigger remediation to delete or flag them.
- ✗
Create an IAM policy that denies actions in unapproved Regions and attach it to all IAM roles.
Why it's wrong here
IAM policies are not as comprehensive as SCPs and can be overridden by resource policies.
- ✗
Configure AWS IAM Identity Center to restrict access to approved Regions.
Why it's wrong here
IAM Identity Center manages SSO and permissions sets but does not enforce Region restrictions.
- ✗
Enable AWS CloudTrail and set up an SNS notification for any API call in an unapproved Region.
Why it's wrong here
CloudTrail logs but does not prevent actions.
- ✓
Create a service control policy (SCP) that denies all actions in non-compliant Regions. Attach it to the root or OUs.
Why this is correct
SCPs provide preventive controls at the organization level.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.