SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is using AWS Organizations with all features enabled. They want to apply a service control policy (SCP) that denies the ability to delete AWS KMS keys across all member accounts, but they need to allow a specific break-glass role in the management account to delete keys in case of emergency. Which statement is true regarding SCP enforcement in this scenario?
⚠ Common exam trap
The trap here is thinking that SCPs apply to the management account or that they can be overridden by IAM policies, when in fact SCPs do not affect the management account and always take precedence over IAM policies in member accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SCPs apply to all principals in member accounts, including the root user, but do not apply to the management account, so the break-glass role in the management account is unaffected.
SCPs are guardrails that apply to all principals in member accounts, including the root user, but they are not evaluated for the management account. Therefore, a role in the management account can perform actions denied by an SCP attached to member accounts. This allows the break-glass role to delete KMS keys without needing an exemption in the SCP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SCPs apply to all principals in member accounts, including the root user, but do not apply to the management account, so the break-glass role in the management account is unaffected.
Why this is correct
SCPs are applied to member accounts and affect all principals, including the root user, but they do not apply to the management account. Therefore, a break-glass role in the management account is not restricted by the SCP, allowing key deletion as intended. This matches the requirement.
- ✗
SCPs apply to all accounts in the organization, including the management account, so the break-glass role must be explicitly exempted in the SCP.
Why it's wrong here
SCPs do not apply to the management account. Therefore, no exemption is needed for the break-glass role in the management account. This statement is incorrect because it misstates the scope of SCPs, which are not evaluated for the management account.
- ✗
SCPs apply only to IAM users, not to IAM roles, so the break-glass role is unaffected regardless of which account it is in.
Why it's wrong here
SCPs apply to all principals, including IAM roles and the root user, in member accounts. This statement is incorrect because it falsely claims SCPs do not apply to roles. The break-glass role in the management account is unaffected for a different reason: SCPs do not apply to the management account.
- ✗
SCPs apply to member accounts but can be overridden by an IAM policy in the member account that allows kms:ScheduleKeyDeletion.
Why it's wrong here
SCPs set the maximum permissions for principals in member accounts. An IAM policy cannot override an SCP deny. If an SCP denies an action, no IAM policy in the member account can allow it. This statement is incorrect because it misunderstands the precedence of SCPs over IAM policies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.