SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is using AWS Organizations and wants to allow certain member accounts to create VPCs with specific CIDR ranges. Which mechanism should be used to enforce this restriction?
⚠ Common exam trap
Watch out — candidates often confuse IAM policies (which are account-specific and can be overridden by local admins) with SCPs (which are organization-wide guardrails that cannot be bypassed by member account administrators), leading them to choose Option B instead of the correct preventive control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SCPs with conditions on the ec2:CreateVpc action, specifying allowed CIDR ranges.
SCPs (Service Control Policies) are the correct mechanism because they allow you to centrally control the maximum available permissions for all IAM users and roles in member accounts within an AWS Organization. By attaching an SCP with a condition key like `ec2:CreateVpc` and specifying allowed CIDR ranges (e.g., using `StringEquals` or `IpAddress` condition operators), you can enforce that only VPCs with permitted CIDR blocks can be created across all affected accounts, regardless of local IAM policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config rules to automatically delete non-compliant VPCs.
Why it's wrong here
Config cannot prevent creation; it can only detect and remediate after.
- ✗
Use IAM policies with conditions on the ec2:CreateVpc action in each account.
Why it's wrong here
IAM policies are account-specific; SCPs are needed for organization-wide enforcement.
- ✗
Use AWS CloudTrail to monitor VPC creation and alert the security team.
Why it's wrong here
Monitoring is not enforcement.
- ✓
Use SCPs with conditions on the ec2:CreateVpc action, specifying allowed CIDR ranges.
Why this is correct
SCPs can deny VPC creation if the CIDR does not match allowed ranges.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.